From 784a8bae51d4dc42bded73bbd540ad1123b56a61 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Sat, 12 Jun 2021 16:01:10 +0530
Subject: [PATCH 01/91] Updated
---
.../mdm/policies-in-policy-csp-admx-backed.md | 2 +
.../policy-configuration-service-provider.md | 10 ++
.../mdm/policy-csp-admx-networklistmanager.md | 162 ++++++++++++++++++
windows/client-management/mdm/toc.yml | 2 +
4 files changed, 176 insertions(+)
create mode 100644 windows/client-management/mdm/policy-csp-admx-networklistmanager.md
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 6c81fd4df2..7d4bd55974 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,6 +733,8 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
+- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
+- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2)
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index fbe229c166..f04ef812f9 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -2573,6 +2573,16 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_NetworkListManager policies
+
+
+ -
+ ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
+
+ -
+ ADMX_NetworkListManager_ConfiguredTLSAuthenticationNetworkName
+
+
### ADMX_OfflineFiles policies
-
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
new file mode 100644
index 0000000000..3bcfab9825
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -0,0 +1,162 @@
+---
+title: Policy CSP - ADMX_NetworkListManager
+description: Policy CSP - ADMX_NetworkListManager
+ms.author: dansimp
+ms.localizationpriority: medium
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: NimishaSatapathy
+ms.date: 06/11/2021
+ms.reviewer:
+manager: dansimp
+---
+
+# Policy CSP - ADMX_NetworkListManager
+
+> [!WARNING]
+> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
+
+
+
+
+## ADMX_NetworkListManager policies
+
+
+ -
+ ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints
+
+ -
+ ADMX_NetworkListManager/ConfiguredTLsAuthenticatedNetworkName
+
+
+
+
+
+
+**ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints**
+
+
+
+
+ Windows Edition |
+ Supported? |
+
+
+ Home |
+  |
+
+
+ Pro |
+  |
+
+
+ Business |
+  |
+
+
+ Enterprise |
+  |
+
+
+ Education |
+  |
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Machine
+
+
+
+
+
+List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+>
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+>
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure*
+- GP name: *NetworkListManager/AllowedTlsAuthenticationEndpoints*
+- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
+- GP ADMX file name: *NetworkListManager.admx*
+
+
+
+
+
+
+**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+
+
+
+
+ Windows Edition |
+ Supported? |
+
+
+ Home |
+  |
+
+
+ Pro |
+  |
+
+
+ Business |
+  |
+
+
+ Enterprise |
+  |
+
+
+ Education |
+  |
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Machine
+
+
+
+
+
+The string to be used to name the network authenticated against one of the endpoints listed in *NetworkListManager/AllowedTlsAuthenticationEndpoints* policy.
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+>
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+>
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
+- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName*
+- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
+- GP ADMX file name: *NetworkListManager.admx*
+
+
+
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 8680bff0db..d6032a06af 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -519,6 +519,8 @@ items:
href: policy-csp-admx-netlogon.md
- name: ADMX_NetworkConnections
href: policy-csp-admx-networkconnections.md
+ - name: ADMX_NetworkListManager
+ href: policy-csp-admx-networklistmanager.md
- name: ADMX_OfflineFiles
href: policy-csp-admx-offlinefiles.md
- name: ADMX_PeerToPeerCaching
From 19b71ff2ef545a4831b2f79fa8f93db6dd696f93 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 14 Jun 2021 15:00:58 +0530
Subject: [PATCH 02/91] Update policies-in-policy-csp-admx-backed.md
---
.../mdm/policies-in-policy-csp-admx-backed.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 7d4bd55974..557e212d5d 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,8 +733,8 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
-- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
-- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
+- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
+- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2)
From 6b05bcc9a7d8dde988e85d7aec658654870d3472 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 15:23:20 +0530
Subject: [PATCH 03/91] Update policy-csp-admx-networklistmanager.md
---
.../mdm/policy-csp-admx-networklistmanager.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 3bcfab9825..2f0f6cead2 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -24,17 +24,17 @@ manager: dansimp
-
- ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints
+ ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints
-
- ADMX_NetworkListManager/ConfiguredTLsAuthenticatedNetworkName
+ ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
-**ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints**
+**ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints**
From aef01d2991f0620c8ae8e598e84f883119d275f8 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 15:31:38 +0530
Subject: [PATCH 04/91] up
---
.../client-management/mdm/policies-in-policy-csp-admx-backed.md | 2 +-
.../client-management/mdm/policy-csp-admx-networklistmanager.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 557e212d5d..3cb809553f 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,7 +733,7 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
-- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints)
+- [ADMX_NetworkListManager-AllowedTlsAuthenticationEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticationendpoints)
- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 2f0f6cead2..40de373e96 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -24,7 +24,7 @@ manager: dansimp
-
- ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints
+ ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
From d6af85097ef258da0393fe6fdf13a7a95b56fd55 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 19:15:48 +0530
Subject: [PATCH 05/91] Update policy-csp-admx-networklistmanager.md
---
.../client-management/mdm/policy-csp-admx-networklistmanager.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 40de373e96..7d7619c1d7 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -34,7 +34,7 @@ manager: dansimp
-**ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints**
+**ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints**
From ccf432d723a0d0ac2ed36cd30de854d04075580a Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Mon, 21 Jun 2021 19:27:41 +0530
Subject: [PATCH 06/91] Update policy-csp-admx-networklistmanager.md
---
.../mdm/policy-csp-admx-networklistmanager.md | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
index 7d7619c1d7..5901b7e3e1 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
@@ -25,11 +25,9 @@ manager: dansimp
-
ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
-
ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
-
@@ -99,7 +97,8 @@ ADMX Info:
-**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+
From f7d9f560f4850071180dbf979c9fc3b70884532a Mon Sep 17 00:00:00 2001
From: Kim Klein
Date: Tue, 22 Jun 2021 14:42:40 -0700
Subject: [PATCH 07/91] Added the NTSATUS section
---
.../event-tag-explanations.md | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index 2ae5aa34a4..a8d2a29659 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -120,3 +120,7 @@ The rule means trust anything signed by a certificate that chains to this root C
| 19 | Microsoft ECC Devices Root CA 2017 |
For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file.
+
+## NTSTATUS Values
+
+Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
From 89ef49a2a467f46296f9a00b87e25e1582ca4814 Mon Sep 17 00:00:00 2001
From: Kim Klein
Date: Tue, 22 Jun 2021 14:59:45 -0700
Subject: [PATCH 08/91] Updated the section name
---
.../event-tag-explanations.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index a8d2a29659..1d237cd396 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -121,6 +121,6 @@ The rule means trust anything signed by a certificate that chains to this root C
For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file.
