diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 6921b57b15..723d827b23 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20650,11 +20650,6 @@ "redirect_url": "/windows/security", "redirect_document_id": false }, - { - "source_path": "windows/security/threat-protection/mbsa-removal-and-guidance.md", - "redirect_url": "/windows/security", - "redirect_document_id": false - }, { "source_path": "windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md", "redirect_url": "/windows/security", @@ -20735,10 +20730,20 @@ "redirect_url": "https://aka.ms/AzureCodeSigning", "redirect_document_id": false }, + { + "source_path": "windows/deployment/update/quality-updates.md", + "redirect_url": "/windows/deployment/update/release-cycle", + "redirect_document_id": false + }, { "source_path": "windows/deployment/windows-autopatch/references/windows-autopatch-privacy.md", "redirect_url": "/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy", "redirect_document_id": true + }, + { + "source_path": "store-for-business/sign-up-microsoft-store-for-business.md", + "redirect_url": "/microsoft-store", + "redirect_document_id": false } ] -} \ No newline at end of file +} diff --git a/education/docfx.json b/education/docfx.json index 8662cf333f..9297b1ed0d 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -67,6 +67,15 @@ "v-stsavell" ] }, + "fileMetadata": { + "appliesto":{ + "windows/**/*.md": [ + "✅ Windows 11", + "✅ Windows 11 SE", + "✅ Windows 10" + ] + } + }, "externalReference": [], "template": "op.html", "dest": "education", diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index c6fc526cd0..adc2f3d815 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -15,7 +15,7 @@ ms.collection: IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen anytime and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state. -To enable Autopilot Reset in Windows 10, version 1709 (Fall Creators Update), you must: +To enable Autopilot Reset you must: 1. [Enable the policy for the feature](#enable-autopilot-reset) 2. [Trigger a reset for each device](#trigger-autopilot-reset) diff --git a/education/windows/change-home-to-edu.md b/education/windows/change-home-to-edu.md index f92de780a3..df5e41eb07 100644 --- a/education/windows/change-home-to-edu.md +++ b/education/windows/change-home-to-edu.md @@ -10,8 +10,6 @@ manager: jeffbu ms.collection: - tier3 - education -appliesto: - - ✅ Windows 10 and later --- # Upgrade Windows Home to Windows Education on student-owned devices diff --git a/education/windows/configure-aad-google-trust.md b/education/windows/configure-aad-google-trust.md index 2afa86f4c1..d96b7414ca 100644 --- a/education/windows/configure-aad-google-trust.md +++ b/education/windows/configure-aad-google-trust.md @@ -1,8 +1,9 @@ --- title: Configure federation between Google Workspace and Azure AD description: Configuration of a federated trust between Google Workspace and Azure AD, with Google Workspace acting as an identity provider (IdP) for Azure AD. -ms.date: 02/24/2023 +ms.date: 04/04/2023 ms.topic: how-to +appliesto: --- # Configure federation between Google Workspace and Azure AD @@ -71,51 +72,56 @@ The configuration of Azure AD consists of changing the authentication method for Using the **IdP metadata** XML file downloaded from Google Workspace, modify the *$DomainName* variable of the following script to match your environment, and then run it in an elevated PowerShell session. When prompted to authenticate to Azure AD, use the credentials of an account with the *Global Administrator* role. ```powershell -Install-Module -Name MSOnline -Import-Module MSOnline +Install-Module Microsoft.Graph +Import-Module Microsoft.Graph -$DomainName = "" +$domainId = "" $xml = [Xml](Get-Content GoogleIDPMetadata.xml) $cert = -join $xml.EntityDescriptor.IDPSSODescriptor.KeyDescriptor.KeyInfo.X509Data.X509Certificate.Split() $issuerUri = $xml.EntityDescriptor.entityID -$logOnUri = $xml.EntityDescriptor.IDPSSODescriptor.SingleSignOnService | ? { $_.Binding.Contains('Redirect') } | % { $_.Location } -$LogOffUri = "https://accounts.google.com/logout" -$brand = "Google Workspace Identity" -Connect-MsolService -$DomainAuthParams = @{ - DomainName = $DomainName - Authentication = "Federated" - IssuerUri = $issuerUri - FederationBrandName = $brand - ActiveLogOnUri = $logOnUri - PassiveLogOnUri = $logOnUri - LogOffUri = $LogOffUri - SigningCertificate = $cert - PreferredAuthenticationProtocol = "SAMLP" +$signinUri = $xml.EntityDescriptor.IDPSSODescriptor.SingleSignOnService | ? { $_.Binding.Contains('Redirect') } | % { $_.Location } +$signoutUri = "https://accounts.google.com/logout" +$displayName = "Google Workspace Identity" +Connect-MGGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All" + +$domainAuthParams = @{ + DomainId = $domainId + IssuerUri = $issuerUri + DisplayName = $displayName + ActiveSignInUri = $signinUri + PassiveSignInUri = $signinUri + SignOutUri = $signoutUri + SigningCertificate = $cert + PreferredAuthenticationProtocol = "saml" + federatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp" } -Set-MsolDomainAuthentication @DomainAuthParams + +New-MgDomainFederationConfiguration @domainAuthParams ``` To verify that the configuration is correct, you can use the following PowerShell command: ```powershell -Get-MsolDomainFederationSettings -DomainName $DomainName +Get-MgDomainFederationConfiguration -DomainId $domainId |fl ``` ```output -ActiveLogOnUri : https://accounts.google.com/o/saml2/idp? -DefaultInteractiveAuthenticationMethod : -FederationBrandName : Google Workspace Identity -IssuerUri : https://accounts.google.com/o/saml2?idpid= -LogOffUri : https://accounts.google.com/logout -MetadataExchangeUri : -NextSigningCertificate : -OpenIdConnectDiscoveryEndpoint : -PassiveLogOnUri : https://accounts.google.com/o/saml2/idp?idpid= -SigningCertificate : -SupportsMfa : +ActiveSignInUri : https://accounts.google.com/o/saml2/idp?idpid= +DisplayName : Google Workspace Identity +FederatedIdpMfaBehavior : acceptIfMfaDoneByFederatedIdp +Id : 3f600dce-ab37-4798-9341-ffd34b147f70 +IsSignedAuthenticationRequestRequired : +IssuerUri : https://accounts.google.com/o/saml2?idpid= +MetadataExchangeUri : +NextSigningCertificate : +PassiveSignInUri : https://accounts.google.com/o/saml2/idp?idpid= +PreferredAuthenticationProtocol : saml +PromptLoginBehavior : +SignOutUri : https://accounts.google.com/logout +SigningCertificate : +AdditionalProperties : {} ``` ## Verify federated authentication between Google Workspace and Azure AD diff --git a/education/windows/edu-take-a-test-kiosk-mode.md b/education/windows/edu-take-a-test-kiosk-mode.md index 5b6c073fcd..10c843fc0b 100644 --- a/education/windows/edu-take-a-test-kiosk-mode.md +++ b/education/windows/edu-take-a-test-kiosk-mode.md @@ -3,8 +3,6 @@ title: Configure Take a Test in kiosk mode description: Learn how to configure Windows to execute the Take a Test app in kiosk mode, using Intune and provisioning packages. ms.date: 09/30/2022 ms.topic: how-to -appliesto: - - ✅ Windows 10 and later --- # Configure Take a Test in kiosk mode diff --git a/education/windows/edu-themes.md b/education/windows/edu-themes.md index f76298ef68..bd941025f7 100644 --- a/education/windows/edu-themes.md +++ b/education/windows/edu-themes.md @@ -5,6 +5,7 @@ ms.date: 09/15/2022 ms.topic: how-to appliesto: - ✅ Windows 11 + - ✅ Windows 11 SE --- # Configure education themes for Windows 11 diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md index 4799a4d3cc..7eccc722a0 100644 --- a/education/windows/federated-sign-in.md +++ b/education/windows/federated-sign-in.md @@ -1,10 +1,11 @@ --- title: Configure federated sign-in for Windows devices description: Description of federated sign-in feature for the Education SKUs of Windows 11 and how to configure it via Intune or provisioning packages. -ms.date: 03/15/2023 +ms.date: 04/04/2023 ms.topic: how-to appliesto: - ✅ Windows 11 + - ✅ Windows 11 SE ms.collection: - highpri - tier1 diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index ca7f319eb1..3fb0972c89 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -3,8 +3,6 @@ title: Get and deploy Minecraft Education description: Learn how to obtain and distribute Minecraft Education to Windows devices. ms.topic: how-to ms.date: 02/23/2023 -appliesto: - - ✅ Windows 10 and later ms.collection: - highpri - education diff --git a/education/windows/includes/intune-custom-settings-1.md b/education/windows/includes/intune-custom-settings-1.md index 5be4cd1204..d911751e75 100644 --- a/education/windows/includes/intune-custom-settings-1.md +++ b/education/windows/includes/intune-custom-settings-1.md @@ -1,6 +1,4 @@ --- -author: paolomatarazzo -ms.author: paoloma ms.date: 02/22/2022 ms.topic: include --- diff --git a/education/windows/includes/intune-custom-settings-2.md b/education/windows/includes/intune-custom-settings-2.md index d623773324..1a601acaa7 100644 --- a/education/windows/includes/intune-custom-settings-2.md +++ b/education/windows/includes/intune-custom-settings-2.md @@ -1,6 +1,4 @@ --- -author: paolomatarazzo -ms.author: paoloma ms.date: 11/08/2022 ms.topic: include --- diff --git a/education/windows/includes/intune-custom-settings-info.md b/education/windows/includes/intune-custom-settings-info.md index a7376ee4ff..8ff9da4294 100644 --- a/education/windows/includes/intune-custom-settings-info.md +++ b/education/windows/includes/intune-custom-settings-info.md @@ -1,6 +1,4 @@ --- -author: paolomatarazzo -ms.author: paoloma ms.date: 11/08/2022 ms.topic: include --- diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md index 2b46d073f5..97988171bf 100644 --- a/education/windows/set-up-school-pcs-whats-new.md +++ b/education/windows/set-up-school-pcs-whats-new.md @@ -3,8 +3,6 @@ title: What's new in the Windows Set up School PCs app description: Find out about app updates and new features in Set up School PCs. ms.topic: whats-new ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 and later --- # What's new in Set up School PCs diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index daab02821c..da1540090d 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -1,10 +1,8 @@ --- title: Take a Test app technical reference description: List of policies and settings applied by the Take a Test app. -ms.date: 09/30/2022 +ms.date: 03/31/2023 ms.topic: reference -appliesto: - - ✅ Windows 10 and later --- # Take a Test app technical reference diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md index 1eea480188..2533467fca 100644 --- a/education/windows/take-tests-in-windows.md +++ b/education/windows/take-tests-in-windows.md @@ -1,10 +1,8 @@ --- title: Take tests and assessments in Windows description: Learn about the built-in Take a Test app for Windows and how to use it. -ms.date: 09/30/2022 +ms.date: 03/31/2023 ms.topic: conceptual -appliesto: - - ✅ Windows 10 and later --- # Take tests and assessments in Windows diff --git a/education/windows/tutorial-school-deployment/configure-device-apps.md b/education/windows/tutorial-school-deployment/configure-device-apps.md index 9d2ad74149..ef1e695396 100644 --- a/education/windows/tutorial-school-deployment/configure-device-apps.md +++ b/education/windows/tutorial-school-deployment/configure-device-apps.md @@ -3,8 +3,6 @@ title: Configure applications with Microsoft Intune description: Learn how to configure applications with Microsoft Intune in preparation for device deployment. ms.date: 03/08/2023 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Configure applications with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/configure-device-settings.md b/education/windows/tutorial-school-deployment/configure-device-settings.md index 5b63ea0b0b..f9d1d2046f 100644 --- a/education/windows/tutorial-school-deployment/configure-device-settings.md +++ b/education/windows/tutorial-school-deployment/configure-device-settings.md @@ -3,8 +3,6 @@ title: Configure and secure devices with Microsoft Intune description: Learn how to configure policies with Microsoft Intune in preparation for device deployment. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Configure and secure devices with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/configure-devices-overview.md b/education/windows/tutorial-school-deployment/configure-devices-overview.md index 60bc205647..075d9fe6d3 100644 --- a/education/windows/tutorial-school-deployment/configure-devices-overview.md +++ b/education/windows/tutorial-school-deployment/configure-devices-overview.md @@ -3,8 +3,6 @@ title: Configure devices with Microsoft Intune description: Learn how to configure policies and applications in preparation for device deployment. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Configure settings and applications with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/enroll-aadj.md b/education/windows/tutorial-school-deployment/enroll-aadj.md index ddcb5d2bb8..1dc7d9beeb 100644 --- a/education/windows/tutorial-school-deployment/enroll-aadj.md +++ b/education/windows/tutorial-school-deployment/enroll-aadj.md @@ -3,8 +3,6 @@ title: Enrollment in Intune with standard out-of-box experience (OOBE) description: Learn how to join devices to Azure AD from OOBE and automatically get them enrolled in Intune. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Automatic Intune enrollment via Azure AD join diff --git a/education/windows/tutorial-school-deployment/enroll-autopilot.md b/education/windows/tutorial-school-deployment/enroll-autopilot.md index 3515c8e99d..e8070b995b 100644 --- a/education/windows/tutorial-school-deployment/enroll-autopilot.md +++ b/education/windows/tutorial-school-deployment/enroll-autopilot.md @@ -3,8 +3,6 @@ title: Enrollment in Intune with Windows Autopilot description: Learn how to join Azure AD and enroll in Intune using Windows Autopilot. ms.date: 03/08/2023 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Windows Autopilot diff --git a/education/windows/tutorial-school-deployment/enroll-overview.md b/education/windows/tutorial-school-deployment/enroll-overview.md index d816ed1b94..6537b7ea3a 100644 --- a/education/windows/tutorial-school-deployment/enroll-overview.md +++ b/education/windows/tutorial-school-deployment/enroll-overview.md @@ -3,8 +3,6 @@ title: Device enrollment overview description: Learn about the different options to enroll Windows devices in Microsoft Intune ms.date: 08/31/2022 ms.topic: overview -appliesto: - - ✅ Windows 10 and later --- # Device enrollment overview diff --git a/education/windows/tutorial-school-deployment/enroll-package.md b/education/windows/tutorial-school-deployment/enroll-package.md index 9f96234636..e73ef21957 100644 --- a/education/windows/tutorial-school-deployment/enroll-package.md +++ b/education/windows/tutorial-school-deployment/enroll-package.md @@ -3,8 +3,6 @@ title: Enrollment of Windows devices with provisioning packages description: Learn about how to enroll Windows devices with provisioning packages using SUSPCs and Windows Configuration Designer. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Enrollment with provisioning packages diff --git a/education/windows/tutorial-school-deployment/index.md b/education/windows/tutorial-school-deployment/index.md index a23afe72b0..b91d83d780 100644 --- a/education/windows/tutorial-school-deployment/index.md +++ b/education/windows/tutorial-school-deployment/index.md @@ -3,8 +3,6 @@ title: Introduction to the tutorial deploy and manage Windows devices in a schoo description: Introduction to deployment and management of Windows devices in education environments. ms.date: 08/31/2022 ms.topic: conceptual -appliesto: - - ✅ Windows 10 and later --- # Tutorial: deploy and manage Windows devices in a school diff --git a/education/windows/tutorial-school-deployment/manage-overview.md b/education/windows/tutorial-school-deployment/manage-overview.md index 00559d4384..ff0997fad9 100644 --- a/education/windows/tutorial-school-deployment/manage-overview.md +++ b/education/windows/tutorial-school-deployment/manage-overview.md @@ -3,8 +3,6 @@ title: Manage devices with Microsoft Intune description: Overview of device management capabilities in Intune for Education, including remote actions, remote assistance and inventory/reporting. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Manage devices with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/reset-wipe.md b/education/windows/tutorial-school-deployment/reset-wipe.md index b9a1f80094..488d2513f1 100644 --- a/education/windows/tutorial-school-deployment/reset-wipe.md +++ b/education/windows/tutorial-school-deployment/reset-wipe.md @@ -3,8 +3,6 @@ title: Reset and wipe Windows devices description: Learn about the reset and wipe options for Windows devices using Intune for Education, including scenarios when to delete devices. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Device reset options diff --git a/education/windows/tutorial-school-deployment/set-up-azure-ad.md b/education/windows/tutorial-school-deployment/set-up-azure-ad.md index 899b8298dd..6aaea36211 100644 --- a/education/windows/tutorial-school-deployment/set-up-azure-ad.md +++ b/education/windows/tutorial-school-deployment/set-up-azure-ad.md @@ -3,6 +3,7 @@ title: Set up Azure Active Directory description: Learn how to create and prepare your Azure AD tenant for an education environment. ms.date: 08/31/2022 ms.topic: tutorial +appliesto: --- # Set up Azure Active Directory diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md index 8d1b84254e..f55a5262c3 100644 --- a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md +++ b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md @@ -3,6 +3,7 @@ title: Set up device management description: Learn how to configure the Intune service and set up the environment for education. ms.date: 08/31/2022 ms.topic: tutorial +appliesto: --- # Set up Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/troubleshoot-overview.md b/education/windows/tutorial-school-deployment/troubleshoot-overview.md index a58a7f2d9a..5e27915802 100644 --- a/education/windows/tutorial-school-deployment/troubleshoot-overview.md +++ b/education/windows/tutorial-school-deployment/troubleshoot-overview.md @@ -3,8 +3,6 @@ title: Troubleshoot Windows devices description: Learn how to troubleshoot Windows devices from Intune and contact Microsoft Support for issues related to Intune and other services. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Troubleshoot Windows devices diff --git a/includes/ai-disclaimer-generic.md b/includes/ai-disclaimer-generic.md new file mode 100644 index 0000000000..0e190e0e38 --- /dev/null +++ b/includes/ai-disclaimer-generic.md @@ -0,0 +1,10 @@ +--- +author: aczechowski +ms.author: aaroncz +ms.date: 03/31/2023 +ms.topic: include +ms.prod: windows-client +--- + +> [!NOTE] +> This article was partially created with the help of artificial intelligence. Before publishing, an author reviewed and revised the content as needed. For more information, see [Our principles for using AI-generated content in Microsoft Learn](/azure/principles-for-ai-generated-content). diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index e4d5e9ef2e..82df7d4d32 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -16,7 +16,7 @@ ms.date: 07/21/2021 # Acquire apps in Microsoft Store for Business and Education > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). > [!IMPORTANT] > Starting on April 14th, 2021, only free apps will be available in Microsoft Store for Business and Education. For more information, see [Microsoft Store for Business and Education](index.md). diff --git a/store-for-business/add-profile-to-devices.md b/store-for-business/add-profile-to-devices.md index d2cf5a3906..18af34875e 100644 --- a/store-for-business/add-profile-to-devices.md +++ b/store-for-business/add-profile-to-devices.md @@ -19,7 +19,7 @@ ms.localizationpriority: medium - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Windows Autopilot simplifies device set up for IT Admins. For an overview of benefits, scenarios, and prerequisites, see [Overview of Windows Autopilot](/windows/deployment/windows-autopilot/windows-10-autopilot). diff --git a/store-for-business/app-inventory-management-microsoft-store-for-business.md b/store-for-business/app-inventory-management-microsoft-store-for-business.md index 926aa750f9..2d0ea132bc 100644 --- a/store-for-business/app-inventory-management-microsoft-store-for-business.md +++ b/store-for-business/app-inventory-management-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: App inventory management for Microsoft Store for Business and Microsoft S description: You can manage all apps that you've acquired on your Apps & Software page. ms.assetid: 44211937-801B-4B85-8810-9CA055CDB1B2 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.date: 07/21/2021 --- @@ -20,7 +20,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). You can manage all apps that you've acquired on your **Apps & software** page. This page shows all of the content you've acquired, including apps that from Microsoft Store, and line-of-business (LOB) apps that you've accepted into your inventory. After LOB apps are submitted to your organization, you'll see a notification on your **Apps & software** page. On the **New LOB apps** tab, you can accept, or reject the LOB apps. For more information on LOB apps, see [Working with line-of-business apps](working-with-line-of-business-apps.md). The inventory page includes apps acquired by all people in your organization with the Store for Business Admin role. diff --git a/store-for-business/apps-in-microsoft-store-for-business.md b/store-for-business/apps-in-microsoft-store-for-business.md index 661d98861a..4fc8e74159 100644 --- a/store-for-business/apps-in-microsoft-store-for-business.md +++ b/store-for-business/apps-in-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: Apps in Microsoft Store for Business and Education (Windows 10) description: Microsoft Store for Business has thousands of apps from many different categories. ms.assetid: CC5641DA-3CEA-4950-AD81-1AF1AE876926 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Microsoft Store for Business and Education has thousands of apps from many different categories. diff --git a/store-for-business/assign-apps-to-employees.md b/store-for-business/assign-apps-to-employees.md index c296c8f37d..eda2a2947c 100644 --- a/store-for-business/assign-apps-to-employees.md +++ b/store-for-business/assign-apps-to-employees.md @@ -3,12 +3,12 @@ title: Assign apps to employees (Windows 10) description: Administrators can assign online-licensed apps to employees and students in their organization. ms.assetid: A0DF4EC2-BE33-41E1-8832-DBB0EBECA31A ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Admins, Purchasers, and Basic Purchasers can assign online-licensed apps to employees or students in their organization. diff --git a/store-for-business/billing-payments-overview.md b/store-for-business/billing-payments-overview.md index 5205cbadba..20e16f502d 100644 --- a/store-for-business/billing-payments-overview.md +++ b/store-for-business/billing-payments-overview.md @@ -5,19 +5,19 @@ keywords: billing, payment methods, invoices, credit card, debit card ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # Billing and payments > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Access invoices and managed your payment methods. diff --git a/store-for-business/billing-profile.md b/store-for-business/billing-profile.md index 82581997ea..4e3c7fe14e 100644 --- a/store-for-business/billing-profile.md +++ b/store-for-business/billing-profile.md @@ -5,19 +5,19 @@ keywords: billing profile, invoices, charges, managed charges ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: trudyha -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # Understand billing profiles > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). For commercial customers purchasing software or hardware products from Microsoft using a Microsoft customer agreement, billing profiles let you customize what products are included on your invoice, and how you pay your invoices. diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md index e500732cc9..a791f8acf8 100644 --- a/store-for-business/billing-understand-your-invoice-msfb.md +++ b/store-for-business/billing-understand-your-invoice-msfb.md @@ -4,19 +4,19 @@ description: Learn how to read and understand your MCA bill ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: trudyha -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # Understand your Microsoft Customer Agreement invoice > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). The invoice provides a summary of your charges and provides instructions for payment. It's available for download in the Portable Document Format (.pdf) for commercial customers from Microsoft Store for Business [Microsoft Store for Business - Invoice](https://businessstore.microsoft.com/manage/payments-billing/invoices) or can be sent via email. This article applies to invoices generated for a Microsoft Customer Agreement billing account. Check if you have a [Microsoft Customer Agreement](https://businessstore.microsoft.com/manage/organization/agreements). diff --git a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md index 190b9be3e6..5455d2c9bd 100644 --- a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md +++ b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: Configure an MDM provider (Windows 10) description: For companies or organizations using mobile device management (MDM) tools, those tools can synchronize with Microsoft Store for Business inventory to manage apps with offline licenses. ms.assetid: B3A45C8C-A96C-4254-9659-A9B364784673 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). For companies or organizations using mobile device management (MDM) tools, those tools can synchronize with Microsoft Store for Business inventory to manage apps with offline licenses. Store for Business management tool services work with your third-party management tool to manage content. diff --git a/store-for-business/distribute-apps-from-your-private-store.md b/store-for-business/distribute-apps-from-your-private-store.md index b443e48e71..1e190dcb69 100644 --- a/store-for-business/distribute-apps-from-your-private-store.md +++ b/store-for-business/distribute-apps-from-your-private-store.md @@ -3,12 +3,12 @@ title: Distribute apps using your private store (Windows 10) description: The private store is a feature in Microsoft Store for Business and Microsoft Store for Education that organizations receive during the signup process. ms.assetid: C4644035-845C-4C84-87F0-D87EA8F5BA19 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). The private store is a feature in Microsoft Store for Business and Education that organizations receive during the signup process. When admins add apps to the private store, all employees in the organization can view and download the apps. Your private store is available as a tab in Microsoft Store app, and is usually named for your company or organization. Only apps with online licenses can be added to the private store. diff --git a/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md b/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md index 7f88c7212e..8433314401 100644 --- a/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md +++ b/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: Distribute apps to your employees from the Microsoft Store for Business a description: Distribute apps to your employees from Microsoft Store for Business or Microsoft Store for Education. You can assign apps to employees,or let employees install them from your private store. ms.assetid: E591497C-6DFA-49C1-8329-4670F2164E9E ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Distribute apps to your employees from Microsoft Store for Business and Microsoft Store for Education. You can assign apps to employees, or let employees install them from your private store. diff --git a/store-for-business/distribute-apps-with-management-tool.md b/store-for-business/distribute-apps-with-management-tool.md index 90e4939804..acc2c676ee 100644 --- a/store-for-business/distribute-apps-with-management-tool.md +++ b/store-for-business/distribute-apps-with-management-tool.md @@ -3,12 +3,12 @@ title: Distribute apps with a management tool (Windows 10) description: You can configure a mobile device management (MDM) tool to synchronize your Microsoft Store for Business or Microsoft Store for Education inventory. Microsoft Store management tool services work with MDM tools to manage content. ms.assetid: 006F5FB1-E688-4769-BD9A-CFA6F5829016 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). You can configure a mobile device management (MDM) tool to synchronize your Microsoft Store for Business or Microsoft Store for Education inventory. Microsoft Store management tool services work with MDM tools to manage content. diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md index 765f0b39ce..2087832b3c 100644 --- a/store-for-business/distribute-offline-apps.md +++ b/store-for-business/distribute-offline-apps.md @@ -3,12 +3,12 @@ title: Distribute offline apps (Windows 10) description: Offline licensing is a new licensing option for Windows 10. ms.assetid: 6B9F6876-AA66-4EE4-A448-1371511AC95E ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). > Offline licensing is a new licensing option for Windows 10 with Microsoft Store for Business and Microsoft Store for Education. With offline licenses, organizations can download apps and their licenses to deploy within their network, or on devices that are not connected to the Internet. ISVs or devs can opt-in their apps for offline licensing when they submit them to the Windows Dev Center. Only apps that are opted in to offline licensing will show that they are available for offline licensing in Microsoft Store for Business and Microsoft Store for Education. This model allows organizations to deploy apps when users or devices do not have connectivity to the Store. diff --git a/store-for-business/find-and-acquire-apps-overview.md b/store-for-business/find-and-acquire-apps-overview.md index ad4b5f621a..fddbd6d1a8 100644 --- a/store-for-business/find-and-acquire-apps-overview.md +++ b/store-for-business/find-and-acquire-apps-overview.md @@ -3,12 +3,12 @@ title: Find and acquire apps (Windows 10) description: Use the Microsoft Store for Business and Education to find apps for your organization. You can also work with developers to create line-of-business apps that are only available to your organization. ms.assetid: 274A5003-5F15-4635-BB8B-953953FD209A ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Use the Microsoft Store for Business and Education to find apps for your organization. You can also work with developers to create line-of-business apps that are only available to your organization. diff --git a/store-for-business/index.md b/store-for-business/index.md index 369336371c..ca868bf64c 100644 --- a/store-for-business/index.md +++ b/store-for-business/index.md @@ -20,7 +20,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Welcome to the Microsoft Store for Business and Education! You can use Microsoft Store to find, acquire, distribute, and manage apps for your organization or school. diff --git a/store-for-business/manage-access-to-private-store.md b/store-for-business/manage-access-to-private-store.md index 2b8c3e26f4..cbf743165b 100644 --- a/store-for-business/manage-access-to-private-store.md +++ b/store-for-business/manage-access-to-private-store.md @@ -3,12 +3,12 @@ title: Manage access to private store (Windows 10) description: You can manage access to your private store in Microsoft Store for Business and Microsoft Store for Education. ms.assetid: 4E00109C-2782-474D-98C0-02A05BE613A5 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.date: 07/21/2021 --- @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). You can manage access to your private store in Microsoft Store for Business and Microsoft Store for Education. diff --git a/store-for-business/manage-apps-microsoft-store-for-business-overview.md b/store-for-business/manage-apps-microsoft-store-for-business-overview.md index 706e1bc726..b8a4cd5717 100644 --- a/store-for-business/manage-apps-microsoft-store-for-business-overview.md +++ b/store-for-business/manage-apps-microsoft-store-for-business-overview.md @@ -3,12 +3,12 @@ title: Manage products and services in Microsoft Store for Business (Windows 10) description: Manage apps, software, devices, products and services in Microsoft Store for Business. ms.assetid: 2F65D4C3-B02C-41CC-92F0-5D9937228202 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Manage products and services in Microsoft Store for Business and Microsoft Store for Education. This includes apps, software, products, devices, and services available under **Products & services**. diff --git a/store-for-business/manage-orders-microsoft-store-for-business.md b/store-for-business/manage-orders-microsoft-store-for-business.md index dfc9b3d00d..39c2d0520f 100644 --- a/store-for-business/manage-orders-microsoft-store-for-business.md +++ b/store-for-business/manage-orders-microsoft-store-for-business.md @@ -4,19 +4,19 @@ description: You can view your order history with Microsoft Store for Business o ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # Manage app orders in Microsoft Store for Business and Education > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). After you've acquired apps, you can review order information and invoices on **Order history**. On this page, you can view invoices, and request refunds. diff --git a/store-for-business/manage-private-store-settings.md b/store-for-business/manage-private-store-settings.md index 218f2b5aac..9774d11faa 100644 --- a/store-for-business/manage-private-store-settings.md +++ b/store-for-business/manage-private-store-settings.md @@ -3,12 +3,12 @@ title: Manage private store settings (Windows 10) description: The private store is a feature in the Microsoft Store for Business and Microsoft Store for Education that organizations receive during the sign up process. ms.assetid: 2D501538-0C6E-4408-948A-2BF5B05F7A0C ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.date: 07/21/2021 ms.localizationpriority: medium @@ -21,7 +21,7 @@ ms.localizationpriority: medium - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). The private store is a feature in Microsoft Store for Business and Education that organizations receive during the sign up process. When admins add apps to the private store, all people in the organization can view and download the apps. Only online-licensed apps can be distributed from your private store. diff --git a/store-for-business/manage-settings-microsoft-store-for-business.md b/store-for-business/manage-settings-microsoft-store-for-business.md index e3d9147262..2de4be35a0 100644 --- a/store-for-business/manage-settings-microsoft-store-for-business.md +++ b/store-for-business/manage-settings-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: Manage settings for Microsoft Store for Business and Microsoft Store for description: You can add users and groups, as well as update some of the settings associated with the Azure Active Directory (AD) tenant. ms.assetid: E3283D77-4DB2-40A9-9479-DDBC33D5A895 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). You can add users and groups, as well as update some of the settings associated with the Azure Active Directory (AD) tenant. diff --git a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md index 36ec4938f9..37984bc540 100644 --- a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md +++ b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: Manage user accounts in Microsoft Store for Business and Microsoft Store description: Microsoft Store for Business and Microsoft Store for Education manages permissions with a set of roles. Currently, you can assign these roles to individuals in your organization, but not to groups. ms.assetid: 5E7FA071-CABD-4ACA-8AAE-F549EFCE922F ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Microsoft Store for Business and Education manages permissions with a set of roles. Currently, you can [assign these roles to individuals in your organization](roles-and-permissions-microsoft-store-for-business.md), but not to groups. diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md index 3318a1ca0c..f0412f4df6 100644 --- a/store-for-business/microsoft-store-for-business-education-powershell-module.md +++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md @@ -4,13 +4,13 @@ description: Preview version of PowerShell module ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # Microsoft Store for Business and Education PowerShell module - preview @@ -19,7 +19,7 @@ manager: dansimp - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Microsoft Store for Business and Education PowerShell module (preview) is now available on [PowerShell Gallery](https://go.microsoft.com/fwlink/?linkid=853459). diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md index a7009160fa..9fcfcf5343 100644 --- a/store-for-business/microsoft-store-for-business-overview.md +++ b/store-for-business/microsoft-store-for-business-overview.md @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). > [!IMPORTANT] > Starting on April 14th, 2021, only free apps will be available in Microsoft Store for Business and Education. For more information, see [Microsoft Store for Business and Education](index.md). diff --git a/store-for-business/notifications-microsoft-store-business.md b/store-for-business/notifications-microsoft-store-business.md index 264f2228e9..a24ce1c761 100644 --- a/store-for-business/notifications-microsoft-store-business.md +++ b/store-for-business/notifications-microsoft-store-business.md @@ -4,12 +4,12 @@ description: Notifications alert you to issues or outages with Microsoft Store f keywords: notifications, alerts ms.assetid: ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -23,7 +23,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Microsoft Store for Business and Microsoft Store for Education use a set of notifications to alert admins if there is an issue or outage with Microsoft Store. diff --git a/store-for-business/payment-methods.md b/store-for-business/payment-methods.md index b56a2ebe5e..385ad90405 100644 --- a/store-for-business/payment-methods.md +++ b/store-for-business/payment-methods.md @@ -5,19 +5,19 @@ keywords: payment method, credit card, debit card, add credit card, update payme ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: trudyha -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # Payment methods > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). You can purchase products and services from Microsoft Store for Business using your credit card. You can enter your credit card information on **Payment methods**, or when you purchase an app. We currently accept these credit cards: - VISA diff --git a/store-for-business/prerequisites-microsoft-store-for-business.md b/store-for-business/prerequisites-microsoft-store-for-business.md index 0dd6457beb..2590dfa2e5 100644 --- a/store-for-business/prerequisites-microsoft-store-for-business.md +++ b/store-for-business/prerequisites-microsoft-store-for-business.md @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). > [!IMPORTANT] > Starting on April 14th, 2021, only free apps will be available in Microsoft Store for Business and Education. For more information, see [Microsoft Store for Business and Education](index.md). diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index e1fd90b393..73feb2d130 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -4,18 +4,18 @@ description: Know the release history of Microsoft Store for Business and Micros ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # Microsoft Store for Business and Education release history > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Microsoft Store for Business and Education regularly releases new and improved features. Here's a summary of new or updated features in previous releases. diff --git a/store-for-business/roles-and-permissions-microsoft-store-for-business.md b/store-for-business/roles-and-permissions-microsoft-store-for-business.md index 1ca0ec4692..946185e95a 100644 --- a/store-for-business/roles-and-permissions-microsoft-store-for-business.md +++ b/store-for-business/roles-and-permissions-microsoft-store-for-business.md @@ -22,7 +22,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). > [!IMPORTANT] > Starting on April 14th, 2021, only free apps will be available in Microsoft Store for Business and Education. For more information, see [Microsoft Store for Business and Education](index.md). diff --git a/store-for-business/settings-reference-microsoft-store-for-business.md b/store-for-business/settings-reference-microsoft-store-for-business.md index f29dace9ef..ac0d610bae 100644 --- a/store-for-business/settings-reference-microsoft-store-for-business.md +++ b/store-for-business/settings-reference-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: Settings reference Microsoft Store for Business and Education (Windows 10 description: The Microsoft Store for Business and Education has a group of settings that admins use to manage the store. ms.assetid: 34F7FA2B-B848-454B-AC00-ECA49D87B678 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -17,7 +17,7 @@ ms.date: 07/21/2021 # Settings reference: Microsoft Store for Business and Education > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). The Microsoft Store for Business and Education has a group of settings that admins use to manage the store. diff --git a/store-for-business/sign-up-microsoft-store-for-business-overview.md b/store-for-business/sign-up-microsoft-store-for-business-overview.md index 4c4e855373..4f76aa0558 100644 --- a/store-for-business/sign-up-microsoft-store-for-business-overview.md +++ b/store-for-business/sign-up-microsoft-store-for-business-overview.md @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). IT admins can sign up for Microsoft Store for Business and Education, and get started working with apps. diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md index f9154689ca..aaca08aa79 100644 --- a/store-for-business/troubleshoot-microsoft-store-for-business.md +++ b/store-for-business/troubleshoot-microsoft-store-for-business.md @@ -3,12 +3,12 @@ title: Troubleshoot Microsoft Store for Business (Windows 10) description: Troubleshooting topics for Microsoft Store for Business. ms.assetid: 243755A3-9B20-4032-9A77-2207320A242A ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Troubleshooting topics for Microsoft Store for Business. diff --git a/store-for-business/update-microsoft-store-for-business-account-settings.md b/store-for-business/update-microsoft-store-for-business-account-settings.md index 78cd7532b8..f5df17e875 100644 --- a/store-for-business/update-microsoft-store-for-business-account-settings.md +++ b/store-for-business/update-microsoft-store-for-business-account-settings.md @@ -5,19 +5,18 @@ keywords: billing accounts, organization info ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 -ms.reviewer: -manager: dansimp --- # Update Billing account settings > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). A billing account contains defining information about your organization. diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index bc329afe4d..576ecfa0c1 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -4,18 +4,18 @@ description: Learn about newest features in Microsoft Store for Business and Mic ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.date: 07/21/2021 ms.reviewer: -manager: dansimp --- # What's new in Microsoft Store for Business and Education > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Microsoft Store for Business and Education regularly releases new and improved features. diff --git a/store-for-business/working-with-line-of-business-apps.md b/store-for-business/working-with-line-of-business-apps.md index 0a71365353..18759b0928 100644 --- a/store-for-business/working-with-line-of-business-apps.md +++ b/store-for-business/working-with-line-of-business-apps.md @@ -3,12 +3,12 @@ title: Working with line-of-business apps (Windows 10) description: Your company or school can make line-of-business (LOB) applications available through Microsoft Store for Business or Microsoft Store for Education. These apps are custom to your organization – they might be internal business apps, or apps specific to your school, business, or industry. ms.assetid: 95EB7085-335A-447B-84BA-39C26AEB5AC7 ms.reviewer: -manager: dansimp ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store -author: TrudyHa -ms.author: TrudyHa +ms.author: cmcatee +author: cmcatee-MSFT +manager: scotv ms.topic: conceptual ms.localizationpriority: medium ms.date: 07/21/2021 @@ -21,7 +21,7 @@ ms.date: 07/21/2021 - Windows 10 > [!IMPORTANT] -> Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Update to Intune integration with the Microsoft Store on Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/update-to-endpoint-manager-integration-with-the-microsoft-store/ba-p/3585077) and [FAQ: Supporting Microsoft Store experiences on managed devices](https://techcommunity.microsoft.com/t5/windows-management/faq-supporting-microsoft-store-experiences-on-managed-devices/m-p/3585286). Your company or school can make line-of-business (LOB) applications available through Microsoft Store for Business or Microsoft Store for Education. These apps are custom to your school or organization – they might be internal apps, or apps specific to your school, business, or industry. diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index 5c38053e2b..fa7f9d3364 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -18,17 +18,17 @@ ms.technology: itpro-apps The following are known issues and workarounds for Application Virtualization (App-V) running on Windows 10, version 1607. ## Windows Installer packages (.msi files) generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client -There are MSI packages generated by an App-V sequencer from previous versions of App-V (Versions 5.1 and earlier). These packages include a check to validate whether the App-V client is installed on client devices, before allowing the MSI package to be installed. As the App-V client gets installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. +There are MSI packages generated by an App-V sequencer from previous versions of App-V (Versions 5.1 and earlier). These packages include a check to validate whether the App-V client is installed on client devices, before allowing the MSI package to be installed. As the App-V client gets installed automatically when you upgrade user devices to Windows 10, version 1607, the prerequisite check fails and causes the MSI to fail. **Workaround**: -1. Install the latest App-V sequencer, which you can get from the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). +1. Install the latest App-V sequencer, which you can get from the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). 2. Ensure that you've installed the **MSI Tools** included in the Windows 10 SDK, available as follows: - - For the **Visual Studio Community 2015 with Update 3** client, which includes the latest Windows 10 SDK and developer tools, see [Downloads and tools for Windows 10](https://developer.microsoft.com/en-us/windows/downloads). + - For the **Visual Studio Community 2015 with Update 3** client, which includes the latest Windows 10 SDK and developer tools, see [Downloads and tools for Windows 10](https://developer.microsoft.com/windows/downloads). - - For the standalone Windows 10 SDK without other tools, see [Standalone Windows 10 SDK](https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk). + - For the standalone Windows 10 SDK without other tools, see [Standalone Windows SDK](https://developer.microsoft.com/windows/downloads/windows-sdk). 3. Copy msidb.exe from the default path of the Windows SDK installation (**C:\Program Files (x86)\Windows Kits\10**) to a different directory. For example: **C:\MyMsiTools\bin** @@ -36,7 +36,7 @@ There are MSI packages generated by an App-V sequencer from previous versions of <Windows Kits 10 installation folder>**\Microsoft Application Virtualization\Sequencer\\** - By default, this path will be:
**C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\Sequencer** + By default, this path is:
**C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\Sequencer** 5. Run the following command: @@ -51,7 +51,7 @@ An error is generated during publishing refresh when synchronizing packages from **Workaround**: Upgrade the App-V 5.0 Management server to the App-V Management server for Windows 10 Clients. ## Custom configurations don't get applied for packages that will be published globally if they're set using the App-V Server -If you assign a package to an AD group that contains machine accounts and apply a custom configuration to that group using the App-V Server, the custom configuration won't be applied to those machines. The App-V Client will publish packages assigned to a machine account globally. However, it stores custom configuration files per user in each user’s profile. Globally published packages won't have access to this custom configuration. +If you assign a package to an AD group that contains machine accounts and apply a custom configuration to that group using the App-V Server, the custom configuration won't be applied to those machines. The App-V Client publishes packages assigned to a machine account globally. However, it stores custom configuration files per user in each user’s profile. Globally published packages won't have access to this custom configuration. **Workaround**: Implement one of the following tasks: @@ -69,23 +69,23 @@ If you uninstall the App-V 5.0 SP1 Server and then install the App-V Server, the Under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall, locate and delete the installation GUID key that contains the DWORD value "DisplayName" with value data "Microsoft Application Virtualization (App-V) Server". This is the only key that should be deleted. -## File type associations added manually are not saved correctly +## File type associations added manually aren't saved correctly File type associations added to an application package manually using the Shortcuts and FTAs tab at the end of the application upgrade wizard aren't saved correctly. They won't be available to the App-V Client or to the Sequencer when updating the saved package again. -**Workaround**: To add a file type association, open the package for modification and run the update wizard. During the Installation step, add the new file type association through the operating system. The sequencer will detect the new association in the system registry and add it to the package’s virtual registry, where it will be available to the client. +**Workaround**: To add a file type association, open the package for modification and run the update wizard. During the Installation step, add the new file type association through the operating system. The sequencer detects the new association in the system registry and adds it to the package’s virtual registry, where it is available to the client. -## When streaming packages in Shared Content Store (SCS) mode to a client that is also managed with AppLocker, additional data is written to the local disk. +## When streaming packages in Shared Content Store (SCS) mode to a client that is also managed with AppLocker, extra data is written to the local disk. To decrease the amount of data written to a client’s local disk, you can enable SCS mode on the App-V Client to stream the contents of a package on demand. However, if AppLocker manages an application within the package, some data might be written to the client’s local disk that wouldn't otherwise be written. **Workaround**: None -## In the Management Console Add Package dialog box, the Browse button is not available when using Chrome or Firefox +## In the Management Console Add Package dialog box, the Browse button isn't available when using Chrome or Firefox -On the Packages page of the Management Console, if you click **Add or Upgrade** in the lower-right corner, the **Add Package** dialog box appears. If you're accessing the Management Console using Chrome or Firefox as your browser, you will not be able to browse to the location of the package. +On the Packages page of the Management Console, if you select **Add or Upgrade** in the lower-right corner, the **Add Package** dialog box appears. If you're accessing the Management Console using Chrome or Firefox as your browser, you won't be able to browse to the location of the package. -**Workaround**: Type or copy and paste the path to the package into the **Add Package** input field. If the Management Console has access to this path, you will be able to add the package. If the package is on a network share, you can browse to the location using File Explorer by doing these steps: +**Workaround**: Type or copy and paste the path to the package into the **Add Package** input field. If the Management Console has access to this path, you'll be able to add the package. If the package is on a network share, you can browse to the location using File Explorer by doing these steps: 1. While pressing **Shift**, right-click on the package file @@ -102,10 +102,10 @@ If you install the App-V 5.0 SP1 Management Server, and then try to upgrade to A where “AppVManagement” is the name of the database. -## Users cannot open a package in a user-published connection group if you add or remove an optional package -In environments that are running the RDS Client or that have multiple concurrent users per computer, logged-in users cannot open applications in packages that are in a user-published connection group if an optional package is added to or removed from the connection group. +## Users can't open a package in a user-published connection group if you add or remove an optional package +In environments that are running the RDS Client or that have multiple concurrent users per computer, logged-in users can't open applications in packages that are in a user-published connection group if an optional package is added to or removed from the connection group. -**Workaround**: Have users log out and then log back in. +**Workaround**: Have users sign out and then log back in. ## Error message is erroneously displayed when the connection group is published only to the user When you run Repair-AppvClientConnectionGroup, the following error is displayed, even when the connection group is published only to the user: “Internal App-V Integration error: Package not integrated for the user. Ensure that the package is added to the machine and published to the user.” @@ -114,7 +114,7 @@ When you run Repair-AppvClientConnectionGroup, the following error is displayed, - Publish all packages in a connection group. - The problem arises when the connection group being repaired has packages that are missing or not available to the user (that is, not published globally or to the user). However, the repair will work if all of the connection group’s packages are available, so ensure that all packages are published. + The problem arises when the connection group being repaired has packages that are missing or not available to the user (that is, not published globally or to the user). However, the repair works if all of the connection group’s packages are available, so ensure that all packages are published. - Repair packages individually using the Repair-AppvClientPackage command rather than the Repair-AppvClientConnectionGroup command. @@ -128,22 +128,22 @@ When you run Repair-AppvClientConnectionGroup, the following error is displayed, ## Icons not displayed properly in Sequencer -Icons in the Shortcuts and File Type Associations tab are not displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons is not 16x16 or 32x32. +Icons in the Shortcuts and File Type Associations tab aren't displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons isn't 16x16 or 32x32. **Workaround**: Only use icons that are 16x16 or 32x32. ## InsertVersionInfo.sql script no longer required for the Management Database -The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. +The InsertVersionInfo.sql script isn't required for versions of the App-V management database later than App-V 5.0 SP3. ## Microsoft Visual Studio 2012 not supported App-V doesn't support Visual Studio 2012. **Workaround**: Use a newer version of Microsoft Visual Studio. -Currently, Visual Studio 2012 doesn't support app virtualization, whether using Microsoft App-V or third party solutions such as VMWare ThinApp. While it is possible you might find that Visual Studio works well enough for your purposes when running within one of these environments, we are unable to address any bugs or issues found when running in a virtualized environment at this time. +Currently, Visual Studio 2012 doesn't support app virtualization, whether using Microsoft App-V or third party solutions such as VMware ThinApp. While it's possible you might find that Visual Studio works well for your purposes when running within one of these environments, we're unable to address any bugs or issues found when running in a virtualized environment at this time. ## Application filename restrictions for App-V Sequencer -The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. +The App-V Sequencer can't sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. **Workaround**: Use a different filename @@ -152,9 +152,9 @@ For information that can help with troubleshooting App-V for Windows 10, see: - [Application Virtualization (App-V): List of Microsoft Support Knowledge Base Articles](https://social.technet.microsoft.com/wiki/contents/articles/14272.app-v-v5-x-list-of-microsoft-support-knowledge-base-articles.aspx) - [The Official Microsoft App-V Team Blog](/archive/blogs/appv/) - [Technical Reference for App-V](./appv-technical-reference.md) -- [App-V TechNet Forum](https://social.technet.microsoft.com/forums/en-us/home?forum=mdopappv) +- [App-V TechNet Forum](https://social.technet.microsoft.com/forums/en-us/home?forum=mdopappv) -
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). Help us to improve diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 523ee3c2d8..e54211075c 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -71,9 +71,9 @@ There are different types of apps that can run on your Windows client devices. T Using an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. -## Android™️ apps +## Android™️ apps -Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can use the Microsoft Store to search, download, and install Android™️ apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. +Starting with Windows 11, users in the [Windows Insider program](https://insider.windows.com/) can use the Microsoft Store to search, download, and install Android™️ apps. This feature uses the Windows Subsystem for Android, and allows users to interact with Android apps, just like others apps installed from the Microsoft Store. For more information, see: @@ -85,7 +85,7 @@ For more information, see: When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. > [!NOTE] -> Microsoft Store for Business and Microsoft Store for Education will be retired on March 31, 2023. Customers may continue to use the current capabilities for free apps until that time. There will be no support for Microsoft Store for Business and Education for Windows 11. +> The retirement of Microsoft Store for Business and Microsoft Store for Education has been postponed. We will update this notice when a new retirement date is announced. Customers may continue to use the current capabilities for free apps until that time. There will be no support for Microsoft Store for Business and Education for Windows 11. >Visit [Evolving the Microsoft Store for Business and Education](https://aka.ms/windows/msfb_evolution) for more information about the new Microsoft Store experience for both Windows 11 and Windows 10, and learn about other options for getting and managing apps. - **Manually install**: On your devices, users can install apps from the Microsoft Store, from the internet, and from an organization shared drive. These apps, and more, are listed in **Settings** > **Apps** > **Apps and Features**. diff --git a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md index 5b0372ddb2..926cb18f47 100644 --- a/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md +++ b/windows/application-management/private-app-repository-mdm-company-portal-windows-11.md @@ -4,7 +4,7 @@ description: Use the Company Portal app in Windows 11 devices to access the priv author: nicholasswhite ms.author: nwhite manager: aaroncz -ms.date: 09/15/2021 +ms.date: 04/04/2023 ms.topic: article ms.prod: windows-client ms.technology: itpro-apps @@ -59,7 +59,7 @@ To install the Company Portal app, you have some options: For more information, see: - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview) - - [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-windows) + - [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft) - [What is co-management?](/mem/configmgr/comanage/overview) - [Use the Company Portal app on co-managed devices](/mem/configmgr/comanage/company-portal) diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 8e4b0ab2da..f500aff927 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -946,9 +946,9 @@ The ApplicationControl CSP can also be managed locally from PowerShell or via Co 3. Use WMI Interface: ```powershell - $namespace = "root\cimv2\mdm\dmmap" - $policyClassName = "MDM_AppControl_Policies" - $policyBase64 = … + $namespace = "root\cimv2\mdm\dmmap" + $policyClassName = "MDM_ApplicationControl_Policies01_01" + $policyBase64 = "" ``` ### Deploying a policy via WMI Bridge diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index b3bbbac0bc..b34bc4709f 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -4,7 +4,7 @@ description: Learn more about the BitLocker CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -176,7 +176,7 @@ require reinstallation of Windows. > [!NOTE] > This policy takes effect only if "RequireDeviceEncryption" policy is set to 1. -The expected values for this policy are +The expected values for this policy are: 1 = This is the default, when the policy is not set. **Warning** prompt and encryption notification is allowed. 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, @@ -317,11 +317,16 @@ Supported Values: 0 - Numeric Recovery Passwords rotation OFF. -This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. +This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive. -- If you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511). +- If you enable this policy setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -- If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" and "Choose drive encryption method and cipher strength" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script." +If the "Deny write access to devices configured in another organization" option is selected, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" policy setting. + +- If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access. + +> [!NOTE] +> This policy setting can be overridden by the policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" policy setting is enabled this policy setting will be ignored. @@ -369,11 +374,12 @@ Sample value for this node to enable this policy and set the encryption methods | Name | Value | |:--|:--| -| Name | EncryptionMethodWithXts_Name | -| Friendly Name | Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) | +| Name | RDVDenyWriteAccess_Name | +| Friendly Name | Deny write access to removable drives not protected by BitLocker | | Location | Computer Configuration | -| Path | Windows Components > BitLocker Drive Encryption | -| Registry Key Name | SOFTWARE\Policies\Microsoft\FVE | +| Path | Windows Components > BitLocker Drive Encryption > Removable Data Drives | +| Registry Key Name | System\CurrentControlSet\Policies\Microsoft\FVE | +| Registry Value Name | RDVDenyWriteAccess | | ADMX File Name | VolumeEncryption.admx | @@ -1578,10 +1584,10 @@ The Windows touch keyboard (such as that used by tablets) isn't available in the - If this policy is not enabled, the Windows Recovery Environment must be enabled on tablets to support the entry of the BitLocker recovery password. When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard. -**Note** that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include -- Configure TPM startup PIN Required/Allowed -- Configure TPM startup key and PIN Required/Allowed -- Configure use of passwords for operating system drives. +**Note** that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include: + - Configure TPM startup PIN: Required/Allowed + - Configure TPM startup key and PIN: Required/Allowed + - Configure use of passwords for operating system drives. diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 081ef8b6f2..206cf3acd1 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/22/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -149,7 +149,7 @@ The following XML file contains the device description framework (DDF) for the B If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.” The format is string. Sample value for this node to enable this policy and set the encryption methods is: - + EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives. EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives. @@ -179,7 +179,7 @@ The following XML file contains the device description framework (DDF) for the B - + @@ -201,7 +201,7 @@ The following XML file contains the device description framework (DDF) for the B Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. The format is string. Sample value for this node to enable this policy is: - + ConfigureNonTPMStartupKeyUsage_Name = Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive) All of the below settings are for computers with a TPM. @@ -257,7 +257,7 @@ The following XML file contains the device description framework (DDF) for the B NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. The format is string. Sample value for this node to enable this policy is: - + Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: @@ -298,7 +298,7 @@ The following XML file contains the device description framework (DDF) for the B Note: Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: 0 = Empty @@ -351,7 +351,7 @@ The following XML file contains the device description framework (DDF) for the B If this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -409,7 +409,7 @@ The following XML file contains the device description framework (DDF) for the B If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -461,7 +461,7 @@ The following XML file contains the device description framework (DDF) for the B If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access. The format is string. Sample value for this node to enable this policy is: - + Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: @@ -502,7 +502,7 @@ The following XML file contains the device description framework (DDF) for the B Note: This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -582,11 +582,11 @@ The following XML file contains the device description framework (DDF) for the B require reinstallation of Windows. Note: This policy takes effect only if "RequireDeviceEncryption" policy is set to 1. The format is integer. - The expected values for this policy are: + The expected values for this policy are: 1 = This is the default, when the policy is not set. Warning prompt and encryption notification is allowed. - 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, - the value 0 only takes affect on Azure Active Directory joined devices. + 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, + the value 0 only takes affect on Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0. If you want to disable this policy use the following SyncML: @@ -630,7 +630,7 @@ The following XML file contains the device description framework (DDF) for the B If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user is the current logged on user in the system. - The expected values for this policy are: + The expected values for this policy are: 1 = "RequireDeviceEncryption" policy will try to enable encryption on all fixed drives even if a current logged in user is standard user. 0 = This is the default, when the policy is not set. If current logged on user is a standard user, "RequireDeviceEncryption" policy @@ -687,17 +687,17 @@ The following XML file contains the device description framework (DDF) for the B 0 Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on AAD and Hybrid domain joined devices. - When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when + When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when Active Directory back up for recovery password is configured to required. For OS drive: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives" For Fixed drives: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives" - + Supported Values: 0 - Numeric Recovery Passwords rotation OFF. 1 - Numeric Recovery Passwords Rotation upon use ON for AAD joined devices. Default value 2 - Numeric Recovery Passwords Rotation upon use ON for both AAD and Hybrid devices - + If you want to disable this policy use the following SyncML: - + 112./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotationint0 @@ -739,20 +739,20 @@ The following XML file contains the device description framework (DDF) for the B Allows admin to push one-time rotation of all numeric recovery passwords for OS and Fixed Data drives on an Azure Active Directory or hybrid-joined device. This policy is Execute type and rotates all numeric passwords when issued from MDM tools. - + The policy only comes into effect when Active Directory backup for a recovery password is configured to "required." * For OS drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for operating system drives." *For fixed drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for fixed data drives." - - Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes: - -* status\RotateRecoveryPasswordsStatus + + Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes: + +* status\RotateRecoveryPasswordsStatus * status\RotateRecoveryPasswordsRequestID + - - + Supported Values: String form of request ID. Example format of request ID is GUID. Server can choose the format as needed according to the management tools.\ - + 113./Device/Vendor/MSFT/BitLocker/RotateRecoveryPasswordschr @@ -824,10 +824,10 @@ Supported Values: String form of request ID. Example format of request ID is GUI - This Node reports the status of RotateRecoveryPasswords request. + This Node reports the status of RotateRecoveryPasswords request. Status code can be one of the following: - NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure - + NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure + @@ -853,10 +853,10 @@ Supported Values: String form of request ID. Example format of request ID is GUI - This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. + This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus - To ensure the status is correctly matched to the request ID. - + To ensure the status is correctly matched to the request ID. + diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 40d679359a..fe160a4fe0 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -4,7 +4,7 @@ description: Learn more about the Defender CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -58,6 +58,7 @@ The following list shows the Defender configuration service provider nodes: - [EnableFileHashComputation](#configurationenablefilehashcomputation) - [EngineUpdatesChannel](#configurationengineupdateschannel) - [HideExclusionsFromLocalAdmins](#configurationhideexclusionsfromlocaladmins) + - [HideExclusionsFromLocalUsers](#configurationhideexclusionsfromlocalusers) - [IntelTDTEnabled](#configurationinteltdtenabled) - [MeteredConnectionUpdates](#configurationmeteredconnectionupdates) - [PassiveRemediation](#configurationpassiveremediation) @@ -65,6 +66,7 @@ The following list shows the Defender configuration service provider nodes: - [RandomizeScheduleTaskTimes](#configurationrandomizescheduletasktimes) - [ScanOnlyIfIdleEnabled](#configurationscanonlyifidleenabled) - [SchedulerRandomizationTime](#configurationschedulerrandomizationtime) + - [SecuredDevicesConfiguration](#configurationsecureddevicesconfiguration) - [SecurityIntelligenceUpdatesChannel](#configurationsecurityintelligenceupdateschannel) - [SupportLogLocation](#configurationsupportloglocation) - [TamperProtection](#configurationtamperprotection) @@ -1622,7 +1624,7 @@ Enable this policy to specify when devices receive Microsoft Defender engine upd -This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled. +This policy setting controls whether or not exclusions are visible to local admins. To control local users exclusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set. @@ -1656,6 +1658,55 @@ This policy setting controls whether or not exclusions are visible to local admi + +### Configuration/HideExclusionsFromLocalUsers + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/HideExclusionsFromLocalUsers +``` + + + + +This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell. | +| 0 (Default) | If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell. | + + + + + + + + ### Configuration/IntelTDTEnabled @@ -1696,6 +1747,7 @@ This policy setting configures the Intel TDT integration level for Intel TDT-cap | Value | Description | |:--|:--| | 0 (Default) | If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat. | +| 1 | If you configure this setting to enabled, Intel TDT integration will turn on. | | 2 | If you configure this setting to disabled, Intel TDT integration will turn off. | @@ -1996,6 +2048,45 @@ This setting allows you to configure the scheduler randomization in hours. The r + +### Configuration/SecuredDevicesConfiguration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/SecuredDevicesConfiguration +``` + + + + +Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + ### Configuration/SecurityIntelligenceUpdatesChannel diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index b540c17da8..4a653a572d 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1852,7 +1852,7 @@ The following XML file contains the device description framework (DDF) for the D 0 - This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled. + This policy setting controls whether or not exclusions are visible to local admins. To control local users exlcusions visibility use HideExclusionsFromLocalUsers. If HideExclusionsFromLocalAdmins is set then HideExclusionsFromLocalUsers will be implicitly set. @@ -1881,6 +1881,45 @@ The following XML file contains the device description framework (DDF) for the D + + HideExclusionsFromLocalUsers + + + + + + + + 0 + This policy setting controls whether or not exclusions are visible to local users. If HideExclusionsFromLocalAdmins is set then this policy will be implicitly set. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + 1 + If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell. + + + 0 + If you disable or do not configure this setting, local users will be able to see exclusions in the Windows Security App and via PowerShell. + + + + ThrottleForScheduledScanOnly @@ -2010,6 +2049,36 @@ The following XML file contains the device description framework (DDF) for the D + + SecuredDevicesConfiguration + + + + + + + + Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + + DataDuplicationLocalRetentionPeriod @@ -2197,6 +2266,10 @@ The following XML file contains the device description framework (DDF) for the D 0 If you do not configure this setting, the default value will be applied. The default value is controlled by Microsoft security intelligence updates. Microsoft will enable Intel TDT if there is a known threat. + + 1 + If you configure this setting to enabled, Intel TDT integration will turn on. + 2 If you configure this setting to disabled, Intel TDT integration will turn off. diff --git a/windows/client-management/mdm/devicepreparation-csp.md b/windows/client-management/mdm/devicepreparation-csp.md index 35028e068e..e32d2c6c9a 100644 --- a/windows/client-management/mdm/devicepreparation-csp.md +++ b/windows/client-management/mdm/devicepreparation-csp.md @@ -4,7 +4,7 @@ description: Learn more about the DevicePreparation CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -31,6 +31,8 @@ The following list shows the DevicePreparation configuration service provider no - [ClassID](#bootstrapperagentclassid) - [ExecutionContext](#bootstrapperagentexecutioncontext) - [InstallationStatusUri](#bootstrapperagentinstallationstatusuri) + - [MDMProvider](#mdmprovider) + - [Progress](#mdmproviderprogress) - [PageEnabled](#pageenabled) - [PageSettings](#pagesettings) - [PageStatus](#pagestatus) @@ -192,6 +194,84 @@ This node holds a URI that can be queried for the status of the Bootstrapper Age + +## MDMProvider + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DevicePreparation/MDMProvider +``` + + + + +The subnode configures the settings for the MDMProvider. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### MDMProvider/Progress + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DevicePreparation/MDMProvider/Progress +``` + + + + +Noode for reporting progress status as opaque data. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get, Replace | + + + + + + + + ## PageEnabled @@ -297,7 +377,7 @@ This node configures specific settings for the Device Preparation page. -This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = Succeeded; 4 = Failed. +This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = ExitedOnSuccess; 4 = ExitedOnFailure. diff --git a/windows/client-management/mdm/devicepreparation-ddf-file.md b/windows/client-management/mdm/devicepreparation-ddf-file.md index e10e6a1a49..c2a8a4aa4e 100644 --- a/windows/client-management/mdm/devicepreparation-ddf-file.md +++ b/windows/client-management/mdm/devicepreparation-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -89,7 +89,7 @@ The following XML file contains the device description framework (DDF) for the D - This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = Succeeded; 4 = Failed. + This node provides status of the Device Preparation page. Values are an enum: 0 = Disabled; 1 = Enabled; 2 = InProgress; 3 = ExitedOnSuccess; 4 = ExitedOnFailure. @@ -243,6 +243,49 @@ The following XML file contains the device description framework (DDF) for the D + + MDMProvider + + + + + The subnode configures the settings for the MDMProvider. + + + + + + + + + + + + + + + Progress + + + + + + Noode for reporting progress status as opaque data. + + + + + + + + + + + + + + + ``` diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index 9bb47acd36..5a0260cdc0 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -9,9 +9,6 @@ author: vinaypamnani-msft ms.date: 06/26/2017 ms.reviewer: manager: aaroncz -ms.collection: - - highpri - - tier2 --- # DynamicManagement CSP @@ -276,4 +273,4 @@ Get ContextStatus and SignalDefinition from a specific context: ## Related articles -[Configuration service provider reference](index.yml) \ No newline at end of file +[Configuration service provider reference](index.yml) diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index e0917186af..c5b31e1372 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -4,7 +4,7 @@ description: Learn more about the Firewall CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -104,19 +104,41 @@ The following list shows the Firewall configuration service provider nodes: - [Enabled](#mdmstorehypervfirewallrulesfirewallrulenameenabled) - [LocalAddressRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocaladdressranges) - [LocalPortRanges](#mdmstorehypervfirewallrulesfirewallrulenamelocalportranges) - - [Name](#mdmstorehypervfirewallrulesfirewallrulenamename) - [Priority](#mdmstorehypervfirewallrulesfirewallrulenamepriority) + - [Profiles](#mdmstorehypervfirewallrulesfirewallrulenameprofiles) - [Protocol](#mdmstorehypervfirewallrulesfirewallrulenameprotocol) - [RemoteAddressRanges](#mdmstorehypervfirewallrulesfirewallrulenameremoteaddressranges) - [RemotePortRanges](#mdmstorehypervfirewallrulesfirewallrulenameremoteportranges) - [Status](#mdmstorehypervfirewallrulesfirewallrulenamestatus) - [VMCreatorId](#mdmstorehypervfirewallrulesfirewallrulenamevmcreatorid) + - [HyperVLoopbackRules](#mdmstorehypervloopbackrules) + - [{RuleName}](#mdmstorehypervloopbackrulesrulename) + - [DestinationVMCreatorId](#mdmstorehypervloopbackrulesrulenamedestinationvmcreatorid) + - [Enabled](#mdmstorehypervloopbackrulesrulenameenabled) + - [PortRanges](#mdmstorehypervloopbackrulesrulenameportranges) + - [SourceVMCreatorId](#mdmstorehypervloopbackrulesrulenamesourcevmcreatorid) - [HyperVVMSettings](#mdmstorehypervvmsettings) - [{VMCreatorId}](#mdmstorehypervvmsettingsvmcreatorid) + - [AllowHostPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge) - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoriddefaultinboundaction) - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoriddefaultoutboundaction) + - [DomainProfile](#mdmstorehypervvmsettingsvmcreatoriddomainprofile) + - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoriddomainprofileallowlocalpolicymerge) + - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoriddomainprofiledefaultinboundaction) + - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoriddomainprofiledefaultoutboundaction) + - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoriddomainprofileenablefirewall) - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridenablefirewall) - [EnableLoopback](#mdmstorehypervvmsettingsvmcreatoridenableloopback) + - [PrivateProfile](#mdmstorehypervvmsettingsvmcreatoridprivateprofile) + - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridprivateprofileallowlocalpolicymerge) + - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoridprivateprofiledefaultinboundaction) + - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoridprivateprofiledefaultoutboundaction) + - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridprivateprofileenablefirewall) + - [PublicProfile](#mdmstorehypervvmsettingsvmcreatoridpublicprofile) + - [AllowLocalPolicyMerge](#mdmstorehypervvmsettingsvmcreatoridpublicprofileallowlocalpolicymerge) + - [DefaultInboundAction](#mdmstorehypervvmsettingsvmcreatoridpublicprofiledefaultinboundaction) + - [DefaultOutboundAction](#mdmstorehypervvmsettingsvmcreatoridpublicprofiledefaultoutboundaction) + - [EnableFirewall](#mdmstorehypervvmsettingsvmcreatoridpublicprofileenablefirewall) - [PrivateProfile](#mdmstoreprivateprofile) - [AllowLocalIpsecPolicyMerge](#mdmstoreprivateprofileallowlocalipsecpolicymerge) - [AllowLocalPolicyMerge](#mdmstoreprivateprofileallowlocalpolicymerge) @@ -1093,7 +1115,7 @@ This value is used as an on/off switch. If this value is on and EnableFirewall i | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1131,7 +1153,7 @@ This value is used as an on/off switch. If this value is on and EnableFirewall i | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1170,7 +1192,7 @@ A list of dynamic keyword addresses for use within firewall rules. Dynamic keywo | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1212,7 +1234,7 @@ A unique GUID string identifier for this dynamic keyword address. | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1258,7 +1280,7 @@ An IPv6 address range in the format of "start address - end address" with no spa | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -1307,7 +1329,7 @@ If this flag is set to TRUE, then the 'keyword' field of this object is expected | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -2078,7 +2100,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -2303,7 +2325,7 @@ Specifies the profiles to which the rule belongs: Domain, Private, Public. See [ | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042.1706] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1706] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044.1706] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -2422,7 +2444,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -3354,7 +3376,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -3363,44 +3385,6 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the - -##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | - - - -```Device -./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Name -``` - - - - - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Add, Delete, Get, Replace | - - - - - - - - ##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Priority @@ -3441,6 +3425,56 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the + +##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Profiles + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules/{FirewallRuleName}/Profiles +``` + + + + +Specifies the profiles to which the rule belongs: Domain, Private, Public. See [FW_PROFILE_TYPE](/openspecs/windows_protocols/ms-fasp/7704e238-174d-4a5e-b809-5f3787dd8acc) for the bitmasks that are used to identify profile types. If not specified, the default is All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | + + + +**Allowed values**: + +| Flag | Description | +|:--|:--| +| 0x1 | FW_PROFILE_TYPE_DOMAIN: This value represents the profile for networks that are connected to domains. | +| 0x2 | FW_PROFILE_TYPE_STANDARD: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD. | +| 0x4 | FW_PROFILE_TYPE_PUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted. | +| 0x7FFFFFFF | FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | + + + + + + + + ##### MdmStore/HyperVFirewallRules/{FirewallRuleName}/Protocol @@ -3557,7 +3591,7 @@ Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the |:--|:--| | Format | chr (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `,`) | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | @@ -3645,6 +3679,255 @@ This field specifies the VM Creator ID that this rule is applicable to. A NULL G + +### MdmStore/HyperVLoopbackRules + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules +``` + + + + +A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +#### MdmStore/HyperVLoopbackRules/{RuleName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName} +``` + + + + +Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get, Replace | +| Atomic Required | True | +| Dynamic Node Naming | ServerGeneratedUniqueIdentifier | +| Allowed Values | Regular Expression: `^[^|/]*$` | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/DestinationVMCreatorId +``` + + + + +This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/Enabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/Enabled +``` + + + + +Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 | Enabled. | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/PortRanges +``` + + + + +Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Regular Expression: `^[0-9,-]+$` | + + + + + + + + + +##### MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVLoopbackRules/{RuleName}/SourceVMCreatorId +``` + + + + +This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Regular Expression: `\{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\}` | + + + + + + + + ### MdmStore/HyperVVMSettings @@ -3726,6 +4009,55 @@ VM Creator ID that these settings apply to. Valid format is a GUID. + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/AllowHostPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/AllowHostPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get, Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowHostPolicyMerge Off. | +| true (Default) | AllowHostPolicyMerge On. | + + + + + + + + ##### MdmStore/HyperVVMSettings/{VMCreatorId}/DefaultInboundAction @@ -3743,7 +4075,7 @@ VM Creator ID that these settings apply to. Valid format is a GUID. -This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -3793,7 +4125,7 @@ This value is the action that the firewall does by default (and evaluates at the -This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -3826,6 +4158,243 @@ This value is the action that the firewall does by default (and evaluates at the + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/AllowLocalPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/AllowLocalPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowLocalPolicyMerge Off. | +| true (Default) | AllowLocalPolicyMerge On. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultInboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultInboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 1 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Allow Inbound By Default. | +| 1 (Default) | Block Inbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultOutboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/DefaultOutboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 0 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Allow Outbound By Default. | +| 1 | Block Outbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/EnableFirewall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/EnableFirewall +``` + + + + +This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | Disable Firewall. | +| true (Default) | Enable Firewall. | + + + + + + + + ##### MdmStore/HyperVVMSettings/{VMCreatorId}/EnableFirewall @@ -3843,7 +4412,7 @@ This value is the action that the firewall does by default (and evaluates at the -This value is an on/off switch for the firewall and advanced security enforcement. +This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -3892,7 +4461,7 @@ This value is an on/off switch for the firewall and advanced security enforcemen -This value is an on/off switch for loopback traffic. This determines if this VM type is able to send/receive loopback traffic. +This value is an on/off switch for loopback traffic. This determines if this VM is able to send/receive loopback traffic to other VMs or the host. @@ -3924,6 +4493,480 @@ This value is an on/off switch for loopback traffic. This determines if this VM + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/AllowLocalPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/AllowLocalPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowLocalPolicyMerge Off. | +| true (Default) | AllowLocalPolicyMerge On. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultInboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultInboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 1 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Allow Inbound By Default. | +| 1 (Default) | Block Inbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultOutboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/DefaultOutboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 0 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Allow Outbound By Default. | +| 1 | Block Outbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/EnableFirewall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PrivateProfile/EnableFirewall +``` + + + + +This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | Disable Firewall. | +| true (Default) | Enable Firewall. | + + + + + + + + + +##### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/AllowLocalPolicyMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/AllowLocalPolicyMerge +``` + + + + +This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | AllowLocalPolicyMerge Off. | +| true (Default) | AllowLocalPolicyMerge On. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultInboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultInboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 1 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Allow Inbound By Default. | +| 1 (Default) | Block Inbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultOutboundAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/DefaultOutboundAction +``` + + + + +This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get, Replace | +| Default Value | 0 | +| Dependency [Enable Firewall] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall`
Dependency Allowed Value: `true`
Dependency Allowed Value Type: `ENUM`
| + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Allow Outbound By Default. | +| 1 | Block Outbound By Default. | + + + + + + + + + +###### MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/EnableFirewall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/PublicProfile/EnableFirewall +``` + + + + +This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Replace | +| Default Value | true | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false | Disable Firewall. | +| true (Default) | Enable Firewall. | + + + + + + + + ### MdmStore/PrivateProfile diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index a55d7cb441..4eb6ee5f96 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/27/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2855,7 +2855,7 @@ The following XML file contains the device description framework (DDF) for the F true - This value is an on/off switch for the firewall and advanced security enforcement. + This value is an on/off switch for the firewall and advanced security enforcement. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -2888,7 +2888,7 @@ The following XML file contains the device description framework (DDF) for the F 0 - This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -2934,7 +2934,7 @@ The following XML file contains the device description framework (DDF) for the F 1 - This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. This value controls the settings for all profiles. It is recommended to instead use the profile setting value under the profile subtree. @@ -2979,7 +2979,7 @@ The following XML file contains the device description framework (DDF) for the F false - This value is an on/off switch for loopback traffic. This determines if this VM type is able to send/receive loopback traffic. + This value is an on/off switch for loopback traffic. This determines if this VM is able to send/receive loopback traffic to other VMs or the host. @@ -3004,6 +3004,606 @@ The following XML file contains the device description framework (DDF) for the F + + AllowHostPolicyMerge + + + + + + true + This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings will be applied to Hyper-V firewall. + + + + + + + + + + + + + + + false + AllowHostPolicyMerge Off + + + true + AllowHostPolicyMerge On + + + + + + DomainProfile + + + + + + + + + + + + + + + + + + + EnableFirewall + + + + + true + This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + + + + + + + + + false + Disable Firewall + + + true + Enable Firewall + + + + + + DefaultOutboundAction + + + + + + 0 + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + + + + + + + + + 0 + Allow Outbound By Default + + + 1 + Block Outbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + DefaultInboundAction + + + + + + 1 + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + + + + + + + + + 0 + Allow Inbound By Default + + + 1 + Block Inbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + AllowLocalPolicyMerge + + + + + true + This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + + + + + + + + + false + AllowLocalPolicyMerge Off + + + true + AllowLocalPolicyMerge On + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/DomainProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + + PrivateProfile + + + + + + + + + + + + + + + + + + + EnableFirewall + + + + + true + This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + + + + + + + + + false + Disable Firewall + + + true + Enable Firewall + + + + + + DefaultOutboundAction + + + + + + 0 + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + + + + + + + + + 0 + Allow Outbound By Default + + + 1 + Block Outbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + DefaultInboundAction + + + + + + 1 + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + + + + + + + + + 0 + Allow Inbound By Default + + + 1 + Block Inbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + AllowLocalPolicyMerge + + + + + true + This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + + + + + + + + + false + AllowLocalPolicyMerge Off + + + true + AllowLocalPolicyMerge On + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PrivateProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + + PublicProfile + + + + + + + + + + + + + + + + + + + EnableFirewall + + + + + true + This value is an on/off switch for the firewall and advanced security enforcement. + + + + + + + + + + + + + + + false + Disable Firewall + + + true + Enable Firewall + + + + + + DefaultOutboundAction + + + + + + 0 + This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 0 [Allow]. + + + + + + + + + + + + + + + 0 + Allow Outbound By Default + + + 1 + Block Outbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + DefaultInboundAction + + + + + + 1 + This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The allow action is represented by 0x00000000; 0x00000001 represents a block action. Default value is 1 [Block]. + + + + + + + + + + + + + + + 0 + Allow Inbound By Default + + + 1 + Block Inbound By Default + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + + AllowLocalPolicyMerge + + + + + true + This value is used as an on/off switch. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions. + + + + + + + + + + + + + + + false + AllowLocalPolicyMerge Off + + + true + AllowLocalPolicyMerge On + + + + + + Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/[VMCreatorId]/PublicProfile/EnableFirewall + + + true + Enable Firewall + + + + + + + + @@ -3231,7 +3831,8 @@ ServiceName - + + ^[0-9,-]+$ @@ -3258,7 +3859,8 @@ ServiceName - + + ^[0-9,-]+$ @@ -3396,7 +3998,7 @@ An IPv6 address range in the format of "start address - end address" with no spa - 99.9.99999 + 10.0.22000, 10.0.19044.1706, 10.0.19043.1706, 10.0.19042.1706 1.0 @@ -4022,7 +4624,8 @@ An IPv6 address range in the format of "start address - end address" with no spa - + + ^[0-9,-]+$ @@ -4081,7 +4684,8 @@ An IPv6 address range in the format of "start address - end address" with no spa - + + ^[0-9,-]+$ @@ -4197,16 +4801,15 @@ If not specified - a new rule is disabled by default. - Name + Profiles - - + Specifies the profiles to which the rule belongs: Domain, Private, Public. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. If not specified, the default is All. - + @@ -4217,6 +4820,192 @@ If not specified - a new rule is disabled by default. + + + 0x1 + FW_PROFILE_TYPE_DOMAIN: This value represents the profile for networks that are connected to domains. + + + 0x2 + FW_PROFILE_TYPE_STANDARD: This value represents the standard profile for networks. These networks are classified as private by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are behind Network Address Translation (NAT) devices, routers, and other edge devices, and they are in a private location, such as a home or an office. AND FW_PROFILE_TYPE_PRIVATE: This value represents the profile for private networks, which is represented by the same value as that used for FW_PROFILE_TYPE_STANDARD. + + + 0x4 + FW_PROFILE_TYPE_PUBLIC: This value represents the profile for public networks. These networks are classified as public by the administrators in the server host. The classification happens the first time the host connects to the network. Usually these networks are those at airports, coffee shops, and other public places where the peers in the network or the network administrator are not trusted. + + + 0x7FFFFFFF + FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. + + + + + + + + HyperVLoopbackRules + + + + + A list of rules controlling loopback traffic through the Windows Firewall. This enforcement is only for traffic from one container to another or to the host device. These rules are all allow rules. + + + + + + + + + + + + + + + + + + + + + + + + Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/). + + + + + + + + + + RuleName + + + + + + + + ^[^|/]*$ + + + + + SourceVMCreatorId + + + + + + + + This field specifies the VM Creator ID of the source of the traffic that this rule applies to. If not specified, this applies to All. + + + + + + + + + + + + + + \{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\} + + + + + DestinationVMCreatorId + + + + + + + + This field specifies the VM Creator ID of the destination of traffic that this rule applies to. If not specified, this applies to All. + + + + + + + + + + + + + + \{[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}\} + + + + + PortRanges + + + + + + + + Comma Separated list of ranges for eg. 100-120,200,300-320. If not specified the default is All. + + + + + + + + + + + + + + ^[0-9,-]+$ + + + + + + Enabled + + + + + + Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default. + + + + + + + + + + + + + + + 0 + Disabled + + + 1 + Enabled + + @@ -4240,7 +5029,7 @@ If not specified - a new rule is disabled by default. - 99.9.99999 + 10.0.22000, 10.0.19044.1706, 10.0.19043.1706, 10.0.19042.1706 1.0 diff --git a/windows/client-management/mdm/laps-csp.md b/windows/client-management/mdm/laps-csp.md index 9c4f8440b5..b5c76b1b14 100644 --- a/windows/client-management/mdm/laps-csp.md +++ b/windows/client-management/mdm/laps-csp.md @@ -4,7 +4,7 @@ description: Learn more about the LAPS CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -112,7 +112,7 @@ Use this setting to tell the CSP to immediately generate and store a new passwor -This action invokes an immediate reset of the local administrator account password, ignoring the normal constraints such as PasswordLengthDays, etc +This action invokes an immediate reset of the local administrator account password, ignoring the normal constraints such as PasswordLengthDays, etc. @@ -333,7 +333,7 @@ This setting is ignored if the password is currently being stored in Azure. This setting is only honored when the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher. -- If this setting is enabled, and the Active Directory domain meets the DFL prerequisite, the password will be encrypted before before being stored in Active Directory. +- If this setting is enabled, and the Active Directory domain meets the DFL prerequisite, the password will be encrypted before being stored in Active Directory. - If this setting is disabled, or the Active Directory domain does not meet the DFL prerequisite, the password will be stored as clear-text in Active Directory. @@ -343,7 +343,7 @@ If not specified, this setting defaults to True. > [!IMPORTANT] -> This setting is ignored unless BackupDirectory is configured to back up the password to Active Directory, AND the the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher. +> This setting is ignored unless BackupDirectory is configured to back up the password to Active Directory, AND the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher. @@ -642,8 +642,8 @@ If not specified, this setting defaults to True. | Value | Description | |:--|:--| -| false | Allow configured password expiriration timestamp to exceed maximum password age. | -| true (Default) | Do not allow configured password expiriration timestamp to exceed maximum password age. | +| false | Allow configured password expiration timestamp to exceed maximum password age. | +| true (Default) | Do not allow configured password expiration timestamp to exceed maximum password age. | diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 34cd8ae204..a937496bd1 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -4,7 +4,7 @@ description: Learn more about the PassportForWork CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # PassportForWork CSP +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + The PassportForWork configuration service provider is used to provision Windows Hello for Business (formerly Microsoft Passport for Work). It allows you to log in to Windows using your Active Directory or Azure Active Directory account and replace passwords, smartcards, and virtual smart cards. @@ -30,6 +33,7 @@ The following list shows the PassportForWork configuration service provider node - ./Device/Vendor/MSFT/PassportForWork - [{TenantId}](#devicetenantid) - [Policies](#devicetenantidpolicies) + - [DisablePostLogonProvisioning](#devicetenantidpoliciesdisablepostlogonprovisioning) - [EnablePinRecovery](#devicetenantidpoliciesenablepinrecovery) - [ExcludeSecurityDevices](#devicetenantidpoliciesexcludesecuritydevices) - [TPM12](#devicetenantidpoliciesexcludesecuritydevicestpm12) @@ -160,6 +164,55 @@ Root node for policies. + +#### Device/{TenantId}/Policies/DisablePostLogonProvisioning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonProvisioning +``` + + + + +Do not start Windows Hello provisioning after sign-in. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Add, Delete, Get, Replace | +| Default Value | False | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Disabled. | +| true | Enabled. | + + + + + + + + #### Device/{TenantId}/Policies/EnablePinRecovery @@ -1187,8 +1240,8 @@ Enhanced Sign-in Security (ESS) isolates both biometric template data and matchi | Value | Description | |:--|:--| -| 0 | Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended). | -| 1 (Default) | Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security). | +| 0 | ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera. (not recommended). | +| 1 (Default) | ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security). | diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index 89dbc41c22..28991ea21c 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/24/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -814,6 +814,45 @@ If you disable or do not configure this policy setting, the PIN recovery secret + + DisablePostLogonProvisioning + + + + + + + + False + Do not start Windows Hello provisioning after sign-in. + + + + + + + + + + + + + + 99.9.99999 + 1.6 + + + + false + Disabled + + + true + Enabled + + + + UseCertificateForOnPremAuth @@ -1507,11 +1546,11 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re 0 - Enhanced sign-in security will be disabled on all systems. If a user already has a secure Windows Hello enrollment, they will lose their enrollment and must reset PIN, and they will have the option to re-enroll in normal face and fingerprint. Peripheral usage will be enabled by disabling Enhanced sign-in security. OS will not attempt to start secure components, even if the secure hardware and software components are present. (not recommended) + ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of peripheral Windows Hello capable devices will be allowed, subject to current feature limitations. In addition, with this setting, ESS will be enabled on devices with a mixture of biometric devices, such as an ESS capable FPR and a non-ESS capable camera. (not recommended) 1 - Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For systems with one secure modality (face or fingerprint) and one insecure modality (fingerprint or face), only the secure sensor can be used for sign-in and the insecure sensor(s) will be blocked. This includes peripheral devices, which are unsupported and will be unusable. (default and recommended for highest security) + ESS will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security) diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md index b7227416df..af0cf9f34d 100644 --- a/windows/client-management/mdm/personaldataencryption-csp.md +++ b/windows/client-management/mdm/personaldataencryption-csp.md @@ -4,7 +4,7 @@ description: Learn more about the PDE CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,13 @@ The following list shows the PDE configuration service provider nodes: - ./User/Vendor/MSFT/PDE - [EnablePersonalDataEncryption](#enablepersonaldataencryption) + - [ProtectFolders](#protectfolders) + - [ProtectDesktop](#protectfoldersprotectdesktop) + - [ProtectDocuments](#protectfoldersprotectdocuments) + - [ProtectPictures](#protectfoldersprotectpictures) - [Status](#status) + - [FolderProtectionStatus](#statusfolderprotectionstatus) + - [FoldersProtected](#statusfoldersprotected) - [PersonalDataEncryptionStatus](#statuspersonaldataencryptionstatus) @@ -79,6 +85,188 @@ The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.u + +## ProtectFolders + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### ProtectFolders/ProtectDesktop + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDesktop +``` + + + + +Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | +| 1 | Enable PDE on the folder. | + + + + + + + + + +### ProtectFolders/ProtectDocuments + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDocuments +``` + + + + +Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | +| 1 | Enable PDE on the folder. | + + + + + + + + + +### ProtectFolders/ProtectPictures + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/ProtectFolders/ProtectPictures +``` + + + + +Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | +| 1 | Enable PDE on the folder. | + + + + + + + + ## Status @@ -121,6 +309,95 @@ Reports the current status of Personal Data Encryption (PDE) for the user. + +### Status/FolderProtectionStatus + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/Status/FolderProtectionStatus +``` + + + + +This node reports folder protection status for a user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Protection not started. | +| 1 | Protection is completed with no failures. | +| 2 | Protection in progress. | +| 3 | Protection failed. | + + + + + + + + + +### Status/FoldersProtected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```User +./User/Vendor/MSFT/PDE/Status/FoldersProtected +``` + + + + +This node reports all folders (full path to each folder) that have been protected. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + ### Status/PersonalDataEncryptionStatus diff --git a/windows/client-management/mdm/personaldataencryption-ddf-file.md b/windows/client-management/mdm/personaldataencryption-ddf-file.md index 9550cce774..b5425cab46 100644 --- a/windows/client-management/mdm/personaldataencryption-ddf-file.md +++ b/windows/client-management/mdm/personaldataencryption-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -83,6 +83,128 @@ The following XML file contains the device description framework (DDF) for the P + + ProtectFolders + + + + + + + + + + + + + + + + + + + ProtectDocuments + + + + + + + + Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + + ProtectDesktop + + + + + + + + Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + + ProtectPictures + + + + + + + + Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy. + + + + + + + + + + + + + + + 0 + Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. + + + 1 + Enable PDE on the folder. + + + + + Status @@ -123,6 +245,66 @@ The following XML file contains the device description framework (DDF) for the P + + FolderProtectionStatus + + + + + This node reports folder protection status for a user. + + + + + + + + + + + + + + + 0 + Protection not started. + + + 1 + Protection is completed with no failures. + + + 2 + Protection in progress. + + + 3 + Protection failed. + + + + + + FoldersProtected + + + + + This node reports all folders (full path to each folder) that have been protected. + + + + + + + + + + + + + + diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index c45d67308a..08332c2601 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/18/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2303,7 +2303,9 @@ This article lists the ADMX-backed policies in Policy CSP. - [EnableSettings](policy-csp-desktopappinstaller.md) - [EnableExperimentalFeatures](policy-csp-desktopappinstaller.md) - [EnableLocalManifestFiles](policy-csp-desktopappinstaller.md) +- [EnableBypassCertificatePinningForMicrosoftStore](policy-csp-desktopappinstaller.md) - [EnableHashOverride](policy-csp-desktopappinstaller.md) +- [EnableLocalArchiveMalwareScanOverride](policy-csp-desktopappinstaller.md) - [EnableDefaultSource](policy-csp-desktopappinstaller.md) - [EnableMicrosoftStoreSource](policy-csp-desktopappinstaller.md) - [SourceAutoUpdateInterval](policy-csp-desktopappinstaller.