-## NTSTATUS Values
+## Status Values
Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
From 227442b0184fa827a9b27a987f3e19846275dea2 Mon Sep 17 00:00:00 2001
From: Kim Klein
Date: Wed, 23 Jun 2021 14:58:51 -0700
Subject: [PATCH 09/91] Included suggested edits to Status values section
---
.../event-tag-explanations.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index 1d237cd396..d19f762683 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -121,6 +121,6 @@ The rule means trust anything signed by a certificate that chains to this root C
For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file.
-## Status Values
+## Status values
-Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
+Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details.
From 862685107a8767e4d07af0691a39146d429cdc76 Mon Sep 17 00:00:00 2001
From: Oscar Beaumont
Date: Sun, 27 Jun 2021 02:48:57 +1000
Subject: [PATCH 10/91] fixed invalid MDM Federated enrollment example code
The example is missing a closing s:Envelope tag.
---
.../mdm/federated-authentication-device-enrollment.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 858a51a88b..27a1b064ae 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -119,6 +119,7 @@ The following example shows the discovery service request.
+
```
The discovery response is in the XML format and includes the following fields:
@@ -627,4 +628,4 @@ The following code shows sample provisioning XML (presented in the preceding pac
- Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document.
- The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique.
- Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate.
-- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
\ No newline at end of file
+- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
From 025f819512f0a9fc772ffae451615af987a20de0 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Wed, 30 Jun 2021 20:18:05 +0530
Subject: [PATCH 11/91] Updated
---
.../mdm/policies-in-policy-csp-admx-backed.md | 2 -
.../policy-configuration-service-provider.md | 22 +++---
...er.md => policy-csp-networklistmanager.md} | 76 ++++++++++++-------
windows/client-management/mdm/toc.yml | 2 +
4 files changed, 62 insertions(+), 40 deletions(-)
rename windows/client-management/mdm/{policy-csp-admx-networklistmanager.md => policy-csp-networklistmanager.md} (53%)
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 3cb809553f..6c81fd4df2 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -733,8 +733,6 @@ ms.date: 10/08/2020
- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui)
- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics)
- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation)
-- [ADMX_NetworkListManager-AllowedTlsAuthenticationEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticationendpoints)
-- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname)
- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1)
- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2)
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index f04ef812f9..57262a6ce7 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -2573,16 +2573,6 @@ The following diagram shows the Policy configuration service provider in tree fo
-### ADMX_NetworkListManager policies
-
-
- -
- ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
- -
- ADMX_NetworkListManager_ConfiguredTLSAuthenticationNetworkName
-
-
### ADMX_OfflineFiles policies
-
@@ -7077,6 +7067,18 @@ The following diagram shows the Policy configuration service provider in tree fo
+### NetworkListManager policies
+
+
+ -
+ NetworkListManager/AllowedTlsAuthenticationEndpoints
+
+ -
+ NetworkListManager/ConfiguredTLSAuthenticationNetworkName
+
+ -
+
+
### Notifications policies
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
similarity index 53%
rename from windows/client-management/mdm/policy-csp-admx-networklistmanager.md
rename to windows/client-management/mdm/policy-csp-networklistmanager.md
index 5901b7e3e1..d8d7be2137 100644
--- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -1,38 +1,40 @@
---
-title: Policy CSP - ADMX_NetworkListManager
-description: Policy CSP - ADMX_NetworkListManager
+title: Policy CSP - NetworkListManager
+description: The Policy CSP - NetworkListManager setting creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure.
ms.author: dansimp
-ms.localizationpriority: medium
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: NimishaSatapathy
-ms.date: 06/11/2021
+author: nimishasatapathy
+ms.localizationpriority: medium
+ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
---
-# Policy CSP - ADMX_NetworkListManager
+# Policy CSP - NetworkListManager
+
-> [!WARNING]
-> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
-## ADMX_NetworkListManager policies
+## NetworkListManager policies
-
- ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
-
-
- ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
+ NetworkListManager/AllowedTlsAuthenticationEndpoints
+ -
+ NetworkListManager/ConfiguredTLSAuthenticationNetworkName
+
+
+
-**ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints**
+**NetworkListManager/AllowedTlsAuthenticationEndpoints**
@@ -46,11 +48,11 @@ manager: dansimp
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -58,7 +60,7 @@ manager: dansimp
Education |
-  |
+  |
@@ -75,15 +77,15 @@ manager: dansimp
-List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
>
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
>
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
ADMX Info:
@@ -96,9 +98,11 @@ ADMX Info:
-
-**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
+
+
+
+**NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
@@ -112,11 +116,11 @@ ADMX Info:
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -124,7 +128,7 @@ ADMX Info:
Education |
-  |
+  |
@@ -141,21 +145,37 @@ ADMX Info:
-The string to be used to name the network authenticated against one of the endpoints listed in *NetworkListManager/AllowedTlsAuthenticationEndpoints* policy.
+This policy setting provides The string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy.
+
> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
>
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
>
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
ADMX Info:
-- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
+- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName*
- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
- GP ADMX file name: *NetworkListManager.admx*
+
+
+Footnotes:
+
+- 1 - Available in Windows 10, version 1607.
+- 2 - Available in Windows 10, version 1703.
+- 3 - Available in Windows 10, version 1709.
+- 4 - Available in Windows 10, version 1803.
+- 5 - Available in Windows 10, version 1809.
+- 6 - Available in Windows 10, version 1903.
+- 7 - Available in Windows 10, version 1909.
+- 8 - Available in Windows 10, version 2004.
+
+
+
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index d6032a06af..f9a7d7ef62 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -727,6 +727,8 @@ items:
href: policy-csp-multitasking.md
- name: NetworkIsolation
href: policy-csp-networkisolation.md
+ - name: NetworkLinkManager
+ href: policy-csp-networklinkmanager.md
- name: Notifications
href: policy-csp-notifications.md
- name: Power
From 1e90e9f4c81e499d996cfaa5e30825b0c964b236 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Tue, 13 Jul 2021 22:03:30 +0530
Subject: [PATCH 12/91] Updated
---
.../mdm/policy-csp-networklistmanager.md | 17 ++++++++---------
windows/client-management/mdm/toc.yml | 4 ++--
2 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index d8d7be2137..13da8d30a4 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -1,13 +1,13 @@
---
title: Policy CSP - NetworkListManager
description: The Policy CSP - NetworkListManager setting creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure.