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index 2b636d3e4f..6aba70d787 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/03/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -340,6 +340,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [ClearTextPassword](policy-csp-devicelock.md) - [PasswordComplexity](policy-csp-devicelock.md) - [PasswordHistorySize](policy-csp-devicelock.md) +- [AccountLockoutThreshold](policy-csp-devicelock.md) +- [AccountLockoutDuration](policy-csp-devicelock.md) +- [ResetAccountLockoutCounterAfter](policy-csp-devicelock.md) +- [AllowAdministratorLockout](policy-csp-devicelock.md) ## Display @@ -400,6 +404,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [ForceInstantLock](policy-csp-humanpresence.md) - [ForceLockTimeout](policy-csp-humanpresence.md) - [ForceInstantDim](policy-csp-humanpresence.md) +- [ForceDisableWakeWhenBatterySaverOn](policy-csp-humanpresence.md) +- [ForceAllowWakeWhenExternalDisplayConnected](policy-csp-humanpresence.md) +- [ForceAllowLockWhenExternalDisplayConnected](policy-csp-humanpresence.md) +- [ForceAllowDimWhenExternalDisplayConnected](policy-csp-humanpresence.md) ## Kerberos @@ -511,6 +519,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [DisallowNotificationMirroring](policy-csp-notifications.md) - [DisallowTileNotification](policy-csp-notifications.md) +- [EnableExpandedToastNotifications](policy-csp-notifications.md) - [DisallowCloudNotification](policy-csp-notifications.md) - [WnsEndpoint](policy-csp-notifications.md) @@ -574,6 +583,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps](policy-csp-privacy.md) - [LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps](policy-csp-privacy.md) - [LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessHumanPresence_UserInControlOfTheseApps](policy-csp-privacy.md) - [LetAppsAccessLocation](policy-csp-privacy.md) - [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md) - [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md) @@ -676,6 +689,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [StartLayout](policy-csp-start.md) - [ConfigureStartPins](policy-csp-start.md) - [HideRecommendedSection](policy-csp-start.md) +- [HideRecoPersonalizedSites](policy-csp-start.md) - [HideTaskViewButton](policy-csp-start.md) - [DisableControlCenter](policy-csp-start.md) - [ForceStartSize](policy-csp-start.md) @@ -686,6 +700,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [StartLayout](policy-csp-start.md) - [ConfigureStartPins](policy-csp-start.md) - [HideRecommendedSection](policy-csp-start.md) +- [HideRecoPersonalizedSites](policy-csp-start.md) - [SimplifyQuickSettings](policy-csp-start.md) - [DisableEditingQuickSettings](policy-csp-start.md) - [HideTaskViewButton](policy-csp-start.md) @@ -869,6 +884,7 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [DenyLogOnAsBatchJob](policy-csp-userrights.md) - [LogOnAsService](policy-csp-userrights.md) - [IncreaseProcessWorkingSet](policy-csp-userrights.md) +- [DenyServiceLogonRight](policy-csp-userrights.md) ## VirtualizationBasedTechnology diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index ce20ebe3db..e17a1d7e53 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,99 +1,378 @@ --- -title: Policies in Policy CSP supported by Microsoft Surface Hub -description: Learn about the policies in Policy CSP supported by Microsoft Surface Hub. -ms.reviewer: +title: Policies in Policy CSP supported by Windows 10 Team +description: Learn about the policies in Policy CSP supported by Windows 10 Team. +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article +ms.date: 03/28/2023 +ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 07/22/2020 +ms.topic: reference --- -# Policies in Policy CSP supported by Microsoft Surface Hub + -- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#allowdeveloperunlock) -- [Accounts/AllowMicrosoftAccountConnection](./policy-csp-accounts.md#allowmicrosoftaccountconnection) -- [Camera/AllowCamera](policy-csp-camera.md#allowcamera) -- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#showappcellularaccessui) -- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#tlsciphersuites) -- [Defender/AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring) -- [Defender/AllowCloudProtection](policy-csp-defender.md#allowcloudprotection) -- [Defender/AllowEmailScanning](policy-csp-defender.md#allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](policy-csp-defender.md#allowioavprotection) -- [Defender/AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](policy-csp-defender.md#allowscriptscanning) -- [Defender/AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess) -- [Defender/AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](policy-csp-defender.md#excludedextensions) -- [Defender/ExcludedPaths](policy-csp-defender.md#excludedpaths) -- [Defender/ExcludedProcesses](policy-csp-defender.md#excludedprocesses) -- [Defender/PUAProtection](policy-csp-defender.md#puaprotection) -- [Defender/RealTimeScanDirection](policy-csp-defender.md#realtimescandirection) -- [Defender/ScanParameter](policy-csp-defender.md#scanparameter) -- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime) -- [Defender/ScheduleScanDay](policy-csp-defender.md#schedulescanday) -- [Defender/ScheduleScanTime](policy-csp-defender.md#schedulescantime) -- [Defender/SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval) -- [Defender/SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#dodownloadmode) -- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated) -- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated) -- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md) (Deprecated) -- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#preventuserredirectionofprofilefolders) -- [RestrictedGroups/ConfigureGroupMembership](policy-csp-restrictedgroups.md#configuregroupmembership) -- [System/AllowLocation](policy-csp-system.md#allowlocation) -- [System/AllowStorageCard](policy-csp-system.md#allowstoragecard) -- [System/AllowTelemetry](policy-csp-system.md#allowtelemetry) -- [TextInput/AllowIMELogging](policy-csp-textinput.md#allowimelogging) -- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#allowimenetworkaccess) -- [TextInput/AllowInputPanel](policy-csp-textinput.md#allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](policy-csp-textinput.md#allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](policy-csp-textinput.md#allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](policy-csp-textinput.md#allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis) -- [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#configuretimezone) -- [Wifi/AllowInternetSharing](policy-csp-wifi.md#allowinternetsharing) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#allowmanualwificonfiguration) -- [Wifi/AllowWiFi](policy-csp-wifi.md#allowwifi) -- [Wifi/AllowWiFiHotSpotReporting](policy-csp-wifi.md) (Deprecated) -- [Wifi/WLANScanMode](policy-csp-wifi.md#wlanscanmode) -- [Wifi/AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect) -- [WirelessDisplay/AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement) -- [WirelessDisplay/AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#allowmdnsdiscovery) -- [WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay.md#allowprojectionfrompc) -- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectionfrompcoverinfrastructure) -- [WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay.md#allowprojectiontopc) -- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectiontopcoverinfrastructure) -- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#allowuserinputfromwirelessdisplayreceiver) -- [WirelessDisplay/RequirePinForPairing](policy-csp-wirelessdisplay.md#requirepinforpairing) +# Policies in Policy CSP supported by Windows 10 Team -## Related topics +This article lists the policies in Policy CSP that are applicable for the Surface Hub operating system, **Windows 10 Team**. -[Policy CSP](policy-configuration-service-provider.md) +## ApplicationDefaults + +- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md#defaultassociationsconfiguration) + +## ApplicationManagement + +- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#allowappstoreautoupdate) +- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md#allowdeveloperunlock) + +## Bluetooth + +- [AllowAdvertising](policy-csp-bluetooth.md#allowadvertising) +- [AllowDiscoverableMode](policy-csp-bluetooth.md#allowdiscoverablemode) +- [AllowPrepairing](policy-csp-bluetooth.md#allowprepairing) +- [AllowPromptedProximalConnections](policy-csp-bluetooth.md#allowpromptedproximalconnections) +- [LocalDeviceName](policy-csp-bluetooth.md#localdevicename) +- [ServicesAllowedList](policy-csp-bluetooth.md#servicesallowedlist) +- [SetMinimumEncryptionKeySize](policy-csp-bluetooth.md#setminimumencryptionkeysize) + +## Browser + +- [AllowAddressBarDropdown](policy-csp-browser.md#allowaddressbardropdown) +- [AllowAutofill](policy-csp-browser.md#allowautofill) +- [AllowBrowser](policy-csp-browser.md#allowbrowser) +- [AllowCookies](policy-csp-browser.md#allowcookies) +- [AllowDeveloperTools](policy-csp-browser.md#allowdevelopertools) +- [AllowDoNotTrack](policy-csp-browser.md#allowdonottrack) +- [AllowFlashClickToRun](policy-csp-browser.md#allowflashclicktorun) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#allowmicrosoftcompatibilitylist) +- [AllowPasswordManager](policy-csp-browser.md#allowpasswordmanager) +- [AllowPopups](policy-csp-browser.md#allowpopups) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#allowsearchsuggestionsinaddressbar) +- [AllowSmartScreen](policy-csp-browser.md#allowsmartscreen) +- [ClearBrowsingDataOnExit](policy-csp-browser.md#clearbrowsingdataonexit) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#configureadditionalsearchengines) +- [DisableLockdownOfStartPages](policy-csp-browser.md#disablelockdownofstartpages) +- [EnterpriseModeSiteList](policy-csp-browser.md#enterprisemodesitelist) +- [HomePages](policy-csp-browser.md#homepages) +- [PreventLiveTileDataCollection](policy-csp-browser.md#preventlivetiledatacollection) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md#preventsmartscreenpromptoverride) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#preventsmartscreenpromptoverrideforfiles) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#preventusinglocalhostipaddressforwebrtc) +- [SetDefaultSearchEngine](policy-csp-browser.md#setdefaultsearchengine) + +## Camera + +- [AllowCamera](policy-csp-camera.md#allowcamera) + +## Connectivity + +- [AllowBluetooth](policy-csp-connectivity.md#allowbluetooth) +- [AllowConnectedDevices](policy-csp-connectivity.md#allowconnecteddevices) + +## Cryptography + +- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#allowfipsalgorithmpolicy) +- [TLSCipherSuites](policy-csp-cryptography.md#tlsciphersuites) + +## Defender + +- [AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning) +- [AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring) +- [AllowCloudProtection](policy-csp-defender.md#allowcloudprotection) +- [AllowEmailScanning](policy-csp-defender.md#allowemailscanning) +- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives) +- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning) +- [AllowIntrusionPreventionSystem](policy-csp-defender.md#allowintrusionpreventionsystem) +- [AllowIOAVProtection](policy-csp-defender.md#allowioavprotection) +- [AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection) +- [AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) +- [AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) +- [AllowScriptScanning](policy-csp-defender.md#allowscriptscanning) +- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md#attacksurfacereductiononlyexclusions) +- [AttackSurfaceReductionRules](policy-csp-defender.md#attacksurfacereductionrules) +- [AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) +- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md#checkforsignaturesbeforerunningscan) +- [CloudBlockLevel](policy-csp-defender.md#cloudblocklevel) +- [CloudExtendedTimeout](policy-csp-defender.md#cloudextendedtimeout) +- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md#controlledfolderaccessallowedapplications) +- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md#controlledfolderaccessprotectedfolders) +- [DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware) +- [DisableCatchupFullScan](policy-csp-defender.md#disablecatchupfullscan) +- [DisableCatchupQuickScan](policy-csp-defender.md#disablecatchupquickscan) +- [EnableControlledFolderAccess](policy-csp-defender.md#enablecontrolledfolderaccess) +- [EnableLowCPUPriority](policy-csp-defender.md#enablelowcpupriority) +- [EnableNetworkProtection](policy-csp-defender.md#enablenetworkprotection) +- [ExcludedExtensions](policy-csp-defender.md#excludedextensions) +- [ExcludedPaths](policy-csp-defender.md#excludedpaths) +- [ExcludedProcesses](policy-csp-defender.md#excludedprocesses) +- [PUAProtection](policy-csp-defender.md#puaprotection) +- [RealTimeScanDirection](policy-csp-defender.md#realtimescandirection) +- [ScanParameter](policy-csp-defender.md#scanparameter) +- [ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime) +- [ScheduleScanDay](policy-csp-defender.md#schedulescanday) +- [ScheduleScanTime](policy-csp-defender.md#schedulescantime) +- [SecurityIntelligenceLocation](policy-csp-defender.md#securityintelligencelocation) +- [SignatureUpdateFallbackOrder](policy-csp-defender.md#signatureupdatefallbackorder) +- [SignatureUpdateFileSharesSources](policy-csp-defender.md#signatureupdatefilesharessources) +- [SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval) +- [SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent) +- [ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction) + +## DeliveryOptimization + +- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#doabsolutemaxcachesize) +- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#doallowvpnpeercaching) +- [DOCacheHost](policy-csp-deliveryoptimization.md#docachehost) +- [DOCacheHostSource](policy-csp-deliveryoptimization.md#docachehostsource) +- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#dodelaybackgrounddownloadfromhttp) +- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#dodelaycacheserverfallbackbackground) +- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#dodelaycacheserverfallbackforeground) +- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#dodelayforegrounddownloadfromhttp) +- [DODisallowCacheServerDownloadsOnVPN](policy-csp-deliveryoptimization.md#dodisallowcacheserverdownloadsonvpn) +- [DODownloadMode](policy-csp-deliveryoptimization.md#dodownloadmode) +- [DOGroupId](policy-csp-deliveryoptimization.md#dogroupid) +- [DOGroupIdSource](policy-csp-deliveryoptimization.md#dogroupidsource) +- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#domaxbackgrounddownloadbandwidth) +- [DOMaxCacheAge](policy-csp-deliveryoptimization.md#domaxcacheage) +- [DOMaxCacheSize](policy-csp-deliveryoptimization.md#domaxcachesize) +- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#domaxforegrounddownloadbandwidth) +- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md#dominbackgroundqos) +- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#dominbatterypercentageallowedtoupload) +- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#domindisksizeallowedtopeer) +- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#dominfilesizetocache) +- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#dominramallowedtopeer) +- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md#domodifycachedrive) +- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#domonthlyuploaddatacap) +- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#dopercentagemaxbackgroundbandwidth) +- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#dopercentagemaxforegroundbandwidth) +- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#dorestrictpeerselectionby) +- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitbackgrounddownloadbandwidth) +- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#dosethourstolimitforegrounddownloadbandwidth) +- [DOVpnKeywords](policy-csp-deliveryoptimization.md#dovpnkeywords) + +## ExploitGuard + +- [ExploitProtectionSettings](policy-csp-exploitguard.md#exploitprotectionsettings) + +## LocalUsersAndGroups + +- [Configure](policy-csp-localusersandgroups.md#configure) + +## NetworkIsolation + +- [EnterpriseCloudResources](policy-csp-networkisolation.md#enterprisecloudresources) +- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md#enterpriseinternalproxyservers) +- [EnterpriseIPRange](policy-csp-networkisolation.md#enterpriseiprange) +- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md#enterpriseiprangesareauthoritative) +- [EnterpriseNetworkDomainNames](policy-csp-networkisolation.md#enterprisenetworkdomainnames) +- [EnterpriseProxyServers](policy-csp-networkisolation.md#enterpriseproxyservers) +- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md#enterpriseproxyserversareauthoritative) +- [NeutralResources](policy-csp-networkisolation.md#neutralresources) + +## Privacy + +- [AllowInputPersonalization](policy-csp-privacy.md#allowinputpersonalization) +- [DisableAdvertisingId](policy-csp-privacy.md#disableadvertisingid) +- [LetAppsAccessAccountInfo](policy-csp-privacy.md#letappsaccessaccountinfo) +- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forceallowtheseapps) +- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_forcedenytheseapps) +- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessaccountinfo_userincontroloftheseapps) +- [LetAppsAccessCalendar](policy-csp-privacy.md#letappsaccesscalendar) +- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscalendar_forceallowtheseapps) +- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscalendar_forcedenytheseapps) +- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscalendar_userincontroloftheseapps) +- [LetAppsAccessCallHistory](policy-csp-privacy.md#letappsaccesscallhistory) +- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_forceallowtheseapps) +- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_forcedenytheseapps) +- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscallhistory_userincontroloftheseapps) +- [LetAppsAccessCamera](policy-csp-privacy.md#letappsaccesscamera) +- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscamera_forceallowtheseapps) +- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscamera_forcedenytheseapps) +- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscamera_userincontroloftheseapps) +- [LetAppsAccessContacts](policy-csp-privacy.md#letappsaccesscontacts) +- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesscontacts_forceallowtheseapps) +- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesscontacts_forcedenytheseapps) +- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesscontacts_userincontroloftheseapps) +- [LetAppsAccessEmail](policy-csp-privacy.md#letappsaccessemail) +- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessemail_forceallowtheseapps) +- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessemail_forcedenytheseapps) +- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessemail_userincontroloftheseapps) +- [LetAppsAccessLocation](policy-csp-privacy.md#letappsaccesslocation) +- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesslocation_forceallowtheseapps) +- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesslocation_forcedenytheseapps) +- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesslocation_userincontroloftheseapps) +- [LetAppsAccessMessaging](policy-csp-privacy.md#letappsaccessmessaging) +- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmessaging_forceallowtheseapps) +- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmessaging_forcedenytheseapps) +- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmessaging_userincontroloftheseapps) +- [LetAppsAccessMicrophone](policy-csp-privacy.md#letappsaccessmicrophone) +- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forceallowtheseapps) +- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_forcedenytheseapps) +- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessmicrophone_userincontroloftheseapps) +- [LetAppsAccessNotifications](policy-csp-privacy.md#letappsaccessnotifications) +- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessnotifications_forceallowtheseapps) +- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessnotifications_forcedenytheseapps) +- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessnotifications_userincontroloftheseapps) +- [LetAppsAccessPhone](policy-csp-privacy.md#letappsaccessphone) +- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessphone_forceallowtheseapps) +- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessphone_forcedenytheseapps) +- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessphone_userincontroloftheseapps) +- [LetAppsAccessRadios](policy-csp-privacy.md#letappsaccessradios) +- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccessradios_forceallowtheseapps) +- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccessradios_forcedenytheseapps) +- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccessradios_userincontroloftheseapps) +- [LetAppsAccessTasks](policy-csp-privacy.md#letappsaccesstasks) +- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstasks_forceallowtheseapps) +- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstasks_forcedenytheseapps) +- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstasks_userincontroloftheseapps) +- [LetAppsAccessTrustedDevices](policy-csp-privacy.md#letappsaccesstrusteddevices) +- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_forceallowtheseapps) +- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_forcedenytheseapps) +- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappsaccesstrusteddevices_userincontroloftheseapps) +- [LetAppsActivateWithVoice](policy-csp-privacy.md#letappsactivatewithvoice) +- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#letappsactivatewithvoiceabovelock) +- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md#letappsgetdiagnosticinfo) +- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_forceallowtheseapps) +- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_forcedenytheseapps) +- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#letappsgetdiagnosticinfo_userincontroloftheseapps) +- [LetAppsRunInBackground](policy-csp-privacy.md#letappsruninbackground) +- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#letappsruninbackground_forceallowtheseapps) +- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#letappsruninbackground_forcedenytheseapps) +- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#letappsruninbackground_userincontroloftheseapps) +- [LetAppsSyncWithDevices](policy-csp-privacy.md#letappssyncwithdevices) +- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#letappssyncwithdevices_forceallowtheseapps) +- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#letappssyncwithdevices_forcedenytheseapps) +- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#letappssyncwithdevices_userincontroloftheseapps) + +## RestrictedGroups + +- [ConfigureGroupMembership](policy-csp-restrictedgroups.md#configuregroupmembership) + +## Security + +- [RecoveryEnvironmentAuthentication](policy-csp-security.md#recoveryenvironmentauthentication) +- [RequireProvisioningPackageSignature](policy-csp-security.md#requireprovisioningpackagesignature) +- [RequireRetrieveHealthCertificateOnBoot](policy-csp-security.md#requireretrievehealthcertificateonboot) + +## Start + +- [StartLayout](policy-csp-start.md#startlayout) + +## System + +- [AllowBuildPreview](policy-csp-system.md#allowbuildpreview) +- [AllowExperimentation](policy-csp-system.md#allowexperimentation) +- [AllowFontProviders](policy-csp-system.md#allowfontproviders) +- [AllowLocation](policy-csp-system.md#allowlocation) +- [AllowStorageCard](policy-csp-system.md#allowstoragecard) +- [AllowTelemetry](policy-csp-system.md#allowtelemetry) + +## TextInput + +- [AllowHardwareKeyboardTextSuggestions](policy-csp-textinput.md#allowhardwarekeyboardtextsuggestions) +- [AllowIMELogging](policy-csp-textinput.md#allowimelogging) +- [AllowIMENetworkAccess](policy-csp-textinput.md#allowimenetworkaccess) +- [AllowInputPanel](policy-csp-textinput.md#allowinputpanel) +- [AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#allowjapaneseimesurrogatepaircharacters) +- [AllowJapaneseIVSCharacters](policy-csp-textinput.md#allowjapaneseivscharacters) +- [AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#allowjapanesenonpublishingstandardglyph) +- [AllowJapaneseUserDictionary](policy-csp-textinput.md#allowjapaneseuserdictionary) +- [AllowKeyboardTextSuggestions](policy-csp-textinput.md#allowkeyboardtextsuggestions) +- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md#allowlanguagefeaturesuninstall) +- [AllowLinguisticDataCollection](policy-csp-textinput.md#allowlinguisticdatacollection) +- [AllowTextInputSuggestionUpdate](policy-csp-textinput.md#allowtextinputsuggestionupdate) +- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md#configurejapaneseimeversion) +- [ConfigureKoreanIMEVersion](policy-csp-textinput.md#configurekoreanimeversion) +- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#configuresimplifiedchineseimeversion) +- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#configuretraditionalchineseimeversion) +- [EnableTouchKeyboardAutoInvokeInDesktopMode](policy-csp-textinput.md#enabletouchkeyboardautoinvokeindesktopmode) +- [ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#excludejapaneseimeexceptjis0208) +- [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc) +- [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis) +- [ForceTouchKeyboardDockedState](policy-csp-textinput.md#forcetouchkeyboarddockedstate) +- [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md#touchkeyboarddictationbuttonavailability) +- [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md#touchkeyboardemojibuttonavailability) +- [TouchKeyboardFullModeAvailability](policy-csp-textinput.md#touchkeyboardfullmodeavailability) +- [TouchKeyboardHandwritingModeAvailability](policy-csp-textinput.md#touchkeyboardhandwritingmodeavailability) +- [TouchKeyboardNarrowModeAvailability](policy-csp-textinput.md#touchkeyboardnarrowmodeavailability) +- [TouchKeyboardSplitModeAvailability](policy-csp-textinput.md#touchkeyboardsplitmodeavailability) +- [TouchKeyboardWideModeAvailability](policy-csp-textinput.md#touchkeyboardwidemodeavailability) + +## TimeLanguageSettings + +- [ConfigureTimeZone](policy-csp-timelanguagesettings.md#configuretimezone) + +## Update + +- [ActiveHoursEnd](policy-csp-update.md#activehoursend) +- [ActiveHoursMaxRange](policy-csp-update.md#activehoursmaxrange) +- [ActiveHoursStart](policy-csp-update.md#activehoursstart) +- [AllowAutoUpdate](policy-csp-update.md#allowautoupdate) +- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md#allowautowindowsupdatedownloadovermeterednetwork) +- [AllowMUUpdateService](policy-csp-update.md#allowmuupdateservice) +- [AllowNonMicrosoftSignedUpdate](policy-csp-update.md#allownonmicrosoftsignedupdate) +- [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol) +- [AllowUpdateService](policy-csp-update.md#allowupdateservice) +- [BranchReadinessLevel](policy-csp-update.md#branchreadinesslevel) +- [ConfigureFeatureUpdateUninstallPeriod](policy-csp-update.md#configurefeatureupdateuninstallperiod) +- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#deferfeatureupdatesperiodindays) +- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md#deferqualityupdatesperiodindays) +- [DeferUpdatePeriod](policy-csp-update.md#deferupdateperiod) +- [DeferUpgradePeriod](policy-csp-update.md#deferupgradeperiod) +- [DetectionFrequency](policy-csp-update.md#detectionfrequency) +- [DisableDualScan](policy-csp-update.md#disabledualscan) +- [DisableWUfBSafeguards](policy-csp-update.md#disablewufbsafeguards) +- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#donotenforceenterprisetlscertpinningforupdatedetection) +- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#excludewudriversinqualityupdate) +- [FillEmptyContentUrls](policy-csp-update.md#fillemptycontenturls) +- [IgnoreMOAppDownloadLimit](policy-csp-update.md#ignoremoappdownloadlimit) +- [IgnoreMOUpdateDownloadLimit](policy-csp-update.md#ignoremoupdatedownloadlimit) +- [ManagePreviewBuilds](policy-csp-update.md#managepreviewbuilds) +- [PauseDeferrals](policy-csp-update.md#pausedeferrals) +- [PauseFeatureUpdates](policy-csp-update.md#pausefeatureupdates) +- [PauseFeatureUpdatesStartTime](policy-csp-update.md#pausefeatureupdatesstarttime) +- [PauseQualityUpdates](policy-csp-update.md#pausequalityupdates) +- [PauseQualityUpdatesStartTime](policy-csp-update.md#pausequalityupdatesstarttime) +- [RequireDeferUpgrade](policy-csp-update.md#requiredeferupgrade) +- [RequireUpdateApproval](policy-csp-update.md#requireupdateapproval) +- [ScheduledInstallDay](policy-csp-update.md#scheduledinstallday) +- [ScheduledInstallEveryWeek](policy-csp-update.md#scheduledinstalleveryweek) +- [ScheduledInstallFirstWeek](policy-csp-update.md#scheduledinstallfirstweek) +- [ScheduledInstallFourthWeek](policy-csp-update.md#scheduledinstallfourthweek) +- [ScheduledInstallSecondWeek](policy-csp-update.md#scheduledinstallsecondweek) +- [ScheduledInstallThirdWeek](policy-csp-update.md#scheduledinstallthirdweek) +- [ScheduledInstallTime](policy-csp-update.md#scheduledinstalltime) +- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md#setpolicydrivenupdatesourcefordriverupdates) +- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforfeatureupdates) +- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforotherupdates) +- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md#setpolicydrivenupdatesourceforqualityupdates) +- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md#setproxybehaviorforupdatedetection) +- [UpdateServiceUrl](policy-csp-update.md#updateserviceurl) +- [UpdateServiceUrlAlternate](policy-csp-update.md#updateserviceurlalternate) + +## Wifi + +- [AllowInternetSharing](policy-csp-wifi.md#allowinternetsharing) +- [AllowManualWiFiConfiguration](policy-csp-wifi.md#allowmanualwificonfiguration) +- [AllowWiFi](policy-csp-wifi.md#allowwifi) +- [AllowWiFiDirect](policy-csp-wifi.md#allowwifidirect) +- [WLANScanMode](policy-csp-wifi.md#wlanscanmode) + +## WirelessDisplay + +- [AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#allowmdnsadvertisement) +- [AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#allowmdnsdiscovery) +- [AllowMovementDetectionOnInfrastructure](policy-csp-wirelessdisplay.md#allowmovementdetectiononinfrastructure) +- [AllowPCReceiverToBeTCPServer](policy-csp-wirelessdisplay.md#allowpcreceivertobetcpserver) +- [AllowPCSenderToBeTCPClient](policy-csp-wirelessdisplay.md#allowpcsendertobetcpclient) +- [AllowProjectionFromPC](policy-csp-wirelessdisplay.md#allowprojectionfrompc) +- [AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectionfrompcoverinfrastructure) +- [AllowProjectionToPC](policy-csp-wirelessdisplay.md#allowprojectiontopc) +- [AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#allowprojectiontopcoverinfrastructure) +- [AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#allowuserinputfromwirelessdisplayreceiver) +- [RequirePinForPairing](policy-csp-wirelessdisplay.md#requirepinforpairing) + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index bdb6a819f1..f6ee903aef 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -4,7 +4,7 @@ description: Learn more about the AboveLock Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -40,7 +40,7 @@ ms.topic: reference -This policy is deprecated +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 44c49be631..a9ee824925 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -4,7 +4,7 @@ description: Learn more about the Accounts Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0 +Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0. > [!NOTE] > This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the EMAIL2 CSP. @@ -138,10 +138,10 @@ Specifies whether the user is allowed to use an MSA account for non-email relate -Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service +Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service. > [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates are not being offered while other updates are +> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates are not being offered while other updates are. > [!NOTE] > If the MSA service is disabled, the Subscription Activation feature will not work properly and your users will not be able to "step-up" from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication cannot be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app. diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 58e17f5f98..d1170a124f 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_AddRemovePrograms Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -110,7 +110,7 @@ You can use this setting to direct users to the programs they are most likely to Removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media. -- If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. +If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. This setting does not prevent users from using other tools and methods to add or remove program components. @@ -173,7 +173,7 @@ This setting does not prevent users from using other tools and methods to add or Removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update. -- If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. +If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. This setting does not prevent users from using other tools and methods to connect to Windows Update. @@ -305,7 +305,7 @@ Removes the Add New Programs button from the Add or Remove Programs bar. As a re The Add New Programs button lets users install programs published or assigned by a system administrator. -- If you disable this setting or do not configure it, the Add New Programs button is available to all users. +If you disable this setting or do not configure it, the Add New Programs button is available to all users. This setting does not prevent users from using other tools and methods to install programs. @@ -369,7 +369,7 @@ This setting removes Add or Remove Programs from Control Panel and removes the A Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs. -- If you disable this setting or do not configure it, Add or Remove Programs is available to all users. +If you disable this setting or do not configure it, Add or Remove Programs is available to all users. When enabled, this setting takes precedence over the other settings in this folder. @@ -433,7 +433,7 @@ Removes the Set Program Access and Defaults button from the Add or Remove Progra The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. -- If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. +If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. @@ -497,7 +497,7 @@ Removes the Change or Remove Programs button from the Add or Remove Programs bar The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs. -- If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. +If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. This setting does not prevent users from using other tools and methods to delete or uninstall programs. @@ -560,6 +560,7 @@ Prevents users from using Add or Remove Programs to configure installed services This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools. - If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. + - If you enable this setting, "Set up services" never appears. This setting does not prevent users from using other methods to configure services. @@ -627,7 +628,7 @@ Removes links to the Support Info dialog box from programs on the Change or Remo Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page. -- If you disable this setting or do not configure it, the Support Info hyperlink appears. +If you disable this setting or do not configure it, the Support Info hyperlink appears. > [!NOTE] > Not all programs provide a support information hyperlink. @@ -690,7 +691,7 @@ Removes the Add/Remove Windows Components button from the Add or Remove Programs The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files. -- If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. +If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard. diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index a0d2e3d901..d864def13f 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_AppCompat Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -241,7 +241,8 @@ The Windows Resource Protection and User Account Control features of Windows use This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential. -NOTE: Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes. +> [!NOTE] +> Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes. diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index 8e82cda5ea..9df41c0e25 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_AuditSettings Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,6 +45,7 @@ ms.topic: reference This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. + - If you enable this policy setting the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. - If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 6c2d52f8d1..4381ecdcb1 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CipherSuiteOrder Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -117,7 +117,7 @@ NistP384 To See all the curves supported on the system, Use the following command: -CertUtil.exe -DisplayEccCurve +CertUtil.exe -DisplayEccCurve. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index 4a3df26d6e..07bb2c18f1 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ControlPanel Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. -- If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. +If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft. Mouse, Microsoft. System, or Microsoft. Personalization. @@ -120,6 +120,7 @@ This policy setting controls the default Control Panel view, whether by category - If this policy setting is disabled, the Control Panel opens to the category view. - If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session. + > [!NOTE] > Icon size is dependent upon what the user has set it to in the previous session. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 68499c0c39..e751b4fa8b 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ControlPanelDisplay Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/13/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Disables the Display Control Panel. -- If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. +If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu & Taskbar) settings. @@ -537,7 +537,7 @@ Prevents users from changing the background image shown when the machine is lock By default, users can change the background image shown when the machine is locked or displaying the logon screen. -- If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image. +If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image. @@ -597,7 +597,7 @@ Prevents users from changing the look of their start menu background, such as it By default, users can change the look of their start menu background, such as its color or accent. -- If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them. +If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them. If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy. @@ -661,7 +661,7 @@ Disables the Color (or Window Color) page in the Personalization Control Panel, This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows. -- If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel. +If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel. For systems prior to Windows Vista, this setting hides the Appearance and Themes tabs in the in Display in Control Panel. @@ -723,7 +723,7 @@ Prevents users from adding or changing the background design of the desktop. By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop. -- If you enable this setting, none of the Desktop Background settings can be changed by the user. +If you enable this setting, none of the Desktop Background settings can be changed by the user. To specify wallpaper for a group, use the "Desktop Wallpaper" setting. @@ -790,7 +790,7 @@ Prevents users from changing the desktop icons. By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons. -- If you enable this setting, none of the desktop icons can be changed by the user. +If you enable this setting, none of the desktop icons can be changed by the user. For systems prior to Windows Vista, this setting also hides the Desktop tab in the Display Control Panel. @@ -912,7 +912,7 @@ Prevents users from changing the mouse pointers. By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers. -- If you enable this setting, none of the mouse pointer scheme settings can be changed by the user. +If you enable this setting, none of the mouse pointer scheme settings can be changed by the user. @@ -1030,7 +1030,7 @@ Prevents users from changing the sound scheme. By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme. -- If you enable this setting, none of the Sound Scheme settings can be changed by the user. +If you enable this setting, none of the Sound Scheme settings can be changed by the user. @@ -1090,7 +1090,7 @@ Forces Windows to use the specified colors for the background and accent. The co By default, users can change the background and accent colors. -- If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text. +If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text. diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index 9ded8c68b8..90a95f4010 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CredentialProviders Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -173,7 +173,7 @@ credential providers from use during authentication. **Note** credential providers are used to process and validate user credentials during logon or when authentication is required. -Windows Vista provides two default credential providers +Windows Vista provides two default credential providers: Password and Smart Card. An administrator can install additional credential providers for different sets of credentials (for example, to support biometric authentication). diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 6af877c393..336f4f912a 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CredSsp Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -50,7 +50,7 @@ This policy setting applies when server authentication was achieved by using a t The policy becomes effective the next time the user signs on to a computer running Windows. -If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. +- If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. FWlink for KB: @@ -61,7 +61,7 @@ FWlink for KB: For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com. @@ -123,7 +123,7 @@ This policy setting applies when server authentication was achieved via NTLM. - If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). -If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. +- If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. > [!NOTE] > The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. @@ -131,7 +131,7 @@ If you disable or do not configure (by default) this policy setting, delegation For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com. @@ -189,19 +189,19 @@ TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all Encryption Oracle Remediation -This policy setting applies to applications using the CredSSP component (for example Remote Desktop Connection). +This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection). Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability. -- If you enable this policy setting, CredSSP version support will be selected based on the following options +If you enable this policy setting, CredSSP version support will be selected based on the following options: -Force Updated Clients Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. **Note** this setting should not be deployed until all remote hosts support the newest version. +Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. **Note** this setting should not be deployed until all remote hosts support the newest version. -Mitigated Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. +Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. -Vulnerable Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. +Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. -For more information about the vulnerability and servicing requirements for protection, see +For more information about the vulnerability and servicing requirements for protection, see @@ -262,7 +262,7 @@ This policy setting applies when server authentication was achieved via a truste - If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). - If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. @@ -273,7 +273,7 @@ For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com. @@ -335,7 +335,7 @@ This policy setting applies when server authentication was achieved via NTLM. - If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). - If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. @@ -345,7 +345,7 @@ If you do not configure (by default) this policy setting, after proper mutual au For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com. @@ -407,7 +407,7 @@ This policy setting applies when server authentication was achieved via a truste - If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). - If you disable this policy setting, delegation of saved credentials is not permitted to any machine. @@ -417,7 +417,7 @@ If you do not configure (by default) this policy setting, after proper mutual au For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com. @@ -479,7 +479,7 @@ This policy setting applies when server authentication was achieved via NTLM. - If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). -If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine. +- If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine. - If you disable this policy setting, delegation of saved credentials is not permitted to any machine. @@ -489,7 +489,7 @@ If you do not configure (by default) this policy setting, after proper mutual au For Example: TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine TERMSRV/* Remote Desktop Session Host running on all machines. -TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com. @@ -549,7 +549,7 @@ This policy setting applies to applications using the Cred SSP component (for ex - If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows). -If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. +- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. > [!NOTE] > The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. @@ -619,7 +619,7 @@ This policy setting applies to applications using the Cred SSP component (for ex - If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application). -If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. +- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. > [!NOTE] > The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. @@ -689,7 +689,7 @@ This policy setting applies to applications using the Cred SSP component (for ex - If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). -If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. +- If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. > [!NOTE] > The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index 16b4681320..84347d6bd5 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_CtrlAltDel Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This policy setting prevents users from changing their Windows password on demand. -- If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del. +If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del. However, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring. diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index d658533761..fcae6c76a0 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DataCollection Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This policy setting defines the identifier used to uniquely associate this device's diagnostic data data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. -- If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data data with your organization. +If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data data with your organization. diff --git a/windows/client-management/mdm/policy-csp-admx-dcom.md b/windows/client-management/mdm/policy-csp-admx-dcom.md index 61fe97ffea..57e6837e05 100644 --- a/windows/client-management/mdm/policy-csp-admx-dcom.md +++ b/windows/client-management/mdm/policy-csp-admx-dcom.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DCOM Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -107,7 +107,7 @@ Allows you to specify that local computer administrators can supplement the "Def Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation security check. DCOM uses two such lists, one configured via Group Policy through this policy setting, and the other via the actions of local computer administrators. DCOM ignores the second list when this policy setting is configured, unless the "Allow local activation security check exemptions" policy is enabled. -DCOM server appids added to this policy must be listed in curly-brace format. For example: {b5dcb061-cefb-42e0-a1be-e6a6438133fe}. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors. +DCOM server appids added to this policy must be listed in curly-brace format. For Example: `{b5dcb061-cefb-42e0-a1be-e6a6438133fe}`. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors. - If you enable this policy setting, you can view and change the list of DCOM activation security check exemptions defined by Group Policy settings. If you add an appid to this list and set its value to 1, DCOM will not enforce the Activation security check for that DCOM server. If you add an appid to this list and set its value to 0 DCOM will always enforce the Activation security check for that DCOM server regardless of local settings. diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 69fb32dabf..4a0662062e 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Desktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -233,7 +233,7 @@ Enables Active Desktop and prevents users from disabling it. This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. -- If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. > [!NOTE] > If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting ( in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored. @@ -296,7 +296,7 @@ Disables Active Desktop and prevents users from enabling it. This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. -- If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. > [!NOTE] > If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored. @@ -1098,7 +1098,7 @@ Removes the Properties option from the Recycle Bin context menu. Prevents users from saving certain changes to the desktop. -- If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. +If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. @@ -1343,7 +1343,7 @@ Prevents users from removing Web content from their Active Desktop. In Active Desktop, you can add items to the desktop but close them so they are not displayed. -- If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel. +If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel. > [!NOTE] > This setting does not prevent users from deleting items from their Active Desktop. @@ -1585,7 +1585,7 @@ This setting removes all Active Desktop items from the desktop. It also removes Prevents users from manipulating desktop toolbars. -- If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. +If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. > [!NOTE] > If users have added or removed toolbars, this setting prevents them from restoring the default configuration. @@ -1776,7 +1776,7 @@ This setting lets you specify the wallpaper on users' desktops and prevents user To use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification. -- If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice. +If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice. Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel. diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index 1deaa9fc80..e0d3710fed 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DeviceInstallation Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,6 +45,7 @@ ms.topic: reference This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings. - If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation. @@ -345,9 +346,11 @@ This policy setting establishes the amount of time (in seconds) that the system This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. -NOTE: To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. +> [!NOTE] +> To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. - If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, Windows can install and update driver packages for removable devices as allowed or prevented by other policy settings. diff --git a/windows/client-management/mdm/policy-csp-admx-diskquota.md b/windows/client-management/mdm/policy-csp-admx-diskquota.md index a8d0a1bea1..30316a20e8 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskquota.md +++ b/windows/client-management/mdm/policy-csp-admx-diskquota.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_DiskQuota Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -189,7 +189,7 @@ This setting overrides new users' settings for the disk quota limit and warning This policy setting applies to all new users as soon as they write to the volume. It does not affect disk quota limits for current users, or affect customized limits and warning levels set for particular users (on the Quota tab in Volume Properties). -- If you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level. +If you disable or do not configure this policy setting, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level. When you select a limit, remember that the same limit applies to all users on all volumes, regardless of actual volume size. Be sure to set the limit and warning level so that it is reasonable for the range of volumes in the group. @@ -384,7 +384,7 @@ This policy setting does not affect the Quota Entries window on the Quota tab. E This policy setting extends the disk quota policies in this folder to NTFS file system volumes on removable media. -- If you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only +If you disable or do not configure this policy setting, the disk quota policies established in this folder apply to fixed-media NTFS volumes only. > [!NOTE] > When this policy setting is applied, the computer will apply the disk quota to both fixed and removable media. diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 600645f1cf..17b77f1279 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ErrorReporting Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -243,6 +243,7 @@ This policy setting does not enable or disable Windows Error Reporting. To turn > If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting. - If you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel). + - If you enable this policy setting, you can configure the following settings in the policy setting: - "Do not display links to any Microsoft 'More information' websites": Select this option if you do not want error dialog boxes to display links to Microsoft websites. @@ -1425,6 +1426,7 @@ This policy setting turns off Windows Error Reporting, so that reports are not c This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. - If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. + - If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. - If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. @@ -1485,6 +1487,7 @@ This policy setting limits Windows Error Reporting behavior for errors in genera This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. - If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. + - If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. - If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md index e1e98092d9..1164b582ab 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlog.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_EventLog Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -973,7 +973,7 @@ This policy setting controls Event Log behavior when the log file reaches its ma This policy setting turns on logging. -- If you enable or do not configure this policy setting, then events can be written to this log. +If you enable or do not configure this policy setting, then events can be written to this log. If the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting. diff --git a/windows/client-management/mdm/policy-csp-admx-eventviewer.md b/windows/client-management/mdm/policy-csp-admx-eventviewer.md index c0b5223b4c..ec7f4e721d 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventviewer.md +++ b/windows/client-management/mdm/policy-csp-admx-eventviewer.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_EventViewer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -97,7 +97,7 @@ This is the program that will be invoked when the user clicks the events.asp lin -This specifies the command line parameters that will be passed to the events.asp program +This specifies the command line parameters that will be passed to the events.asp program. diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index 1d565c61b0..1508b4ca33 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Explorer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -165,7 +165,7 @@ This policy setting configures File Explorer to always display the menu bar. This policy setting allows administrators who have configured roaming profile in conjunction with Delete Cached Roaming Profile Group Policy setting to ensure that Explorer will not reinitialize default program associations and other settings to default values. -- If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. +If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md index 329a7e9c63..cf01947874 100644 --- a/windows/client-management/mdm/policy-csp-admx-filesys.md +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_FileSys Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Compression can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of compressed files. -A reboot is required for this setting to take effect +A reboot is required for this setting to take effect. @@ -161,7 +161,7 @@ A value of 1 will disable delete notifications for all volumes. Encryption can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of encrypted files. -A reboot is required for this setting to take effect +A reboot is required for this setting to take effect. @@ -395,7 +395,8 @@ Remote Link to Local Target For further information please refer to the Windows Help section -NOTE: If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated. +> [!NOTE] +> If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated. diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md index e3ca25a214..ef355a430a 100644 --- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_FolderRedirection Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -115,7 +115,7 @@ This policy setting allows you to control whether individual redirected shell fo For the folders affected by this setting, users must manually select the files they wish to make available offline. -- If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. +If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. > [!NOTE] > This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface. diff --git a/windows/client-management/mdm/policy-csp-admx-framepanes.md b/windows/client-management/mdm/policy-csp-admx-framepanes.md index 898a9c4f92..00c5fcc190 100644 --- a/windows/client-management/mdm/policy-csp-admx-framepanes.md +++ b/windows/client-management/mdm/policy-csp-admx-framepanes.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_FramePanes Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,9 +44,9 @@ ms.topic: reference This policy setting shows or hides the Details Pane in File Explorer. -- If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user. +If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user. -- If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user +If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user. > [!NOTE] > This has a side effect of not being able to toggle to the Preview Pane since the two cannot be displayed at the same time. @@ -108,7 +108,7 @@ If you disable, or do not configure this policy setting, the Details Pane is hid Hides the Preview Pane in File Explorer. -- If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user. +If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user. If you disable, or do not configure this setting, the Preview Pane is hidden by default and can be displayed by the user. diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md index f755796c17..f1ef50e530 100644 --- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_GroupPolicy Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -47,10 +47,10 @@ This policy setting allows user-based policy processing, roaming user profiles, This policy setting affects all user accounts that interactively log on to a computer in a different forest when a trust across forests or a two-way forest trust exists. - If you do not configure this policy setting: -- No user-based policy settings are applied from the user's forest. -- Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted. -- Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer. -- An event log message (1109) is posted, stating that loopback was invoked in Replace mode. + - No user-based policy settings are applied from the user's forest. + - Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted. + - Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer. + - An event log message (1109) is posted, stating that loopback was invoked in Replace mode. - If you enable this policy setting, the behavior is exactly the same as in Windows 2000: user policy is applied, and a roaming user profile is allowed from the trusted forest. @@ -1117,7 +1117,8 @@ Changing the status of this setting to Enabled will keep any source files from c Changing the status of this setting to Disabled will enforce the default behavior. Files will always be copied to the GPO if they have a later timestamp. -NOTE: If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled. +> [!NOTE] +> If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled. @@ -1496,6 +1497,7 @@ The timeout value that is defined in this policy setting determines how long Gro This policy setting allows you to configure Group Policy caching behavior on Windows Server machines. + - If you enable this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the "Configure Group Policy Slow Link Detection" policy setting to configure asynchronous foreground behavior.) The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds. The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds. @@ -1819,7 +1821,7 @@ The system's response to a slow policy connection varies among policies. The pro This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder. -Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile +Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. > [!NOTE] > If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. @@ -1889,7 +1891,7 @@ The system's response to a slow policy connection varies among policies. The pro This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder. -Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile +Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. > [!NOTE] > If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. @@ -2231,7 +2233,7 @@ This setting allows you to specify the default name for new Group Policy objects The display name can contain environment variables and can be a maximum of 255 characters long. -- If this setting is disabled or Not Configured, the default display name of New Group Policy object is used. +If this setting is Disabled or Not Configured, the default display name of New Group Policy object is used. @@ -2694,12 +2696,10 @@ This policy directs Group Policy processing to skip processing any client side e - If you enable this policy setting, when a slow network connection is detected, Group Policy processing will always run in an asynchronous manner. Client computers will not wait for the network to be fully initialized at startup and logon. Existing users will be logged on using cached credentials, which will result in shorter logon times. Group Policy will be applied in the background after the network becomes available. -> [!NOTE] -> that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection +**Note** that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection and Drive Maps preference extension will not be applied. -> [!NOTE] -> There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled: +**Note** There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled: 1 - At the first computer startup after the client computer has joined the domain. 2 - If the policy setting "Always wait for the network at computer startup and logon" is enabled. @@ -2821,6 +2821,7 @@ This policy setting specifies how long Group Policy should wait for network avai This policy setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user setting based on the computer that is being used. By default, the user's Group Policy Objects determine which user settings apply. + - If this setting is enabled, then, when a user logs on to this computer, the computer's Group Policy Objects determine which set of Group Policy Objects applies. - If you enable this setting, you can select one of the following modes from the Mode box: diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index 08e004e302..c125af97bc 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Help Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -187,7 +187,7 @@ This policy setting allows you to restrict programs from being run from online H > You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. > [!NOTE] -> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. @@ -252,7 +252,7 @@ This policy setting allows you to restrict programs from being run from online H > You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. > [!NOTE] -> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md index 27fdebb0e8..962e5c380e 100644 --- a/windows/client-management/mdm/policy-csp-admx-icm.md +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -555,11 +555,11 @@ The Knowledge Base is an online source of technical support information and self This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. -- If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. +- If you enable this setting, all of the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. -- If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. +- If you disable this policy setting, all of the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. -- If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. +- If you do not configure this policy setting, all of the policy settings in the "Internet Communication settings" section are set to not configured. @@ -617,11 +617,11 @@ This policy setting specifies whether Windows can access the Internet to accompl This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. -- If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. +- If you enable this setting, all of the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. -- If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. +- If you disable this policy setting, all of the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. -- If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. +- If you do not configure this policy setting, all of the policy settings in the "Internet Communication settings" section are set to not configured. diff --git a/windows/client-management/mdm/policy-csp-admx-iis.md b/windows/client-management/mdm/policy-csp-admx-iis.md index 0af1df4d24..6ac2bb4f65 100644 --- a/windows/client-management/mdm/policy-csp-admx-iis.md +++ b/windows/client-management/mdm/policy-csp-admx-iis.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_IIS Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -43,6 +43,7 @@ ms.topic: reference "This policy setting prevents installation of Internet Information Services (IIS) on this computer. + - If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not receive a warning that IIS cannot be installed because of this Group Policy setting. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer. - If you disable or do not configure this policy setting, IIS can be installed, as well as all the programs and applications that require IIS to run." diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md index 0b0cd3777a..3a5a0abee3 100644 --- a/windows/client-management/mdm/policy-csp-admx-kdc.md +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_kdc Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -59,8 +59,8 @@ Domain functional level requirements For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the "Supported" option is selected. When the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and: -- If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST). -- If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages. + - If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST). + - If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages. > [!WARNING] > When "Fail unarmored authentication requests" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller. @@ -68,9 +68,9 @@ When the domain functional level is set to Windows Server 2012 then the domain c To ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the "Supported" option is enabled). Impact on domain controller performance when this policy setting is enabled: -- Secure Kerberos domain capability discovery is required resulting in additional message exchanges. -- Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size. -- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size. + - Secure Kerberos domain capability discovery is required resulting in additional message exchanges. + - Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size. + - Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size. diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md index 1845af6733..2a492d3afd 100644 --- a/windows/client-management/mdm/policy-csp-admx-kerberos.md +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Kerberos Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -237,6 +237,7 @@ This policy setting allows you to specify which DNS host names and which DNS suf This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server. - If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections. + > [!WARNING] > When revocation check is ignored, the server represented by the certificate is not guaranteed valid. diff --git a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md index 3908dc2a9b..566b0c5342 100644 --- a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_LeakDiagnostic Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -49,8 +49,8 @@ This policy setting determines whether Diagnostic Policy Service (DPS) diagnoses - If you disable this policy setting, the DPS is not able to diagnose memory leak problems. This policy setting takes effect only under the following conditions: -- If the diagnostics-wide scenario execution policy is not configured. -- When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. + - If the diagnostics-wide scenario execution policy is not configured. + - When the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios are not executed. > [!NOTE] > The DPS can be configured with the Services snap-in to the Microsoft Management Console. diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md index d95dcfdb4f..8854f1a0e9 100644 --- a/windows/client-management/mdm/policy-csp-admx-logon.md +++ b/windows/client-management/mdm/policy-csp-admx-logon.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Logon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -839,15 +839,15 @@ If a user with a roaming profile, home directory, or user object logon script lo On servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup). -If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon -- The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and -- The "Allow asynchronous user Group Policy processing when logging on through Terminal Services" policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\. +If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon: + - The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and + - The "Allow asynchronous user Group Policy processing when logging on through Terminal Services" policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\. If this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon). - If you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background. -**Note** +**Note**: -If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy. -If Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available. diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 7cc5313827..07eef1894d 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MicrosoftDefenderAntivirus Area in Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -589,7 +589,7 @@ This policy setting allows you to disable scheduled and real-time scanning for f -This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as "c\windows\app.exe". The value is not used and it is recommended that this be set to 0. +This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0. @@ -650,8 +650,8 @@ Exclude files and paths from Attack Surface Reduction (ASR) rules. Enabled: Specify the folders or files and resources that should be excluded from ASR rules in the Options section. Enter each rule on a new line as a name-value pair: -- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder -- Value column: Enter "0" for each item + - Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder + - Value column: Enter "0" for each item Disabled: No exclusions will be applied to the ASR rules. @@ -718,26 +718,26 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s Set the state for each Attack Surface Reduction (ASR) rule. After enabling this setting, you can set each rule to the following in the Options section: -- Block: the rule will be applied -- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) -- Off: the rule will not be applied -- Not Configured: the rule is enabled with default values -- Warn: the rule will be applied and the end-user will have the option to bypass the block + - Block: the rule will be applied + - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) + - Off: the rule will not be applied + - Not Configured: the rule is enabled with default values + - Warn: the rule will be applied and the end-user will have the option to bypass the block -Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. +Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. Enter each rule on a new line as a name-value pair: -- Name column: Enter a valid ASR rule ID -- Value column: Enter the status ID that relates to state you want to specify for the associated rule + - Name column: Enter a valid ASR rule ID + - Value column: Enter the status ID that relates to state you want to specify for the associated rule The following status IDs are permitted under the value column: -- 1 (Block) -- 0 (Off) -- 2 (Audit) -- 5 (Not Configured) -- 6 (Warn) + - 1 (Block) + - 0 (Off) + - 2 (Audit) + - 5 (Not Configured) + - 6 (Warn) Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx @@ -1511,6 +1511,7 @@ This policy setting defines the number of days items should be kept in the Quara This policy setting allows you to configure the scheduled scan, and the scheduled security intelligence update, start time window in hours. - If you disable or do not configure this setting, scheduled tasks will begin at a random time within 4 hours after the time specified in Task Scheduler. + - If you enable this setting, you can widen, or narrow, this randomization period. Specify a randomization window of between 1 and 23 hours. @@ -2823,7 +2824,7 @@ Tracing levels are defined as: 1 - Error 2 - Warning 3 - Info -4 - Debug +4 - Debug. @@ -4742,7 +4743,7 @@ This policy setting allows you to configure security intelligence updates on sta This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", and "FileShares" -For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } +For Example: `{ InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }` - If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. @@ -5054,7 +5055,7 @@ This policy setting allows you to specify the time of day at which to check for This policy setting allows you to define the security intelligence location for VDI-configured computers. -- If you disable or do not configure this setting, security intelligence will be referred from the default local source. +If you disable or do not configure this setting, security intelligence will be referred from the default local source. @@ -5427,7 +5428,7 @@ This policy setting customize which remediation action will be taken for each li Valid remediation action values are: 2 = Quarantine 3 = Remove -6 = Ignore +6 = Ignore. @@ -5603,7 +5604,7 @@ Use this policy setting to specify if you want Microsoft Defender Antivirus noti This policy setting allows user to supress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode). -- If you enable this setting AM UI won't show reboot notifications. +If you enable this setting AM UI won't show reboot notifications. @@ -5660,7 +5661,7 @@ This policy setting allows user to supress reboot notifications in UI only mode This policy setting allows you to configure whether or not to display AM UI to the users. -- If you enable this setting AM UI won't be available to users. +If you enable this setting AM UI won't be available to users. diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md index 1956accd4b..1a28b481b0 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmc.md +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MMC Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Permits or prohibits use of this snap-in. -- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. @@ -114,7 +114,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo Permits or prohibits use of this snap-in. -- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. @@ -184,7 +184,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo Permits or prohibits use of this snap-in. -- If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. @@ -260,7 +260,7 @@ As a result, users cannot create console files or add or remove snap-ins. Also, This setting permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server family or Windows Server 2003 family. However, users cannot open a blank MMC console window on the Start menu. (To open the MMC, click Start, click Run, and type mmc.) Users also cannot open a blank MMC console window from a command prompt. -- If you disable this setting or do not configure it, users can enter author mode and open author-mode console files. +If you disable this setting or do not configure it, users can enter author mode and open author-mode console files. diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md index b4f74ad73e..4bd4f1a4d1 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MMCSnapins Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2564,7 +2564,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo Permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. -- If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins. +If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins. If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this tab is displayed. diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md index aac8c8c118..6d4c737e5b 100644 --- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSAPolicy Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -43,6 +43,7 @@ ms.topic: reference This setting controls whether users can provide Microsoft accounts for authentication for applications or services. + - If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication. This applies both to existing users of a device and new users who may be added. However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires. It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present. diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md index cdfeba781c..5dee7d69dd 100644 --- a/windows/client-management/mdm/policy-csp-admx-msdt.md +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSDT Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -115,6 +115,7 @@ Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by These tools are required to completely troubleshoot the problem. If tool download is restricted, it may not be possible to find the root cause of the problem. - If you enable this policy setting for remote troubleshooting, MSDT prompts the user to download additional tools to diagnose problems on remote computers only. + - If you enable this policy setting for local and remote troubleshooting, MSDT always prompts for additional tool downloading. - If you disable this policy setting, MSDT never downloads tools, and is unable to diagnose problems on remote computers. diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index 637630abaf..6b3d9e67e1 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSI Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -551,7 +551,7 @@ Also, see the "Enable user to use media source while elevated" and "Hide the 'Ad This policy setting restricts the use of Windows Installer. -- If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting. +If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting. - The "Never" option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and Windows Vista when the policy is not configured. @@ -681,7 +681,7 @@ Also, see the "Enable user to patch elevated products" policy setting. This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. -- If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. @@ -743,7 +743,7 @@ This policy setting appears in the Computer Configuration and User Configuration This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. -- If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. @@ -1303,7 +1303,7 @@ When you enable this policy setting, you can specify the types of events you wan To disable logging, delete all of the letters from the box. -- If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap." +If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap." diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md index 3177e932ac..4f0aa3bb0a 100644 --- a/windows/client-management/mdm/policy-csp-admx-nca.md +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_nca Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -56,7 +56,7 @@ We recommend that you use FQDNs instead of IPv6 addresses wherever possible. At least one of the entries must be a PING: resource. -- A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is "HTTP:" followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP: or HTTP:https://2002:836b:1::1/. +- A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is "HTTP:" followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP:https://myserver.corp.contoso.com/ or HTTP:https://2002:836b:1::1/. - A Universal Naming Convention (UNC) path to a file that NCA checks for existence. The contents of the file do not matter. The syntax is "FILE:" followed by a UNC path. The ComputerName portion of the UNC path must resolve to an IPv6 address or contain an IPv6 address. Examples: FILE:\\myserver\myshare\test.txt or FILE:\\2002:836b:1::1\myshare\test.txt. @@ -290,7 +290,7 @@ If this setting is not configured, the string that appears for DirectAccess conn Specifies whether the user has Connect and Disconnect options for the DirectAccess entry when the user clicks the Networking notification area icon. -If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the Name Resolution Policy Table (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. **Note** that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names. +If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the [Name Resolution Policy Table](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn593632(v=ws.11)) (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. **Note** that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names. The ability to disconnect allows users to specify single-label, unqualified names (such as "PRINTSVR") for local resources when connected to a different intranet and for temporary access to intranet resources when network location detection has not correctly determined that the DirectAccess client computer is connected to its own intranet. diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md index 66333d0c19..4fbd4d3169 100644 --- a/windows/client-management/mdm/policy-csp-admx-ncsi.md +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_NCSI Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -47,6 +47,8 @@ This policy setting enables you to specify the expected address of the host name +> [!NOTE] +> This applies exclusively to DirectAccess clients. @@ -102,6 +104,8 @@ This policy setting enables you to specify the host name of a computer known to +> [!NOTE] +> This applies exclusively to DirectAccess clients. @@ -157,6 +161,8 @@ This policy setting enables you to specify the list of IPv6 corporate site prefi +> [!NOTE] +> This applies exclusively to DirectAccess clients. @@ -212,6 +218,8 @@ This policy setting enables you to specify the URL of the corporate website, aga +> [!NOTE] +> This applies exclusively to DirectAccess clients. @@ -267,6 +275,8 @@ This policy setting enables you to specify the HTTPS URL of the corporate websit +> [!NOTE] +> This indicates the Network Location Server (NLS) URL and applies exclusively to DirectAccess clients (it does NOT apply for example to VPN clients). For non-DirectAccess scenarios, such as Azure AD only joined devices, please refer to [Policy CSP - NetworkListManager](./policy-csp-networklistmanager.md). @@ -317,8 +327,7 @@ This policy setting enables you to specify the HTTPS URL of the corporate websit -This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. -- If you enable this setting, NCSI will allow the DNS lookups to happen on any interface. +This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. If you enable this setting, NCSI will allow the DNS lookups to happen on any interface. diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md index 9656e0aa10..2b76aaec77 100644 --- a/windows/client-management/mdm/policy-csp-admx-netlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Netlogon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -54,7 +54,7 @@ The allowable values for this setting result in the following behaviors: To specify this behavior in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 2. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -955,7 +955,7 @@ DCs configured to perform dynamic registration of the DC Locator DNS resource re To specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes). -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1082,7 +1082,7 @@ This policy setting specifies the value for the Time-To-Live (TTL) field in SRV To specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value "900" is 15 minutes). -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1141,7 +1141,7 @@ This policy setting specifies the additional time for the computer to wait for t To specify the expected dial-up delay at logon, click Enabled, and then enter the desired value in seconds (for example, the value "60" is 1 minute). -- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. @@ -1265,7 +1265,7 @@ The GC Locator DNS records and the site-specific SRV records are dynamically reg To specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format. -- If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration. +If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration. @@ -1391,7 +1391,7 @@ The Priority field in the SRV record sets the preference for target hosts (speci To specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is from 0 to 65535. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1452,7 +1452,7 @@ The Weight field in the SRV record can be used in addition to the Priority value To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 65535. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1510,6 +1510,7 @@ To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then This policy setting specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled. By default, the maximum size of the log file is 20MB. + - If you enable this policy setting, the maximum size of the log file is set to the specified size. Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified. - If you disable or do not configure this policy setting, the default behavior occurs as indicated above. @@ -1573,7 +1574,7 @@ The application directory partition DC Locator DNS records and the site-specific To specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -1823,7 +1824,7 @@ The allowable values for this setting result in the following behaviors: To specify this behavior, click Enabled and then enter a value. The range of values is from 1 to 2. -- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. @@ -1949,7 +1950,7 @@ The DC Locator DNS records are dynamically registered by the Net Logon service, To specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format. -- If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. @@ -2010,7 +2011,7 @@ An Active Directory site is one or more well-connected TCP/IP subnets that allow To specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory. -- If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. @@ -2076,7 +2077,7 @@ By default, the SYSVOL share will grant shared read access to files on the share > [!NOTE] > The SYSVOL share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the SYSVOL share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the SYSVOL share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the SYSVOL share on the domain will be decreased. -- If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. +If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md index f59fcc9805..8844aca989 100644 --- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_NetworkConnections Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -544,7 +544,7 @@ Specifies whether or not the "local access only" network icon will be shown. When enabled, the icon for Internet access will be shown in the system tray even when a user is connected to a network with local access only. -- If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only. +If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only. @@ -950,6 +950,7 @@ This setting determines whether the Properties menu item is enabled, and thus, w > [!NOTE] > This setting takes precedence over settings that manipulate the availability of features inside the Local Area Connection Properties dialog box. + - If this setting is enabled, nothing within the properties dialog box for a LAN connection is available to users. > [!NOTE] @@ -1378,6 +1379,7 @@ This setting determines whether the Properties menu item is enabled, and thus, w > [!NOTE] > This setting takes precedence over settings that manipulate the availability of features in the Remote Access Connection Properties dialog box. + - If this setting is enabled, nothing within the properties dialog box for a remote access connection will be available to users. > [!NOTE] @@ -1445,7 +1447,7 @@ To create an all-user connection, on the Connection Availability page in the New - If you disable this setting, the Rename option is disabled for nonadministrators only. -If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections. +- If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections. > [!NOTE] > This setting does not apply to Administrators diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md index a4d11fa601..38fe42d808 100644 --- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_OfflineFiles Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1642,7 +1642,7 @@ Hides or displays reminder balloons, and prevents users from changing the settin Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. -- If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. @@ -1713,7 +1713,7 @@ Hides or displays reminder balloons, and prevents users from changing the settin Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. -- If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. @@ -1847,7 +1847,7 @@ Deletes local copies of the user's offline files when the user logs off. This setting specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files. -- If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use. +If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use. > [!CAUTION] > Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost. @@ -1968,7 +1968,7 @@ This policy setting allows you to turn on economical application of administrati Determines how often reminder balloon updates appear. -- If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. @@ -2032,7 +2032,7 @@ This setting appears in the Computer Configuration and User Configuration folder Determines how often reminder balloon updates appear. -- If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. @@ -2744,7 +2744,7 @@ Determines whether offline files are synchonized before a computer is suspended. - If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. -If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. +- If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. > [!NOTE] > If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. @@ -2806,7 +2806,7 @@ Determines whether offline files are synchonized before a computer is suspended. - If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. -If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. +- If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. > [!NOTE] > If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md index dea0b08208..f2d2d78382 100644 --- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_PeerToPeerCaching Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -261,10 +261,9 @@ Hosted cache clients must trust the server certificate that is issued to the hos -This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. -- If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies. +This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies. -- If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy. +If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy. When this policy setting is applied, the client computer performs or does not perform automatic hosted cache server discovery under the following circumstances: diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index b85780257a..207d96ce87 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Printing Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -242,6 +242,7 @@ Web view is affected by the "Turn on Classic Shell" and "Do not allow Folder Opt + - If you enable this policy setting, it sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.) - If this policy setting is disabled, the network scan page will not be displayed. @@ -258,6 +259,7 @@ In order to view available Web Services printers on your network, ensure that ne If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. In Windows 10 and later, only TCP/IP printers can be shown in the wizard. + - If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. @@ -577,7 +579,7 @@ Adds a link to an Internet or intranet Web page to the Add Printer Wizard. You can use this setting to direct users to a Web page from which they can install printers. -- If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers. +If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers. This setting makes it easy for users to find the printers you want them to add. @@ -823,13 +825,14 @@ Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default + - If this policy setting is enabled, it prevents users from deleting local and network printers. If a user tries to delete a printer, such as by using the Delete option in Printers in Control Panel, a message appears explaining that a setting prevents the action. This setting does not prevent users from running other programs to delete a printer. -If this policy is disabled, or not configured, users can delete printers using the methods described above. +- If this policy is disabled, or not configured, users can delete printers using the methods described above. @@ -898,6 +901,7 @@ Shared printers: 50 If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. In Windows 10 and later, only TCP/IP printers can be shown in the wizard. + - If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. @@ -1204,6 +1208,7 @@ Windows Vista and later clients will attempt to make a non-package point and pri + - If this policy setting is enabled, it specifies the default location criteria used when searching for printers. This setting is a component of the Location Tracking feature of Windows printers. To use this setting, enable Location Tracking by enabling the "Pre-populate printer search location text" setting. @@ -1463,7 +1468,7 @@ Specifies the Active Directory location where searches for printers begin. The Add Printer Wizard gives users the option of searching Active Directory for a shared printer. -- If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory. +If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory. This setting only provides a starting point for Active Directory searches for printers. It does not restrict user searches through Active Directory. diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index dd69376114..1d78b2f09e 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Printing2 Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -251,7 +251,7 @@ By default, the pruning service contacts computers every eight hours and allows - If you enable this setting, you can change the interval between contact attempts. -If you do not configure or disable this setting the default values will be used. +- If you do not configure or disable this setting the default values will be used. > [!NOTE] > This setting is used only on domain controllers. @@ -381,7 +381,7 @@ By default, the pruning service contacts computers every eight hours and allows - If you enable this setting, you can change the interval between attempts. -If you do not configure or disable this setting, the default values are used. +- If you do not configure or disable this setting, the default values are used. > [!NOTE] > This setting is used only on domain controllers. diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md index 1d7a70b423..da10e25a17 100644 --- a/windows/client-management/mdm/policy-csp-admx-programs.md +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Programs Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -46,7 +46,7 @@ This setting removes the Set Program Access and Defaults page from the Programs The Set Program Access and Computer Defaults page allows administrators to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as specify the programs that are accessible from the Start menu, desktop, and other locations. -- If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users. +If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. @@ -177,7 +177,7 @@ This setting prevents users from accessing "Installed Updates" page from the "Vi "Installed Updates" allows users to view and uninstall updates currently installed on the computer. The updates are often downloaded directly from Windows Update or from various program publishers. -- If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users. +If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users. This setting does not prevent users from using other tools and methods to install or uninstall programs. @@ -237,7 +237,7 @@ This setting does not prevent users from using other tools and methods to instal This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are currently installed on the computer. -- If this setting is disabled or not configured, "Programs and Features" will be available to all users. +If this setting is disabled or not configured, "Programs and Features" will be available to all users. This setting does not prevent users from using other tools and methods to view or uninstall programs. It also does not prevent users from linking to related Programs Control Panel Features including Windows Features, Get Programs, or Windows Marketplace. @@ -299,7 +299,7 @@ This setting prevents users from using the Programs Control Panel in Category Vi The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to the user by the system administrator also appear in the Programs Control Panel. -- If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users. +If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users. When enabled, this setting takes precedence over the other settings in this folder. @@ -361,7 +361,7 @@ This setting does not prevent users from using other tools and methods to instal This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. As a result, users cannot view, enable, or disable various Windows features and services. -- If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users. +If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users. This setting does not prevent users from using other tools and methods to configure services or enable or disable program components. diff --git a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md index a2094c9c4e..812ee0a71e 100644 --- a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md +++ b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_PushToInstall Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -- If you enable this setting, users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web. +If you enable this setting, users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web. diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index b37b7eb63d..ca1428aae4 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_RPC Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -273,7 +273,7 @@ This policy setting determines whether the RPC Runtime maintains RPC state infor - If you enable this policy setting, you can use the drop-down box to determine which systems maintain RPC state information. -- "None" indicates that the system does not maintain any RPC state information +- "None" indicates that the system does not maintain any RPC state information. > [!NOTE] > Because the basic state information required for troubleshooting has a negligible effect on performance and uses only about 4K of memory, this setting is not recommended for most installations. diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index 3a57924050..1dc3a07841 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_sam Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,19 +44,19 @@ ms.topic: reference This policy setting allows you to configure how domain controllers handle Windows Hello for Business (WHfB) keys that are vulnerable to the "Return of Coppersmith's attack" (ROCA) vulnerability. -For more information on the ROCA vulnerability, please see +For more information on the ROCA vulnerability, please see: - + - + -- If you enable this policy setting the following options are supported +If you enable this policy setting the following options are supported: -Ignore during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability. +Ignore: during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability. -Audit during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed). +Audit: during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed). -Block during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail). +Block: during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail). This setting only takes effect on domain controllers. @@ -66,7 +66,7 @@ A reboot is not required for changes to this setting to take effect. **Note** to avoid unexpected disruptions this setting should not be set to Block until appropriate mitigations have been performed, for example patching of vulnerable TPMs. -More information is available at . +More information is available at< https://go.microsoft.com/fwlink/?linkid=2116430>. diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index 4525405908..3eb2672ba9 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_SettingSync Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference Prevent the "app settings" group from syncing to and from this PC. This turns off and disables the "app settings" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "app settings" group will not be synced. +If you enable this policy setting, the "app settings" group will not be synced. Use the option "Allow users to turn app settings syncing on" so that syncing it turned off by default but not disabled. @@ -106,7 +106,7 @@ If you do not set or disable this setting, syncing of the "app settings" group i Prevent the "AppSync" group from syncing to and from this PC. This turns off and disables the "AppSync" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "AppSync" group will not be synced. +If you enable this policy setting, the "AppSync" group will not be synced. Use the option "Allow users to turn app syncing on" so that syncing it turned off by default but not disabled. @@ -168,7 +168,7 @@ If you do not set or disable this setting, syncing of the "AppSync" group is on Prevent the "passwords" group from syncing to and from this PC. This turns off and disables the "passwords" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "passwords" group will not be synced. +If you enable this policy setting, the "passwords" group will not be synced. Use the option "Allow users to turn passwords syncing on" so that syncing it turned off by default but not disabled. @@ -230,7 +230,7 @@ If you do not set or disable this setting, syncing of the "passwords" group is o Prevent the "desktop personalization" group from syncing to and from this PC. This turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "desktop personalization" group will not be synced. +If you enable this policy setting, the "desktop personalization" group will not be synced. Use the option "Allow users to turn desktop personalization syncing on" so that syncing it turned off by default but not disabled. @@ -292,7 +292,7 @@ If you do not set or disable this setting, syncing of the "desktop personalizati Prevent the "personalize" group from syncing to and from this PC. This turns off and disables the "personalize" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "personalize" group will not be synced. +If you enable this policy setting, the "personalize" group will not be synced. Use the option "Allow users to turn personalize syncing on" so that syncing it turned off by default but not disabled. @@ -354,7 +354,7 @@ If you do not set or disable this setting, syncing of the "personalize" group is Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings. -- If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. +If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. Use the option "Allow users to turn syncing on" so that syncing it turned off by default but not disabled. @@ -416,7 +416,7 @@ If you do not set or disable this setting, "sync your settings" is on by default Prevent the "Start layout" group from syncing to and from this PC. This turns off and disables the "Start layout" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "Start layout" group will not be synced. +If you enable this policy setting, the "Start layout" group will not be synced. Use the option "Allow users to turn start syncing on" so that syncing is turned off by default but not disabled. @@ -478,7 +478,7 @@ If you do not set or disable this setting, syncing of the "Start layout" group i Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings. -- If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. +If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. If you do not set or disable this setting, syncing on metered connections is configurable by the user. @@ -538,7 +538,7 @@ If you do not set or disable this setting, syncing on metered connections is con Prevent the "Other Windows settings" group from syncing to and from this PC. This turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings. -- If you enable this policy setting, the "Other Windows settings" group will not be synced. +If you enable this policy setting, the "Other Windows settings" group will not be synced. Use the option "Allow users to turn other Windows settings syncing on" so that syncing it turned off by default but not disabled. diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index 0380f886fb..fbc5c518ac 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_SharedFolders Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -31,7 +31,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | @@ -46,7 +46,7 @@ This policy setting determines whether the user can publish DFS roots in Active - If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS . -- If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled +- If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. > [!NOTE] > The default is to allow shared folders to be published when this setting is not configured. @@ -109,7 +109,7 @@ This policy setting determines whether the user can publish shared folders in Ac - If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS. -- If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled +- If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled. > [!NOTE] > The default is to allow shared folders to be published when this setting is not configured. diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index d51369a170..e438a375db 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_ShellCommandPromptRegEditTools Area in Po author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -175,6 +175,7 @@ This policy setting only prevents users from running programs that are started b > [!NOTE] > Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. + > [!NOTE] > To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). @@ -242,6 +243,7 @@ This policy setting only prevents users from running programs that are started b > [!NOTE] > Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. + > [!NOTE] > To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index ddfeafcb32..9f8cd9d3d9 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Smartcard Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/23/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -352,6 +352,7 @@ This policy setting allows you to manage the certificate propagation that occurs This policy setting allows you to manage the clean up behavior of root certificates. + - If you enable this policy setting then root certificate cleanup will occur according to the option selected. - If you disable or do not configure this setting then root certificate clean up will occur on log off. @@ -413,7 +414,7 @@ This policy setting allows you to manage the root certificate propagation that o - If you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card. > [!NOTE] -> For this policy setting to work the following policy setting must also be enabled Turn on certificate propagation from smart card. +> For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card. - If you disable this policy setting then root certificates will not be propagated from the smart card. @@ -542,6 +543,7 @@ This policy setting allows you to control whether elliptic curve cryptography (E > [!NOTE] > This policy setting only affects a user's ability to log on to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting. + > [!NOTE] > If you use an ECDSA key to log on, you must also have an associated ECDH key to permit logons when you are not connected to the network. @@ -599,14 +601,14 @@ This policy setting allows you to control whether elliptic curve cryptography (E -This policy settings lets you configure if all your valid logon certificates are displayed. +This policy setting lets you configure if all your valid logon certificates are displayed. During the certificate renewal period, a user can have multiple valid logon certificates issued from the same certificate template. This can cause confusion as to which certificate to select for logon. The common case for this behavior is when a certificate is renewed and the old one has not yet expired. Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (determined by their UPN). -If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the the certificate with the expiration time furthest in the future will be shown. +If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the certificate with the expiration time furthest in the future will be shown. > [!NOTE] -> This setting will be applied after the following policy "Allow time invalid certificates" +> This setting will be applied after the following policy: "Allow time invalid certificates" - If you enable or do not configure this policy setting, filtering will take place. @@ -794,7 +796,7 @@ This policy setting lets you reverse the subject name from how it is stored in t By default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another. For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of user1@example.com then "User1" will be displayed along with "user1@example.com." If the UPN is not present then the entire subject name will be displayed. This setting controls the appearance of that subject name and might need to be adjusted per organization. -- If you enable this policy setting or do not configure this setting, then the subject name will be reversed. +If you enable this policy setting or do not configure this setting, then the subject name will be reversed. If you disable , the subject name will be displayed as it appears in the certificate. diff --git a/windows/client-management/mdm/policy-csp-admx-srmfci.md b/windows/client-management/mdm/policy-csp-admx-srmfci.md index 11e6d2fff2..cce101b264 100644 --- a/windows/client-management/mdm/policy-csp-admx-srmfci.md +++ b/windows/client-management/mdm/policy-csp-admx-srmfci.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_srmfci Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -227,7 +227,7 @@ The Classification tab enables users to manually classify files by selecting pro -This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types +This Group Policy Setting should be set on Windows clients to enable access-denied assistance for all file types. diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index b4ffcc734a..39837aa6f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_StartMenu Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,6 +42,7 @@ ms.topic: reference + - If you enable this policy, a "Search the Internet" link is shown when the user performs a search in the start menu search box. This button launches the default browser with the search terms. - If you disable this policy, there will not be a "Search the Internet" link when the user performs a search in the start menu search box. @@ -173,6 +174,7 @@ This policy also does not clear items that the user may have pinned to the Jump + - If you enable this policy setting, the recent programs list in the start menu will be blank for each new user. - If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user. @@ -231,6 +233,7 @@ This policy also does not clear items that the user may have pinned to the Jump + - If you enable this setting, the system deletes tile notifications when the user logs on. As a result, the Tiles in the start view will always show their default content when the user logs on. In addition, any cached versions of these notifications will be cleared when the user logs on. - If you disable or do not configure this setting, the system retains notifications, and when a user logs on, the tiles appear just as they did when the user logged off, including the history of previous notifications for each tile. @@ -550,7 +553,7 @@ This setting makes it easier for users to distinguish between programs that are Partially installed programs include those that a system administrator assigns using Windows Installer and those that users have configured for full installation upon first use. -- If you disable this setting or do not configure it, all Start menu shortcuts appear as black text. +If you disable this setting or do not configure it, all Start menu shortcuts appear as black text. > [!NOTE] > Enabling this setting can make the Start menu slow to open. @@ -673,7 +676,7 @@ Disables personalized menus. Windows personalizes long menus by moving recently used items to the top of the menu and hiding items that have not been used recently. Users can display the hidden items by clicking an arrow to extend the menu. -- If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect. +If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect. > [!NOTE] > Personalized menus require user tracking. If you enable the "Turn off user tracking" setting, the system disables user tracking and personalized menus and ignores this setting. @@ -868,7 +871,7 @@ The notification area is located in the task bar, generally at the bottom of the - If you disable this setting, the system notification area will always collapse notifications. -If you do not configure it, the user can choose if they want notifications collapsed. +- If you do not configure it, the user can choose if they want notifications collapsed. @@ -1115,8 +1118,7 @@ This policy setting prevents users from performing the following commands from t Removes items in the All Users profile from the Programs menu on the Start menu. -By default, the Programs menu contains items from the All Users profile and items from the user's profile. -- If you enable this setting, only items in the user's profile appear in the Programs menu. +By default, the Programs menu contains items from the All Users profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu. > [!TIP] > To see the Program menu items in the All Users profile, on the system drive, go to ProgramData\Microsoft\Windows\Start Menu\Programs. @@ -1311,6 +1313,7 @@ This policy setting affects the specified user interface elements only. It does + - If you enable this policy the start menu will not show a link to the Games folder. - If you disable or do not configure this policy, the start menu will show a link to the Games folder, unless the user chooses to remove it in the start menu control panel. @@ -1499,6 +1502,7 @@ This policy setting does not prevent users from pinning programs to the Start Me + - If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu. Selecting "Collapse" will not display the app list next to the pinned tiles in Start. An "All apps" button will be displayed on Start to open the all apps list. This is equivalent to setting the "Show app list in Start" in Settings to Off. @@ -1628,6 +1632,7 @@ Also, see the "Disable programs on Settings menu" and "Disable Control Panel" po + - If you enable this setting, the "Pinned Programs" list is removed from the Start menu. Users cannot pin programs to the Start menu. In Windows XP and Windows Vista, the Internet and email checkboxes are removed from the 'Customize Start Menu' dialog. @@ -1692,7 +1697,7 @@ Removes the Recent Items menu from the Start menu. Removes the Documents menu fr The Recent Items menu contains links to the non-program files that users have most recently opened. It appears so that users can easily reopen their documents. -- If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on. +If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on. If you later disable the setting, so that the Recent Items menu appears in the Start Menu, the document shortcuts saved before the setting was enabled and while it was in effect appear in the Recent Items menu. @@ -1973,6 +1978,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy the start menu search box will not search for communications. - If you disable or do not configure this policy, the start menu will search for communications, unless the user chooses not to in the start menu control panel. @@ -2031,6 +2037,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy, the "See all results" link will not be shown when the user performs a search in the start menu search box. - If you disable or do not configure this policy, the "See all results" link will be shown when the user performs a search in the start menu search box. @@ -2089,6 +2096,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. - If you disable or do not configure this policy, a "See more results" link will be shown when the user performs a search in the start menu search box. If a 3rd party protocol handler is installed, a "Search Everywhere" link will be shown instead of the "See more results" link. @@ -2147,9 +2155,11 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy setting the Start menu search box will not search for files. - If you disable or do not configure this policy setting, the Start menu will search for files, unless the user chooses not to do so directly in Control Panel. + - If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. @@ -2206,6 +2216,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy the start menu search box will not search for internet history or favorites. - If you disable or do not configure this policy, the start menu will search for for internet history or favorites, unless the user chooses not to in the start menu control panel. @@ -2264,6 +2275,7 @@ Also, users with extended keyboards will no longer be able to display the Run di + - If you enable this policy setting the Start menu search box will not search for programs or Control Panel items. - If you disable or do not configure this policy setting, the Start menu search box will search for programs and Control Panel items, unless the user chooses not to do so directly in Control Panel. @@ -2822,6 +2834,7 @@ This policy setting allows you to remove the Downloads link from the Start Menu. + - If you enable this policy the Start menu will not show a link to Homegroup. It also removes the homegroup item from the Start Menu options. As a result, users cannot add the homegroup link to the Start Menu. - If you disable or do not configure this policy, users can use the Start Menu options to add or remove the homegroup link from the Start Menu. @@ -3194,7 +3207,7 @@ Taskbar grouping consolidates similar applications when there is no room on the - If you enable this setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled. -If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose. +- If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose. @@ -3447,9 +3460,10 @@ Description: The notification area is located at the far right end of the task b + - If you enable this setting, users cannot uninstall apps from Start. -- If you disable this setting or do not configure it, users can access the uninstall command from Start +- If you disable this setting or do not configure it, users can access the uninstall command from Start. @@ -3505,6 +3519,7 @@ Description: The notification area is located at the far right end of the task b + - If you enable this policy the start menu will not show a link to the user's storage folder. - If you disable or do not configure this policy, the start menu will display a link, unless the user chooses to remove it in the start menu control panel. @@ -3629,7 +3644,7 @@ This policy setting allows you to remove links and access to Windows Update. - If you enable this policy setting, users are prevented from connecting to the Windows Update Web site. -Enabling this policy setting blocks user access to the Windows Update Web site at . Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. +Enabling this policy setting blocks user access to the Windows Update Web site at< https://windowsupdate.microsoft.com>. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. Windows Update, the online extension of Windows, offers software updates to keep a user's system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download. @@ -3814,6 +3829,7 @@ This policy setting controls whether the QuickLaunch bar is displayed in the Tas + - If you enable this setting, the "Undock PC" button is removed from the simple Start Menu, and your PC cannot be undocked. - If you disable this setting or do not configure it, the "Undock PC" button remains on the simple Start menu, and your PC can be undocked. @@ -3995,6 +4011,7 @@ This policy setting shows or hides the "Run as different user" command on the St + - If you enable this setting, the Run command is added to the Start menu. - If you disable or do not configure this setting, the Run command is not visible on the Start menu by default, but it can be added from the Taskbar and Start menu properties. If the Remove Run link from Start Menu policy is set, the Add the Run command to the Start menu policy has no effect. diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index d5babf1d77..5324e13ac0 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_Taskbar Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -416,7 +416,7 @@ This policy setting allows you to remove the volume control icon from the system This policy setting allows you to turn off feature advertisement balloon notifications. -- If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown. +If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown. If you disable do not configure this policy setting, feature advertisement balloons are shown. diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md index a0b38a0dd1..07885bdc4a 100644 --- a/windows/client-management/mdm/policy-csp-admx-tcpip.md +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_tcpip Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -535,7 +535,7 @@ This policy setting allows you to select the UDP port the Teredo client will use This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state. -- If you disable or do not configure this policy setting, the local host setting is used. +If you disable or do not configure this policy setting, the local host setting is used. This policy setting contains only one state: diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index e293e8cf71..31bdd76413 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_TerminalServer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -239,7 +239,8 @@ This policy setting allows you to specify whether users can run Remote Desktop P - If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked. > [!NOTE] -> You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected. +> You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, all users on the computer are affected. @@ -302,7 +303,8 @@ This policy setting allows you to specify whether users can run Remote Desktop P - If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked. > [!NOTE] -> You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected. +> You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, all users on the computer are affected. @@ -863,8 +865,7 @@ By default, Remote Desktop Services automatically designates the client default -This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate. -- If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available. +This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate. If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available. @@ -924,7 +925,7 @@ Controls whether a user can save passwords using Remote Desktop Connection. - If you enable this setting the credential saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted. -- If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection +- If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection. @@ -1182,7 +1183,8 @@ This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA **Note**: -You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. +You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. @@ -1249,7 +1251,8 @@ This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA **Note**: -You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. +You can define this policy setting in the Computer Configuration node or in the User Configuration node. +- If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. @@ -1579,7 +1582,8 @@ This policy setting enables system administrators to change the graphics renderi - If you do not configure this policy setting, Remote Desktop Services sessions on the RD Session Host server use the Microsoft Basic Render Driver as the default adapter. In all other cases, Remote Desktop Services sessions use the hardware graphics renderer by default. -NOTE: The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting. +> [!NOTE] +> The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting. @@ -1971,7 +1975,7 @@ Specifies the authentication method that clients must use when attempting to con To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default. -- If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication. +If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication. @@ -2026,6 +2030,7 @@ To allow users to overwrite this policy setting, select the "Allow users to chan + - If you enable this policy setting, when Remote Desktop Connection cannot connect directly to a remote computer (an RD Session Host server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through an RD Gateway server. In this case, the clients will attempt to connect to the RD Gateway server that is specified in the "Set RD Gateway server address" policy setting. You can enforce this policy setting or you can allow users to overwrite this setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. @@ -2165,6 +2170,7 @@ If the policy setting is not configured, the policy setting is not specified at **Note**: 1. + - If you enable this policy setting, you must also enable the Configure RD Connection Broker farm name and Configure RD Connection Broker server name policy settings. 