-ms.author: dansimp
+ms.author: v-nsatapathy
ms.topic: article
ms.prod: w10
ms.technology: windows
author: nimishasatapathy
ms.localizationpriority: medium
-ms.date: 09/27/2019
+ms.date: 7/10/2021
ms.reviewer:
manager: dansimp
---
@@ -15,7 +15,6 @@ manager: dansimp
# Policy CSP - NetworkListManager
-
@@ -48,11 +47,11 @@ manager: dansimp
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -60,7 +59,7 @@ manager: dansimp
Education |
-  |
+  |
@@ -116,11 +115,11 @@ ADMX Info:
Pro |
-  |
+  |
Business |
-  |
+  |
Enterprise |
@@ -128,7 +127,7 @@ ADMX Info:
Education |
-  |
+  |
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index f9a7d7ef62..0b96b10953 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -727,8 +727,8 @@ items:
href: policy-csp-multitasking.md
- name: NetworkIsolation
href: policy-csp-networkisolation.md
- - name: NetworkLinkManager
- href: policy-csp-networklinkmanager.md
+ - name: NetworkListManager
+ href: policy-csp-networklistmanager.md
- name: Notifications
href: policy-csp-notifications.md
- name: Power
From 6d86539e91a7d9ff4a09cc75250d80242928fde3 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Tue, 13 Jul 2021 22:14:57 +0530
Subject: [PATCH 13/91] Update toc.yml
---
windows/client-management/mdm/toc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 0b96b10953..51a0630b08 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -728,7 +728,7 @@ items:
- name: NetworkIsolation
href: policy-csp-networkisolation.md
- name: NetworkListManager
- href: policy-csp-networklistmanager.md
+ href: policy-csp-networklistmanager.md
- name: Notifications
href: policy-csp-notifications.md
- name: Power
From 94b4379cd2804c471a49451ffe7d129e50934136 Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Tue, 13 Jul 2021 23:18:17 +0530
Subject: [PATCH 14/91] Update policy-csp-networklistmanager.md
---
.../mdm/policy-csp-networklistmanager.md | 47 +------------------
1 file changed, 1 insertion(+), 46 deletions(-)
diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index 13da8d30a4..4328d1b831 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -78,23 +78,6 @@ manager: dansimp
This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
->
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
->
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
-
-ADMX Info:
-- GP English name: *Creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure*
-- GP name: *NetworkListManager/AllowedTlsAuthenticationEndpoints*
-- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
-- GP ADMX file name: *NetworkListManager.admx*
-
-
-
@@ -144,37 +127,9 @@ ADMX Info:
-This policy setting provides The string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy.
+This policy setting provides the string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy.
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
->
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
->
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
-
-ADMX Info:
-- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks*
-- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName*
-- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM*
-- GP ADMX file name: *NetworkListManager.admx*
-
-
-
-Footnotes:
-
-- 1 - Available in Windows 10, version 1607.
-- 2 - Available in Windows 10, version 1703.
-- 3 - Available in Windows 10, version 1709.
-- 4 - Available in Windows 10, version 1803.
-- 5 - Available in Windows 10, version 1809.
-- 6 - Available in Windows 10, version 1903.
-- 7 - Available in Windows 10, version 1909.
-- 8 - Available in Windows 10, version 2004.
-
From b8bbf43577e4f6dd818235c4db3c3350cba97b0e Mon Sep 17 00:00:00 2001
From: Daniel Simpson
Date: Tue, 13 Jul 2021 12:03:19 -0700
Subject: [PATCH 15/91] updating check marks
---
.../mdm/configuration-service-provider-reference.md | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md
index a780da0495..c22595460c 100644
--- a/windows/client-management/mdm/configuration-service-provider-reference.md
+++ b/windows/client-management/mdm/configuration-service-provider-reference.md
@@ -1270,10 +1270,10 @@ Additional lists:
 |
-  |
-  |
-  |
-  |
+  |
+  |
+  |
+  |
 |
From e9582816ae06af226dd38472e52c4c45e602bf4c Mon Sep 17 00:00:00 2001
From: Daniel Simpson
Date: Tue, 13 Jul 2021 12:34:00 -0700
Subject: [PATCH 16/91] updating UEFI too
---
.../mdm/configuration-service-provider-reference.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md
index c22595460c..cce8060fe3 100644
--- a/windows/client-management/mdm/configuration-service-provider-reference.md
+++ b/windows/client-management/mdm/configuration-service-provider-reference.md
@@ -2156,7 +2156,7 @@ Additional lists:
 |
-  |
+  |
4 |
4 |
4 |
From 7d71012f2c43aeac083218ec17953e311d4f8ad8 Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 13 Jul 2021 13:24:31 -0700
Subject: [PATCH 17/91] Update select-types-of-rules-to-create.md
---
.../select-types-of-rules-to-create.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index 5f12576ef7..a05bd37d01 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -14,7 +14,7 @@ author: jsuther1974
ms.reviewer: isbrahm
ms.author: dansimp
manager: dansimp
-ms.date: 03/04/2020
+ms.date: 07/13/2021
ms.technology: mde
---
@@ -121,7 +121,7 @@ To create the WDAC policy, they build a reference server on their standard hardw
As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version.
## File rule precedence order
-<<<<<<< HEAD
+
WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md).
## More information about filepath rules
From eb90c7fec69f8f95879d5886da983516b58d029b Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 13 Jul 2021 13:24:49 -0700
Subject: [PATCH 18/91] Update
windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
.../select-types-of-rules-to-create.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index a05bd37d01..0f5ed1558b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -122,7 +122,7 @@ As part of normal operations, they will eventually install software updates, or
## File rule precedence order
-WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md).
+WDAC has a built-in file rule conflict logic that translates to precedence order. It will first process all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md).
## More information about filepath rules
From 39a975e9dc090d4c264258237b627d227a7ffa5d Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT
Date: Tue, 13 Jul 2021 13:25:19 -0700
Subject: [PATCH 19/91] Update event-tag-explanations.md
---
.../event-tag-explanations.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index d19f762683..9eb35220b5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -14,7 +14,7 @@ author: jsuther1974
ms.reviewer: isbrahm
ms.author: dansimp
manager: dansimp
-ms.date: 8/27/2020
+ms.date: 07/13/2021
ms.technology: mde
---
From 40ce58718de251c57979f41d87ae4f77a6c617c3 Mon Sep 17 00:00:00 2001
From: Gary Moore
Date: Tue, 13 Jul 2021 18:51:12 -0700
Subject: [PATCH 20/91] Applied proper >[!NOTE] style and made other formatting
changes
---
...erated-authentication-device-enrollment.md | 33 +++++++++++--------
1 file changed, 20 insertions(+), 13 deletions(-)
diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 19f9e8481a..5a31b4587a 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -152,7 +152,7 @@ The following are the explicit requirements for the server.
The enrollment client issues an HTTPS request as follows:
-```
+```http
AuthenticationServiceUrl?appru=&login_hint=
```
@@ -235,16 +235,18 @@ Policy service is optional. By default, if no policies are specified, the minimu
This web service implements the X.509 Certificate Enrollment Policy Protocol (MS-XCEP) specification that allows customizing certificate enrollment to match different security needs of enterprises at different times (cryptographic agility). The service processes the GetPolicies message from the client, authenticates the client, and returns matching enrollment policies in the GetPoliciesResponse message.
-For Federated authentication policy, The security token credential is provided in a request message using the <wsse:BinarySecurityToken> element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows:
+For Federated authentication policy, the security token credential is provided in a request message using the <wsse:BinarySecurityToken> element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows:
- wsse:Security: The enrollment client implements the <wsse:Security> element defined in \[WSS\] section 5. The <wsse:Security> element must be a child of the <s:Header> element.
- wsse:BinarySecurityToken: The enrollment client implements the <wsse:BinarySecurityToken> element defined in \[WSS\] section 6.3. The <wsse:BinarySecurityToken> element must be included as a child of the <wsse:Security> element in the SOAP header.
As was described in the discovery response section, the inclusion of the <wsse:BinarySecurityToken> element is opaque to the enrollment client, and the client does not interpret the string, and the inclusion of the element is agreed upon by the security token authentication server (as identified in the <AuthenticationServiceUrl> element of <DiscoveryResponse> and the enterprise server.
-The <wsse:BinarySecurityToken> element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the <wsse:BinarySecurityToken> element. wsse:BinarySecurityToken/attributes/ValueType: The <wsse:BinarySecurityToken> ValueType attribute must be "http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken".
+The <wsse:BinarySecurityToken> element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the <wsse:BinarySecurityToken> element.
-wsse:BinarySecurityToken/attributes/EncodingType: The <wsse:BinarySecurityToken> EncodingType attribute must be "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary".
+- wsse:BinarySecurityToken/attributes/ValueType: The `` ValueType attribute must be "http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken".
+
+- wsse:BinarySecurityToken/attributes/EncodingType: The `` EncodingType attribute must be "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary".
The following is an enrollment policy request example with a received security token as client credential.
@@ -381,7 +383,7 @@ This web service implements the MS-WSTEP protocol. It processes the RequestSecur
The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on match the certificate template), the client can enroll successfully.
-Note that the RequestSecurityToken will use a custom TokenType (http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section.
+Note that the RequestSecurityToken will use a custom TokenType (`http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken`), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section.
The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration.
@@ -611,11 +613,16 @@ The following code shows sample provisioning XML (presented in the preceding pac
```
-**Notes**
-
-- <Parm name> and <characteristic type=> elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase.
-- In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML.
-- Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document.
-- The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique.
-- Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate.
-- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
+> [!NOTE]
+>
+> - <Parm name> and <characteristic type=> elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase.
+>
+> - In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML.
+>
+> - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document.
+>
+> - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique.
+>
+> - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate.
+>
+> - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it.
From ce6231a2037e7b1204b74d603d41a2c97be2cf44 Mon Sep 17 00:00:00 2001
From: Gary Moore
Date: Tue, 13 Jul 2021 20:59:31 -0700
Subject: [PATCH 21/91] Removed unnecessary indentation in code; added missing
---
...erated-authentication-device-enrollment.md | 575 +++++++++---------
1 file changed, 288 insertions(+), 287 deletions(-)
diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 5a31b4587a..3a32b79699 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -89,37 +89,37 @@ https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc
The following example shows the discovery service request.
```xml
-
-
-
-
- http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover
-
- urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc
-
-
-
-
-
- user@contoso.com
- 3
- 3.0
- WindowsPhone
- 10.0.0.0
-
- OnPremise
- Federated
-
-
-
-
-
+
+
+
+
+ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover
+
+ urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc
+
+
+
+
+
+ user@contoso.com
+ 3
+ 3.0
+ WindowsPhone
+ 10.0.0.0
+
+ OnPremise
+ Federated
+
+
+
+
+
```
The discovery response is in the XML format and includes the following fields:
@@ -196,37 +196,37 @@ The server has to send a POST to a redirect URL of the form ms-app://string (the
The following example shows a response received from the discovery web service which requires authentication via WAB.
```xml
-
-
-
- http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse
-
-
- d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8
-
- urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
-
-
-
-
- Federated
- 3.0
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
- https://portal.manage.contoso.com/LoginRedirect.aspx
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse
+
+
+ d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8
+
+ urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478
+
+
+
+
+ Federated
+ 3.0
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+ https://portal.manage.contoso.com/LoginRedirect.aspx
+
+
+
+
+
```
## Enrollment policy web service
@@ -251,44 +251,44 @@ The <wsse:BinarySecurityToken> element contains a base64-encoded string. T
The following is an enrollment policy request example with a received security token as client credential.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies
-
- urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies
+
+ urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+
+
+
+
+
+
+
+
+
+
+
```
After the user is authenticated, the web service retrieves the certificate template that the user should enroll with and creates enrollment policies based on the certificate template properties. A sample of the response can be found on MSDN.
@@ -301,80 +301,80 @@ MS-XCEP supports very flexible enrollment policies using various Complex Types a
The following snippet shows the policy web service response.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse
-
- urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598
-
-
-
-
-
-
-
-
-
-
- 0
-
-
- CEPUnitTest
- 3
-
- 1209600
- 172800
-
-
- true
- false
-
-
- 2048
-
-
-
-
-
-
-
- 101
- 0
-
-
-
-
-
-
- 0
-
-
-
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse
+
+ urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598
+
+
+
+
+
+
+
+
+
+
+ 0
-
-
- 1.3.14.3.2.29
- 1
- 0
- szOID_OIWSEC_sha1RSASign
-
-
-
-
-
+
+ CEPUnitTest
+ 3
+
+ 1209600
+ 172800
+
+
+ true
+ false
+
+
+ 2048
+
+
+
+
+
+
+
+ 101
+ 0
+
+
+
+
+
+
+ 0
+
+
+
+
+
+
+
+
+
+
+ 1.3.14.3.2.29
+ 1
+ 0
+ szOID_OIWSEC_sha1RSASign
+
+
+
+
+
```
## Enrollment web service
@@ -393,83 +393,84 @@ The RST may also specify a number of AdditionalContext items, such as DeviceType
The following example shows the enrollment web service request for federated authentication.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep
-
- urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749
-
- http://www.w3.org/2005/08/addressing/anonymous
-
-
- https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
-
-
-
-
- http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
-
-
- http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
-
-
- DER format PKCS#10 certificate request in Base64 encoding Insterted Here
-
-
-
- 4
-
-
- 10.0.9999.0
-
-
- MY_WINDOWS_DEVICE
-
-
- FF:FF:FF:FF:FF:FF
-
-
- CC:CC:CC:CC:CC:CC
-
- 49015420323756
-
-
- 30215420323756
-
-
- Full
-
-
- CIMClient_Windows
-
-
- 10.0.9999.0
-
-
- 7BA748C8-703E-4DF2-A74A-92984117346A
-
-
- True
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep
+
+ urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749
+
+ http://www.w3.org/2005/08/addressing/anonymous
+
+
+ https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+
+
+
+
+ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
+
+
+ http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
+
+
+ DER format PKCS#10 certificate request in Base64 encoding Insterted Here
+
+
+
+ 4
+
+
+ 10.0.9999.0
+
+
+ MY_WINDOWS_DEVICE
+
+
+ FF:FF:FF:FF:FF:FF
+
+
+ CC:CC:CC:CC:CC:CC
+
+ 49015420323756
+
+
+ 30215420323756
+
+
+ Full
+
+
+ CIMClient_Windows
+
+
+ 10.0.9999.0
+
+
+ 7BA748C8-703E-4DF2-A74A-92984117346A
+
+
+ True
+
+
+
+
+
```
After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR).