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. @@ -2982,7 +2988,7 @@ This policy setting determines whether a user will be prompted on the client com This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. -The default connection URL must be configured in the form of . +The default connection URL must be configured in the form of< https://contoso.com/rdweb/Feed/webfeed.aspx>. - If you enable this policy setting, the specified URL is configured as the default connection URL for the user and replaces any existing connection URL. The user cannot change the default connection URL. The user's default logon credentials are used when setting up the default connection URL. @@ -3106,6 +3112,7 @@ By default, when a new user signs in to a computer, the Start screen is shown an + - If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list: 1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session. @@ -3171,6 +3178,7 @@ By default, when a new user signs in to a computer, the Start screen is shown an + - If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list: 1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session. @@ -3242,8 +3250,7 @@ Depending on the requirements of your users, you can reduce network bandwidth us If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality. -By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. -- If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). +By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). @@ -3573,7 +3580,7 @@ If you disable Continuous Network Detect, Remote Desktop Protocol will not try t If you disable Connect Time Detect and Continuous Network Detect, Remote Desktop Protocol will not try to determine the network quality at the connect time; instead it will assume that all traffic to this server originates from a low-speed connection, and it will not try to adapt the user experience to varying network quality. -- If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality. +If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality. @@ -3818,8 +3825,7 @@ Do not connect if authentication fails: The client establishes a connection to t -This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. -- If you disable or do not configure this policy, we will always use software encoding. +This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. If you disable or do not configure this policy, we will always use software encoding. @@ -3995,9 +4001,13 @@ You can also choose not to use an RDP compression algorithm. Choosing not to use This policy setting allows you to specify the visual quality for remote users when connecting to this computer by using Remote Desktop Connection. You can use this policy setting to balance the network bandwidth usage with the visual quality that is delivered. + - If you enable this policy setting and set quality to Low, RemoteFX Adaptive Graphics uses an encoding mechanism that results in low quality images. This mode consumes the lowest amount of network bandwidth of the quality modes. + - If you enable this policy setting and set quality to Medium, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. This mode provides better graphics quality than low quality and uses less bandwidth than high quality. + - If you enable this policy setting and set quality to High, RemoteFX Adaptive Graphics uses an encoding mechanism that results in high quality images and consumes moderate network bandwidth. + - If you enable this policy setting and set quality to Lossless, RemoteFX Adaptive Graphics uses lossless encoding. In this mode, the color integrity of the graphics data is not impacted. However, this setting results in a significant increase in network bandwidth consumption. We recommend that you set this for very specific cases only. - If you disable or do not configure this policy setting, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. @@ -4055,6 +4065,7 @@ This policy setting allows you to specify the visual quality for remote users wh This policy setting allows you to configure graphics encoding to use the RemoteFX Codec on the Remote Desktop Session Host server so that the sessions are compatible with non-Windows thin client devices designed for Windows Server 2008 R2 SP1. These clients only support the Windows Server 2008 R2 SP1 RemoteFX Codec. + - If you enable this policy setting, users' sessions on this server will only use the Windows Server 2008 R2 SP1 RemoteFX Codec for encoding. This mode is compatible with thin client devices that only support the Windows Server 2008 R2 SP1 RemoteFX Codec. - If you disable or do not configure this policy setting, non-Windows thin clients that only support the Windows Server 2008 R2 SP1 RemoteFX Codec will not be able to connect to this server. This policy setting applies only to clients that are using Remote Desktop Protocol (RDP) 7.1, and does not affect clients that are using other RDP versions. diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md index 9237bb81e7..b22b7d4527 100644 --- a/windows/client-management/mdm/policy-csp-admx-tpm.md +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_TPM Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -342,7 +342,7 @@ This policy setting configures how much of the TPM owner authorization informati You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none. -- If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. +If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios which do not depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPM anti-hammering logic can be used. diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md index 15da8637a6..f802208d23 100644 --- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_UserExperienceVirtualization Area in Poli author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -48,6 +48,7 @@ ms.topic: reference This policy setting configures the synchronization of user settings of Calculator. By default, the user settings of Calculator synchronize between computers. Use the policy setting to prevent the user settings of Calculator from synchronization between computers. + - If you enable this policy setting, the Calculator user settings continue to synchronize. - If you disable this policy setting, Calculator user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -175,6 +176,7 @@ With notifications enabled, UE-V users receive a message when the settings sync This policy setting configures the synchronization of User Experience Virtualization (UE-V) rollback information for computers running in a non-persistent, pooled VDI environment. UE-V settings rollback data and checkpoints are normally stored only on the local computer. With this policy setting enabled, the rollback information is copied to the settings storage location when the user logs off or shuts down their VDI session. Enable this setting to register a VDI-specific settings location template and restore data on computers in pooled VDI environments that reset to a clean state on logout. With this policy enabled you can roll settings back to the state when UE-V was installed or to "last-known-good" configurations. Only enable this policy setting on computers running in a non-persistent VDI environment. The VDI Collection Name defines the name of the virtual desktop collection containing the virtual computers. + - If you enable this policy setting, the UE-V rollback state is copied to the settings storage location on logout and restored on login. - If you disable this policy setting, no UE-V rollback state is copied to the settings storage location. - If you do not configure this policy, no UE-V rollback state is copied to the settings storage location. @@ -234,6 +236,7 @@ This policy setting configures the synchronization of User Experience Virtualiza This policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center. + - If you enable this policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL. - If you disable this policy setting, the Company Settings Center does not display an IT Contact link. - If you do not configure this policy setting, any defined values will be deleted. @@ -292,6 +295,7 @@ This policy setting specifies the text of the Contact IT URL hyperlink in the Co This policy setting specifies the URL for the Contact IT link in the Company Settings Center. + - If you enable this policy setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol such as http or mailto. - If you disable this policy setting, the Company Settings Center does not display an IT Contact link. - If you do not configure this policy setting, any defined values will be deleted. @@ -355,9 +359,11 @@ This policy setting specifies the URL for the Contact IT link in the Company Set This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings for Windows apps. By default, the UE-V Agent synchronizes settings for Windows apps between the computer and the settings storage location. + - If you enable this policy setting, the UE-V Agent will not synchronize settings for Windows apps. - If you disable this policy setting, the UE-V Agent will synchronize settings for Windows apps. - If you do not configure this policy setting, any defined values are deleted. + > [!NOTE] > If the user connects their Microsoft account for their computer then the UE-V Agent will not synchronize Windows apps. The Windows apps will default to whatever settings are configured in the Sync your settings configuration in Windows. @@ -421,6 +427,7 @@ By default, the UE-V Agent synchronizes settings for Windows apps between the co This policy setting configures the synchronization of Windows settings between computers. Certain Windows settings will synchronize between computers by default. These settings include Windows themes, Windows desktop settings, Ease of Access settings, and network printers. Use this policy setting to specify which Windows settings synchronize between computers. You can also use these settings to enable synchronization of users' sign-in information for certain apps, networks, and certificates. + - If you enable this policy setting, only the selected Windows settings synchronize. Unselected Windows settings are excluded from settings synchronization. - If you disable this policy setting, all Windows Settings are excluded from the settings synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -540,6 +547,7 @@ This policy setting allows you to enable or disable User Experience Virtualizati This policy setting configures the synchronization of user settings for the Finance app. By default, the user settings of Finance sync between computers. Use the policy setting to prevent the user settings of Finance from synchronizing between computers. + - If you enable this policy setting, Finance user settings continue to sync. - If you disable this policy setting, Finance user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -602,7 +610,7 @@ This policy setting enables a notification in the system tray that appears when By default, a notification informs users that Company Settings Center, the user-facing name for the UE-V Agent, now helps to synchronize settings between their work computers. With this setting enabled, the notification appears the first time that the UE-V Agent runs. With this setting disabled, no notification appears. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -664,6 +672,7 @@ With this setting disabled, no notification appears. This policy setting configures the synchronization of user settings for the Games app. By default, the user settings of Games sync between computers. Use the policy setting to prevent the user settings of Games from synchronizing between computers. + - If you enable this policy setting, Games user settings continue to sync. - If you disable this policy setting, Games user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -728,6 +737,7 @@ By default, the user settings of Games sync between computers. Use the policy se This policy setting configures the synchronization of user settings of Internet Explorer 10. By default, the user settings of Internet Explorer 10 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 10 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 10 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 10 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -792,6 +802,7 @@ By default, the user settings of Internet Explorer 10 synchronize between comput This policy setting configures the synchronization of user settings of Internet Explorer 11. By default, the user settings of Internet Explorer 11 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 11 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 11 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 11 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -856,6 +867,7 @@ By default, the user settings of Internet Explorer 11 synchronize between comput This policy setting configures the synchronization of user settings for Internet Explorer 8. By default, the user settings of Internet Explorer 8 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 8 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 8 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 8 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -920,6 +932,7 @@ By default, the user settings of Internet Explorer 8 synchronize between compute This policy setting configures the synchronization of user settings for Internet Explorer 9. By default, the user settings of Internet Explorer 9 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 9 from synchronization between computers. + - If you enable this policy setting, the Internet Explorer 9 user settings continue to synchronize. - If you disable this policy setting, Internet Explorer 9 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -984,6 +997,7 @@ By default, the user settings of Internet Explorer 9 synchronize between compute This policy setting configures the synchronization of user settings which are common between the versions of Internet Explorer. By default, the user settings which are common between the versions of Internet Explorer synchronize between computers. Use the policy setting to prevent the user settings of Internet Explorer from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the versions of Internet Explorer continue to synchronize. - If you disable this policy setting, the user settings which are common between the versions of Internet Explorer are excluded from settings synchronization. If any version of the Internet Explorer settings are enabled this policy setting should not be disabled. - If you do not configure this policy setting, any defined values will be deleted. @@ -1047,6 +1061,7 @@ By default, the user settings which are common between the versions of Internet This policy setting configures the synchronization of user settings for the Maps app. By default, the user settings of Maps sync between computers. Use the policy setting to prevent the user settings of Maps from synchronizing between computers. + - If you enable this policy setting, Maps user settings continue to sync. - If you disable this policy setting, Maps user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -1110,6 +1125,7 @@ By default, the user settings of Maps sync between computers. Use the policy set This policy setting allows you to configure the UE-V Agent to write a warning event to the event log when a settings package file size reaches a defined threshold. By default the UE-V Agent does not report information about package file size. + - If you enable this policy setting, specify the threshold file size in bytes. When the settings package file exceeds this threshold the UE-V Agent will write a warning event to the event log. - If you disable or do not configure this policy setting, no event is written to the event log to report settings package size. @@ -1172,6 +1188,7 @@ This policy setting allows you to configure the UE-V Agent to write a warning ev This policy setting configures the synchronization of user settings for Microsoft Access 2010. By default, the user settings of Microsoft Access 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Access 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Access 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1235,6 +1252,7 @@ By default, the user settings of Microsoft Access 2010 synchronize between compu This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2010 applications. By default, the user settings which are common between the Microsoft Office Suite 2010 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2010 applications from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications continue to synchronize. - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2010 applications are enabled, this policy setting should not be disabled - If you do not configure this policy setting, any defined values will be deleted. @@ -1298,6 +1316,7 @@ By default, the user settings which are common between the Microsoft Office Suit This policy setting configures the synchronization of user settings for Microsoft Excel 2010. By default, the user settings of Microsoft Excel 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Excel 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Excel 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1361,6 +1380,7 @@ By default, the user settings of Microsoft Excel 2010 synchronize between comput This policy setting configures the synchronization of user settings for Microsoft InfoPath 2010. By default, the user settings of Microsoft InfoPath 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft InfoPath 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft InfoPath 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1424,6 +1444,7 @@ By default, the user settings of Microsoft InfoPath 2010 synchronize between com This policy setting configures the synchronization of user settings for Microsoft Lync 2010. By default, the user settings of Microsoft Lync 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Lync 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Lync 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1488,6 +1509,7 @@ By default, the user settings of Microsoft Lync 2010 synchronize between compute This policy setting configures the synchronization of user settings for Microsoft OneNote 2010. By default, the user settings of Microsoft OneNote 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft OneNote 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft OneNote 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1551,6 +1573,7 @@ By default, the user settings of Microsoft OneNote 2010 synchronize between comp This policy setting configures the synchronization of user settings for Microsoft Outlook 2010. By default, the user settings of Microsoft Outlook 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Outlook 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Outlook 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1614,6 +1637,7 @@ By default, the user settings of Microsoft Outlook 2010 synchronize between comp This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2010. By default, the user settings of Microsoft PowerPoint 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft PowerPoint 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft PowerPoint 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1677,6 +1701,7 @@ By default, the user settings of Microsoft PowerPoint 2010 synchronize between c This policy setting configures the synchronization of user settings for Microsoft Project 2010. By default, the user settings of Microsoft Project 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Project 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Project 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1740,6 +1765,7 @@ By default, the user settings of Microsoft Project 2010 synchronize between comp This policy setting configures the synchronization of user settings for Microsoft Publisher 2010. By default, the user settings of Microsoft Publisher 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Publisher 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Publisher 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1803,6 +1829,7 @@ By default, the user settings of Microsoft Publisher 2010 synchronize between co This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2010. By default, the user settings of Microsoft SharePoint Designer 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft SharePoint Designer 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft SharePoint Designer 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1866,6 +1893,7 @@ By default, the user settings of Microsoft SharePoint Designer 2010 synchronize This policy setting configures the synchronization of user settings for Microsoft SharePoint Workspace 2010. By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Workspace 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft SharePoint Workspace 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft SharePoint Workspace 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1929,6 +1957,7 @@ By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize This policy setting configures the synchronization of user settings for Microsoft Visio 2010. By default, the user settings of Microsoft Visio 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Visio 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Visio 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -1992,6 +2021,7 @@ By default, the user settings of Microsoft Visio 2010 synchronize between comput This policy setting configures the synchronization of user settings for Microsoft Word 2010. By default, the user settings of Microsoft Word 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2010 from synchronization between computers. + - If you enable this policy setting, Microsoft Word 2010 user settings continue to synchronize. - If you disable this policy setting, Microsoft Word 2010 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2055,6 +2085,7 @@ By default, the user settings of Microsoft Word 2010 synchronize between compute This policy setting configures the synchronization of user settings for Microsoft Access 2013. By default, the user settings of Microsoft Access 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Access 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Access 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2118,6 +2149,7 @@ By default, the user settings of Microsoft Access 2013 synchronize between compu This policy setting configures the backup of certain user settings for Microsoft Access 2013. Microsoft Access 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Access 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Access 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2181,6 +2213,7 @@ Microsoft Access 2013 has user settings that are backed up instead of synchroniz This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. By default, the user settings which are common between the Microsoft Office Suite 2013 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize. - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2013 applications are enabled, this policy setting should not be disabled. - If you do not configure this policy setting, any defined values will be deleted. @@ -2244,6 +2277,7 @@ By default, the user settings which are common between the Microsoft Office Suit This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2013 applications. Microsoft Office Suite 2013 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2013 applications. + - If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will continue to be backed up. - If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2307,6 +2341,7 @@ Microsoft Office Suite 2013 has user settings which are common between applicati This policy setting configures the synchronization of user settings for Microsoft Excel 2013. By default, the user settings of Microsoft Excel 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Excel 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Excel 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2370,6 +2405,7 @@ By default, the user settings of Microsoft Excel 2013 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Excel 2013. Microsoft Excel 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Excel 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Excel 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2433,6 +2469,7 @@ Microsoft Excel 2013 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft InfoPath 2013. By default, the user settings of Microsoft InfoPath 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft InfoPath 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft InfoPath 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2496,6 +2533,7 @@ By default, the user settings of Microsoft InfoPath 2013 synchronize between com This policy setting configures the backup of certain user settings for Microsoft InfoPath 2013. Microsoft InfoPath 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft InfoPath 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft InfoPath 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft InfoPath 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2559,6 +2597,7 @@ Microsoft InfoPath 2013 has user settings that are backed up instead of synchron This policy setting configures the synchronization of user settings for Microsoft Lync 2013. By default, the user settings of Microsoft Lync 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Lync 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Lync 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2622,6 +2661,7 @@ By default, the user settings of Microsoft Lync 2013 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Lync 2013. Microsoft Lync 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Lync 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Lync 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2685,6 +2725,7 @@ Microsoft Lync 2013 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for OneDrive for Business 2013. By default, the user settings of OneDrive for Business 2013 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2013 from synchronization between computers. + - If you enable this policy setting, OneDrive for Business 2013 user settings continue to synchronize. - If you disable this policy setting, OneDrive for Business 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2748,6 +2789,7 @@ By default, the user settings of OneDrive for Business 2013 synchronize between This policy setting configures the synchronization of user settings for Microsoft OneNote 2013. By default, the user settings of Microsoft OneNote 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft OneNote 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft OneNote 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2811,6 +2853,7 @@ By default, the user settings of Microsoft OneNote 2013 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft OneNote 2013. Microsoft OneNote 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft OneNote 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft OneNote 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -2874,6 +2917,7 @@ Microsoft OneNote 2013 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Outlook 2013. By default, the user settings of Microsoft Outlook 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Outlook 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Outlook 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -2937,6 +2981,7 @@ By default, the user settings of Microsoft Outlook 2013 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Outlook 2013. Microsoft Outlook 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Outlook 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Outlook 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3000,6 +3045,7 @@ Microsoft Outlook 2013 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2013. By default, the user settings of Microsoft PowerPoint 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft PowerPoint 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft PowerPoint 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3063,6 +3109,7 @@ By default, the user settings of Microsoft PowerPoint 2013 synchronize between c This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2013. Microsoft PowerPoint 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft PowerPoint 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft PowerPoint 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3126,6 +3173,7 @@ Microsoft PowerPoint 2013 has user settings that are backed up instead of synchr This policy setting configures the synchronization of user settings for Microsoft Project 2013. By default, the user settings of Microsoft Project 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Project 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Project 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3189,6 +3237,7 @@ By default, the user settings of Microsoft Project 2013 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Project 2013. Microsoft Project 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Project 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Project 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3252,6 +3301,7 @@ Microsoft Project 2013 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Publisher 2013. By default, the user settings of Microsoft Publisher 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Publisher 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Publisher 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3315,6 +3365,7 @@ By default, the user settings of Microsoft Publisher 2013 synchronize between co This policy setting configures the backup of certain user settings for Microsoft Publisher 2013. Microsoft Publisher 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Publisher 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Publisher 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3378,6 +3429,7 @@ Microsoft Publisher 2013 has user settings that are backed up instead of synchro This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2013. By default, the user settings of Microsoft SharePoint Designer 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft SharePoint Designer 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft SharePoint Designer 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3441,6 +3493,7 @@ By default, the user settings of Microsoft SharePoint Designer 2013 synchronize This policy setting configures the backup of certain user settings for Microsoft SharePoint Designer 2013. Microsoft SharePoint Designer 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft SharePoint Designer 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3504,6 +3557,7 @@ Microsoft SharePoint Designer 2013 has user settings that are backed up instead This policy setting configures the synchronization of user settings for Microsoft Office 2013 Upload Center. By default, the user settings of Microsoft Office 2013 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2013 Upload Center from synchronization between computers. + - If you enable this policy setting, Microsoft Office 2013 Upload Center user settings continue to synchronize. - If you disable this policy setting, Microsoft Office 2013 Upload Center user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3567,6 +3621,7 @@ By default, the user settings of Microsoft Office 2013 Upload Center synchronize This policy setting configures the synchronization of user settings for Microsoft Visio 2013. By default, the user settings of Microsoft Visio 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Visio 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Visio 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3630,6 +3685,7 @@ By default, the user settings of Microsoft Visio 2013 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Visio 2013. Microsoft Visio 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Visio 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Visio 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3693,6 +3749,7 @@ Microsoft Visio 2013 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft Word 2013. By default, the user settings of Microsoft Word 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2013 from synchronization between computers. + - If you enable this policy setting, Microsoft Word 2013 user settings continue to synchronize. - If you disable this policy setting, Microsoft Word 2013 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3756,6 +3813,7 @@ By default, the user settings of Microsoft Word 2013 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Word 2013. Microsoft Word 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2013 settings. + - If you enable this policy setting, certain user settings of Microsoft Word 2013 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Word 2013 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3819,6 +3877,7 @@ Microsoft Word 2013 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for Microsoft Access 2016. By default, the user settings of Microsoft Access 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Access 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Access 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -3882,6 +3941,7 @@ By default, the user settings of Microsoft Access 2016 synchronize between compu This policy setting configures the backup of certain user settings for Microsoft Access 2016. Microsoft Access 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Access 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Access 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -3945,6 +4005,7 @@ Microsoft Access 2016 has user settings that are backed up instead of synchroniz This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. By default, the user settings which are common between the Microsoft Office Suite 2016 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers. + - If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize. - If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2016 applications are enabled, this policy setting should not be disabled. - If you do not configure this policy setting, any defined values will be deleted. @@ -4008,6 +4069,7 @@ By default, the user settings which are common between the Microsoft Office Suit This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2016 applications. Microsoft Office Suite 2016 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2016 applications. + - If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will continue to be backed up. - If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4071,6 +4133,7 @@ Microsoft Office Suite 2016 has user settings which are common between applicati This policy setting configures the synchronization of user settings for Microsoft Excel 2016. By default, the user settings of Microsoft Excel 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Excel 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Excel 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4134,6 +4197,7 @@ By default, the user settings of Microsoft Excel 2016 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Excel 2016. Microsoft Excel 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Excel 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Excel 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4197,6 +4261,7 @@ Microsoft Excel 2016 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft Lync 2016. By default, the user settings of Microsoft Lync 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Lync 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Lync 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4260,6 +4325,7 @@ By default, the user settings of Microsoft Lync 2016 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Lync 2016. Microsoft Lync 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Lync 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Lync 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4323,6 +4389,7 @@ Microsoft Lync 2016 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for OneDrive for Business 2016. By default, the user settings of OneDrive for Business 2016 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2016 from synchronization between computers. + - If you enable this policy setting, OneDrive for Business 2016 user settings continue to synchronize. - If you disable this policy setting, OneDrive for Business 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4386,6 +4453,7 @@ By default, the user settings of OneDrive for Business 2016 synchronize between This policy setting configures the synchronization of user settings for Microsoft OneNote 2016. By default, the user settings of Microsoft OneNote 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft OneNote 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft OneNote 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4449,6 +4517,7 @@ By default, the user settings of Microsoft OneNote 2016 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft OneNote 2016. Microsoft OneNote 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft OneNote 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft OneNote 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4512,6 +4581,7 @@ Microsoft OneNote 2016 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Outlook 2016. By default, the user settings of Microsoft Outlook 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Outlook 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Outlook 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4575,6 +4645,7 @@ By default, the user settings of Microsoft Outlook 2016 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Outlook 2016. Microsoft Outlook 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Outlook 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Outlook 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4638,6 +4709,7 @@ Microsoft Outlook 2016 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2016. By default, the user settings of Microsoft PowerPoint 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft PowerPoint 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft PowerPoint 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4701,6 +4773,7 @@ By default, the user settings of Microsoft PowerPoint 2016 synchronize between c This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2016. Microsoft PowerPoint 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft PowerPoint 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft PowerPoint 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4764,6 +4837,7 @@ Microsoft PowerPoint 2016 has user settings that are backed up instead of synchr This policy setting configures the synchronization of user settings for Microsoft Project 2016. By default, the user settings of Microsoft Project 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Project 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Project 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4827,6 +4901,7 @@ By default, the user settings of Microsoft Project 2016 synchronize between comp This policy setting configures the backup of certain user settings for Microsoft Project 2016. Microsoft Project 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Project 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Project 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -4890,6 +4965,7 @@ Microsoft Project 2016 has user settings that are backed up instead of synchroni This policy setting configures the synchronization of user settings for Microsoft Publisher 2016. By default, the user settings of Microsoft Publisher 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Publisher 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Publisher 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -4953,6 +5029,7 @@ By default, the user settings of Microsoft Publisher 2016 synchronize between co This policy setting configures the backup of certain user settings for Microsoft Publisher 2016. Microsoft Publisher 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Publisher 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Publisher 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -5016,6 +5093,7 @@ Microsoft Publisher 2016 has user settings that are backed up instead of synchro This policy setting configures the synchronization of user settings for Microsoft Office 2016 Upload Center. By default, the user settings of Microsoft Office 2016 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2016 Upload Center from synchronization between computers. + - If you enable this policy setting, Microsoft Office 2016 Upload Center user settings continue to synchronize. - If you disable this policy setting, Microsoft Office 2016 Upload Center user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -5079,6 +5157,7 @@ By default, the user settings of Microsoft Office 2016 Upload Center synchronize This policy setting configures the synchronization of user settings for Microsoft Visio 2016. By default, the user settings of Microsoft Visio 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Visio 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Visio 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -5142,6 +5221,7 @@ By default, the user settings of Microsoft Visio 2016 synchronize between comput This policy setting configures the backup of certain user settings for Microsoft Visio 2016. Microsoft Visio 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Visio 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Visio 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -5205,6 +5285,7 @@ Microsoft Visio 2016 has user settings that are backed up instead of synchronizi This policy setting configures the synchronization of user settings for Microsoft Word 2016. By default, the user settings of Microsoft Word 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2016 from synchronization between computers. + - If you enable this policy setting, Microsoft Word 2016 user settings continue to synchronize. - If you disable this policy setting, Microsoft Word 2016 user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -5268,6 +5349,7 @@ By default, the user settings of Microsoft Word 2016 synchronize between compute This policy setting configures the backup of certain user settings for Microsoft Word 2016. Microsoft Word 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2016 settings. + - If you enable this policy setting, certain user settings of Microsoft Word 2016 will continue to be backed up. - If you disable this policy setting, certain user settings of Microsoft Word 2016 will not be backed up. - If you do not configure this policy setting, any defined values will be deleted. @@ -5331,6 +5413,7 @@ Microsoft Word 2016 has user settings that are backed up instead of synchronizin This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Access 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Access 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5394,6 +5477,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Access 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Access 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5457,6 +5541,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2013 applications will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers with UE-V. + - If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize with UE-V. - If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5520,6 +5605,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2016 applications will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers with UE-V. + - If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize with UE-V. - If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5583,6 +5669,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Excel 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Excel 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5646,6 +5733,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Excel 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Excel 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5709,6 +5797,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 InfoPath 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 InfoPath 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 InfoPath 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 InfoPath 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 InfoPath 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5772,6 +5861,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Lync 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Lync 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5835,6 +5925,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Lync 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Lync 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5898,6 +5989,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 OneNote 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 OneNote 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -5961,6 +6053,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 OneNote 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 OneNote 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6024,6 +6117,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Outlook 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Outlook 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6087,6 +6181,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Outlook 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Outlook 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6150,6 +6245,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6213,6 +6309,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6276,6 +6373,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Project 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Project 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6339,6 +6437,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Project 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Project 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6402,6 +6501,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Publisher 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Publisher 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6465,6 +6565,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Publisher 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Publisher 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6528,6 +6629,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 SharePoint Designer 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 SharePoint Designer 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 SharePoint Designer 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6591,6 +6693,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Visio 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Visio 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6654,6 +6757,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Visio 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Visio 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6717,6 +6821,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2013 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2013 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Word 2013 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Word 2013 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6780,6 +6885,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2016 will synchronize between a user's work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2016 from synchronization between computers with UE-V. + - If you enable this policy setting, Microsoft Office 365 Word 2016 user settings continue to sync with UE-V. - If you disable this policy setting, Microsoft Office 365 Word 2016 user settings are excluded from synchronization with UE-V. - If you do not configure this policy setting, any defined values will be deleted. @@ -6843,6 +6949,7 @@ Microsoft Office 365 synchronizes certain settings by default without UE-V. If t This policy setting configures the synchronization of user settings for the Music app. By default, the user settings of Music sync between computers. Use the policy setting to prevent the user settings of Music from synchronizing between computers. + - If you enable this policy setting, Music user settings continue to sync. - If you disable this policy setting, Music user settings are excluded from the synchronizing settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -6907,6 +7014,7 @@ By default, the user settings of Music sync between computers. Use the policy se This policy setting configures the synchronization of user settings for the News app. By default, the user settings of News sync between computers. Use the policy setting to prevent the user settings of News from synchronizing between computers. + - If you enable this policy setting, News user settings continue to sync. - If you disable this policy setting, News user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -6971,6 +7079,7 @@ By default, the user settings of News sync between computers. Use the policy set This policy setting configures the synchronization of user settings of Notepad. By default, the user settings of Notepad synchronize between computers. Use the policy setting to prevent the user settings of Notepad from synchronization between computers. + - If you enable this policy setting, the Notepad user settings continue to synchronize. - If you disable this policy setting, Notepad user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. @@ -7035,6 +7144,7 @@ By default, the user settings of Notepad synchronize between computers. Use the This policy setting configures the synchronization of user settings for the Reader app. By default, the user settings of Reader sync between computers. Use the policy setting to prevent the user settings of Reader from synchronizing between computers. + - If you enable this policy setting, Reader user settings continue to sync. - If you disable this policy setting, Reader user settings are excluded from the synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7099,6 +7209,7 @@ By default, the user settings of Reader sync between computers. Use the policy s This policy setting configures the number of milliseconds that the computer waits when retrieving user settings from the settings storage location. You can use this setting to override the default value of 2000 milliseconds. + - If you enable this policy setting, set the number of milliseconds that the system waits to retrieve settings. - If you disable or do not configure this policy setting, the default value of 2000 milliseconds is used. @@ -7160,6 +7271,7 @@ You can use this setting to override the default value of 2000 milliseconds. This policy setting configures where the settings package files that contain user settings are stored. + - If you enable this policy setting, the user settings are stored in the specified location. - If you disable or do not configure this policy setting, the user settings are stored in the user's home directory if configured for your environment. @@ -7217,6 +7329,7 @@ This policy setting configures where the settings package files that contain use This policy setting configures where custom settings location templates are stored and if the catalog will be used to replace the default Microsoft templates installed with the UE-V Agent. + - If you enable this policy setting, the UE-V Agent checks the specified location once each day and updates its synchronization behavior based on the templates in this location. Settings location templates added or updated since the last check are registered by the UE-V Agent. The UE-V Agent deregisters templates that were removed from this location. If you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they will be ignored. If you specify a UNC path and check the option to replace the default Microsoft templates, all of the default Microsoft templates installed by the UE-V Agent will be deleted from the computer and only the templates located in the settings template catalog will be used. @@ -7283,6 +7396,7 @@ If you specify a UNC path and check the option to replace the default Microsoft This policy setting configures the synchronization of user settings for the Sports app. By default, the user settings of Sports sync between computers. Use the policy setting to prevent the user settings of Sports from synchronizing between computers. + - If you enable this policy setting, Sports user settings continue to sync. - If you disable this policy setting, Sports user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7409,7 +7523,7 @@ This policy setting defines whether the User Experience Virtualization (UE-V) Ag By default, the UE-V Agent does not synchronize settings over a metered connection. With this setting enabled, the UE-V Agent synchronizes settings over a metered connection. With this setting disabled, the UE-V Agent does not synchronize settings over a metered connection. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7473,7 +7587,7 @@ This policy setting defines whether the User Experience Virtualization (UE-V) Ag By default, the UE-V Agent does not synchronize settings over a metered connection that is roaming. With this setting enabled, the UE-V Agent synchronizes settings over a metered connection that is roaming. With this setting disabled, the UE-V Agent will not synchronize settings over a metered connection that is roaming. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7534,6 +7648,7 @@ With this setting disabled, the UE-V Agent will not synchronize settings over a This policy setting allows you to configure the User Experience Virtualization (UE-V) sync provider to ping the settings storage path before attempting to sync settings. If the ping is successful then the sync provider attempts to synchronize the settings packages. If the ping is unsuccessful then the sync provider doesn't attempt the synchronization. + - If you enable this policy setting, the sync provider pings the settings storage location before synchronizing settings packages. - If you disable this policy setting, the sync provider doesn't ping the settings storage location before synchronizing settings packages. - If you do not configure this policy, any defined values will be deleted. @@ -7596,7 +7711,7 @@ This policy setting defines the default settings sync behavior of the User Exper By default, the UE-V Agent only synchronizes settings of those Windows apps included in the Windows App List. With this setting enabled, the settings of all Windows apps not expressly disable in the Windows App List are synchronized. With this setting disabled, only the settings of the Windows apps set to synchronize in the Windows App List are synchronized. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7658,6 +7773,7 @@ With this setting disabled, only the settings of the Windows apps set to synchro This policy setting configures the synchronization of user settings for the Travel app. By default, the user settings of Travel sync between computers. Use the policy setting to prevent the user settings of Travel from synchronizing between computers. + - If you enable this policy setting, Travel user settings continue to sync. - If you disable this policy setting, Travel user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7718,7 +7834,7 @@ By default, the user settings of Travel sync between computers. Use the policy s This policy setting enables the User Experience Virtualization (UE-V) tray icon. By default, an icon appears in the system tray that displays notifications for UE-V. This icon also provides a link to the UE-V Agent application, Company Settings Center. Users can open the Company Settings Center by right-clicking the icon and selecting Open or by double-clicking the icon. When this group policy setting is enabled, the UE-V tray icon is visible, the UE-V notifications display, and the Company Settings Center is accessible from the tray icon. With this setting disabled, the tray icon does not appear in the system tray, UE-V never displays notifications, and the user cannot access Company Settings Center from the system tray. The Company Settings Center remains accessible through the Control Panel and the Start menu or Start screen. -- If you do not configure this policy setting, any defined values are deleted. +If you do not configure this policy setting, any defined values are deleted. @@ -7780,6 +7896,7 @@ With this setting disabled, the tray icon does not appear in the system tray, UE This policy setting configures the synchronization of user settings for the Video app. By default, the user settings of Video sync between computers. Use the policy setting to prevent the user settings of Video from synchronizing between computers. + - If you enable this policy setting, Video user settings continue to sync. - If you disable this policy setting, Video user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7844,6 +7961,7 @@ By default, the user settings of Video sync between computers. Use the policy se This policy setting configures the synchronization of user settings for the Weather app. By default, the user settings of Weather sync between computers. Use the policy setting to prevent the user settings of Weather from synchronizing between computers. + - If you enable this policy setting, Weather user settings continue to sync. - If you disable this policy setting, Weather user settings are excluded from synchronization. - If you do not configure this policy setting, any defined values will be deleted. @@ -7908,6 +8026,7 @@ By default, the user settings of Weather sync between computers. Use the policy This policy setting configures the synchronization of user settings of WordPad. By default, the user settings of WordPad synchronize between computers. Use the policy setting to prevent the user settings of WordPad from synchronization between computers. + - If you enable this policy setting, the WordPad user settings continue to synchronize. - If you disable this policy setting, WordPad user settings are excluded from the synchronization settings. - If you do not configure this policy setting, any defined values will be deleted. diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md index 1f26fcf32f..e5f3324a38 100644 --- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_UserProfiles Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days +This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. > [!NOTE] > One day is interpreted as 24 hours after a specific user profile was accessed. @@ -373,7 +373,7 @@ This policy setting and related policy settings in this folder together define t - If you enable this policy setting, you can change how long Windows waits for a response from the server before considering the connection to be slow. -- If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond. Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections +- If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond. Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections. > [!IMPORTANT] > If the "Do not detect slow network connections" policy setting is enabled, this policy setting is ignored. Also, if the "Delete cached copies of roaming profiles" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection. @@ -507,7 +507,7 @@ This setting prevents users from managing the ability to allow apps to access th "Always off" - users will not be able to change this setting and the user's name and account picture will not be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will not be able to retrieve the user's UPN, SIP/URI, and DNS. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources. -If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off. +- If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off. diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md index 48ea1bbd7f..f35943b958 100644 --- a/windows/client-management/mdm/policy-csp-admx-w32time.md +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_W32Time Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -46,7 +46,7 @@ This policy setting allows you to specify Clock discipline and General values fo - If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values. -For more details on individual parameters, combinations of parameter values as well as definitions of flags, see . +For more details on individual parameters, combinations of parameter values as well as definitions of flags, see< https://go.microsoft.com/fwlink/?linkid=847809>. FrequencyCorrectRate This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause larger corrections; larger values cause smaller corrections. Default: 4 (scalar). diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md index f572e7a8d8..525dff55c9 100644 --- a/windows/client-management/mdm/policy-csp-admx-wcm.md +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WCM Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -109,9 +109,9 @@ This policy setting determines whether Windows will soft-disconnect a computer f - If this policy setting is disabled, Windows will disconnect a computer from a network immediately when it determines that the computer should no longer be connected to a network. When soft disconnect is enabled: -- When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted. -- Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection. -- When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they're not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network. + - When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted. + - Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection. + - When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they're not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network. This policy setting depends on other group policy settings. For example, if 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is disabled, Windows will not disconnect from any networks. diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index 8a53921483..be0b41abb0 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WindowsExplorer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/10/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -357,6 +357,7 @@ This disables access to user-defined properties, and properties stored in NTFS s This policy setting allows you to turn off Windows Libraries features that need indexed file metadata to function properly. + - If you enable this policy, some Windows Libraries features will be turned off to better handle included folders that have been redirected to non-indexed network locations. Setting this policy will: * Disable all Arrangement views except for "By Folder" @@ -681,8 +682,7 @@ For more information, see [Microsoft Defender SmartScreen](/windows/security/thr -This setting is designed to ensure that shell extensions can operate on a per-user basis. -- If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine. +This setting is designed to ensure that shell extensions can operate on a per-user basis. If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine. A shell extension only runs if there is an entry in at least one of the following locations in registry. @@ -749,6 +749,7 @@ For shell extensions to run on a per-user basis, there must be an entry at HKEY_ This policy setting allows you to specify whether the ribbon appears minimized or in full when new File Explorer windows are opened. + - If you enable this policy setting, you can set how the ribbon appears the first time users open File Explorer and whenever they open new windows. - If you disable or do not configure this policy setting, users can choose how the ribbon appears when they open new windows. @@ -2776,7 +2777,7 @@ Also, see the "Prevent access to drives from My Computer" policy setting. Removes all computers outside of the user's workgroup or local domain from lists of network resources in File Explorer and Network Locations. -- If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option. +If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option. This setting does not prevent users from viewing or connecting to computers in their workgroup or domain. It also does not prevent users from connecting to remote computers by other commonly used methods, such as by typing the share name in the Run dialog box or the Map Network Drive dialog box. @@ -2900,6 +2901,7 @@ This setting does not prevent users from using other methods to perform tasks av Removes the list of most recently used files from the Open dialog box. - If you disable this setting or do not configure it, the "File name" field includes a drop-down list of recently used files. + - If you enable this setting, the "File name" field is a simple text box. Users must browse directories to find a file or type a file name in the text box. This setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs. @@ -3213,7 +3215,7 @@ When a Windows client is in a workgroup, a Shared Documents icon appears in the Prevents users from using File Explorer or Network Locations to map or disconnect network drives. -- If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons. +If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons. This setting does not prevent users from connecting to another computer by typing the name of a shared folder in the Run dialog box. @@ -3465,6 +3467,7 @@ Prevents users from submitting alternate logon credentials to install a program. This setting suppresses the "Install Program As Other User" dialog box for local and network installations. This dialog box, which prompts the current user for the user name and password of an administrator, appears when users who are not administrators try to install programs locally on their computers. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. Many programs can be installed only by an administrator. + - If you enable this setting and a user does not have sufficient permissions to install a program, the installation continues with the current user's logon credentials. As a result, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly. - If you disable this setting or do not configure it, the "Install Program As Other User" dialog box appears whenever users install programs locally on the computer. @@ -3525,6 +3528,7 @@ By default, users are not prompted for alternate logon credentials when installi + - If you enable this policy, the "Internet" "Search again" link will not be shown when the user performs a search in the Explorer window. - If you disable this policy, there will be an "Internet" "Search again" link when the user performs a search in the Explorer window. This button launches a search in the default browser with the search terms. @@ -3714,6 +3718,7 @@ This policy setting does not affect the Search items on the File Explorer contex This policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order. + - If you enable this policy setting, File Explorer will sort file names by each digit in a file name (for example, 111 < 22 < 3). - If you disable or do not configure this policy setting, File Explorer will sort file names by increasing number value (for example, 3 < 22 < 111). @@ -3773,7 +3778,7 @@ This policy setting allows you to have file names sorted literally (as in Window Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear when you right-click an item. -- If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus. +If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus. @@ -3831,7 +3836,7 @@ Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear Prevents users from using My Computer to gain access to the content of selected drives. -- If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. +If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. To use this setting, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this setting or select the "Do not restrict drives" option from the drop-down list. @@ -4039,7 +4044,7 @@ The list of Common Shell Folders that may be specified: Desktop, Recent Places, Documents, Pictures, Music, Recently Changed, Attachments and Saved Searches. -- If you disable or do not configure this setting the default list of items will be displayed in the Places Bar. +If you disable or do not configure this setting the default list of items will be displayed in the Places Bar. > [!NOTE] > In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. @@ -4101,7 +4106,7 @@ Prompts users for alternate logon credentials during network-based installations This setting displays the "Install Program As Other User" dialog box even when a program is being installed from files on a network computer across a local area network connection. -- If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media. +If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media. The "Install Program as Other User" dialog box prompts the current user for the user name and password of an administrator. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md index 97b2a94a4a..3f211bcf84 100644 --- a/windows/client-management/mdm/policy-csp-admx-winlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WinLogon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,6 +45,7 @@ ms.topic: reference Specifies an alternate user interface. The Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface. + - If you enable this setting, the system starts the interface you specify instead of Explorer.exe. To use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file. @@ -176,7 +177,7 @@ This policy controls whether the logged on user should be notified when his logo - If you disable or do not configure this setting, users receive warnings before the logon hours expire, if actions have been set to occur when the logon hours expire. > [!NOTE] -> If you configure this setting, you might want to examine and appropriately configure the "Set action to take when logon hours expire" setting. If "Set action to take when logon hours expire" is disabled or not configured, the "Remove logon hours expiration warnings" setting will have no effect, and users receive no warnings about logon hour expiration +> If you configure this setting, you might want to examine and appropriately configure the "Set action to take when logon hours expire" setting. If "Set action to take when logon hours expire" is disabled or not configured, the "Remove logon hours expiration warnings" setting will have no effect, and users receive no warnings about logon hour expiration. @@ -243,7 +244,7 @@ If you choose to log off a user, the user cannot log on again except during perm - If you disable or do not configure this setting, the system takes no action when the user's logon hours expire. The user can continue the existing session, but cannot log on to a new session. > [!NOTE] -> If you configure this setting, you might want to examine and appropriately configure the "Remove logon hours expiration warnings" setting +> If you configure this setting, you might want to examine and appropriately configure the "Remove logon hours expiration warnings" setting. diff --git a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md index 1ba24c4abe..1d2efeeadc 100644 --- a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md +++ b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_WorkFoldersClient Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -165,7 +165,7 @@ This policy setting specifies the Work Folders server for affected users, as wel The "Work Folders URL" can specify either the URL used by the organization for Work Folders discovery, or the specific URL of the file server that stores the affected users' data. -The "Work Folders Local Path" specifies the local folder used on the client machine to sync files. This path may contain environment variables +The "Work Folders Local Path" specifies the local folder used on the client machine to sync files. This path may contain environment variables. > [!NOTE] > In order for this configuration to take effect, a valid 'Work Folders URL' must also be specified. diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 849c9609bc..dfa18c48f2 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -4,7 +4,7 @@ description: Learn more about the ApplicationDefaults Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,19 @@ ms.topic: reference - -This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc. xml), and then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Azure Active Directory joined, the associations assigned in SyncML will be processed and default associations will be applied. + +This policy specifies the path to a file (e.g. either stored locally or on a network location) that contains file type and protocol default application associations. This file can be created using the DISM tool. + +For example: +Dism.exe /Online /Export-DefaultAppAssociations:C:\AppAssoc.txt + +For more information, refer to the DISM documentation on TechNet. + +If this group policy is enabled and the client machine is domain-joined, the file will be processed and default associations will be applied at logon time. + +If the group policy is not configured, disabled, or the client machine is not domain-joined, no default associations will be applied at logon time. + +If the policy is enabled, disabled, or not configured, users will still be able to override default file type and protocol associations. @@ -60,7 +71,7 @@ This policy allows an administrator to set default file type and protocol associ |:--|:--| | Name | DefaultAssociationsConfiguration | | Friendly Name | Set a default associations configuration file | -| Element Name | Default Associations Configuration File | +| Element Name | Default Associations Configuration File. | | Location | Computer Configuration | | Path | WindowsComponents > File Explorer | | Registry Key Name | Software\Policies\Microsoft\Windows\System | @@ -147,7 +158,7 @@ Enabling this policy setting enables web-to-app linking so that apps can be laun Disabling this policy disables web-to-app linking and http(s) URIs will be opened in the default browser instead of launching the associated app. -- If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. +If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 8e2b18b64d..6cd0b742ae 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -4,7 +4,7 @@ description: Learn more about the ApplicationManagement Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -309,8 +309,7 @@ Allows or denies development of Microsoft Store applications and installing them Windows Game Recording and Broadcasting. -This setting enables or disables the Windows Game Recording and Broadcasting features. -- If you disable this setting, Windows Game Recording will not be allowed. +This setting enables or disables the Windows Game Recording and Broadcasting features. If you disable this setting, Windows Game Recording will not be allowed. If the setting is enabled or not configured, then Recording and Broadcasting (streaming) will be allowed. @@ -446,7 +445,7 @@ Manages a Windows app's ability to share data between users who have installed t -This policy is deprecated +This policy is deprecated. @@ -498,7 +497,7 @@ This policy is deprecated -This policy is deprecated +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index f4f3975002..8163149bf4 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -4,7 +4,7 @@ description: Learn more about the AppVirtualization Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1526,7 +1526,7 @@ Specifies that streamed package contents will be not be saved to the local hard -If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache +If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache. diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 46796cc58d..f558a57eaa 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -4,7 +4,7 @@ description: Learn more about the Audit Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/10/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -98,7 +98,8 @@ Volume: High on domain controllers. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. +- If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. @@ -160,7 +161,8 @@ Volume: High on Kerberos Key Distribution Center servers. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. +- If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. @@ -404,7 +406,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +- If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. @@ -466,7 +469,8 @@ Volume: High. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +- If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. @@ -528,7 +532,8 @@ Volume: High. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +- If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. @@ -590,7 +595,8 @@ Volume: High. -This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +- If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. - If you do not configure this policy setting, no audit event is generated when a logon session is closed. @@ -713,7 +719,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser -This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +- If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. - If you do not configure this policy settings, IAS and NAP user access requests are not audited. @@ -836,7 +843,7 @@ Volume: Low. -This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](). +This policy setting allows you to audit events generated by special logons such as the following : The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). @@ -958,7 +965,8 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser -This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group. If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to application groups such as the following: Application group is created, changed, or deleted. Member is added or removed from an application group. +- If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an application group changes. @@ -1020,7 +1028,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. +- If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a computer account changes. @@ -1082,7 +1091,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to distribution groups such as the following Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to distribution groups such as the following: Distribution group is created, changed, or deleted. Member is added or removed from a distribution group. Distribution group type is changed. +- If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a distribution group changes. > [!NOTE] @@ -1147,7 +1157,7 @@ Volume: Low. -This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy +This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. @@ -1208,7 +1218,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed. +- If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a security group changes. @@ -1270,7 +1281,8 @@ Volume: Low. -This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account's password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored. If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit changes to user accounts. Events include the following: A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. A user account's password is set or changed. A security identifier (SID) is added to the SID History of a user account. The Directory Services Restore Mode password is configured. Permissions on administrative user accounts are changed. Credential Manager credentials are backed up or restored. +- If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a user account changes. @@ -1332,7 +1344,8 @@ Volume: Low. -This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see [How to Use Data Protection](/dotnet/standard/security/how-to-use-data-protection). If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see [How to Use Data Protection](/dotnet/standard/security/how-to-use-data-protection). +- If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. @@ -1394,7 +1407,8 @@ Volume: Low. -This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +This policy setting allows you to audit when plug and play detects an external device. +- If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. - If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -1456,7 +1470,8 @@ Volume: Low. -This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. +- If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a process is created. @@ -1518,7 +1533,8 @@ Volume: Depends on how the computer is used. -This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated when a process ends. +- If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a process ends. @@ -1580,7 +1596,8 @@ Volume: Depends on how the computer is used. -This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit inbound remote procedure call (RPC) connections. +- If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. @@ -1828,7 +1845,8 @@ Volume: High on domain controllers. None on client computers. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object's properties. Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. > [!NOTE] -> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. +- If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. - If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. @@ -1890,7 +1908,8 @@ Volume: High on domain controllers only. -This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. +- If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. - If you do not configure this policy setting, no audit event is generated during AD DS replication. @@ -2135,10 +2154,12 @@ Volume: Medium or Low on computers running Active Directory Certificate Services -This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. +This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. +- If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. > [!NOTE] > There are no system access control lists (SACLs) for shared folders. + - If this policy setting is enabled, access to all shared files and folders on the system is audited. @@ -2200,11 +2221,13 @@ Volume: High on a file server or domain controller because of SYSVOL network acc -This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. +This policy setting allows you to audit attempts to access a shared folder. +- If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. - If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. > [!NOTE] > There are no system access control lists (SACLs) for shared folders. + - If this policy setting is enabled, access to all shared folders on the system is audited. @@ -2266,7 +2289,8 @@ Volume: High on a file server or domain controller because of SYSVOL network acc -This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see . If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see< https://go.microsoft.com/fwlink/?LinkId=122083>. +- If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. > [!NOTE] @@ -2331,7 +2355,8 @@ Volume: Depends on how the file system SACLs are configured. -This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections. If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: The Windows Firewall Service blocks an application from accepting incoming connections on the network. The WFP allows a connection. The WFP blocks a connection. The WFP permits a bind to a local port. The WFP blocks a bind to a local port. The WFP allows a connection. The WFP blocks a connection. The WFP permits an application or service to listen on a port for incoming connections. The WFP blocks an application or service to listen on a port for incoming connections. +- If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. - If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. @@ -2454,7 +2479,8 @@ Volume: High. -This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. +- If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a handle is manipulated. > [!NOTE] @@ -2522,7 +2548,7 @@ Volume: Depends on how SACLs are configured. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!NOTE] -> The Audit Audit the access of global system objects policy setting controls the default SACL of kernel objects. +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. @@ -2644,7 +2670,8 @@ Volume: Low. -This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. +- If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. > [!NOTE] @@ -2709,7 +2736,8 @@ Volume: Depends on how registry SACLs are configured. -This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. +- If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. @@ -2770,11 +2798,12 @@ This policy setting allows you to audit user attempts to access file system obje -This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER - A user account. SAM_DOMAIN - A domain. SAM_SERVER - A computer account. If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: SAM_ALIAS -- A local group. SAM_GROUP -- A group that is not a local group. SAM_USER - A user account. SAM_DOMAIN - A domain. SAM_SERVER - A computer account. +- If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. > [!NOTE] -> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume High on domain controllers. For information about SACL, see [Access control lists](/windows/win32/secauthz/access-control-lists). +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). @@ -2835,7 +2864,8 @@ Volume: High on domain controllers. For more information about reducing the numb -This policy setting allows you to audit events generated by changes to the authentication policy such as the following Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to the authentication policy such as the following: Creation of forest and domain trusts. Modification of forest and domain trusts. Removal of forest and domain trusts. Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. Granting of any of the following user rights to a user or group: Access This Computer From the Network. Allow Logon Locally. Allow Logon Through Terminal Services. Logon as a Batch Job. Logon a Service. Namespace collision. For example, when a new trust has the same name as an existing namespace name. +- If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. > [!NOTE] @@ -2900,7 +2930,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object. If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to the authorization policy such as the following: Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the "Authentication Policy Change" subcategory. Changes in the Encrypted File System (EFS) policy. Changes to the Resource attributes of an object. Changes to the Central Access Policy (CAP) applied to an object. +- If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when the authorization policy changes. @@ -2962,7 +2993,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine. If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: IPsec services status. Changes to IPsec policy settings. Changes to Windows Firewall policy settings. Changes to WFP providers and engine. +- If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. @@ -3024,7 +3056,8 @@ Volume: Low. -This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings. If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: Reporting of active policies when Windows Firewall service starts. Changes to Windows Firewall rules. Changes to Windows Firewall exception list. Changes to Windows Firewall settings. Rules ignored or not applied by Windows Firewall Service. Changes to Windows Firewall Group Policy settings. +- If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. @@ -3147,7 +3180,7 @@ Volume: Low. -This policy setting allows you to audit changes in the security audit policy settings such as the following Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list. +This policy setting allows you to audit changes in the security audit policy settings such as the following: Settings permissions and audit settings on the Audit Policy object. Changes to the system audit policy. Registration of security event sources. De-registration of security event sources. Changes to the per-user audit settings. Changes to the value of CrashOnAuditFail. Changes to the system access control list on a file system or registry object. Changes to the Special Groups list. > [!NOTE] > System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. @@ -3212,7 +3245,8 @@ Volume: Low. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: Access Credential Manager as a trusted caller. Access this computer from the network. Add workstations to domain. Adjust memory quotas for a process. Allow log on locally. Allow log on through Terminal Services. Bypass traverse checking. Change the system time. Create a pagefile. Create global objects. -Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data. If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +Create permanent shared objects. Create symbolic links. Deny access this computer from the network. Deny log on as a batch job. Deny log on as a service. Deny log on locally. Deny log on through Terminal Services. Force shutdown from a remote system. Increase a process working set. Increase scheduling priority. Lock pages in memory. Log on as a batch job. Log on as a service. Modify an object label. Perform volume maintenance tasks. Profile single process. Profile system performance. Remove computer from docking station. Shut down the system. Synchronize directory service data. +- If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. - If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. @@ -3334,7 +3368,8 @@ Not used. -This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects. If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: A privileged service is called. One of the following privileges are called: Act as part of the operating system. Back up files and directories. Create a token object. Debug programs. Enable computer and user accounts to be trusted for delegation. Generate security audits. Impersonate a client after authentication. Load and unload device drivers. Manage auditing and security log. Modify firmware environment values. Replace a process-level token. Restore files and directories. Take ownership of files or other objects. +- If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. - If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. @@ -3396,7 +3431,8 @@ Volume: High. -This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters. If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events generated by the IPsec filter driver such as the following: Startup and shutdown of the IPsec services. Network packets dropped due to integrity check failure. Network packets dropped due to replay check failure. Network packets dropped due to being in plaintext. Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. Inability to process IPsec filters. +- If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. @@ -3580,7 +3616,8 @@ Volume: Low. -This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +This policy setting allows you to audit events related to security system extensions or services such as the following: A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +- If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. - If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 019ddd4885..3fa1f38453 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -4,7 +4,7 @@ description: Learn more about the Authentication Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - Authentication +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -356,7 +359,7 @@ Your organization's PIN reset or web sign-in authentication flow is expected to -Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts +Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts. @@ -394,6 +397,56 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex + +## EnablePasswordlessExperience + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Authentication/EnablePasswordlessExperience +``` + + + + +Specifies whether connected users on AADJ devices receive a Passwordless experience on Windows. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | The feature defaults to the existing edition and device capabilities. | +| 1 | Enabled. The Passwordless experience will be enabled on Windows. | +| 2 | Disabled. The Passwordless experience will not be enabled on Windows. | + + + + + + + + ## EnableWebSignIn @@ -411,7 +464,7 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex -Specifies whether web-based sign-in is allowed for signing in to Windows +Specifies whether web-based sign-in is allowed for signing in to Windows. diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index 332ce05cc6..a51ea4a85a 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -4,7 +4,7 @@ description: Learn more about the BITS Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,12 +36,19 @@ ms.topic: reference - -This policy specifies the bandwidth throttling end time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 17 (5 PM). Supported value range 0 - 23. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. -- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth + +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.) + +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. + +- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. + +- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. > [!NOTE] -> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). +> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. + +Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -66,7 +73,7 @@ This policy specifies the bandwidth throttling end time that Background Intellig |:--|:--| | Name | BITS_MaxBandwidth | | Friendly Name | Limit the maximum network bandwidth for BITS background transfers | -| Element Name | to | +| Element Name | to. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | @@ -95,12 +102,19 @@ This policy specifies the bandwidth throttling end time that Background Intellig - -This policy specifies the bandwidth throttling start time that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. Value type is integer. Default value is 8 (8 am). Supported value range 0 - 23. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. -- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth + +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.) + +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. + +- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. + +- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. > [!NOTE] -> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). +> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. + +Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -125,7 +139,7 @@ This policy specifies the bandwidth throttling start time that Background Intell |:--|:--| | Name | BITS_MaxBandwidth | | Friendly Name | Limit the maximum network bandwidth for BITS background transfers | -| Element Name | From | +| Element Name | From. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | @@ -154,12 +168,19 @@ This policy specifies the bandwidth throttling start time that Background Intell - -This policy specifies the bandwidth throttling transfer rate in kilobits per second (Kbps) that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. Value type is integer. Default value is 1000. Supported value range 0 - 4294967200. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 800 A. M. to 500 P. M. , and use all available unused bandwidth the rest of the day's hours. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. -- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth + +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.) + +You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A. M. to 5:00 P. M., and use all available unused bandwidth the rest of the day's hours. + +- If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. + +- If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. > [!NOTE] -> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the Limit the maximum network bandwidth used for Peercaching policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). +> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. + +Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -184,7 +205,7 @@ This policy specifies the bandwidth throttling transfer rate in kilobits per sec |:--|:--| | Name | BITS_MaxBandwidth | | Friendly Name | Limit the maximum network bandwidth for BITS background transfers | -| Element Name | Limit background transfer rate (Kbps) to | +| Element Name | Limit background transfer rate (Kbps) to. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | @@ -213,9 +234,27 @@ This policy specifies the bandwidth throttling transfer rate in kilobits per sec - -This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of background transfers. -- If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained + +This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers. + +If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. + +For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are: + - Always transfer + - Transfer unless roaming + - Transfer unless surcharge applies (when not roaming or overcap) + - Transfer unless nearing limit (when not roaming or nearing cap) + - Transfer only if unconstrained + - Custom--allows you to specify a bitmask, in which the bits describe cost states allowed or disallowed for this priority: (bits described here) +0x1 - The cost is unknown or the connection is unlimited and is considered to be unrestricted of usage charges and capacity constraints. +0x2 - The usage of this connection is unrestricted up to a certain data limit +0x4 - The usage of this connection is unrestricted up to a certain data limit and plan usage is less than 80 percent of the limit. +0x8 - Usage of this connection is unrestricted up to a certain data limit and plan usage is between 80 percent and 100 percent of the limit. +0x10 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. Surcharge applied or unknown. +0x20 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. No surcharge applies, but speeds are likely reduced. +0x40 - The connection is costed on a per-byte basis. +0x80 - The connection is roaming. +0x80000000 - Ignore congestion. @@ -251,7 +290,7 @@ This policy setting defines the default behavior that the Background Intelligent |:--|:--| | Name | BITS_SetTransferPolicyOnCostedNetwork | | Friendly Name | Set default download behavior for BITS jobs on costed networks | -| Element Name | Normal | +| Element Name | Normal. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS\TransferPolicy | @@ -280,9 +319,27 @@ This policy setting defines the default behavior that the Background Intelligent - -This policy setting defines the default behavior that the foreground Intelligent Transfer Service (BITS) uses for foreground transfers when the system is connected to a costed network (3G, etc. ). Download behavior policies further limit the network usage of foreground transfers. -- If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. For example, you can specify that foreground jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:1 - Always transfer2 - Transfer unless roaming3 - Transfer unless surcharge applies (when not roaming or overcap)4 - Transfer unless nearing limit (when not roaming or nearing cap)5 - Transfer only if unconstrained + +This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers. + +If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. + +For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are: + - Always transfer + - Transfer unless roaming + - Transfer unless surcharge applies (when not roaming or overcap) + - Transfer unless nearing limit (when not roaming or nearing cap) + - Transfer only if unconstrained + - Custom--allows you to specify a bitmask, in which the bits describe cost states allowed or disallowed for this priority: (bits described here) +0x1 - The cost is unknown or the connection is unlimited and is considered to be unrestricted of usage charges and capacity constraints. +0x2 - The usage of this connection is unrestricted up to a certain data limit +0x4 - The usage of this connection is unrestricted up to a certain data limit and plan usage is less than 80 percent of the limit. +0x8 - Usage of this connection is unrestricted up to a certain data limit and plan usage is between 80 percent and 100 percent of the limit. +0x10 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. Surcharge applied or unknown. +0x20 - Usage of this connection is unrestricted up to a certain data limit, which has been exceeded. No surcharge applies, but speeds are likely reduced. +0x40 - The connection is costed on a per-byte basis. +0x80 - The connection is roaming. +0x80000000 - Ignore congestion. @@ -318,7 +375,7 @@ This policy setting defines the default behavior that the foreground Intelligent |:--|:--| | Name | BITS_SetTransferPolicyOnCostedNetwork | | Friendly Name | Set default download behavior for BITS jobs on costed networks | -| Element Name | Foreground | +| Element Name | Foreground. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS\TransferPolicy | @@ -347,11 +404,17 @@ This policy setting defines the default behavior that the foreground Intelligent - -This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk + +This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk. > [!NOTE] -> Any property changes to the job or any successful download action will reset this timeout. Value type is integer. Default is 90 days. Supported values range 0 - 999. Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs. Consider decreasing this value if you are concerned about orphaned jobs occupying disk space. +> Any property changes to the job or any successful download action will reset this timeout. + +Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs. +Consider decreasing this value if you are concerned about orphaned jobs occupying disk space. + +- If you enable this policy setting, you can configure the inactive job timeout to specified number of days. + - If you disable or do not configure this policy setting, the default value of 90 (days) will be used for the inactive job timeout. @@ -377,7 +440,7 @@ This policy setting specifies the number of days a pending BITS job can remain i |:--|:--| | Name | BITS_Job_Timeout | | Friendly Name | Timeout for inactive BITS jobs | -| Element Name | Inactive Job Timeout in Days | +| Element Name | Inactive Job Timeout in Days. | | Location | Computer Configuration | | Path | Network > Background Intelligent Transfer Service (BITS) | | Registry Key Name | Software\Policies\Microsoft\Windows\BITS | diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index e2910d975d..d3031acbca 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -4,7 +4,7 @@ description: Learn more about the Bluetooth Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -272,7 +272,7 @@ Sets the local Bluetooth device name. If this is set, the value that it is set t -Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7. CAA-436. C-8. BF0-78. CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide +Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7. CAA-436. C-8. BF0-78. CD0FFBD4AF}. The default value is an empty string. For more information, see ServicesAllowedList usage guide. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 8f7766c3a5..821501520e 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -4,7 +4,7 @@ description: Learn more about the Browser Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -200,7 +200,7 @@ To verify AllowAutofill is set to 0 (not allowed): -This policy is deprecated +This policy is deprecated. @@ -305,8 +305,15 @@ This policy setting lets you decide whether Microsoft Edge can automatically upd - -This setting lets you configure how your company deals with cookies. + +This setting lets you configure how to work with cookies. + +- If you enable this setting, you must also decide whether to: +Allow all cookies (default): Allows all cookies from all websites. +Block all cookies: Blocks all cookies from all websites. +Block only 3rd-party cookies: Blocks only cookies from 3rd-party websites. + +- If you disable or don't configure this setting, all cookies are allowed from all sites. @@ -340,7 +347,7 @@ This setting lets you configure how your company deals with cookies. |:--|:--| | Name | Cookies | | Friendly Name | Configure cookies | -| Element Name | Configure Cookies | +| Element Name | Configure Cookies. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Main | @@ -1483,8 +1490,8 @@ Computer Configuration > Administrative Templates > Windows Components > App Pac Supported versions: Microsoft Edge on Windows 10, version 1809 Default setting: Disabled or not configured Related policies: -- Allows development of Windows Store apps and installing them from an integrated development environment (IDE) -- Allow all trusted apps to install + - Allows development of Windows Store apps and installing them from an integrated development environment (IDE) + - Allow all trusted apps to install @@ -1920,9 +1927,17 @@ To verify whether browsing data is cleared on exit (ClearBrowsingDataOnExit is s - -Allows you to add up to 5 additional search engines for MDM-enrolled devices. If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. If this setting is not configured, the search engines are the ones specified in the App settings. -- If this setting is disabled, the search engines you had added will be deleted from your employee's machine. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + +This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting. + +**Important** +This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). + +- If you enable this setting, you can add up to 5 additional search engines. For each additional engine, you must also add a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/library/dd163546.aspx) topic. Use this format to specify the link(s) you wish to add: `` `` + +- If you disable this setting, any added search engines are removed from your employee's devices. + +- If you don't configure this setting, the search engine list is set to what is specified in App settings. @@ -1945,7 +1960,7 @@ Allows you to add up to 5 additional search engines for MDM-enrolled devices. If |:--|:--| | Name | ConfigureAdditionalSearchEngines | | Friendly Name | Configure additional search engines | -| Element Name | Use this format to specify the link(s) you wish to add: `<>` `<>` | +| Element Name | Use this format to specify the link(s) you wish to add: `` `` | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\OpenSearch | @@ -2051,8 +2066,23 @@ If not configured, the favorites bar is hidden but is visible on the Start and N - -The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. By default, this policy is disabled or not configured and clicking the home button loads the default Start page. When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. If Enabled AND: - Show home button & set to Start page is selected, clicking the home button loads the Start page. - Show home button & set to New tab page is selected, clicking the home button loads a New tab page. - Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. - Hide home button is selected, the home button is hidden in Microsoft Edge. Default setting: Disabled or not configured Related policies: - Set Home Button URL - Unlock Home Button + +The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. + +By default, this policy is disabled or not configured and clicking the home button loads the default Start page. + +When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. + +If Enabled AND: + - Show home button & set to Start page is selected, clicking the home button loads the Start page. + - Show home button & set to New tab page is selected, clicking the home button loads a New tab page. + - Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. + - Hide home button is selected, the home button is hidden in Microsoft Edge. + +Default setting: Disabled or not configured +Related policies: + - Set Home Button URL + - Unlock Home Button. @@ -2087,7 +2117,7 @@ The Home button loads either the default Start page, the New tab page, or a URL |:--|:--| | Name | ConfigureHomeButton | | Friendly Name | Configure Home Button | -| Element Name | Configure the Home Button | +| Element Name | Configure the Home Button. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings | @@ -2122,8 +2152,17 @@ The Home button loads either the default Start page, the New tab page, or a URL - -Configure how Microsoft Edge behaves when it's running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see "Configure kiosk and shared devices running Windows desktop editions" (. If enabled and set to 0 (Default or not configured): - If it's a single app, it runs InPrivate full screen for digital signage or interactive displays. - If it's one of many apps, Microsoft Edge runs as normal. If enabled and set to 1: - If it's a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can't minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking "End session." You can configure Microsoft Edge to restart after a period of inactivity by using the "Configure kiosk reset after idle timeout" policy. - If it's one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can't customize Microsoft Edge. + +Configure how Microsoft Edge behaves when it's running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. + +You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see "Configure kiosk and shared devices running Windows desktop editions" (https://aka.ms/E489vw). + +If enabled and set to 0 (Default or not configured): + - If it's a single app, it runs InPrivate full screen for digital signage or interactive displays. + - If it's one of many apps, Microsoft Edge runs as normal. +If enabled and set to 1: + - If it's a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can't minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking "End session." You can configure Microsoft Edge to restart after a period of inactivity by using the "Configure kiosk reset after idle timeout" policy. + - If it's one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can't customize Microsoft Edge. @@ -2188,8 +2227,16 @@ Configure how Microsoft Edge behaves when it's running in kiosk mode with assign - -You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user's browsing data. If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. If you set this policy to 0, Microsoft Edge does not use an idle timer. If disabled or not configured, the default value is 5 minutes. If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. + +You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user's browsing data. + +If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. + +If you set this policy to 0, Microsoft Edge does not use an idle timer. + +If disabled or not configured, the default value is 5 minutes. + +If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. @@ -2247,8 +2294,23 @@ You can configure Microsoft Edge to reset to the configured start experience aft - -You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. If enabled, you can choose one of the following options: - Start page: the Start page loads ignoring the Configure Start Pages policy. - New tab page: the New tab page loads ignoring the Configure Start Pages policy. - Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. - A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. Default setting: A specific page or pages (default) Related policies: -Disable Lockdown of Start Pages -Configure Start Pages + +You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. + +If enabled, you can choose one of the following options: + - Start page: the Start page loads ignoring the Configure Start Pages policy. + - New tab page: the New tab page loads ignoring the Configure Start Pages policy. + - Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. + - A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. + +When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Microsoft Edge With policy, and then enable the Disable Lockdown of Start Pages policy. + +If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. + +Default setting: A specific page or pages (default) +Related policies: +-Disable Lockdown of Start Pages +-Configure Start Pages. @@ -2283,7 +2345,7 @@ You can configure Microsoft Edge to lock down the Start page, preventing users f |:--|:--| | Name | ConfigureOpenEdgeWith | | Friendly Name | Configure Open Microsoft Edge With | -| Element Name | Configure Open Microsoft Edge With | +| Element Name | Configure Open Microsoft Edge With. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings | @@ -2321,8 +2383,11 @@ You can configure Microsoft Edge to lock down the Start page, preventing users f - -Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization. + +You can configure Microsoft Edge to send intranet history only, internet history only, or both to Desktop Analytics for enterprise devices with a configured Commercial ID. If disabled or not configured, Microsoft Edge does not send browsing history data to Desktop Analytics. + +Supported versions: Microsoft Edge on Windows 10, version 1809 +Default setting: Disabled or not configured (no data collected or sent) @@ -2357,7 +2422,7 @@ Configures what browsing data will be sent to Microsoft 365 Analytics for device |:--|:--| | Name | ConfigureTelemetryForMicrosoft365Analytics | | Friendly Name | Configure collection of browsing data for Desktop Analytics | -| Element Name | Configure telemetry collection | +| Element Name | Configure telemetry collection. | | Location | Computer and User Configuration | | Path | WindowsComponents > Data Collection and Preview Builds | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection | @@ -2390,8 +2455,15 @@ Configures what browsing data will be sent to Microsoft 365 Analytics for device - -You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Start Pages - Configure Open Microsoft Edge With + +You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. + +If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. + +Supported devices: Domain-joined or MDM-enrolled +Related policy: + - Configure Start Pages + - Configure Open Microsoft Edge With. @@ -2532,8 +2604,12 @@ This policy setting lets you decide how much data to send to Microsoft about the - -This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. + +This policy setting lets you configure whether to use Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy apps. + +- If you enable this setting, Microsoft Edge looks for the Enterprise Mode Site List XML file. This file includes the sites and domains that need to be viewed using Internet Explorer 11 and Enterprise Mode. + +- If you disable or don't configure this setting, Microsoft Edge won't use the Enterprise Mode Site List XML file. In this case, employees might experience compatibility problems while using legacy apps. @@ -2556,7 +2632,7 @@ This setting lets you configure whether your company uses Enterprise Mode and th |:--|:--| | Name | EnterpriseModeSiteList | | Friendly Name | Configure the Enterprise Mode Site List | -| Element Name | Type the location (URL) of your Enterprise Mode IE website list | +| Element Name | Type the location (URL) of your Enterprise Mode IE website list. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode | @@ -2676,8 +2752,25 @@ Configure first run URL. - -When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: `` `` If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: If you do not want to send traffic to Microsoft, enable this policy and use the `` value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. Supported devices: Domain-joined or MDM-enrolled Related policy: - Configure Open Microsoft Edge With - Disable Lockdown of Start Pages + +When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. + +If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: + +`` `` + +If disabled or not configured, the webpages specified in App settings loads as the default Start pages. + +Version 1703 or later: +If you do not want to send traffic to Microsoft, enable this policy and use the `` value, which honors domain- and non-domain-joined devices, when it is the only configured URL. + +Version 1809: +If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. + +Supported devices: Domain-joined or MDM-enrolled +Related policy: + - Configure Open Microsoft Edge With + - Disable Lockdown of Start Pages. @@ -2700,7 +2793,7 @@ When you enable the Configure Open Microsoft Edge With policy, you can configure |:--|:--| | Name | HomePages | | Friendly Name | Configure Start pages | -| Element Name | Use this format: `` `<>` | +| Element Name | Use this format: `` `` | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Internet Settings | @@ -2808,7 +2901,7 @@ Don't enable both this setting and the Keep favorites in sync between Internet E -This policy settings lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features. +This policy setting lets you decide whether employees can access the about:flags page, which is used to change developer settings and to enable experimental features. - If you enable this policy setting, employees can't access the about:flags page. @@ -3374,12 +3467,14 @@ This policy setting lets you decide whether an employee's LocalHost IP address s - + This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. -- If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites -> [!IMPORTANT] -> Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. +- If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. + +**Important** +Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. + - If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. @@ -3403,7 +3498,7 @@ This policy setting allows you to configure a default set of favorites, which wi |:--|:--| | Name | ConfiguredFavorites | | Friendly Name | Provision Favorites | -| Element Name | Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Microsoft Edge and use that html file for provisioning user machines.

URL can be specified as

1. HTTP location: https://localhost:8080/URLs.html
2. Local network: \\network\shares\URLs.html
3. Local file: file:///c:\\Users\\``\\Documents\\URLs.html or C:\\Users\\``\\Documents\\URLs.html | +| Element Name | Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Microsoft Edge and use that html file for provisioning user machines.

URL can be specified as

1. HTTP location: https://localhost:8080/URLs.html
2. Local network: \\network\shares\URLs.html
3. Local file: file:///c:\\Users\\``\\Documents\\URLs.html or C:\\Users\\``\\Documents\\URLs.html. | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\Favorites | @@ -3514,9 +3609,24 @@ This policy setting lets you decide whether your intranet sites should all open - -Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. -- If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. + +This policy setting lets you configure the default search engine for your employees. Your employees can change the default search engine at any time. + +**Important** +This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy). + +- If you enable this setting, you can choose a default search engine for your employees. + +- If this setting is enabled, you must also add the default engine to the "Set default search engine" setting, by adding a link to your OpenSearch XML file, including at least the short name and https: URL of the search engine. For more info about creating the OpenSearch XML file, see the Understanding OpenSearch Standards (https://msdn.microsoft.com/library/dd163546.aspx) topic. Use this format to specify the link you wish to add: `` + +**Note** +If you'd like your employees to use the default Microsoft Edge settings for each market, you can set the string to EDGEDEFAULT. If you'd like your employees to use Microsoft Bing as the default search engine, you can set the string to EDGEBING. + +Employees can change the default search engine at any time, unless you disable the "Allow search engine customization" setting, which restricts any changes. + +- If you disable this setting, the policy-set default search engine is removed. If this is also the current in-use default, the engine changes to the Microsoft Edge specified engine for the market. + +- If you don't configure this setting, the default search engine is set to the one specified in App settings. @@ -3539,7 +3649,7 @@ Sets the default search engine for MDM-enrolled devices. Users can still change |:--|:--| | Name | SetDefaultSearchEngine | | Friendly Name | Set default search engine | -| Element Name | Use this format to specify the link you wish to add: `<>` | +| Element Name | Use this format to specify the link you wish to add: `` | | Location | Computer and User Configuration | | Path | Windows Components > Microsoft Edge | | Registry Key Name | Software\Policies\Microsoft\MicrosoftEdge\OpenSearch | @@ -3572,8 +3682,13 @@ Sets the default search engine for MDM-enrolled devices. Users can still change - -The home button can be configured to load a custom URL when your user clicks the home button. If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. Default setting: Blank or not configured Related policy: Configure Home Button + +The home button can be configured to load a custom URL when your user clicks the home button. + +If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. + +Default setting: Blank or not configured +Related policy: Configure Home Button. @@ -3629,8 +3744,15 @@ The home button can be configured to load a custom URL when your user clicks the - -You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. If enabled, you can set the default New Tab page URL. If disabled or not configured, the default Microsoft Edge new tab page is used. Default setting: Disabled or not configured Related policy: Allow web content on New Tab page + +You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. + +If enabled, you can set the default New Tab page URL. + +If disabled or not configured, the default Microsoft Edge new tab page is used. + +Default setting: Disabled or not configured +Related policy: Allow web content on New Tab page. @@ -3696,7 +3818,7 @@ If disabled or not configured, the default app behavior occurs and no additional Default setting: Disabled or not configured Related policies: -Configure the Enterprise Mode Site List --Send all intranet sites to Internet Explorer 11 +-Send all intranet sites to Internet Explorer 11. @@ -3852,7 +3974,7 @@ If disabled or not configured, the UI settings for the home button are disabled Default setting: Disabled or not configured Related policy: -Configure Home Button --Set Home Button URL +-Set Home Button URL. diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 6931233c08..aee369d5ea 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -4,7 +4,7 @@ description: Learn more about the Cellular Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -41,8 +41,20 @@ ms.topic: reference - + This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -87,7 +99,7 @@ If an app is open when this Group Policy object is applied on a device, employee |:--|:--| | Name | LetAppsAccessCellularData | | Friendly Name | Let Windows apps access cellular data | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Network > WWAN Service > Cellular Data Access | | Registry Key Name | Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess | @@ -116,8 +128,20 @@ If an app is open when this Group Policy object is applied on a device, employee - -List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -169,8 +193,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -222,8 +258,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access cellular data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index e614be7f73..5bee8f32ce 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -4,7 +4,7 @@ description: Learn more about the CloudDesktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - CloudDesktop +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -37,12 +40,7 @@ ms.topic: reference -This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well. - -This policy supports the below options: - -1. Not Configured: Machine will not trigger the Cloud PC connection automatically. -2. Enable Boot to Cloud Desktop: Users who have a Cloud PC provisioned will get connected seamlessly to the Cloud PC as they finish sign-in operation. +This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well. This policy supports the below options: 1. Not Configured: Machine will not trigger the Cloud PC connection automatically. 2. Enable Boot to Cloud Desktop: Users who have a Cloud PC provisioned will get connected seamlessly to the Cloud PC as they finish sign-in operation. diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 0254386450..8bc1fb0fda 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -4,7 +4,7 @@ description: Learn more about the Connectivity Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -Allows the user to enable Bluetooth or restrict access +Allows the user to enable Bluetooth or restrict access. > [!NOTE] > This value is not supported in Windows Phone 8. 1 MDM and EAS, Windows 10 for desktop, or Windows 10 Mobile. If this is not set or it is deleted, the default value of 2 (Allow) is used. Most restricted value is 0. @@ -220,6 +220,7 @@ To validate, the enterprise can confirm by observing the roaming enable switch i + > [!NOTE] > This policy requires reboot to take effect. Allows IT Admins the ability to disable the Connected Devices Platform (CDP) component. CDP enables discovery and connection to other devices (either proximally with BT/LAN or through the cloud) to support remote app launching, remote messaging, remote app sessions, and other cross-device experiences. @@ -396,6 +397,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li + > [!NOTE] > Currently, this policy is supported only in HoloLens 2, HoloLens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging. Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy is enforced. Most restricted value is 0. @@ -811,7 +813,7 @@ As part of determining the connectivity level, NCSI performs one of two active t This policy setting configures secure access to UNC paths. -- If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. +If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. @@ -874,7 +876,7 @@ Determines whether a user can install and configure the Network Bridge. The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder. -- If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. +If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 6c2609c4c7..fb84b5f3b7 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -4,7 +4,7 @@ description: Learn more about the DataProtection Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -86,7 +86,7 @@ This policy setting allows you to block direct memory access (DMA) for all hot p -Important. This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. Setting used by Windows 8. 1 Selective Wipe +Important. This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. Setting used by Windows 8. 1 Selective Wipe. > [!NOTE] > This policy is not recommended for use in Windows 10. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index c5e12804f1..1f26de308e 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/08/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -221,7 +221,7 @@ In Windows 10, Basic membership is no longer available, so setting the value to |:--|:--| | Name | SpynetReporting | | Friendly Name | Join Microsoft MAPS | -| Element Name | Join Microsoft MAPS | +| Element Name | Join Microsoft MAPS. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MAPS | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet | @@ -697,16 +697,15 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. - -This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. - -- If you enable this setting or do not configure this setting, network files will be scanned. - -- If you disable this setting, network files will not be scanned. + +This policy setting allows you to configure real-time scanning for files that are accessed over the network. It is recommended to enable this setting. + +- If you enable this setting or do not configure this setting, network files will be scanned. +- If you disable this setting, network files will not be scanned. @@ -815,7 +814,7 @@ Allows or disallows Windows Defender Script Scanning functionality. This policy setting allows you to configure whether or not to display AM UI to the users. -- If you enable this setting AM UI won't be available to users. +If you enable this setting AM UI won't be available to users. @@ -883,8 +882,8 @@ Exclude files and paths from Attack Surface Reduction (ASR) rules. Enabled: Specify the folders or files and resources that should be excluded from ASR rules in the Options section. Enter each rule on a new line as a name-value pair: -- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder -- Value column: Enter "0" for each item + - Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder + - Value column: Enter "0" for each item Disabled: No exclusions will be applied to the ASR rules. @@ -916,7 +915,7 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s |:--|:--| | Name | ExploitGuard_ASR_ASROnlyExclusions | | Friendly Name | Exclude files and paths from Attack Surface Reduction Rules | -| Element Name | Exclusions from ASR rules | +| Element Name | Exclusions from ASR rules. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR | @@ -949,26 +948,26 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s Set the state for each Attack Surface Reduction (ASR) rule. After enabling this setting, you can set each rule to the following in the Options section: -- Block: the rule will be applied -- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) -- Off: the rule will not be applied -- Not Configured: the rule is enabled with default values -- Warn: the rule will be applied and the end-user will have the option to bypass the block + - Block: the rule will be applied + - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) + - Off: the rule will not be applied + - Not Configured: the rule is enabled with default values + - Warn: the rule will be applied and the end-user will have the option to bypass the block Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. Enter each rule on a new line as a name-value pair: -- Name column: Enter a valid ASR rule ID -- Value column: Enter the status ID that relates to state you want to specify for the associated rule + - Name column: Enter a valid ASR rule ID + - Value column: Enter the status ID that relates to state you want to specify for the associated rule The following status IDs are permitted under the value column: -- 1 (Block) -- 0 (Off) -- 2 (Audit) -- 5 (Not Configured) -- 6 (Warn) + - 1 (Block) + - 0 (Off) + - 2 (Audit) + - 5 (Not Configured) + - 6 (Warn) Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx @@ -1007,7 +1006,7 @@ You can exclude folders or files in the "Exclude files and paths from Attack Sur |:--|:--| | Name | ExploitGuard_ASR_Rules | | Friendly Name | Configure Attack Surface Reduction rules | -| Element Name | Set the state for each ASR rule | +| Element Name | Set the state for each ASR rule. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR | @@ -1066,7 +1065,7 @@ This policy setting allows you to configure the maximum percentage CPU utilizati |:--|:--| | Name | Scan_AvgCPULoadFactor | | Friendly Name | Specify the maximum percentage of CPU utilization during a scan | -| Element Name | Specify the maximum percentage of CPU utilization during a scan | +| Element Name | Specify the maximum percentage of CPU utilization during a scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -1163,11 +1162,22 @@ This setting applies to scheduled scans, but it has no effect on scans initiated - -This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. For more information about specific values that are supported, see [Specify the cloud protection level](/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus). + +This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. + +If this setting is on, Microsoft Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. + +For more information about specific values that are supported, see the Microsoft Defender Antivirus documentation site. > [!NOTE] -> This feature requires the Join Microsoft MAPS setting enabled in order to function. +> This feature requires the "Join Microsoft MAPS" setting enabled in order to function. + +Possible options are: +(0x0) Default Microsoft Defender Antivirus blocking level +(0x1) Moderate Microsoft Defender Antivirus blocking level, delivers verdict only for high confidence detections +(0x2) High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives) +(0x4) High+ blocking level - aggressively block unknowns and apply additional protection measures (may impact client performance) +(0x6) Zero tolerance blocking level - block all unknown executables. @@ -1202,7 +1212,7 @@ This policy setting determines how aggressive Windows Defender Antivirus will be |:--|:--| | Name | MpEngine_MpCloudBlockLevel | | Friendly Name | Select cloud protection level | -| Element Name | Select cloud blocking level | +| Element Name | Select cloud blocking level. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MpEngine | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine | @@ -1231,11 +1241,15 @@ This policy setting determines how aggressive Windows Defender Antivirus will be - -This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds. + +This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. + +The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. + +For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds. > [!NOTE] -> This feature depends on three other MAPS settings the must all be enabled- Configure the 'Block at First Sight' feature; Join Microsoft MAPS; Send file samples when further analysis is required. +> This feature depends on three other MAPS settings - "Configure the 'Block at First Sight' feature; "Join Microsoft MAPS"; "Send file samples when further analysis is required" all need to be enabled. @@ -1260,7 +1274,7 @@ This feature allows Windows Defender Antivirus to block a suspicious file for up |:--|:--| | Name | MpEngine_MpBafsExtendedTimeout | | Friendly Name | Configure extended cloud check | -| Element Name | Specify the extended cloud check time in seconds | +| Element Name | Specify the extended cloud check time in seconds. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MpEngine | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine | @@ -1331,7 +1345,7 @@ Default system folders are automatically guarded, but you can add folders in the |:--|:--| | Name | ExploitGuard_ControlledFolderAccess_AllowedApplications | | Friendly Name | Configure allowed applications | -| Element Name | Enter the applications that should be trusted | +| Element Name | Enter the applications that should be trusted. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | @@ -1403,7 +1417,7 @@ Microsoft Defender Antivirus automatically determines which applications can be |:--|:--| | Name | ExploitGuard_ControlledFolderAccess_ProtectedFolders | | Friendly Name | Configure protected folders | -| Element Name | Enter the folders that should be guarded | +| Element Name | Enter the folders that should be guarded. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | @@ -1462,7 +1476,7 @@ This policy setting defines the number of days items should be kept in the Quara |:--|:--| | Name | Quarantine_PurgeItemsAfterDelay | | Friendly Name | Configure removal of items from Quarantine folder | -| Element Name | Configure removal of items from Quarantine folder | +| Element Name | Configure removal of items from Quarantine folder. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Quarantine | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Quarantine | @@ -1625,8 +1639,8 @@ This policy setting allows you to configure catch-up scans for scheduled quick s Enable or disable controlled folder access for untrusted applications. You can choose to block, audit, or allow attempts by untrusted apps to: -- Modify or delete files in protected folders, such as the Documents folder -- Write to disk sectors + - Modify or delete files in protected folders, such as the Documents folder + - Write to disk sectors You can also choose to only block or audit writes to disk sectors while still allowing the modification or deletion of files in protected folders. @@ -1635,35 +1649,35 @@ Default system folders are automatically protected, but you can add folders in t Block: The following will be blocked: -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors The Windows event log will record these blocks under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. Disabled: The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors These attempts will not be recorded in the Windows event log. Audit Mode: The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124. Block disk modification only: The following will be blocked: -- Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to write to disk sectors The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to modify or delete files in protected folders These attempts will not be recorded in the Windows event log. Audit disk modification only: The following will not be blocked and will be allowed to run: -- Attempts by untrusted apps to write to disk sectors -- Attempts by untrusted apps to modify or delete files in protected folders + - Attempts by untrusted apps to write to disk sectors + - Attempts by untrusted apps to modify or delete files in protected folders Only attempts to write to protected disk sectors will be recorded in the Windows event log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124). Attempts to modify or delete files in protected folders will not be recorded. @@ -1702,7 +1716,7 @@ Same as Disabled. |:--|:--| | Name | ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess | | Friendly Name | Configure Controlled folder access | -| Element Name | Configure the guard my folders feature | +| Element Name | Configure the guard my folders feature. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | @@ -1871,8 +1885,8 @@ Same as Disabled. - -Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a |. For example, lib|obj. + +This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value is not used and it is recommended that this be set to 0. @@ -1896,7 +1910,7 @@ Allows an administrator to specify a list of file type extensions to ignore duri |:--|:--| | Name | Exclusions_Extensions | | Friendly Name | Extension Exclusions | -| Element Name | Extension Exclusions | +| Element Name | Extension Exclusions. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Exclusions | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | @@ -1925,8 +1939,8 @@ Allows an administrator to specify a list of file type extensions to ignore duri - -Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a |. For example, C:\Example|C:\Example1. + +This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0. @@ -1950,7 +1964,7 @@ Allows an administrator to specify a list of directory paths to ignore during a |:--|:--| | Name | Exclusions_Paths | | Friendly Name | Path Exclusions | -| Element Name | Path Exclusions | +| Element Name | Path Exclusions. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Exclusions | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | @@ -1979,11 +1993,8 @@ Allows an administrator to specify a list of directory paths to ignore during a - -Allows an administrator to specify a list of files opened by processes to ignore during a scan. - -> [!IMPORTANT] -> The process itself is not excluded from the scan, but can be by using the Defender/ExcludedPaths policy to exclude its path. Each file type must be separated by a |. For example, C\Example. exe|C\Example1.exe. + +This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy does not apply to scheduled scans. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. **Note** that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0. @@ -2007,7 +2018,7 @@ Allows an administrator to specify a list of files opened by processes to ignore |:--|:--| | Name | Exclusions_Processes | | Friendly Name | Process Exclusions | -| Element Name | Process Exclusions | +| Element Name | Process Exclusions. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Exclusions | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | @@ -2115,7 +2126,7 @@ This policy setting allows you to configure monitoring for incoming and outgoing **Note** that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes. -The options for this setting are mutually exclusive +The options for this setting are mutually exclusive: 0 = Scan incoming and outgoing files (default) 1 = Scan incoming files only 2 = Scan outgoing files only @@ -2158,7 +2169,7 @@ Any other value, or if the value does not exist, resolves to the default (0). |:--|:--| | Name | RealtimeProtection_RealtimeScanDirection | | Friendly Name | Configure monitoring for incoming and outgoing file and program activity | -| Element Name | Configure monitoring for incoming and outgoing file and program activity | +| Element Name | Configure monitoring for incoming and outgoing file and program activity. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection | @@ -2227,7 +2238,7 @@ This policy setting allows you to specify the scan type to use during a schedule |:--|:--| | Name | Scan_ScanParameters | | Friendly Name | Specify the scan type to use for a scheduled scan | -| Element Name | Specify the scan type to use for a scheduled scan | +| Element Name | Specify the scan type to use for a scheduled scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2286,7 +2297,7 @@ This policy setting allows you to specify the time of day at which to perform a |:--|:--| | Name | Scan_ScheduleQuickScantime | | Friendly Name | Specify the time for a daily quick scan | -| Element Name | Specify the time for a daily quick scan | +| Element Name | Specify the time for a daily quick scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2371,7 +2382,7 @@ This setting can be configured with the following ordinal number values: |:--|:--| | Name | Scan_ScheduleDay | | Friendly Name | Specify the day of the week to run a scheduled scan | -| Element Name | Specify the day of the week to run a scheduled scan | +| Element Name | Specify the day of the week to run a scheduled scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2430,7 +2441,7 @@ This policy setting allows you to specify the time of day at which to perform a |:--|:--| | Name | Scan_ScheduleTime | | Friendly Name | Specify the time of day to run a scheduled scan | -| Element Name | Specify the time of day to run a scheduled scan | +| Element Name | Specify the time of day to run a scheduled scan. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Scan | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | @@ -2462,7 +2473,7 @@ This policy setting allows you to specify the time of day at which to perform a This policy setting allows you to define the security intelligence location for VDI-configured computers. -- If you disable or do not configure this setting, security intelligence will be referred from the default local source. +If you disable or do not configure this setting, security intelligence will be referred from the default local source. @@ -2485,7 +2496,7 @@ This policy setting allows you to define the security intelligence location for |:--|:--| | Name | SignatureUpdate_SharedSignaturesLocation | | Friendly Name | Define security intelligence location for VDI clients. | -| Element Name | Define file share for downloading security intelligence updates in virtual environments | +| Element Name | Define file share for downloading security intelligence updates in virtual environments. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2517,7 +2528,7 @@ This policy setting allows you to define the security intelligence location for This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", and "FileShares" -For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } +For Example: `{ InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }` - If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. @@ -2545,7 +2556,7 @@ For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } |:--|:--| | Name | SignatureUpdate_FallbackOrder | | Friendly Name | Define the order of sources for downloading security intelligence updates | -| Element Name | Define the order of sources for downloading security intelligence updates | +| Element Name | Define the order of sources for downloading security intelligence updates. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2603,7 +2614,7 @@ This policy setting allows you to configure UNC file share sources for downloadi |:--|:--| | Name | SignatureUpdate_DefinitionUpdateFileSharesSources | | Friendly Name | Define file shares for downloading security intelligence updates | -| Element Name | Define file shares for downloading security intelligence updates | +| Element Name | Define file shares for downloading security intelligence updates. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2662,7 +2673,7 @@ This policy setting allows you to specify an interval at which to check for secu |:--|:--| | Name | SignatureUpdate_SignatureUpdateInterval | | Friendly Name | Specify the interval to check for security intelligence updates | -| Element Name | Specify the interval to check for security intelligence updates | +| Element Name | Specify the interval to check for security intelligence updates. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | @@ -2698,7 +2709,7 @@ Possible options are: (0x0) Always prompt (0x1) Send safe samples automatically (0x2) Never send -(0x3) Send all samples automatically +(0x3) Send all samples automatically. @@ -2733,7 +2744,7 @@ Possible options are: |:--|:--| | Name | SubmitSamplesConsent | | Friendly Name | Send file samples when further analysis is required | -| Element Name | Send file samples when further analysis is required | +| Element Name | Send file samples when further analysis is required. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > MAPS | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet | @@ -2762,8 +2773,19 @@ Possible options are: - -Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take. This value is a list of threat severity level IDs and corresponding actions, separated by a | using the format threat level=action|threat level=action. For example, 1=6|2=2|4=10|5=3. The following list shows the supported values for threat severity levels:1 - Low severity threats2 - Moderate severity threats4 - High severity threats5 - Severe threatsThe following list shows the supported values for possible actions:2 - Quarantine. Moves files to quarantine. 3 - Remove. Removes files from system. 6 - Allow. Allows file/does none of the above actions. 8 - User defined. Requires user to make a decision on which action to take. 10 - Block. Blocks file execution. + +This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. + +Valid threat alert levels are: +1 = Low +2 = Medium +4 = High +5 = Severe + +Valid remediation action values are: +2 = Quarantine +3 = Remove +6 = Ignore. @@ -2786,7 +2808,7 @@ Allows an administrator to specify any valid threat severity levels and the corr |:--|:--| | Name | Threats_ThreatSeverityDefaultAction | | Friendly Name | Specify threat alert levels at which default action should not be taken when detected | -| Element Name | Specify threat alert levels at which default action should not be taken when detected | +| Element Name | Specify threat alert levels at which default action should not be taken when detected. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Antivirus > Threats | | Registry Key Name | Software\Policies\Microsoft\Windows Defender\Threats | diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index fe04df23d4..0a0eeb6f78 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -4,7 +4,7 @@ description: Learn more about the DeliveryOptimization Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -134,7 +134,7 @@ Specifies whether the device is allowed to participate in Peer Caching while con |:--|:--| | Name | AllowVPNPeerCaching | | Friendly Name | Enable Peer Caching while the device connects via VPN | -| Element Name | Enable Peer Caching while the device connects via VPN | +| Element Name | Enable Peer Caching while the device connects via VPN. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -192,7 +192,7 @@ One or more values can be added as either fully qualified domain names (FQDN) or |:--|:--| | Name | CacheHost | | Friendly Name | Cache Server Hostname | -| Element Name | Cache Server | +| Element Name | Cache Server. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -259,7 +259,7 @@ If this policy is not configured, the client will attempt to automatically find |:--|:--| | Name | CacheHostSource | | Friendly Name | Cache Server Hostname Source | -| Element Name | Cache Server Hostname Source | +| Element Name | Cache Server Hostname Source. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -619,7 +619,7 @@ Specifies the download method that Delivery Optimization can use in downloads of |:--|:--| | Name | DownloadMode | | Friendly Name | Download Mode | -| Element Name | Download Mode | +| Element Name | Download Mode. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -676,7 +676,7 @@ Use this if you need to create a single group for Local Network Peering for bran |:--|:--| | Name | GroupId | | Friendly Name | Group ID | -| Element Name | Group ID | +| Element Name | Group ID. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -745,7 +745,7 @@ Set this policy to restrict peer selection to a specific source. Available optio |:--|:--| | Name | GroupIdSource | | Friendly Name | Select the source of Group IDs | -| Element Name | Source of Group IDs | +| Element Name | Source of Group IDs. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -1308,7 +1308,7 @@ By default, %SystemDrive% is used to store the cache. The drive location can be |:--|:--| | Name | ModifyCacheDrive | | Friendly Name | Modify Cache Drive | -| Element Name | Modify Cache Drive | +| Element Name | Modify Cache Drive. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | @@ -1555,7 +1555,7 @@ In Windows 11 the 'Local Peer Discovery' option was introduced to restrict peer |:--|:--| | Name | RestrictPeerSelectionBy | | Friendly Name | Select a method to restrict Peer Selection | -| Element Name | Restrict Peer Selection By | +| Element Name | Restrict Peer Selection By. | | Location | Computer Configuration | | Path | Windows Components > Delivery Optimization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization | diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 1cc683a423..e0eeb748b5 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -4,7 +4,7 @@ description: Learn more about the Desktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -46,7 +46,7 @@ Prevents users from changing the path to their profile folders. By default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box. -- If you enable this setting, users are unable to type a new location in the Target box. +If you enable this setting, users are unable to type a new location in the Target box. diff --git a/windows/client-management/mdm/policy-csp-desktopappinstaller.md b/windows/client-management/mdm/policy-csp-desktopappinstaller.md index 36f2988560..c2e602fd7a 100644 --- a/windows/client-management/mdm/policy-csp-desktopappinstaller.md +++ b/windows/client-management/mdm/policy-csp-desktopappinstaller.md @@ -4,7 +4,7 @@ description: Learn more about the DesktopAppInstaller Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -210,6 +210,57 @@ Users will still be able to execute the *winget* command. The default help will + +## EnableBypassCertificatePinningForMicrosoftStore + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DesktopAppInstaller/EnableBypassCertificatePinningForMicrosoftStore +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EnableBypassCertificatePinningForMicrosoftStore | +| ADMX File Name | DesktopAppInstaller.admx | + + + + + + + + ## EnableDefaultSource @@ -393,6 +444,57 @@ This policy controls whether or not the [Windows Package Manager](/windows/packa + +## EnableLocalArchiveMalwareScanOverride + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DesktopAppInstaller/EnableLocalArchiveMalwareScanOverride +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EnableLocalArchiveMalwareScanOverride | +| ADMX File Name | DesktopAppInstaller.admx | + + + + + + + + ## EnableLocalManifestFiles diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 03c560a1d3..ba41b0ac29 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -4,7 +4,7 @@ description: Learn more about the DeviceGuard Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/01/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -101,72 +101,8 @@ For more information about System Guard, see [Introducing Windows Defender Syste - -Specifies whether Virtualization Based Security is enabled. - -Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections require hardware support and will only be enabled on correctly configured devices. - -Virtualization Based Protection of Code Integrity - -This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections are enforced and the Code Integrity validation path is protected by the Virtualization Based Security feature. - -The "Disabled" option turns off Virtualization Based Protection of Code Integrity remotely if it was previously turned on with the "Enabled without lock" option. - -The "Enabled with UEFI lock" option ensures that Virtualization Based Protection of Code Integrity cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI. - -The "Enabled without lock" option allows Virtualization Based Protection of Code Integrity to be disabled remotely by using Group Policy. - -The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. - -The "Require UEFI Memory Attributes Table" option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the Memory Attributes Table. Devices without the UEFI Memory Attributes Table may have firmware that is incompatible with Virtualization Based Protection of Code Integrity which in some cases can lead to crashes or data loss or incompatibility with certain plug-in cards. If not setting this option the targeted devices should be tested to ensure compatibility. - -> [!WARNING] -> All drivers on the system must be compatible with this feature or the system may crash. Ensure that this policy setting is only deployed to computers which are known to be compatible. - -Credential Guard - -This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials. - -For Windows 11 21. H2 and earlier, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option. For later versions, the "Disabled" option turns off Credential Guard remotely if it was previously turned on with the "Enabled without lock" option or was "Not Configured". - -The "Enabled with UEFI lock" option ensures that Credential Guard cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI. - -The "Enabled without lock" option allows Credential Guard to be disabled remotely by using Group Policy. The devices that use this setting must be running at least Windows 10 (Version 1511). - -For Windows 11 21. H2 and earlier, the "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. For later versions, if there is no current setting in the registry, the "Not Configured" option will enable Credential Guard without UEFI lock. - -Secure Launch - -This setting sets the configuration of Secure Launch to secure the boot chain. - -The "Not Configured" setting is the default, and allows configuration of the feature by Administrative users. - -The "Enabled" option turns on Secure Launch on supported hardware. - -The "Disabled" option turns off Secure Launch, regardless of hardware support. - -Kernel-mode Hardware-enforced Stack Protection - -This setting enables Hardware-enforced Stack Protection for kernel-mode code. When this security feature is enabled, kernel-mode data stacks are hardened with hardware-based shadow stacks, which store intended return address targets to ensure that program control flow is not tampered. - -This security feature has the following prerequisites: -1) The CPU hardware supports hardware-based shadow stacks. -2) Virtualization Based Protection of Code Integrity is enabled. - -If either prerequisite is not met, this feature will not be enabled, even if an "Enabled" option is selected for this feature. **Note** that selecting an "Enabled" option for this feature will not automatically enable Virtualization Based Protection of Code Integrity, that needs to be done separately. - -Devices that enable this security feature must be running at least Windows 11 (Version 22. H2). - -The "Disabled" option turns off kernel-mode Hardware-enforced Stack Protection. - -The "Enabled in audit mode" option enables kernel-mode Hardware-enforced Stack Protection in audit mode, where shadow stack violations are not fatal and will be logged to the system event log. - -The "Enabled in enforcement mode" option enables kernel-mode Hardware-enforced Stack Protection in enforcement mode, where shadow stack violations are fatal. - -The "Not Configured" option leaves the policy setting undefined. Group Policy does not write the policy setting to the registry, and so it has no impact on computers or users. If there is a current setting in the registry it will not be modified. - -> [!WARNING] -> All drivers on the system must be compatible with this security feature or the system may crash in enforcement mode. Audit mode can be used to discover incompatible drivers. For more information, see [A driver can't load on this device](https://go.microsoft.com/fwlink/?LinkId=2162953). + +Turns On Virtualization Based Security(VBS) diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 0696c7e877..b65b65b1e4 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -4,7 +4,7 @@ description: Learn more about the DeviceInstallation Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -45,11 +45,12 @@ ms.topic: reference This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: -- Prevent installation of devices that match these device IDs -- Prevent installation of devices that match any of these device instance IDs + - Prevent installation of devices that match these device IDs + - Prevent installation of devices that match any of these device instance IDs If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. -NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). @@ -146,10 +147,11 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: -- Prevent installation of devices that match any of these device instance IDs + - Prevent installation of devices that match any of these device instance IDs If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. -NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). @@ -248,12 +250,13 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: -- Prevent installation of devices for these device classes -- Prevent installation of devices that match these device IDs -- Prevent installation of devices that match any of these device instance IDs + - Prevent installation of devices for these device classes + - Prevent installation of devices that match these device IDs + - Prevent installation of devices that match any of these device instance IDs If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. -NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). @@ -378,9 +381,10 @@ Removable devices 7. Prevent installation of removable devices -NOTE: This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored. +> [!NOTE] +> This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored. -- If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device. +If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device. @@ -533,7 +537,8 @@ This policy setting allows you to prevent Windows from retrieving device metadat This policy setting allows you to prevent the installation of devices that are not specifically described by any other policy setting. -NOTE: This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting. +> [!NOTE] +> This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting. - If you enable this policy setting, Windows is prevented from installing or updating the driver package for any device that is not described by either the "Allow installation of devices that match any of these device IDs", the "Allow installation of devices for these device classes", or the "Allow installation of devices that match any of these device instance IDs" policy setting. @@ -632,9 +637,11 @@ You can also block installation by using a custom profile in Intune. This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. -NOTE: To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. +> [!NOTE] +> To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. - If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. @@ -736,6 +743,7 @@ For example, this custom profile blocks installation and usage of USB devices wi This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. - If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. @@ -846,9 +854,11 @@ To prevent installation of devices with matching device instance IDs by using cu This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. -NOTE: To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. +> [!NOTE] +> To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. - If you enable this policy setting, Windows is prevented from installing or updating driver packages whose device setup class GUIDs appear in the list you create. + - If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. - If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 9645d243cd..69a26fb46f 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -4,7 +4,7 @@ description: Learn more about the DeviceLock Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,12 +21,165 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + > [!IMPORTANT] > The DeviceLock CSP utilizes the [Exchange ActiveSync Policy Engine](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)). When password length and complexity rules are applied, all the local user and administrator accounts are marked to change their password at the next sign in to ensure complexity requirements are met. For more information, see [Password length and complexity supported by account types](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)#password-length-and-complexity-supported-by-account-types). + +## AccountLockoutDuration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutDuration +``` + + + + +Account lockout duration This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. The available range is from 0 minutes through 99,999 minutes. If you set the account lockout duration to 0, the account will be locked out until an administrator explicitly unlocks it. If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-99999]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Account lockout duration | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + + +## AccountLockoutThreshold + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/AccountLockoutThreshold +``` + + + + +Account lockout threshold - This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. You can set a value between 0 and 999 failed logon attempts. If you set the value to 0, the account will never be locked out. Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers count as failed logon attempts. Default: 0. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-10]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Account lockout threshold | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + + +## AllowAdministratorLockout + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/AllowAdministratorLockout +``` + + + + +Allow Administrator account lockout This security setting determines whether the builtin Administrator account is subject to account lockout policy. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-1]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Allow Administrator account lockout | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + ## AllowIdleReturnWithoutPassword @@ -202,7 +355,7 @@ For more information about this policy, see [Exchange ActiveSync Policy Engine O -Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0 +Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0. @@ -567,7 +720,7 @@ Specifies the default lock screen and logon image shown when no user is signed i -The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality +The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality. > [!NOTE] > This policy must be wrapped in an Atomic command. This policy has different behaviors on the mobile device and desktop. On a mobile device, when the user reaches the value set by this policy, then the device is wiped. On a desktop, when the user reaches the value set by this policy, it is not wiped. Instead, the desktop is put on BitLocker recovery mode, which makes the data inaccessible but recoverable. If BitLocker is not enabled, then the policy cannot be enforced. Prior to reaching the failed attempts limit, the user is sent to the lock screen and warned that more failed attempts will lock their computer. When the user reaches the limit, the device automatically reboots and shows the BitLocker recovery page. This page prompts the user for the BitLocker recovery key. Most secure value is 0 if all policy values = 0; otherwise, Min policy value is the most secure value. For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)). @@ -612,10 +765,10 @@ The number of authentication failures allowed before the device will be wiped. A -This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days +This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If the maximum password age is between 1 and 999 days, the Minimum password age must be less than the maximum password age. If the maximum password age is set to 0, the minimum password age can be any value between 0 and 998 days. > [!NOTE] -> It is a security best practice to have passwords expire every 30 to 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to crack a user's password and have access to your network resources. Default 42. +> It is a security best practice to have passwords expire every 30 to 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to crack a user's password and have access to your network resources. Default: 42. @@ -1013,10 +1166,10 @@ Complexity requirements are enforced when passwords are changed or created. Minimum password length -This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting is dependent on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting is not defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required +This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting is dependent on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting is not defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required. > [!NOTE] -> By default, member computers follow the configuration of their domain controllers. Default 7 on domain controllers. 0 on stand-alone servers. Configuring this setting than 14 may affect compatibility with clients, services, and applications. Microsoft recommends that you only configure this setting larger than 14 after using the Minimum password length audit setting to test for potential incompatibilities at the new setting. +> By default, member computers follow the configuration of their domain controllers. Default: 7 on domain controllers. 0 on stand-alone servers. Configuring this setting than 14 may affect compatibility with clients, services, and applications. Microsoft recommends that you only configure this setting larger than 14 after using the Minimum password length audit setting to test for potential incompatibilities at the new setting. @@ -1070,7 +1223,7 @@ Disables the lock screen camera toggle switch in PC Settings and prevents a came By default, users can enable invocation of an available camera on the lock screen. -- If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen. +If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen. @@ -1130,7 +1283,7 @@ Disables the lock screen slide show settings in PC Settings and prevents a slide By default, users can enable a slide show that will run after they lock the machine. -- If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start. +If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start. @@ -1169,6 +1322,56 @@ By default, users can enable a slide show that will run after they lock the mach + +## ResetAccountLockoutCounterAfter + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/DeviceLock/ResetAccountLockoutCounterAfter +``` + + + + +Reset account lockout counter after - This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. The available range is 1 minute to 99,999 minutes. If an account lockout threshold is defined, this reset time must be less than or equal to the Account lockout duration. Default: None, because this policy setting only has meaning when an Account lockout threshold is specified. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-99999]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Reset account lockout counter after | +| Path | Windows Settings > Security Settings > Account Policies > Account Lockout Policy | + + + + + + + + ## ScreenTimeoutWhileLocked diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 5c610c1946..19f3a8b859 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -4,7 +4,7 @@ description: Learn more about the Display Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,20 @@ ms.topic: reference - -This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + +Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows. + +When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows. + +Be aware of the following: + +Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors. + +Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays. + +In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. + +Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. @@ -94,8 +106,20 @@ This policy allows you to disable Per-Process System DPI for a semicolon-separat - -Enable or disable Per-Process System DPI for all applications. + +Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows. + +When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows. + +Be aware of the following: + +Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors. + +Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays. + +In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. + +Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. @@ -169,8 +193,20 @@ Enabling this setting lets you specify the system-wide default for desktop appli - -This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. + +Per Process System DPI is an application compatibility feature for desktop applications that do not render properly after a display-scale factor (DPI) change. When the display scale factor of the primary display changes (which can happen when you connect or disconnect a display that has a different display scale factor (DPI), connect remotely from a device with a different display scale factor, or manually change the display scale factor), many desktop applications can display blurry. Desktop applications that have not been updated to display properly in this scenario will be blurry until the user logs out and back in to Windows. + +When you enable this policy some blurry applications will be crisp after they are restarted, without requiring the user to log out and back in to Windows. + +Be aware of the following: + +Per Process System DPI will only improve the rendering of desktop applications that are positioned on the primary display. Some desktop applications can still be blurry on secondary displays that have different display scale factors. + +Per Process System DPI will not work for all applications as some older desktop applications will always be blurry on high DPI displays. + +In some cases, you may see some odd behavior in some desktop applications. If that happens, Per Process System DPI should be disabled. + +Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. @@ -223,8 +259,16 @@ This policy allows you to enable Per-Process System DPI for a semicolon-separate - -This policy allows to force turn off GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. + +GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware. + +This policy setting lets you specify legacy applications that have GDI DPI Scaling turned off. + +- If you enable this policy setting, GDI DPI Scaling is turned off for all applications in the list, even if they are enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest. + +- If you disable or do not configure this policy setting, GDI DPI Scaling might still be turned on for legacy applications. + +If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off. @@ -293,8 +337,16 @@ To validate on Desktop, do the following tasks: - -This policy allows to turn on GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. + +GDI DPI Scaling enables applications that are not DPI aware to become per monitor DPI aware. + +This policy setting lets you specify legacy applications that have GDI DPI Scaling turned on. + +- If you enable this policy setting, GDI DPI Scaling is turned on for all legacy applications in the list. + +- If you disable or do not configure this policy setting, GDI DPI Scaling will not be enabled for an application except when an application is enabled by using ApplicationCompatibility database, ApplicationCompatibility UI System (Enhanced) setting, or an application manifest. + +If GDI DPI Scaling is configured to both turn off and turn on an application, the application will be turned off. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index c8c5aed332..004ce690a4 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -4,7 +4,7 @@ description: Learn more about the Education Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -39,6 +39,7 @@ ms.topic: reference This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. - If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. + - If you enable or don't configure this policy setting, users will be able to access graphing functionality. @@ -102,7 +103,7 @@ This policy setting allows you to control whether graphing functionality is avai -This policy sets user's default printer +This policy sets user's default printer. @@ -144,6 +145,7 @@ The policy value is expected to be the name (network host name) of an installed This policy setting allows you to control whether EDU-specific theme packs are available in Settings > Personalization. - If you disable or don't configure this policy setting, EDU-specific theme packs will not be included. + - If you enable this policy setting, users will be able to personalize their devices with EDU-specific themes. @@ -193,7 +195,7 @@ This policy setting allows you to control whether EDU-specific theme packs are a -This policy setting allows tenant to control whether to declare this OS as an education environment +This policy setting allows tenant to control whether to declare this OS as an education environment. @@ -255,7 +257,7 @@ This setting does not delete printers that users have already added. However, if > [!NOTE] > You can use printer permissions to restrict the use of printers without specifying a setting. In the Printers folder, right-click a printer, click Properties, and then click the Security tab. -If this policy is disabled, or not configured, users can add printers using the methods described above. +- If this policy is disabled, or not configured, users can add printers using the methods described above. @@ -318,7 +320,7 @@ If this policy is disabled, or not configured, users can add printers using the -This policy provisions per-user network printers +This policy provisions per-user network printers. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index b804039125..4dcd8140d3 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -4,7 +4,7 @@ description: Learn more about the EnterpriseCloudPrint Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -This policy provisions per-user discovery end point to discover cloud printers +This policy provisions per-user discovery end point to discover cloud printers. @@ -84,7 +84,7 @@ The default value is an empty string. Otherwise, the value should contain the UR -Authentication endpoint for acquiring OAuth tokens +Authentication endpoint for acquiring OAuth tokens. @@ -131,7 +131,7 @@ The default value is an empty string. Otherwise, the value should contain the UR -A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority +A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority. @@ -178,7 +178,7 @@ The default value is an empty string. Otherwise, the value should contain a GUID -Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication +Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication. @@ -225,7 +225,7 @@ The default value is an empty string. Otherwise, the value should contain a URL. -Defines the maximum number of printers that should be queried from discovery end point +Defines the maximum number of printers that should be queried from discovery end point. @@ -267,7 +267,7 @@ This policy must target ./User, otherwise it fails. -Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication +Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index e46c94e961..6505002489 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -4,7 +4,7 @@ description: Learn more about the Experience Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - Experience +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -38,6 +41,7 @@ ms.topic: reference This policy setting determines whether history of Clipboard contents can be stored in memory. + - If you enable this policy setting, history of Clipboard contents are allowed to be stored. - If you disable this policy setting, history of Clipboard contents are not allowed to be stored. Policy change takes effect immediately. @@ -346,7 +350,7 @@ When Find My Device is off, the device and its location are not registered and t -Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e. g. auto-enrolled), then disabling the MDM unenrollment has no effect +Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e. g. auto-enrolled), then disabling the MDM unenrollment has no effect. > [!NOTE] > The MDM server can always remotely delete the account. Most restricted value is 0. @@ -447,7 +451,7 @@ This policy is deprecated. -Allow screen capture +Allow screen capture. @@ -598,6 +602,7 @@ Allow SIM error dialog prompts when no SIM is inserted. Specifies whether Spotlight collection is allowed as a Personalization->Background Setting. + - If you enable this policy setting, Spotlight collection will show as an option in the user's Personalization Settings, and the user will be able to get daily images from Microsoft displayed on their desktop. - If you disable this policy setting, Spotlight collection will not show as an option in Personalization Settings, and the user will not have the choice of getting Microsoft daily images shown on their desktop. @@ -708,8 +713,9 @@ Allows or disallows all Windows sync settings on the device. For information abo This policy allows you to prevent Windows from using diagnostic data to provide customized experiences to the user. + - If you enable this policy setting, Windows will not use diagnostic data from this device to customize content shown on the lock screen, Windows tips, Microsoft consumer features, or other related features. If these features are enabled, users will still see recommendations, tips and offers, but they may be less relevant. -- If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them. Diagnostic data can include browser, app and feature usage, depending on the Diagnostic and usage data setting value +- If you disable or do not configure this policy setting, Microsoft will use diagnostic data to provide personalized recommendations, tips, and offers to tailor Windows for the user's needs and make it work better for them. Diagnostic data can include browser, app and feature usage, depending on the Diagnostic and usage data setting value. > [!NOTE] > This setting does not control Cortana cutomized experiences because there are separate policies to configure it. Most restricted value is 0. @@ -1009,6 +1015,7 @@ Prior to Windows 10, version 1803, this policy had User scope. This policy allow Specifies whether to turn off all Windows spotlight features at once. + - If you enable this policy setting, Windows spotlight on lock screen, Windows Tips, Microsoft consumer features and other related features will be turned off. You should enable this policy setting if your goal is to minimize network traffic from target devices. - If you disable or do not configure this policy setting, Windows spotlight features are allowed and may be controlled individually using their corresponding policy settings. Most restricted value is 0. @@ -1074,6 +1081,7 @@ Specifies whether to turn off all Windows spotlight features at once. This policy allows administrators to prevent Windows spotlight notifications from being displayed in the Action Center. + - If you enable this policy, Windows spotlight notifications will no longer be displayed in the Action Center. - If you disable or do not configure this policy, Microsoft may display notifications in the Action Center that will suggest apps or features to help users be more productive on Windows. Most restricted value is 0. @@ -1203,6 +1211,7 @@ This policy allows IT admins to turn off Suggestions in Settings app. These sugg This policy setting lets you turn off the Windows spotlight Windows welcome experience feature. The Windows welcome experience feature introduces onboard users to Windows; for example, launching Microsoft Edge with a webpage that highlights new features. + - If you enable this policy, the Windows welcome experience will no longer be displayed when there are updates and changes to Windows and its apps. - If you disable or do not configure this policy, the Windows welcome experience will be launched to inform onboard users about what's new, changed, and suggested. Most restricted value is 0. @@ -1318,6 +1327,9 @@ Enables or disables Windows Tips / soft landing. ## ConfigureChatIcon +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| @@ -1331,8 +1343,16 @@ Enables or disables Windows Tips / soft landing. - -Configures the Chat icon on the taskbar + +This policy setting allows you to configure the Chat icon on the taskbar. + +- If you enable this policy setting and set it to Show, the Chat icon will be displayed on the taskbar by default. Users can show or hide it in Settings. + +- If you enable this policy setting and set it to Hide, the Chat icon will be hidden by default. Users can show or hide it in Settings. + +- If you enable this policy setting and set it to Disabled, the Chat icon will not be displayed, and users cannot show or hide it in Settings. + +- If you disable or do not configure this policy setting, the Chat icon will be configured according to the defaults for your Windows edition. @@ -1369,7 +1389,7 @@ Configures the Chat icon on the taskbar |:--|:--| | Name | ConfigureChatIcon | | Friendly Name | Configures the Chat icon on the taskbar | -| Element Name | State | +| Element Name | State. | | Location | Computer Configuration | | Path | Windows Components > Chat | | Registry Key Name | Software\Policies\Microsoft\Windows\Windows Chat | @@ -1410,7 +1430,7 @@ Additionally, if you check the "Include content from Enterprise spotlight" check - If you do not configure this policy, Windows spotlight will be available on the lock screen and will be selected by default, unless you have configured another default lock screen image using the "Force a specific default lock screen and logon image" policy. > [!NOTE] -> This policy is only available for Enterprise SKUs +> This policy is only available for Enterprise SKUs. @@ -1593,6 +1613,55 @@ This policy setting lets you turn off cloud consumer account state content in al + +## DisableTextTranslation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Experience/DisableTextTranslation +``` + + + + +Allows Text Translation feature to be enabled/disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Enable Text Translation. | +| 1 | Disable Text Translation. | + + + + + + + + ## DoNotShowFeedbackNotifications @@ -1682,7 +1751,7 @@ This policy setting allows an organization to prevent its devices from showing f Prevent the "browser" group from syncing to and from this PC. This turns off and disables the "browser" group on the "sync your settings" page in PC settings. The "browser" group contains settings and info like history and favorites. -- If you enable this policy setting, the "browser" group, including info like history and favorites, will not be synced. +If you enable this policy setting, the "browser" group, including info like history and favorites, will not be synced. Use the option "Allow users to turn browser syncing on" so that syncing is turned off by default but not disabled. @@ -1767,8 +1836,7 @@ _**Turn syncing off by default but don’t disable**_ -Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Intune. By default, this policy is disabled. -- If you enable this policy, these experiences will show content booked by Administrators. Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences. +Organizational messages allow Administrators to deliver messages to their end users on selected Windows 11 experiences. Organizational messages are available to Administrators via services like Microsoft Endpoint Manager. By default, this policy is disabled. If you enable this policy, these experiences will show content booked by Administrators. Enabling this policy will have no impact on existing MDM policy settings governing delivery of content from Microsoft on Windows experiences. @@ -1901,6 +1969,7 @@ _**Prevent syncing of browser settings and let users turn on syncing**_ Shows or hides lock from the user tile menu. + - If you enable this policy setting, the lock option will be shown in the User Tile menu. - If you disable this policy setting, the lock option will never be shown in the User Tile menu. diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index e1291d1cb0..8a44d2c7e1 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -4,7 +4,7 @@ description: Learn more about the ExploitGuard Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -60,7 +60,7 @@ Enables the IT admin to push out a configuration representing the desired system |:--|:--| | Name | ExploitProtection_Name | | Friendly Name | Use a common set of exploit protection settings | -| Element Name | Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file | +| Element Name | Type the location (local path, UNC path, or URL) of the mitigation settings configuration XML file. | | Location | Computer Configuration | | Path | Windows Components > Microsoft Defender Exploit Guard > Exploit Protection | | Registry Key Name | Software\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection | diff --git a/windows/client-management/mdm/policy-csp-federatedauthentication.md b/windows/client-management/mdm/policy-csp-federatedauthentication.md index 41e2f19ab9..85326a86f9 100644 --- a/windows/client-management/mdm/policy-csp-federatedauthentication.md +++ b/windows/client-management/mdm/policy-csp-federatedauthentication.md @@ -4,7 +4,7 @@ description: Learn more about the FederatedAuthentication Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Specifies whether web-based sign-in is enabled with the Primary User experience +Specifies whether web-based sign-in is enabled with the Primary User experience. diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 2a1b573428..66486d9057 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -4,7 +4,7 @@ description: Learn more about the HumanPresence Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,10 +16,249 @@ ms.topic: reference # Policy CSP - HumanPresence +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + + +## ForceAllowDimWhenExternalDisplayConnected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowDimWhenExternalDisplayConnected +``` + + + + +Determines whether Allow Adaptive Dimming When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceAllowDimWhenExternalDisplayConnected | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForceAllowLockWhenExternalDisplayConnected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowLockWhenExternalDisplayConnected +``` + + + + +Determines whether Allow Lock on Leave When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceAllowLockWhenExternalDisplayConnected | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForceAllowWakeWhenExternalDisplayConnected + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceAllowWakeWhenExternalDisplayConnected +``` + + + + +Determines whether Allow Wake on Approach When External Display Connected checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceAllowWakeWhenExternalDisplayConnected | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + + +## ForceDisableWakeWhenBatterySaverOn + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/HumanPresence/ForceDisableWakeWhenBatterySaverOn +``` + + + + +Determines whether Disable Wake on Approach When Battery Saver On checkbox is forced checked/unchecked by the MDM policy. The user will not be able to change this setting and the checkbox in the UI will be greyed out. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 2 | ForcedUnchecked. | +| 1 | ForcedChecked. | +| 0 (Default) | DefaultToUserChoice. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ForceDisableWakeWhenBatterySaverOn | +| Path | Sensors > AT > WindowsComponents > HumanPresence | + + + + + + + + ## ForceInstantDim @@ -254,6 +493,7 @@ Determines the timeout for Lock on Leave forced by the MDM policy. The user will | 120 | TwoMinutes. | | 30 | ThirtySeconds. | | 10 | TenSeconds. | +| 1 | Immediate. | | 0 (Default) | DefaultToUserChoice. | diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index b60ae5ce2c..92fda2c42a 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -4,7 +4,7 @@ description: Learn more about the InternetExplorer Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -48,7 +48,7 @@ ms.topic: reference This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website. -- If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]) +- If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). > [!NOTE] > This list can be created from a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers. @@ -577,7 +577,7 @@ This policy setting lets you decide whether users can turn on Enterprise Mode fo If you turn this setting on, users can see and use the Enterprise Mode option from the Tools menu. If you turn this setting on, but don't specify a report location, Enterprise Mode will still be available to your users, but you won't get any reports. -- If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode. +If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode. @@ -701,7 +701,7 @@ We recommend that you do not allow insecure fallback in order to prevent a man-i This policy does not affect which security protocols are enabled. -- If you disable this policy, system defaults will be used. +If you disable this policy, system defaults will be used. @@ -2098,23 +2098,23 @@ This policy setting allows you to manage whether Internet Explorer checks for di Enables you to configure up to three versions of Microsoft Edge to open a redirected site (in order of preference). Use this policy if your environment is configured to redirect sites from Internet Explorer 11 to Microsoft Edge. If any of the chosen versions are not installed on the device, that preference will be bypassed. If both the Windows Update for the next version of Microsoft Edge* and Microsoft Edge Stable channel are installed, the following behaviors occur: -- If you disable or don't configure this policy, Microsoft Edge Stable channel is used. This is the default behavior. -- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: + - If you disable or don't configure this policy, Microsoft Edge Stable channel is used. This is the default behavior. + - If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: 1 = Microsoft Edge Stable 2 = Microsoft Edge Beta version 77 or later 3 = Microsoft Edge Dev version 77 or later 4 = Microsoft Edge Canary version 77 or later If the Windows Update for the next version of Microsoft Edge* or Microsoft Edge Stable channel are not installed, the following behaviors occur: -- If you disable or don't configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior. -- If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: + - If you disable or don't configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior. + - If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: 0 = Microsoft Edge version 45 or earlier 1 = Microsoft Edge Stable 2 = Microsoft Edge Beta version 77 or later 3 = Microsoft Edge Dev version 77 or later 4 = Microsoft Edge Canary version 77 or later -*For more information about the Windows update for the next version of Microsoft Edge including how to disable it, see . This update applies only to Windows 10 version 1709 and higher. +- For more information about the Windows update for the next version of Microsoft Edge including how to disable it, see< https://go.microsoft.com/fwlink/?linkid=2102115>. This update applies only to Windows 10 version 1709 and higher. @@ -3160,8 +3160,8 @@ This policy setting controls whether to have background synchronization for feed This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows. - If you enable this policy setting, you must make one of the following choices: -- Skip the First Run wizard, and go directly to the user's home page. -- Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage. + - Skip the First Run wizard, and go directly to the user's home page. + - Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage. Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not available. The user's home page will display regardless of which option is chosen. @@ -3616,13 +3616,13 @@ InPrivate Browsing prevents Internet Explorer from storing data about a user's b This policy lets you restrict launching of Internet Explorer as a standalone browser. -- If you enable this policy, it -- Prevents Internet Explorer 11 from launching as a standalone browser. -- Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'. -- Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser. -- Overrides any other policies that redirect to Internet Explorer 11. +If you enable this policy, it: + - Prevents Internet Explorer 11 from launching as a standalone browser. + - Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'. + - Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser. + - Overrides any other policies that redirect to Internet Explorer 11. -If you disable, or don't configure this policy, all sites are opened using the current active browser settings +If you disable, or don't configure this policy, all sites are opened using the current active browser settings. > [!NOTE] > Microsoft Edge Stable Channel must be installed for this policy to take effect. @@ -4503,7 +4503,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T This policy setting lets admins enable extended Microsoft Edge Internet Explorer mode hotkeys, such as "Ctrl+S" to have "Save as" functionality. -- If you enable this policy, extended hotkey functionality is enabled in Internet Explorer mode and work the same as Internet Explorer. +If you enable this policy, extended hotkey functionality is enabled in Internet Explorer mode and work the same as Internet Explorer. If you disable, or don't configure this policy, extended hotkeys will not work in Internet Explorer mode. @@ -5095,6 +5095,7 @@ This policy setting allows you to manage whether users can drag files or copy an This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -7256,6 +7257,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -7921,7 +7923,7 @@ This policy setting specifies whether JScript or JScript9Legacy is loaded for MS - If you disable this policy, then JScript will be utilized. -If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript. +- If this policy is left unconfigured, then MSHTML will use JScript9Legacy and MSXML/Cscript will use JScript. @@ -7990,10 +7992,10 @@ Prevents intranet sites from being opened in any browser except Internet Explore We strongly recommend keeping this policy in sync with the 'Send all intranet sites to Internet Explorer' ('SendIntranetToInternetExplorer') policy. Additionally, it's best to enable this policy only if your intranet sites have known compatibility problems with Microsoft Edge. Related policies: -- Send all intranet sites to Internet Explorer ('SendIntranetToInternetExplorer') -- Send all sites not included in the Enterprise Mode Site List to Microsoft Edge ('RestrictIE') + - Send all intranet sites to Internet Explorer ('SendIntranetToInternetExplorer') + - Send all sites not included in the Enterprise Mode Site List to Microsoft Edge ('RestrictIE') -For more info about how to use this policy together with other related policies to create the optimal configuration for your organization, see . +For more info about how to use this policy together with other related policies to create the optimal configuration for your organization, see< https://go.microsoft.com/fwlink/?linkid=2094210>. @@ -8272,6 +8274,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -9127,6 +9130,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -9988,6 +9992,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -10707,6 +10712,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -11497,6 +11503,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -12287,6 +12294,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -13399,7 +13407,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T This policy setting lets admins reset zoom to default for HTML dialogs in Internet Explorer mode. -- If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page. +If you enable this policy, the zoom of an HTML dialog in Internet Explorer mode will not get propagated from its parent page. If you disable, or don't configure this policy, the zoom of an HTML dialog in Internet Explorer mode will be set based on the zoom of it's parent page. @@ -14051,6 +14059,7 @@ This policy setting allows you to manage whether file downloads are permitted fr This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. @@ -16414,7 +16423,7 @@ Internet Explorer allows scripts to programmatically open, resize, and repositio This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website. -- If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers +- If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers. > [!NOTE] > This list can be created through a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers. @@ -16895,6 +16904,7 @@ This policy setting determines whether users will be prompted for non user-initi This policy setting allows you to manage whether pages of the zone may download HTML fonts. - If you enable this policy setting, HTML fonts can be downloaded automatically. + - If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. - If you disable this policy setting, HTML fonts are prevented from downloading. diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 68f64fc6e5..870386a6e5 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -4,7 +4,7 @@ description: Learn more about the Kerberos Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -170,6 +170,7 @@ This policy setting allows retrieving the Azure AD Kerberos Ticket Granting Tick This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. + - If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring. - If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition. @@ -241,7 +242,7 @@ This policy setting controls hash or checksum algorithms used by the Kerberos cl - "Not Supported" disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure. - If you disable or do not configure this policy, each algorithm will assume the "Default" state. -More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at . +More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at< https://go.microsoft.com/fwlink/?linkid=2169037>. Events generated by this configuration: 205, 206, 207, 208. @@ -347,8 +348,13 @@ If you don't configure this policy, the SHA1 algorithm will assume the **Default | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA1 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | @@ -415,8 +421,13 @@ If you don't configure this policy, the SHA256 algorithm will assume the **Defau | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA256 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | @@ -483,8 +494,13 @@ If you don't configure this policy, the SHA384 algorithm will assume the **Defau | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA384 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | @@ -551,8 +567,13 @@ If you don't configure this policy, the SHA512 algorithm will assume the **Defau | Name | Value | |:--|:--| -| Name | PKInitHashAlgorithmSHA512 | -| Path | Kerberos > AT > System > kerberos | +| Name | PKInitHashAlgorithmConfiguration | +| Friendly Name | Configure hash algorithms for certificate logon | +| Location | Computer Configuration | +| Path | System > Kerberos | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters | +| Registry Value Name | PKInitHashAlgorithmConfigurationEnabled | +| ADMX File Name | Kerberos.admx | diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index b425e49931..4ece74db51 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -4,7 +4,7 @@ description: Learn more about the Licensing Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -39,9 +39,9 @@ ms.topic: reference This policy setting controls whether OS Reactivation is blocked on a device. Policy Options: -- Not Configured (default -- Windows registration and reactivation is allowed) -- Disabled (Windows registration and reactivation is not allowed) -- Enabled (Windows registration is allowed) + - Not Configured (default -- Windows registration and reactivation is allowed) + - Disabled (Windows registration and reactivation is not allowed) + - Enabled (Windows registration is allowed) @@ -105,11 +105,11 @@ Policy Options: This policy setting lets you opt-out of sending KMS client activation data to Microsoft automatically. Enabling this setting prevents this computer from sending data to Microsoft regarding its activation state. -- If you disable or do not configure this policy setting, KMS client activation data will be sent to Microsoft services when this device activates. +If you disable or do not configure this policy setting, KMS client activation data will be sent to Microsoft services when this device activates. Policy Options: -- Not Configured (default -- data will be automatically sent to Microsoft) -- Disabled (data will be automatically sent to Microsoft) -- Enabled (data will not be sent to Microsoft) + - Not Configured (default -- data will be automatically sent to Microsoft) + - Disabled (data will be automatically sent to Microsoft) + - Enabled (data will not be sent to Microsoft) diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 075a1bd389..b85c550c26 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -4,7 +4,7 @@ description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CS author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - LocalPoliciesSecurityOptions +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + > [!NOTE] @@ -39,8 +42,7 @@ ms.topic: reference -This policy setting prevents users from adding new Microsoft accounts on this computer. If you select the "Users can't add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. If you select the "Users can't add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. -- If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. +This policy setting prevents users from adding new Microsoft accounts on this computer. If you select the "Users can't add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. If you select the "Users can't add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. @@ -99,10 +101,10 @@ This policy setting prevents users from adding new Microsoft accounts on this co -This security setting determines whether the local Administrator account is enabled or disabled +This security setting determines whether the local Administrator account is enabled or disabled. > [!NOTE] -> If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. Default Disabled. +> If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. Default: Disabled. @@ -160,10 +162,10 @@ This security setting determines whether the local Administrator account is enab -This security setting determines if the Guest account is enabled or disabled. Default Disabled +This security setting determines if the Guest account is enabled or disabled. Default: Disabled. > [!NOTE] -> If the Guest account is disabled and the security option Network Access Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. +> If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. @@ -221,10 +223,10 @@ This security setting determines if the Guest account is enabled or disabled. De -Accounts Limit local account use of blank passwords to console logon only This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. Default Enabled +Accounts: Limit local account use of blank passwords to console logon only This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. Default: Enabled. > [!WARNING] -> Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services +> Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services. > [!NOTE] > This setting does not affect logons that use domain accounts. It is possible for applications that use remote interactive logons to bypass this setting. @@ -432,7 +434,7 @@ Devices: Allowed to format and eject removable media This security setting deter -Devices Allow undock without having to log on This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. Default Enabled +Devices: Allow undock without having to log on This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. Default: Enabled. > [!CAUTION] > Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. @@ -494,6 +496,7 @@ Devices Allow undock without having to log on This security setting determines w Devices: Prevent users from installing printer drivers when connecting to shared printers For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. + - If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. - If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. Default on servers: Enabled. Default on workstations: Disabled Notes This setting does not affect the ability to add a local printer. This setting does not affect Administrators. @@ -986,10 +989,10 @@ Interactive logon: Message title for users attempting to log on This security se -Interactive logon Smart card removal behavior This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. The options are No Action Lock Workstation Force Logoff Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation +Interactive logon: Smart card removal behavior This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. The options are: No Action Lock Workstation Force Logoff Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. > [!NOTE] -> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. Default This policy is not defined, which means that the system treats it as No action. On Windows Vista and above For this setting to work, the Smart Card Removal Policy service must be started. +> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. Default: This policy is not defined, which means that the system treats it as No action. On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started. @@ -1049,14 +1052,16 @@ Interactive logon Smart card removal behavior This security setting determines w -Microsoft network client Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB client component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. -- If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. Default Disabled +Microsoft network client: Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB client component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. + +- If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. +- If this policy is disabled, SMB packet signing is negotiated between the client and server. Default: Disabled. > [!IMPORTANT] -> For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client Digitally sign communications (if server agrees) +> For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). > [!NOTE] -> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. For more information, reference . +> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1114,11 +1119,13 @@ Microsoft network client Digitally sign communications (always) This security se -Microsoft network client Digitally sign communications (if server agrees) This security setting determines whether the SMB client attempts to negotiate SMB packet signing. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. -- If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default Enabled +Microsoft network client: Digitally sign communications (if server agrees) This security setting determines whether the SMB client attempts to negotiate SMB packet signing. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. + +- If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. +- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default: Enabled. > [!NOTE] -> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference . +> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1234,15 +1241,16 @@ Microsoft network client: Send unencrypted password to connect to third-party SM -Microsoft network server Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB server component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. +Microsoft network server: Digitally sign communications (always) This security setting determines whether packet signing is required by the SMB server component. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. + - If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. -- If this setting is disabled, SMB packet signing is negotiated between the client and server. Default Disabled for member servers. Enabled for domain controllers +- If this setting is disabled, SMB packet signing is negotiated between the client and server. Default: Disabled for member servers. Enabled for domain controllers. > [!NOTE] -> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors +> All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. > [!IMPORTANT] -> For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy Microsoft network server Digitally sign communications (if server agrees) For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature For more information, reference . +> For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy: Microsoft network server: Digitally sign communications (if server agrees) For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1300,11 +1308,13 @@ Microsoft network server Digitally sign communications (always) This security se -Microsoft network server Digitally sign communications (if client agrees) This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. -- If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default Enabled on domain controllers only +Microsoft network server: Digitally sign communications (if client agrees) This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. + +- If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. +- If this policy is disabled, the SMB client will never negotiate SMB packet signing. Default: Enabled on domain controllers only. > [!IMPORTANT] -> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000 HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings Microsoft network client Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference . +> For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature Notes All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. For more information, reference:< https://go.microsoft.com/fwlink/?LinkID=787136>. @@ -1362,7 +1372,8 @@ Microsoft network server Digitally sign communications (if client agrees) This s -Network access: Allow anonymous SID/name translation This policy setting determines whether an anonymous user can request security identifier (SID) attributes for another user. If this policy is enabled, an anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects both the SID-to-name translation as well as the name-to-SID translation. +Network access: Allow anonymous SID/name translation This policy setting determines whether an anonymous user can request security identifier (SID) attributes for another user. +- If this policy is enabled, an anonymous user can request the SID attribute for another user. An anonymous user with knowledge of an administrator's SID could contact a computer that has this policy enabled and use the SID to get the administrator's name. This setting affects both the SID-to-name translation as well as the name-to-SID translation. - If this policy setting is disabled, an anonymous user cannot request the SID attribute for another user. Default on workstations and member servers: Disabled. Default on domain controllers running Windows Server 2008 or later: Disabled. Default on domain controllers running Windows Server 2003 R2 or earlier: Enabled. @@ -1421,7 +1432,7 @@ Network access: Allow anonymous SID/name translation This policy setting determi -Network access Do not allow anonymous enumeration of SAM accounts This security setting determines what additional permissions will be granted for anonymous connections to the computer. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. This security option allows additional restrictions to be placed on anonymous connections as follows Enabled Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. Disabled No additional restrictions. Rely on default permissions. Default on workstations Enabled. Default on serverEnabled +Network access: Do not allow anonymous enumeration of SAM accounts This security setting determines what additional permissions will be granted for anonymous connections to the computer. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. This security option allows additional restrictions to be placed on anonymous connections as follows: Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. Disabled: No additional restrictions. Rely on default permissions. Default on workstations: Enabled. Default on server:Enabled. > [!IMPORTANT] > This policy has no impact on domain controllers. @@ -1646,9 +1657,10 @@ Network access: Restrict clients allowed to make remote calls to SAM This policy -Network security Allow Local System to use computer identity for NTLM This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. +Network security: Allow Local System to use computer identity for NTLM This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. + - If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. -- If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. By default, this policy is enabled on Windows 7 and above. By default, this policy is disabled on Windows Vista. This policy is supported on at least Windows Vista or Windows Server 2008 +- If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. By default, this policy is enabled on Windows 7 and above. By default, this policy is disabled on Windows Vista. This policy is supported on at least Windows Vista or Windows Server 2008. > [!NOTE] > Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. @@ -1772,7 +1784,7 @@ Network security: Allow PKU2U authentication requests to this computer to use on -Network security Do not store LAN Manager hash value on next password change This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. Default on Windows Vista and above Enabled Default on Windows XP Disabled +Network security: Do not store LAN Manager hash value on next password change This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. Default on Windows Vista and above: Enabled Default on Windows XP: Disabled. > [!IMPORTANT] > Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0. This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98. @@ -1833,7 +1845,7 @@ Network security Do not store LAN Manager hash value on next password change Thi -Network security Force logoff when logon hours expire This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired. Default Enabled +Network security: Force logoff when logon hours expire This security setting determines whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire. If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired. Default: Enabled. > [!NOTE] > This security setting behaves as an account policy. For domain accounts, there can be only one account policy. The account policy must be defined in the Default Domain Policy, and it is enforced by the domain controllers that make up the domain. A domain controller always pulls the account policy from the Default Domain Policy Group Policy object (GPO), even if there is a different account policy applied to the organizational unit that contains the domain controller. By default, workstations and servers that are joined to a domain (for example, member computers) also receive the same account policy for their local accounts. However, local account policies for member computers can be different from the domain account policy by defining an account policy for the organizational unit that contains the member computers. Kerberos settings are not applied to member computers. @@ -1894,10 +1906,10 @@ Network security Force logoff when logon hours expire This security setting dete -Network security LAN Manager authentication level This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows Send LM and NTLM responses Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send LM and NTLM - use NTLMv2 session security if negotiated Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLM response only Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only\refuse LM Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). Send NTLMv2 response only\refuse LM and NTLM Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication) +Network security LAN Manager authentication level This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication). > [!IMPORTANT] -> This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. Default Windows 2000 and windows XP send LM and NTLM responses Windows Server 2003 Send NTLM response only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 Send NTLMv2 response only +> This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. Default: Windows 2000 and windows XP: send LM and NTLM responses Windows Server 2003: Send NTLM response only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only. @@ -1959,7 +1971,7 @@ Network security LAN Manager authentication level This security setting determin -Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption +Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption. @@ -2019,7 +2031,7 @@ Network security: Minimum session security for NTLM SSP based (including secure -Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption +Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. Windows 7 and Windows Server 2008 R2: Require 128-bit encryption. @@ -2079,7 +2091,8 @@ Network security: Minimum session security for NTLM SSP based (including secure -Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. +Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. +- If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. - If you do not configure this policy setting, no exceptions will be applied. The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. @@ -2129,7 +2142,7 @@ Network security: Restrict NTLM: Add remote server exceptions for NTLM authentic -Network security Restrict NTLM Audit Incoming NTLM Traffic This policy setting allows you to audit incoming NTLM traffic. If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security Restrict NTLM Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security Restrict NTLM Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. This policy is supported on at least Windows 7 or Windows Server 2008 R2 +Network security: Restrict NTLM: Audit Incoming NTLM Traffic This policy setting allows you to audit incoming NTLM traffic. If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. This policy is supported on at least Windows 7 or Windows Server 2008 R2. > [!NOTE] > Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2191,7 +2204,7 @@ Network security Restrict NTLM Audit Incoming NTLM Traffic This policy setting a -Network security Restrict NTLM Incoming NTLM traffic This policy setting allows you to deny or allow incoming NTLM traffic. If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. This policy is supported on at least Windows 7 or Windows Server 2008 R2 +Network security: Restrict NTLM: Incoming NTLM traffic This policy setting allows you to deny or allow incoming NTLM traffic. If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. This policy is supported on at least Windows 7 or Windows Server 2008 R2. > [!NOTE] > Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2253,7 +2266,7 @@ Network security Restrict NTLM Incoming NTLM traffic This policy setting allows -Network security Restrict NTLM Outgoing NTLM traffic to remote servers This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security Restrict NTLM Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. This policy is supported on at least Windows 7 or Windows Server 2008 R2 +Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. This policy is supported on at least Windows 7 or Windows Server 2008 R2. > [!NOTE] > Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2373,8 +2386,7 @@ Shutdown: Allow system to be shut down without having to log on This security se -Shutdown: Clear virtual memory pagefile This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. -- If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. Default: Disabled. +Shutdown: Clear virtual memory pagefile This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. Default: Disabled. @@ -2490,10 +2502,10 @@ User Account Control: Allow UIAccess applications to prompt for elevation withou -User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are - Elevate without prompting Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials +User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are: - Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. > [!NOTE] -> Use this option only in the most constrained environments. - Prompt for credentials on the secure desktop When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for credentials When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - Prompt for consent When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for consent for non-Windows binaries (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. +> Use this option only in the most constrained environments. - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. @@ -2788,7 +2800,7 @@ User Account Control: Only elevate UIAccess applications that are installed in s -User Account Control Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are - Enabled (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - Disabled Admin Approval Mode and all related UAC policy settings are disabled +User Account Control: Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are: - Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - Disabled: Admin Approval Mode and all related UAC policy settings are disabled. > [!NOTE] > If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index f2cfa06fb3..bf0872d969 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -4,7 +4,7 @@ description: Learn more about the LocalUsersAndGroups Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,10 +37,16 @@ ms.topic: reference -This Setting allows an administrator to manage local groups on a Device. Possible settings: +This Setting allows an administrator to manage local groups on a Device. +Possible settings: -1. Update Group Membership Update a group and add and/or remove members though the 'U' action. When using Update, existing group members that are not specified in the policy remain untouched. -2. Replace Group Membership Restrict a group by replacing group membership through the 'R' action. When using Replace, existing group membership is replaced by the list of members specified in the add member section. This option works in the same way as a Restricted Group and any group members that are not specified in the policy are removed. +1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. +When using Update, existing group members that are not specified in the policy remain untouched. + +2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. +When using Replace, existing group membership is replaced by the list of members specified in +the add member section. This option works in the same way as a Restricted Group and any group +members that are not specified in the policy are removed. > [!CAUTION] > If the same group is configured with both Replace and Update, then Replace will win. diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md index ee17cf4ab6..c4a07c645d 100644 --- a/windows/client-management/mdm/policy-csp-multitasking.md +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -4,7 +4,7 @@ description: Learn more about the Multitasking Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,12 @@ ms.topic: reference - -Configures the inclusion of Microsoft Edge tabs into Alt-Tab. + +This setting controls the inclusion of Microsoft Edge tabs into Alt+Tab. + +This can be set to show all tabs, the most recent 3 or 5 tabs, or no tabs from Microsoft Edge. + +If this is set to show "Open windows only", the whole feature will be disabled. @@ -77,9 +81,13 @@ This policy only applies to the Alt+Tab switcher. When the policy isn't enabled, | Name | Value | |:--|:--| -| Name | MultiTaskingAltTabFilter | -| Path | multitasking > AT > WindowsComponents > MULTITASKING | -| Element Name | AltTabFilterDropdown | +| Name | BrowserAltTabBlowout | +| Friendly Name | Configure the inclusion of Microsoft Edge tabs into Alt-Tab | +| Element Name | Pressing Alt + Tab shows. | +| Location | User Configuration | +| Path | Windows Components > Multitasking | +| Registry Key Name | Software\Policies\Microsoft\Windows\Explorer | +| ADMX File Name | Multitasking.admx | diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 2805dfa3b0..ec7813abdb 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -4,7 +4,7 @@ description: Learn more about the NetworkIsolation Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,8 +36,18 @@ ms.topic: reference - -Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy. This domain list is a pipe-separated list of cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. For example, ``|``|``,``|``|``,``|. + +This setting does not apply to desktop apps. + +A pipe-separated list of domain cloud resources. Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address. + +Contains a list of Enterprise resource domains hosted in the cloud. Connections to these resources are considered connections to enterprise networks. + +If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the Intranet proxy servers for apps policy. + +Example: [cloudresource]|[cloudresource]|[cloudresource],[proxy]|[cloudresource]|[cloudresource],[proxy]| + +For more information see: @@ -61,7 +71,7 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to |:--|:--| | Name | WF_NetIsolation_EnterpriseCloudResources | | Friendly Name | Enterprise resource domains hosted in the cloud | -| Element Name | Enterprise cloud resources | +| Element Name | Enterprise cloud resources. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -90,8 +100,20 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to - -This is the comma-separated list of internal proxy servers. For example 157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseCloudResources policy to force traffic to the matched cloud resources through these proxies. + +This setting does not apply to desktop apps. + +A semicolon-separated list of intranet proxy server IP addresses. These addresses are categorized as private by Windows Network Isolation and are accessible to apps that have the Home/Work Networking capability. + +- If you enable this policy setting, it allows an administrator to configure a set of proxies that provide access to intranet resources. + +- If you disable or do not configure this policy setting, Windows Network Isolation attempts to discover proxies and configures them as Internet nodes. + +This setting should NOT be used to configure Internet proxies. + +Example: [3efe:3022::1000]; 18.0.0.1; 18.0.0.2 + +For more information see: @@ -115,7 +137,7 @@ This is the comma-separated list of internal proxy servers. For example 157.54.1 |:--|:--| | Name | WF_NetIsolation_Intranet_Proxies | | Friendly Name | Intranet proxy servers for apps | -| Element Name | Type a proxy server IP address for the intranet | +| Element Name | Type a proxy server IP address for the intranet. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -144,8 +166,22 @@ This is the comma-separated list of internal proxy servers. For example 157.54.1 - -Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of IPv4 and IPv6 ranges. + +This setting does not apply to desktop apps. + +A comma-separated list of IP address ranges that are in your corporate network. + +- If you enable this policy setting, it ensures that apps with the Home/Work Networking capability have appropriate access to your corporate network. These addresses are only accessible to apps if and only if the app has declared the Home/Work Networking capability. + +Windows Network Isolation attempts to automatically discover private network hosts. By default, the addresses configured with this policy setting are merged with the hosts that are declared as private through automatic discovery. + +To ensure that these addresses are the only addresses ever classified as private, enable the "Subnet definitions are authoritative" policy setting. + +- If you disable or do not configure this policy setting, Windows Network Isolation attempts to automatically discover your private network hosts. + +Example: 3efe:1092::/96,18.1.1.1/10 + +For more information see: @@ -169,7 +205,7 @@ Sets the enterprise IP ranges that define the computers in the enterprise networ |:--|:--| | Name | WF_NetIsolation_PrivateSubnet | | Friendly Name | Private network ranges for apps | -| Element Name | Private subnets | +| Element Name | Private subnets. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -280,10 +316,10 @@ For more information see: -This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example contoso. sharepoint. com, Fabrikam. com +This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to. This is a comma-separated list of domains, for example contoso. sharepoint. com, Fabrikam. com. > [!NOTE] -> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. Here are the steps to create canonical domain namesTransform the ASCII characters (A-Z only) to lower case. For example, Microsoft. COM -> microsoft. com. Call IdnToAscii with IDN_USE_STD3_ASCII_RULES as the flags. Call IdnToUnicode with no flags set (dwFlags = 0). +> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. Here are the steps to create canonical domain names:Transform the ASCII characters (A-Z only) to lower case. For example, Microsoft. COM -> microsoft. com. Call IdnToAscii with IDN_USE_STD3_ASCII_RULES as the flags. Call IdnToUnicode with no flags set (dwFlags = 0). @@ -327,8 +363,18 @@ For more information, see the following APIs: - -This is a comma-separated list of proxy servers. Any server on this list is considered non-enterprise. For example 157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59. + +This setting does not apply to desktop apps. + +A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to apps that have the Internet Client or Internet Client/Server capabilities. + +- If you enable this policy setting, apps on proxied networks can access the Internet without relying on the Private Network capability. However, in most situations Windows Network Isolation will be able to correctly discover proxies. By default, any proxies configured with this setting are merged with proxies that are auto-discovered. To make this policy configuration the sole list of allowed proxies, enable the "Proxy definitions are authoritative" setting. + +- If you disable or do not configure this policy setting, apps will use the Internet proxies auto-discovered by Windows Network Isolation. + +Example: [3efe:3022::1000];18.0.0.1;18.0.0.2 + +For more information see: @@ -352,7 +398,7 @@ This is a comma-separated list of proxy servers. Any server on this list is cons |:--|:--| | Name | WF_NetIsolation_Domain_Proxies | | Friendly Name | Internet proxy servers for apps | -| Element Name | Domain Proxies | +| Element Name | Domain Proxies. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | @@ -452,8 +498,12 @@ For more information see: - -List of domain names that can used for work or personal resource. + +This setting does not apply to desktop apps. + +A comma-separated list of domain names that can be used as both work or personal resource. + +For more information see: @@ -477,7 +527,7 @@ List of domain names that can used for work or personal resource. |:--|:--| | Name | WF_NetIsolation_NeutralResources | | Friendly Name | Domains categorized as both work and personal | -| Element Name | Neutral resources | +| Element Name | Neutral resources. | | Location | Computer Configuration | | Path | Network > Network Isolation | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation | diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index 4669b6c300..783e4f6580 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -4,7 +4,7 @@ description: Learn more about the NetworkListManager Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042] and later | @@ -37,7 +37,7 @@ ms.topic: reference -List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. +List of URLs (seperated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. @@ -79,7 +79,7 @@ Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 2009 [10.0.19042] and later | @@ -90,7 +90,7 @@ Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing -The string will be used to name the network authenticated against one of the endpoints listed in AllowedTlsAuthenticationEndpoints policy +The string will be used to name the network authenticated against one of the endpoints listed in AllowedTlsAuthenticationEndpoints policy. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 1e4d224152..5f2769f2f1 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -4,7 +4,7 @@ description: Learn more about the Notifications Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -242,6 +242,67 @@ No reboots or service restarts are required for this policy setting to take effe + +## EnableExpandedToastNotifications + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1620] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/Notifications/EnableExpandedToastNotifications +``` + + + + +This policy setting turns on multiple expanded toast notifications in action center. + +- If you enable this policy setting, the first three notifications of each application will be expanded by default in action center. +- If you disable or do not configure this policy setting, only the first notification of each application will be expanded by default in action center. Windows 10 only. This will be immediately deprecated for Windows 11. No reboots or service restarts are required for this policy setting to take effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disable multiple expanded toasts in action center. | +| 1 | Enable multiple expanded toasts in action center. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExpandedToastNotifications | +| Path | WPN > AT > StartMenu > NotificationsCategory | + + + + + + + + ## WnsEndpoint @@ -258,8 +319,8 @@ No reboots or service restarts are required for this policy setting to take effe - -FQDN for the WNS endpoint + +This policy sets a special WNS FQDN for specific environments. @@ -289,7 +350,7 @@ If you disable or don't configure this setting, the push notifications will conn |:--|:--| | Name | WnsEndpoint_Policy | | Friendly Name | Enables group policy for the WNS FQDN | -| Element Name | FQDN for WNS | +| Element Name | FQDN for WNS. | | Location | Computer Configuration | | Path | Start Menu and Taskbar > Notifications | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications | diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 1af9f3391f..a8a8f001c3 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -4,7 +4,7 @@ description: Learn more about the Power Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -332,9 +332,11 @@ If the user has configured a slide show to run on the lock screen when the machi - + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + - If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + - If you disable or do not configure this policy setting, users control this setting. @@ -389,9 +391,11 @@ This policy setting allows you to specify battery charge level at which Energy S - + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + - If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + - If you disable or do not configure this policy setting, users control this setting. @@ -688,8 +692,17 @@ This policy setting specifies whether or not the user is prompted for a password - -This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -725,7 +738,7 @@ This policy setting specifies the action that Windows takes when a user closes t |:--|:--| | Name | DCSystemLidAction_2 | | Friendly Name | Select the lid switch action (on battery) | -| Element Name | Lid Switch Action | +| Element Name | Lid Switch Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936 | @@ -754,8 +767,17 @@ This policy setting specifies the action that Windows takes when a user closes t - -This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -791,7 +813,7 @@ This policy setting specifies the action that Windows takes when a user closes t |:--|:--| | Name | ACSystemLidAction_2 | | Friendly Name | Select the lid switch action (plugged in) | -| Element Name | Lid Switch Action | +| Element Name | Lid Switch Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936 | @@ -820,8 +842,17 @@ This policy setting specifies the action that Windows takes when a user closes t - -This policy setting specifies the action that Windows takes when a user presses the power button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -857,7 +888,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | DCPowerButtonAction_2 | | Friendly Name | Select the Power button action (on battery) | -| Element Name | Power Button Action | +| Element Name | Power Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280 | @@ -886,8 +917,17 @@ This policy setting specifies the action that Windows takes when a user presses - -This policy setting specifies the action that Windows takes when a user presses the power button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -923,7 +963,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | ACPowerButtonAction_2 | | Friendly Name | Select the Power button action (plugged in) | -| Element Name | Power Button Action | +| Element Name | Power Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280 | @@ -952,8 +992,17 @@ This policy setting specifies the action that Windows takes when a user presses - -This policy setting specifies the action that Windows takes when a user presses the sleep button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -989,7 +1038,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | DCSleepButtonAction_2 | | Friendly Name | Select the Sleep button action (on battery) | -| Element Name | Sleep Button Action | +| Element Name | Sleep Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB | @@ -1018,8 +1067,17 @@ This policy setting specifies the action that Windows takes when a user presses - -This policy setting specifies the action that Windows takes when a user presses the sleep button. Possible actions include: 0 - Take no action 1 - Sleep 2 - Hibernate 3 - Shut down If you enable this policy setting, you must select the desired action. + +This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +-Take no action +-Sleep +-Hibernate +-Shut down + +- If you enable this policy setting, you must select the desired action. + - If you disable this policy setting or do not configure it, users can see and change this setting. @@ -1055,7 +1113,7 @@ This policy setting specifies the action that Windows takes when a user presses |:--|:--| | Name | ACSleepButtonAction_2 | | Friendly Name | Select the Sleep button action (plugged in) | -| Element Name | Sleep Button Action | +| Element Name | Sleep Button Action. | | Location | Computer Configuration | | Path | System > Power Management > Button Settings | | Registry Key Name | Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB | @@ -1340,10 +1398,14 @@ This policy setting allows you to turn off hybrid sleep. - + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + - If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. -- If you disable or do not configure this policy setting, users control this setting. If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + +- If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. @@ -1397,10 +1459,14 @@ This policy setting allows you to specify the period of inactivity before Window - + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + - If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. -- If you disable or do not configure this policy setting, users control this setting. If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + +- If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index d6abd1659d..61ca4d4ecc 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -4,7 +4,7 @@ description: Learn more about the Printers Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -166,7 +166,7 @@ Manages how Queue-specific files are processed during printer installation. At p You can enable this setting to change the default behavior involving queue-specific files. To use this setting, select one of the options below from the "Manage processing of Queue-specific files" box. -- If you disable or do not configure this policy setting, the default behavior is "Limit Queue-specific files to Color profiles". +If you disable or do not configure this policy setting, the default behavior is "Limit Queue-specific files to Color profiles". - "Do not allow Queue-specific files" specifies that no queue-specific files will be allowed/processed during print queue/printer connection installation. @@ -238,7 +238,7 @@ As part of this validation the catalog/embedded signature is verified and all fi You can enable this setting to change the default signature validation method. To use this setting, select one of the options below from the "Select the driver signature mechanism for this computer" box. -- If you disable or do not configure this policy setting, the default method is "Allow all validly signed drivers". +If you disable or do not configure this policy setting, the default method is "Allow all validly signed drivers". - "Require inbox signed drivers" specifies only drivers that are shipped as part of a Windows image are allowed on this computer. @@ -508,15 +508,15 @@ This policy setting controls which protocol and protocol settings to use for out By default, RPC over TCP is used and authentication is always enabled. For RPC over named pipes, authentication is always enabled for domain joined machines but disabled for non domain joined machines. Protocol to use for outgoing RPC connections: -- "RPC over TCP": Use RPC over TCP for outgoing RPC connections to a remote print spooler -- "RPC over named pipes": Use RPC over named pipes for outgoing RPC connections to a remote print spooler + - "RPC over TCP": Use RPC over TCP for outgoing RPC connections to a remote print spooler + - "RPC over named pipes": Use RPC over named pipes for outgoing RPC connections to a remote print spooler Use authentication for outgoing RPC over named pipes connections: -- "Default": By default domain joined computers enable RPC authentication for RPC over named pipes while non domain joined computers disable RPC authentication for RPC over named pipes -- "Authentication enabled": RPC authentication will be used for outgoing RPC over named pipes connections -- "Authentication disabled": RPC authentication will not be used for outgoing RPC over named pipes connections + - "Default": By default domain joined computers enable RPC authentication for RPC over named pipes while non domain joined computers disable RPC authentication for RPC over named pipes + - "Authentication enabled": RPC authentication will be used for outgoing RPC over named pipes connections + - "Authentication disabled": RPC authentication will not be used for outgoing RPC over named pipes connections -- If you disable or do not configure this policy setting, the above defaults will be used. +If you disable or do not configure this policy setting, the above defaults will be used. @@ -576,15 +576,15 @@ This policy setting controls which protocols incoming RPC connections to the pri By default, RPC over TCP is enabled and Negotiate is used for the authentication protocol. Protocols to allow for incoming RPC connections: -- "RPC over named pipes": Incoming RPC connections are only allowed over named pipes -- "RPC over TCP": Incoming RPC connections are only allowed over TCP (the default option) -- "RPC over named pipes and TCP": Incoming RPC connections will be allowed over TCP and named pipes + - "RPC over named pipes": Incoming RPC connections are only allowed over named pipes + - "RPC over TCP": Incoming RPC connections are only allowed over TCP (the default option) + - "RPC over named pipes and TCP": Incoming RPC connections will be allowed over TCP and named pipes Authentication protocol to use for incoming RPC connections: -- "Negotiate": Use the Negotiate authentication protocol (the default option) -- "Kerberos": Use the Kerberos authentication protocol + - "Negotiate": Use the Negotiate authentication protocol (the default option) + - "Kerberos": Use the Kerberos authentication protocol -- If you disable or do not configure this policy setting, the above defaults will be used. +If you disable or do not configure this policy setting, the above defaults will be used. @@ -644,9 +644,9 @@ This policy setting controls which port is used for RPC over TCP for incoming co By default dynamic TCP ports are used. RPC over TCP port: -- The port to use for RPC over TCP. A value of 0 is the default and indicates that dynamic TCP ports will be used + - The port to use for RPC over TCP. A value of 0 is the default and indicates that dynamic TCP ports will be used -- If you disable or do not configure this policy setting, dynamic TCP ports are used. +If you disable or do not configure this policy setting, dynamic TCP ports are used. @@ -831,7 +831,7 @@ This checks outranks the signature check and allows drivers that have a valid si Entries in the exclusion list consist of a SHA256 hash (or SHA1 hash for Win7) of the INF file and/or main driver DLL file of the driver and the name of the file. -- If you disable or do not configure this policy setting, the registry key and values associated with this policy setting will be deleted, if currently set to a value. +If you disable or do not configure this policy setting, the registry key and values associated with this policy setting will be deleted, if currently set to a value. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 24f10738e5..f4fa8a6e6a 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -4,7 +4,7 @@ description: Learn more about the Privacy Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -90,6 +90,7 @@ Allows or disallows the automatic acceptance of the pairing and privacy user con This policy setting determines whether Clipboard contents can be synchronized across devices. + - If you enable this policy setting, Clipboard contents are allowed to be synchronized across devices logged in under the same Microsoft account or Azure AD account. - If you disable this policy setting, Clipboard contents cannot be shared to other devices. Policy change takes effect immediately. @@ -372,6 +373,7 @@ In some managed environments, the privacy settings may be set by other policies. This policy setting determines whether ActivityFeed is enabled. + - If you enable this policy setting, all activity types (as applicable) are allowed to be published and ActivityFeed shall roam these activities across device graph of the user. - If you disable this policy setting, activities can't be published and ActivityFeed shall disable cloud sync. Policy change takes effect immediately. @@ -436,8 +438,20 @@ Policy change takes effect immediately. - + This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -473,7 +487,7 @@ The most restrictive value is `2` to deny apps access to account information. |:--|:--| | Name | LetAppsAccessAccountInfo | | Friendly Name | Let Windows apps access account information | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -502,8 +516,20 @@ The most restrictive value is `2` to deny apps access to account information. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -555,8 +581,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -608,8 +646,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access account information. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access account information and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access account information and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access account information by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -841,8 +891,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use - + This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -878,7 +940,7 @@ The most restrictive value is `2` to deny apps access to the calendar. |:--|:--| | Name | LetAppsAccessCalendar | | Friendly Name | Let Windows apps access the calendar | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -907,8 +969,20 @@ The most restrictive value is `2` to deny apps access to the calendar. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -960,8 +1034,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1013,8 +1099,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access the calendar. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the calendar and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the calendar and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the calendar by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1066,8 +1164,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1103,7 +1213,7 @@ The most restrictive value is `2` to deny apps access to call history. |:--|:--| | Name | LetAppsAccessCallHistory | | Friendly Name | Let Windows apps access call history | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1132,8 +1242,20 @@ The most restrictive value is `2` to deny apps access to call history. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1185,8 +1307,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1238,8 +1372,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can access call history. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access call history by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the call history and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the call history and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the call history by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1291,8 +1437,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1328,7 +1486,7 @@ The most restrictive value is `2` to deny apps access to the camera. |:--|:--| | Name | LetAppsAccessCamera | | Friendly Name | Let Windows apps access the camera | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1357,8 +1515,20 @@ The most restrictive value is `2` to deny apps access to the camera. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1410,8 +1580,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1463,8 +1645,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the camera. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the camera and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the camera and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the camera by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1516,8 +1710,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1553,7 +1759,7 @@ The most restrictive value is `2` to deny apps access to contacts. |:--|:--| | Name | LetAppsAccessContacts | | Friendly Name | Let Windows apps access contacts | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1582,8 +1788,20 @@ The most restrictive value is `2` to deny apps access to contacts. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1635,8 +1853,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1688,8 +1918,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access contacts. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access contacts and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access contacts and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access contacts by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1741,8 +1983,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1778,7 +2032,7 @@ The most restrictive value is `2` to deny apps access to email. |:--|:--| | Name | LetAppsAccessEmail | | Friendly Name | Let Windows apps access email | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -1807,8 +2061,20 @@ The most restrictive value is `2` to deny apps access to email. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1860,8 +2126,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -1913,8 +2191,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access email. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access email and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access email and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access email by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2127,8 +2417,20 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use - -This policy setting specifies whether Windows apps can use screen capture on arbitrary windows or displays. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2181,8 +2483,20 @@ This policy setting specifies whether Windows apps can use screen capture on arb - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to use screen capture on arbitrary windows or displays. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2234,8 +2548,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the use of screen capture on arbitrary windows or displays. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2287,8 +2613,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the programmatic screen capture setting for the listed apps. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can take screenshots of various windows or displays. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to take screenshots of various windows or displays and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can take screenshots of various windows or displays by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2340,8 +2678,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - -This policy setting specifies whether Windows apps can disable the screen capture border. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2366,7 +2716,7 @@ This policy setting specifies whether Windows apps can disable the screen captur |:--|:--| | Name | LetAppsAccessGraphicsCaptureWithoutBorder | | Friendly Name | Let Windows apps turn off the screenshot border | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -2395,8 +2745,20 @@ This policy setting specifies whether Windows apps can disable the screen captur - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to disable the screen capture border. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2448,8 +2810,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied configuration access to the screen capture border. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2501,8 +2875,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the screen capture border privacy setting for the listed apps. This setting overrides the default LetAppsAccessGraphicsCaptureWithoutBorder policy setting for the specified apps. + +This policy setting specifies whether Windows apps can turn off the screenshot border. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to turn off the screenshot border and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can turn off the screenshot border by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2538,6 +2924,216 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u + +## LetAppsAccessHumanPresence + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence +``` + + + + +This policy setting specifies whether Windows apps can access the human presence sensor. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User in control. | +| 1 | Force allow. | +| 2 | Force deny. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_Enum | + + + + + + + + + +## LetAppsAccessHumanPresence_ForceAllowTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_ForceAllowTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_ForceAllowTheseApps_List | + + + + + + + + + +## LetAppsAccessHumanPresence_ForceDenyTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_ForceDenyTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the human presence sensor. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_ForceDenyTheseApps_List | + + + + + + + + + +## LetAppsAccessHumanPresence_UserInControlOfTheseApps + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.25000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessHumanPresence_UserInControlOfTheseApps +``` + + + + +List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the human presence privacy setting for the listed apps. This setting overrides the default LetAppsAccessHumanPresence policy setting for the specified apps. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | LetAppsAccessHumanPresence | +| Path | AppPrivacy > AT > WindowsComponents > AppPrivacy | +| Element Name | LetAppsAccessHumanPresence_UserInControlOfTheseApps_List | + + + + + + + + ## LetAppsAccessLocation @@ -2554,8 +3150,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2591,7 +3199,7 @@ The most restrictive value is `2` to deny apps access to the device's location. |:--|:--| | Name | LetAppsAccessLocation | | Friendly Name | Let Windows apps access location | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -2620,8 +3228,20 @@ The most restrictive value is `2` to deny apps access to the device's location. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2673,8 +3293,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2726,8 +3358,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access location. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access location and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access location and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access location by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2779,8 +3423,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2816,7 +3472,7 @@ The most restrictive value is `2` to deny apps access to messaging. |:--|:--| | Name | LetAppsAccessMessaging | | Friendly Name | Let Windows apps access messaging | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -2845,8 +3501,20 @@ The most restrictive value is `2` to deny apps access to messaging. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2898,8 +3566,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -2951,8 +3631,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + +This policy setting specifies whether Windows apps can read or send messages (text or MMS). + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps can read or send messages and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps cannot read or send messages and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can read or send messages by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3004,8 +3696,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3041,7 +3745,7 @@ The most restrictive value is `2` to deny apps access to the microphone. |:--|:--| | Name | LetAppsAccessMicrophone | | Friendly Name | Let Windows apps access the microphone | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3070,8 +3774,20 @@ The most restrictive value is `2` to deny apps access to the microphone. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3123,8 +3839,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3176,8 +3904,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access the microphone. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access the microphone and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access the microphone and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access the microphone by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3229,8 +3969,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3266,7 +4018,7 @@ The most restrictive value is `2` to deny apps access to motion data. |:--|:--| | Name | LetAppsAccessMotion | | Friendly Name | Let Windows apps access motion | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3295,8 +4047,20 @@ The most restrictive value is `2` to deny apps access to motion data. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3348,8 +4112,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3401,8 +4177,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access motion data. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access motion data and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access motion data and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access motion data by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3454,8 +4242,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3491,7 +4291,7 @@ The most restrictive value is `2` to deny apps access to notifications. |:--|:--| | Name | LetAppsAccessNotifications | | Friendly Name | Let Windows apps access notifications | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3520,8 +4320,20 @@ The most restrictive value is `2` to deny apps access to notifications. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3573,8 +4385,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3626,8 +4450,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access notifications. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access notifications and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access notifications and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access notifications by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3679,8 +4515,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - -This policy setting specifies whether Windows apps can make phone calls + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3716,7 +4564,7 @@ The most restrictive value is `2` to deny apps access to make phone calls. |:--|:--| | Name | LetAppsAccessPhone | | Friendly Name | Let Windows apps make phone calls | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3745,8 +4593,20 @@ The most restrictive value is `2` to deny apps access to make phone calls. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3798,8 +4658,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3851,8 +4723,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + +This policy setting specifies whether Windows apps can make phone calls. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to make phone calls and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to make phone calls and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can make phone calls by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3904,8 +4788,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -3941,7 +4837,7 @@ The most restrictive value is `2` to deny apps access to control radios. |:--|:--| | Name | LetAppsAccessRadios | | Friendly Name | Let Windows apps control radios | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -3970,8 +4866,20 @@ The most restrictive value is `2` to deny apps access to control radios. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4023,8 +4931,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4076,8 +4996,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + +This policy setting specifies whether Windows apps have access to control radios. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps will have access to control radios and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps will not have access to control radios and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps have access to control radios by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4129,8 +5061,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4155,7 +5099,7 @@ This policy setting specifies whether Windows apps can access tasks. |:--|:--| | Name | LetAppsAccessTasks | | Friendly Name | Let Windows apps access Tasks | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4184,8 +5128,20 @@ This policy setting specifies whether Windows apps can access tasks. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4237,8 +5193,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4290,8 +5258,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access tasks. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access tasks and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access tasks and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access tasks by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4343,8 +5323,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4380,7 +5372,7 @@ The most restrictive value is `2` to deny apps access trusted devices. |:--|:--| | Name | LetAppsAccessTrustedDevices | | Friendly Name | Let Windows apps access trusted devices | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4409,8 +5401,20 @@ The most restrictive value is `2` to deny apps access trusted devices. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4462,8 +5466,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4515,8 +5531,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can access trusted devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to access trusted devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to access trusted devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access trusted devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4568,8 +5596,18 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u - + This policy setting specifies whether Windows apps can be activated by voice. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to be activated with a voice keyword and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to be activated with a voice keyword and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can be activated with a voice keyword by using Settings > Privacy on the device. + +This policy is applied to Windows apps and Cortana. @@ -4603,7 +5641,7 @@ This policy setting specifies whether Windows apps can be activated by voice. |:--|:--| | Name | LetAppsActivateWithVoice | | Friendly Name | Let Windows apps activate with voice | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4632,8 +5670,18 @@ This policy setting specifies whether Windows apps can be activated by voice. - + This policy setting specifies whether Windows apps can be activated by voice while the system is locked. + +If you choose the "User is in control" option, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, users can interact with applications using speech while the system is locked and employees in your organization cannot change it. + +If you choose the "Force Deny" option, users cannot interact with applications using speech while the system is locked and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether users can interact with applications using speech while the system is locked by using Settings > Privacy on the device. + +This policy is applied to Windows apps and Cortana. It takes precedence of the "Allow Cortana above lock" policy. This policy is applicable only when "Allow voice activation" policy is configured to allow applications to be activated with voice. @@ -4667,7 +5715,7 @@ This policy setting specifies whether Windows apps can be activated by voice whi |:--|:--| | Name | LetAppsActivateWithVoiceAboveLock | | Friendly Name | Let Windows apps activate with voice while the system is locked | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4696,8 +5744,20 @@ This policy setting specifies whether Windows apps can be activated by voice whi - -This policy setting specifies whether Windows apps can get diagnostic information about other apps, including user names. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4733,7 +5793,7 @@ The most restrictive value is `2` to deny apps access to diagnostic data. |:--|:--| | Name | LetAppsGetDiagnosticInfo | | Friendly Name | Let Windows apps access diagnostic information about other apps | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4762,8 +5822,20 @@ The most restrictive value is `2` to deny apps access to diagnostic data. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4815,8 +5887,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4868,8 +5952,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the app diagnostics privacy setting for the listed Windows apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can get diagnostic information about other Windows apps, including user name. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can get diagnostic information about other apps using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to get diagnostic information about other apps and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can get diagnostic information about other apps by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4921,8 +6017,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -4960,7 +6068,7 @@ The most restrictive value is `2` to deny apps from running in the background. |:--|:--| | Name | LetAppsRunInBackground | | Friendly Name | Let Windows apps run in the background | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -4989,8 +6097,20 @@ The most restrictive value is `2` to deny apps from running in the background. - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5042,8 +6162,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5095,8 +6227,20 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window - -List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the background apps privacy setting for the listed Windows apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. + +This policy setting specifies whether Windows apps can run in the background. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to run in the background and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to run in the background and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can run in the background by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5148,8 +6292,20 @@ List of semi-colon delimited Package Family Names of Windows apps. The user is a - + This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5185,7 +6341,7 @@ The most restrictive value is `2` to deny apps syncing with devices. |:--|:--| | Name | LetAppsSyncWithDevices | | Friendly Name | Let Windows apps communicate with unpaired devices | -| Element Name | Default for all apps | +| Element Name | Default for all apps. | | Location | Computer Configuration | | Path | Windows Components > App Privacy | | Registry Key Name | Software\Policies\Microsoft\Windows\AppPrivacy | @@ -5214,8 +6370,20 @@ The most restrictive value is `2` to deny apps syncing with devices. - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5267,8 +6435,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5320,8 +6500,20 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. Liste - -List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + +This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. + +You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. + +If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If you choose the "Force Allow" option, Windows apps are allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you choose the "Force Deny" option, Windows apps are not allowed to communicate with unpaired wireless devices and employees in your organization cannot change it. + +If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can communicate with unpaired wireless devices by using Settings > Privacy on the device. + +If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app. @@ -5375,6 +6567,7 @@ List of semi-colon delimited Package Family Names of Microsoft Store Apps. The u This policy setting determines whether User Activities can be published. + - If you enable this policy setting, activities of type User Activity are allowed to be published. - If you disable this policy setting, activities of type User Activity are not allowed to be published. Policy change takes effect immediately. @@ -5443,6 +6636,7 @@ For more information, see [Windows activity history and your privacy](https://su This policy setting determines whether published User Activities can be uploaded. + - If you enable this policy setting, activities of type User Activity are allowed to be uploaded. - If you disable this policy setting, activities of type User Activity are not allowed to be uploaded. Deletion of activities of type User Activity are independent of this setting. diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 4cfd15a4b7..247dadacdb 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteAssistance Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -277,7 +277,7 @@ For computers running Windows Server 2003 with Service Pack 1 (SP1) Port 135:TCP %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe -Allow Remote Desktop Exception +Allow Remote Desktop Exception. diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md index a82841ffd5..6144dbef4f 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktop.md +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteDesktop Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Controls the list of URLs that the user should be auto-subscribed to +Controls the list of URLs that the user should be auto-subscribed to. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 1545ea14b2..1025e2c4b0 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteManagement Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -299,7 +299,7 @@ For example, if you want the service to listen only on IPv4 addresses, leave the Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter. Example IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22 -Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3. FFE:FFFF:7654:FEDA:1245:BA98:3210:4562 +Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3. FFE:FFFF:7654:FEDA:1245:BA98:3210:4562. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 35fe66ae1a..f0153f08b7 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -4,7 +4,7 @@ description: Learn more about the RemoteShell Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -44,7 +44,7 @@ ms.topic: reference This policy setting configures access to remote shells. -- If you enable or do not configure this policy setting, new remote shell connections are accepted by the server. +If you enable or do not configure this policy setting, new remote shell connections are accepted by the server. If you set this policy to 'disabled', new remote shell connections are rejected by the server. @@ -169,7 +169,7 @@ Any value from 0 to 0x7FFFFFFF can be set. A minimum of 60000 milliseconds (1 mi - If you enable this policy setting, the server will wait for the specified amount of time since the last received message from the client before terminating the open shell. -If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used. +- If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 1da17f0f74..f148ceb767 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -4,7 +4,7 @@ description: Learn more about the RestrictedGroups Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -42,7 +42,7 @@ ms.topic: reference -This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group +This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. > [!CAUTION] > If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 00120ee4f2..dc4d67697d 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -4,7 +4,7 @@ description: Learn more about the Search Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/01/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -39,8 +39,8 @@ ms.topic: reference - -Allow search and Cortana to search cloud sources like OneDrive and SharePoint. This policy allows corporate administrators to control whether employees can turn off/on the search of these cloud sources. The default policy value is to allow employees access to the setting that controls search of cloud sources. + +Allow search and Cortana to search cloud sources like OneDrive and SharePoint. @@ -73,7 +73,7 @@ Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T |:--|:--| | Name | AllowCloudSearch | | Friendly Name | Allow Cloud Search | -| Element Name | Cloud Search Setting | +| Element Name | Cloud Search Setting. | | Location | Computer Configuration | | Path | Windows Components > Search | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\Windows Search | @@ -103,7 +103,7 @@ Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T -Allow the cortana opt-in page during windows setup out of the box experience +Allow the cortana opt-in page during windows setup out of the box experience. @@ -166,7 +166,7 @@ Allow the cortana opt-in page during windows setup out of the box experience -This feature allows you to disable find my files completely on the machine +This feature allows you to disable find my files completely on the machine. @@ -190,7 +190,7 @@ This policy controls whether the user can configure search to *Find My Files* mo | Value | Description | |:--|:--| -| 1 (Default) | , and the settings UI is present. | +| 1 (Default) | Find My Files feature can be toggled (still off by default), and the settings UI is present. | | 0 | Find My Files feature is turned off completely, and the settings UI is disabled. | @@ -227,6 +227,7 @@ This policy controls whether the user can configure search to *Find My Files* mo This policy setting allows encrypted items to be indexed. + - If you enable this policy setting, indexing will attempt to decrypt and index the content (access restrictions will still apply). - If you disable this policy setting, the search service components (including non-Microsoft components) are expected not to index encrypted items or encrypted stores. This policy setting is not configured by default. - If you do not configure this policy setting, the local setting, configured through Control Panel, will be used. By default, the Control Panel setting is set to not index encrypted content. @@ -481,6 +482,7 @@ This policy has been deprecated. This policy setting allows words that contain diacritic characters to be treated as separate words. + - If you enable this policy setting, words that only differ in diacritics are treated as different words. - If you disable this policy setting, words with diacritics and words without diacritics are treated as identical words. This policy setting is not configured by default. - If you do not configure this policy setting, the local setting, configured through Control Panel, will be used. @@ -593,6 +595,7 @@ Allow Windows indexer. Value type is integer. This policy setting determines when Windows uses automatic language detection results, and when it relies on indexing history. + - If you enable this policy setting, Windows will always use automatic language detection to index (as it did in Windows 7). Using automatic language detection can increase memory usage. We recommend enabling this policy setting only on PCs where documents are stored in many languages. - If you disable or do not configure this policy setting, Windows will use automatic language detection only when it can determine the language of a document with high confidence. @@ -704,7 +707,7 @@ This policy setting allows you to configure search on the taskbar. |:--|:--| | Name | ConfigureSearchOnTaskbarMode | | Friendly Name | Configures search on the taskbar | -| Element Name | Search on the taskbar | +| Element Name | Search on the taskbar. | | Location | Computer Configuration | | Path | Windows Components > Search | | Registry Key Name | Software\Policies\Microsoft\Windows\Windows Search | @@ -853,7 +856,7 @@ This policy setting configures whether or not locations on removable drives can | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | @@ -864,6 +867,7 @@ This policy setting configures whether or not locations on removable drives can + - If you enable this policy, the Search UI will be disabled along with all its entry points, such as keyboard shortcuts, touchpad gestures, and type-to-search in the Start menu. The Start menu's search box and Search Taskbar button will also be hidden. - If you disable or don't configure this policy setting, the user will be able to open the Search UI and its different entry points will be shown. @@ -929,13 +933,13 @@ This policy setting configures whether or not locations on removable drives can -This policy setting allows you to control whether or not Search can perform queries on the web, and if the web results are displayed in Search. +This policy setting allows you to control whether or not Search can perform queries on the web, if web results are displayed in Search, and if search highlights are shown in the search box and in search home. -- If you enable this policy setting, queries won't be performed on the web and web results won't be displayed when a user performs a query in Search. +- If you enable this policy setting, queries won't be performed on the web, web results won't be displayed when a user performs a query in Search, and search highlights will not be shown in the search box and in search home. -- If you disable this policy setting, queries will be performed on the web and web results will be displayed when a user performs a query in Search. +- If you disable this policy setting, queries will be performed on the web, web results will be displayed when a user performs a query in Search, and search highlights will be shown in the search box and in search home. -- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search. +- If you don't configure this policy setting, a user can choose whether or not Search can perform queries on the web, and if the web results are displayed in Search, and if search highlights are shown in the search box and in search home. @@ -1109,10 +1113,13 @@ If enabled, clients will be unable to query this computer's index remotely. Thus ## SafeSearchPermissions +> [!NOTE] +> This policy is deprecated and may be removed in a future release. + | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | @@ -1122,7 +1129,8 @@ If enabled, clients will be unable to query this computer's index remotely. Thus - + +This policy is deprecated. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index f4b72810bf..da0b3fb337 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -4,7 +4,7 @@ description: Learn more about the Security Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -302,7 +302,7 @@ This policy setting configures the system to prompt the user to clear the TPM if -Configures the use of passwords for Windows features +Configures the use of passwords for Windows features. @@ -578,7 +578,7 @@ Specifies whether provisioning packages must have a certificate signed by a devi -Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots. Setting this policy to 1 (Required)Determines whether a device is capable of Remote Device Health Attestation, by verifying if the device has TPM 2. 0. Improves the performance of the device by enabling the device to fetch and cache data to reduce the latency during Device Health Verification +Specifies whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service (HAS) when a device boots or reboots. Setting this policy to 1 (Required):Determines whether a device is capable of Remote Device Health Attestation, by verifying if the device has TPM 2. 0. Improves the performance of the device by enabling the device to fetch and cache data to reduce the latency during Device Health Verification. > [!NOTE] > We recommend that this policy is set to Required after MDM enrollment. Most restricted value is 1. diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index e26697bc7e..4102db4c23 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -4,7 +4,7 @@ description: Learn more about the Settings Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Allows the user to change Auto Play settings +Allows the user to change Auto Play settings. > [!NOTE] > Setting this policy to 0 (Not allowed) does not affect the autoplay dialog box that appears when a device is connected. @@ -287,8 +287,10 @@ Allows the user to change the language settings. - -Enables or disables the retrieval of online tips and help for the Settings app. If disabled, Settings will not contact Microsoft content services to retrieve tips and help content. + +Enables or disables the retrieval of online tips and help for the Settings app. + +If disabled, Settings will not contact Microsoft content services to retrieve tips and help content. @@ -719,8 +721,22 @@ By default, the calendar is set according to the locale of the operating system, - -Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string showonly or hide. Pages are identified by a shortened version of their already published URIs, which is the URI minus the ms-settings prefix. For example, if the URI for a settings page is ms-settingsbluetooth, the page identifier used in the policy will be just bluetooth. Multiple page identifiers are separated by semicolons. The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI ms-settingsabout and ms-settingsbluetooth respectivelyshowonlyabout;bluetooth. If the policy is not specified, the behavior will be that no pages are affected. If the policy string is formatted incorrectly, it will be ignored entirely (i. e. treated as not set) to prevent the machine from becoming unserviceable if data corruption occurs. **Note** that if a page is already hidden for another reason, then it will remain hidden even if it is in a showonly list. The format of the PageVisibilityList value is as follows The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. There are two variants one that shows only the given pages and one which hides the given pages. The first variant starts with the string showonly and the second with the string hide. Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. Each page identifier is the ms-settingsxyz URI for the page, minus the ms-settings prefix, so the identifier for the page with URI ms-settingsnetwork-wifi would be just network-wifi. The default value for this setting is an empty string, which is interpreted as show everything. Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settingsnetwork-wifi and ms-settingsbluetooth). All other pages (and the categories they're in) will be hiddenshowonlynetwork-wifi;bluetooth. Example 2, specifies that the wifi page should not be shownhidenetwork-wifi + +Specifies the list of pages to show or hide from the System Settings app. + +This policy allows an administrator to block a given set of pages from the System Settings app. Blocked pages will not be visible in the app, and if all pages in a category are blocked the category will be hidden as well. Direct navigation to a blocked page via URI, context menu in Explorer or other means will result in the front page of Settings being shown instead. + +This policy has two modes: it can either specify a list of settings pages to show or a list of pages to hide. To specify a list of pages to show, the policy string must begin with "showonly:" (without quotes), and to specify a list of pages to hide, it must begin with "hide:". If a page in a showonly list would normally be hidden for other reasons (such as a missing hardware device), this policy will not force that page to appear. After this, the policy string must contain a semicolon-delimited list of settings page identifiers. The identifier for any given settings page is the published URI for that page, minus the "ms-settings:" protocol part. + +Example: to specify that only the About and Bluetooth pages should be shown (their respective URIs are ms-settings:about and ms-settings:bluetooth) and all other pages hidden: + +showonly:about;bluetooth + +Example: to specify that only the Bluetooth page (which has URI ms-settings:bluetooth) should be hidden: + +hide:bluetooth + +The availability of per-user support is documented here: @@ -751,7 +767,7 @@ To validate this policy, use the following steps: |:--|:--| | Name | SettingsPageVisibility | | Friendly Name | Settings Page Visibility | -| Element Name | Settings Page Visibility | +| Element Name | Settings Page Visibility. | | Location | Computer and User Configuration | | Path | Control Panel | | Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index e0f18ffd48..c879d37038 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -4,7 +4,7 @@ description: Learn more about the SettingsSync Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,6 +21,9 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -44,7 +47,7 @@ ms.topic: reference Prevent the "accessibility" group from syncing to and from this PC. This turns off and disables the "accessibility" group on the "Windows backup" settings page in PC settings. -- If you enable this policy setting, the "accessibility", group will not be synced. +If you enable this policy setting, the "accessibility", group will not be synced. Use the option "Allow users to turn accessibility syncing on" so that syncing is turned off by default but not disabled. diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 907c344a75..8c3978aae7 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -4,7 +4,7 @@ description: Learn more about the SmartScreen Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -193,8 +193,23 @@ Some information is sent to Microsoft about files and programs run on PCs with t - -Allows IT Admins to control whether users can ignore SmartScreen warnings and run malicious files. + +This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that do not appear to be suspicious. + +Some information is sent to Microsoft about files and programs run on PCs with this feature enabled. + +- If you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options: + +- Warn and prevent bypass +- Warn + +- If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs will not present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app. + +- If you enable this policy with the "Warn" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app. + +- If you disable this policy, SmartScreen will be turned off for all users. Users will not be warned if they try to run suspicious apps from the Internet. + +- If you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings. @@ -227,7 +242,7 @@ Allows IT Admins to control whether users can ignore SmartScreen warnings and ru |:--|:--| | Name | ShellConfigureSmartScreen | | Friendly Name | Configure Windows Defender SmartScreen | -| Element Name | Pick one of the following settings | +| Element Name | Pick one of the following settings. | | Location | Computer Configuration | | Path | Windows Components > Windows Defender SmartScreen > Explorer | | Registry Key Name | Software\Policies\Microsoft\Windows\System | diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index f0db80b75a..19a927a634 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -4,7 +4,7 @@ description: Learn more about the Start Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -601,7 +601,7 @@ This string policy takes a JSON file named `LayoutModification.json`. The file e This policy allows you to prevent users from being able to open context menus in the Start Menu. -- If you enable this policy, then invocations of context menus within the Start Menu will be ignored. +If you enable this policy, then invocations of context menus within the Start Menu will be ignored. @@ -668,7 +668,7 @@ This policy setting removes Quick Settings from the bottom right area on the tas The quick settings area is located at the left of the clock in the taskbar and includes icons for current network and volume. -- If this setting is enabled, Quick Settings is not displayed in the quick settings area. +If this setting is enabled, Quick Settings is not displayed in the quick settings area. A reboot is required for this policy setting to take effect. @@ -732,6 +732,7 @@ A reboot is required for this policy setting to take effect. + - If you enable this policy, the user will be unable to modify Quick Settings. - If you disable or don't configure this policy setting, the user will be able to edit Quick Settings, such as pinning or unpinning buttons. @@ -801,6 +802,7 @@ A reboot is required for this policy setting to take effect. + - If you enable this policy and set it to Start menu or full screen Start, Start will be that size and users will be unable to change the size of Start in Settings. - If you disable or don't configure this policy setting, Windows will automatically select the size based on hardware form factor and users will be able to change the size of Start in Settings. @@ -993,6 +995,7 @@ Enabling this policy hides "Change account settings" from appearing in the user + - If you enable this setting, the frequently used programs list is removed from the Start menu. - If you disable this setting or do not configure it, the frequently used programs list remains on the simple Start menu. @@ -1174,7 +1177,7 @@ Enabling this policy hides "Lock" from appearing in the user tile in the start m This policy allows you to remove the People Bar from the taskbar and disables the My People experience. -- If you enable this policy the people icon will be removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users will not be able to pin people to the taskbar. +If you enable this policy the people icon will be removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users will not be able to pin people to the taskbar. @@ -1363,7 +1366,7 @@ To validate this policy, do the following steps: This policy allows you to prevent the Start Menu from displaying a list of recently installed applications. -- If you enable this policy, the Start Menu will no longer display the "Recently added" list. The corresponding setting will also be disabled in Settings. +If you enable this policy, the Start Menu will no longer display the "Recently added" list. The corresponding setting will also be disabled in Settings. @@ -1444,7 +1447,7 @@ To validate this policy, do the following steps: This policy allows you to prevent the Start Menu from displaying a list of recommended applications and files. -- If you enable this policy setting, the Start Menu will no longer show the section containing a list of recommended files and apps. +If you enable this policy setting, the Start Menu will no longer show the section containing a list of recommended files and apps. @@ -1490,6 +1493,68 @@ This policy allows you to prevent the Start Menu from displaying a list of recom + +## HideRecoPersonalizedSites + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/Start/HideRecoPersonalizedSites +``` + + + + +This policy setting allows you to hide the personalized websites in the recommended section of the Start Menu. If you enable this policy setting, the Start Menu will no longer show personalized website recommendations in the recommended section of the start menu. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Personalized Website Recommendations shown. | +| 1 | Personalized Website Recommendations hidden. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | HideRecoPersonalizedSites | +| Path | StartMenu > AT > StartMenu | + + + + + + + + ## HideRestart @@ -1759,7 +1824,7 @@ Enabling this policy hides "Switch account" from appearing in the user tile in t This policy setting allows you to hide the TaskView button. -- If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled. +If you enable this policy setting, the TaskView button will be hidden and the Settings toggle will be disabled. @@ -1931,6 +1996,7 @@ To validate this policy, do the following steps: This policy setting allows you to control pinning programs to the Taskbar. + - If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. - If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. @@ -1993,6 +2059,7 @@ To validate this policy, do the following steps: + - If you enable this policy setting, you can configure Start menu to show or hide the list of user's most used apps, regardless of user settings. Selecting "Show" will force the "Most used" list to be shown, and user cannot change to hide it using the Settings app. @@ -2064,6 +2131,7 @@ Selecting "Not Configured", or if you disable or do not configure this policy se + - If you enable this policy, Quick Settings will be reduced to only having the WiFi, Bluetooth, Accessibility, and VPN buttons; the brightness and volume sliders; and battery indicator and link to the Settings app. - If you disable or don't configure this policy setting, the regular Quick Settings layout will appear whenever Quick Settings is invoked. @@ -2140,7 +2208,7 @@ To use this setting, you must first manually configure a device's Start layout t Once the XML file is generated and moved to the desired file path, type the fully qualified path and name of the XML file. You can type a local path, such as C:\StartLayouts\myLayout.xml or a UNC path, such as \\Server\Share\Layout.xml. If the specified file is not available when the user logs on, the layout won't be changed. Users cannot customize their Start screen while this setting is enabled. -- If you disable this setting or do not configure it, the Start screen layout won't be changed and users will be able to customize it. +If you disable this setting or do not configure it, the Start screen layout won't be changed and users will be able to customize it. diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md index b466e095ca..c977508f6e 100644 --- a/windows/client-management/mdm/policy-csp-stickers.md +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -4,7 +4,7 @@ description: Learn more about the Stickers Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | @@ -37,7 +37,7 @@ ms.topic: reference -This policy setting allows you to control whether you want to allow stickers to be edited and placed on Desktop +This policy setting allows you to control whether you want to allow stickers to be edited and placed on Desktop. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index fd1abf6088..3af6abb66f 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -4,7 +4,7 @@ description: Learn more about the System Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,6 +21,9 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -112,14 +115,14 @@ This policy is only supported up to Windows 10, Version 1703. Please use 'Manage -AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +AllowCommercialDataPipeline configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting 2. Join an Azure Active Directory account to the device Windows diagnostic data is collected when the Allow Telemetry policy setting is set to value 1 - Required or above. Configuring this setting does not change the Windows diagnostic data collection level set for the device -- If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing". +If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft's privacy statement at unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing". See the documentation at for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. @@ -187,7 +190,7 @@ See the documentation at for i -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting @@ -197,8 +200,7 @@ To enable this behavior: 4. Set the Configure the Commercial ID setting for your Desktop Analytics workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. -- If you disable this policy setting, devices will not appear in Desktop Analytics. +This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. If you disable this policy setting, devices will not appear in Desktop Analytics. @@ -264,7 +266,7 @@ This setting has no effect on devices unless they are properly enrolled in Deskt This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data. -- If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. +If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. @@ -375,6 +377,7 @@ Specifies whether set general purpose device to be in embedded mode. Most restri + > [!NOTE] > This policy is not supported in Windows 10, version 1607. This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior. Most restricted value is 0. @@ -566,11 +569,10 @@ Specifies whether to allow app access to the Location service. Most restricted v This policy is deprecated and will only work on Windows 10 version 1809. Setting this policy will have no effect for other supported versions of Windows. -This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. For customers who enroll into the Microsoft Managed Desktop service, enabling this policy is required to allow Microsoft to process data for operational and analytic needs. See for more information. hen these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. -- If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. +This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. @@ -680,7 +682,7 @@ By configuring this policy setting you can adjust what diagnostic data is collec - Send required diagnostic data. This is the minimum diagnostic data necessary to keep Windows secure, up to date, and performing as expected. Using this value disables the "Optional diagnostic data" control in the Settings app. - Send optional diagnostic data. Additional diagnostic data is collected that helps us to detect, diagnose and fix issues, as well as make product improvements. Required diagnostic data will always be included when you choose to send optional diagnostic data. Optional diagnostic data can also include diagnostic log files and crash dumps. Use the "Limit Dump Collection" and the "Limit Diagnostic Log Collection" policies for more granular control of what optional diagnostic data is sent. -- If you disable or do not configure this policy setting, the device will send required diagnostic data and the end user can choose whether to send optional diagnostic data from the Settings app. +If you disable or do not configure this policy setting, the device will send required diagnostic data and the end user can choose whether to send optional diagnostic data from the Settings app. **Note**: The "Configure diagnostic data opt-in settings user interface" group policy can be used to prevent end users from changing their data collection settings. @@ -703,7 +705,12 @@ The "Configure diagnostic data opt-in settings user interface" group policy can **Allowed values**: -
+| Value | Description | +|:--|:--| +| 0 | Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. | +| 1 (Default) | Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level. | +| 3 | Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels. | + **Group policy mapping**: @@ -741,7 +748,7 @@ The "Configure diagnostic data opt-in settings user interface" group policy can -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting @@ -751,7 +758,7 @@ To enable this behavior: 4. Set the Configure the Commercial ID setting for your Update Compliance workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -- If you disable or do not configure this policy setting, devices will not appear in Update Compliance. +If you disable or do not configure this policy setting, devices will not appear in Update Compliance. @@ -864,7 +871,7 @@ Specifies whether to allow the user to factory reset the device by using control -This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at . +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms at< https://go.microsoft.com/fwlink/?linkid=2185086>. To enable this behavior: 1. Enable this policy setting @@ -873,7 +880,7 @@ To enable this behavior: 3. Set Allow Telemetry to value 1 - Required, or higher When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. -- If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features. +If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features. @@ -938,10 +945,10 @@ When these policies are configured, Windows diagnostic data collected from the d This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver: -- Good: The driver has been signed and has not been tampered with. -- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized. -- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. -- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver. + - Good: The driver has been signed and has not been tampered with. + - Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized. + - Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. + - Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver. - If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started. @@ -1029,7 +1036,7 @@ The value for this setting will be provided by Microsoft as part of the onboardi |:--|:--| | Name | ConfigureMicrosoft365UploadEndpoint | | Friendly Name | Configure diagnostic data upload endpoint for Desktop Analytics | -| Element Name | Desktop Analytics Custom Upload Endpoint | +| Element Name | Desktop Analytics Custom Upload Endpoint. | | Location | Computer Configuration | | Path | WindowsComponents > Data Collection and Preview Builds | | Registry Key Name | Software\Policies\Microsoft\Windows\DataCollection | @@ -1129,7 +1136,7 @@ This policy setting determines whether an end user can change diagnostic data se If you set this policy setting to "Disable diagnostic data opt-in settings", diagnostic data settings are disabled in the Settings app. -- If you don't configure this policy setting, or you set it to "Enable diagnostic data opt-in settings", end users can change the device diagnostic settings in the Settings app. +If you don't configure this policy setting, or you set it to "Enable diagnostic data opt-in settings", end users can change the device diagnostic settings in the Settings app. **Note**: To set a limit on the amount of diagnostic data that is sent to Microsoft by your organization, use the "Allow Diagnostic Data" policy setting. @@ -1384,8 +1391,7 @@ This group policy allows control over whether the DirectX Database Updater task -This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. -- If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. +This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. @@ -1448,6 +1454,7 @@ This policy setting blocks the Connected User Experience and Telemetry service f This policy setting lets you prevent apps and features from working with files on OneDrive. + - If you enable this policy setting: * Users can't access OneDrive from the OneDrive app and file picker. @@ -1837,7 +1844,7 @@ This policy setting controls whether additional diagnostic logs are collected wh By enabling this policy setting, diagnostic logs will not be collected. -- If you disable or do not configure this policy setting, we may occasionally collect diagnostic logs if the device has been configured to send optional diagnostic data. +If you disable or do not configure this policy setting, we may occasionally collect diagnostic logs if the device has been configured to send optional diagnostic data. @@ -1903,7 +1910,7 @@ This policy setting limits the type of dumps that can be collected when more inf By enabling this setting, Windows Error Reporting is limited to sending kernel mini dumps and user mode triage dumps. -- If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data. +If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data. @@ -1975,9 +1982,9 @@ To enable the behavior described above, complete the following steps: 3. Enable the "Limit Dump Collection" policy 4. Enable the "Limit Diagnostic Log Collection" policy -When these policies are configured, Microsoft will collect only required diagnostic data and the events required by Desktop Analytics, which can be viewed at . +When these policies are configured, Microsoft will collect only required diagnostic data and the events required by Desktop Analytics, which can be viewed at< https://go.microsoft.com/fwlink/?linkid=2116020>. -- If you disable or do not configure this policy setting, diagnostic data collection is determined by the "Allow Diagnostic Data" policy setting or by the end user from the Settings app. +If you disable or do not configure this policy setting, diagnostic data collection is determined by the "Allow Diagnostic Data" policy setting or by the end user from the Settings app. @@ -2038,9 +2045,12 @@ When these policies are configured, Microsoft will collect only required diagnos - -Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is ``:``. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device. -- If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration. + +With this policy setting, you can forward Connected User Experience and Telemetry requests to a proxy server. + +- If you enable this policy setting, you can specify the FQDN or IP address of the destination device within your organization's network (and optionally a port number, if desired). The connection will be made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if you disable or do not configure this policy setting, Connected User Experience and Telemetry data will be sent to Microsoft using the default proxy configuration. + +The format for this setting is ``:`` @@ -2063,7 +2073,7 @@ Allows you to specify the fully qualified domain name (FQDN) or IP address of a |:--|:--| | Name | TelemetryProxy | | Friendly Name | Configure Connected User Experiences and Telemetry | -| Element Name | Proxy Server Name | +| Element Name | Proxy Server Name. | | Location | Computer Configuration | | Path | WindowsComponents > Data Collection and Preview Builds | | Registry Key Name | Software\Policies\Microsoft\Windows\DataCollection | diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 6c58c87151..398334874d 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -4,7 +4,7 @@ description: Learn more about the TaskManager Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled +This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 656d59762c..4d0a66c573 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -4,7 +4,7 @@ description: Learn more about the TextInput Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -86,8 +86,7 @@ Placeholder only. Do not use in production environment. -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. Most restricted value is 0. +Allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. Most restricted value is 0. @@ -185,8 +184,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the IT admin to disable the touch/handwriting keyboard on Windows. Most restricted value is 0. +Allows the IT admin to disable the touch/handwriting keyboard on Windows. Most restricted value is 0. @@ -235,8 +233,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the Japanese IME surrogate pair characters. Most restricted value is 0. +Allows the Japanese IME surrogate pair characters. Most restricted value is 0. @@ -285,8 +282,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows Japanese Ideographic Variation Sequence (IVS) characters. Most restricted value is 0. +Allows Japanese Ideographic Variation Sequence (IVS) characters. Most restricted value is 0. @@ -335,8 +331,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the Japanese non-publishing standard glyph. Most restricted value is 0. +Allows the Japanese non-publishing standard glyph. Most restricted value is 0. @@ -385,8 +380,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the Japanese user dictionary. Most restricted value is 0. +Allows the Japanese user dictionary. Most restricted value is 0. @@ -435,8 +429,7 @@ Allows the user to turn on Open Extended Dictionary, Internet search integration -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled. Most restricted value is 0. +Specifies whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. When this policy is set to disabled, text prediction is disabled. Most restricted value is 0. @@ -1005,8 +998,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter. +Allows the users to restrict character code range of conversion by setting the character filter. @@ -1055,8 +1047,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter. +Allows the users to restrict character code range of conversion by setting the character filter. @@ -1105,8 +1096,7 @@ This policy allows the IT admin to enable the touch keyboard to automatically sh -> [!NOTE] -> The policy is only enforced in Windows 10 for desktop. Allows the users to restrict character code range of conversion by setting the character filter. +Allows the users to restrict character code range of conversion by setting the character filter. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 6aac2cbd12..28b396eb2f 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -4,7 +4,7 @@ description: Learn more about the Update Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/03/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,7 +26,6 @@ ms.topic: reference Update CSP policies are listed below based on the group policy area: - [Windows Insider Preview](#windows-insider-preview) - - [AllowTemporaryEnterpriseFeatureControl](#allowtemporaryenterprisefeaturecontrol) - [ConfigureDeadlineNoAutoRebootForFeatureUpdates](#configuredeadlinenoautorebootforfeatureupdates) - [ConfigureDeadlineNoAutoRebootForQualityUpdates](#configuredeadlinenoautorebootforqualityupdates) - [Manage updates offered from Windows Update](#manage-updates-offered-from-windows-update) @@ -63,6 +62,7 @@ Update CSP policies are listed below based on the group policy area: - [AllowAutoUpdate](#allowautoupdate) - [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](#allowautowindowsupdatedownloadovermeterednetwork) - [AllowMUUpdateService](#allowmuupdateservice) + - [AllowTemporaryEnterpriseFeatureControl](#allowtemporaryenterprisefeaturecontrol) - [ConfigureDeadlineForFeatureUpdates](#configuredeadlineforfeatureupdates) - [ConfigureDeadlineForQualityUpdates](#configuredeadlineforqualityupdates) - [ConfigureDeadlineGracePeriod](#configuredeadlinegraceperiod) @@ -107,75 +107,6 @@ Update CSP policies are listed below based on the group policy area: ## Windows Insider Preview - -### AllowTemporaryEnterpriseFeatureControl - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl -``` - - - - -Features introduced via servicing (outside of the annual feature update) are off by default for devices that have their Windows updates managed*. - -- If this policy is configured to "Enabled", then all features available in the latest monthly quality update installed will be on. - -- If this policy is set to "Not Configured" or "Disabled" then features that are shipped via a monthly quality update (servicing) will remain off until the feature update that includes these features is installed. - -*Windows update managed devices are those that have their Windows updates managed via policy; whether via the cloud using Windows Update for Business or on-premises with Windows Server Update Services (WSUS). - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | int | -| Access Type | Add, Delete, Get, Replace | -| Default Value | 0 | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 (Default) | Not allowed. | -| 1 | Allowed. | - - - -**Group policy mapping**: - -| Name | Value | -|:--|:--| -| Name | AllowTemporaryEnterpriseFeatureControl | -| Friendly Name | Enable features introduced via servicing that are off by default | -| Location | Computer Configuration | -| Path | Windows Components > Windows Update > Manage end user experience | -| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | -| Registry Value Name | AllowTemporaryEnterpriseFeatureControl | -| ADMX File Name | WindowsUpdate.admx | - - - - - - - - ### ConfigureDeadlineNoAutoRebootForFeatureUpdates @@ -430,8 +361,12 @@ The maintenance wakeup policy specifies if Automatic Maintenance should make a w - -Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of Semi-Annual Channel (Targeted) and Semi-Annual Channel have been combined into one Semi-Annual Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 is not a supported value. + +Enable this policy to specify when to receive Feature Updates. + +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -496,11 +431,12 @@ Allows the IT admin to set which branch a device receives their updates from. As - -Defers Feature Updates for the specified number of days. Supported values are 0-365 days. + +Enable this policy to specify when to receive Feature Updates. -> [!IMPORTANT] -> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -554,8 +490,16 @@ Defers Feature Updates for the specified number of days. Supported values are 0- - -Defers Quality Updates for the specified number of days. Supported values are 0-30. + +Enable this policy to specify when to receive quality updates. + +You can defer receiving quality updates for up to 30 days. + +To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. + +To resume receiving Quality Updates which are paused, clear the start date field. + +If you disable or do not configure this policy, Windows Update will not alter its behavior. @@ -580,7 +524,7 @@ Defers Quality Updates for the specified number of days. Supported values are 0- |:--|:--| | Name | DeferQualityUpdates | | Friendly Name | Select when Quality Updates are received | -| Element Name | After a quality update is released, defer receiving it for this many days | +| Element Name | After a quality update is released, defer receiving it for this many days. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -671,7 +615,7 @@ IT admins can, if necessary, opt devices out of safeguard protections using this Enable this policy to not include drivers with Windows quality updates. -- If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. +If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. @@ -733,8 +677,25 @@ Enable this policy to not include drivers with Windows quality updates. - -Used to manage Windows 10 Insider Preview builds. Value type is integer. + +Enable this policy to manage which updates you receive prior to the update being released to the world. + +Dev Channel +Ideal for highly technical users. Insiders in the Dev Channel will receive builds from our active development branch that is earliest in a development cycle. These builds are not matched to a specific Windows 10 release. + +Beta Channel +Ideal for feature explorers who want to see upcoming Windows 10 features. Your feedback will be especially important here as it will help our engineers ensure key issues are fixed before a major release. + +Release Preview Channel (default) +Insiders in the Release Preview Channel will have access to the upcoming release of Windows 10 prior to it being released to the world. These builds are supported by Microsoft. The Release Preview Channel is where we recommend companies preview and validate upcoming Windows 10 releases before broad deployment within their organization. + +Release Preview Channel, Quality Updates Only +Ideal for those who want to validate the features and fixes coming soon to their current version. Note, released feature updates will continue to be offered in accordance with configured policies when this option is selected. + +> [!NOTE] +> Preview Build enrollment requires a telemetry level setting of 2 or higher and your domain registered on insider.windows.com. For additional information on Preview Builds, see: + +If you disable or do not configure this policy, Windows Update will not offer you any pre-release updates and you will receive such content once released to the world. Disabling this policy will cause any devices currently on a pre-release build to opt out and stay on the latest Feature Update once released. @@ -797,8 +758,12 @@ Used to manage Windows 10 Insider Preview builds. Value type is integer. - -Allows IT Admins to pause Feature Updates for up to 60 days. + +Enable this policy to specify when to receive Feature Updates. + +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -861,8 +826,12 @@ Allows IT Admins to pause Feature Updates for up to 60 days. - -Specifies the date and time when the IT admin wants to start pausing the Feature Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28). + +Enable this policy to specify when to receive Feature Updates. + +Defer Updates | This enables devices to defer taking the next Feature Update available for their current product (or a new product if specified in the Select the target Feature Update version policy). You can defer a Feature Update for up to 14 days for all pre-release channels and up to 365 days for the General Availability Channel. To learn more about the current releases, please see aka.ms/WindowsTargetVersioninfo + +Pause Updates | To prevent Feature Updates from being offered to the device, you can temporarily pause Feature Updates. This pause will remain in effect for 35 days from the specified start date or until the field is cleared. Note, Quality Updates will still be offered even if Feature Updates are paused. @@ -885,7 +854,7 @@ Specifies the date and time when the IT admin wants to start pausing the Feature |:--|:--| | Name | DeferFeatureUpdates | | Friendly Name | Select when Preview Builds and Feature Updates are received | -| Element Name | Pause Preview Builds or Feature Updates starting | +| Element Name | Pause Preview Builds or Feature Updates starting. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -914,8 +883,16 @@ Specifies the date and time when the IT admin wants to start pausing the Feature - -Allows IT Admins to pause Quality Updates. + +Enable this policy to specify when to receive quality updates. + +You can defer receiving quality updates for up to 30 days. + +To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. + +To resume receiving Quality Updates which are paused, clear the start date field. + +If you disable or do not configure this policy, Windows Update will not alter its behavior. @@ -978,8 +955,16 @@ Allows IT Admins to pause Quality Updates. - -Specifies the date and time when the IT admin wants to start pausing the Quality Updates. Value type is string (yyyy-mm-dd, ex. 2018-10-28). + +Enable this policy to specify when to receive quality updates. + +You can defer receiving quality updates for up to 30 days. + +To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. + +To resume receiving Quality Updates which are paused, clear the start date field. + +If you disable or do not configure this policy, Windows Update will not alter its behavior. @@ -1004,7 +989,7 @@ Specifies the date and time when the IT admin wants to start pausing the Quality |:--|:--| | Name | DeferQualityUpdates | | Friendly Name | Select when Quality Updates are received | -| Element Name | Pause Quality Updates starting | +| Element Name | Pause Quality Updates starting. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1033,8 +1018,16 @@ Specifies the date and time when the IT admin wants to start pausing the Quality - -Enables IT administrators to specify the product version associated with the target feature update they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows release information](/windows/release-health/release-information). + +Enter the product and version as listed on the Windows Update target version page: + +aka.ms/WindowsTargetVersioninfo + +The device will request that Windows Update product and version in subsequent scans. + +Entering a target product and clicking OK or Apply means I accept the Microsoft Software License Terms for it found at aka.ms/WindowsTargetVersioninfo. If an organization is licensing the software, I am authorized to bind the organization. + +If you enter an invalid value, you will remain on your current version until you correct the values to a supported product and version. @@ -1064,7 +1057,7 @@ Supported value type is a string containing a Windows product. For example, "Win |:--|:--| | Name | TargetReleaseVersion | | Friendly Name | Select the target Feature Update version | -| Element Name | Which Windows product version would you like to receive feature updates for? e.g., Windows 10 | +| Element Name | Which Windows product version would you like to receive feature updates for? e.g., Windows 10. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1093,8 +1086,16 @@ Supported value type is a string containing a Windows product. For example, "Win - -Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](/windows/release-health/release-information). + +Enter the product and version as listed on the Windows Update target version page: + +aka.ms/WindowsTargetVersioninfo + +The device will request that Windows Update product and version in subsequent scans. + +Entering a target product and clicking OK or Apply means I accept the Microsoft Software License Terms for it found at aka.ms/WindowsTargetVersioninfo. If an organization is licensing the software, I am authorized to bind the organization. + +If you enter an invalid value, you will remain on your current version until you correct the values to a supported product and version. @@ -1118,7 +1119,7 @@ Supported value type is a string containing Windows version number. For example, |:--|:--| | Name | TargetReleaseVersion | | Friendly Name | Select the target Feature Update version | -| Element Name | Target Version for Feature Updates | +| Element Name | Target Version for Feature Updates. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Update | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1214,8 +1215,21 @@ Specifies whether the device could use Microsoft Update, Windows Server Update S - -Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours. + +Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is a sum of the specific value and a random variant of 0-4 hours. + +If the status is set to Enabled, Windows will check for available updates at the specified interval. + +If the status is set to Disabled or Not Configured, Windows will check for available updates at the default interval of 22 hours. + +> [!NOTE] +> The "Specify intranet Microsoft update service location" setting must be enabled for this policy to have effect. + +> [!NOTE] +> If the "Configure Automatic Updates" policy is disabled, this policy has no effect. + +> [!NOTE] +> This policy is not supported on %WINDOWS_ARM_VERSION_6_2%. Setting this policy will not have any effect on %WINDOWS_ARM_VERSION_6_2% PCs. @@ -1273,8 +1287,7 @@ This policy should be enabled only when [UpdateServiceUrl](#updateserviceurl) is - -Do not enforce TLS certificate pinning for Windows Update client for detecting updates. + @@ -1680,8 +1693,7 @@ Configure this policy to specify whether to receive **Windows Quality Updates** - -Select the proxy behavior for Windows Update client for detecting updates + @@ -1720,7 +1732,7 @@ This policy setting doesn't impact those customers who have, per Microsoft recom |:--|:--| | Name | CorpWuURL | | Friendly Name | Specify intranet Microsoft update service location | -| Element Name | Select the proxy behavior for Windows Update client for detecting updates | +| Element Name | Select the proxy behavior for Windows Update client for detecting updates. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1778,7 +1790,7 @@ The following list shows the supported values: |:--|:--| | Name | CorpWuURL | | Friendly Name | Specify intranet Microsoft update service location | -| Element Name | Set the intranet update service for detecting updates | +| Element Name | Set the intranet update service for detecting updates. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1825,7 +1837,7 @@ The following list shows the supported values: -Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. Value type is string and the default value is an empty string, . If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. +Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. Value type is string and the default value is an empty string, . If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. > [!NOTE] > If the Configure Automatic Updates Group Policy is disabled, then this policy has no effect. If the Alternate Download Server Group Policy is not set, it will use the WSUS server by default to download updates. This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. @@ -1851,7 +1863,7 @@ Specifies an alternate intranet server to host updates from Microsoft Update. Yo |:--|:--| | Name | CorpWuURL | | Friendly Name | Specify intranet Microsoft update service location | -| Element Name | Set the alternate download server | +| Element Name | Set the alternate download server. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage updates offered from Windows Server Update Service | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1882,11 +1894,20 @@ Specifies an alternate intranet server to host updates from Microsoft Update. Yo - -Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. + -> [!NOTE] -> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange below for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default is 17 (5 PM). +- If you enable this policy, the PC will not automatically restart after updates during active hours. The PC will attempt to restart outside of active hours. + +**Note** that the PC must restart for certain updates to take effect. + +- If you disable or do not configure this policy and have no other reboot group policies, the user selected active hours will be in effect. + +If any of the following two policies are enabled, this policy has no effect: + +1. No auto-restart with logged on users for scheduled automatic updates installations. +2. Always automatically restart at scheduled time. + +**Note** that the default max active hours range is 18 hours from the active hours start time unless otherwise configured via the Specify active hours range for auto-restarts policy. @@ -1911,7 +1932,7 @@ Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range o |:--|:--| | Name | ActiveHours | | Friendly Name | Turn off auto-restart for updates during active hours | -| Element Name | End | +| Element Name | End. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1945,7 +1966,7 @@ Enable this policy to specify the maximum number of hours from the start time th The max active hours range can be set between 8 and 18 hours. -- If you disable or do not configure this policy, the default max active hours range will be used. +If you disable or do not configure this policy, the default max active hours range will be used. @@ -1970,7 +1991,7 @@ The max active hours range can be set between 8 and 18 hours. |:--|:--| | Name | ActiveHoursMaxRange | | Friendly Name | Specify active hours range for auto-restarts | -| Element Name | Max range | +| Element Name | Max range. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -1999,11 +2020,20 @@ The max active hours range can be set between 8 and 18 hours. - -Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. + -> [!NOTE] -> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See Update/ActiveHoursMaxRange above for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. The default value is 8 (8 AM). +- If you enable this policy, the PC will not automatically restart after updates during active hours. The PC will attempt to restart outside of active hours. + +**Note** that the PC must restart for certain updates to take effect. + +- If you disable or do not configure this policy and have no other reboot group policies, the user selected active hours will be in effect. + +If any of the following two policies are enabled, this policy has no effect: + +1. No auto-restart with logged on users for scheduled automatic updates installations. +2. Always automatically restart at scheduled time. + +**Note** that the default max active hours range is 18 hours from the active hours start time unless otherwise configured via the Specify active hours range for auto-restarts policy. @@ -2028,7 +2058,7 @@ Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of |:--|:--| | Name | ActiveHours | | Friendly Name | Turn off auto-restart for updates during active hours | -| Element Name | Start | +| Element Name | Start. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -2057,8 +2087,41 @@ Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of - -Enables the IT admin to manage automatic update behavior to scan, download, and install updates. Important. This option should be used only for systems under regulatory compliance, as you will not get security updates as well. If the policy is not configured, end-users get the default behavior (Auto install and restart). + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2095,7 +2158,7 @@ Enables the IT admin to manage automatic update behavior to scan, download, and |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Configure automatic updating | +| Element Name | Configure automatic updating. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2190,8 +2253,41 @@ This policy is accessible through the Update setting in the user interface or Gr - -Allows the IT admin to manage whether to scan for app updates from Microsoft Update. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2231,7 +2327,7 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Install updates for other Microsoft products | +| Element Name | Install updates for other Microsoft products. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2244,6 +2340,77 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd + +### AllowTemporaryEnterpriseFeatureControl + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621.1344] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Update/AllowTemporaryEnterpriseFeatureControl +``` + + + + +Features introduced via servicing (outside of the annual feature update) are off by default for devices that have their Windows updates managed*. + +- If this policy is configured to "Enabled", then all features available in the latest monthly quality update installed will be on. + +- If this policy is set to "Not Configured" or "Disabled" then features that are shipped via a monthly quality update (servicing) will remain off until the feature update that includes these features is installed. + +*Windows update managed devices are those that have their Windows updates managed via policy; whether via the cloud using Windows Update for Business or on-premises with Windows Server Update Services (WSUS). + + + + +> [!NOTE] +> In Intune, this setting is known as **Allow Temporary Enterprise Feature Control** and is available in the Settings Catalog. By default, all features introduced via servicing that are behind the commercial control are off for Windows-Update-managed devices. When set to Allowed, these features are enabled and turned on. For more information, see [Blog: Commercial control for continuous innovation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/commercial-control-for-continuous-innovation/ba-p/3737575). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed. | +| 1 | Allowed. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowTemporaryEnterpriseFeatureControl | +| Friendly Name | Enable features introduced via servicing that are off by default | +| Location | Computer Configuration | +| Path | Windows Components > Windows Update > Manage end user experience | +| Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | +| Registry Value Name | AllowTemporaryEnterpriseFeatureControl | +| ADMX File Name | WindowsUpdate.admx | + + + + + + + + ### ConfigureDeadlineForFeatureUpdates @@ -2518,7 +2685,7 @@ When enabled, devices will not automatically restart outside of active hours unt |:--|:--| | Name | ComplianceDeadline | | Friendly Name | Specify deadlines for automatic updates and restarts | -| Element Name | Don't auto-restart until end of grace period | +| Element Name | Don't auto-restart until end of grace period. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -2548,7 +2715,7 @@ When enabled, devices will not automatically restart outside of active hours unt -Enable enterprises/IT admin to configure feature update uninstall period +Enable enterprises/IT admin to configure feature update uninstall period. @@ -2632,7 +2799,7 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2 |:--|:--| | Name | UpdateNotificationLevel | | Friendly Name | Display options for update notifications | -| Element Name | Apply only during active hours | +| Element Name | Apply only during active hours. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -2661,8 +2828,41 @@ If you select "Apply only during active hours" in conjunction with Option 1 or 2 - -Enables the IT admin to schedule the day of the update installation. The data type is an integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2703,7 +2903,7 @@ Enables the IT admin to schedule the day of the update installation. The data ty |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Scheduled install day | +| Element Name | Scheduled install day. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2732,8 +2932,41 @@ Enables the IT admin to schedule the day of the update installation. The data ty - -Enables the IT admin to schedule the update installation every week. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2768,7 +3001,7 @@ Enables the IT admin to schedule the update installation every week. Value type |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Every week | +| Element Name | Every week. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2797,8 +3030,41 @@ Enables the IT admin to schedule the update installation every week. Value type - -Enables the IT admin to schedule the update installation on the first week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2833,7 +3099,7 @@ Enables the IT admin to schedule the update installation on the first week of th |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | First week of the month | +| Element Name | First week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2862,8 +3128,41 @@ Enables the IT admin to schedule the update installation on the first week of th - -Enables the IT admin to schedule the update installation on the fourth week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2898,7 +3197,7 @@ Enables the IT admin to schedule the update installation on the fourth week of t |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Fourth week of the month | +| Element Name | Fourth week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2927,8 +3226,41 @@ Enables the IT admin to schedule the update installation on the fourth week of t - -Enables the IT admin to schedule the update installation on the second week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -2963,7 +3295,7 @@ Enables the IT admin to schedule the update installation on the second week of t |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Second week of the month | +| Element Name | Second week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -2992,8 +3324,41 @@ Enables the IT admin to schedule the update installation on the second week of t - -Enables the IT admin to schedule the update installation on the third week of the month. Value type is integer. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -3028,7 +3393,7 @@ Enables the IT admin to schedule the update installation on the third week of th |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Third week of the month | +| Element Name | Third week of the month. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -3057,8 +3422,41 @@ Enables the IT admin to schedule the update installation on the third week of th - - the IT admin to schedule the time of the update installation. The data type is an integer. Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. The default value is 3. + +Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. + +> [!NOTE] +> This policy does not apply to %WINDOWS_ARM_VERSION_6_2%. + +This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: + +2 = Notify before downloading and installing any updates. + +When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. + +3 = (Default setting) Download the updates automatically and notify when they are ready to be installed + +Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. + +4 = Automatically download updates and install them on the schedule specified below. + +When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) + +Specify the schedule using the options in the Group Policy Setting. For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) + +On %WINDOWS_CLIENT_VERSION_6_2% and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. + +5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates. (This option has not been carried over to any Win 10 Versions) + +With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +7 = Notify for install and notify for restart. (Windows Server only) + +With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually. + +If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. + +If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. @@ -3087,7 +3485,7 @@ Enables the IT admin to schedule the update installation on the third week of th |:--|:--| | Name | AutoUpdateCfg | | Friendly Name | Configure Automatic Updates | -| Element Name | Scheduled install time | +| Element Name | Scheduled install time. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Manage end user experience | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate\AU | @@ -3117,7 +3515,7 @@ Enables the IT admin to schedule the update installation on the third week of th -This setting allows removing access to "Pause updates" feature. +This setting allows to remove access to "Pause updates" feature. Once enabled user access to pause updates is removed. @@ -3184,7 +3582,7 @@ Once enabled user access to pause updates is removed. This setting allows you to remove access to scan Windows Update. -- If you enable this setting user access to Windows Update scan, download and install is removed. +If you enable this setting user access to Windows Update scan, download and install is removed. @@ -3262,7 +3660,6 @@ The following rules are followed regarding battery power: This setting overrides the install deferral behaviour of [AllowAutoUpdate](#allowautoupdate). These settings are designed for education devices that remain in carts overnight that are left in sleep mode. It is not designed for 1:1 devices. - @@ -3399,7 +3796,7 @@ Specify the deadline before the PC will automatically restart to apply updates. The restart may happen inside active hours. -- If you disable or do not configure this policy, the PC will restart according to the default schedule. +If you disable or do not configure this policy, the PC will restart according to the default schedule. Enabling either of the following two policies will override the above policy: @@ -3463,7 +3860,7 @@ Specify the deadline before the PC will automatically restart to apply updates. The restart may happen inside active hours. -- If you disable or do not configure this policy, the PC will restart according to the default schedule. +If you disable or do not configure this policy, the PC will restart according to the default schedule. Enabling either of the following two policies will override the above policy: @@ -3522,8 +3919,12 @@ Enabling either of the following two policies will override the above policy: - -Allows the IT Admin to specify the period for auto-restart reminder notifications. The default value is 15 (minutes). + +Enable this policy to specify when auto-restart reminders are displayed. + +You can specify the amount of time prior to a scheduled restart to notify the user. + +If you disable or do not configure this policy, the default period will be used. @@ -3593,7 +3994,7 @@ Enable this policy to specify the method by which the auto-restart required noti The method can be set to require user action to dismiss the notification. -- If you disable or do not configure this policy, the default method will be used. +If you disable or do not configure this policy, the default method will be used. @@ -3626,7 +4027,7 @@ The method can be set to require user action to dismiss the notification. |:--|:--| | Name | AutoRestartRequiredNotificationDismissal | | Friendly Name | Configure auto-restart required notification for updates | -| Element Name | Method | +| Element Name | Method. | | Location | Computer Configuration | | Path | Windows Components > Windows Update > Legacy Policies | | Registry Key Name | Software\Policies\Microsoft\Windows\WindowsUpdate | @@ -3803,6 +4204,7 @@ Allows IT Admins to specify additional upgrade delays for up to 8 months. Suppor Enable this policy to not allow update deferral policies to cause scans against Windows Update. If this policy is disabled or not configured, then the Windows Update client may initiate automatic scans against Windows Update while update deferral policies are enabled. + > [!NOTE] > This policy applies only when the intranet Microsoft update service this computer is directed to is configured to support client-side targeting. If the "Specify intranet Microsoft update service location" policy is disabled or not configured, this policy has no effect. @@ -3877,14 +4279,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -3947,14 +4349,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4017,14 +4419,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4087,14 +4489,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4157,14 +4559,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4227,14 +4629,14 @@ You can specify the deadline in days before automatically scheduling and executi If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. -- If you disable or do not configure this policy, the PC will restart following the default schedule. +If you disable or do not configure this policy, the PC will restart following the default schedule. Enabling any of the following policies will override the above policy: 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time -3. Specify deadline before auto-restart for update installation +3. Specify deadline before auto-restart for update installation. @@ -4409,6 +4811,7 @@ To validate this policy: + > [!NOTE] > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. If the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. @@ -4510,6 +4913,7 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead. + > [!NOTE] > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to Semi-Annual Channel train. @@ -4570,6 +4974,7 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead. + > [!NOTE] > If you previously used the Update/PhoneUpdateRestrictions policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. @@ -4619,8 +5024,14 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead. - -Allows the IT Admin to specify the period for auto-restart imminent warning notifications. The default value is 15 (minutes). + +Enable this policy to control when notifications are displayed to warn users about a scheduled restart for the update installation deadline. Users are not able to postpone the scheduled restart once the deadline has been reached and the restart is automatically executed. + +Specifies the amount of time prior to a scheduled restart to display the warning reminder to the user. + +You can specify the amount of time prior to a scheduled restart to notify the user that the auto restart is imminent to allow them time to save their work. + +If you disable or do not configure this policy, the default notification behaviors will be used. @@ -4690,7 +5101,7 @@ Specifies the amount of time prior to a scheduled restart to display the warning You can specify the amount of time prior to a scheduled restart to notify the user that the auto restart is imminent to allow them time to save their work. -- If you disable or do not configure this policy, the default notification behaviors will be used. +If you disable or do not configure this policy, the default notification behaviors will be used. @@ -4755,8 +5166,12 @@ You can specify the amount of time prior to a scheduled restart to notify the us - -Allows the IT Admin to disable auto-restart notifications for update installations. + +This policy setting allows you to control whether users receive notifications for auto restarts for update installations including reminder and warning notifications. + +Enable this policy to turn off all auto restart notifications. + +If you disable or do not configure this policy, the default notification behaviors will be unchanged. diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 3e96dc09de..113eac5d6c 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -4,7 +4,7 @@ description: Learn more about the UserRights Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - UserRights +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as Security Identifiers (SID) or strings. For more information, see [Well-known SID structures](/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab). @@ -170,7 +173,7 @@ This user right is used by Credential Manager during Backup/Restore. No accounts -This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right +This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right. > [!NOTE] > Remote Desktop Services was called Terminal Services in previous versions of Windows Server. @@ -222,7 +225,7 @@ This user right determines which users and groups are allowed to connect to the -This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned +This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. > [!CAUTION] > Assigning this user right can be a security risk. Only assign this user right to trusted users. @@ -274,10 +277,10 @@ This user right allows a process to impersonate any user without authentication. -This user right determines which users can log on to the computer +This user right determines which users can log on to the computer. > [!NOTE] -> Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally ( ) at the Microsoft website. +> Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. @@ -326,10 +329,10 @@ This user right determines which users can log on to the computer -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the systemTraverse Folder/Execute File, Read +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. > [!CAUTION] -> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users +> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users. @@ -534,7 +537,7 @@ This user right determines which users and groups can change the time zone used -This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption +This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. > [!CAUTION] > Assigning this user right can be a security risk. Assign this user right only to trusted users. @@ -586,7 +589,7 @@ This security setting determines whether users can create global objects that ar -This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users +This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users. @@ -684,10 +687,10 @@ This user right determines which accounts can be used by processes to create a d -This user right determines if the user can create a symbolic link from the computer he is logged on to +This user right determines if the user can create a symbolic link from the computer he is logged on to. > [!CAUTION] -> This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them +> This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. > [!NOTE] > This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. @@ -739,7 +742,7 @@ This user right determines if the user can create a symbolic link from the compu -This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System +This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. > [!CAUTION] > Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. @@ -791,7 +794,7 @@ This user right determines which accounts can be used by processes to create a t -This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components +This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. > [!CAUTION] > Assigning this user right can be a security risk. Only assign this user right to trusted users. @@ -892,7 +895,7 @@ This user right determines which users are prevented from accessing a computer o -This security setting determines which service accounts are prevented from registering a process as a service +This security setting determines which service accounts are prevented from registering a process as a service. > [!NOTE] > This security setting does not apply to the System, Local Service, or Network Service accounts. @@ -1026,6 +1029,58 @@ This user right determines which users and groups are prohibited from logging on + +## DenyServiceLogonRight + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/DenyServiceLogonRight +``` + + + + +This security setting determines which service accounts are prevented from registering a process as a service. This policy setting supersedes the Log on as a service policy setting if an account is subject to both policies. + +> [!NOTE] +> This security setting does not apply to the System, Local Service, or Network Service accounts. Default: None. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Deny log on as a service | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + ## EnableDelegation @@ -1043,7 +1098,7 @@ This user right determines which users and groups are prohibited from logging on -This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set +This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. > [!CAUTION] > Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. @@ -1144,13 +1199,13 @@ This user right determines which accounts can be used by a process to add entrie -Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels +Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. > [!CAUTION] -> Assigning this user right can be a security risk. Only assign this user right to trusted users +> Assigning this user right can be a security risk. Only assign this user right to trusted users. > [!NOTE] -> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. Because of these factors, users do not usually need this user right +> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. Because of these factors, users do not usually need this user right. > [!WARNING] > If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. @@ -1202,7 +1257,7 @@ Assigning this user right to a user allows programs running on behalf of that us -Increase a process working set. This privilege determines which user accounts can increase or decrease the size of a process's working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process +Increase a process working set. This privilege determines which user accounts can increase or decrease the size of a process's working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process. > [!WARNING] > Increasing the working set size for a process decreases the amount of physical memory available to the rest of the system. @@ -1308,7 +1363,7 @@ This user right determines which accounts can use a process with Write Property -This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users +This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. > [!CAUTION] > Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. @@ -1605,7 +1660,7 @@ This user right determines which users and groups can run maintenance tasks on a -This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows +This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows. > [!NOTE] > This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. @@ -1902,7 +1957,7 @@ This security setting determines which user accounts can call the CreateProcessA -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the systemTraverse Folder/Execute File, Write +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. > [!CAUTION] > Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. @@ -2003,7 +2058,7 @@ This security setting determines which users who are logged on locally to the co -This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads +This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. > [!CAUTION] > Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. diff --git a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md index 055490b65d..c0ee21c83b 100644 --- a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md +++ b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md @@ -4,7 +4,7 @@ description: Learn more about the VirtualizationBasedTechnology Area in Policy C author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,7 +36,7 @@ ms.topic: reference - + Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock, 1 - Turns on Hypervisor-Protected Code Integrity with UEFI lock, 2 - Turns on Hypervisor-Protected Code Integrity without UEFI lock. @@ -71,7 +71,7 @@ Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Int |:--|:--| | Name | VirtualizationBasedSecurity | | Friendly Name | Turn On Virtualization Based Security | -| Element Name | Virtualization Based Protection of Code Integrity | +| Element Name | Virtualization Based Protection of Code Integrity. | | Location | Computer Configuration | | Path | System > Device Guard | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard | @@ -100,8 +100,8 @@ Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Int - -Require UEFI Memory Attributes Table + +Require UEFI Memory Attributes Table. @@ -134,7 +134,7 @@ Require UEFI Memory Attributes Table |:--|:--| | Name | VirtualizationBasedSecurity | | Friendly Name | Turn On Virtualization Based Security | -| Element Name | Require UEFI Memory Attributes Table | +| Element Name | Require UEFI Memory Attributes Table. | | Location | Computer Configuration | | Path | System > Device Guard | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\DeviceGuard | diff --git a/windows/client-management/mdm/policy-csp-webthreatdefense.md b/windows/client-management/mdm/policy-csp-webthreatdefense.md index 2862cf0565..3f32d7c225 100644 --- a/windows/client-management/mdm/policy-csp-webthreatdefense.md +++ b/windows/client-management/mdm/policy-csp-webthreatdefense.md @@ -4,7 +4,7 @@ description: Learn more about the WebThreatDefense Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,9 @@ ms.topic: reference # Policy CSP - WebThreatDefense +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + > [!NOTE] diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 62d4b45e2a..5eb3b2dd3e 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -4,7 +4,7 @@ description: Learn more about the Wifi Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -193,7 +193,7 @@ By default, ICS is disabled when you create a remote access connection, but admi -Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0 +Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0. > [!NOTE] > Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that are not user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted. @@ -343,7 +343,7 @@ Allow WiFi Direct connection. . -Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency. The default value is 0. Supported operations are Add, Delete, Get, and Replace. +Allow an enterprise to control the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. Supported values are 0-500, where 100 = normal scan frequency and 500 = low scan frequency. The default value is 0. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 020c169b11..bbe80dfd19 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsDefenderSecurityCenter Area in Policy C author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,9 +36,17 @@ ms.topic: reference - -The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options. Value type is string. Supported operations are Add, Get, Replace and Delete. + +Specify the company name that will be displayed in Windows Security and associated notifications. This setting must be enabled for any contact information to appear. + +Enabled: +Enter the company name in the Options section. + +Disabled: +Company information will not be shown at all in either Windows Security or any notifications that it creates. + +Not configured: +Same as Disabled. @@ -61,7 +69,7 @@ The company name that is displayed to the users. CompanyName is required for bot |:--|:--| | Name | EnterpriseCustomization_CompanyName | | Friendly Name | Specify contact company name | -| Element Name | Company name | +| Element Name | Company name. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | @@ -956,9 +964,19 @@ Same as Disabled. - -The email address that is displayed to users. The default mail application is used to initiate email actions. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options. Value type is string. Supported operations are Add, Get, Replace and Delete. + +Specify the email address or email ID that will be displayed in Windows Security and associated notifications. + +Users can click on the contact information to create an email that will be sent to the specified address. The default email application will be used. + +Enabled: +Enter the email address or email ID in the Options section. + +Disabled: +A contact email address or email ID will not be shown in either Windows Security or any notifications it creates. + +Not configured: +Same as Disabled. @@ -981,7 +999,7 @@ The email address that is displayed to users. The default mail application is us |:--|:--| | Name | EnterpriseCustomization_Email | | Friendly Name | Specify contact email address or Email ID | -| Element Name | Email address or email ID | +| Element Name | Email address or email ID. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | @@ -1455,9 +1473,19 @@ Same as Disabled. - -The phone number or Skype ID that is displayed to users. Skype is used to initiate the call. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options. Value type is string. Supported operations are Add, Get, Replace, and Delete. + +Specify the phone number or Skype ID that will be displayed in Windows Security and associated notifications. + +Users can click on the contact information to automatically call the supplied number. Skype will be used to initiate the call. + +Enabled: +Enter the phone number or Skype ID in the Options section. + +Disabled: +A contact phone number or Skype ID will not be shown in either Windows Security or any notifications it creates. + +Not configured: +Same as Disabled. @@ -1480,7 +1508,7 @@ The phone number or Skype ID that is displayed to users. Skype is used to initia |:--|:--| | Name | EnterpriseCustomization_Phone | | Friendly Name | Specify contact phone number or Skype ID | -| Element Name | Phone number or Skype ID | +| Element Name | Phone number or Skype ID. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | @@ -1509,9 +1537,19 @@ The phone number or Skype ID that is displayed to users. Skype is used to initia - -The help portal URL this is displayed to users. The default browser is used to initiate this action. -- If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options. Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete. + +Specify the URL that will be displayed in Windows Security and associated notifications. + +Users can click on the contact information to visit the specified website. The default web browser will be used. + +Enabled: +Enter the URL in the Options section. + +Disabled: +A contact website URL will not be shown in either Windows Security or any notifications it creates. + +Not configured: +Same as Disabled. @@ -1534,7 +1572,7 @@ The help portal URL this is displayed to users. The default browser is used to i |:--|:--| | Name | EnterpriseCustomization_URL | | Friendly Name | Specify contact website | -| Element Name | IT or support website | +| Element Name | IT or support website. | | Location | Computer Configuration | | Path | Windows Components > Windows Security > Enterprise Customization | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Enterprise Customization | diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index c2a2419ae6..3b22eda9a0 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsInkWorkspace Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -37,7 +37,7 @@ ms.topic: reference -Allow suggested apps in Windows Ink Workspace +Allow suggested apps in Windows Ink Workspace. @@ -99,8 +99,8 @@ Allow suggested apps in Windows Ink Workspace - -Specifies whether to allow the user to access the ink workspace. + +Allow Windows Ink Workspace. @@ -134,7 +134,7 @@ Specifies whether to allow the user to access the ink workspace. |:--|:--| | Name | AllowWindowsInkWorkspace | | Friendly Name | Allow Windows Ink Workspace | -| Element Name | Choose one of the following actions | +| Element Name | Choose one of the following actions. | | Location | Computer Configuration | | Path | Windows Components > Windows Ink Workspace | | Registry Key Name | Software\Policies\Microsoft\WindowsInkWorkspace | diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 51b6c8cc5e..3969e76da3 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsLogon Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -21,6 +21,9 @@ ms.topic: reference > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> [!IMPORTANT] +> This CSP contains preview policies that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These policies are subject to change and may have dependencies on other features or services in preview. + @@ -114,8 +117,8 @@ This policy setting controls the configuration under which an automatic restart 1. "Enabled if BitLocker is on and not suspended" specifies that automatic sign on and lock will only occur if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device's hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components. BitLocker is suspended during updates if: -- The device doesn't have TPM 2.0 and PCR7, or -- The device doesn't use a TPM-only protector + - The device doesn't have TPM 2.0 and PCR7, or + - The device doesn't use a TPM-only protector 2. "Always Enabled" specifies that automatic sign on will happen even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location. @@ -581,14 +584,7 @@ The locations that Switch User interface appear are in the Logon UI, the Start m -OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program. - -The policy currently supports below options: - -1. Not Configured: Default shell will be launched. -2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell. - -- If you disable or do not configure this policy setting, then the default shell will be launched. +OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program. The policy currently supports below options: 1. Not Configured: Default shell will be launched. 2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell. If you disable or do not configure this policy setting, then the default shell will be launched. diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 7547dce65b..982bf3c027 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsPowerShell Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 01/09/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -47,6 +47,7 @@ ms.topic: reference This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. + - If you enable this policy setting, Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or through automation. diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index c341176e4b..04eabb0246 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -4,7 +4,7 @@ description: Learn more about the Reboot CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -29,6 +29,7 @@ The following list shows the Reboot configuration service provider nodes: - [Schedule](#schedule) - [DailyRecurrent](#scheduledailyrecurrent) - [Single](#schedulesingle) + - [WeeklyRecurrent](#scheduleweeklyrecurrent) @@ -126,7 +127,7 @@ The supported operation is Get. -Value in ISO8601, time is required. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. +Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. @@ -187,6 +188,45 @@ Value in ISO8601, both the date and time are required. A reboot will be schedule + +### Schedule/WeeklyRecurrent + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Reboot/Schedule/WeeklyRecurrent +``` + + + + +Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index a1f1988804..98866efffa 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/17/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -47,7 +47,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; @@ -129,7 +129,7 @@ The following XML file contains the device description framework (DDF) for the R - Value in ISO8601, time is required. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled each day at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. @@ -147,6 +147,33 @@ The following XML file contains the device description framework (DDF) for the R + + WeeklyRecurrent + + + + + + + + Value in ISO8601, time is required. Either setting DailyRecurrent or WeeklyRecurrent is supported but not both at same time. A reboot will be scheduled every week at the configured time starting at the date and time. Setting a null (empty) date will delete the existing schedule. + + + + + + + + + + WeeklyRecurrent + + + + + + + diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 4375aed8a9..9da01ea478 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -4,7 +4,7 @@ description: Learn more about the RootCATrustedCertificates CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index d12b3ffc21..14712bc288 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/24/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index e77c419631..7594de5981 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -4,7 +4,7 @@ description: Learn more about the SUPL CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -336,7 +336,7 @@ Optional. Determines the full version (X. Y. Z where X, Y and Z are major versio -Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. +Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. @@ -540,7 +540,7 @@ Optional. Time in seconds that the network-initiated location request is display -Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. +Required. Specifies the root certificate for the H-SLP server. Windows does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. @@ -1568,7 +1568,7 @@ Optional. The address of the Position Determination Entity (PDE), in the format -Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. +Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 07296eebc3..af93e84137 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/23/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -245,7 +245,7 @@ The following XML file contains the device description framework (DDF) for the S 0 - Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. + Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. @@ -375,7 +375,7 @@ The following XML file contains the device description framework (DDF) for the S - Required. Specifies the root certificate for the H-SLP server. Windows Phone does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. + Required. Specifies the root certificate for the H-SLP server. Windows does not support a non-secure mode. If this node is not included, the configuration service provider will fail but may not return a specific error. @@ -874,7 +874,7 @@ The following XML file contains the device description framework (DDF) for the S 0 - Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows Phones provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. + Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The default is 0. The default method in Windows provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator's network or location services. The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 1925bbdccc..46e9609e96 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/28/2023 +ms.date: 03/27/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -28,10 +28,6 @@ The SurfaceHub configuration service provider (CSP) is used to configure Microso The following list shows the SurfaceHub configuration service provider nodes: - ./Vendor/MSFT/SurfaceHub - - [AutopilotSelfdeploy](#autopilotselfdeploy) - - [FriendlyName](#autopilotselfdeployfriendlyname) - - [Password](#autopilotselfdeploypassword) - - [UserPrincipalName](#autopilotselfdeployuserprincipalname) - [DeviceAccount](#deviceaccount) - [CalendarSyncEnabled](#deviceaccountcalendarsyncenabled) - [DomainName](#deviceaccountdomainname) @@ -40,7 +36,7 @@ The following list shows the SurfaceHub configuration service provider nodes: - [ExchangeModernAuthEnabled](#deviceaccountexchangemodernauthenabled) - [ExchangeServer](#deviceaccountexchangeserver) - [Password](#deviceaccountpassword) - - [PasswordRotationPeriod](#deviceaccountpasswordrotationperiod) + - [PasswordRotationEnabled](#deviceaccountpasswordrotationenabled) - [SipAddress](#deviceaccountsipaddress) - [UserName](#deviceaccountusername) - [UserPrincipalName](#deviceaccountuserprincipalname) @@ -93,163 +89,6 @@ The following list shows the SurfaceHub configuration service provider nodes: - [VtcAppPackageId](#propertiesvtcapppackageid) - -## AutopilotSelfdeploy - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy -``` - - - - -Node for setting Autopilot self-deployment mode device account information. This information is stored and committed by the Autopilot client during the Enrollment Status Page phase of OOBE for Surface Hub devices that are using Autopilot self-deploying mode. These values should be set only during the first sync phase of enrollment and are ignored at any other time. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | node | -| Access Type | Get | -| Case Sensitive | True | - - - - - - - - - -### AutopilotSelfdeploy/FriendlyName - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/FriendlyName -``` - - - - -The device friendly name set during Autopilot self-deploying mode on Surface Hub. Get is allowed here but only returns a blank. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Get, Replace | - - - - - - - - - -### AutopilotSelfdeploy/Password - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/Password -``` - - - - -Password for the device account. Get is allowed here, but will always return a blank. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Get, Replace | - - - - - - - - - -### AutopilotSelfdeploy/UserPrincipalName - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - - - -```Device -./Vendor/MSFT/SurfaceHub/AutopilotSelfdeploy/UserPrincipalName -``` - - - - -User principal name (UPN) of the device account. Autopilot on Surface Hub only supports Azure Active Directory, and this should specify the UPN of the device account. Get is allowed here but only returns a blank. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Get, Replace | - - - - - - - - ## DeviceAccount @@ -643,53 +482,53 @@ Password for the device account. Get is allowed here, but will always return a b - -### DeviceAccount/PasswordRotationPeriod + +### DeviceAccount/PasswordRotationEnabled - + | Scope | Editions | Applicable OS | |:--|:--|:--| | :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | - + - + ```Device -./Vendor/MSFT/SurfaceHub/DeviceAccount/PasswordRotationPeriod +./Vendor/MSFT/SurfaceHub/DeviceAccount/PasswordRotationEnabled ``` - + - + Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, use this setting to allow the device to manage its own password by changing it frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory (or Azure AD). - + - + - + - + **Description framework properties**: | Property name | Property value | |:--|:--| | Format | int | | Access Type | Get, Replace | - + - + **Allowed values**: | Value | Description | |:--|:--| | 0 | Password rotation enabled. | | 1 | Disabled. | - + - + - + - + ### DeviceAccount/SipAddress diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index 0f0117489c..16e2b4acd8 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -4,7 +4,7 @@ description: View the XML file containing the device description framework (DDF) author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/24/2023 +ms.date: 03/24/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 3a88cd3e96..e4247312ed 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -37,21 +37,21 @@ items: href: configuration-service-provider-ddf.md - name: Policy CSP support scenarios items: - - name: ADMX policies in Policy CSP + - name: Policies that are ADMX-backed href: policies-in-policy-csp-admx-backed.md - - name: Policies in Policy CSP supported by Group Policy + - name: Policies supported by Group Policy href: policies-in-policy-csp-supported-by-group-policy.md - - name: Policies in Policy CSP supported by HoloLens 2 + - name: Policies supported by HoloLens 2 href: policies-in-policy-csp-supported-by-hololens2.md - - name: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite + - name: Policies supported by HoloLens (1st gen) Commercial Suite href: policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md - - name: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition + - name: Policies supported by HoloLens (1st gen) Development Edition href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md - - name: Policies in Policy CSP supported by Windows 10 IoT Core + - name: Policies supported by Windows 10 IoT Core href: policies-in-policy-csp-supported-by-iot-core.md - - name: Policies in Policy CSP supported by Microsoft Surface Hub + - name: Policies supported by Windows 10 Team href: policies-in-policy-csp-supported-by-surface-hub.md - - name: Policy CSPs that can be set using Exchange Active Sync (EAS) + - name: Policies that can be set using Exchange Active Sync (EAS) href: policies-in-policy-csp-that-can-be-set-using-eas.md - name: Policy CSP areas expanded: true diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index a4ce00c0f4..37eb5a69cb 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -11,8 +11,8 @@ href: update/waas-quick-start.md - name: Windows as a service overview href: update/waas-overview.md - - name: Monthly quality updates - href: update/quality-updates.md + - name: Update release cycle + href: update/release-cycle.md - name: Basics of Windows updates, channels, and tools href: update/get-started-updates-channels-tools.md - name: Prepare servicing strategy for Windows client updates diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 7239ce998b..92d3cab701 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -8,7 +8,9 @@ ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium ms.topic: how-to -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 appliesto: - ✅ Windows 10 - ✅ Windows 11 diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index 5c8f6ce68d..f878a7d748 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -1,15 +1,17 @@ --- title: What's new in Windows client deployment -manager: aaroncz -ms.author: frankroj description: Use this article to learn about new solutions and online content related to deploying Windows in your organization. ms.localizationpriority: medium ms.prod: windows-client -author: frankroj -ms.topic: article -ms.collection: highpri, tier2 -ms.date: 11/23/2022 ms.technology: itpro-deploy +author: frankroj +manager: aaroncz +ms.author: frankroj +ms.topic: conceptual +ms.collection: + - highpri + - tier2 +ms.date: 11/23/2022 --- # What's new in Windows client deployment diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md index 8a735ec6c4..7ecf3516b0 100644 --- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -8,7 +8,9 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier3 ms.date: 11/28/2022 --- diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md index 757c32ec36..4adba0785d 100644 --- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md @@ -8,7 +8,9 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier3 ms.date: 11/28/2022 --- @@ -190,7 +192,7 @@ Selection profiles, which are available in the Advanced Configuration node, prov MDT uses many log files during operating system deployments. By default the logs are client side, but by configuring the deployment settings, you can have MDT store them on the server, as well. > [!NOTE] -> The easiest way to view log files is to use Configuration Manager Trace (CMTrace), which is included in the [Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). +> The easiest way to view log files is to use Configuration Manager Trace (CMTrace). For more information, see [CMTrace](/mem/configmgr/core/support/cmtrace). ## Monitoring diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index bf1a4099cc..cef1350b94 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -8,7 +8,9 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier3 ms.date: 11/28/2022 --- @@ -264,7 +266,8 @@ See the following example: ## Use CMTrace to read log files (optional) -The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace ([CMTrace](/sccm/core/support/cmtrace)), which is available as part of the [Microsoft System 2012 R2 Center Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). You should also download this tool. +The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace ([CMTrace](/mem/configmgr/core/support/cmtrace)). + You can use Notepad (example below): ![figure 8.](../images/mdt-05-fig09.png) diff --git a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md index 8c40be4dcd..0ea1bd83a0 100644 --- a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md +++ b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md @@ -49,7 +49,8 @@ On **PC0001**: & "C:\MDT\CMTrace" C:\MININT\SMSOSD\OSDLOGS\ZTIGather.log ``` -3. Download and install the free [Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717) on PC0001 so that you have access to the Configuration Manager Trace (cmtrace.exe) tool. + > [!NOTE] + > For more information about the Configuration Manager Trace (cmtrace.exe) tool, see [CMTrace](/mem/configmgr/core/support/cmtrace). 4. Using Local Users and Groups (lusrmgr.msc), add the **contoso\\MDT\_BA** user account to the local **Administrators** group. diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md index 9bdd82e8d5..b6ead30f95 100644 --- a/windows/deployment/do/delivery-optimization-endpoints.md +++ b/windows/deployment/do/delivery-optimization-endpoints.md @@ -1,7 +1,7 @@ --- -title: Delivery Optimization and Microsoft Connected Cache content endpoints +title: Microsoft Connected Cache content and services endpoints description: List of fully qualified domain names, ports, and associated content types to use Delivery Optimization and Microsoft Connected Cache. -ms.date: 07/26/2022 +ms.date: 03/31/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: reference @@ -13,7 +13,7 @@ manager: aaroncz ms.collection: tier3 --- -# Delivery Optimization and Microsoft Connected Cache content type endpoints +# Microsoft Connected Cache content and services endpoints _Applies to:_ @@ -23,16 +23,17 @@ _Applies to:_ > [!NOTE] > All ports are outbound. -This article lists the endpoints that need to be allowed through the firewall to ensure that content from Delivery Optimization and Microsoft Connected cache is properly delivered. Use the table below to reference any particular content types supported by Delivery Optimization and Microsoft Connected Cache: +This article lists the content and services endpoints to allow in your firewall to be used by Microsoft Connected Cache. +Use the table below to reference any particular content types or services endpoints that are required for [Connected Cache on a Configuration Manager distribution point](/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache), [Connected Cache managed in Azure](waas-microsoft-connected-cache.md), or both. -|Domain Name |Protocol/Port(s) | Content Type | Additional Information | Version | +|Domain Name |Protocol/Port(s) | Content Type | Additional Information | Microsoft Connected Cache Version | |---------|---------|---------------|-------------------|-----------------| -| *.b1.download.windowsupdate.com, *.dl.delivery.mp.microsoft.com, *.download.windowsupdate.com, *.au.download.windowsupdate.com, *.au.b1.download.windowsupdate.com, *.tlu.dl.delivery.mp.microsoft.com, *.emdl.ws.microsoft.com, *.ctldl.windowsupdate.com | HTTP / 80 | Windows Update