@@ -495,43 +496,43 @@ Here is a sample RSTR message and a sample of OMA client provisioning XML within
The following example shows the enrollment web service response.
```xml
-
-
-
- http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep
-
- urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab
-
-
- 2012-08-02T00:32:59.420Z
- 2012-08-02T00:37:59.420Z
-
-
-
-
-
-
-
- http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
-
-
-
-
- B64EncodedSampleBinarySecurityToken
-
-
- 0
-
-
-
-
+
+
+
+ http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep
+
+ urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab
+
+
+ 2012-08-02T00:32:59.420Z
+ 2012-08-02T00:37:59.420Z
+
+
+
+
+
+
+
+ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken
+
+
+
+
+ B64EncodedSampleBinarySecurityToken
+
+
+ 0
+
+
+
+
```
The following code shows sample provisioning XML (presented in the preceding package as a security token):
From 6dbf6d1cee21a1ad1cf2924d7f6462672785379c Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Wed, 14 Jul 2021 11:54:45 +0100
Subject: [PATCH 22/91] Update changes-to-windows-diagnostic-data-collection.md
---
.../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index f582ab8f63..5064e1663c 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -72,7 +72,7 @@ A final set of changes includes two new policies that can help you fine-tune dia
>[!Important]
>All the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier.
-## Configure a Windows 10 device to limit crash dumps and logs
+## Configure a Windows 11 device to limit crash dumps and logs
With the Enhanced diagnostic data level being split out into new policies, we're providing additional controls to manage what types of crash dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them:
From baac5ccf496c86c12b65c9a57fd44009f1ee6e40 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Wed, 14 Jul 2021 11:57:45 +0100
Subject: [PATCH 23/91] Update changes-to-windows-diagnostic-data-collection.md
---
.../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index 5064e1663c..86e8ebcf13 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -50,7 +50,7 @@ Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience
## Behavioral changes
-In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see [Configure a Windows 10 device to limit crash dumps and logs](#configure-a-windows-10-device-to-limit-crash-dumps-and-logs). For more information on services that rely on Enhanced diagnostic data, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data).
+In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see [Configure a Windows 11 device to limit crash dumps and logs](#configure-a-windows-11-device-to-limit-crash-dumps-and-logs). For more information on services that rely on Enhanced diagnostic data, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data).
Additionally, you will see the following policy changes in an upcoming release of Windows 10:
From 32cbdb5c1447644f8f8fd730b0eea74da2864ced Mon Sep 17 00:00:00 2001
From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com>
Date: Wed, 14 Jul 2021 18:09:46 +0530
Subject: [PATCH 24/91] Updated
---
windows/client-management/mdm/toc.yml | 2 --
1 file changed, 2 deletions(-)
diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml
index 51a0630b08..1d385366fb 100644
--- a/windows/client-management/mdm/toc.yml
+++ b/windows/client-management/mdm/toc.yml
@@ -519,8 +519,6 @@ items:
href: policy-csp-admx-netlogon.md
- name: ADMX_NetworkConnections
href: policy-csp-admx-networkconnections.md
- - name: ADMX_NetworkListManager
- href: policy-csp-admx-networklistmanager.md
- name: ADMX_OfflineFiles
href: policy-csp-admx-offlinefiles.md
- name: ADMX_PeerToPeerCaching
From 2d5392a9db828752bdcd0a95e4b2eeffe1ffe47b Mon Sep 17 00:00:00 2001
From: greg-lindsay
Date: Wed, 14 Jul 2021 09:19:45 -0700
Subject: [PATCH 25/91] clarification
---
windows/deployment/upgrade/setupdiag.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md
index da30d6f337..98e9be1e49 100644
--- a/windows/deployment/upgrade/setupdiag.md
+++ b/windows/deployment/upgrade/setupdiag.md
@@ -49,7 +49,7 @@ When run by Windows Setup, the following [parameters](#parameters) are used:
- /Output:%windir%\logs\SetupDiag\SetupDiagResults.xml
- /RegPath:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupDiag\Results
-The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**.
+The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**. Please note that this is not the same as the default registry path when SetupDiag is run manually. When SetupDiag is run manually, and the /RegPath parameter is not specificed, data is stored in the registry at HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag.
> [!IMPORTANT]
> When SetupDiag indicates that there were multiple failures, the last failure in the log file is typically the fatal error, not the first one.
From 704bc15a2b571da34792e3f3353c947663eadb1d Mon Sep 17 00:00:00 2001
From: greg-lindsay
Date: Wed, 14 Jul 2021 12:48:35 -0700
Subject: [PATCH 26/91] add link
---
windows/deployment/deploy-whats-new.md | 8 ++++----
windows/whats-new/windows-11.md | 7 +++++--
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md
index d2e0935b7d..6c5df77f39 100644
--- a/windows/deployment/deploy-whats-new.md
+++ b/windows/deployment/deploy-whats-new.md
@@ -35,12 +35,12 @@ Check out the following new articles about Windows 11:
- [Plan for Windows 11](/windows/whats-new/windows-11-plan)
- [Prepare for Windows 11](/windows/whats-new/windows-11-prepare)
+The [Windows ADK for Windows 11](/windows-hardware/get-started/adk-install) is available.
+
[SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.
-The [Windows ADK for Windows 10, version 2004](/windows-hardware/get-started/adk-install) is available.
New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
VPN support is added to [Windows Autopilot](#windows-autopilot)
An in-place upgrade wizard is available in [Configuration Manager](#microsoft-endpoint-configuration-manager).
-The [Windows ADK](#windows-assessment-and-deployment-kit-adk) for Windows 10, version 2004 is available.
The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with additional content added and more content coming soon.
## The Modern Desktop Deployment Center
@@ -186,9 +186,9 @@ For the latest information about MDT, see the [MDT release notes](/mem/configmgr
The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows.
-Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](/windows-hardware/get-started/adk-install).
+Download the Windows ADK and Windows PE add-on for Windows 11 [here](/windows-hardware/get-started/adk-install).
-For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004).
+For information about what's new in the ADK, see [What's new in the Windows ADK](/windows-hardware/get-started/what-s-new-in-kits-and-tools).
Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md).
diff --git a/windows/whats-new/windows-11.md b/windows/whats-new/windows-11.md
index 260967a467..2d7eae37a6 100644
--- a/windows/whats-new/windows-11.md
+++ b/windows/whats-new/windows-11.md
@@ -1,7 +1,6 @@
---
title: Windows 11 overview
description: Overview of Windows 11
-ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C
ms.reviewer:
manager: laurawi
ms.audience: itpro
@@ -83,4 +82,8 @@ When Windows 11 reaches general availability, important servicing-related announ
[Windows 11 requirements](windows-11-requirements.md)
[Plan for Windows 11](windows-11-plan.md)
-[Prepare for Windows 11](windows-11-prepare.md)
\ No newline at end of file
+[Prepare for Windows 11](windows-11-prepare.md)
+
+## Also see
+
+[What's new in Windows 11](/windows-hardware/get-started/what-s-new-in-windows)
\ No newline at end of file
From cfdbcd4f76f95b3ae1fe71d4c1602c4f8e0135ee Mon Sep 17 00:00:00 2001
From: Barak Manor
Date: Wed, 14 Jul 2021 13:09:58 -0700
Subject: [PATCH 27/91] Creating a new page for Device Installation under
Client Management
---
...eviceInstallation_ApplyLayered_Policy2.png | Bin 0 -> 83277 bytes
...eviceInstallation_ApplyLayered_policy1.png | Bin 0 -> 245699 bytes
...Installation_DM_Printer_Compatible_Ids.png | Bin 0 -> 42744 bytes
...ceInstallation_DM_Printer_Hardware_Ids.png | Bin 0 -> 37272 bytes
...eviceInstallation_DM_Printer_by_device.png | Bin 0 -> 123239 bytes
...Installation_DM_Printer_details_screen.png | Bin 0 -> 33695 bytes
.../images/DeviceInstallation_DM_USB_HWID.png | Bin 0 -> 43507 bytes
...eviceInstallation_DM_USB_by_connection.png | Bin 0 -> 206435 bytes
...tion_DM_USB_by_connection_and_layering.png | Bin 0 -> 207551 bytes
...tallation_DM_USB_by_connection_blocked.png | Bin 0 -> 98870 bytes
.../DeviceInstallation_DM_USB_by_device.png | Bin 0 -> 47760 bytes
...ation_GPO_allow_device_id_list_printer.png | Bin 0 -> 20306 bytes
...tallation_GPO_allow_device_id_list_usb.png | Bin 0 -> 46437 bytes
...iceInstallation_GPO_prevent_class_list.png | Bin 0 -> 26422 bytes
...ion_GPO_prevent_device_id_list_printer.png | Bin 0 -> 28667 bytes
...llation_GPO_prevent_device_id_list_usb.png | Bin 0 -> 26746 bytes
.../DeviceInstallation_USB_properties.png | Bin 0 -> 27834 bytes
.../images/DeviceInstallation_flowchart.png | Bin 0 -> 67266 bytes
...ge-device-installtion-with-group-policy.md | 543 ++++++++++++++++++
19 files changed, 543 insertions(+)
create mode 100644 windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png
create mode 100644 windows/client-management/images/DeviceInstallation_ApplyLayered_policy1.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_Compatible_Ids.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_Hardware_Ids.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_by_device.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_details_screen.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_HWID.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection_and_layering.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection_blocked.png
create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_device.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_allow_device_id_list_printer.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_allow_device_id_list_usb.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_class_list.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_device_id_list_printer.png
create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_device_id_list_usb.png
create mode 100644 windows/client-management/images/DeviceInstallation_USB_properties.png