Windows Defender
Windows Drivers | [Complete list](/windows/privacy/manage-windows-2004-endpoints) of endpoints for Windows Update services and payload. | Microsoft Configuration Manager Distribution Point | -| *.delivery.mp.microsoft.com | HTTP / 80 | Edge Browser | [Complete list](/deployedge/microsoft-edge-security-endpoints) of endpoints for Edge Browser. | Microsoft Configuration Manager Distribution Point | -| *.officecdn.microsoft.com.edgesuite.net, *.officecdn.microsoft.com, *.cdn.office.net | HTTP / 80 | Office CDN updates | [Complete list](/office365/enterprise/office-365-endpoints) of endpoints for Office CDN updates. | Microsoft Configuration Manager Distribution Point | -| *.manage.microsoft.com, *.swda01.manage.microsoft.com, *.swda02.manage.microsoft.com, *.swdb01.manage.microsoft.com, *.swdb02.manage.microsoft.com, *.swdc01.manage.microsoft.com, *.swdc02.manage.microsoft.com, *.swdd01.manage.microsoft.com, *.swdd02.manage.microsoft.com, *.swda01-mscdn.manage.microsoft.com, *.swda02-mscdn.manage.microsoft.com, *.swdb01-mscdn.manage.microsoft.com, *.swdb02-mscdn.manage.microsoft.com, *.swdc01-mscdn.manage.microsoft.com, *.swdc02-mscdn.manage.microsoft.com, *.swdd01-mscdn.manage.microsoft.com, *.swdd02-mscdn.manage.microsoft.com | HTTP / 80
HTTPs / 443 | Intune Win32 Apps | [Complete list](/mem/intune/fundamentals/intune-endpoints) of endpoints for Intune Win32 Apps updates. | Microsoft Configuration Manager Distribution Point | -| *.statics.teams.cdn.office.net | HTTP / 80
HTTPs / 443 | Teams | | Microsoft Configuration Manager Distribution Point | -| *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com | HTTP / 80 | Xbox | | Microsoft Configuration Manager Distribution Point | -| *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Microsoft Configuration Manager Distribution Point | -| *.do.dsp.mp.microsoft.com | HTTP / 80
HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Microsoft Connected Cache Managed in Azure | -| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | AMQP / 5671
MQTT / 8883
HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | +| *.b1.download.windowsupdate.com, *.dl.delivery.mp.microsoft.com, *.download.windowsupdate.com, *.au.download.windowsupdate.com, *.au.b1.download.windowsupdate.com, *.tlu.dl.delivery.mp.microsoft.com, *.emdl.ws.microsoft.com, *.ctldl.windowsupdate.com | HTTP / 80 | Windows Update
Windows Defender
Windows Drivers | [Complete list](/windows/privacy/manage-windows-2004-endpoints) of endpoints for Windows Update services and payload. | Both | +| *.delivery.mp.microsoft.com | HTTP / 80 | Edge Browser | [Complete list](/deployedge/microsoft-edge-security-endpoints) of endpoints for Edge Browser. | Both | +| *.officecdn.microsoft.com.edgesuite.net, *.officecdn.microsoft.com, *.cdn.office.net | HTTP / 80 | Office CDN updates | [Complete list](/office365/enterprise/office-365-endpoints) of endpoints for Office CDN updates. | Both | +| *.manage.microsoft.com, *.swda01.manage.microsoft.com, *.swda02.manage.microsoft.com, *.swdb01.manage.microsoft.com, *.swdb02.manage.microsoft.com, *.swdc01.manage.microsoft.com, *.swdc02.manage.microsoft.com, *.swdd01.manage.microsoft.com, *.swdd02.manage.microsoft.com, *.swda01-mscdn.manage.microsoft.com, *.swda02-mscdn.manage.microsoft.com, *.swdb01-mscdn.manage.microsoft.com, *.swdb02-mscdn.manage.microsoft.com, *.swdc01-mscdn.manage.microsoft.com, *.swdc02-mscdn.manage.microsoft.com, *.swdd01-mscdn.manage.microsoft.com, *.swdd02-mscdn.manage.microsoft.com | HTTP / 80
HTTPs / 443 | Intune Win32 Apps | [Complete list](/mem/intune/fundamentals/intune-endpoints) of endpoints for Intune Win32 Apps updates. | Both | +| *.statics.teams.cdn.office.net | HTTP / 80
HTTPs / 443 | Teams | | Both | +| *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com | HTTP / 80 | Xbox | | Both | +| *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Both | +| *.do.dsp.mp.microsoft.com | HTTP / 80
HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Connected Cache Managed in Azure | +| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | AMQP / 5671
MQTT / 8883
HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Connected Cache Managed in Azure | diff --git a/windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png b/windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png new file mode 100644 index 0000000000..75028f213c Binary files /dev/null and b/windows/deployment/do/images/mcc-isp-diagnose-solve-troubleshoot.png differ diff --git a/windows/deployment/do/images/mcc-isp-diagnose-solve.png b/windows/deployment/do/images/mcc-isp-diagnose-solve.png new file mode 100644 index 0000000000..6fa1dcc336 Binary files /dev/null and b/windows/deployment/do/images/mcc-isp-diagnose-solve.png differ diff --git a/windows/deployment/do/index.yml b/windows/deployment/do/index.yml index 7c057be789..cdbe9ad071 100644 --- a/windows/deployment/do/index.yml +++ b/windows/deployment/do/index.yml @@ -9,7 +9,9 @@ metadata: ms.topic: landing-page ms.prod: windows-client ms.technology: itpro-updates - ms.collection: highpri, tier3 + ms.collection: + - highpri + - tier3 author: aczechowski ms.author: aaroncz manager: dougeby diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md index f1a81788a0..badea53748 100644 --- a/windows/deployment/do/mcc-enterprise-prerequisites.md +++ b/windows/deployment/do/mcc-enterprise-prerequisites.md @@ -18,6 +18,8 @@ ms.collection: tier3 - Windows 10 - Windows 11 +> [!NOTE] +> We're still accepting Enterprise and Education customers to join the early preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). ## Enterprise requirements for MCC 1. **Azure subscription**: MCC management portal is hosted within Azure and is used to create the Connected Cache [Azure resource](/azure/cloud-adoption-framework/govern/resource-consistency/resource-access-management) and IoT Hub resource. Both are free services. diff --git a/windows/deployment/do/mcc-isp-faq.yml b/windows/deployment/do/mcc-isp-faq.yml index 1d912e7b10..ddcf91bb1e 100644 --- a/windows/deployment/do/mcc-isp-faq.yml +++ b/windows/deployment/do/mcc-isp-faq.yml @@ -5,7 +5,9 @@ metadata: author: amymzhou ms.author: amymzhou manager: aaroncz - ms.collection: highpri, tier3 + ms.collection: + - highpri + - tier3 ms.topic: faq ms.date: 09/30/2022 ms.prod: windows-client @@ -84,6 +86,6 @@ sections: - question: I signed up for Microsoft Connected Cache, but I'm not receiving the verification email. What should I do? answer: First, check that the email under the NOC role is correct in your PeeringDB page. If the email associated with NOC role is correct, search for an email from the sender "microsoft-noreply@microsoft.com" with the email subject - "Here's your Microsoft Connected Cache verification code" in your Spam folders. Still can't find it? Ensure that your email admin rules allow emails from the sender "microsoft-noreply@microsoft.com". - question: I have an active MCC, but I'm noticing I hit the message limit for my IoT Hub each day. Does this affect my MCC performance and should I be concerned? - answer: Even when the quota of 8k messages is hit, the MCC functionality won't be affected. Your client devices will continue to download content as normal. You'll also not be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the private preview and isn't an issue during public preview. + answer: Even when the quota of 8k messages is hit, the MCC functionality won't be affected. Your client devices will continue to download content as normal. You'll also not be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the early preview and isn't an issue during public preview. - question: What do I do if I need more support and have more questions even after reading this FAQ page? answer: For further support for Microsoft Connected Cache, visit [Troubleshooting Issues for Microsoft Connected Cache for ISP (public preview)](mcc-isp-support.md). diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md index ca3e78f917..960485c7cb 100644 --- a/windows/deployment/do/mcc-isp-signup.md +++ b/windows/deployment/do/mcc-isp-signup.md @@ -20,6 +20,9 @@ ms.collection: tier3 This article details the process of signing up for Microsoft Connected Cache for Internet Service Providers (public preview). + > [!NOTE] + > Microsoft Connected Cache is now in public review. Instead of submitting a survey, you can directly onboard by following the instructions in this article. + ## Prerequisites Before you begin sign up, ensure you have the following components: diff --git a/windows/deployment/do/mcc-isp-support.md b/windows/deployment/do/mcc-isp-support.md index 5fb2e95dbe..2be225b039 100644 --- a/windows/deployment/do/mcc-isp-support.md +++ b/windows/deployment/do/mcc-isp-support.md @@ -19,27 +19,45 @@ ms.collection: tier3 - Windows 11 This article provides information on how to troubleshoot common issues with Microsoft Connected Cache for ISPs. -## Sign up errors -### Cannot verify account +## Common issues + +This section details a few common issues that customers face during the sign up process. + +### Sign up errors + +#### Cannot verify account During sign-up, we verify the information you provide against what is present in [Peering DB](https://www.peeringdb.com/). Make sure the information for your ISP entry on [Peering DB](https://www.peeringdb.com/) is up to date and matches what you provide during sign-up. -### Invalid verification code +#### Invalid verification code During sign-up, a verification code is sent to your NOC email address present in [Peering DB](https://www.peeringdb.com/). This code expires in 24 hours. If it's expired, you'll need to request a new verification code to complete the sign-up. -## Cache Node Errors +### Cache Node Errors -### Cannot find my cache node +#### Cannot find my cache node Did you previously had access to your cache nodes but it's now no longer accessible? If so, it may be because you had a trial subscription, and its trial period ended. To resolve this issue, complete the following two steps: 1. Create a new Azure Pay-As-You-Go subscription 1. Recreate the cache nodes using the new subscription +## Diagnose and Solve Problems + +If this article isn't resolving the issue you're facing with your cache node, you can use the **Diagnose and solve problems** functionality within your MCC resource to continue troubleshooting. **Diagnose and solve problems** contains solutions to most common problems that users may face as they onboard. + +You can find **Diagnose and solve problems** on the left pane within your MCC resource. + +:::image type="content" source="images/mcc-isp-diagnose-solve.png" alt-text="A screenshot of Azure portal showing the Diagnose and Solve problems tab on the left hand pane of Azure portal." lightbox="images/mcc-isp-diagnose-solve.png"::: + +Within **Diagnose and solve problems**, select **Troubleshoot** under the type of problem you're facing and follow the prompts that narrow down the solution to the issue. + +:::image type="content" source="images/mcc-isp-diagnose-solve-troubleshoot.png" alt-text="A screenshot of Azure portal showing the option to select Troubleshoot to continue troubleshooting common issues related to the installation of Microsoft Connected Cache." lightbox="images/mcc-isp-diagnose-solve-troubleshoot.png"::: + ## Steps to obtain an Azure subscription ID +To onboard onto Microsoft Connected Cache, you will need an Azure subscription ID. Follow the steps below to obtain your subscription ID: [!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] diff --git a/windows/deployment/do/mcc-isp.md b/windows/deployment/do/mcc-isp.md index 103077d2f5..9a067c4a51 100644 --- a/windows/deployment/do/mcc-isp.md +++ b/windows/deployment/do/mcc-isp.md @@ -565,7 +565,7 @@ To migrate, use the following steps: 1. Navigate to the cache node that you would like to migrate and select **Download Migration Package** using the button at the top of the page. 1. Follow the instructions under the **Connected Cache Migrate Scripts** section within Azure portal. - :::image type="content" source="images/mcc-isp-migrate.png" alt-text="A screenshot of Azure portal showing the migration instructions for migrating a cache node from the private preview to the public preview." lightbox="images/mcc-isp-migrate.png"::: + :::image type="content" source="images/mcc-isp-migrate.png" alt-text="A screenshot of Azure portal showing the migration instructions for migrating a cache node from the early preview to the public preview." lightbox="images/mcc-isp-migrate.png"::: 1. Go to https://portal.azure.com and navigate to your resource to check your migrated cache nodes. diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index cb916610f0..f363e5116d 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -2,13 +2,15 @@ metadata: title: Delivery Optimization Frequently Asked Questions description: The following is a list of frequently asked questions for Delivery Optimization. - ms.reviewer: aaroncz + ms.reviewer: mstewart ms.prod: windows-client - author: carmenf + author: cmknox ms.author: carmenf - manager: dougeby + manager: aaroncz ms.technology: itpro-updates - ms.collection: highpri, tier3 + ms.collection: + - highpri + - tier3 ms.topic: faq ms.date: 08/04/2022 title: Delivery Optimization Frequently Asked Questions diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index ad50cecaaa..4908ba4901 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -285,7 +285,7 @@ This policy allows you to specify how your client(s) can discover Delivery Optim With either option, the client will query DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if set. **By default, this policy has no value.** -Set this policy to designate Delivery Optimization in Network Cache servers through a custom DHCP Option. Specify the custom DHCP option on your server as *text* type. You can add one or more values as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address with commas. +Set this policy to designate Delivery Optimization in Network Cache servers through a custom DHCP Option. Specify the custom DHCP option on your DHCP server as *text* type. You can add one or more values as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address with commas. > [!NOTE] > If you format the DHCP Option ID incorrectly, the client will fall back to the Cache Server Hostname policy value if that value has been set. diff --git a/windows/deployment/do/waas-delivery-optimization.md b/windows/deployment/do/waas-delivery-optimization.md index 0f88d16b68..94d89f77a1 100644 --- a/windows/deployment/do/waas-delivery-optimization.md +++ b/windows/deployment/do/waas-delivery-optimization.md @@ -1,14 +1,16 @@ --- title: What is Delivery Optimization? -manager: aaroncz description: This article provides information about Delivery Optimization, a peer-to-peer distribution method in Windows 10 and Windows 11. ms.prod: windows-client -author: cmknox -ms.localizationpriority: medium -ms.author: carmenf -ms.collection: tier3, highpri -ms.topic: article ms.technology: itpro-updates +ms.localizationpriority: medium +author: cmknox +ms.author: carmenf +manager: aaroncz +ms.collection: + - tier3 + - highpri +ms.topic: overview ms.date: 12/31/2017 --- @@ -16,7 +18,7 @@ ms.date: 12/31/2017 **Applies to** -- Windows 10 +- Windows 10 - Windows 11 > **Looking for Group Policy objects?** See [Delivery Optimization reference](waas-delivery-optimization-reference.md) or the master spreadsheet available at the Download Center [for Windows 11](https://www.microsoft.com/en-us/download/details.aspx?id=104594) or [for Windows 10](https://www.microsoft.com/en-us/download/details.aspx?id=104678). @@ -81,7 +83,7 @@ In Windows client Enterprise, Professional, and Education editions, Delivery Opt ## How Microsoft uses Delivery Optimization -At Microsoft, to help ensure that ongoing deployments weren't affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. +At Microsoft, to help ensure that ongoing deployments weren't affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. For more information, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study. diff --git a/windows/deployment/do/waas-microsoft-connected-cache.md b/windows/deployment/do/waas-microsoft-connected-cache.md index 3f99fd1880..dec5e3708d 100644 --- a/windows/deployment/do/waas-microsoft-connected-cache.md +++ b/windows/deployment/do/waas-microsoft-connected-cache.md @@ -20,14 +20,26 @@ ms.collection: tier3 - Windows 11 > [!IMPORTANT] -> Microsoft Connected Cache is currently a preview feature. To view our Microsoft Connected Cache for ISPs early preview documentation, visit [Microsoft Connected Cache for Internet Service Providers (ISPs)](mcc-isp.md). For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). +> Microsoft Connected Cache is currently a preview feature. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). -Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings: 1) Microsoft Connected Cache for Internet Service Providers and 2) Microsoft Connected Cache for Enterprise and Education (early preview). Both products are created and managed in the cloud portal. +Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. Microsoft Connected Cache has two main offerings: +- Microsoft Connected Cache for Internet Service Providers +- Microsoft Connected Cache for Enterprise and Education (early preview). + +Both products are created and managed in the cloud portal. ## Microsoft Connected Cache for ISPs (preview) + +> [!NOTE] +> Microsoft Connected Cache for Internet Service Providers is now in public preview. Instead of submitting a survey, you can directly onboard by following the instructions in the [Operator sign up and service onboarding](mcc-isp-signup.md) article. + Microsoft Connected Cache (MCC) for Internet Service Providers is currently in preview. MCC can be deployed to as many bare-metal servers or VMs as needed and is managed from a cloud portal. When deployed, MCC can help to reduce your network bandwidth usage for Microsoft software content and updates. Cache nodes are created in the cloud portal and are configured to deliver traffic to customers by manual CIDR or BGP routing. ## Microsoft Connected Cache for Enterprise and Education (early preview) + +> [!NOTE] +> We're still accepting Enterprise and Education customers to join the early preview. To register your interest, fill out the survey located at [https://aka.ms/MSConnectedCacheSignup](https://aka.ms/MSConnectedCacheSignup). + Microsoft Connected Cache (MCC) for Enterprise and Education (early preview) is a software-only caching solution that delivers Microsoft content within Enterprise and Education networks. MCC can be deployed to as many Windows servers, bare-metal servers, or VMs as needed, and is managed from a cloud portal. Cache nodes are created in the cloud portal and are configured by applying the client policy using management tools such as Intune. MCC is a hybrid (mix of on-premises and cloud resources) SaaS solution built as an Azure IoT Edge module and Docker compatible Linux container deployed to your Windows devices. The Delivery Optimization team chose IoT Edge for Linux on Windows (EFLOW) as a secure, reliable container management infrastructure. EFLOW is a Linux virtual machine, based on Microsoft's first party CBL-Mariner operating system. It’s built with the IoT Edge runtime and validated as a tier 1 supported environment for IoT Edge workloads. MCC will be a Linux IoT Edge module running on the Windows Host OS. diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 5e9e859e17..c2e2672c36 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -5,15 +5,17 @@ summary: Learn about deploying and keeping Windows client devices up to date. # metadata: title: Windows client deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn about deploying Windows 10 and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. + description: Learn about deploying Windows and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. ms.topic: landing-page - ms.technology: itpro-apps + ms.technology: itpro-deploy ms.prod: windows-client - ms.collection: highpri, tier1 + ms.collection: + - highpri + - tier1 author: frankroj ms.author: frankroj manager: aaroncz - ms.date: 10/31/2022 #Required; mm/dd/yyyy format. + ms.date: 10/31/2022 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 4caffd0228..2ab8313425 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -7,8 +7,10 @@ ms.author: frankroj ms.date: 11/23/2022 manager: aaroncz ms.localizationpriority: high -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: how-to +ms.collection: + - highpri + - tier2 ms.technology: itpro-deploy --- diff --git a/windows/deployment/planning/windows-to-go-frequently-asked-questions.yml b/windows/deployment/planning/windows-to-go-frequently-asked-questions.yml index c234ad4992..4907345be4 100644 --- a/windows/deployment/planning/windows-to-go-frequently-asked-questions.yml +++ b/windows/deployment/planning/windows-to-go-frequently-asked-questions.yml @@ -164,7 +164,7 @@ sections: - question: | Can the user self-provision Windows To Go? answer: | - Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise, Windows 10 Education and Windows 10 Professional. Additionally, Configuration Manager SP1 and later releases includes support for user self-provisioning of Windows To Go drives. Configuration Manager can be downloaded for evaluation from the [Microsoft TechNet Evaluation Center](https://go.microsoft.com/fwlink/p/?LinkID=618746). + Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise, Windows 10 Education and Windows 10 Professional. Additionally, Configuration Manager SP1 and later releases include support for user self-provisioning of Windows To Go drives. - question: | How can Windows To Go be managed in an organization? @@ -292,7 +292,7 @@ sections: Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That's why you can't see the internal hard drives of the host computer when you're booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive. **Warning** - It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. + It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefore user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. @@ -324,7 +324,7 @@ sections: - question: | Do I need to activate Windows To Go every time I roam? answer: | - No, Windows To Go requires volume activation; either using the [Key Management Service](/previous-versions/tn-archive/ff793434(v=technet.10)) (KMS) server in your organization or using [Active Directory](/previous-versions/windows/hh852637(v=win.10)) based volume activation. The Windows To Go workspace won't need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or a through remote connection using DirectAccess or a virtual private network connection), once activated the machine won't need to be activated again until the activation validity interval has passed. In a KMS configuration, the activation validity interval is 180 days. + No, Windows To Go requires volume activation; either using the [Key Management Service](/previous-versions/tn-archive/ff793434(v=technet.10)) (KMS) server in your organization or using [Active Directory](/previous-versions/windows/hh852637(v=win.10)) based volume activation. The Windows To Go workspace won't need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or through a remote connection using DirectAccess or a virtual private network connection), once activated the machine won't need to be activated again until the activation validity interval has passed. In a KMS configuration, the activation validity interval is 180 days. - question: | Can I use all Windows features on Windows To Go? @@ -433,7 +433,7 @@ sections: answer: | One of the challenges involved in moving the Windows To Go drive between PCs while seamlessly booting Windows with access to all of their applications and data is that for Windows to be fully functional, specific drivers need to be installed for the hardware in each machine that runs Windows. Windows 8 or later has a process called respecialize which will identify new drivers that need to be loaded for the new PC and disable drivers that aren't present on the new configuration. In general, this feature is reliable and efficient when roaming between PCs of widely varying hardware configurations. - In certain cases, third-party drivers for different hardware models or versions can reuse device ID's, driver file names, registry keys (or any other operating system constructs that don't support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID's, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver. + In certain cases, third-party drivers for different hardware models or versions can reuse device IDs, driver file names, registry keys (or any other operating system constructs that don't support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID's, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver. This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message "Installing devices…" displaying every time that a Windows to Go drive is roamed between two PCs that require conflicting drivers. diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index f9b22c70d2..29746b5180 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -5,9 +5,11 @@ manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.topic: article +ms.topic: overview ms.technology: itpro-deploy -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.date: 10/28/2022 --- @@ -22,41 +24,39 @@ ms.date: 10/28/2022 Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. -PCs that meet the Windows 7 or later [certification requirements](/previous-versions/windows/hardware/cert-program/) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: +PCs that meet the Windows 7 or later [certification requirements](/previous-versions/windows/hardware/cert-program/) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go isn't intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some other considerations that you should keep in mind before you start to use Windows To Go: - [Windows To Go: feature overview](#windows-to-go-feature-overview) - [Differences between Windows To Go and a typical installation of Windows](#differences-between-windows-to-go-and-a-typical-installation-of-windows) - [Roaming with Windows To Go](#roaming-with-windows-to-go) - [Prepare for Windows To Go](#prepare-for-windows-to-go) - [Hardware considerations for Windows To Go](#hardware-considerations-for-windows-to-go) - - [Additional resources](#additional-resources) - - [Related topics](#related-topics) > [!NOTE] -> Windows To Go is not supported on Windows RT. +> Windows To Go isn't supported on Windows RT. ## Differences between Windows To Go and a typical installation of Windows Windows To Go workspace operates just like any other installation of Windows with a few exceptions. These exceptions are: -- **Internal disks are offline.** To ensure data isn't accidentally disclosed, internal hard disks on the host computer are offline by default when booted into a Windows To Go workspace. Similarly if a Windows To Go drive is inserted into a running system, the Windows To Go drive will not be listed in Windows Explorer. -- **Trusted Platform Module (TPM) is not used.** When using BitLocker Drive Encryption a pre-operating system boot password will be used for security rather than the TPM since the TPM is tied to a specific computer and Windows To Go drives will move between computers. +- **Internal disks are offline.** To ensure data isn't accidentally disclosed, internal hard disks on the host computer are offline by default when booted into a Windows To Go workspace. Similarly if a Windows To Go drive is inserted into a running system, the Windows To Go drive won't be listed in Windows Explorer. +- **Trusted Platform Module (TPM) is not used.** When using BitLocker Drive Encryption, a pre-operating system boot password will be used for security rather than the TPM since the TPM is tied to a specific computer and Windows To Go drives will move between computers. - **Hibernate is disabled by default.** To ensure that the Windows To Go workspace is able to move between computers easily, hibernation is disabled by default. Hibernation can be re-enabled by using Group Policy settings. - **Windows Recovery Environment is not available.** In the rare case that you need to recover your Windows To Go drive, you should re-image it with a fresh image of Windows. - **Refreshing or resetting a Windows To Go workspace is not supported.** Resetting to the manufacturer's standard for the computer doesn't apply when running a Windows To Go workspace, so the feature was disabled. -- **Upgrading a Windows To Go workspace is not supported.** Older Windows 8 or Windows 8.1 Windows To Go workspaces cannot be upgraded to Windows 10 workspaces, nor can Windows 10 Windows To Go workspaces be upgraded to future versions of Windows 10. For new versions, the workspace needs to be re-imaged with a fresh image of Windows. +- **Upgrading a Windows To Go workspace is not supported.** Older Windows 8 or Windows 8.1 Windows To Go workspaces can't be upgraded to Windows 10 workspaces, nor can Windows 10 Windows To Go workspaces be upgraded to future versions of Windows 10. For new versions, the workspace needs to be re-imaged with a fresh image of Windows. ## Roaming with Windows To Go -Windows To Go drives can be booted on multiple computers. When a Windows To Go workspace is first booted on a host computer it will detect all hardware on the computer and install any needed drivers. When the Windows To Go workspace is subsequently booted on that host computer it will be able to identify the host computer and load the correct set of drivers automatically. +Windows To Go drives can be booted on multiple computers. When a Windows To Go workspace is first booted on a host computer, it will detect all hardware on the computer and install any needed drivers. When the Windows To Go workspace is next booted on that host computer, it will be able to identify the host computer and load the correct set of drivers automatically. -The applications that you want to use from the Windows To Go workspace should be tested to make sure they also support roaming. Some applications bind to the computer hardware which will cause difficulties if the workspace is being used with multiple host computers. +The applications that you want to use from the Windows To Go workspace should be tested to make sure they also support roaming. Some applications bind to the computer hardware, which will cause difficulties if the workspace is being used with multiple host computers. ## Prepare for Windows To Go Enterprises install Windows on a large group of computers either by using configuration management software (such as Microsoft Configuration Manager), or by using standard Windows deployment tools such as DiskPart and the Deployment Image Servicing and Management (DISM) tool. -These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](/windows-hardware/get-started/adk-install) to review deployment tools available. +These same tools can be used to provision Windows To Go drive, just as if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](/windows-hardware/get-started/adk-install) to review deployment tools available. > [!IMPORTANT] > Make sure you use the versions of the deployment tools provided for the version of Windows you are deploying. There have been many enhancements made to support Windows To Go. Using versions of the deployment tools released for earlier versions of Windows to provision a Windows To Go drive is not supported. @@ -67,7 +67,7 @@ Are there any drivers that you need to inject into the image? How will data be stored and synchronized to appropriate locations from the USB device? -Are there any applications that are incompatible with Windows To Go roaming that should not be included in the image? +Are there any applications that are incompatible with Windows To Go roaming that shouldn't be included in the image? What should be the architecture of the image - 32bit/64bit? @@ -79,7 +79,7 @@ For more information about designing and planning your Windows To Go deployment, **For USB drives** -The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following: +The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following items: - Windows To Go certified USB drives are built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. - Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later. @@ -101,7 +101,7 @@ As of the date of publication, the following are the USB drives currently certif - Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) > [!IMPORTANT] - > You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). + > You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go, see [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). - Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) @@ -121,25 +121,25 @@ As of the date of publication, the following are the USB drives currently certif - Western Digital My Passport Enterprise ([http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722)) - We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go. For more information about the WD Compass utility please refer to [http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722) + We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go. For more information about the WD Compass utility, see [http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722) **For host computers** -When assessing the use of a PC as a host for a Windows To Go workspace you should consider the following criteria: +When assessing the use of a PC as a host for a Windows To Go workspace, you should consider the following criteria: - Hardware that has been certified for use with Windows 7 or later operating systems will work well with Windows To Go. -- Running a Windows To Go workspace from a computer that is running Windows RT is not a supported scenario. -- Running a Windows To Go workspace on a Mac computer is not a supported scenario. +- Running a Windows To Go workspace from a computer that is running Windows RT isn't a supported scenario. +- Running a Windows To Go workspace on a Mac computer isn't a supported scenario. The following table details the characteristics that the host computer must have to be used with Windows To Go: |Item|Requirement| |--- |--- | |Boot process|Capable of USB boot| -|Firmware|USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you are unsure of the ability of your PC to boot from USB)| +|Firmware|USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you're unsure of the ability of your PC to boot from USB)| |Processor architecture|Must support the image on the Windows To Go drive| |External USB Hubs|Not supported; connect the Windows To Go drive directly to the host machine| -|Processor|1 Ghz or faster| +|Processor|1 GHz or faster| |RAM|2 GB or greater| |Graphics|DirectX 9 graphics device with WDDM 1.2 or greater driver| |USB port|USB 2.0 port or greater| @@ -155,13 +155,13 @@ In addition to the USB boot support in the BIOS, the Windows 10 image on your Wi |UEFI BIOS|32-bit|32-bit only| |UEFI BIOS|64-bit|64-bit only| -## Additional resources +## Other resources - [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) - [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) - [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) -## Related topics +## Related articles [Deploy Windows To Go in your organization](../deploy-windows-to-go.md)
[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.yml)
diff --git a/windows/deployment/update/deploy-updates-intune.md b/windows/deployment/update/deploy-updates-intune.md index 5c884406fd..8ce126fdb1 100644 --- a/windows/deployment/update/deploy-updates-intune.md +++ b/windows/deployment/update/deploy-updates-intune.md @@ -1,6 +1,6 @@ --- title: Deploy updates with Intune -description: Deploy Windows client updates with Intune +description: Deploy Windows client updates with Intune. ms.prod: windows-client author: mestew ms.localizationpriority: medium @@ -8,7 +8,9 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.date: 12/31/2017 --- @@ -16,7 +18,7 @@ ms.date: 12/31/2017 **Applies to** -- Windows 10 +- Windows 10 - Windows 11 See the Microsoft Intune [documentation](/mem/intune/protect/windows-update-for-business-configure#windows-10-feature-updates) for details about using Intune to deploy and manage Windows client updates. diff --git a/windows/deployment/update/includes/update-history.md b/windows/deployment/update/includes/update-history.md new file mode 100644 index 0000000000..9963e0b8b6 --- /dev/null +++ b/windows/deployment/update/includes/update-history.md @@ -0,0 +1,16 @@ +--- +author: mestew +ms.author: mstewart +manager: aaroncz +ms.technology: itpro-updates +ms.prod: windows-client +ms.topic: include +ms.date: 02/24/2023 +ms.localizationpriority: medium +--- + +- [Windows 11, version 22H2 update history](https://support.microsoft.com/en-us/topic/windows-11-version-22h2-update-history-ec4229c3-9c5f-4e75-9d6d-9025ab70fcce) +- [Windows 11, version 21H2 update history](https://support.microsoft.com/en-us/topic/windows-11-version-21h2-update-history-a19cd327-b57f-44b9-84e0-26ced7109ba9) +- [Windows 10 update history](https://support.microsoft.com/en-us/topic/windows-10-update-history-8127c2c6-6edf-4fdf-8b9f-0f7be1ef3562) +- [Windows release health](/windows/release-health/) +- [What's new in Windows](/windows/whats-new/) diff --git a/windows/deployment/update/includes/wufb-reports-recommend.md b/windows/deployment/update/includes/wufb-reports-recommend.md index 37caa47a4d..afd3f56219 100644 --- a/windows/deployment/update/includes/wufb-reports-recommend.md +++ b/windows/deployment/update/includes/wufb-reports-recommend.md @@ -11,5 +11,4 @@ ms.localizationpriority: medium > [!Important] -> - Update Compliance is [deprecated](/windows/whats-new/deprecated-features) and is no longer accepting new onboarding requests. Update Compliance has been replaced by [Windows Update for Business reports](..\wufb-reports-overview.md). If you're currently using Update Compliance, you can continue to use it, but you can't change your `CommercialID`. Support for Update Compliance will end on March 31, 2023 when the service will be [retired](/windows/whats-new/feature-lifecycle#terminology). -> - Changes have been made to the Windows diagnostic data processor configuration. For more information, see [Windows diagnostic data processor changes](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data). +> Update Compliance was [retired](/windows/whats-new/feature-lifecycle#terminology) on March 31, 2023 and the service has been [removed](/windows/whats-new/removed-features). Update Compliance has been replaced by [Windows Update for Business reports](..\wufb-reports-overview.md). Support for Update Compliance ended on March 31, 2023. diff --git a/windows/deployment/update/optional-content.md b/windows/deployment/update/optional-content.md index ee5da0bb30..b088d43792 100644 --- a/windows/deployment/update/optional-content.md +++ b/windows/deployment/update/optional-content.md @@ -8,21 +8,18 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 03/15/2023 --- # Migrating and acquiring optional Windows content during updates -**Applies to** - -- Windows 10 -- Windows 11 +***(Applies to: Windows 11 & Windows 10)*** This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term. -When you update the operating system, it’s critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows client setup using a local Windows image or WIM file (a “media-based” or “task-sequence-based” update). Others do in-place updates using an approved Windows client feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a "servicing-based” update). +When you update the operating system, it's critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows client setup using a local Windows image or WIM file (a *media-based* or *task-sequence-based* update). Others do in-place updates using an approved Windows client feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a *servicing-based* update). -Neither approach contains the full set of Windows optional features that a user’s device might need, so those features are not migrated to the new operating system. Further, those features are not available in Configuration Manager or WSUS for on-premises acquisition after a feature update +Neither approach contains the full set of Windows optional features that a user's device might need, so those features aren't migrated to the new operating system. In the past, those features weren't available in Configuration Manager nor WSUS for on-premises acquisition after a feature update. ## What is optional content? @@ -32,7 +29,7 @@ Optional content includes the following items: - Language-based and regional FODs (for example, Language.Basic~~~ja-jp~0.0.1.0) - Local Experience Packs -Optional content isn’t included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it’s released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This approach provides more space for user’s data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network. +Optional content isn't included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it's released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This approach provides more space for user's data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network. ## Why is acquiring optional content challenging? @@ -40,121 +37,130 @@ The challenges surrounding optional content typically fall into two groups: ### Incomplete operating system updates -The first challenge is related to content migration during a feature update. When Windows Setup performs an in-place update, the new operating system is written to the user’s disk alongside the old version in a temporary folder, where a second clean operating system is installed and prepared for the user to "move into." When operation happens, Windows Setup enumerates optional content installed already in the current version and plans to install the new version of this content in the new operating system. +The first challenge is related to content migration during a feature update. When Windows Setup performs an in-place update, the new operating system is written to the user's disk alongside the old version in a temporary folder, where a second clean operating system is installed and prepared for the user to *move into*. When operation happens, Windows Setup enumerates optional content installed already in the current version and plans to install the new version of this content in the new operating system. -Windows Setup needs access to the optional content. Since optional content is not in the Windows image by default, Windows Setup must look elsewhere to get the Windows packages, stage them, and then install them in the new operating system. When the content can’t be found, the result is an update that is missing features on the device, a frustrated end user, and likely a help desk call. This pain point is sometimes referred to "failure to migrate optional content during update." For media-based updates, Windows will automatically try again once the new operating system boots. We call this “latent acquisition.” +Windows Setup needs access to the optional content. Since optional content isn't in the Windows image by default, Windows Setup must look elsewhere to get the Windows packages, stage them, and then install them in the new operating system. When the content can't be found, the result is an update that is missing features on the device, a frustrated end user, and likely a help desk call. This pain point is sometimes referred to as *failure to migrate optional content during update*. For media-based updates, Windows will automatically try again once the new operating system boots. We call this *latent acquisition*. ### User-initiated feature acquisition failure -The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows client, either by using a clean installation or an in-place update. The user visits Settings, and attempts to install a second language, more language experience features, or other optional content. Again, since these features are not in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can’t be found, users are frustrated and another help desk call could result. This pain point is sometimes referred to as "failure to acquire optional content.” +The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows client, either by using a clean installation or an in-place update. The user visits **Settings**, and attempts to install a second language, more language experience features, or other optional content. Again, since these features aren't in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can't be found, users are frustrated, and another help desk call could result. This pain point is sometimes referred to as *failure to acquire optional content*. ## Options for acquiring optional content -Most commercial organizations understand the pain points outlined above, and discussions typically start with them asking what plans are available to address these challenges. The following table includes multiple options for consideration, depending on how you are currently deploying Windows client. In this table, - -- Migration means it supports optional content migration during an update. -- Acquisition means it supports optional content acquisition (that is, initiated by the user). -- Media means it's applicable with media-based deployments. -- Servicing means applicable with servicing-based deployments. - - -|Method |Migration |Acquisition |Media | Servicing | -|---------|---------|---------|---------|--------------| -|Option 1: Use Windows Update | Yes | Yes | No | Yes | -|Option 2: Enable Dynamic Update | Yes | No | Yes |Yes | -|Option 3: Customize the Windows image before deployment | Yes | No | Yes |No | -|Option 4: Install language features during deployment | Partial | No | Yes | No | -|Option 5: Install optional content after deployment | Yes | No |Yes | Yes | -|Option 6: Configure alternative source for Features on Demand | No | Partial | Yes | Yes | +Most commercial organizations understand the pain points outlined above, and discussions typically start with them asking what plans are available to address these challenges. The following table includes multiple options for consideration, depending on how you're currently deploying Windows client. The following definitions are used in the table headings: +- **Migration**: Supports optional content migration during an update. +- **Acquisition**: Supports optional content acquisition (that is, initiated by the user). +- **Media**: Applicable with media-based deployments. +- **Servicing**: Applicable with servicing-based deployments. +| Method | Migration | Acquisition | Media | Servicing | +|---|---|---|---|---| +| Option 1: Use Windows Update | Yes | Yes | No | Yes | +| Option 2: Use WSUS with UUP Integration | Yes | Yes | No | Yes | +| Option 3: Enable Dynamic Update | Yes | No | Yes | Yes | +| Option 4: Customize the Windows image before deployment | Yes | No | Yes | No | +| Option 5: Install language features during deployment | Partial | No | Yes | No | +| Option 6: Install optional content after deployment | Yes | No |Yes | Yes | +| Option 7: Configure alternative source for Features on Demand | No | Partial | Yes | Yes | ### Option 1: Use Windows Update -Windows Update for Business solves the optional content problem. Optional content is published and available for acquisition by Windows Setup from a nearby Microsoft content delivery network and acquired using the Unified Update Platform. Optional content migration and acquisition scenarios "just work" when the device is connected to an update service that uses the Unified Update Platform, such as Windows Update or Windows Update for Business. If for some reason a language pack fails to install during the update, the update will automatically roll back. +Windows Update for Business solves the optional content problem. Optional content is published and available for acquisition by Windows Setup from a nearby Microsoft content delivery network and acquired using the Unified Update Platform. Optional content migration and acquisition scenarios just work when the device is connected to an update service that uses the Unified Update Platform, such as Windows Update or Windows Update for Business. If for some reason a language pack fails to install during the update, the update will automatically roll back. -Starting with Windows 10, version 1709, we introduced the [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/). The Unified Update Platform is an improvement in the underlying Windows update technology that results in smaller download sizes and a more efficient protocol for checking for updates, acquiring and installing the packages needed, and getting current in one update step. The technology is "unified" because it brings together the update stack for Windows client, Windows Server, and other products, such as HoloLens. The Unified Update Platform is not currently integrated with WSUS. +The [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/) is an improvement in the underlying Windows update technology that results in smaller download sizes and a more efficient protocol for checking for updates, acquiring and installing the packages needed, and getting current in one update step. The technology is *unified* because it brings together the update stack for Windows client, Windows Server, and other products, such as HoloLens. -Consider moving to Windows Update for Business. Not only will the optional content scenario work seamlessly (as it does for consumer devices today), but you also get the full benefits of smaller download sizes also known as Express Updates. Further, devices that use devices are immune to the challenge of upgrading a Windows client device where the operating system installation language is inadvertently changed to a new language. Otherwise, any future media-based feature updates can fail when the installation media has a different installation language. For more info, see [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/upgrading-windows-10-devices-with-installation-media-different/ba-p/746126) for more details, and our [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) on this topic. +Consider moving to Windows Update for Business. Not only will the optional content scenario work seamlessly (as it does for consumer devices today), but you also get the full benefits of smaller download sizes. Further, devices are immune to the challenge of upgrading Windows when the operating system installation language is inadvertently changed to a new language. Otherwise, any future media-based feature updates can fail when the installation media has a different installation language. For more information about this issue, see [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/upgrading-windows-10-devices-with-installation-media-different/ba-p/746126) and the [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002). -### Option 2: Enable Dynamic Update -If you’re not ready to move to Windows Update, another option is to enable Dynamic Update during a feature update. As soon as a Windows feature update starts, whether via a media-based update or a WSUS-based feature update, Dynamic Update is one of the first steps invoked. Windows Setup connects to an internet-facing URL hosted by Microsoft to fetch Dynamic Update content, and then applies those updates to the operating system installation media. The content acquired includes the following: +### Option 2: Use WSUS with UUP Integration -- Setup updates: Fixes to Setup.exe binaries or any files that Setup uses for feature updates. -- Safe OS updates: Fixes for the "safe OS" that are used to update Windows recovery environment (WinRE). -- Servicing stack updates: Fixes that are necessary to address the Windows servicing stack issue and thus required to complete the feature update. -- Latest cumulative update: Installs the latest cumulative quality update. -- Driver updates: Latest version of applicable drivers that have already been published by manufacturers into Windows Update and meant specifically for Dynamic Update. +Starting in March 2023, UUP has been integrated with WSUS and Configuration Manager to bring the same optional content and acquisition benefits of Windows Update to on-premises management solutions. For example: -In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device is not connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This approach addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this value with setupconfig.ini. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. +- FODs and languages will automatically migrate for devices that perform an in-place update using an approved Windows 11, version 22H2 client feature update from WSUS. Similarly, updates such as the combined cumulative update, Setup updates, and Safe OS updates will be included and current based on the month that the feature update was approved. -Starting in Windows 10, version 2004, Dynamic Update can be configured with more options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will reboot again for the latest cumulative update since it was not available during the feature update. +- Devices that upgrade using a local Windows image but use WSUS or Configuration Manager for approving the combined cumulative update will benefit by having support for optional content acquisition in the updated Windows OS, as well as OS self-healing. -One further consideration when using Dynamic Update is the affect on your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Windows 10, version 2004 setup now downloads Dynamic Update content using Delivery Optimization when available. - For devices that aren’t connected to the internet, a subset of the Dynamic Update content is available by using WSUS and the Microsoft catalog. +The content required to enable this will be acquired via WSUS or Configuration Manager, without client endpoints requiring internet connectivity. To enable this improvement, once per major Windows release, a significant download to the WSUS content directory or the distribution point is required. This includes packages to support FOD and language acquisition, along with packages to enable OS self-healing due to corruption. For more information, see [Plan your WSUS deployment](/windows-server/administration/windows-server-update-services/plan/plan-your-wsus-deployment). -### Option 3: Customize the Windows Image before deployment - For many organizations, the deployment workflow involves a Configuration Manager task sequence that performs a media-based update. Some customers either don’t have internet connectivity, or the connectivity is poor and so they can’t enable Dynamic Update. In these cases, we recommend installing optional content prior to deployment. This activity is sometimes referred to as customizing the installation media. +### Option 3: Enable Dynamic Update + +If you're not ready to move to Windows Update, another option is to enable Dynamic Update during a feature update. As soon as a Windows feature update starts, whether via a media-based update or a WSUS-based feature update, Dynamic Update is one of the first steps invoked. Windows Setup connects to an internet-facing URL hosted by Microsoft to fetch Dynamic Update content, and then applies those updates to the operating system installation media. The content acquired includes the following: + +- **Setup updates**: Fixes to Setup.exe binaries or any files that Setup uses for feature updates. +- **Safe OS updates**: Fixes for the *safe OS* that are used to update Windows recovery environment (WinRE). +- **Servicing stack updates**: Fixes that are necessary to address the Windows servicing stack issue and thus required to complete the feature update. +- **Latest cumulative update**: Installs the latest cumulative quality update. +- **Driver updates**: Latest version of applicable drivers that have already been published by manufacturers into Windows Update and meant specifically for Dynamic Update. + +In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device isn't connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This approach addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this value with `setupconfig.ini`. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. + +Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will reboot again for the latest cumulative update since it wasn't available during the feature update. + +One further consideration when using Dynamic Update is the effect on your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Setup downloads Dynamic Update content using Delivery Optimization when available. For devices that aren't connected to the internet, a subset of the Dynamic Update content is available by using WSUS and the Microsoft catalog. + +### Option 4: Customize the Windows Image before deployment + +For many organizations, the deployment workflow involves a Configuration Manager task sequence that performs a media-based update. Some customers either don't have internet connectivity, or the connectivity is poor and so they can't enable Dynamic Update. In these cases, we recommend installing optional content prior to deployment. This activity is sometimes referred to as customizing the installation media. You can customize the Windows image in these ways: -- Applying a cumulative (quality) update +- Applying a cumulative update - Applying updates to the servicing stack -- Applying updates to Setup.exe binaries or other files that Setup uses for feature updates -- Applying updates for the "safe operating system" (SafeOS) that is used for the Windows recovery environment +- Applying updates to `Setup.exe` binaries or other files that setup uses for feature updates +- Applying updates for the *safe operating system* (SafeOS) that's used for the Windows recovery environment - Adding or removing languages - Adding or removing Features on Demand -The benefit of this option is that the Windows image can include those additional languages, language experience features, and other Features on Demand through one-time updates to the image. Then you can use them in an existing task sequence or custom deployment where Setup.exe is involved. The downside of this approach is that it requires some preparation of the image in advance, including scripting with DISM to install the additional packages. It also means the image is the same for all devices that consume it and might contain more features than some users need. For more information on customizing your media, see [Updating Windows 10 media with Dynamic Update packages](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/updating-windows-10-media-with-dynamic-update-packages/ba-p/982477) and our [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073). Also like Option 2, you still have a solution for migration of optional content, but not supporting user-initiated optional content acquisition. Also, there is a variation of this option in which media is updated *on the device* just before installation. This option allows for device-specific image customization based on what's currently installed. +The benefit of this option is that the Windows image can include those additional languages, language experience features, and other Features on Demand through one-time updates to the image. Then you can use them in an existing task sequence or custom deployment where `Setup.exe` is involved. The downside of this approach is that it requires some preparation of the image in advance, including scripting with DISM to install the additional packages. It also means the image is the same for all devices that consume it and might contain more features than some users need. For more information on customizing your media, see [Updating Windows 10 media with Dynamic Update packages](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/updating-windows-10-media-with-dynamic-update-packages/ba-p/982477) and the [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073). Also like Dynamic Update, you still have a solution for migration of optional content, but not supporting user-initiated optional content acquisition. Also, there's a variation of this option in which media is updated *on the device* just before installation. This option allows for device-specific image customization based on what's currently installed. -### Option 4: Install language features during deployment +### Option 5: Install language features during deployment -A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows Setup option [/InstallLangPacks](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using setupconfig.ini. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. +A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows Setup option [/InstallLangPacks](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using `setupconfig.ini`. For more information, see [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview). -When Setup runs, it will inject these packages into the new operating system during installation. It can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages cannot be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, and the architecture-specific Language Pack .cabs from the LPLIP ISO. Also, starting with Windows 10, version 1903, the behavior changed. In Windows 10, version 1809 and earlier, failure to install the packages wasn’t a fatal error. Starting with Windows 10, version 1903, we treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don’t migrate FOD and languages (unless Dynamic Update is enabled). +When Setup runs, it will inject these packages into the new operating system during installation. It can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages can't be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, and the architecture-specific Language Pack .cabs from the LPLIP ISO. We treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don't migrate FOD and languages (unless Dynamic Update is enabled). -This approach has some interesting benefits. The original Windows image doesn’t need to be modified, possibly saving time and scripting. +This approach has some interesting benefits. The original Windows image doesn't need to be modified, possibly saving time and scripting. -### Option 5: Install optional content after deployment +### Option 6: Install optional content after deployment -This option is like Option 3 in that you customize the operating system image with more optional content after it’s deployed. IT pros can extend the behavior of Windows Setup by running their own custom action scripts during and after a feature update. See [Run custom actions during feature update](/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) for details. With this approach, you can create a device-specific migration of optional content by capturing the optional content that is installed in the operating system, and then saving this list to install the same optional content in the new operating system. Like Option 4, you would internally host a network share that contains the source of the optional content packages. Then, during the execution of Setup on the device, capture the list of installed optional content from the source operating system and save. Later, after Setup completes, you use the list to install the optional content, which leaves the user’s device without loss of functionality. +This option is like Option 4 in that you customize the operating system image with more optional content after it's deployed. IT pros can extend the behavior of Windows Setup by running their own custom action scripts during and after a feature update. See [Run custom actions during feature update](/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) for details. With this approach, you can create a device-specific migration of optional content by capturing the optional content that's installed in the operating system, and then saving this list to install the same optional content in the new operating system. Like Option 5, you would internally host a network share that contains the source of the optional content packages. Then, during the execution of Setup on the device, capture the list of installed optional content from the source operating system and save. Later, after Setup completes, you use the list to install the optional content, which leaves the user's device without loss of functionality. -### Option 6: Configure an alternative source for optional content +### Option 7: Configure an alternative source for optional content -Several of the options address ways to address optional content migration issues during an in-place update. To address the second pain point of easily acquiring optional content in the user-initiated case, you can configure each device by using the Specify settings for optional component installation and component repair Group Policy. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. This approach has the disadvantage of more content to be hosted within your network (in addition to the operating system image you might be still deploying to some clients) but has the advantage of acquiring content within your network. Some reminders about this policy: +Several of the options address ways to address optional content migration issues during an in-place update. To address the second pain point of easily acquiring optional content in the user-initiated case, you can configure each device by using the [Specify settings for optional component installation and component repair](/windows/client-management/mdm/policy-csp-admx-servicing#servicing) Group Policy. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. This approach has the disadvantage of more content to be hosted within your network (in addition to the operating system image you might be still deploying to some clients) but has the advantage of acquiring content within your network. Some reminders about this policy: - The file path to the alternate source must be a fully qualified path; multiple locations can be separated by a semicolon. -- This setting does not support installing language packs from Alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired. -- If this setting is not configured or disabled, files will be downloaded from the default Windows Update location, for example Windows Update for Business or WSUS). +- This setting doesn't support installing language packs from an alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired. +- If this setting isn't configured or disabled, files will be downloaded from the default Windows Update location, for example Windows Update for Business or WSUS. -See [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) for more information. +For more information, see [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source). ## Learn more For more information about the Unified Update Platform and the approaches outlined in this article, see the following resources: +- [Plan your WSUS deployment](/windows-server/administration/windows-server-update-services/plan/plan-your-wsus-deployment) - [/InstallLangPacks](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) - [/DynamicUpdate](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) - [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) -- [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073) -- [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) - [Run custom actions during feature update](/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) - [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/) - [Updating Windows installation media with Dynamic Update packages](media-dynamic-update.md) - [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) - +- [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073) +- [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) ## Sample scripts -Options 3 and 5 involve the most scripting. Sample scripts for Option 3 already exist, so we’ll look at sample scripts for [Option 5](#option-5-install-optional-content-after-deployment): Install Optional Content after Deployment. +Options 4 and 6 involve the most scripting. Sample scripts for Option 4 already exist, so we'll look at sample scripts for [Option 6](#option-6-install-optional-content-after-deployment): Install Optional Content after Deployment. ### Creating an optional content repository -To get started, we’ll build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We’ll configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository. +To get started, we'll build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We'll configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository. @@ -715,7 +721,7 @@ Log ("Exiting") ### Adding optional content in the target operating system -After setup has completed successfully, we use success.cmd to retrieve the optional content state from the source operating system and install in the new operating system only if that’s missing. Then, apply the latest monthly update as a final step. +After setup has completed successfully, we use success.cmd to retrieve the optional content state from the source operating system and install in the new operating system only if that's missing. Then, apply the latest monthly update as a final step. ```powershell diff --git a/windows/deployment/update/quality-updates.md b/windows/deployment/update/quality-updates.md deleted file mode 100644 index 4597ce3369..0000000000 --- a/windows/deployment/update/quality-updates.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Monthly quality updates (Windows 10/11) -description: Learn about Windows monthly quality updates to stay productive and protected. -ms.prod: windows-client -author: mestew -ms.localizationpriority: medium -ms.author: mstewart -manager: aaroncz -ms.topic: article -ms.technology: itpro-updates -ms.date: 12/31/2017 ---- - -# Monthly quality updates - -**Applies to** - -- Windows 10 -- Windows 11 - -Windows monthly quality updates help you to stay productive and protected. They provide your users and IT administrators with the security fixes they need, and protect devices so that unpatched vulnerabilities can't be exploited. Quality updates are cumulative; they include all previously released fixes to guard against fragmentation of the operating system (OS). Reliability and vulnerability issues can occur when only a subset of fixes is installed.   - -This article provides details on the types of monthly quality updates that Microsoft provides, and how they help make the overall user experience simple and consistent. - -## Quality updates - -Quality updates are provided on a monthly schedule, as two types of releases: - -1. Non-security releases -2. Combined security + non-security releases - -Non-security releases provide IT admins an opportunity for early validation of that content prior to the combined release. Releases can also be provided outside of the monthly schedule when there is an exceptional need. - -### B releases - -Most people are familiar with what is commonly referred to as **Patch Tuesday** or **Update Tuesday**. These updates are released on the second Tuesday of each month, and are known as the **B release** (where “**B**” refers to the second week in the month). B releases are typically published at 10:00 AM Pacific Time (PST/PDT). - -Because they are cumulative, B releases include both new and previously released security fixes, along with non-security content introduced in the prior month’s **Preview C release** (see the next section). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. B releases are mandatory. - -Channels for availability of B releases include: Windows Update, Windows Server Update Services (WSUS), and the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). - -### C releases - -IT admins have the option to test and validate production-quality releases ahead of the planned B release for the following month. These updates are optional, cumulative, non-security preview releases known as **C releases**. These releases are only offered to the most recent, supported versions of Windows. For example, new features like [News and Interests](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/group-configuration-news-and-interests-on-the-windows-taskbar/ba-p/2281005) might initially be deployed in the prior month’s C preview release, then ship in the following month’s B release. - -For customers to access the C releases, they must navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**. - -IT admins can also validate fixes and features in a preview update by leveraging the [Windows Insider Program for Business](https://insider.windows.com/for-business) or via the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). - -### OOB releases - -Out-of-band (OOB) releases might be provided to fix a recently identified issue or vulnerability. They are used in atypical cases when an issue is detected and cannot wait for the next monthly release, because devices must be updated immediately to address security vulnerabilities or to resolve a quality issue impacting many devices. - -Some key considerations about OOB releases include: - -- OOB releases are always cumulative, and they supersede any prior B or C release. -- The OOB releases will generally require IT admins to deploy off-cycle. -- Some OOB releases are classified as critical and will automatically be pushed to Windows Server Update Services and Windows Update for Business, just like the B releases. -- Some OOB releases are non-critical and only go to the Microsoft Update Catalog for users or organizations to voluntarily seek out the update. - -## More information - -For additional details about the different types of Windows updates like critical, security, drivers, service packs, and more, please see the [Description of the standard terminology used to describe Microsoft software updates](/troubleshoot/windows-client/deployment/standard-terminology-software-updates) and [Introducing a new deployment service for driver and firmware updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-a-new-deployment-service-for-driver-and-firmware/ba-p/2176942). - -## Related topics - -- [Overview of Windows as a service](waas-overview.md) -- [Update Windows 10 in the enterprise](index.md) -- [Quick guide to Windows as a service](waas-quick-start.md) -- [Configure Delivery Optimization for Windows 10 updates](../do/waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](/intune/windows-update-for-business-configure) -- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/release-cycle.md b/windows/deployment/update/release-cycle.md new file mode 100644 index 0000000000..aa65a1cf19 --- /dev/null +++ b/windows/deployment/update/release-cycle.md @@ -0,0 +1,114 @@ +--- +title: Update release cycle for Windows clients +description: Learn about the release cycle of updates for Windows clients to stay productive and protected. +ms.prod: windows-client +author: mestew +ms.localizationpriority: medium +ms.author: mstewart +manager: aaroncz +ms.topic: article +ms.technology: itpro-updates +ms.date: 03/23/2023 +--- + +# Update release cycle for Windows clients + +***(Applies to: Windows 11 & Windows 10)*** + +Windows updates help you to stay productive and protected. They provide your users and IT administrators with the security fixes they need, and protect devices so that unpatched vulnerabilities can't be exploited. Updates for the Windows client OS are typically cumulative. They include all previously released fixes to guard against fragmentation of the operating system. Reliability and vulnerability issues can occur when only a subset of fixes is installed. + +This article provides details on the types of updates that Microsoft provides, and how they help make the overall user experience simple and consistent. + +## Types of update releases + +|Release type | Description | Release cycle | +|---|---|---| +| [Monthly security update release](#monthly-security-update-release)| A cumulative update release that includes both security and non-security content | Second Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | +| [Optional non-security preview release](#optional-non-security-preview-release)| An optional cumulative update release that's typically used for early validation of the monthly security update release| Fourth Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) | +| [Out-of-band (OOB) release](#oob-releases) | Resolves a recently identified issue or vulnerability | As needed | +| [Annual feature update](#annual-feature-updates) | An update with new features and enhancements that also changes the Windows version | Once a year in the second half of the calendar year | +| [Continuous innovation for Windows 11](#continuous-innovation-for-windows-11)| Introduces new features and enhancements for Windows 11 | Periodically included in an optional non-security preview release then in the monthly security update releases | + + +## Monthly security update release + +Most people are familiar with the **monthly security update release**. The **monthly security update release** is published on the second Tuesday of each month, typically at 10:00 AM Pacific Time (PST/PDT). This release might commonly be referred to as: + +- Patch Tuesday +- Update Tuesday +- B week releases (meaning the second week of the month) +- Quality updates +- Security updates +- Latest cumulative update (LCU) + + +**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with non-security content introduced in the prior month's [**Optional non-security preview release**](#optional-non-security-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory. + +Monthly security update releases are available through the following channels: + +- Windows Update +- Windows Server Update Services (WSUS) +- The [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx) + +Many update management tools, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Intune](/mem/intune/), rely on these channels for update deployment. + +## Optional non-security preview release + +**Optional non-security preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, non-security preview releases. New features might initially be deployed in the prior month's **optional non-security preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows. + +**Optional non-security preview releases** might commonly be referred to as: + +- C or D week releases (meaning the third or fourth week of the month) +- Preview updates +- Preview CU +- LCU preview + +> [!Important] +> Starting in April 2023, all **optional non-security preview releases** will be released on the fourth Tuesday of the month. This change in release cadence gives admins a consistent time cycle for testing and validating fixes and features. + +To access the optional non-security preview release: +- Navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**. +- Use [Windows Insider Program for Business](https://insider.windows.com/for-business) +- Use the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). + +## OOB releases + +**Out-of-band (OOB) releases** might be provided to fix a recently identified issue or vulnerability. They're used in atypical cases when an issue is detected and can't wait for the next monthly release, because devices must be updated immediately to address security vulnerabilities or to resolve a quality issue impacting many devices. **Out-of-band (OOB) releases** are provided outside of the monthly schedule when there's an exceptional need. + +Some key considerations about OOB releases include: + +- OOB releases are always cumulative. + - OOB releases supersede any prior monthly security update and optional non-security preview release. +- OOB releases generally require IT admins to deploy off-cycle. +- Some OOB releases are classified as critical. + - Critical OOB releases are automatically available to WSUS and Windows Update for Business, just like the monthly security update releases. +- Some OOB releases are classified as non-critical. + - Non-critical releases only go to the Microsoft Update Catalog for users or organizations to voluntarily obtain the update. + +## Continuous innovation for Windows 11 + +Starting with Windows 11, version 22H2, new features and enhancements are introduced periodically to provide continuous innovation for Windows 11. These features and enhancements use the normal update servicing channels you're already familiar with. At first, new features are introduced with an **optional non-security preview release** and gradually rolled out to unmanaged clients. These new features are released later as part of a **monthly security update release**. + +Some of the new features may be disruptive to organizations. By default, these select features are turned off temporarily for all managed devices until the next annual feature update is installed. In this scenario, a device is considered managed if it uses one of the following to determine which updates to install: + +- Windows Update for Business + - Devices that have updates managed Microsoft Intune use Windows Update for Business +- WSUS + - Devices that have updates managed by Configuration Manager use WSUS + +Features that are turned off by default are listed in the KB article for the monthly cumulative update. If you want to enable these features, there's a client policy that allows admins to **Enable features introduced via servicing that are off by default**. For more information about this policy, see [Enable features introduced via servicing that are off by default](waas-configure-wufb.md#enable-features-introduced-via-servicing-that-are-off-by-default). + +## Annual feature updates + +Annual feature updates are released in the second half of the calendar year. These updates are typically cumulative and include all previously released fixes. They also include new features and enhancements. The annual feature update marks the start of the support lifecycle: +- 24 months of support for Home and Pro editions of Windows +- 36 months of support for Enterprise and Education editions + +For more information, see [Windows lifecycle FAQ](/lifecycle/faq/windows). + +## Release information + +For more information about specific releases, see: + + +[!INCLUDE [Windows update history and release health links](./includes/update-history.md)] diff --git a/windows/deployment/update/safeguard-holds.md b/windows/deployment/update/safeguard-holds.md index 7bb8cf8dca..6535bc2084 100644 --- a/windows/deployment/update/safeguard-holds.md +++ b/windows/deployment/update/safeguard-holds.md @@ -1,6 +1,6 @@ --- title: Safeguard holds -description: What are safeguard holds, how can you tell if one is in effect, and what to do about it +description: What are safeguard holds, how can you tell if one is in effect, and what to do about it. ms.prod: windows-client author: mestew ms.localizationpriority: medium @@ -8,7 +8,9 @@ ms.author: mstewart manager: aaroncz ms.topic: article ms.technology: itpro-updates -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.date: 12/31/2017 --- @@ -19,11 +21,11 @@ ms.date: 12/31/2017 - Windows 10 - Windows 11 -Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply safeguard holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use safeguard holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available. +Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply safeguard holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use safeguard holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe effect (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround isn't immediately available. Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows client. -The lifespan of safeguard holds varies depending on the time required to investigate and fix an issue. During this time, Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the safeguard hold. Once we release the safeguard hold, Windows Update will resume offering new operating system versions to devices. +The safeguard holds lifespan varies depending on the time required to investigate and fix an issue. During this time, Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the safeguard hold. Once we release the safeguard hold, Windows Update will resume offering new operating system versions to devices. Safeguard holds only affect devices that use the Windows Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments. @@ -31,19 +33,19 @@ IT admins managing updates using the [Windows Update for Business deployment ser ## Am I affected by a safeguard hold? -IT admins can use [Windows Update for Business reports](wufb-reports-overview.md) to monitor various update health metrics for devices in their organization. The reports provide a list of [active Safeguard Holds](wufb-reports-workbook.md#bkmk_update-group-feature) to provide you insight into the safeguard holds that are preventing devices from updating or upgrading. +IT admins can use [Windows Update for Business reports](wufb-reports-overview.md) to monitor various update health metrics for devices in their organization. The reports provide a list of [active Safeguard Holds](wufb-reports-workbook.md#bkmk_update-group-feature) to provide you with insight into the safeguard holds that are preventing devices from updating or upgrading. -Windows Update for Business reports identifies safeguard holds by their 8-digit identifiers. For safeguard holds associated with publicly discussed known issues, you can find additional details about the issue on the [Windows release health](/windows/release-health/) dashboard by searching for the safeguard hold ID on the **Known issues** page for the relevant release. +Windows Update for Business reports identifies safeguard holds by their 8-digit identifiers. For safeguard holds associated with publicly discussed known issues, you can find more details about the issue on the [Windows release health](/windows/release-health/) dashboard by searching for the safeguard hold ID on the **Known issues** page for the relevant release. On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message: ![Feature update message reading "The Windows 10 May 2020 Update is on its way. Once it's ready for your device, you'll see the update available on this page.](images/safeguard-hold-notification.png) -This message means that the device is protected by one or more safeguard holds. When the issue is resolved and the update is safe to install, we will release the safeguard hold and the update can resume safely. +This message means that the device is protected by one or more safeguard holds. When the issue is resolved and the update is safe to install, we'll release the safeguard hold and the update can resume safely. ## What can I do? -We recommend that you do not attempt to manually update until issues have been resolved and holds released. +We recommend that you don't attempt to manually update until issues have been resolved and holds released. > [!CAUTION] > Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out. diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index a7a6c5b72e..30228a83de 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -6,8 +6,10 @@ author: mestew ms.localizationpriority: high ms.author: mstewart manager: aaroncz -ms.collection: highpri, tier2 -ms.topic: article +ms.collection: + - highpri + - tier2 +ms.topic: conceptual ms.technology: itpro-updates ms.date: 12/31/2017 --- @@ -39,9 +41,9 @@ Servicing stack update are released depending on new issues or vulnerabilities. Both Windows client and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates. -Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. +Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest monthly security update release and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. -Beginning with the February 2021 LCU, Microsoft will publish all future cumulative updates and SSUs for Windows 10, version 2004 and later together as one cumulative monthly update to the normal release category in WSUS. +Microsoft publishes all cumulative updates and SSUs for Windows 10, version 2004 and later together as one cumulative monthly update to the normal release category in WSUS. ## Is there any special guidance? diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md index 2cd4b2f59a..8d6b9f249b 100644 --- a/windows/deployment/update/update-compliance-configuration-manual.md +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -8,7 +8,7 @@ ms.author: mstewart ms.localizationpriority: medium ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Manually Configuring Devices for Update Compliance diff --git a/windows/deployment/update/update-compliance-configuration-mem.md b/windows/deployment/update/update-compliance-configuration-mem.md index aab7607865..7f4c13868a 100644 --- a/windows/deployment/update/update-compliance-configuration-mem.md +++ b/windows/deployment/update/update-compliance-configuration-mem.md @@ -8,7 +8,7 @@ ms.author: mstewart ms.localizationpriority: medium ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Configuring Microsoft Intune devices for Update Compliance diff --git a/windows/deployment/update/update-compliance-configuration-script.md b/windows/deployment/update/update-compliance-configuration-script.md index 2e2c5100e7..567ff4f6f1 100644 --- a/windows/deployment/update/update-compliance-configuration-script.md +++ b/windows/deployment/update/update-compliance-configuration-script.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.localizationpriority: medium ms.topic: article -ms.date: 06/16/2022 +ms.date: 04/01/2023 ms.technology: itpro-updates --- diff --git a/windows/deployment/update/update-compliance-delivery-optimization.md b/windows/deployment/update/update-compliance-delivery-optimization.md index 37aad4dc7a..6c6fe09823 100644 --- a/windows/deployment/update/update-compliance-delivery-optimization.md +++ b/windows/deployment/update/update-compliance-delivery-optimization.md @@ -8,7 +8,7 @@ ms.author: mstewart ms.localizationpriority: medium ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Delivery Optimization in Update Compliance diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md index 51a728c4c8..94fffb85ab 100644 --- a/windows/deployment/update/update-compliance-feature-update-status.md +++ b/windows/deployment/update/update-compliance-feature-update-status.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Feature Update Status diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index a7272569b6..d5167f79ad 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -6,9 +6,11 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.localizationpriority: medium -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.topic: article -ms.date: 05/03/2022 +ms.date: 04/01/2023 ms.technology: itpro-updates --- diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 323cc9207e..4a047e610a 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -8,7 +8,7 @@ ms.author: mstewart ms.localizationpriority: medium ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Monitor Windows Updates with Update Compliance diff --git a/windows/deployment/update/update-compliance-need-attention.md b/windows/deployment/update/update-compliance-need-attention.md index 2dcb66b2bf..51212b396d 100644 --- a/windows/deployment/update/update-compliance-need-attention.md +++ b/windows/deployment/update/update-compliance-need-attention.md @@ -7,7 +7,7 @@ ms.author: mstewart ms.topic: article ms.prod: windows-client ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Needs attention! @@ -22,7 +22,7 @@ ms.date: 12/31/2017 ![Needs attention section.](images/UC_workspace_needs_attention.png) -The **Needs attention!** section provides a breakdown of all Windows client device and update issues detected by Update Compliance. The summary tile for this section counts the number of devices that have issues, while the blades within break down the issues encountered. Finally, a [list of queries](#list-of-queries) blade in this section contains queries that provide values but do not fit within any other main section. +The **Needs attention!** section provides a breakdown of all Windows client device and update issues detected by Update Compliance. The summary tile for this section counts the number of devices that have issues, while the blades within breakdown the issues encountered. Finally, a [list of queries](#list-of-queries) blade in this section contains queries that provide values but don't fit within any other main section. > [!NOTE] > The summary tile counts the number of devices that have issues, while the blades within the section break down the issues encountered. A single device can have more than one issue, so these numbers might not add up. @@ -32,15 +32,15 @@ The different issues are broken down by Device Issues and Update Issues: ## Device Issues * **Missing multiple security updates:** This issue occurs when a device is behind by two or more security updates. These devices might be more vulnerable and should be investigated and updated. -* **Out of support OS Version:** This issue occurs when a device has fallen out of support due to the version of Windows client it is running. When a device has fallen out of support, it will no longer receive important security updates, and might be vulnerable. These devices should be updated to a supported version of Windows client. +* **Out of support OS Version:** This issue occurs when a device has fallen out of support due to the version of Windows client it's running. When a device has fallen out of support, it will no longer receive important security updates, and might be vulnerable. These devices should be updated to a supported version of Windows client. ## Update Issues * **Failed:** This issue occurs when an error halts the process of downloading and applying an update on a device. Some of these errors might be transient, but should be investigated further to be sure. -* **Cancelled**: This issue occurs when a user cancels the update process. +* **Canceled**: This issue occurs when a user cancels the update process. * **Rollback**: This issue occurs when a fatal error occurs during a feature update, and the device is rolled back to the previous version. -* **Uninstalled**: This issue occurs when a feature update is uninstalled from a device by a user or an administrator. Note that this might not be a problem if the uninstallation was intentional, but is highlighted as it might need attention. -* **Progress stalled:** This issue occurs when an update is in progress, but has not completed over a period of 7 days. +* **Uninstalled**: This issue occurs when a feature update is uninstalled from a device by a user or an administrator. This might not be a problem if the uninstallation was intentional, but is highlighted as it might need attention. +* **Progress stalled:** This issue occurs when an update is in progress, but hasn't completed over a period of 7 days. Selecting any of the issues will take you to a [Log Analytics](/azure/log-analytics/query-language/get-started-analytics-portal) view with all devices that have the given issue. @@ -49,4 +49,4 @@ Selecting any of the issues will take you to a [Log Analytics](/azure/log-analyt ## List of Queries -The **List of Queries** blade is in the **Needs Attention** section of Update Compliance. This blade contains a list of queries with a description and a link to the query. These queries contain important meta-information that did not fit within any specific section or were listed to serve as a good starting point for modification into custom queries. +The **List of Queries** blade is in the **Needs Attention** section of Update Compliance. This blade contains a list of queries with a description and a link to the query. These queries contain important meta-information that didn't fit within any specific section or were listed to serve as a good starting point for modification into custom queries. diff --git a/windows/deployment/update/update-compliance-privacy.md b/windows/deployment/update/update-compliance-privacy.md index c99c4f7dc8..345802748b 100644 --- a/windows/deployment/update/update-compliance-privacy.md +++ b/windows/deployment/update/update-compliance-privacy.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Privacy in Update Compliance diff --git a/windows/deployment/update/update-compliance-safeguard-holds.md b/windows/deployment/update/update-compliance-safeguard-holds.md index 071e0da12f..f74ace76b9 100644 --- a/windows/deployment/update/update-compliance-safeguard-holds.md +++ b/windows/deployment/update/update-compliance-safeguard-holds.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Safeguard Holds diff --git a/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md b/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md index 125d1a6de3..07a33a985c 100644 --- a/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md +++ b/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # WaaSDeploymentStatus diff --git a/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md b/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md index 9e8a73b355..0db7e2035a 100644 --- a/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md +++ b/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # WaaSInsiderStatus diff --git a/windows/deployment/update/update-compliance-schema-waasupdatestatus.md b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md index 3a83aad3f6..6f885bf11a 100644 --- a/windows/deployment/update/update-compliance-schema-waasupdatestatus.md +++ b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # WaaSUpdateStatus diff --git a/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md b/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md index a16ae4d5a3..901babfe34 100644 --- a/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md +++ b/windows/deployment/update/update-compliance-schema-wudoaggregatedstatus.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # WUDOAggregatedStatus diff --git a/windows/deployment/update/update-compliance-schema-wudostatus.md b/windows/deployment/update/update-compliance-schema-wudostatus.md index 60ae8e5991..3cd9bfa64f 100644 --- a/windows/deployment/update/update-compliance-schema-wudostatus.md +++ b/windows/deployment/update/update-compliance-schema-wudostatus.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # WUDOStatus diff --git a/windows/deployment/update/update-compliance-schema.md b/windows/deployment/update/update-compliance-schema.md index 5c760ad6d0..163144290a 100644 --- a/windows/deployment/update/update-compliance-schema.md +++ b/windows/deployment/update/update-compliance-schema.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Update Compliance Schema diff --git a/windows/deployment/update/update-compliance-security-update-status.md b/windows/deployment/update/update-compliance-security-update-status.md index 829e562eba..874e7b6ff9 100644 --- a/windows/deployment/update/update-compliance-security-update-status.md +++ b/windows/deployment/update/update-compliance-security-update-status.md @@ -7,7 +7,7 @@ author: mestew ms.author: mstewart ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Security Update Status diff --git a/windows/deployment/update/update-compliance-using.md b/windows/deployment/update/update-compliance-using.md index a8eb872ebf..4220a931ba 100644 --- a/windows/deployment/update/update-compliance-using.md +++ b/windows/deployment/update/update-compliance-using.md @@ -8,7 +8,7 @@ ms.author: mstewart ms.localizationpriority: medium ms.topic: article ms.technology: itpro-updates -ms.date: 12/31/2017 +ms.date: 04/01/2023 --- # Use Update Compliance diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 5de1f980ef..abf55e970a 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -210,7 +210,7 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving | GPO for Windows 10, version 1607 or later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Do not include drivers with Windows Updates** | \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | | MDM for Windows 10, version 1607 and later:
../Vendor/MSFT/Policy/Config/Update/
**ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | -## Enable features introduced via servicing that are off by default +## Enable features introduced via servicing that are off by default New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default. Features that are turned off by default are listed in the KB article for the monthly cumulative update. Typically, a feature is selected to be off by default because it either impacts the user experience or IT administrators significantly. @@ -221,8 +221,8 @@ The features that are turned off by default from servicing updates will be enabl | Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 11, version 22H2 and later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage end user experience > **Enable features introduced via servicing that are off by default**| \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | -| MDM for Windows 11, version 22H2 and later:
../Vendor/MSFT/Policy/Config/Update/
**[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol)** | \Microsoft\PolicyManager\default\Update\AllowTemporaryEnterpriseFeatureControl | +| GPO for Windows 11, version 22H2 with [kb5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage end user experience > **Enable features introduced via servicing that are off by default**| \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | +| MDM for Windows 11, version 22H2 with [kb5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
../Vendor/MSFT/Policy/Config/Update/
**[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol)** | \Microsoft\PolicyManager\default\Update\AllowTemporaryEnterpriseFeatureControl | ## Summary: MDM and Group Policy settings for Windows 10, version 1703 and later diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 231671f5d7..93ab10c8bc 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -6,8 +6,10 @@ author: mestew ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: how-to +ms.collection: + - highpri + - tier2 ms.technology: itpro-updates ms.date: 12/31/2017 --- diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index 2cd41a5831..54da439aad 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -6,8 +6,10 @@ ms.prod: windows-client author: mestew ms.localizationpriority: medium ms.author: mstewart -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: overview +ms.collection: + - highpri + - tier2 ms.technology: itpro-updates ms.date: 12/31/2017 --- diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md index 184b4e1c7a..2585696606 100644 --- a/windows/deployment/update/waas-overview.md +++ b/windows/deployment/update/waas-overview.md @@ -6,8 +6,10 @@ author: mestew ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: overview +ms.collection: + - highpri + - tier2 ms.technology: itpro-updates ms.date: 12/31/2017 --- diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index ea9726a38e..e95825d0c0 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -1,13 +1,15 @@ --- -title: Manage device restarts after updates (Windows 10) +title: Manage device restarts after updates description: Use Group Policy settings, mobile device management (MDM), or Registry to configure when devices will restart after a Windows 10 update is installed. ms.prod: windows-client author: mestew ms.localizationpriority: medium ms.author: mstewart manager: aaroncz -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: how-to +ms.collection: + - highpri + - tier2 ms.technology: itpro-updates ms.date: 12/31/2017 --- diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 19c313af57..dd358bb8a2 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -6,8 +6,10 @@ ms.localizationpriority: medium author: mestew ms.author: mstewart manager: aaroncz -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: how-to +ms.collection: + - highpri + - tier2 ms.technology: itpro-updates ms.date: 03/09/2023 --- diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 7c7b83dcd3..7d696f704d 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -5,9 +5,11 @@ ms.prod: windows-client author: mestew ms.localizationpriority: medium ms.author: mstewart -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 manager: aaroncz -ms.topic: article +ms.topic: how-to ms.technology: itpro-updates ms.date: 02/28/2023 --- diff --git a/windows/deployment/update/windows-update-logs.md b/windows/deployment/update/windows-update-logs.md index 0f3dcb78bb..b4ab1cd282 100644 --- a/windows/deployment/update/windows-update-logs.md +++ b/windows/deployment/update/windows-update-logs.md @@ -5,8 +5,10 @@ ms.prod: windows-client author: mestew ms.author: mstewart manager: aaroncz -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: troubleshooting +ms.collection: + - highpri + - tier2 ms.technology: itpro-updates ms.date: 12/31/2017 --- diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index 60af41b984..e5e5fca659 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -1,13 +1,15 @@ --- title: Log files and resolving upgrade errors -manager: aaroncz -ms.author: frankroj description: Learn how to interpret and analyze the log files that are generated during the Windows 10 upgrade process. ms.prod: windows-client author: frankroj +manager: aaroncz +ms.author: frankroj ms.localizationpriority: medium -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: troubleshooting +ms.collection: + - highpri + - tier2 ms.technology: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 62aa926553..3b512451f5 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -1,14 +1,16 @@ --- title: SetupDiag -manager: aaroncz -ms.author: frankroj description: SetupDiag works by examining Windows Setup log files. This article shows how to use the SetupDiag tool to diagnose Windows Setup errors. ms.prod: windows-client -author: frankroj -ms.localizationpriority: medium -ms.topic: article -ms.collection: highpri, tier2 ms.technology: itpro-deploy +author: frankroj +manager: aaroncz +ms.author: frankroj +ms.localizationpriority: medium +ms.topic: troubleshooting +ms.collection: + - highpri + - tier2 ms.date: 10/28/2022 --- diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index a49e89b8ed..ea38090b1d 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -6,8 +6,10 @@ ms.author: frankroj ms.prod: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article -ms.collection: highpri, tier2 +ms.topic: conceptual +ms.collection: + - highpri + - tier2 ms.technology: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index 7e8b1b574e..9cd2a2aca9 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -1,13 +1,15 @@ --- title: Windows 10 upgrade paths (Windows 10) -manager: aaroncz -ms.author: frankroj description: You can upgrade to Windows 10 from a previous version of Windows if the upgrade path is supported. ms.prod: windows-client ms.localizationpriority: medium author: frankroj -ms.topic: article -ms.collection: highpri, tier2 +manager: aaroncz +ms.author: frankroj +ms.topic: conceptual +ms.collection: + - highpri + - tier2 ms.technology: itpro-deploy ms.date: 10/28/2022 --- diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md index eb67085ba9..dae39a70bd 100644 --- a/windows/deployment/usmt/usmt-overview.md +++ b/windows/deployment/usmt/usmt-overview.md @@ -1,14 +1,16 @@ --- -title: User State Migration Tool (USMT) Overview (Windows 10) +title: User State Migration Tool (USMT) overview description: Learn about using User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. +ms.prod: windows-client +ms.technology: itpro-deploy +author: frankroj manager: aaroncz ms.author: frankroj -ms.prod: windows-client -author: frankroj ms.date: 11/01/2022 -ms.topic: article -ms.collection: highpri, tier2 -ms.technology: itpro-deploy +ms.topic: overview +ms.collection: + - highpri + - tier2 --- # User State Migration Tool (USMT) overview diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md index 3239732839..7e377402d1 100644 --- a/windows/deployment/usmt/usmt-recognized-environment-variables.md +++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md @@ -1,14 +1,16 @@ --- -title: Recognized Environment Variables (Windows 10) +title: Recognized environment variables description: Learn how to use environment variables to identify folders that may be different on different computers. +ms.prod: windows-client +ms.technology: itpro-deploy manager: aaroncz ms.author: frankroj -ms.prod: windows-client author: frankroj ms.date: 11/01/2022 -ms.topic: article -ms.collection: highpri, tier2 -ms.technology: itpro-deploy +ms.topic: conceptual +ms.collection: + - highpri + - tier2 --- # Recognized environment variables diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index 2495b86782..9304d88783 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -10,7 +10,9 @@ ms.technology: itpro-fundamentals ms.localizationpriority: medium ms.date: 11/07/2022 ms.topic: how-to -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 --- # Activate using Active Directory-based activation diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 72dd3657cf..3401c97658 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -1,16 +1,18 @@ --- -title: Activate using Key Management Service (Windows 10) +title: Activate using Key Management Service description: Learn how to use Key Management Service (KMS) to activate Windows. ms.reviewer: nganguly +ms.prod: windows-client +ms.technology: itpro-fundamentals +author: frankroj manager: aaroncz ms.author: frankroj -ms.prod: windows-client -author: frankroj ms.localizationpriority: medium ms.date: 11/07/2022 -ms.topic: article -ms.collection: highpri, tier2 -ms.technology: itpro-fundamentals +ms.topic: how-to +ms.collection: + - highpri + - tier2 --- # Activate using Key Management Service diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index 87d0a1a2d5..d3c1320d86 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -67,8 +67,12 @@ The procedures in this guide are summarized in the following table. An estimate > [!NOTE] > If the request to add features fails, retry the installation by typing the command again. -2. Download [SQL Server 2014 SP2](https://www.microsoft.com/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. -3. When you've downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +2. Download [SQL Server](https://www.microsoft.com/evalcenter/evaluate-sql-server-2022) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. + + > [!NOTE] + > The rest of this article describes the installation of SQL Server 2014. If you download a different version of SQL Server, you may need to modify the installation steps. + +1. When you've downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\SQLServer2014SP2-FullSlipstream-x64-ENU.iso diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 924489e2c6..59914650f4 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -7,7 +7,9 @@ ms.localizationpriority: medium author: frankroj ms.author: frankroj manager: aaroncz -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.topic: conceptual ms.date: 11/23/2022 appliesto: diff --git a/windows/deployment/windows-autopatch/index.yml b/windows/deployment/windows-autopatch/index.yml index 2105efa402..f80f14cdd2 100644 --- a/windows/deployment/windows-autopatch/index.yml +++ b/windows/deployment/windows-autopatch/index.yml @@ -14,7 +14,9 @@ metadata: ms.custom: intro-hub-or-landing ms.prod: windows-client ms.technology: itpro-updates - ms.collection: highpri, tier2 + ms.collection: + - highpri + - tier2 # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index ce6d60f33d..10b2232d41 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -82,7 +82,7 @@ Windows Autopatch provides a permanent pause of a Windows feature update deploym ### Pausing and resuming a release > [!CAUTION] -> It's recommended to only use Windows Autopatch's Release management blade to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). +> You should only pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release) on Windows Autopatch managed devices using the Windows Autopatch Release management blade. Do **not** use the Microsoft Intune end-user experience flows to pause or resume Windows Autopatch managed devices. If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). > [!IMPORTANT] > Pausing or resuming an update can take up to eight hours to be applied to devices. Windows Autopatch uses Microsoft Intune as its management solution and that's the average frequency devices take to communicate back to Microsoft Intune with new instructions to pause, resume or rollback updates.