create mode 100644 windows/client-management/images/DeviceInstallation_flowchart.png
create mode 100644 windows/client-management/manage-device-installtion-with-group-policy.md
diff --git a/windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png b/windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png
new file mode 100644
index 0000000000000000000000000000000000000000..8cf3edaff44944fd0528b44534075a8faafb8897
GIT binary patch
literal 83277
zcmeFZcT`hb7cYuO5fwo>s7Q?(6&2~dC03BGprEvf^xjKo@z@XrBE1voNR>_?5RqOZ
zHPj#w5~-0;LI_D-Eay9C-1ogP-o1a^`_J8DFtYYyXRkTen)Nr=O88xUO|ByXN7&fd
zxU}xvGGt?8H)mrzuyg1js|O!=c%AjJ&)ZP*23u*r&?4*RfcuhZ0aLzp|cGmr2
zk2{aN+1P}`e*Eo&FRa_Lu`zSCZe710V7Wr)j5~o%{z?mNyZL9#arT&!u-m|Ww*J;%
z9^Qy?{aR&ak>_xJEhc#1MB+YNDe}*XVO?96aj^2?x1_SCs*t^Eb9_W{QTa6c*u$JawRcl_1|NgXTjna#nnmS`H;Ngk)T$P1v9B&MTghQDDC)+jt{Eo$z6j
z7;+m##efr5-8(KxR<2C$+AIbKF3hSoh2UhUrd>C*ObwJLBht|G7a)SC&Dq_ovGC;ukH)z%Q&v3a6o&guc`B@4)Psx77DA~oth$qnAIL%T=c_J$v;
z^rEKTiImhF_abMAAy*$GlZbHgmho-qi&f3)4tM<4M8~X>`$UJ8_5#q%z>YkXE->
zzk-pT`1@+!zk;cy5L_OWrT`
zus;o~YmE-UsUe}X?YUKU=vDtvZn4^T^Orms`)=LmAUdcNc9yJigT
zxGXPi?xXE3VU{o@W?Qz@BMFYvPKjS2Ic8f(uXWzeaG&;N^G&A-{o2r)$7ZH>9D_w$)Q{we6ibUFgUYg+
zD4E-qox^(H>%YrrJv6Y(h89I6fnBYUH21kmg#4t!WcUTg2HDRO;RJE}^pR?&R4C)d
zg#O18OhWO;LD!s%)Y6BfHF!q=ZT2y(*;5DzzkQIp$7AXKAVISvYUVt#+@bDN>FtE$h`GJc2tMDn2IYQB!`KA?U!Cqjj2z<8ZrHf>z
z^+WZ8Pee4eHjbTnqoNGi&vuu?1yU5{VSx%LhaTI{(y|}d`D)L34gOj156%2>-4EwB
z`PE|cc=3O#nUh&rDccyZ{)DMnJGfYN^ysDz49&OgdEO3bcm(0<;P8>@6u4TAg&O?v
zi`Gxa$Lc(-T~*C#G|8@)8^nb@YNglO)FY(N2Mkm1@I-3LDAOg(*)y?-Y5s-ZIp!4)
zP&Xoh=OX<%xNay&6jGxkI)p-juJ<>P
z98t728kshOmLxSYGlO@m%7jSjR&zO{6KJ!Z`z*AvL3k-hSKv}X)qoe_s`@MEI`Jv3`l!aP!h-TP)992_?o_
zrlvIYp!O)ecnYrJ`Zfu1iG-ruQ$~o0CJMB_i9qSQHHM`1qL>;;;+pe<(U2fM@9;UI
z9+I-N+mvlnD%D~zH=7P?{>vDikol=CC29WcfaK1TgYTTHtF(*|CGFG1tJo^6SX0&F#aplV6N}#zWYjStMq2yS^CPI77kTs*qA*P{}
zepT{X13I1(N-50=1P?2lW75?{^ZQ8s84c&TfSNt82TZ!Cj3WG#z^cxXY<#_E_Cnq|
zw$l~Be?gB|5T9_E%d78F^m6Gbq*X*`o%8C6Kh9bA%}d)wFKa;FNdpbuY$D<}_;&Gw
zxuMh@QN|Zcmxtf2dR2vP3?;|rb8nXn4mMiSJl5_pD(3FGi^hXVLfi|oX=GDNQnVYi
znntYfCW?&9x=dc|NYF|2Pkmo<-kX}XQ7SY%z7XzhM$cS{9)2u>L5aR+tc+J`4kgPL
zH5_gz+A=?^5hZllC{H)q+8tdYoUc#~o+S40>!+6(8yLVFF0&upmDJiDgla*QE@w+-
z#0hFx#I0kGcJ35$*z|Vlc&$(IBRw)rO6zxTBDd=;`Q>+u}p{wehX|(U!3yU`IpV%d{!SXj$TI39hkzV`=F#j;b@)
zY&7xT&oXB-TL_|TH}g$!6V}H%4|~nb-L5D=K1$(}?@7l=@|ci#phZEkE&`(_x3+$=
zSJN9NOWUW{vKO$oa~5jdp`p@W(la;pSH&wc;h~HB*y@UJulfj=rk5mCa$|j%xA~*j
zVx_r4yjmX6y*9YA7i!vz77_$Cy7jCFy`~FvydFG_=)CaD~ea>?^om#OO>WK+D^!f+F(@sQqWFe(QJu8u%
zm(@E`Aw*E&Jgw4*j=tHUr(*SHs+sbpaFmv+PJVUD;j+K>MwYRotHpVLtoI`#~Z3H^@O5sIGEBfy2i0j`U?
zw!?>1KX0XNLX?0+Oj-=f&!j$6v;V9w?V;75)^tAKwPRU}H-C`eIgzv9Yi;G}CS>q1
zyN~uh!GX9g8CN>hFr`Voq2OL8dN1%;T_-2Tae(IZoOFS&Aa@xi!
zy|ksVazwyNLe|ENX2|ToA3V65TUKTukp>neVi5A4{U^RawT^9eedF2h)gph+x{UvF
zwx;C;pk`FUK(d^Q5f%c{AzXvZJ!al|i$8~uTcT`c(eQ-d`j7K~>Tfqy;yB^Gr1}RUN@Z4M*
z@x$^-C29NCb5r__i)Lr~Xg0fGS0?dv_AMRNb)2;F#;hut20=>@17Tu70Rff)0xA0w
z;)2IgV_?+jFtQ}T@&eP#DQj$-&HJ+ea2{x#6FTZ+)Dx3@)oG!n~tygDoO0s@(Zzo}8dgGOUvupAj
zgiPglagoRPmBdO&h|3n?YL%k>xM%0pKT|a4@6`H?@#!UtmH2gZU%_b@mvt>!j(d0F
zirZn@x|XEW%ao}QdxCz<$U@glyP%yQLpF0^fR^AgvGYm@>noS?z%O;x$zAh0&bnCk
zG4bGJD$}?6u$^k3oho{~>K;zXvM~6{WsA`5Jg_VYY4)b#PhaMr#OhPF7WxtNV>Lu(
zQjtr;l|Nkpv9;rawEF?N0XL#bP!-}2VnzV5&B)@o6;R@2)X8kdea5c9+kS5&d{Z)|
zbGnT);Z%`cYj08PcDgumjCA()q^Aj=?Z)wyTBcf7
zVZEVl6R9E3;Vq?=Etrn=$LZT*9fX#_OhucHc0I$jrmLB>M5VIoOUp7(NHA*!gDVZa
zaT?4IZ?Z_%6$*m%q=LxPlkS^65=LnZj6znNef+AT5@yS;-;7Xi<8}}=P$fmNX7w~7>C&F-_XY=&U>E%5m@9ByS@J`ixX85ehnsC}
zL72NJdkqPS6Gqs0PDL<6=IFd@&^&jgYpN>@(Kx?yx4B>ozxD1G%DNrjmm#S;4mh^d
zKl~R#e1RxtD2&~uuW1K?d-#fF$<^25X~!+n=FjL(%>!?wmR!;bibR*$f>S$65iIez