For more information, see [how long does it take for devices to get a policy, profile, or app after they are assigned from Microsoft Intune](/mem/intune/configuration/device-profile-troubleshoot#how-long-does-it-take-for-devices-to-get-a-policy-profile-or-app-after-they-are-assigned).

@@ -109,7 +109,7 @@ If you've paused an update, the specified release will have the **Customer Pause Windows Autopatch doesn’t support the rollback of Windows feature updates. > [!CAUTION] -> It's recommended to only use Windows Autopatch's Release management blade to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). +> You should only pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release) on Windows Autopatch managed devices using the Windows Autopatch Release management blade. Do **not** use the Microsoft Intune end-user experience flows to pause or resume Windows Autopatch managed devices. If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). ## Contact support diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md index ddf26cae19..f715f1bba8 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications.md @@ -1,7 +1,7 @@ --- title: Windows quality update communications description: This article explains Windows quality update communications -ms.date: 05/30/2022 +ms.date: 03/30/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -32,10 +32,26 @@ Communications are posted to, as appropriate for the type of communication, to t | Communication | Location | Timing | Description | | ----- | ----- | ----- | ----- | -| Release schedule |
  • Message center
  • Messages blade
  • Email sent to your specified [admin contacts](../deploy/windows-autopatch-admin-contacts.md)
      • | At least seven days prior to the second Tuesday of the month| Notification of the planned release window for each ring. | +| Release schedule |
      • Messages blade
      • Email sent to your specified [admin contacts](../deploy/windows-autopatch-admin-contacts.md)
          • | At least seven days prior to the second Tuesday of the month| Notification of the planned release window for each ring. | | Release start | Same as release schedule | The second Tuesday of every month. | Notification that the update is now being released into your environment. | | Release summary | Same as release schedule | The fourth Tuesday of every month. | Informs you of the percentage of eligible devices that were patched during the release. | +### Opt out of receiving emails for standard communications + +> [!IMPORTANT] +> This feature is in **public preview**. This feature is being actively developed and may not be complete. You can test and use these features in production environments and provide feedback. + +If you don't want to receive standard communications for Windows Updates releases via email, you can choose to opt out. + +**To opt out of receiving emails for standard communications:** + +1. Go to the **[Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)**. +2. Go to **Windows Autopatch** > **Tenant administration** > select **Admin contacts**. +3. Select the admin contact you want to opt out for. +4. Select **Edit Contact**. +5. Clear the **Send me emails for Windows update releases and status** checkbox in the fly-in pane. +6. Select **Save** to apply the changes. + ## Communications during release The most common type of communication during a release is a customer advisory. Customer advisories are posted to both Message center and the Messages blade of the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) shortly after Autopatch becomes aware of the new information. diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md index e18ee9ef48..1a345f2942 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp.md @@ -67,8 +67,8 @@ Windows Autopatch understands the importance of not disrupting end users but als | Policy | Description | | ----- | ----- | -| [Active hours start](/windows/client-management/mdm/policy-csp-update#update-activehoursstart) | This policy controls the start of the protected window where devices won't restart. Supported values are from zero through to 23. Zero is 12∶00AM, representing the hours of the day in local time on that device. | -| [Active hours end](/windows/client-management/mdm/policy-csp-update#update-activehoursend) | This policy controls the end of the protected window where devices won't restart. Supported values are from zero through to 23. Zero is 12∶00AM, representing the hours of the day in local time on that device. This value can be no more than 12 hours after the time set in active hours start. | +| [Active hours start](/windows/client-management/mdm/policy-csp-update#activehoursstart) | This policy controls the start of the protected window where devices won't restart. Supported values are from zero through to 23. Zero is 12∶00AM, representing the hours of the day in local time on that device. | +| [Active hours end](/windows/client-management/mdm/policy-csp-update#activehoursend) | This policy controls the end of the protected window where devices won't restart. Supported values are from zero through to 23. Zero is 12∶00AM, representing the hours of the day in local time on that device. This value can be no more than 12 hours after the time set in active hours start. | > [!IMPORTANT] > Both policies must be deployed for them to work as expected. @@ -76,4 +76,4 @@ Windows Autopatch understands the importance of not disrupting end users but als A device won't restart during active hours unless it has passed the date specified by the update deadline policy. Once the device has passed the deadline policy, the device will update as soon as possible. > [!IMPORTANT] -> If your devices must be updated at a specific date or time, they aren't suitable for Windows Autopatch. Allowing you to choose specific dates to update devices would disrupt the rollout schedule, and prevent us from delivering the service level objective. The use of any of the following CSPs on a managed device will render it ineligible for management:
          • [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday)
          • [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek)
          • [Update/ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek)
          • [Update/ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek)
          • [Update/ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek)
          • [Update/ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek)
          • [Update/ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime)
          +> If your devices must be updated at a specific date or time, they aren't suitable for Windows Autopatch. Selecting specific dates to update devices would disrupt the rollout schedule, and prevent Windows Autopatch from delivering the [service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective). The use of any of the following CSPs on a managed device will render it ineligible for the service level objective:
          • [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#scheduledinstallday)
          • [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstalleveryweek)
          • [Update/ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallfirstweek)
          • [Update/ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallfourthweek)
          • [Update/ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallsecondweek)
          • [Update/ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallthirdweek)
          • [Update/ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#scheduledinstalltime)
          diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index c687882aaf..974c419ebd 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -38,7 +38,7 @@ For a device to be eligible for Windows quality updates as a part of Windows Aut ## Windows quality update releases -Windows Autopatch deploys the [B release of Windows quality updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-quality-updates-primer/ba-p/2569385) that are released on the second Tuesday of each month. +Windows Autopatch deploys the [Monthly security update releases](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-quality-updates-primer/ba-p/2569385) that are released on the second Tuesday of each month. To release updates to devices in a gradual manner, Windows Autopatch deploys a set of mobile device management (MDM) policies to each update deployment ring to control the rollout. There are three primary policies that are used to control Windows quality updates: @@ -115,7 +115,7 @@ Windows Autopatch schedules and deploys required Out of Band (OOB) updates relea ### Pausing and resuming a release > [!CAUTION] -> It's recommended to only use Windows Autopatch's Release management blade to pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). +> You should only pause and resume [Windows quality](windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release) on Windows Autopatch managed devices using the Windows Autopatch Release management blade. Do **not** use the Microsoft Intune end-user experience flows to pause or resume Windows Autopatch managed devices. If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). The service-level pause of updates is driven by the various software update deployment-related signals Windows Autopatch receives from Windows Update for Business, and several other product groups within Microsoft. diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md index 492e76ed01..bd21b2a994 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals.md @@ -1,6 +1,6 @@ --- -title: Windows quality update signals -description: This article explains the Windows quality update signals +title: Windows quality update release signals +description: This article explains the Windows quality update release signals ms.date: 01/24/2023 ms.prod: windows-client ms.technology: itpro-updates @@ -14,7 +14,7 @@ ms.reviewer: hathind # Windows quality update signals -Windows Autopatch monitors a specific set of signals and aims to release quality updates both quickly and safely. The service doesn't comprehensively monitor every use case in Windows. +Windows Autopatch monitors a specific set of signals and aims to release the monthly security update both quickly and safely. The service doesn't comprehensively monitor every use case in Windows. If there's a scenario that is critical to your business, which isn't monitored by Windows Autopatch, you're responsible for testing and taking any follow-up actions, like requesting to pause the release. @@ -24,9 +24,9 @@ Before being released to the Test ring, Windows Autopatch reviews several data s | Pre-release signal | Description | | ----- | ----- | -| Windows Payload Review | The contents of the B release are reviewed to help focus your update testing on areas that have changed. If any relevant changes are detected, a [customer advisory](../operate/windows-autopatch-windows-quality-update-communications.md#communications-during-release) will be sent out. | -| C-Release Review - Internal Signals | Windows Autopatch reviews active incidents associated with the previous C release to understand potential risks in the B release. | -| C-Release Review - Social Signals | Windows Autopatch monitors social signals to better understand potential risks associated with the B release. | +| Windows Payload Review | The contents of the monthly security update release are reviewed to help focus your update testing on areas that have changed. If any relevant changes are detected, a [customer advisory](../operate/windows-autopatch-windows-quality-update-communications.md#communications-during-release) will be sent out. | +| Optional non-security preview release review - Internal Signals | Windows Autopatch reviews active incidents associated with the previous optional non-security preview release to understand potential risks in the monthly security update release. | +| Optional non-security preview release review - Social Signals | Windows Autopatch monitors social signals to better understand potential risks associated with the monthly security update release. | ## Early signals diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md index 508c99fa46..6bc2b3018b 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md @@ -53,7 +53,7 @@ However, if an update has already started for a particular deployment ring, Wind #### Scheduled install > [!NOTE] -> If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective). +> This feature isn't suitable for business critical workloads because Windows Autopatch cannot guarantee that devices will always update and restart in the specified time.

          If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective).

          While the Windows Autopatch default options will meet the majority of the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. The **Scheduled install** cadence type will prevent forced restarts and interruptions to critical business activities for end users, thereby minimizing disruptions. Upon selecting the **Scheduled install** cadence type, any previously set deadlines and grace periods will be removed. The expectation is that devices would only update and restart according to the time specified. diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md index 35df585aa1..c515617ae7 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md @@ -1,6 +1,6 @@ --- title: What is Windows Autopatch? -description: Details what the service is and shortcuts to articles +description: Details what the service is and shortcuts to articles. ms.date: 07/11/2022 ms.prod: windows-client ms.technology: itpro-updates @@ -9,7 +9,9 @@ ms.localizationpriority: medium author: tiaraquan ms.author: tiaraquan manager: dougeby -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.reviewer: hathind --- diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index 0c4b7973da..a180a874ec 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -45,14 +45,13 @@ This setting must be turned on to avoid a "lack of permissions" error when we in | ----- | ----- | | Not ready | Allow access to unlicensed admins should be turned on. Without this setting enabled, errors can occur when we try to access your Azure AD organization for service. You can safely enable this setting without worrying about security implications. The scope of access is defined by the roles assigned to users, including our operations staff.

          For more information, see [Unlicensed admins](/mem/intune/fundamentals/unlicensed-admins). | -### Windows 10 and later update rings +### Update rings for Windows 10 or later -Your "Windows 10 and later update ring" policy in Intune must not target any Windows Autopatch devices. +Your "Update rings for Windows 10 or later" policy in Intune must not target any Windows Autopatch devices. | Result | Meaning | | ----- | ----- | -| Not ready | You have an "update ring" policy that targets all devices, all users, or both.

          To resolve, change the policy to use an assignment that targets a specific Azure Active Directory (AD) group that doesn't include any Windows Autopatch devices.

          For more information, see [Manage Windows 10 and later software updates in Intune](/mem/intune/protect/windows-update-for-business-configure).

          | -| Advisory | Both the **Modern Workplace Devices - All** and **Modern Workplace - All** Azure AD groups are groups that we create after you enroll in Windows Autopatch.

          You can continue with enrollment. However, you must resolve the advisory prior to deploying your first device. To resolve the advisory, see [Maintain the Windows Autopatch environment](../operate/windows-autopatch-maintain-environment.md).

          | +| Advisory | You have an "update ring" policy that targets all devices, all users, or both. Windows Autopatch will also create our own update ring policies during enrollment. To avoid conflicts with Windows Autopatch devices, we'll exclude our devices group from your existing update ring policies that target all devices, all users, or both. You must consent to this change when you go to enroll your tenant.

          | ## Azure Active Directory settings diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md index 47d7aa1795..e8e54695c8 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-microsoft-365-policies.md @@ -26,8 +26,8 @@ Window Autopatch deploys mobile device management (MDM) policies to configure Mi | ----- | ----- | ----- | | Set updates to occur automatically | Enabled | Enable automatic updates | | Specify a location to look for updates | Blank | Don't use this setting since it overwrites the update branch | -| Update branch | Monthly Enterprise | Supported branch for Windows Autopatch | +| Update channel | Monthly Enterprise | Supported channel for Windows Autopatch | | Specify the version of Microsoft 365 Apps to update to | Variable | Used to roll back to a previous version if an error occurs | -| Set a deadline by when updates must be applied | 3 | Update deadline | +| Set a deadline by when updates must be applied | 7 | Update deadline | | Hide update notifications from users | Turned off | Users should be notified when Microsoft 365 Apps are being updated | | Hide the option to turn on or off automatic Office updates | Turned on | Prevents users from disabling automatic updates | diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 03a4316178..576eade6e5 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 03/21/2023 +ms.date: 04/04/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -18,12 +18,21 @@ This article lists new and updated feature releases, and service releases, with Minor corrections such as typos, style, or formatting issues aren't listed. +## April 2023 + +### April 2023 service release + +| Message center post number | Description | +| ----- | ----- | +| [MC536881](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Take action: Review Windows Autopatch Tenant management blade for potential action required to prevent inactive status | + ## March 2023 ### March feature releases or updates | Article | Description | | ----- | ----- | +| [Windows quality update communications](../operate/windows-autopatch-windows-quality-update-communications.md#standard-communications) | Added guidance on how to [opt out of receiving emails for standard communications](../operate/windows-autopatch-windows-quality-update-communications.md#opt-out-of-receiving-emails-for-standard-communications) (public preview) | | [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md) |
          • Added support for subscription versions of Microsoft Project and Visio desktop apps
          • Updated device eligibility criteria
          • Clarified update controls
          | | [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) | New [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) feature. This feature is in public preview
        • [MC524715](https://admin.microsoft.com/adminportal/home#/MessageCenter)
          • | @@ -31,6 +40,8 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Message center post number | Description | | ----- | ----- | +| [MC536880](https://admin.microsoft.com/adminportal/home#/MessageCenter) | New Features in Windows Autopatch Public Preview | +| [MC535259](https://admin.microsoft.com/adminportal/home#/MessageCenter) | March 2023 Windows Autopatch baseline configuration update | | [MC527439](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Prepare for Windows Autopatch Groups | | [MC524715](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Public preview - Customize Windows Update settings | diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 4ca53207b6..4ebfe798e1 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -1,13 +1,15 @@ --- title: Demonstrate Autopilot deployment -manager: aaroncz description: Step-by-step instructions on how to set up a virtual machine with a Windows Autopilot deployment. ms.prod: windows-client ms.technology: itpro-deploy ms.localizationpriority: medium author: frankroj ms.author: frankroj -ms.collection: highpri, tier2 +manager: aaroncz +ms.collection: + - highpri + - tier2 ms.topic: tutorial ms.date: 10/28/2022 --- diff --git a/windows/deployment/windows-autopilot/index.yml b/windows/deployment/windows-autopilot/index.yml index 82cba08343..78ac058a36 100644 --- a/windows/deployment/windows-autopilot/index.yml +++ b/windows/deployment/windows-autopilot/index.yml @@ -9,11 +9,13 @@ metadata: ms.topic: landing-page ms.prod: windows-client ms.technology: itpro-deploy - ms.collection: highpri, tier1 + ms.collection: + - highpri + - tier1 author: frankroj ms.author: frankroj manager: aaroncz - ms.date: 10/28/2022 #Required; mm/dd/yyyy format. + ms.date: 10/28/2022 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 34186301e4..8eb8641a31 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -12,8 +12,9 @@ metadata: ms.prod: windows-client ms.collection: - highpri - author: dougeby #Required; your GitHub user alias, with correct capitalization. - ms.author: dougeby #Required; microsoft alias of author; optional team alias. + - tier1 + author: aczechowski #Required; your GitHub user alias, with correct capitalization. + ms.author: aaroncz #Required; microsoft alias of author; optional team alias. ms.date: 10/01/2021 #Required; mm/dd/yyyy format. localization_priority: medium diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index dc1df5efdf..c94b44464a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -370,8 +370,8 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file that is generating the events. - **BlockAlreadyInbox** The uplevel runtime block on the file already existed on the current OS. - **BlockingApplication** Indicates whether there are any application issues that interfere with the upgrade due to the file in question. -- **DisplayGenericMessage** Will be a generic message be shown for this file? -- **DisplayGenericMessageGated** Indicates whether a generic message be shown for this file. +- **DisplayGenericMessage** Will a generic message be shown for this file? +- **DisplayGenericMessageGated** Indicates whether a generic message will be shown for this file. - **HardBlock** This file is blocked in the SDB. - **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? - **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? @@ -1314,8 +1314,8 @@ The following fields are available: - **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. - **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. - **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. -- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. -- **RunResult** The hresult of the Appraiser diagnostic data run. +- **RunOnline** Indicates if appraiser was able to connect to Windows Update and therefore is making decisions using up-to-date driver coverage information. +- **RunResult** The result of the Appraiser diagnostic data run. - **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. - **StoreHandleIsNotNull** Obsolete, always set to false - **TelementrySent** Indicates whether diagnostic data was successfully sent. @@ -1560,7 +1560,7 @@ The following fields are available: - **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store. - **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. - **OSEdition** Retrieves the version of the current OS. -- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc +- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc. - **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). - **OSSKU** Retrieves the Friendly Name of OS Edition. - **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines. @@ -1715,7 +1715,7 @@ The following fields are available: - **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display. - **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display. - **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display. -- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches . +- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches. - **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches - **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine - **NumberofInternalDisplays** Retrieves the number of internal displays in a machine. @@ -1807,7 +1807,7 @@ The following fields are available: - **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured - **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting - **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. -- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? +- **OSAssessmentFeatureOutOfDate** How many days has it been since the last feature update was released but the device did not install it? - **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? - **OSAssessmentForQualityUpdate** Is the device on the latest quality update? - **OSAssessmentForSecurityUpdate** Is the device on the latest security update? @@ -2099,7 +2099,7 @@ The following fields are available: - **pendingDecision** Indicates the cause of reboot, if applicable. - **primitiveExecutionContext** The state during system startup when the uninstall was completed. - **revisionVersion** The revision number of the security update being uninstalled. -- **transactionCanceled** Indicates whether the uninstall was cancelled. +- **transactionCanceled** Indicates whether the uninstall was canceled. ### CbsServicingProvider.CbsQualityUpdateInstall @@ -2397,7 +2397,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3091,7 +3091,7 @@ The following fields are available: - **secondsInMixedMode** The amount of time (in seconds) that the cluster has been in mixed mode (nodes with different operating system versions in the same cluster). - **securityLevel** The cluster parameter: security level. - **securityLevelForStorage** The cluster parameter: security level for storage. -- **sharedVolumeBlockCacheSize** Specifies the block cache size for shared for shared volumes. +- **sharedVolumeBlockCacheSize** Specifies the block cache size shared volumes. - **shutdownTimeoutMinutes** Specifies the amount of time it takes to time out when shutting down. - **upNodeCount** Specifies the number of nodes that are up (online). - **useClientAccessNetworksForCsv** The cluster parameter: use client access networks for CSV. @@ -3191,7 +3191,7 @@ This event captures basic checksum data about the device inventory items stored The following fields are available: -- **DeviceCensus** A count of devicecensus objects in cache. +- **DeviceCensus** A count of device census objects in cache. - **DriverPackageExtended** A count of driverpackageextended objects in cache. - **FileSigningInfo** A count of file signing objects in cache. - **InventoryApplication** A count of application objects in cache. @@ -3204,7 +3204,7 @@ The following fields are available: - **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache. - **InventoryDeviceMediaClass** A count of device media objects in cache. - **InventoryDevicePnp** A count of device Plug and Play objects in cache. -- **InventoryDeviceUsbHubClass** A count of device usb objects in cache +- **InventoryDeviceUsbHubClass** A count of device USB objects in cache - **InventoryDriverBinary** A count of driver binary objects in cache. - **InventoryDriverPackage** A count of device objects in cache. - **InventoryMiscellaneousOfficeAddIn** A count of office add-in objects in cache. @@ -3988,7 +3988,7 @@ The following fields are available: - **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. - **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. - **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. -- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osPlatform** The operating system family within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. - **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. - **osVersion** The primary version of the operating system. '' if unknown. Default: ''. - **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. @@ -4037,7 +4037,7 @@ The following fields are available: - **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." - **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appBrandCode** The 4-digit brand code under which the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). - **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). - **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. - **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. @@ -4085,7 +4085,7 @@ The following fields are available: - **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. - **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. - **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. -- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osPlatform** The operating system family within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. - **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. - **osVersion** The primary version of the operating system. '' if unknown. Default: ''. - **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. @@ -4999,7 +4999,7 @@ The following fields are available: - **AdditionalReasons** If an action has been assessed as inapplicable, the additional logic prevented it. - **CachedEngineVersion** The engine DLL version that is being used. - **EventInstanceID** A unique identifier for event instance. -- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed. - **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it. - **IsExecutingAction** If the action is presently being executed. - **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). @@ -5033,7 +5033,7 @@ The following fields are available: - **CachedEngineVersion** The engine DLL version that is being used. - **EventInstanceID** A unique identifier for event instance. -- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed. - **FailedParseActions** The list of actions that were not successfully parsed. - **ParsedActions** The list of actions that were successfully parsed. - **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). @@ -5077,7 +5077,7 @@ The following fields are available: - **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled. - **DriverSyncPassPerformed** Were drivers scanned this time? - **EventInstanceID** A globally unique identifier for event instance. -- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed. - **ExtendedMetadataCabUrl** Hostname that is used to download an update. - **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. - **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan. @@ -5147,8 +5147,8 @@ The following fields are available: - **ClientVersion** Version number of the software distribution client - **DeviceModel** Device model as defined in the system bios - **EventInstanceID** A globally unique identifier for event instance -- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc. -- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver". +- **EventScenario** Indicates the purpose of the event - whether because scan started, succeeded, failed, etc. +- **EventType** Possible values are "Child", "Bundle", "Release" or "Driver". - **FlightId** The specific id of the flight the device is getting - **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.) - **RevisionNumber** Identifies the revision number of this specific piece of content @@ -5189,7 +5189,7 @@ The following fields are available: - **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority. - **DownloadScenarioId** A unique ID for a given download, used to tie together Windows Update and Delivery Optimizer events. - **EventInstanceID** A globally unique identifier for event instance. -- **EventScenario** Indicates the purpose for sending this event: whether because the software distribution just started downloading content; or whether it was cancelled, succeeded, or failed. +- **EventScenario** Indicates the purpose for sending this event: whether because the software distribution just started downloading content; or whether it was canceled, succeeded, or failed. - **EventType** Identifies the type of the event (Child, Bundle, or Driver). - **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. - **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. @@ -5241,8 +5241,8 @@ The following fields are available: - **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client - **ClientVersion** The version number of the software distribution client -- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed -- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver" +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed +- **EventType** Possible values are "Child", "Bundle", "Release" or "Driver" - **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough - **FileId** A hash that uniquely identifies a file - **FileName** Name of the downloaded file @@ -5274,7 +5274,7 @@ The following fields are available: - **IsNetworkMetered** Indicates whether Windows considered the current network to be ?metered" - **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any - **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any -- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby) +- **PowerState** Indicates the power state of the device at the time of heartbeat (DC, AC, Battery Saver, or Connected Standby) - **RelatedCV** The previous correlation vector that was used by the client, before swapping with a new one - **ResumeCount** Number of times this active download has resumed from a suspended state - **RevisionNumber** Identifies the revision number of this specific piece of content @@ -5307,7 +5307,7 @@ The following fields are available: - **DeviceModel** The device model. - **DriverPingBack** Contains information about the previous driver and system state. - **EventInstanceID** A globally unique identifier for event instance. -- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was canceled, succeeded, or failed. - **EventType** Possible values are Child, Bundle, or Driver. - **ExtendedErrorCode** The extended error code. - **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode is not specific enough. @@ -5675,7 +5675,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. +This event sends a summary of all the update agent mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5958,7 +5958,7 @@ The following fields are available: - **Setup360Result** The result of Setup360 (HRESULT used to diagnose errors). - **Setup360Scenario** The Setup360 flow type (for example, Boot, Media, Update, MCT). - **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). -- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, canceled. - **TestId** An ID that uniquely identifies a group of events. - **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId. @@ -5980,7 +5980,7 @@ The following fields are available: - **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). -- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. - **TestId** ID that uniquely identifies a group of events. - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. @@ -6002,7 +6002,7 @@ The following fields are available: - **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). -- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. - **TestId** ID that uniquely identifies a group of events. - **WuId** Windows Update client ID. @@ -6024,7 +6024,7 @@ The following fields are available: - **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). -- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled - **TestId** A string to uniquely identify a group of events. - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId. @@ -6068,7 +6068,7 @@ The following fields are available: - **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). -- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, canceled. - **TestId** ID that uniquely identifies a group of events. - **WuId** Windows Update client ID. @@ -6090,7 +6090,7 @@ The following fields are available: - **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. - **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT). - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). -- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. - **TestId** A string to uniquely identify a group of events. - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. @@ -6112,7 +6112,7 @@ The following fields are available: - **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. - **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). -- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. - **TestId** A string to uniquely identify a group of events. - **WuId** Windows Update client ID. @@ -6224,10 +6224,10 @@ The following fields are available: - **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. - **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. - **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. -- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). -- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. - **TestId** A string to uniquely identify a group of events. - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. @@ -6296,7 +6296,7 @@ The following fields are available: ### Microsoft.Windows.WERVertical.OSCrash -This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. +This event sends binary data from the collected dump file whenever a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. The following fields are available: @@ -6715,7 +6715,7 @@ The following fields are available: - **CatalogId** The Store Catalog ID for the product being installed. - **ProductId** The Store Product ID for the product being installed. -- **SkuId** Specfic edition of the app being updated. +- **SkuId** Specific edition of the app being updated. ### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest @@ -7069,7 +7069,7 @@ The following fields are available: - **flightMetadata** Contains the FlightId and the build being flighted. - **objectId** Unique value for each Update Agent mode. - **relatedCV** Correlation vector value generated from the latest USO scan. -- **result** Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled. +- **result** Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Canceled, 3 = Blocked, 4 = BlockCanceled. - **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios). - **sessionId** Unique value for each Update Agent mode attempt. @@ -7379,7 +7379,7 @@ The following fields are available: - **detectionBlockreason** The reason detection did not complete. - **detectionRetryMode** Indicates whether we will try to scan again. - **errorCode** The error code returned for the current process. -- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed. +- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was canceled, succeeded, or failed. - **flightID** The unique identifier for the flight (Windows Insider pre-release build) should be delivered to the device, if applicable. - **interactive** Indicates whether the user initiated the session. - **networkStatus** Indicates if the device is connected to the internet. @@ -7410,7 +7410,7 @@ This event indicates the reboot was postponed due to needing a display. The data The following fields are available: - **displayNeededReason** Reason the display is needed. -- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed. - **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours. - **revisionNumber** Revision number of the update. - **updateId** Update ID. @@ -7528,7 +7528,7 @@ This event indicates that an enabled GameMode process prevented the device from The following fields are available: -- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was canceled, succeeded, or failed. - **gameModeReason** Name of the enabled GameMode process that prevented the device from restarting to complete an update. - **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. @@ -7632,13 +7632,13 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after an update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **powermenuNewOptions** The new options after the power menu changed. - **powermenuOldOptions** The old options before the power menu changed. -- **rebootPendingMinutes** If the power menu changed because a reboot is pending due to a update, this indicates how long that reboot has been pending. +- **rebootPendingMinutes** If the power menu changed because a reboot is pending due to an update, this indicates how long that reboot has been pending. - **wuDeviceid** The device ID recorded by Windows Update if the power menu changed because a reboot is pending due to an update. @@ -8122,7 +8122,7 @@ The following fields are available: - **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. - **FlightId** Unique identifier for each flight. -- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **InstanceId** Unique GUID that identifies each instance of setuphost.exe. - **MitigationScenario** The update scenario in which the mitigation was executed. - **RelatedCV** Correlation vector value generated from the latest USO scan. - **ReparsePointsFailed** Number of reparse points that are corrupted but we failed to fix them. @@ -8145,7 +8145,7 @@ The following fields are available: - **ClientId** In the Windows Update scenario, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. - **EditionIdUpdated** Determine whether EditionId was changed. - **FlightId** Unique identifier for each flight. -- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **InstanceId** Unique GUID that identifies each instance of setuphost.exe. - **MitigationScenario** The update scenario in which the mitigation was executed. - **ProductEditionId** Expected EditionId value based on GetProductInfo. - **ProductType** Value returned by GetProductInfo. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index b0975595c9..46a32b7e45 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -5475,7 +5475,7 @@ The following fields are available: - **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." - **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appBrandCode** The 4-digit brand code under which the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). - **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). - **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. - **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index c1efb0d547..2b7ee3b4fa 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -5877,7 +5877,7 @@ The following fields are available: - **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." - **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appBrandCode** The 4-digit brand code under which the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). - **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). - **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. - **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index a001e395da..5b73a85111 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -5212,7 +5212,7 @@ The following fields are available: - **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." - **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appBrandCode** The 4-digit brand code under which the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). - **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). - **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. - **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 38c4f1639f..4984e4e28e 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -215,6 +215,8 @@ href: threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md - name: Get support href: threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md + - name: Guide to removing Microsoft Baseline Security Analyzer (MBSA) + href: threat-protection/mbsa-removal-and-guidance.md - name: Virus & threat protection items: - name: Overview diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 7591454011..5d4dda26a8 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -76,11 +76,46 @@ "identity-protection/**/*.md": "paoloma", "threat-protection/windows-firewall/*.md": "aaroncz" }, + "appliesto":{ + "identity-protection/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10" + ], + "identity-protection/credential-guard/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], + "identity-protection/smart-cards/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], + "identity-protection/user-account-control/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], + "identity-protection/virtual-smart-cards/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ] + }, "ms.reviewer":{ "identity-protection/hello-for-business/*.md": "erikdau", "identity-protection/credential-guard/*.md": "zwhittington", "identity-protection/access-control/*.md": "sulahiri", - "threat-protection/windows-firewall/*.md": "paoloma" + "threat-protection/windows-firewall/*.md": "paoloma", + "identity-protection/vpn/*.md": "pesmith" }, "ms.collection":{ "identity-protection/hello-for-business/*.md": "tier1", diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index 4ddce5cb4e..6bec9ee14c 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -1,13 +1,14 @@ --- +ms.date: 11/22/2022 title: Access Control Overview description: Description of the access controls in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. -ms.prod: windows-client ms.topic: article -ms.date: 11/22/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.technology: itpro-security +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Access Control Overview diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index f6baab162b..a2c64c37a0 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,15 +1,17 @@ --- +ms.date: 12/05/2022 title: Local Accounts description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. -ms.date: 12/05/2022 +ms.topic: conceptual ms.collection: - highpri - tier2 -ms.topic: article appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.technology: itpro-security +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Local Accounts @@ -60,7 +62,7 @@ Group Policy can be used to control the use of the local Administrators group au > [!IMPORTANT] > -> - Blank passwords are not allowed in the versions designated in the **Applies To** list at the beginning of this topic. +> - Blank passwords are not allowed. > > - Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index e7d4d83f53..317ef89a50 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -1,26 +1,13 @@ --- title: Configure S/MIME for Windows description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, also known as a certificate, can read them. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 07/27/2017 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security --- # Configure S/MIME for Windows -**Applies to** -- Windows 10 -- Windows 11 - S/MIME stands for Secure/Multipurpose Internet Mail Extensions, and provides an added layer of security for email sent to and from an Exchange ActiveSync (EAS) account. S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. ## About message encryption @@ -31,11 +18,11 @@ Encrypted messages can be read only by recipients who have a certificate. If you ## About digital signatures -A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they’re using an email client that supports S/MIME. +A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they're using an email client that supports S/MIME. ## Prerequisites -- [S/MIME is enabled for Exchange accounts](/microsoft-365/security/office-365-security/s-mime-for-message-signing-and-encryption) (on-premises and Office 365). Users can’t use S/MIME signing and encryption with a personal account such as Outlook.com. +- [S/MIME is enabled for Exchange accounts](/microsoft-365/security/office-365-security/s-mime-for-message-signing-and-encryption) (on-premises and Office 365). Users can't use S/MIME signing and encryption with a personal account such as Outlook.com. - Valid Personal Information Exchange (PFX) certificates are installed on the device. - [How to Create PFX Certificate Profiles in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/mt131410(v=technet.10)) @@ -49,11 +36,11 @@ On the device, perform the following steps: (add select certificate) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. - :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png"::: + :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png"::: 3. Tap **Email security**. - :::image type="content" alt-text="email security settings." source="images/emailsecurity.png"::: + :::image type="content" alt-text="email security settings." source="images/emailsecurity.png"::: 4. In **Select an account**, select the account for which you want to configure S/MIME options. @@ -74,7 +61,7 @@ On the device, perform the following steps: (add select certificate) 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. - :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png"::: + :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png"::: ## Read signed or encrypted messages @@ -90,5 +77,5 @@ When you receive a signed email, the app provides a feature to install correspon 3. Tap **Install.** - :::image type="content" alt-text="message security information." source="images/installcert.png"::: + :::image type="content" alt-text="message security information." source="images/installcert.png":::   diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index c8ed1adc92..ca9c7acd52 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -1,11 +1,8 @@ --- +ms.date: 08/17/2017 title: Additional mitigations description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard. -ms.date: 08/17/2017 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Additional mitigations diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index bde6066c0c..d48686101c 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,11 +1,8 @@ --- +ms.date: 01/06/2023 title: Considerations when using Windows Defender Credential Guard description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard. -ms.date: 01/06/2023 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Considerations when using Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index c9ed9e42c7..f6fafc39c0 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,11 +1,8 @@ --- +ms.date: 08/17/2017 title: How Windows Defender Credential Guard works description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them. -ms.date: 08/17/2017 ms.topic: conceptual -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # How Windows Defender Credential Guard works diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 07d9647887..f05c26620f 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -1,11 +1,8 @@ --- +ms.date: 11/28/2022 title: Windows Defender Credential Guard - Known issues description: Windows Defender Credential Guard - Known issues in Windows Enterprise ms.topic: article -ms.date: 11/28/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard: Known issues diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index a4f523f78b..eb38ab1250 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -6,9 +6,6 @@ ms.collection: - highpri - tier2 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Manage Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 42fbe2a663..6b9dbeadc9 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -3,9 +3,6 @@ title: Windows Defender Credential Guard protection limits (Windows) description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows. Learn more with this guide. ms.date: 08/17/2017 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard protection limits diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 164f0f776e..ea7bf02bae 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -3,9 +3,6 @@ title: Windows Defender Credential Guard requirements description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security. ms.date: 12/27/2021 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard requirements diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 0ab05c22ab..af00a1aef1 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -6,9 +6,6 @@ ms.topic: article ms.collection: - highpri - tier2 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Protect derived domain credentials with Windows Defender Credential Guard diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index 6b2de2aa60..d4f8cceb8d 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -1,17 +1,8 @@ --- title: Enterprise Certificate Pinning description: Enterprise certificate pinning is a Windows feature for remembering; or pinning a root issuing certificate authority, or end entity certificate to a given domain name. -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-security -ms.localizationpriority: medium +ms.topic: conceptual ms.date: 07/27/2017 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 --- # Enterprise Certificate Pinning @@ -22,7 +13,7 @@ Enterprise certificate pinning helps reduce man-in-the-middle attacks by enablin > [!NOTE] > External domain names, where the certificate issued to these domains is issued by a public certificate authority, are not ideal for enterprise certificate pinning. -Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site’s chain that authenticates servers matches a restricted set of certificates. +Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site's chain that authenticates servers matches a restricted set of certificates. These restrictions are encapsulated in a Pin Rules Certificate Trust List (CTL) that is configured and deployed to Windows 10 computers. Any site certificate that triggers a name mismatch causes Windows to write an event to the CAPI2 event log and prevents the user from navigating to the web site using Microsoft Edge or Internet Explorer. @@ -97,7 +88,7 @@ The **Certificate** element can have the following attributes. | **File** | Path to a file containing one or more certificates. Where the certificate(s) can be encoded as:
          - single certificate
          - p7b
          - sst
          These files can also be Base64 formatted. All **Site** elements included in the same **PinRule** element can match any of these certificates. | Yes (File, Directory, or Base64 must be present). | | **Directory** | Path to a directory containing one or more of the above certificate files. Skips any files not containing any certificates. | Yes (File, Directory, or Base64 must be present). | | **Base64** | Base64 encoded certificate(s). Where the certificate(s) can be encoded as:
          - single certificate
          - p7b
          - sst
          This allows the certificates to be included in the XML file without a file directory dependency.
          Note:
          You can use **certutil -encode** to convert a .cer file into base64. You can then use Notepad to copy and paste the base64 encoded certificate into the pin rule. | Yes (File, Directory, or Base64 must be present). | -| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule.
          If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element’s certificates.
          If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and excludes the certificate(s) from the Pin Rule in the generated CTL.
          For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml).| No.| +| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule.
          If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element's certificates.
          If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and excludes the certificate(s) from the Pin Rule in the generated CTL.
          For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml).| No.| #### Site element @@ -154,7 +145,7 @@ Use **certutil.exe** to apply your certificate pinning rules to your reference c The **setreg** argument takes a secondary argument that determines the location of where certutil writes the certificate pining rules. This secondary argument is **chain\PinRules**. The last argument you provide is the name of file that contains your certificate pinning rules in certificate trust list format (.stl). -You’ll pass the name of the file as the last argument; however, you need to prefix the file name with the '@' symbol as shown in the following example. +You'll pass the name of the file as the last argument; however, you need to prefix the file name with the '@' symbol as shown in the following example. You need to perform this command from an elevated command prompt. ```code @@ -174,7 +165,7 @@ Certutil writes the binary information to the following registration location: ### Deploying Enterprise Pin Rule Settings using Group Policy -You’ve successfully created a certificate pinning rules XML file. +You've successfully created a certificate pinning rules XML file. From the XML file you've created a certificate pinning trust list file, and you've applied the contents of that file to your reference computer from which you can run the Group Policy Management Console. Now you need to configure a Group Policy object to include the applied certificate pin rule settings and deploy it to your environment. @@ -182,7 +173,7 @@ Sign-in to the reference computer using domain administrator equivalent credenti 1. Start the **Group Policy Management Console** (gpmc.msc) 2. In the navigation pane, expand the forest node and then expand the domain node. -3. Expand the node that contains your Active Directory’s domain name +3. Expand the node that contains your Active Directory's domain name 4. Select the **Group Policy objects** node. Right-click the **Group Policy objects** node and click **New**. 5. In the **New GPO** dialog box, type _Enterprise Certificate Pinning Rules_ in the **Name** text box and click **OK**. 6. In the content pane, right-click the **Enterprise Certificate Pinning Rules** Group Policy object and click **Edit**. @@ -227,16 +218,16 @@ icacls %PinRulesLogDir% /grant *S-1-5-12:(OI)(CI)(F) icacls %PinRulesLogDir% /inheritance:e /setintegritylevel (OI)(CI)L ``` -Whenever an application verifies a TLS/SSL certificate chain that contains a server name matching a DNS name in the server certificate, Windows writes a .p7b file consisting of all the certificates in the server’s chain to one of three child folders: +Whenever an application verifies a TLS/SSL certificate chain that contains a server name matching a DNS name in the server certificate, Windows writes a .p7b file consisting of all the certificates in the server's chain to one of three child folders: - AdminPinRules Matched a site in the enterprise certificate pinning rules. - AutoUpdatePinRules Matched a site in the certificate pinning rules managed by Microsoft. - NoPinRules - Didn’t match any site in the certificate pin rules. + Didn't match any site in the certificate pin rules. -The output file name consists of the leading eight ASCII hex digits of the root’s SHA1 thumbprint followed by the server name. +The output file name consists of the leading eight ASCII hex digits of the root's SHA1 thumbprint followed by the server name. For example: - `D4DE20D0_xsi.outlook.com.p7b` @@ -255,7 +246,7 @@ You can then copy and paste the output of the cmdlet into the XML file. ![Representing a date.](images/enterprise-certificate-pinning-representing-a-date.png) For simplicity, you can truncate decimal point (.) and the numbers after it. -However, be certain to append the uppercase “Z” to the end of the XML date string. +However, be certain to append the uppercase "Z" to the end of the XML date string. ```code 2015-05-11T07:00:00.2655691Z @@ -264,7 +255,7 @@ However, be certain to append the uppercase “Z” to the end of the XML date s ## Converting an XML Date -You can also use Windows PowerShell to validate and convert an XML date into a human readable date to validate it’s the correct date. +You can also use Windows PowerShell to validate and convert an XML date into a human readable date to validate it's the correct date. ![Converting an XML date.](images/enterprise-certificate-pinning-converting-an-xml-date.png) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 1ca04993a0..c4e5d43423 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -1,9 +1,7 @@ --- title: Multi-factor unlock description: Learn how Windows offers multi-factor device unlock by extending Windows Hello with trusted signals. -ms.date: 03/09/2023 -appliesto: -- ✅ Windows 10 and later +ms.date: 03/30/2023 ms.topic: how-to --- # Multi-factor unlock diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index fa405ca079..8838fb1b97 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -2,8 +2,6 @@ title: Windows Hello for Business cloud-only deployment description: Learn how to configure Windows Hello for Business in a cloud-only deployment scenario. ms.date: 06/23/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Cloud-only deployment diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index 6607d17abb..f825873fc9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -3,8 +3,11 @@ title: Plan an adequate number of Domain Controllers for Windows Hello for Busin description: Learn how to plan for an adequate number of Domain Controllers to support Windows Hello for Business deployments. ms.date: 03/10/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: conceptual --- # Plan an adequate number of Domain Controllers for Windows Hello for Business deployments diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md index 5d311af3bb..2b3a033a16 100644 --- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md +++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md @@ -2,8 +2,6 @@ title: Windows Hello and password changes description: Learn the impact of changing a password when using Windows Hello. ms.date: 03/15/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: conceptual --- # Windows Hello and password changes diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index e6a01bb2b8..f1a275279e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -2,8 +2,6 @@ title: Windows Hello biometrics in the enterprise (Windows) description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition. ms.date: 01/12/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index c765eb789e..744816323d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -3,8 +3,11 @@ title: Prepare and deploy Active Directory Federation Services in an on-premises description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business on-premises certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Prepare and deploy Active Directory Federation Services - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 5d92d9dcb7..b3059ee0c0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -2,12 +2,9 @@ title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario ms.collection: - - highpri - - tier1 +- highpri +- tier1 ms.date: 12/12/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later ms.topic: tutorial --- # Configure Windows Hello for Business group policy settings - on-premises certificate Trust diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index 629e59b1e2..455d4055a2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -3,8 +3,11 @@ title: Validate Active Directory prerequisites in an on-premises certificate tru description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Validate Active Directory prerequisites - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index c7c5b09a61..c7b67abec3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -3,8 +3,11 @@ title: Validate and Deploy MFA for Windows Hello for Business with certificate t description: Validate and deploy multi-factor authentication (MFA) for Windows Hello for Business in an on-premises certificate trust model. ms.date: 12/13/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 27f2375bae..6174ed348a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an on-premises ce description: Configure and validate the Public Key Infrastructure the Public Key Infrastructure when deploying Windows Hello for Business in a certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index 0775ea4e9d..70a5ee4feb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -3,8 +3,11 @@ title: Windows Hello for Business deployment guide for the on-premises certifica description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Deployment guide overview - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 22f170e86e..9646f16b66 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -2,8 +2,6 @@ title: Windows Hello for Business Deployment Overview description: Use this deployment guide to successfully deploy Windows Hello for Business in an existing environment. ms.date: 02/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Deployment Overview diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md index 8c8fd3b65d..655c8961da 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md @@ -2,8 +2,6 @@ title: Windows Hello for Business Deployment Known Issues description: A Troubleshooting Guide for Known Windows Hello for Business Deployment Issues ms.date: 05/03/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Known Deployment Issues diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md index 6104c34401..56d613052d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md @@ -2,9 +2,6 @@ title: Windows Hello for Business deployment guide for the on-premises key trust model description: Learn how to deploy Windows Hello for Business in an on-premises, key trust model. ms.date: 12/12/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later ms.topic: tutorial --- # Deployment guide overview - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 7d4f20063d..0b255e1d93 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -6,8 +6,6 @@ ms.collection: - tier1 ms.topic: article ms.date: 03/15/2023 -appliesto: -- ✅ Windows 10 and later --- # Deploy certificates for remote desktop (RDP) sign-in diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index e1b28aec6f..23537daa14 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -1,10 +1,8 @@ --- -title: Windows Hello errors during PIN creation (Windows) -description: When you set up Windows Hello in Windows 10/11, you may get an error during the Create a work PIN step. +title: Windows Hello errors during PIN creation +description: When you set up Windows Hello, you may get an error during the Create a work PIN step. ms.topic: troubleshooting -ms.date: 05/05/2018 -appliesto: -- ✅ Windows 10 and later +ms.date: 03/31/2023 --- # Windows Hello errors during PIN creation diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index bb59a07821..0a5083fd99 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -9,8 +9,6 @@ metadata: - tier1 ms.topic: faq ms.date: 03/09/2023 - appliesto: - - ✅ Windows 10 and later title: Common questions about Windows Hello for Business summary: Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This Frequently Asked Questions (FAQ) article is intended to help you learn more about Windows Hello for Business. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index d6d35b189a..2f6540362a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -2,8 +2,6 @@ title: Dual Enrollment description: Learn how to configure Windows Hello for Business dual enrollment. Also, learn how to configure Active Directory to support Domain Administrator enrollment. ms.date: 09/09/2019 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md index 5fea59fc25..28401253c2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -2,8 +2,6 @@ title: Dynamic lock description: Learn how to configure dynamic lock on Windows devices via group policies. This feature locks a device when a Bluetooth signal falls below a set value. ms.date: 03/10/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index ea7e72e5d4..916a8890bf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.date: 03/10/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 2f1c460668..45fc8c784f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -2,8 +2,6 @@ title: Remote Desktop description: Learn how Windows Hello for Business supports using biometrics with remote desktop ms.date: 02/24/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article ms.collection: - tier1 diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index 27dde9400e..f25bac5b47 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works - Authentication description: Learn about the authentication flow for Windows Hello for Business. ms.date: 02/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business and Authentication diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 6d250848d5..219e82d35c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works - Provisioning description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments. ms.date: 2/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Provisioning diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index b3765851fa..76368b1c12 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works - technology and terms description: Explore technology and terms associated with Windows Hello for Business. Learn how Windows Hello for Business works. ms.date: 10/08/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index 40e094e6c7..93bfd6d56a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works description: Learn how Windows Hello for Business works, and how it can help your users authenticate to services. ms.date: 05/05/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # How Windows Hello for Business works in Windows Devices diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index fbed200f77..3eeb4f536d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -2,8 +2,6 @@ title: Use Certificates to enable SSO for Azure AD join devices description: If you want to use certificates for on-premises single-sign on for Azure Active Directory-joined devices, then follow these additional steps. ms.date: 08/19/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index d0aa2590f7..9a5646c257 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -2,8 +2,6 @@ title: Configure single sign-on (SSO) for Azure AD joined devices description: Learn how to configure single sign-on to on-premises resources for Azure AD-joined devices, using Windows Hello for Business. ms.date: 12/30/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Configure single sign-on for Azure AD joined devices diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md index 788cd8af15..662e259872 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an hybrid certifi description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid certificate trust model. ms.date: 01/03/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - hybrid certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index 02c36f3fbe..eabb6ec24d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -3,8 +3,11 @@ title: Windows Hello for Business hybrid certificate trust deployment description: Learn how to deploy Windows Hello for Business in a hybrid certificate trust scenario. ms.date: 03/16/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index a1a88d6f2e..629d9c561e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -2,8 +2,6 @@ title: Windows Hello for Business hybrid certificate trust clients configuration and enrollment description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid certificate trust scenario. ms.date: 01/03/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index ca0662ddde..2a40af9e7f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -3,8 +3,11 @@ title: Configure Active Directory Federation Services in a hybrid certificate tr description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business hybrid certificate trust model. ms.date: 01/03/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure Active Directory Federation Services - hybrid certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md index 73c27e5835..31e4fb9ee2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md @@ -2,8 +2,6 @@ title: Windows Hello for Business hybrid key trust clients configuration and enrollment description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid key trust scenario. ms.date: 01/03/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md index 19c9df7d89..c4248ffb62 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an hybrid key tru description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in an hybrid key trust model. ms.date: 01/03/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - hybrid key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 042fe747a8..8ab43e5406 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -3,8 +3,11 @@ title: Windows Hello for Business hybrid key trust deployment description: Learn how to deploy Windows Hello for Business in a hybrid key trust scenario. ms.date: 12/28/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: how-to --- # Hybrid key trust deployment diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 518283865d..9c4a5f6165 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -1,14 +1,17 @@ --- +ms.date: 12/13/2022 title: Windows Hello for Business Deployment Prerequisite Overview description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models -ms.collection: +ms.topic: article +ms.collection: - highpri - tier1 -ms.date: 12/13/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Windows Hello for Business Deployment Prerequisite Overview diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index b0cf1c66b8..be437d043f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -1,10 +1,13 @@ --- +ms.date: 12/12/2022 title: Prepare and deploy Active Directory Federation Services in an on-premises key trust description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business key trust model. -ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Prepare and deploy Active Directory Federation Services - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index d9446b6eec..3fd25ec607 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -1,10 +1,10 @@ --- +ms.date: 12/12/2022 title: Configure Windows Hello for Business Policy settings in an on-premises key trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises key trust scenario -ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 ms.topic: tutorial --- # Configure Windows Hello for Business group policy settings - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 07673151d3..19fe709d3f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -3,8 +3,11 @@ title: Validate Active Directory prerequisites in an on-premises key trust description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a key trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Validate Active Directory prerequisites - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 65f12b5274..4d089851ff 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -3,8 +3,11 @@ title: Validate and Deploy MFA for Windows Hello for Business with key trust description: Validate and deploy multi-factor authentication (MFA) for Windows Hello for Business in an on-premises key trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index 96505087ec..e2f7510aac 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an on-premises ke description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a key trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index e666aa4beb..2676f0066f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.date: 2/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index d6e6de308d..005fb6c685 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.topic: conceptual -appliesto: - - ✅ Windows 10 and later ms.date: 12/31/2017 --- # Windows Hello for Business Overview diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index f3e0b27534..b941c37a84 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -2,8 +2,6 @@ title: Planning a Windows Hello for Business Deployment description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure. ms.date: 09/16/2020 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Planning a Windows Hello for Business Deployment diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 1d36c9e14c..90bd5ec677 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -2,8 +2,6 @@ title: Prepare people to use Windows Hello (Windows) description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization. ms.date: 08/19/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Prepare people to use Windows Hello diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index 1afbc43168..0963b04163 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -2,8 +2,6 @@ title: Windows Hello for Business Videos description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10 and Windows 11. ms.date: 03/09/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Videos diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 80c0b844fc..9c3cd5a067 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.date: 03/15/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: conceptual --- # Why a PIN is better than an online password diff --git a/windows/security/identity-protection/hello-for-business/index.yml b/windows/security/identity-protection/hello-for-business/index.yml index 4d8789f403..e888c0e2f7 100644 --- a/windows/security/identity-protection/hello-for-business/index.yml +++ b/windows/security/identity-protection/hello-for-business/index.yml @@ -6,12 +6,7 @@ summary: Learn how to manage and deploy Windows Hello for Business. metadata: title: Windows Hello for Business documentation description: Learn how to manage and deploy Windows Hello for Business. - ms.prod: windows-client - ms.technology: itpro-security ms.topic: landing-page - author: paolomatarazzo - ms.author: paoloma - manager: aaroncz ms.date: 03/09/2023 ms.collection: - highpri diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 4b2daf06b4..3ad9597e77 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -3,8 +3,6 @@ title: Password-less strategy description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10 and Windows 11. ms.topic: conceptual ms.date: 05/24/2022 -appliesto: -- ✅ Windows 10 and later --- # Password-less strategy diff --git a/windows/security/identity-protection/hello-for-business/webauthn-apis.md b/windows/security/identity-protection/hello-for-business/webauthn-apis.md index 654302f210..f2aa96a5ea 100644 --- a/windows/security/identity-protection/hello-for-business/webauthn-apis.md +++ b/windows/security/identity-protection/hello-for-business/webauthn-apis.md @@ -2,8 +2,6 @@ title: WebAuthn APIs description: Learn how to use WebAuthn APIs to enable passwordless authentication for your sites and apps. ms.date: 03/09/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # WebAuthn APIs for passwordless authentication on Windows diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index dc71f52903..c16e630bed 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -1,17 +1,8 @@ --- -title: Identity and access management (Windows 10) +title: Identity and access management description: Learn more about identity and access protection technologies in Windows. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 02/05/2018 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security --- # Identity and access management diff --git a/windows/security/identity-protection/password-support-policy.md b/windows/security/identity-protection/password-support-policy.md index fe76412c23..46e3507908 100644 --- a/windows/security/identity-protection/password-support-policy.md +++ b/windows/security/identity-protection/password-support-policy.md @@ -1,22 +1,13 @@ --- title: Technical support policy for lost or forgotten passwords description: Outlines the ways in which Microsoft can help you reset a lost or forgotten password, and provides links to instructions for doing so. -ms.custom: - - CI ID 110060 - - CSSTroubleshoot -ms.prod: windows-client ms.topic: article -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.date: 11/20/2019 -ms.technology: itpro-security --- # Technical support policy for lost or forgotten passwords -Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. If these options don’t work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password. +Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. If these options don't work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password. If you lose or forget a password, you can use the links in this article to find published support information that will help you reset the password. diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 63c2e03d67..64e9869d2a 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -1,20 +1,17 @@ --- title: Protect Remote Desktop credentials with Windows Defender Remote Credential Guard (Windows 10) description: Windows Defender Remote Credential Guard helps to secure your Remote Desktop credentials by never sending them to the target device. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.collection: - - highpri - - tier2 +- highpri +- tier2 ms.topic: article -ms.localizationpriority: medium ms.date: 01/12/2018 appliesto: - - ✅ Windows 10 - - ✅ Windows Server 2016 -ms.technology: itpro-security +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Protect Remote Desktop credentials with Windows Defender Remote Credential Guard diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 7c25e23d15..365f168f07 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,27 +1,15 @@ --- +ms.date: 09/24/2021 title: Smart Card and Remote Desktop Services (Windows) description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium -ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +ms.reviewer: ardenw --- # Smart Card and Remote Desktop Services This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. -The content in this topic applies to the versions of Windows that are designated in the **Applies To** list at the beginning of this topic. In these versions, smart card redirection logic and **WinSCard** API are combined to support multiple redirected sessions into a single process. +Smart card redirection logic and **WinSCard** API are combined to support multiple redirected sessions into a single process. Smart card support is required to enable many Remote Desktop Services scenarios. These include: @@ -95,7 +83,8 @@ Where <*CertFile*> is the root certificate of the KDC certificate issuer. For information about this option for the command-line tool, see [-addstore](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_addstore). -> **Note**  If you use the credential SSP on computers running the supported versions of the operating system that are designated in the **Applies To** list at the beginning of this topic: To sign in with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel cannot be established without the root certification of the domain controller. +> [!NOTE] +> To sign in with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel cannot be established without the root certification of the domain controller. Sign-in to Remote Desktop Services across a domain works only if the UPN in the certificate uses the following form: <*ClientName*>@<*DomainDNSName*> diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 0b300b959d..5a810263fc 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -1,21 +1,9 @@ --- title: Smart Card Architecture (Windows) description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Architecture @@ -94,7 +82,7 @@ Figure 2 illustrates the relationship between the CryptoAPI, CSPs, the Smart Ca ### Caching with Base CSP and smart card KSP -Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user’s access to a PIN. +Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user's access to a PIN. - [Data caching](#data-caching): The data cache provides for a single process to minimize smart card I/O operations. @@ -320,8 +308,6 @@ Figure 4 shows the Cryptography architecture that is used by the Windows operat ### Base CSP and smart card KSP properties in Windows -The following properties are supported in versions of Windows designated in the **Applies To** list at the beginning of this topic. - > **Note**  The API definitions are located in WinCrypt.h and WinSCard.h. | **Property** | **Description** | diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index ad23803395..bbdab0c142 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -1,21 +1,9 @@ --- title: Certificate Propagation Service (Windows) description: This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 08/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Certificate Propagation Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 4d2926242d..e52b7eeabd 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -1,21 +1,9 @@ --- title: Certificate Requirements and Enumeration (Windows) description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Certificate Requirements and Enumeration @@ -81,7 +69,7 @@ The following table lists the certificate support in older Windows operating sys Most issues during authentication occur because of session behavior changes. When changes occur, the Local Security Authority (LSA) does not reacquire the session context; it relies instead on the Cryptographic Service Provider to handle the session change. -In the supported versions of Windows designated in the **Applies To** list at the beginning of this topic, client certificates that do not contain a UPN in the **subjectAltName** (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. +Client certificates that do not contain a UPN in the **subjectAltName** (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. Support for multiple certificates on the same card is enabled by default. New certificate types must be enabled through Group Policy. @@ -131,7 +119,7 @@ Following are the steps that are performed during a smart card sign-in: 12. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store. -13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT’s authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. +13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT's authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. 14. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response. diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 10b6bda518..72b31805ae 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -1,24 +1,12 @@ --- title: Smart Card Troubleshooting (Windows) description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.collection: - highpri - tier2 ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Troubleshooting diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index ed07b57089..50e701debe 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -1,21 +1,9 @@ --- title: Smart Card Events (Windows) description: This topic for the IT professional and smart card developer describes events that are related to smart card deployment and development. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Events diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 26f06f48c2..78fe0f4b8a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -1,21 +1,9 @@ --- title: Smart Card Group Policy and Registry Settings (Windows) description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 11/02/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Group Policy and Registry Settings @@ -222,7 +210,7 @@ You can use this policy setting to change the default message that a user sees i When this policy setting is turned on, you can create and manage the displayed message that the user sees when a smart card is blocked. -When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system’s default message when the smart card is blocked. +When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system's default message when the smart card is blocked. | **Item** | **Description** | |--------------------------------------|-------------------------| @@ -236,7 +224,7 @@ When this policy setting isn't turned on (and the integrated unblock feature is You can use this policy setting to configure which valid sign-in certificates are displayed. > [!NOTE] -> During the certificate renewal period, a user’s smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. +> During the certificate renewal period, a user's smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. > > If two certificates are issued from the same template with the same major version and they are for the same user (this is determined by their UPN), they are determined to be the same. @@ -288,7 +276,7 @@ When this setting isn't turned on, the user doesn't see a smart card device driv You can use this policy setting to prevent Credential Manager from returning plaintext PINs. > [!NOTE] -> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user’s profile. +> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user's profile. When this policy setting is turned on, Credential Manager doesn't return a plaintext PIN. @@ -310,7 +298,7 @@ You can use this policy setting to control the way the subject name appears duri When this policy setting is turned on, the subject name during sign-in appears reversed from the way that it's stored in the certificate. -When this policy setting isn’t turned on, the subject name appears the same as it’s stored in the certificate. +When this policy setting isn't turned on, the subject name appears the same as it's stored in the certificate. | **Item** | **Description** | @@ -346,7 +334,7 @@ You can use this policy setting to manage the root certificate propagation that When this policy setting is turned on, root certificate propagation occurs when the user inserts the smart card. -When this policy setting isn’t turned on, root certificate propagation doesn’t occur when the user inserts the smart card. +When this policy setting isn't turned on, root certificate propagation doesn't occur when the user inserts the smart card. | **Item** | **Description** | |--------------------------------------|---------------------------------------------------------------------------------------------------------| diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index b0989b839d..a44e2533fc 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -1,21 +1,9 @@ --- title: How Smart Card Sign-in Works in Windows description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # How Smart Card Sign-in Works in Windows diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 1df09c74c0..40f781ce63 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -1,21 +1,9 @@ --- title: Smart Card Removal Policy Service (Windows) description: This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Removal Policy Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index 187d0bc8a9..170dfa5cf4 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -1,21 +1,9 @@ --- title: Smart Cards for Windows Service (Windows) description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Cards for Windows Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index c543380fcd..bb1e4d8fb6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -1,21 +1,9 @@ --- title: Smart Card Tools and Settings (Windows) description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Tools and Settings diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index d5912c3e8d..3b74397463 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -4,10 +4,6 @@ description: Learn about the Windows smart card infrastructure for physical smar ms.reviewer: ardenw ms.topic: article ms.date: 09/24/2021 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.technology: itpro-security --- # Smart Card Technical Reference diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 8037f68045..0e56328a44 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -5,11 +5,7 @@ ms.collection: - highpri - tier2 ms.topic: article -ms.localizationpriority: medium ms.date: 09/23/2021 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # How User Account Control works diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 979a7ae1f1..08e9ce3e06 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -6,9 +6,6 @@ ms.collection: - tier2 ms.topic: article ms.date: 04/19/2017 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # User Account Control Group Policy and registry key settings diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md index 93502be3e3..e85aae3ab9 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md @@ -6,9 +6,6 @@ ms.collection: - tier2 ms.topic: article ms.date: 09/24/2011 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # User Account Control diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index 28f209a22e..ffdb4e4a3f 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -3,9 +3,6 @@ title: User Account Control security policy settings (Windows) description: You can use security policies to configure how User Account Control works in your organization. ms.topic: article ms.date: 09/24/2021 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # User Account Control security policy settings diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 63ac28b3e9..b20f03522b 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -3,9 +3,6 @@ title: Deploy Virtual Smart Cards description: Learn about what to consider when deploying a virtual smart card authentication solution ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Deploy Virtual Smart Cards diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index b2afb7673e..d86c288331 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -3,9 +3,6 @@ title: Evaluate Virtual Smart Card Security description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Evaluate Virtual Smart Card Security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index ab3569f8ab..9d8e125298 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -3,9 +3,6 @@ title: Get Started with Virtual Smart Cards - Walkthrough Guide (Windows 10) description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Get Started with Virtual Smart Cards: Walkthrough Guide diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index 05598bf6ee..1445f06ad2 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -3,9 +3,6 @@ title: Virtual Smart Card Overview description: Learn about virtual smart card technology for Windows. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Virtual Smart Card Overview diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index 5f39e38b48..5eca1fae1e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -3,9 +3,6 @@ title: Tpmvscmgr description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Tpmvscmgr diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index dfde051a1a..77e78baaf2 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -4,9 +4,6 @@ description: Learn how smart card technology can fit into your authentication de ms.prod: windows-client ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Understand and Evaluate Virtual Smart Cards diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index eb4d234c61..ddb91270e5 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -3,9 +3,6 @@ title: Use Virtual Smart Cards description: Learn about the requirements for virtual smart cards, how to use and manage them. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Use Virtual Smart Cards diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md index 188fe97442..834f56a321 100644 --- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md +++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md @@ -1,24 +1,12 @@ --- -title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10 and Windows 11) +title: How to configure Diffie Hellman protocol over IKEv2 VPN connections description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: how-to --- # How to configure Diffie Hellman protocol over IKEv2 VPN connections ->Applies To: Windows Server (General Availability Channel), Windows Server 2016, Windows 10, Windows 11 - In IKEv2 VPN connections, the default configuration for Diffie Hellman group is Group 2, which is not secure for IKE exchanges. To secure the connections, update the configuration of VPN servers and clients by running VPN cmdlets. @@ -31,7 +19,7 @@ For VPN servers that run Windows Server 2012 R2 or later, you need to run [Set-V Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy ``` -On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn’t have `-TunnelType`, the configuration applies to all tunnel types on the server. +On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn't have `-TunnelType`, the configuration applies to all tunnel types on the server. ```powershell Set-VpnServerIPsecConfiguration -CustomPolicy diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index e44a13a1a8..08b4c532c8 100644 --- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -1,16 +1,7 @@ --- title: How to use Single Sign-On (SSO) over VPN and Wi-Fi connections description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. -ms.prod: windows-client -author: paolomatarazzo ms.date: 12/28/2022 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: how-to --- @@ -95,7 +86,7 @@ For more information, see [Configure certificate infrastructure for SCEP](/mem/i You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well. -Domain controllers must have appropriate KDC certificates for the client to trust them as domain controllers. Because phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store. +Domain controllers must have appropriate KDC certificates for the client to trust them as domain controllers. Because phones are not domain-joined, the root CA of the KDC's certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store. Domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication. This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server. diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index f14e959f6b..c74740f325 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -1,17 +1,7 @@ --- title: VPN authentication options (Windows 10 and Windows 11) description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 61044232d2..51c5aebb16 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -1,23 +1,13 @@ --- title: VPN auto-triggered profile options (Windows 10 and Windows 11) description: Learn about the types of auto-trigger rules for VPNs in Windows, which start a VPN when it is needed to access a resource. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- # VPN auto-triggered profile options -In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won’t have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: +In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won't have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: - App trigger - Name-based trigger @@ -64,7 +54,7 @@ When a device has multiple profiles with Always On triggers, the user can specif ## Preserving user Always On preference -Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**. +Windows has a feature to preserve a user's AlwaysOn preference. In the event that a user manually unchecks the "Connect automatically" checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**. Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference. diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 4e7d339c66..392b5cf099 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -1,17 +1,7 @@ --- title: VPN and conditional access (Windows 10 and Windows 11) description: Learn how to integrate the VPN client with the Conditional Access Platform, so you can create access rules for Azure Active Directory (Azure AD) connected apps. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: pesmith -manager: aaroncz -ms.localizationpriority: medium ms.date: 09/23/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- @@ -63,43 +53,34 @@ After the server side is set up, VPN admins can add the policy settings for cond Two client-side configuration service providers are leveraged for VPN device compliance. - VPNv2 CSP DeviceCompliance settings: - - - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD. - - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication. - - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication. - - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication. - - **Sso/Eku**: comma-separated list of extended key usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication. - + - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD. + - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication. + - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication. + - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication. + - **Sso/Eku**: comma-separated list of extended key usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication. - HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include: + - Collects TPM data used to verify health states + - Forwards the data to the Health Attestation Service (HAS) + - Provisions the Health Attestation Certificate received from the HAS + - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification - - Collects TPM data used to verify health states - - Forwards the data to the Health Attestation Service (HAS) - - Provisions the Health Attestation Certificate received from the HAS - - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification - > [!NOTE] -> Currently, it is required that certificates used for obtaining Kerberos tickets must be issued from an on-premises CA, and that SSO must be enabled in the user’s VPN profile. This will enable the user to access on-premises resources. -> +> It's required that certificates used for obtaining Kerberos tickets to be issued from an on-premises CA, and that SSO to be enabled in the user's VPN profile. This will enable the user to access on-premises resources. > In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero). ## Client connection flow The VPN client side connection flow works as follows: -> [!div class="mx-imgBorder"] -> ![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png) - +![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png) + When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow: -1. The VPN client calls into Windows 10’s or Windows 11’s Azure AD Token Broker, identifying itself as a VPN client. - -2. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies. - -3. If compliant, Azure AD requests a short-lived certificate. - -4. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing. - -5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server. +1. The VPN client calls into Windows 10's or Windows 11's Azure AD Token Broker, identifying itself as a VPN client. +1. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies. +1. If compliant, Azure AD requests a short-lived certificate. +1. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing. +1. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server. ## Configure conditional access diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index e9eecdbbb9..0ae1626c8b 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -1,23 +1,13 @@ --- title: VPN connection types (Windows 10 and Windows 11) description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 08/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- # VPN connection types -Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization’s private network. +Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization's private network. There are many options for VPN clients. In Windows 10 and Windows 11, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index f8cf27d242..15f788082b 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -1,17 +1,7 @@ --- title: Windows VPN technical guide (Windows 10 and Windows 11) description: Learn about decisions to make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 02/21/2022 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index 34f201d00a..2c6402477a 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -1,17 +1,7 @@ --- title: VPN name resolution (Windows 10 and Windows 11) description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- @@ -23,7 +13,7 @@ The name resolution setting in the VPN profile configures how name resolution sh ## Name Resolution Policy table (NRPT) -The NRPT is a table of namespaces that determines the DNS client’s behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache. +The NRPT is a table of namespaces that determines the DNS client's behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache. There are 3 types of name matches that can set up for NRPT: diff --git a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md index 6e45c35a7e..8eb30c7bce 100644 --- a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md +++ b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md @@ -1,18 +1,8 @@ --- -title: Optimizing Office 365 traffic for remote workers with the native Windows 10 or Windows 11 VPN client -description: tbd -ms.prod: windows-client +title: Optimizing Office 365 traffic for remote workers with the native Windows VPN client +description: Learn how to optimize Office 365 traffic for remote workers with the native Windows VPN client ms.topic: article -ms.localizationpriority: medium ms.date: 09/23/2021 -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security --- # Optimizing Office 365 traffic for remote workers with the native Windows 10 and Windows 11 VPN client diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index a6330f4ad8..2ebbff5348 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -1,17 +1,7 @@ --- title: VPN profile options (Windows 10 and Windows 11) description: Windows adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network. -manager: aaroncz -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: pesmith -ms.localizationpriority: medium ms.date: 05/17/2018 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- @@ -221,75 +211,75 @@ The following sample is a sample plug-in VPN profile. This blob would fall under ```xml - TestVpnProfile - - testserver1.contoso.com;testserver2.contoso..com - JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy - <pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema> - - -
          192.168.0.0
          - 24 -           - -
          10.10.0.0
          - 16 -           - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - 6 - 10,20-50,100-200 - 20-50,100-200,300 - 30.30.0.0/16,10.10.10.10-20.20.20.20 - - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - 3.3.3.3/32,1.1.1.1-2.2.2.2 - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - O:SYG:SYD:(A;;CC;;;AU) - - - - corp.contoso.com - 1.2.3.4,5.6.7.8 - 5.5.5.5 - false - - - corp.contoso.com - 10.10.10.10,20.20.20.20 - 100.100.100.100 - - - true - false - corp.contoso.com - contoso.com,test.corp.contoso.com - - - HelloServer - - Helloworld.Com - + TestVpnProfile + + testserver1.contoso.com;testserver2.contoso..com + JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy + <pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema> + + +
          192.168.0.0
          + 24 +           + +
          10.10.0.0
          + 16 +           + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + O:SYG:SYD:(A;;CC;;;AU) + + + + corp.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + false + + + corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + true + false + corp.contoso.com + contoso.com,test.corp.contoso.com + + + HelloServer + + Helloworld.Com +           ``` diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index be5bc1caf0..925b124da9 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -1,17 +1,7 @@ --- -title: VPN routing decisions (Windows 10 and Windows 10) -description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security +title: VPN routing decisions +description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations. ms.topic: conceptual --- # VPN routing decisions @@ -38,7 +28,7 @@ Routes can also be added at connect time through the server for UWP VPN apps. In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified. -The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn’t a specific route on the physical interface itself. +The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn't a specific route on the physical interface itself. For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**. diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index f8fb6861a0..c4d9da3ec4 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -1,17 +1,7 @@ --- title: VPN security features description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 07/21/2022 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index aee7a82d2d..5cbde2e21f 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -1,17 +1,8 @@ --- title: Windows Credential Theft Mitigation Guide Abstract description: Provides a summary of the Windows credential theft mitigation guide. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz -ms.topic: article -ms.localizationpriority: medium -ms.date: 04/19/2017 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security +ms.topic: conceptual +ms.date: 03/31/2023 --- # Windows Credential Theft Mitigation Guide Abstract @@ -65,5 +56,3 @@ This sections covers how to detect the use of stolen credentials and how to coll ## Responding to suspicious activity Learn Microsoft's recommendations for responding to incidents, including how to recover control of compromised accounts, how to investigate attacks, and how to recover from a breach. - - diff --git a/windows/security/information-protection/bitlocker/images/kernel-dma-protection-security-center.png b/windows/security/information-protection/bitlocker/images/kernel-dma-protection-security-center.png deleted file mode 100644 index 9f9aea0f86..0000000000 Binary files a/windows/security/information-protection/bitlocker/images/kernel-dma-protection-security-center.png and /dev/null differ diff --git a/windows/security/information-protection/images/device-details-tab.png b/windows/security/information-protection/images/device-details-tab.png deleted file mode 100644 index 4dfe33e156..0000000000 Binary files a/windows/security/information-protection/images/device-details-tab.png and /dev/null differ diff --git a/windows/security/information-protection/images/device-details.png b/windows/security/information-protection/images/device-details.png new file mode 100644 index 0000000000..32e2edb41d Binary files /dev/null and b/windows/security/information-protection/images/device-details.png differ diff --git a/windows/security/information-protection/images/device_details_tab_1903.png b/windows/security/information-protection/images/device_details_tab_1903.png deleted file mode 100644 index beb0337379..0000000000 Binary files a/windows/security/information-protection/images/device_details_tab_1903.png and /dev/null differ diff --git a/windows/security/information-protection/images/kernel-dma-protection-security-center.png b/windows/security/information-protection/images/kernel-dma-protection-security-center.png new file mode 100644 index 0000000000..61a2a9a928 Binary files /dev/null and b/windows/security/information-protection/images/kernel-dma-protection-security-center.png differ diff --git a/windows/security/information-protection/images/kernel-dma-protection-user-experience.png b/windows/security/information-protection/images/kernel-dma-protection-user-experience.png deleted file mode 100644 index 8949c51627..0000000000 Binary files a/windows/security/information-protection/images/kernel-dma-protection-user-experience.png and /dev/null differ diff --git a/windows/security/information-protection/images/kernel-dma-protection.png b/windows/security/information-protection/images/kernel-dma-protection.png new file mode 100644 index 0000000000..be1a68e120 Binary files /dev/null and b/windows/security/information-protection/images/kernel-dma-protection.png differ diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 49d276838c..eb8db70020 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -1,6 +1,6 @@ --- -title: Kernel DMA Protection (Windows) -description: Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. +title: Kernel DMA Protection +description: Learn how Kernel DMA Protection protects Windows devices against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices. ms.prod: windows-client author: vinaypamnani-msft ms.author: vinpa @@ -9,123 +9,94 @@ ms.collection: - highpri - tier1 ms.topic: conceptual -ms.date: 01/05/2023 +ms.date: 03/30/2023 ms.technology: itpro-security +appliesto: + - ✅ Windows 10 and later --- # Kernel DMA Protection -**Applies to** -- Windows 10 -- Windows 11 +Kernel DMA Protection is a Windows security feature that protects against external peripherals from gaining unauthorized access to memory. -In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to externally accessible PCIe ports (for example, Thunderbolt™ 3 ports and CFexpress). In Windows 10 version 1903, Microsoft expanded the Kernel DMA Protection support to cover internal PCIe ports (for example, M.2 slots) +PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach classes of external peripherals, including graphics cards, to their devices with the plug-and-play ease of USB.\ +These devices are DMA-capable, and can access system memory and perform read and write operations without the need for the system processor's involvement. This capability is the reason behind the exceptional performance of PCI devices, but it also makes them susceptible to *drive-by DMA attacks*. -Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely. +Drive-by DMA attacks are attacks that occur while the owner of the system isn't present and usually take just a few minutes, with simple-to-moderate attacking tools (affordable, off-the-shelf hardware and software), that don't require the disassembly of the device. For example, attackers can plug in a USB-like device while the device owner is on a break, and walk away with all the secrets on the machine, or inject a malware that allows them to have full control over the device remotely while bypassing the lock screen. -This feature doesn't protect against DMA attacks via 1394/FireWire, PCMCIA, CardBus, ExpressCard, and so on. - - -## Background - -PCI devices are DMA-capable, which allows them to read and write to system memory at will, without having to engage the system processor in these operations. -The DMA capability is what makes PCI devices the highest performing devices available today. -These devices have historically existed only inside the PC chassis, either connected as a card or soldered on the motherboard. -Access to these devices required the user to turn off power to the system and disassemble the chassis. - -Today, this is no longer the case with hot plug PCIe ports (for example, Thunderbolt™ and CFexpress). - -Hot plug PCIe ports such as Thunderbolt™ technology have provided modern PCs with extensibility that wasn't available before for PCs. -It allows users to attach new classes of external peripherals, such as graphics cards or other PCI devices, to their PCs with a hot plug experience identical to USB. -Having PCI hot plug ports externally and easily accessible makes PCs susceptible to drive-by DMA attacks. - -Drive-by DMA attacks are attacks that occur while the owner of the system is not present and usually take less than 10 minutes, with simple to moderate attacking tools (affordable, off-the-shelf hardware and software) that do not require the disassembly of the PC. -A simple example would be a PC owner leaves the PC for a quick coffee break, and within the break, an attacker steps in, plugs in a USB-like device and walks away with all the secrets on the machine, or injects a malware that allows them to have full control over the PC remotely. +> [!NOTE] +> Kernel DMA Protection feature doesn't protect against DMA attacks via 1394/FireWire, PCMCIA, CardBus, or ExpressCard. ## How Windows protects against DMA drive-by attacks -Windows leverages the system Input/Output Memory Management Unit (IOMMU) to block external peripherals from starting and performing DMA unless the drivers for these peripherals support memory isolation (such as DMA-remapping). -Peripherals with [DMA Remapping compatible drivers](/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers) will be automatically enumerated, started, and allowed to perform DMA to their assigned memory regions. +Windows uses the system *Input/Output Memory Management Unit (IOMMU)* to block external peripherals from starting and performing DMA, unless the drivers for these peripherals support memory isolation (such as DMA-remapping). +Peripherals with [DMA Remapping compatible drivers][LINK-1] will be automatically enumerated, started, and allowed to perform DMA to their assigned memory regions. -By default, peripherals with DMA Remapping incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using the [DmaGuard MDM policies](/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies). +By default, peripherals with DMA Remapping incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using MDM or group policies. ## User experience -![Kernel DMA protection user experience](images/kernel-dma-protection-user-experience.png) +When Kernel DMA Protection is enabled: -By default, peripherals with DMA remapping compatible device drivers will be automatically enumerated and started. Peripherals with DMA Remapping incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. -The peripheral will continue to function normally if the user locks the screen or logs out of the system. +- Peripherals with DMA Remapping-compatible device drivers will be automatically enumerated and started +- Peripherals with DMA Remapping-incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or signs out of the system. ## System compatibility -Kernel DMA Protection requires new UEFI firmware support. -This support is anticipated only on newly introduced, Intel-based systems shipping with Windows 10 version 1803 (not all systems). Virtualization-based Security (VBS) is not required. +Kernel DMA Protection requires UEFI firmware support, and Virtualization-based Security (VBS) isn't required. -To see if a system supports Kernel DMA Protection, check the System Information desktop app (MSINFO32). -Systems released prior to Windows 10 version 1803 do not support Kernel DMA Protection, but they can leverage other DMA attack mitigations as described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md). +Kernel DMA Protection isn't compatible with other BitLocker DMA attacks countermeasures. It's recommended to disable the BitLocker DMA attacks countermeasures if the system supports Kernel DMA Protection. Kernel DMA Protection provides higher security bar for the system over the BitLocker DMA attack countermeasures, while maintaining usability of external peripherals. ->[!NOTE] ->Kernel DMA Protection is not compatible with other BitLocker DMA attacks countermeasures. It is recommended to disable the BitLocker DMA attacks countermeasures if the system supports Kernel DMA Protection. Kernel DMA Protection provides higher security bar for the system over the BitLocker DMA attack countermeasures, while maintaining usability of external peripherals. +> [!NOTE] +> DMA remapping support for graphics devices was added in Windows 11 with the WDDM 3.0 driver model; Windows 10 doesn't support this feature. ->[!NOTE] ->DMA remapping support for graphics devices was added in Windows 11 with the WDDM 3.0 driver model; Windows 10 does not support this feature. +## Check if Kernel DMA Protection is enabled -## How to check if Kernel DMA Protection is enabled +Systems that support Kernel DMA Protection will enable the feature automatically, with no user or IT admin configuration required. -Systems running Windows 10 version 1803 that do support Kernel DMA Protection do have this security feature enabled automatically by the OS with no user or IT admin configuration required. +You can use the Windows Security app to check if Kernel DMA Protection is enabled: -### Using the Windows Security app +1. Open Windows Security app +1. Select **Device security > Core isolation details > Memory access protection** -Beginning with Windows 10 version 1809, you can use the Windows Security app to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. +:::image type="content" source="images/kernel-dma-protection-security-center.png" alt-text="Screenshot of Kernel DMA protection in Windows Security." lightbox="images/kernel-dma-protection-security-center.png" border="true"::: -![Kernel DMA protection in Windows Security](bitlocker/images/kernel-dma-protection-security-center.png) +Alternatively, you can use the System Information desktop app (`msinfo32.exe`). If the system supports Kernel DMA Protection, the **Kernel DMA Protection** value will be set to **ON**. -### Using System information +:::image type="content" source="images/kernel-dma-protection.png" alt-text="Screenshot of Kernel DMA protection in System Information." lightbox="images/kernel-dma-protection.png" border="true"::: -1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar. +If the current state of **Kernel DMA Protection** is **OFF** and **Hyper-V - Virtualization Enabled in Firmware** is **NO**: -2. Check the value of **Kernel DMA Protection**. +- Reboot into UEFI settings +- Turn on Intel Virtualization Technology +- Turn on Intel Virtualization Technology for I/O (VT-d) +- Reboot system into Windows - ![Kernel DMA protection in System Information.](bitlocker/images/kernel-dma-protection.png) - -3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO: +> [!NOTE] +> If the **Hyper-V** Windows feature is enabled, all the Hyper-V-related features will be hidden, and **A hypervisor has been detected. Features required for Hyper-V will not be displayed** entity will be shown at the bottom of the list. It means that **Hyper-V - Virtualization Enabled in Firmware** is set to **YES**. +> +> Enabling Hyper-V virtualization in Firmware (IOMMU) is required to enable **Kernel DMA Protection**, even when the firmware has the flag of *ACPI Kernel DMA Protection Indicators* described in [Kernel DMA Protection (Memory Access Protection) for OEMs][LINK-3]. - - Reboot into BIOS settings - - Turn on Intel Virtualization Technology. - - Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md). - - Reboot system into Windows. +If the state of **Kernel DMA Protection** remains Off, then the system doesn't support Kernel DMA Protection. - > [!NOTE] - > If the **Hyper-V** Windows feature is enabled, all the Hyper-V-related features will be hidden, and **A hypervisor has been detected. Features required for Hyper-V will not be displayed** entity will be shown at the bottom of the list. It means that **Hyper-V - Virtualization Enabled in Firmware** is set to YES. - - > [!NOTE] - > Enabling Hyper-V virtualization in Firmware (IOMMU) is required to enable **Kernel DMA Protection**, even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](/windows-hardware/design/device-experiences/oem-kernel-dma-protection). - -4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature. - - For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. +For systems that don't support Kernel DMA Protection, refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt 3 and Security on Microsoft Windows Operating system][EXT-1] for other means of DMA protection. ## Frequently asked questions -### Do in-market systems support Kernel DMA Protection for Thunderbolt™ 3? -In-market systems, released with Windows 10 version 1709 or earlier, will not support Kernel DMA Protection for Thunderbolt™ 3 after upgrading to Windows 10 version 1803, as this feature requires the BIOS/platform firmware changes and guarantees that cannot be backported to previously released devices. For these systems, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. - ### Does Kernel DMA Protection prevent drive-by DMA attacks during Boot? -No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It is the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt™ 3 ports during boot. + +No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It's the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt 3 ports during boot. ### How can I check if a certain driver supports DMA-remapping? -DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of two means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (that is, the device driver does not support DMA-remapping). -Check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). -![A user's experience about Kernel DMA protection](images/device_details_tab_1903.png) +Not all devices and drivers support DMA-remapping. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of **0** or **1** means that the device driver doesn't support DMA-remapping. A value of **2** means that the device driver supports DMA-remapping. If the property isn't available, then the device driver doesn't support DMA-remapping. +Check the driver instance for the device you're testing. Some drivers may have varying values depending on the location of the device (internal vs. external). -*For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. +:::image type="content" source="images/device-details.png" alt-text="Screenshot of device details for a Thunderbolt controller showing a value of 2." border="false"::: -![Experience of a user about Kernel DMA protection](images/device-details-tab.png) +### When the drivers for PCI or Thunderbolt 3 peripherals don't support DMA-remapping? -### When the drivers for PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? - -If the peripherals do have class drivers provided by Windows, use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, contact your peripheral vendor/driver vendor to update the driver to support [DMA Remapping](/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers). +Use the Windows-provided drivers for the peripherals, when available. If there are no class drivers provided by Windows for your peripherals, contact your peripheral vendor/driver vendor to update the driver to support [DMA Remapping][LINK-1]. ### My system's Kernel DMA Protection is off. Can DMA-remapping for a specific device be turned on? @@ -134,20 +105,26 @@ Yes. DMA remapping for a specific device can be turned on independent from Kerne Kernel DMA Protection is a policy that allows or blocks devices to perform DMA, based on their remapping state and capabilities. ### Do Microsoft drivers support DMA-remapping? -In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers, and Storage NVMe Controllers support DMA Remapping. + +The Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers, and Storage NVMe Controllers support DMA Remapping. ### Do drivers for non-PCI devices need to be compatible with DMA-remapping? -No. Devices for non-PCI peripherals, such as USB devices, do not perform DMA, thus no need for the driver to be compatible with DMA Remapping. + +No. Devices for non-PCI peripherals, such as USB devices, don't perform DMA, thus no need for the driver to be compatible with DMA Remapping. ### How can an enterprise enable the External device enumeration policy? -The External device enumeration policy controls whether to enumerate external peripherals that are not compatible with DMA-remapping. Peripherals that are compatible with DMA-remapping are always enumerated. Peripherals that aren't, can be blocked, allowed, or allowed only after the user signs in (default). -The policy can be enabled by using: +The External device enumeration policy controls whether to enumerate external peripherals that aren't compatible with DMA-remapping. Peripherals that are compatible with DMA-remapping are always enumerated. Peripherals that aren't, can be blocked, allowed, or allowed only after the user signs in (default). -- Group Policy: Administrative Templates\System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection -- Mobile Device Management (MDM): [DmaGuard policies](/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies) +The policy can be enabled by using: -## Related topics +- Group Policy: **Administrative Templates\System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection** +- Mobile Device Management (MDM): [DmaGuard policies][LINK-2] -- [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) -- [DmaGuard MDM policies](/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies) + + +[LINK-1]: /windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers +[LINK-2]: /windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies +[LINK-3]: /windows-hardware/design/device-experiences/oem-kernel-dma-protection + +[EXT-1]: https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf \ No newline at end of file diff --git a/windows/security/threat-protection/images/powershell-example.png b/windows/security/threat-protection/images/powershell-example.png new file mode 100644 index 0000000000..4ec2be97af Binary files /dev/null and b/windows/security/threat-protection/images/powershell-example.png differ diff --git a/windows/security/threat-protection/images/vbs-example.png b/windows/security/threat-protection/images/vbs-example.png new file mode 100644 index 0000000000..6a1cc80fd4 Binary files /dev/null and b/windows/security/threat-protection/images/vbs-example.png differ diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md new file mode 100644 index 0000000000..ca5ddc47aa --- /dev/null +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -0,0 +1,44 @@ +--- +title: Guide to removing Microsoft Baseline Security Analyzer (MBSA) +description: This article documents the removal of Microsoft Baseline Security Analyzer (MBSA) and provides alternative solutions. +ms.prod: windows-client +ms.localizationpriority: medium +ms.author: paoloma +author: paolomatarazzo +manager: aaroncz +ms.technology: itpro-security +ms.date: 03/29/2023 +ms.topic: article +--- + +# What is Microsoft Baseline Security Analyzer and its uses? + +Microsoft Baseline Security Analyzer (MBSA) is used to verify patch compliance. MBSA also performed several other security checks for Windows, IIS, and SQL Server. Unfortunately, the logic behind these extra checks hadn't been actively maintained since Windows XP and Windows Server 2003. Changes in the products since then rendered many of these security checks obsolete and some of their recommendations counterproductive. + +MBSA was largely used in situations where Microsoft Update a local WSUS or Configuration Manager server wasn't available, or as a compliance tool to ensure that all security updates were deployed to a managed environment. While MBSA version 2.3 introduced support for Windows Server 2012 R2 and Windows 8.1, it has since been deprecated and no longer developed. MBSA 2.3 isn't updated to fully support Windows 10 and Windows Server 2016. + +> [!NOTE] +> In accordance with our [SHA-1 deprecation initiative](https://aka.ms/sha1deprecation), the Wsusscn2.cab file is no longer dual-signed using both SHA-1 and the SHA-2 suite of hash algorithms (specifically SHA-256). This file is now signed using only SHA-256. Administrators who verify digital signatures on this file should now expect only single SHA-256 signatures. Starting with the August 2020 Wsusscn2.cab file, MBSA will return the following error "The catalog file is damaged or an invalid catalog." when attempting to scan using the offline scan file. + +## Solution + +A script can help you with an alternative to MBSA's patch-compliance checking: + +- [Using WUA to Scan for Updates Offline](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline), which includes a sample .vbs script. +For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0). + +For example: + +[![Screenshot that shows the VBS script.](images/vbs-example.png)](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) +[![Screenshot that shows the PowerShell script.](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) + +The preceding scripts use the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it. +The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it doesn't contain any information on non-security updates, tools or drivers. + +## More information + +For security compliance and for desktop/server hardening, we recommend the Microsoft Security Baselines and the Security Compliance Toolkit. + +- [Windows security baselines](windows-security-baselines.md) +- [Download Microsoft Security Compliance Toolkit 1.0](https://www.microsoft.com/download/details.aspx?id=55319) +- [Microsoft Security Guidance blog](/archive/blogs/secguide/) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg b/windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg deleted file mode 100644 index 428f96e9b5..0000000000 Binary files a/windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg and /dev/null differ diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index 43d0713f40..6f0853d443 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -1,19 +1,19 @@ --- -title: Enable hardware-based isolation for Microsoft Edge (Windows) +title: Enable hardware-based isolation for Microsoft Edge description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise. ms.prod: windows-client -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft ms.author: vinpa ms.date: 11/30/2022 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.custom: asr ms.technology: itpro-security -ms.collection: +appliesto: + - ✅ Windows 10 + - ✅ Windows 11 +ms.collection: - highpri - tier2 ms.topic: how-to @@ -21,39 +21,34 @@ ms.topic: how-to # Prepare to install Microsoft Defender Application Guard -**Applies to:** - -- Windows 10 -- Windows 11 - -## Review system requirements - -See [System requirements for Microsoft Defender Application Guard](./reqs-md-app-guard.md) to review the hardware and software installation requirements for Microsoft Defender Application Guard. +Before you continue, review [System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) to review the hardware and software installation requirements for Microsoft Defender Application Guard. > [!NOTE] > Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. -## Prepare for Microsoft Defender Application Guard +## Prepare for Microsoft Defender Application Guard Before you can install and use Microsoft Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode. ### Standalone mode -Applies to: -- Windows 10 Enterprise edition, version 1709 or higher -- Windows 10 Pro edition, version 1803 -- Windows 11 +Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-md-app-guard.md) testing scenario. -Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-md-app-guard.md) testing scenario. +Standalone mode is applicable for: + +- Windows 10 Enterprise edition, version 1709 and later +- Windows 10 Pro edition, version 1803 and later +- Windows 11 and later ## Enterprise-managed mode -Applies to: -- Windows 10 Enterprise edition, version 1709 or higher -- Windows 11 - You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container. +Enterprise-managed mode is applicable for: + +- Windows 10 Enterprise edition, version 1709 and later +- Windows 11 and later + The following diagram shows the flow between the host PC and the isolated container. ![Flowchart for movement between Microsoft Edge and Application Guard.](images/application-guard-container-v-host.png) @@ -62,71 +57,56 @@ The following diagram shows the flow between the host PC and the isolated contai Application Guard functionality is turned off by default. However, you can quickly install it on your employee's devices through the Control Panel, PowerShell, or your mobile device management (MDM) solution. -### To install by using the Control Panel +### Install from Control Panel -1. Open the **Control Panel**, click **Programs,** and then select **Turn Windows features on or off**. +1. Open the **Control Panel**, select **Programs,** and then select **Turn Windows features on or off**. ![Windows Features, turning on Microsoft Defender Application Guard.](images/turn-windows-features-on-off.png) -2. Select the check box next to **Microsoft Defender Application Guard** and then select **OK**. +1. Select the check box next to **Microsoft Defender Application Guard** and then select **OK** to install Application Guard and its underlying dependencies. - Application Guard and its underlying dependencies are all installed. - -### To install by using PowerShell +### Install from PowerShell > [!NOTE] > Ensure your devices have met all system requirements prior to this step. PowerShell will install the feature without checking system requirements. If your devices don't meet the system requirements, Application Guard may not work. This step is recommended for enterprise managed scenarios only. -1. Select the **Search** or **Cortana** icon in the Windows 10 or Windows 11 taskbar and type **PowerShell**. - -2. Right-click **Windows PowerShell**, and then select **Run as administrator**. +1. Select the **Search** icon in the Windows taskbar and type **PowerShell**. - Windows PowerShell opens with administrator credentials. +1. Right-click **Windows PowerShell**, and then select **Run as administrator** to open Windows PowerShell with administrator credentials. -3. Type the following command: +1. Type the following command: - ``` - Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard - ``` -4. Restart the device. + ```powershell + Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard + ``` - Application Guard and its underlying dependencies are all installed. +1. Restart the device to install Application Guard and its underlying dependencies. -### To install by using Intune +### Install from Intune > [!IMPORTANT] > Make sure your organization's devices meet [requirements](reqs-md-app-guard.md) and are [enrolled in Intune](/mem/intune/enrollment/device-enrollment). -:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune."::: +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. In the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Devices** > **Configuration profiles** > **+ Create profile**, and do the following:
          +1. Select **Endpoint security** > **Attack surface reduction** > **Create Policy**, and do the following: - 1. In the **Platform** list, select **Windows 10 and later**. - - 2. In the **Profile** type, choose **Templates** and select **Endpoint protection**. - - 3. Choose **Create**. + - In the **Platform** list, select **Windows 10 and later**. + - In the **Profile** type, select **App and browser isolation**. + - Select **Create**. -2. Specify the following settings for the profile: +1. In the **Basics** tab, specify the **Name** and **Description** for the policy. Select **Next**. - - **Name** and **Description** +1. In the **Configuration settings** tab, configure the **Application Guard** settings, as desired. Select **Next**. - - In the **Select a category to configure settings** section, choose **Microsoft Defender Application Guard**. +1. In the **Scope tags** tab, if your organization is using scope tags, choose **+ Select scope tags**, and then select the tags you want to use. Select **Next**. - - In the **Application Guard** list, choose **Enabled for Edge**. + To learn more about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). - - Choose your preferences for **Clipboard behavior**, **External content**, and the remaining settings. +1. In the **Assignments** page, select the users or groups that will receive the policy. Select **Next**. -3. Choose **OK**, and then choose **OK** again. + To learn more about assigning policies, see [Assign policies in Microsoft Intune](/mem/intune/configuration/device-profile-assign). -4. Review your settings, and then choose **Create**. +1. Review your settings, and then select **Create**. -5. Choose **Assignments**, and then do the following: - - 1. On the **Include** tab, in the **Assign to** list, choose an option. - - 2. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the **Exclude** tab. - - 3. Select **Save**. - -After the profile is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place. +After the policy is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place. diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.yml b/windows/security/threat-protection/windows-defender-application-control/TOC.yml index 2dfbaefa4f..c003b5258e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.yml +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.yml @@ -105,6 +105,8 @@ - name: WDAC operational guide href: windows-defender-application-control-operational-guide.md items: + - name: WDAC debugging and troubleshooting + href: operations/wdac-debugging-and-troubleshooting.md - name: Understanding Application Control event IDs href: event-id-explanations.md - name: Understanding Application Control event tags diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md index 4b9c9e64bd..1b123b517a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md @@ -8,7 +8,7 @@ author: jsuther1974 ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 06/27/2022 +ms.date: 03/24/2023 ms.topic: reference --- @@ -20,50 +20,82 @@ ms.topic: reference - Windows 11 - Windows Server 2016 and later (limited events) -A Windows Defender Application Control policy logs events locally in Windows Event Viewer in either enforced or audit mode. These events are generated under two locations: +## WDAC Events Overview -- Events about Application Control policy activation and the control of executables, dlls, and drivers appear in **Applications and Services logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational** +WDAC logs events when a policy is loaded, when a file is blocked, or when a file would be blocked if in audit mode. These block events include information that identifies the policy and gives more details about the block. WDAC doesn't generate events when a binary is allowed. However, you can turn on allow audit events for files authorized by a managed installer or the Intelligent Security Graph (ISG) as described later in this article. -- Events about the control of MSI installers, scripts, and COM objects appear in **Applications and Services logs** > **Microsoft** > **Windows** > **AppLocker** > **MSI and Script** +### Core WDAC event logs + +WDAC events are generated under two locations in the Windows Event Viewer: + +- **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational** includes events about Application Control policy activation and the control of executables, dlls, and drivers. +- **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script** includes events about the control of MSI installers, scripts, and COM objects. + +Most app and script failures that occur when WDAC is active can be diagnosed using these two event logs. This article describes in greater detail the events that exist in these logs. To understand the meaning of different data elements, or tags, found in the details of these events, see [Understanding Application Control event tags](event-tag-explanations.md). > [!NOTE] -> These event IDs are not included on Windows Server Core edition. +> **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script** events are not included on Windows Server Core edition. -## Windows CodeIntegrity Operational log +## WDAC block events for executables, dlls, and drivers + +These events are found in the **CodeIntegrity - Operational** event log. | Event ID | Explanation | |--------|-----------| -| 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required. | -| 3033 | This event isn't common. It often means the file's signature is revoked or expired. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a non-signature rule (for example, hash) to address issues with revoked or expired certs. | -| 3034 | This event isn't common. It's the audit mode equivalent of event 3033 described above. | +| 3004 | This event isn't common and may occur with or without an Application Control policy present. It typically indicates a kernel driver tried to load with an invalid signature. For example, the file may not be WHQL-signed on a system where WHQL is required.

          This event is also seen for kernel- or user-mode code that the developer opted-in to [/INTEGRITYCHECK](/cpp/build/reference/integritycheck-require-signature-check) but isn't signed correctly. | +| 3033 | This event may occur with or without an Application Control policy present and should occur alongside a 3077 event if caused by WDAC policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where WDAC blocks files due to an expired signature. Try using option `20 Enabled:Revoked Expired As Unsigned` in your policy along with a rule (for example, hash) that doesn't rely on the revoked or expired cert.

          This event also occurs if code compiled with [Code Integrity Guard (CIG)](/microsoft-365/security/defender-endpoint/exploit-protection-reference#code-integrity-guard) tries to load other code that doesn't meet the CIG requirements. | +| 3034 | This event isn't common. It's the audit mode equivalent of event 3033. | | 3076 | This event is the main Application Control block event for audit mode policies. It indicates that the file would have been blocked if the policy was enforced. | | 3077 | This event is the main Application Control block event for enforced policies. It indicates that the file didn't pass your policy and was blocked. | -| 3089 | This event contains signature information for files that were blocked or would have been blocked by Application Control. One 3089 event is created for each signature of a file. The event shows the total number of signatures found and an index value to identify the current signature. Unsigned files produce a single 3089 event with TotalSignatureCount 0. 3089 events are correlated with 3004, 3033, 3034, 3076 and 3077 events. You can match the events using the `Correlation ActivityID` found in the **System** portion of the event. | -| 3099 | Indicates that a policy has been loaded. This event also includes information about the Application Control policy options that were specified by the policy. | +| 3089 | This event contains signature information for files that were blocked or audit blocked by Application Control. One of these events is created for each signature of a file. Each event shows the total number of signatures found and an index value to identify the current signature. Unsigned files generate a single one of these events with TotalSignatureCount of 0. These events are correlated with 3004, 3033, 3034, 3076 and 3077 events. You can match the events using the `Correlation ActivityID` found in the **System** portion of the event. | -## Windows AppLocker MSI and Script log +## WDAC block events for packaged apps, MSI installers, scripts, and COM objects + +These events are found in the **AppLocker – MSI and Script** event log. | Event ID | Explanation | |--------|-----------| -| 8028 | This event indicates that a script host, such as PowerShell, queried Application Control about a file the script host was about to run. Since the policy was in audit mode, the script or MSI file should have run. Some script hosts may have additional information in their logs. Note: Most third-party script hosts don't integrate with Application Control. Consider the risks from unverified scripts when choosing which script hosts you allow to run. | -| 8029 | This event is the enforcement mode equivalent of event 8028 described above. Note: While this event says that a script was blocked, the actual script enforcement behavior is implemented by the script host. The script host may allow the file to run with restrictions and not block the file outright. For example, PowerShell will allow a script to run but only in [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). | +| 8028 | This event indicates that a script host, such as PowerShell, queried Application Control about a file the script host was about to run. Since the policy was in audit mode, the script or MSI file should have run, but wouldn't have passed the WDAC policy if it was enforced. Some script hosts may have additional information in their logs. Note: Most third-party script hosts don't integrate with Application Control. Consider the risks from unverified scripts when choosing which script hosts you allow to run. | +| 8029 | This event is the enforcement mode equivalent of event 8028. Note: While this event says that a script was blocked, the script hosts control the actual script enforcement behavior. The script host may allow the file to run with restrictions and not block the file outright. For example, PowerShell runs script not allowed by your WDAC policy in [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). | | 8036| COM object was blocked. To learn more about COM object authorization, see [Allow COM object registration in a Windows Defender Application Control policy](allow-com-object-registration-in-windows-defender-application-control-policy.md). | -| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. 8038 events are correlated with 8028 and 8029 events and can be matched using the `Correlation ActivityID` found in the **System** portion of the event. | +| 8037 | This event indicates that a script host checked whether to allow a script to run, and the file passed the WDAC policy. | +| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files generate a single 8038 event with TotalSignatureCount 0. These events are correlated with 8028 and 8029 events and can be matched using the `Correlation ActivityID` found in the **System** portion of the event. | +| 8039 | This event indicates that a packaged app (MSIX/AppX) was allowed to install or run because the WDAC policy is in audit mode. But, it would have been blocked if the policy was enforced. | +| 8040 | This event indicates that a packaged app was prevented from installing or running due to the WDAC policy. | + +## WDAC policy activation events + +These events are found in the **CodeIntegrity - Operational** event log. + +| Event ID | Explanation | +|--------|-----------| +| 3095 | The Application Control policy can't be refreshed and must be rebooted instead. | +| 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. This event's Details includes useful information about the policy, such as its policy options. | +| 3097 | The Application Control policy can't be refreshed. | +| 3099 | Indicates that a policy has been loaded. This event's Details includes useful information about the Application Control policy, such as its policy options. | +| 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. | +| 3101 | Application Control policy refresh started for *N* policies. | +| 3102 | Application Control policy refresh finished for *N* policies. | +| 3103 | The system is ignoring the Application Control policy refresh. For example, an inbox Windows policy that doesn't meet the conditions for activation. | +| 3105 | The system is attempting to refresh the Application Control policy with the specified ID. | ## Diagnostic events for Intelligent Security Graph (ISG) and Managed Installer (MI) > [!NOTE] > When Managed Installer is enabled, customers using LogAnalytics should be aware that Managed Installer may fire many 3091 events. Customers may need to filter out these events to avoid high LogAnalytics costs. -Events 3090, 3091 and 3092 prove helpful diagnostic information when the ISG or MI option is enabled by any Application Control policy. These events can help you debug why something was allowed/denied based on managed installer or ISG. These events don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077 described above. +The following events provide helpful diagnostic information when a WDAC policy includes the ISG or MI option. These events can help you debug why something was allowed/denied based on managed installer or ISG. Events 3090, 3091, and 3092 don't necessarily indicate a problem but should be reviewed in context with other events like 3076 or 3077. + +Unless otherwise noted, these events are found in either the **CodeIntegrity - Operational** event log or the **CodeIntegrity - Verbose** event log depending on your version of Windows. | Event ID | Explanation | |--------|---------| | 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. | | 3091 | This event indicates that a file didn't have ISG or managed installer authorization and the Application Control policy is in audit mode. | | 3092 | This event is the enforcement mode equivalent of 3091. | +| 8002 | This event is found in the **AppLocker - EXE and DLL** event log. When a process launches that matches a managed installer rule, this event is raised with PolicyName = MANAGEDINSTALLER found in the event Details. Events with PolicyName = EXE or DLL aren't related to WDAC. | -The above events are reported per active policy on the system, so you may see multiple events for the same file. +Events 3090, 3091, and 3092 are reported per active policy on the system, so you may see multiple events for the same file. ### ISG and MI diagnostic event details @@ -86,57 +118,7 @@ To enable 3090 allow events, create a TestFlags regkey with a value of 0x300 as reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300 ``` -3091 and 3092 events are inactive on some versions of Windows. The above steps will also turn on those events. - -## Event ID 3099 Options - -The Application Control policy rule option values can be derived from the "Options" field in the Details section of the Code integrity 3099 event. To parse the values, first convert the hex value to binary. To derive and parse these values, follow the below workflow. - -- Access Event Viewer. -- Access the Code integrity 3099 event. -- Access the details pane. -- Identify the hex code listed in the "Options" field. -- Convert the hex code to binary. - -:::image type="content" source="images/event-3099-options.png" alt-text="Event 3099 policy rule options."::: - -For a simple solution for converting hex to binary, follow these steps: - -1. Open the Calculator app. -1. Select the menu icon. :::image type="icon" source="images/calculator-menu-icon.png" border="false"::: -1. Select **Programmer** mode. -1. Select **HEX**. :::image type="icon" source="images/hex-icon.png" border="false"::: -1. Enter your hex code. For example, `80881000`. -1. Switch to the **Bit Toggling Keyboard**. :::image type="icon" source="images/bit-toggling-keyboard-icon.png" border="false"::: - -:::image type="content" source="images/calculator-with-hex-in-binary.png" alt-text="An example of the calculator app in programmer mode, with a hex code converted into binary."::: - -This view will provide the hex code in binary form, with each bit address shown separately. The bit addresses start at 0 in the bottom right. Each bit address correlates to a specific event policy-rule option. If the bit address holds a value of 1, the setting is in the policy. - -Next, use the bit addresses and their values from the table below to determine the state of each [policy rule-option](select-types-of-rules-to-create.md#table-1-windows-defender-application-control-policy---policy-rule-options). For example, if the bit address of 16 holds a value of 1, then the **Enabled: Audit Mode (Default)** option is in the policy. This setting means that the policy is in audit mode. - -| Bit Address | Policy Rule Option | -|-------|------| -| 2 | `Enabled:UMCI` | -| 3 | `Enabled:Boot Menu Protection` | -| 4 | `Enabled:Intelligent Security Graph Authorization` | -| 5 | `Enabled:Invalidate EAs on Reboot` | -| 7 | `Required:WHQL` | -| 10 | `Enabled:Allow Supplemental Policies` | -| 11 | `Disabled:Runtime FilePath Rule Protection` | -| 13 | `Enabled:Revoked Expired As Unsigned` | -| 16 | `Enabled:Audit Mode (Default)` | -| 17 | `Disabled:Flight Signing` | -| 18 | `Enabled:Inherit Default Policy` | -| 19 | `Enabled:Unsigned System Integrity Policy (Default)` | -| 20 | `Enabled:Dynamic Code Security` | -| 21 | `Required:EV Signers` | -| 22 | `Enabled:Boot Audit on Failure` | -| 23 | `Enabled:Advanced Boot Options Menu` | -| 24 | `Disabled:Script Enforcement` | -| 25 | `Required:Enforce Store Applications` | -| 27 | `Enabled:Managed Installer` | -| 28 | `Enabled:Update Policy No Reboot` | +Events 3091 and 3092 are inactive on some versions of Windows and are turned on by the preceding command. ## Appendix @@ -152,11 +134,11 @@ A list of other relevant event IDs and their corresponding description. | 3012 | Code Integrity started loading the signature catalog. | | 3023 | The driver file under validation didn't meet the requirements to pass the application control policy. | | 3024 | Windows application control was unable to refresh the boot catalog file. | -| 3026 | The catalog loaded is signed by a signing certificate that has been revoked by Microsoft and/or the certificate issuing authority. | -| 3032 | The file under validation is revoked by the system or the file has a signature that has been revoked. +| 3026 | Microsoft or the certificate issuing authority revoked the certificate that signed the catalog. | +| 3032 | The file under validation is revoked or the file has a signature that is revoked. | 3033 | The file under validation didn't meet the requirements to pass the application control policy. | | 3034 | The file under validation wouldn't meet the requirements to pass the Application Control policy if it was enforced. The file was allowed since the policy is in audit mode. | -| 3036 | The signed file under validation is signed by a code signing certificate that has been revoked by Microsoft or the certificate issuing authority. | +| 3036 | Microsoft or the certificate issuing authority revoked the certificate that signed the file being validated. | | 3064 | If the Application Control policy was enforced, a user mode DLL under validation wouldn't meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. | | 3065 | If the Application Control policy was enforced, a user mode DLL under validation wouldn't meet the requirements to pass the application control policy. | | 3074 | Page hash failure while hypervisor-protected code integrity was enabled. | @@ -166,18 +148,18 @@ A list of other relevant event IDs and their corresponding description. | 3079 | The file under validation didn't meet the requirements to pass the application control policy. | | 3080 | If the Application Control policy was in enforced mode, the file under validation wouldn't have met the requirements to pass the application control policy. | | 3081 | The file under validation didn't meet the requirements to pass the application control policy. | -| 3082 | If the Application Control policy was in enforced mode, the non-WHQL driver would have been denied by the policy. | -| 3084 | Code Integrity will enforce the WHQL driver signing requirements on this boot session. | -| 3085 | Code Integrity won't enforce the WHQL driver signing requirements on this boot session. | +| 3082 | If the Application Control policy was enforced, the policy would have blocked this non-WHQL driver. | +| 3084 | Code Integrity is enforcing WHQL driver signing requirements on this boot session. | +| 3085 | Code Integrity isn't enforcing WHQL driver signing requirements on this boot session. | | 3086 | The file under validation doesn't meet the signing requirements for an isolated user mode (IUM) process. | -| 3089 | This event contains signature information for files that were blocked or would have been blocked by Application Control. One 3089 event is created for each signature of a file. | +| 3089 | This event contains signature information for files that were blocked or audit blocked by Application Control. One 3089 event is created for each signature of a file. | | 3090 | *Optional* This event indicates that a file was allowed to run based purely on ISG or managed installer. | | 3091 | This event indicates that a file didn't have ISG or managed installer authorization and the Application Control policy is in audit mode. | | 3092 | This event is the enforcement mode equivalent of 3091. | | 3095 | The Application Control policy can't be refreshed and must be rebooted instead. | | 3096 | The Application Control policy wasn't refreshed since it's already up-to-date. | | 3097 | The Application Control policy can't be refreshed. | -| 3099 | Indicates that a policy has been loaded. This event also includes information about the options that were specified by the Application Control policy. | +| 3099 | Indicates that a policy has been loaded. This event also includes information about the options set by the Application Control policy. | | 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. | | 3101 | The system started refreshing the Application Control policy. | | 3102 | The system finished refreshing the Application Control policy. | @@ -187,5 +169,5 @@ A list of other relevant event IDs and their corresponding description. | 3108 | Windows mode change event was successful. | | 3110 | Windows mode change event was unsuccessful. | | 3111 | The file under validation didn't meet the hypervisor-protected code integrity (HVCI) policy. | -| 3112 | The file under validation is signed by a certificate that has been explicitly revoked by Windows. | +| 3112 | Windows has revoked the certificate that signed the file being validated. | | 3114 | Dynamic Code Security opted the .NET app or DLL into Application Control policy validation. The file under validation didn't pass your policy and was blocked. | diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md index f358465735..04be400ff9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md @@ -10,17 +10,17 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 07/13/2021 +ms.date: 03/24/2023 ms.technology: itpro-security ms.topic: article --- # Understanding Application Control event tags -Windows Defender Application Control (WDAC) events include many fields, which provide helpful troubleshooting information to figure out exactly what an event means. Below, we've documented the values and meanings for a few useful event tags. +Windows Defender Application Control (WDAC) events include many fields, which provide helpful troubleshooting information to figure out exactly what an event means. This article describes the values and meanings for a few useful event tags. ## SignatureType @@ -30,21 +30,21 @@ Represents the type of signature which verified the image. |---|----------| | 0 | Unsigned or verification hasn't been attempted | | 1 | Embedded signature | -| 2 | Cached signature; presence of CI EA shows that file had been previously verified | +| 2 | Cached signature; presence of a CI EA means the file was previously verified | | 3 | Cached catalog verified via Catalog Database or searching catalog directly | | 4 | Uncached catalog verified via Catalog Database or searching catalog directly | | 5 | Successfully verified using an EA that informs CI that catalog to try first | | 6 | AppX / MSIX package catalog verified | | 7 | File was verified | -## ValidatedSigningLevel +## Requested and Validated Signing Level Represents the signature level at which the code was verified. -| ValidatedSigningLevel Value | Explanation | +| SigningLevel Value | Explanation | |---|----------| | 0 | Signing level hasn't yet been checked | -| 1 | File is unsigned | +| 1 | File is unsigned or has no signature that passes the active policies | | 2 | Trusted by Windows Defender Application Control policy | | 3 | Developer signed code | | 4 | Authenticode signed | @@ -76,15 +76,15 @@ Represents why verification failed, or if it succeeded. | 11 | Page hash mismatch | | 12 | Not valid for a PPL (Protected Process Light) | | 13 | Not valid for a PP (Protected Process) | -| 14 | The signature is missing the required ARM EKU | +| 14 | The signature is missing the required ARM processor EKU | | 15 | Failed WHQL check | | 16 | Default policy signing level not met | | 17 | Custom policy signing level not met; returned when signature doesn't validate against an SBCP-defined set of certs | -| 18 | Custom signing level not met; returned if signature fails to match CISigners in UMCI | -| 19 | Binary is revoked by file hash | +| 18 | Custom signing level not met; returned if signature fails to match `CISigners` in UMCI | +| 19 | Binary is revoked based on its file hash | | 20 | SHA1 cert hash's timestamp is missing or after valid cutoff as defined by Weak Crypto Policy | | 21 | Failed to pass Windows Defender Application Control policy | -| 22 | Not IUM (Isolated User Mode) signed; indicates trying to load a non-trustlet binary into a trustlet | +| 22 | Not Isolated User Mode (IUM)) signed; indicates an attempt to load a non-trustlet binary into a trustlet | | 23 | Invalid image hash | | 24 | Flight root not allowed; indicates trying to run flight-signed code on production OS | | 25 | Anti-cheat policy violation | @@ -92,6 +92,56 @@ Represents why verification failed, or if it succeeded. | 27 | The signing chain appears to be tampered/invalid | | 28 | Resource page hash mismatch | +## Policy activation event Options + +The Application Control policy rule option values can be derived from the "Options" field in the Details section for successful [policy activation events](event-id-explanations.md#wdac-policy-activation-events). To parse the values, first convert the hex value to binary. To derive and parse these values, follow the below workflow. + +- Access Event Viewer. +- Access the Code integrity 3099 event. +- Access the details pane. +- Identify the hex code listed in the "Options" field. +- Convert the hex code to binary. + +:::image type="content" source="images/event-3099-options.png" alt-text="Event 3099 policy rule options."::: + +For a simple solution for converting hex to binary, follow these steps: + +1. Open the Calculator app. +1. Select the menu icon. :::image type="icon" source="images/calculator-menu-icon.png" border="false"::: +1. Select **Programmer** mode. +1. Select **HEX**. :::image type="icon" source="images/hex-icon.png" border="false"::: +1. Enter your hex code. For example, `80881000`. +1. Switch to the **Bit Toggling Keyboard**. :::image type="icon" source="images/bit-toggling-keyboard-icon.png" border="false"::: + +:::image type="content" source="images/calculator-with-hex-in-binary.png" alt-text="An example of the calculator app in programmer mode, with a hex code converted into binary."::: + +This view provides the hex code in binary form, with each bit address shown separately. The bit addresses start at 0 in the bottom right. Each bit address correlates to a specific event policy-rule option. If the bit address holds a value of 1, the setting is in the policy. + +Next, use the bit addresses and their values from the following table to determine the state of each [policy rule-option](select-types-of-rules-to-create.md#table-1-windows-defender-application-control-policy---policy-rule-options). For example, if the bit address of 16 holds a value of 1, then the **Enabled: Audit Mode (Default)** option is in the policy. This setting means that the policy is in audit mode. + +| Bit Address | Policy Rule Option | +|-------|------| +| 2 | `Enabled:UMCI` | +| 3 | `Enabled:Boot Menu Protection` | +| 4 | `Enabled:Intelligent Security Graph Authorization` | +| 5 | `Enabled:Invalidate EAs on Reboot` | +| 7 | `Required:WHQL` | +| 10 | `Enabled:Allow Supplemental Policies` | +| 11 | `Disabled:Runtime FilePath Rule Protection` | +| 13 | `Enabled:Revoked Expired As Unsigned` | +| 16 | `Enabled:Audit Mode (Default)` | +| 17 | `Disabled:Flight Signing` | +| 18 | `Enabled:Inherit Default Policy` | +| 19 | `Enabled:Unsigned System Integrity Policy (Default)` | +| 20 | `Enabled:Dynamic Code Security` | +| 21 | `Required:EV Signers` | +| 22 | `Enabled:Boot Audit on Failure` | +| 23 | `Enabled:Advanced Boot Options Menu` | +| 24 | `Disabled:Script Enforcement` | +| 25 | `Required:Enforce Store Applications` | +| 27 | `Enabled:Managed Installer` | +| 28 | `Enabled:Update Policy No Reboot` | + ## Microsoft Root CAs trusted by Windows The rule means trust anything signed by a certificate that chains to this root CA. @@ -101,7 +151,7 @@ The rule means trust anything signed by a certificate that chains to this root C | 0| None | | 1| Unknown | | 2 | Self-Signed | -| 3 | Authenticode | +| 3 | Microsoft Authenticode(tm) Root Authority | | 4 | Microsoft Product Root 1997 | | 5 | Microsoft Product Root 2001 | | 6 | Microsoft Product Root 2010 | @@ -123,4 +173,4 @@ For well-known roots, the TBS hashes for the certificates are baked into the cod ## Status values -Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details. +Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. See [NTSATUS](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) for information about common usage details. diff --git a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md index 3bd14575c5..fdbd1d7ecc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md @@ -8,7 +8,7 @@ author: jsuther1974 ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 03/16/2023 +ms.date: 03/31/2023 ms.technology: itpro-security --- @@ -23,7 +23,7 @@ ms.technology: itpro-security > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. For more information, see [Windows Defender Application Control feature availability](feature-availability.md). -When you create policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that you can use. +When you create policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that you can use. These example policies are provided "as-is". You should thoroughly test the policies you deploy using safe deployment methods. | **Example Base Policy** | **Description** | **Where it can be found** | |-------------------------|---------------------------------------------------------------|--------| @@ -31,7 +31,7 @@ When you create policies for use with Windows Defender Application Control (WDAC | **AllowMicrosoft.xml** | This example policy includes the rules from DefaultWindows and adds rules to trust apps signed by the Microsoft product root certificate. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowMicrosoft.xml
          %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\AllowMicrosoft.xml | | **AllowAll.xml** | This example policy is useful when creating a blocklist. All block policies should include rules allowing all other code to run and then add the DENY rules for your organization's needs. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml | | **AllowAll_EnableHVCI.xml** | This example policy can be used to enable [memory integrity](https://support.microsoft.com/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78) (also known as hypervisor-protected code integrity) using WDAC. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll_EnableHVCI.xml | -| **DenyAllAudit.xml** | ***Warning: May cause long boot time on Windows Server 2019.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml | +| **DenyAllAudit.xml** | ***Warning: Will cause boot issues on Windows Server 2019 and earlier. Do not use on those operating systems.*** Only deploy this example policy in audit mode to track all binaries running on critical systems or to meet regulatory requirements. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml | | **Microsoft Configuration Manager** | Customers who use Configuration Manager can deploy a policy with Configuration Manager's built-in WDAC integration, and then use the generated policy XML as an example base policy. | %OSDrive%\Windows\CCM\DeviceGuard on a managed endpoint | | **SmartAppControl.xml** | This example policy includes rules based on [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) that are well-suited for lightly managed systems. This policy includes a rule that is unsupported for enterprise WDAC policies and must be removed. For more information about using this example policy, see [Create a custom base policy using an example base policy](create-wdac-policy-for-lightly-managed-devices.md#create-a-custom-base-policy-using-an-example-wdac-base-policy). | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml
          %ProgramFiles%\WindowsApps\Microsoft.WDAC.WDACWizard*\SignedReputable.xml | | **Example supplemental policy** | This example policy shows how to use supplemental policy to expand the DefaultWindows_Audit.xml allow a single Microsoft-signed file. | %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Supplemental.xml | diff --git a/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png b/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png new file mode 100644 index 0000000000..2b39c88a49 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png differ diff --git a/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png b/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png new file mode 100644 index 0000000000..30d2cba31d Binary files /dev/null and b/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png differ diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands.md b/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands.md index ac290b7659..9c88206c87 100644 --- a/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands.md +++ b/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands.md @@ -65,18 +65,9 @@ CiTool makes Windows Defender Application Control (WDAC) policy management easie 4. List the actively enforced WDAC policies on the system ```powershell - $wdacPolicies = (CiTool -lp -json | ConvertFrom-Json).Policies - # Check each policy's IsEnforced state and return only the enforced policies - foreach($wdacPolicy in $wdacPolicies ){ - - if($wdacPolicy.IsEnforced) - { - Write-Host $wdacPolicy.FriendlyName - Write-Host $wdacPolicy.PolicyID "`n" - } - } - + (CiTool -lp -json | ConvertFrom-Json).Policies | Where-Object {$_.IsEnforced -eq "True"} | + Select-Object -Property PolicyID,FriendlyName | Format-List ``` 5. Display the help menu diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md index a5642a032c..d6e821e8be 100644 --- a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md @@ -9,7 +9,7 @@ ms.reviewer: jogeurte ms.author: jogeurte ms.manager: jsuther manager: aaroncz -ms.date: 02/02/2023 +ms.date: 04/04/2023 ms.technology: itpro-security ms.topic: article ms.localizationpriority: medium @@ -28,15 +28,34 @@ ms.localizationpriority: medium This article covers tips and tricks for admins and known issues with Windows Defender Application Control (WDAC). Test this configuration in your lab before enabling it in production. -## Managed Installer and ISG will cause garrulous events +## WDAC policy file locations + +**Multiple policy format WDAC policies** are found in the following locations depending on whether the policy is signed or not, and the method of policy deployment that was used. + +- <OS Volume>\\Windows\\System32\\CodeIntegrity\\CiPolicies\Active\\*\{PolicyId GUID\}*.cip +- <EFI System Partition>\\Microsoft\\Boot\\CiPolicies\Active\\*\{PolicyId GUID\}*.cip + +The *\{PolicyId GUID\}* value is unique by policy and defined in the policy XML with the <PolicyId> element. + +For **single policy format WDAC policies**, in addition to the two locations above, also look for a file called SiPolicy.p7b that may be found in the following locations: + +- <EFI System Partition>\\Microsoft\\Boot\\SiPolicy.p7b +- <OS Volume>\\Windows\\System32\\CodeIntegrity\\SiPolicy.p7b + +> [!NOTE] +> A multiple policy format WDAC policy using the single policy format GUID `{A244370E-44C9-4C06-B551-F6016E563076}` may exist under any of the policy file locations. + +## Known issues + +### Managed Installer and ISG may cause excessive events When Managed Installer and ISG are enabled, 3091 and 3092 events will be logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events have been moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy. -## .NET native images may generate false positive block events +### .NET native images may generate false positive block events In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image will fall back to its corresponding assembly and .NET will regenerate the native image at its next scheduled maintenance window. -## MSI Installations launched directly from the internet are blocked by WDAC +### MSI Installations launched directly from the internet are blocked by WDAC Installing .msi files directly from the internet to a computer protected by WDAC will fail. For example, this command won't work: diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md new file mode 100644 index 0000000000..81ed21b671 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting.md @@ -0,0 +1,257 @@ +--- +title: WDAC debugging and troubleshooting guide +description: Learn how to debug and troubleshoot app and script failures when using WDAC +author: valemieux +ms.author: jogeurte +ms.reviewer: jsuther1974 +ms.topic: how-to +ms.date: 03/23/2023 +ms.custom: template-how-to +ms.prod: windows-client +ms.technology: itpro-security +--- + +# WDAC debugging and troubleshooting + +**Applies to** + +- Windows 10 +- Windows 11 +- Windows Server 2016 and later + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). + +This article describes how to debug and troubleshoot app and script failures when using Windows Defender Application Control (WDAC). + +## 1 - Gather WDAC diagnostic data + +Before debugging and troubleshooting WDAC issues, you must collect information from a device exhibiting the problem behavior. + +Run the following commands from an elevated PowerShell window to collect the diagnostic information you may need: + +1. Gather general WDAC diagnostic data and copy it to %userprofile%\AppData\Local\Temp\DiagOutputDir\CiDiag: + + ```powershell + cidiag.exe /stop + ``` + + If CiDiag.exe isn't present in your version of Windows, gather this information manually: + + - WDAC policy binaries from the [Windows and EFI system partitions](known-issues.md#wdac-policy-file-locations) + - [WDAC event logs](#core-wdac-event-logs) + - [AppLocker event logs](#core-wdac-event-logs) + - [Other event logs that may contain useful information](#other-windows-event-logs-that-may-be-useful) from other Windows apps and services + +2. Save the device's System Information to the CiDiag folder: + + ```powershell + msinfo32.exe /report $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\SystemInformation.txt + ``` + +3. Use [CiTool.exe](citool-commands.md) to inventory the list of WDAC policies on the device. Skip this step if CiTool.exe isn't present in your version of Windows. + + ```powershell + citool.exe -lp -json > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\CiToolOutput.json + ```` + +4. Export AppLocker registry key data to the CiDiag folder: + + ```powershell + reg.exe query HKLM\Software\Policies\Microsoft\Windows\SrpV2 /s > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt; reg.exe query HKLM\Software\Policies\Microsoft\Windows\AppidPlugins /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt; reg.exe query HKLM\System\CurrentControlSet\Control\Srp\ /s >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerRegistry.txt + ``` + + > [!NOTE] + > You may see an error that the system was unable to find the specified registry key or value. This error doesn't indicate a problem and can be ignored. + +5. Copy any AppLocker policy files from %windir%System32\AppLocker to the CiDiag folder: + + ```powershell + Copy-Item -Path $env:windir\System32\AppLocker -Destination $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\ -Recurse -Force -ErrorAction Ignore + ``` + +6. Collect file information for the AppLocker policy files collected in the previous step: + + ```powershell + Get-ChildItem -Path $env:windir\System32\AppLocker\ -Recurse | select Mode,LastWriteTime,CreationTime,Length,Name >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerPolicyFiles.txt + ``` + +7. Export the effective AppLocker policy: + + ```powershell + Get-AppLockerPolicy -xml -Effective > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml + ``` + +8. Collect AppLocker services configuration and state information: + + ```powershell + sc.exe query appid > $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt; sc.exe query appidsvc >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt; sc.exe query applockerfltr >> $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt + ``` + +### Core WDAC event logs + +WDAC events are generated under two locations: + +- Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational +- Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script + +Within the CiDiag output directory, these event logs are called CIOperational.evtx and ALMsiAndScript.evtx, respectively. + +### Other Windows event logs that may be useful + +Sometimes, you may be able to supplement the information contained in the core WDAC event logs with information found in these other event logs. CIDiag.exe doesn't collect the ones shown in *italics*. + +- Applications and Services logs – Microsoft – Windows – CodeIntegrity – Verbose +- Applications and Services logs – Microsoft – Windows – AppLocker – EXE and DLL +- Applications and Services logs – Microsoft – Windows – AppLocker – Packaged app-Deployment +- Applications and Services logs – Microsoft – Windows – AppLocker – Packaged app-Execution +- Applications and Services logs – Microsoft – Windows – AppID - Operational +- Applications and Services logs – Microsoft – Windows – CAPI2 - Operational +- Applications and Services logs – Microsoft – Windows – DeviceGuard - Operational +- *Applications and Services logs – Microsoft – Windows – PowerShell - \** +- *Windows - Application* +- *Windows - System* + +## 2 - Use the diagnostic and log data to identify problems + +Having gathered the necessary diagnostic information from a device, you're ready to begin your analysis of the diagnostic data collected in the previous section. + +1. Verify the set of WDAC policies that are active and enforced. Confirm that only those policies you expect to be active are currently active. Be aware of the [Windows inbox policies](inbox-wdac-policies.md) that may also be active. You can use either of these methods: + + - Review the output from *CiTool.exe -lp*, if applicable, which was saved to the CIDiag output directory as CiToolOutput.json. See [use Microsoft Edge to view the formatted json file](/microsoft-edge/devtools-guide-chromium/json-viewer/json-viewer). + - Review all [policy activation events](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations#wdac-policy-activation-events) from the core WDAC event log found at **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx. + +2. Review any [block events for executables, dlls, and drivers](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations#wdac-block-events-for-executables-dlls-and-drivers) from the core WDAC event log found at **Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational**. Within the CIDiag output directory, this event log is called CIOperational.evtx. Use information from the block events and their correlated 3089 signature details event(s) to investigate any blocks that are unexplained or unexpected. See the blocked executable example described later in this article for reference. +3. Review any [block events for packaged apps, MSI installers, scripts, and COM objects](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations#wdac-block-events-for-packaged-apps-msi-installers-scripts-and-com-objects) from the core script enforcement event log found at **Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script**. Within the CIDiag output directory, this event log is called ALMsiAndScript.evtx. Use information from the block events and their correlated 8038 signature details event(s) to investigate any blocks that are unexplained or unexpected. + +Most WDAC-related issues, including app and script failures, can be diagnosed using the preceding steps. + +### Event analysis for an example blocked executable + +Here's an example of detailed EventData from a typical WDAC enforcement mode block event 3077, and one of its correlated 3089 signature information events. The tables that follow each event screenshot describe some of the elements contained in the events. Following the event descriptions is a step-by-step walkthrough explaining how to use the events to understand why the block occurred. + +#### Event 3077 - WDAC enforcement block event + +![Example 3077 block event for PowerShell.exe.](/windows/security/threat-protection/windows-defender-application-control/images/event-3077.png) + +| Element name | Description | +| ----- | ----- | +| System - Correlation - \[ActivityID\] | **Not shown in screenshot**
          Use the correlation ActivityID to match a WDAC block event with one or more 3089 signature events. | +| File Name | The file's path and name on disk that was blocked from running. Since the name on disk is mutable, this value **isn't** the one used when creating WDAC file rules with `-Level FileName`. Instead, see the OriginalFileName element later in this table. | +| Process Name | The path and name of the file that attempted to run the blocked file. Also called the parent process. | +| Requested Signing Level | The Windows signing authorization level the code needed to pass in order to run. See [Requested and validated signing level](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#requested-and-validated-signing-level). | +| Validated Signing Level | The Windows signing authorization level the code was given. See [Requested and validated signing level](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#requested-and-validated-signing-level). | +| Status | Windows NT status code. You can use `certutil.exe -error ` to look up the meaning of the status code. | +| SHA1 Hash | The SHA1 Authenticode hash for the blocked file. | +| SHA256 Hash | The SHA256 Authenticode hash for the blocked file. | +| SHA1 Flat Hash | The SHA1 flat file hash for the blocked file. | +| SHA256 Flat Hash | The SHA256 flat file hash for the blocked file. | +| PolicyName | The friendly name of the WDAC policy that caused the block event. A separate 3077 block event (or 3076 audit block event) is shown for each policy that blocks the file from running. | +| PolicyId | The friendly ID value of the WDAC policy that caused the block event. | +| PolicyHash | The SHA256 Authenticode hash of the WDAC policy binary that caused the block event. | +| OriginalFileName | The immutable file name set by the developer in the blocked file's resource header. This value is the one used when creating WDAC file rules with `-Level FileName`. | +| InternalName | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel InternalName`. | +| FileDescription | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel FileDescription`. | +| ProductName | Another immutable value set by the developer in the blocked file's resource header. You can substitute this value for the OriginalFileName in file rules with `-Level FileName -SpecificFileNameLevel ProductName`. | +| FileVersion | The policy's VersionEx value used to enforce version control over signed policies. | +| PolicyGUID | The PolicyId of the WDAC policy that caused the block event. | +| UserWriteable | A boolean value indicating if the file was in a user-writeable location. This information is useful for diagnosing issues when allowing by FilePath rules. | +| PackageFamilyName | The Package Family Name for the packaged app (MSIX) that includes the blocked file. | + +#### Event 3089 - WDAC signature information event + +![Example 3089 signature information event for PowerShell.exe.](/windows/security/threat-protection/windows-defender-application-control/images/event-3089.png) + +| Element name | Description | +| ----- | ----- | +| System - Correlation - \[ActivityID\] | Use the correlation ActivityID to match a WDAC signature event with its block event. | +| TotalSignatureCount | The total number of signatures detected for the blocked file. | +| Signature | The index count, starting at 0, of the current signature shown in this 3089 event. If the file had multiple signatures, you'll find other 3089 events for the other signatures. | +| Hash | The hash value that WDAC used to match the file. This value should match one of the four hashes shown on the 3077 or 3076 block event. If no signatures were found for the file (TotalSignatureCount = 0), then only the hash value is shown. | +| SignatureType | The [type of signature](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#signaturetype). | +| ValidatedSigningLevel | The Windows signing authorization level the signature met. See [Requested and validated signing level](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#requested-and-validated-signing-level). | +| VerificationError | The reason this particular signature failed to pass the WDAC policy. See [VerificationError](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations#verificationerror). | +| PublisherName | The common name (CN) value from the leaf certificate. | +| IssuerName | The CN value from the highest available certificate in the certificate chain. This level is typically one certificate below the root. | +| PublisherTBSHash | The TBS hash of the leaf certificate. | +| IssuerTBSHash | The TBS hash of the highest available certificate in the certificate chain. This level is typically one certificate below the root. | + +#### Step-by-step walkthrough of the example 3077 and 3089 events + +Now let's walk through how to use the event data in the example 3077 and 3089 events to understand why the WDAC policy blocked this file. + +##### Understand what file is being blocked and the block context + +Referring to the 3077 event, locate the information that identifies the policy, the file being blocked, and the parent process that tried to run it. Consider this context information to determine whether the block is expected and wanted. + +In the example, the file being blocked is PowerShell.exe, which is part of Windows and would normally be expected to run. However, in this case, the policy was based off of the Windows in S mode policy template, which doesn't allow script hosts to run as a way to limit the attack surface. For S mode, this block event is a success. But let's assume the policy author was unaware of that constraint when they chose the template, and treat this block as unexpected. + +##### Determine why WDAC rejected the file + +Again referring to the 3077 event, we see the Requested Signing Level of 2 means the code must pass the WDAC policy. But the Validated Signing Level of 1 means the code was treated as though unsigned. "Unsigned" could mean the file was truly unsigned, signed but with an invalid certificate, or signed but without any certificates allowed by the WDAC policy. + +Now, let's inspect the correlated 3089 event(s) for the blocked file. In the example, we're looking at only the first signature (Signature index 0) found on a file that had multiple signatures. For this signature, the ValidatedSigningLevel is 12, meaning it has a Microsoft Windows product signature. The VerificationError of 21 means that the signature didn't pass the WDAC policy. + +It's important to review the information for each correlated 3089 event as each signature may have a different ValidatedSigningLevel and VerificationError. + +> [!IMPORTANT] +> Notice how the Validated Signing Level on the 3077 event is interpreted very differently from the ValidatedSigningLevel on the 3089 event. +> +> In the case of the 3077 event, Validated Signing Level tells us how the binary was actually treated by Windows. +> +> In the case of the 3089 event, on the other hand, ValidatedSigningLevel tells us the potential **maximum** level the signature could receive. We must use the VerificationError to understand why the signature was rejected. + +## 3 - Resolve common problems + +Having analyzed the WDAC diagnostic data, you can take steps to resolve the issue or do more debugging steps. Following are some common problems and steps you can try to resolve or further isolate the root issue: + +### Issue: A file was blocked that you want to allow + +- Use data from the core WDAC event logs to add rules to allow the blocked file. +- Redeploy the file or app using a managed installer if your policy trusts managed installers. + +### Issue: A policy is active that is unexpected + +This condition may exist if: + +- A policy was removed but the system hasn't been rebooted. +- A policy was partially removed, but a copy of the policy still exists in either the System or EFI partition. +- A policy with PolicyId {A244370E-44C9-4C06-B551-F6016E563076} (single-policy format) was copied to the multiple-policy format policy location before activation, resulting in a duplicate policy binary on disk. Check for both SiPolicy.p7b and \{A244370E-44C9-4C06-B551-F6016E563076\}.cip files in the System and EFI partitions. +- A policy was incorrectly deployed to the device. +- An attacker with administrator access has applied a policy to cause denial of service for some critical processes. + +To resolve such an issue, follow the instructions to [Remove WDAC policies](/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies) for the identified policy. + +### Issue: An unhandled app failure is occurring and no WDAC events are observed + +Some apps alter their behavior when a user mode WDAC policy is active, which can result in unexpected failures. It can also be a side-effect of script enforcement for apps that don't properly handle the enforcement behaviors implemented by the script hosts. + +Try to isolate the root cause by doing the following actions: + +- Check the other event logs listed in section 1 of this article for events corresponding with the unexpected app failures. +- Temporarily replace the WDAC policy with another policy that [disables script enforcement](/windows/security/threat-protection/windows-defender-application-control/design/script-enforcement) and retest. +- Temporarily replace the WDAC policy with another policy that [allows all COM objects](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy) and retest. +- Temporarily replace the WDAC policy with another policy that relaxes other [policy rules](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-policy-rules) and retest. + +### Issue: An app deployed by a managed installer isn't working + +To debug issues using managed installer, try these steps: + +- Check that the WDAC policy that is blocking the app includes the option to enable managed installer. +- Check that the effective AppLocker policy $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLocker.xml is correct as described in [Automatically allow apps deployed by a managed installer](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer#create-and-deploy-an-applocker-policy-that-defines-your-managed-installer-rules-and-enables-services-enforcement-for-executables-and-dlls). +- Check that the AppLocker services are running. This information is found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created in section 1 of this article. +- Check that an AppLocker file exists called MANAGEDINSTALLER.APPLOCKER exists in the CiDiag folder created earlier. If not, repeat the steps to deploy and enable the managed installer AppLocker configuration. +- Restart the managed installer process and check that an 8002 event is observed in the **AppLocker - EXE and DLL** event log for the managed installer process with PolicyName = MANAGEDINSTALLER. If instead you see an event with 8003 or 8004 with PolicyName = MANAGEDINSTALLER, then check the ManagedInstaller rules in the AppLocker policy XML and ensure a rule matches the managed installer process. +- [Use fsutil.exe](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer#using-fsutil-to-query-extended-attributes-for-managed-installer-mi) to verify files written by the managed installer process have the managed installer origin extended attribute. If not, redeploy the files with the managed installer and check again. +- Test installation of a different app using the managed installer. +- Add another managed installer to your AppLocker policy and test installation using the other managed installer. +- Check if the app is encountering a [known limitation with managed installer](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer#known-limitations-with-managed-installer). If so, you must authorize the app using other means. + +### Issue: An app you expected the Intelligent Security Graph (ISG) to allow isn't working + +To debug issues using ISG, try these steps: + +- Check that the WDAC policy that is blocking the app includes the option to enable the intelligent security graph. +- Check that the AppLocker services are running. This information is found in $env:USERPROFILE\AppData\Local\Temp\DiagOutputDir\CiDiag\AppLockerServices.txt created in section 1 of this article. +- [Use fsutil.exe](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer#using-fsutil-to-query-extended-attributes-for-intelligent-security-graph-isg) to verify files have the ISG origin extended attribute. If not, redeploy the files with the managed installer and check again. +- Check if the app is encountering a [known limitation with ISG](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph#known-limitations-with-using-the-isg). diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md index 1cac513952..35aa964c26 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md @@ -10,10 +10,10 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: vinaypamnani-msft -ms.reviewer: isbrahm +ms.reviewer: jsuther ms.author: vinpa manager: aaroncz -ms.date: 09/30/2020 +ms.date: 04/04/2023 ms.custom: asr ms.technology: itpro-security ms.topic: article @@ -51,7 +51,7 @@ Prior to Windows 10 version 1709, Windows Defender Application Control was known Windows Defender Application Control (WDAC) policies can be created on any client edition of Windows 10 build 1903+, or Windows 11, or on Windows Server 2016 and above. -WDAC policies can be applied to devices running any edition of Windows 10, Windows 11, or Windows Server 2016 and above, via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies to Windows 10 and Windows 11 Enterprise edition, or Windows Server 2016 and above, but can't deploy policies to devices running non-Enterprise SKUs of Windows 10. +WDAC policies can be applied to devices running any edition of Windows 10, Windows 11, or Windows Server 2016 and above, via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies, but is limited to single-policy format policies that work on Windows Server 2016 and 2019. For more information on which individual WDAC features are available on specific WDAC builds, see [WDAC feature availability](feature-availability.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md index 4a03e5ee20..5697c8f256 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md @@ -10,10 +10,10 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 03/16/2020 +ms.date: 03/30/2023 ms.technology: itpro-security ms.topic: article --- @@ -29,22 +29,17 @@ ms.topic: article > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -After enabling you understand how to design and deploy your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they aren't behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature. - -## WDAC Events Overview - -Windows Defender Application Control generates and logs events when a policy is loaded as well as when a binary attempts to execute and is blocked. These events include information that identifies the policy and gives more details about the block. Generally, WDAC doesn't generate events when a binary is allowed; however, there's the option to enable events when Managed Installer and/or the Intelligent Security Graph (ISG) is configured. - -WDAC events are generated under two locations: - - - Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational - - - Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script +You now understand how to design and deploy your Windows Defender Application Control (WDAC) policies. This guide explains how to understand the effects your policies have and how to troubleshoot when they aren't behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature. ## In this section -| Topic | Description | +| Article | Description | | - | - | -| [Understanding Application Control event IDs](event-id-explanations.md) | This topic explains the meaning of different WDAC event IDs. | -| [Understanding Application Control event tags](event-tag-explanations.md) | This topic explains the meaning of different WDAC event tags. | -| [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md) | This topic covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender for Endpoint. | +| [Debugging and troubleshooting](/windows/security/threat-protection/windows-defender-application-control/operations/wdac-debugging-and-troubleshooting) | This article explains how to debug app and script failures with WDAC. | +| [Understanding Application Control event IDs](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations) | This article explains the meaning of different WDAC event IDs. | +| [Understanding Application Control event tags](/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations) | This article explains the meaning of different WDAC event tags. | +| [Query WDAC events with Advanced hunting](/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting) | This article covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender for Endpoint. | +| [Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues) | This article describes some WDAC Admin Tips & Known Issues. | +| [Managed installer and ISG technical reference and troubleshooting guide](/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer) | This article provides technical details and debugging steps for managed installer and ISG. | +| [CITool.exe technical reference](/windows/security/threat-protection/windows-defender-application-control/operations/citool-commands) | This article explains how to use CITool.exe. | +| [Inbox WDAC policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) | This article describes the WDAC policies that ship with Windows and when they're active. | diff --git a/windows/whats-new/deprecated-features-resources.md b/windows/whats-new/deprecated-features-resources.md index f00940e722..6728e2b1bd 100644 --- a/windows/whats-new/deprecated-features-resources.md +++ b/windows/whats-new/deprecated-features-resources.md @@ -9,7 +9,9 @@ author: mestew ms.author: mstewart manager: aaroncz ms.topic: reference -ms.collection: highpri, tier1 +ms.collection: + - highpri + - tier1 --- # Resources for deprecated features diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 331770192b..84ceba70f7 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -8,8 +8,10 @@ ms.localizationpriority: medium author: mestew ms.author: mstewart manager: aaroncz -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: conceptual +ms.collection: + - highpri + - tier1 --- # Deprecated features for Windows client diff --git a/windows/whats-new/feature-lifecycle.md b/windows/whats-new/feature-lifecycle.md index d97cc8895b..d987cfd951 100644 --- a/windows/whats-new/feature-lifecycle.md +++ b/windows/whats-new/feature-lifecycle.md @@ -9,7 +9,9 @@ ms.author: mstewart ms.topic: article ms.technology: itpro-fundamentals ms.date: 10/28/2022 -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 --- # Windows client features lifecycle diff --git a/windows/whats-new/index.yml b/windows/whats-new/index.yml index d1f1ec51df..c988c8ebb4 100644 --- a/windows/whats-new/index.yml +++ b/windows/whats-new/index.yml @@ -11,6 +11,7 @@ metadata: ms.topic: landing-page ms.collection: - highpri + - tier1 author: aczechowski ms.author: aaroncz manager: dougeby diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index 78b5590c17..e294bee159 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -6,8 +6,7 @@ author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: low -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: overview ms.technology: itpro-fundamentals ms.date: 12/31/2017 --- diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 14d7f14fa9..d3e3ac864f 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -6,10 +6,9 @@ description: New and updated IT Pro content about new features in Windows 10 Ent ms.prod: windows-client author: mestew ms.localizationpriority: medium -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: conceptual ms.technology: itpro-fundamentals -ms.date: 12/31/2017 +ms.date: 04/05/2023 --- # What's new in Windows 10 Enterprise LTSC 2019 @@ -36,7 +35,8 @@ The Windows 10 Enterprise LTSC 2019 release is an important release for LTSC use ## Microsoft Intune -Microsoft Intune supports Windows 10 Enterprise LTSC 2019 and later. However, Windows 10 update rings device profiles don't support LTSC releases. For installing software updates, use the [policy configuration service provider (CSP)](/windows/client-management/mdm/policy-csp-update), Windows Server Update Services (WSUS), or Microsoft Configuration Manager. +Microsoft Intune supports Windows 10 Enterprise LTSC 2019 with the following exception: +- [Update rings](/mem/intune/protect/windows-10-update-rings) can't be used for feature updates since they aren't supported by Windows Update for Business. Update rings can be used for quality updates for Windows 10 Enterprise LTSC 2019 clients. ## Security @@ -201,7 +201,7 @@ Windows Hello for Business now supports FIDO 2.0 authentication for Azure AD Joi - Windows Hello is part of the account protection pillar in Windows Defender Security Center. Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign-in, and will notify Dynamic lock users if Dynamic lock has stopped working because their device Bluetooth is off. -- You can set up Windows Hello from lock screen for Microsoft accounts. We’ve made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options. +- You can set up Windows Hello from lock screen for Microsoft accounts. We've made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options. - New [public API](/uwp/api/windows.security.authentication.web.core.webauthenticationcoremanager.findallaccountsasync) for secondary account SSO for a particular identity provider. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2021.md b/windows/whats-new/ltsc/whats-new-windows-10-2021.md index ccc6db0ea1..614576055a 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2021.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2021.md @@ -6,18 +6,17 @@ description: New and updated IT Pro content about new features in Windows 10 Ent ms.prod: windows-client author: mestew ms.localizationpriority: high -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: conceptual ms.technology: itpro-fundamentals -ms.date: 12/31/2017 +ms.date: 04/05/2023 --- # What's new in Windows 10 Enterprise LTSC 2021 **Applies to** -- Windows 10 Enterprise LTSC 2021 +- Windows 10 Enterprise LTSC 2021 -This article lists new and updated features and content that is of interest to IT Pros for Windows 10 Enterprise LTSC 2021, compared to Windows 10 Enterprise LTSC 2019 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that is of interest to IT Pros for Windows 10 Enterprise LTSC 2021, compared to Windows 10 Enterprise LTSC 2019 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). > [!NOTE] > Features in Windows 10 Enterprise LTSC 2021 are equivalent to Windows 10, version 21H2.
          @@ -76,11 +75,11 @@ Windows Defender Firewall also now supports [Windows Subsystem for Linux (WSL)]( ### Virus and threat protection -[Attack surface area reduction](/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allowlists and blocklists for specific URL’s and IP addresses. -[Next generation protection](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. - - Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform. - - [Tamper-proofing](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection) capabilities – Uses virtualization-based security to isolate critical Microsoft Defender for Endpoint security capabilities away from the OS and attackers. -[Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Microsoft Defender for Endpoint’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. +[Attack surface area reduction](/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) - IT admins can configure devices with advanced web protection that enables them to define allowlists and blocklists for specific URL's and IP addresses. +[Next generation protection](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-in-windows-10) - Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. + - Integrity enforcement capabilities - Enable remote runtime attestation of Windows 10 platform. + - [Tamper-proofing](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection) capabilities - Uses virtualization-based security to isolate critical Microsoft Defender for Endpoint security capabilities away from the OS and attackers. +[Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) - In addition to Windows 10, Microsoft Defender for Endpoint's functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware. @@ -105,7 +104,7 @@ Windows Defender Firewall also now supports [Windows Subsystem for Linux (WSL)]( [Microsoft Defender Application Guard](/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements include: - Standalone users can install and configure their Windows Defender Application Guard settings without needing to change registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior. - - Application Guard is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend Application Guard’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the Application Guard extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigation to the Application Guard Edge browser. There's also a companion app to enable this feature in the Microsoft Store. Users can quickly launch Application Guard from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. + - Application Guard is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend Application Guard's browser isolation technology beyond Microsoft Edge. In the latest release, users can install the Application Guard extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigation to the Application Guard Edge browser. There's also a companion app to enable this feature in the Microsoft Store. Users can quickly launch Application Guard from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. To try this extension: 1. Configure Application Guard policies on your device. @@ -129,7 +128,7 @@ Application Guard performance is improved with optimized document opening times: [Application Control for Windows](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903, Windows Defender Application Control (WDAC) added many new features that light up key scenarios and provide feature parity with AppLocker. - - [Multiple Policies](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): Windows Defender Application Control now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side by side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy. + - [Multiple Policies](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): Windows Defender Application Control now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side by side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new 'supplemental' policy. - [Path-Based Rules](/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that aren't user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for unknown admins. If a file is found to be user writeable, the executable is blocked from running unless it's authorized by something other than a path rule like a signer or hash rule.
          This functionality brings WDAC to parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that isn't available with AppLocker. - [Allow COM Object Registration](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, Windows Defender Application Control (WDAC) enforced a built-in allowlist for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where more COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. @@ -171,7 +170,8 @@ An in-place upgrade wizard is available in Configuration Manager. For more infor #### Microsoft Intune -Microsoft Intune supports Windows 10 Enterprise LTSC 2021, except for [Windows Update Rings](/mem/intune/configuration/device-profile-create#create-the-profile) in device profiles. +Microsoft Intune supports Windows 10 Enterprise LTSC 2021 with the following exception: +- [Update rings](/mem/intune/protect/windows-10-update-rings) can't be used for feature updates since they aren't supported by Windows Update for Business. Update rings can be used for quality updates for Windows 10 Enterprise LTSC 2021 clients. A new Intune remote action: **Collect diagnostics**, lets you collect the logs from corporate devices without interrupting or waiting for the end user. For more information, see [Collect diagnostics remote action](/mem/intune/fundamentals/whats-new#collect-diagnostics-remote-action). diff --git a/windows/whats-new/removed-features.md b/windows/whats-new/removed-features.md index d0825bcd12..0cfa8fb10e 100644 --- a/windows/whats-new/removed-features.md +++ b/windows/whats-new/removed-features.md @@ -6,10 +6,12 @@ ms.localizationpriority: medium author: mestew ms.author: mstewart manager: aaroncz -ms.topic: article +ms.topic: conceptual ms.technology: itpro-fundamentals ms.date: 01/05/2023 -ms.collection: highpri, tier1 +ms.collection: + - highpri + - tier1 --- # Features and functionality removed in Windows client @@ -38,6 +40,7 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Support removed | | ----------- | --------------------- | ------ | +| Update Compliance | Update Compliance, a cloud-based service for the Windows client, is retired. This service has been replaced with [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), which provides reporting on client compliance with Microsoft updates from the Azure portal. | March 31, 2023 | | Store uploader tool | Support has been removed for the store uploader tool. This tool is included in the Windows SDK only. The endpoint for the tool has been removed from service and the files will be removed from the SDK in the next release. | November, 2022 | | Internet Explorer 11 | The Internet Explorer 11 desktop application is [retired and out of support](https://aka.ms/IEJune15Blog) as of June 15, 2022 for certain versions of Windows 10. You can still access older, legacy sites that require Internet Explorer with Internet Explorer mode in Microsoft Edge. [Learn how](https://aka.ms/IEmodewebsite). The Internet Explorer 11 desktop application will progressively redirect to the faster, more secure Microsoft Edge browser, and will ultimately be disabled via Windows Update. [Disable IE today](/deployedge/edge-ie-disable-ie11). | June 15, 2022 | | XDDM-based remote display driver | Support for Windows 2000 Display Driver Model (XDDM) based remote display drivers is removed in this release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information on implementing remote display indirect display driver, see [Updates for IddCx versions 1.4 and later](/windows-hardware/drivers/display/iddcx1.4-updates). | 21H1 | diff --git a/windows/whats-new/whats-new-windows-10-version-20H2.md b/windows/whats-new/whats-new-windows-10-version-20H2.md index 078b022d66..3030181ea5 100644 --- a/windows/whats-new/whats-new-windows-10-version-20H2.md +++ b/windows/whats-new/whats-new-windows-10-version-20H2.md @@ -7,7 +7,9 @@ ms.author: mstewart manager: aaroncz ms.localizationpriority: high ms.topic: article -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.technology: itpro-fundamentals ms.date: 12/31/2017 --- diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 77d6e3c52f..af47ae3987 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -7,7 +7,9 @@ ms.author: mstewart manager: aaroncz ms.localizationpriority: high ms.topic: article -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.technology: itpro-fundamentals ms.date: 12/31/2017 --- diff --git a/windows/whats-new/whats-new-windows-10-version-21H2.md b/windows/whats-new/whats-new-windows-10-version-21H2.md index c6aaf4368c..0e8808f228 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H2.md +++ b/windows/whats-new/whats-new-windows-10-version-21H2.md @@ -7,7 +7,9 @@ ms.author: mstewart author: mestew ms.localizationpriority: medium ms.topic: article -ms.collection: highpri, tier2 +ms.collection: + - highpri + - tier2 ms.technology: itpro-fundamentals ms.date: 12/31/2017 --- @@ -35,7 +37,7 @@ To learn more about the status of the November 2021 Update rollout, known issues Windows 10, version 21H2 feature updates are installed annually using the General Availability Channel. Previous feature updates were installed using the General Availability Channel. For more information on this change, see the [How to get the Windows 10 November 2021 Update](https://blogs.windows.com/windowsexperience/?p=176473). -Quality updates are still installed monthly on patch Tuesday. +Quality updates are still installed monthly on the second Tuesday of the month. For more information, see: diff --git a/windows/whats-new/whats-new-windows-10-version-22H2.md b/windows/whats-new/whats-new-windows-10-version-22H2.md index 99199e8037..e1ecaecbb0 100644 --- a/windows/whats-new/whats-new-windows-10-version-22H2.md +++ b/windows/whats-new/whats-new-windows-10-version-22H2.md @@ -7,9 +7,11 @@ ms.author: mstewart author: mestew manager: aaroncz ms.localizationpriority: medium -ms.topic: article +ms.topic: conceptual ms.date: 10/18/2022 -ms.collection: highpri, tier1 +ms.collection: + - highpri + - tier2 --- # What's new in Windows 10, version 22H2 @@ -31,7 +33,7 @@ To learn more about the status of the Windows 10, version 22H2 rollout, known is For more information about updated tools to support this release, see [IT tools to support Windows 10, version 22H2](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-22h2/ba-p/3655750). -The Windows 10, version 22H2 feature update is installed as part of the general availability channel. Quality updates are still installed monthly on patch Tuesday. +The Windows 10, version 22H2 feature update is installed as part of the general availability channel. Quality updates are still installed monthly on the second Tuesday of the month. For more information, see: diff --git a/windows/whats-new/whats-new-windows-11-version-22H2.md b/windows/whats-new/whats-new-windows-11-version-22H2.md index 9879efdeab..bb565c5358 100644 --- a/windows/whats-new/whats-new-windows-11-version-22H2.md +++ b/windows/whats-new/whats-new-windows-11-version-22H2.md @@ -6,8 +6,10 @@ ms.prod: windows-client ms.author: mstewart author: mestew ms.localizationpriority: medium -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: conceptual +ms.collection: + - highpri + - tier2 ms.technology: itpro-fundamentals ms.date: 12/31/2017 --- diff --git a/windows/whats-new/windows-11-overview.md b/windows/whats-new/windows-11-overview.md index 93f8c35444..df91262622 100644 --- a/windows/whats-new/windows-11-overview.md +++ b/windows/whats-new/windows-11-overview.md @@ -9,7 +9,9 @@ ms.date: 09/20/2022 ms.technology: itpro-fundamentals ms.localizationpriority: medium ms.topic: overview -ms.collection: highpri, tier1 +ms.collection: + - highpri + - tier1 --- # Windows 11 overview diff --git a/windows/whats-new/windows-11-plan.md b/windows/whats-new/windows-11-plan.md index d61ccbad1a..ce4a6efa32 100644 --- a/windows/whats-new/windows-11-plan.md +++ b/windows/whats-new/windows-11-plan.md @@ -6,8 +6,10 @@ author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: high -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: conceptual +ms.collection: + - highpri + - tier1 ms.technology: itpro-fundamentals ms.date: 12/31/2017 --- diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 46740f84c3..9a0cdaf844 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -6,8 +6,10 @@ author: mestew ms.author: mstewart manager: aaroncz ms.localizationpriority: high -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: conceptual +ms.collection: + - highpri + - tier1 ms.technology: itpro-fundamentals ms.date: 12/31/2017 --- diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index f264fb396a..74230a9b73 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -6,8 +6,10 @@ author: mestew ms.author: mstewart ms.prod: windows-client ms.localizationpriority: medium -ms.topic: article -ms.collection: highpri, tier1 +ms.topic: conceptual +ms.collection: + - highpri + - tier1 ms.technology: itpro-fundamentals ms.date: 02/13/2023 ---