zzcByh3`&&klZQ09>!cWCzJ)m{N(aOWenX$<>(7Y6`NM#saI`2Z7x*$z62d3ZO?{h)
z-+Z}GIn=Hg6|!f2QCO0`KN~-I?Ya54N~1sI?wD$He;dfgPdICK7YuO8Ji#AA4!gU*
zlYg9G&~tmEUe;c+Ydw}|Gu&AzvkoLKOcY6Wj#u*GvmP-m{HGU)=Ubzv$q43nT0#Dl
z7y==*_tFI=m$ThD>yL}(9-pl9iz^
zgchNiQRod-eragRluA3Kcw%8CH3HgbXWuLDHG2n+^4>$4CsHOp@r={FD|=ti@Eeux
z@mUbQ%jI0YmZ6k2b}F9eYMBp(%1@@+S;~HPW2WC%C<`as%
zbYwC^fm`^>CHMw9R>Vl3C}0>9Xdj^q*>ksPPD|bml$<#{>NwNOEMs0IC21NFBof*x
zITIGgKP<~SU%iCzIxX$L<3;6uQyTN`WJPXsH;f};<4hGkE`ch(8*g{-KxZn&Ja#Uq+IIEa>Y=u
z7Z8Qo%+p9h0Mk;>Rfn4jJM-M%5HY+@;9h>x3x#4!i)u69hXyXdRwsaYM>aigUT1{b
z_XEO$@;e(5aKnRI@RxP2z(wV#1XJQ~$B>QfN{fhHnPL#7w>8;A#=Zb-I>pZ!A#;0l<+sCkVh(6$`
z!7yDUg&aQV*Ug_pc_H?x8f&>Mciat=p`Ow&*Wn@m!}b{~*)N~=?yrQy8|gI+9y@$z
zG(#*bEF&Z1Yu+P{#+)PB8W8d9GNgW~Ku~NF48NJY5woP%wP=)&pBk_9`ap__5Rkv&
zhVqQil_EKC*(JXvN_Ky`y>Suie|?azzlVLJ9*2`9<7oDHe>B*2E@F?N&U=wQOrXOy`sTIY1j6UYCKN@tRC-X>cN`_1=a%cJMJSl-dyO_k$u@Kpq
zn`lsPJ{o`w%8SapLY?RpuFRj}S&x*87}xg>N2L%+A7K`9lNj#z+VAp#LATLo?Lgm7
zz=S{U?XEx+Ixym%_QMC3kCN>YFEgCpi0^klp(nI}bsP<}ue>_C3pyX9P4`u>`Rz6}
zMrepzD3Zc5Z?T7Rr|FkFjwz?kR~dJho)~Eg
zyA|!iTstAj*+@_~L44oY=+j4HR1G#yMZ6!FmIl~laXrz+otm$TY$c-32dIZ!GwOp*6~L`4bkn)ImDO&o)ug^f2dXjp)5`XnJUXV;`k^7tF?)2U
zeGWCP-1Hsk+qM+XNoOxF$njTIs-3og8xOtI%+
z=sB!RPL10mIFz-|0vicP%Z-NEn2Me)E(gV;RhJSqW--ju5hQUkWN4+o3l~;!Gpw)Z
zbKJvzzTosB^S+dx=^I*!V#iZD(p2sE8kH~DO5A{>F1Y*p>rnFaDjbc%VAoC0*kz#l
z->?!D^|S1M7MIed-(iznEm<2aIKdJZUl4$quZiR{IO>Vyc(*f3)VKSLqbnqG?u
z={1*X14W$^;gvUz%S`6osWM&6ZunbkiMZ30`JL8%U~`DVQxHXKg$Q2z@}h?ga@sfknD
zMs(0EUZT>WSp1I1q+ND({w-R{W+n1oVQAJG{U(
z@~(OOXt+sFj+RN+rlYkD0bSu4AM7-7huU)45xKD)ilh_XdM)b_7i!>RO3osPXm|)d
zZOZd4l+mu^)%Re3P3?%_oM|{~DRE6?$vU|eo3A+14US96N4SOAPfX3$#pU#zJPi7F
z5-&}O8pp{#kaF*yPSu4bz5OEW-YFQy4Rv>zU!A(X`|J--@`(tPiiEq%)vL@i&jMdx
z=~8)a+paSJh~j-)*Z*+K^+KPscz1o8=_*WFiz1!VXU8bC3=nElzi2KPv3l$_{et`p
zXvwzv`Isx)81(Tj%PFex-HALpkGL|h5;aiDYtt=!Pp2?y;)#53PzC){p0w?oDSPx<
zT>&!Sfb*m0o(!$}$mWD!ruo1mH|ao6Av5qa%)hdC3r-SNfTylZMW-w#IfX<(no0KM
zrR)ct0dqneRx!c=w+WZDZTu6+{;p-wrO;!c)VdSp!Eeqx>##{2vq~@dYZkYta>FLi
zWqO*xOq$AN=nRT-dD*pAd#x>{o)2kR9rT#iY!oz0o`H-6q(;;`7Mj;Fj^US5-J|&t
z8E1}xyt0G01|}EE%M9YmBs9)kaO9AHUq)YZ5u-ug{3^Z)YcLu
zlM&3#p>u!{#iQ=i@fvjpVdGVRKp8$W=q!Dr&E$sjg*vNSZX)oNkQS7DJX6g1zF+?t
z_bNu2h}b{OifACvz$X7~H0_42CE96h&|i$kzeC)}M1TaSYqbRmSsyUUB>DPNQf)Ra9zaX6DN22pONu&}A#s)Hv#nDIX?&N>JL@<&C0B
z>1c-%$v&|*phI)Z)$i^^>;|Ug9wjI#&LGl!jRa*QKUi|%I!e?xfpKG((v^a=4OxI_
zSJQx(=jH+A8qmLU2d)?IS*xE=UaQcR1lLO}a$^AbeOo&4yQ!dau^`VPxxSs(d)J3f
zC(GI9>572WPiuZ6r*bpuQKhpwQe*2}%UI$VjH>zW;q<64Ns
zrnhvNz~OIX-s_a63qhNeJ0TTgP2+J#H}dQtK@RZN4DQQ2PB*6%33WZ}kmksGMq1c@sd9i6nmJBOn;PVD7+Khs6#KT7En40V{YP^&d`94VIF(Q&%W5H7M7
ztJMcOs)nayP2+q|R8KGs3&%QiQ@NtHJ}RVsPx7$)SPM?tGAX&@M@vI|i`
z#BNtvVh@)dGu50{&M)KlS$uFTAX^S6qlKSgzS6r$|L!I<=~Cq!~L*CVuLXa`&=|
z#RmaZ`gZBjx1cc+CWca0b>PDd%#+y5vLwIn?M7?oYNk@{Hr1fsf4+=!zp;+xM`b2H
zy0|eiTTsFKB{8*AeTdt7*nbc;npNB~;>7IHX@ZaMP1ru~qQ9MV8MMxd_^1rh8MWrB
zfed~bhREEEH4$ayJ@;#2&1s%BMh`Ui7JRQ!sg-1?8~F!n00G3gl(DSmkOH2U)l=7|O8(NR#VD);9)WzbyB
zc-?AOUsIs@j}Wiams%%hUTVR1w7Twxu^C$|1e&XgxO@Q=t~cO@$g^D=UP~@$b8UEn
zbI0^0MI7k1n@hck04v47PEDQ9cHb#5_wJKt+4F3CiZu33M3cV0rI0uYA@J^)L7FV~
znW(&en$m@QeMCGbpG4Q|Xp>~Dr6ktU|9OP)g%h_yd$y7mc-BvYr#Rertd;2@&Ym{pnzc9g
zkL@#?!JXe)Us83nbiOybFw9z<4|V|A9+3&LAo@MFHrJXr)>(I@&h-=*eT({>x%F^*
z8{SbzU%5LBF?^0NF(I8DxL*ysuDU#(4fNtveZAFgO85*TSvBC4NW$Fkmq(mDLrY&y
zAYg@)8uD{#s>PWBh&QIMte!2jz$#h@4&8
zhuq$Ew)L6s8w3+BDyvIr>~aX$`0TP!R7hM?(_63gCkXR8n?!w`mNp}=^%X5;|FvSO
z1wu|vuG1F_5d}1?`ccPL0kLN8jSt)!7mSfqLMpxP_K=`E>Rx-Kb6inblj%luJ_XiQ
zs!r-;j-miRtA?8zb(?=x2#Vk;wJG;Gy%NuM#EtvJMDEs7Qqpvo1u0iYBLEdycVq<
z6xA6$+(0g+J}&nsVQh*0BFa;fX8<&tyW8#587(-Jjyz1b`L@V6N_y4d#WZ%Ftd9{H
zx3)|Tq*y3Fv1EE1NpMm6;und>QbP_GJvXeNDlzo0gStojbLl#1KTNOkVam*r8dZWd
zxy$in)PUOIZE2uGW#gdp#L5dANV4*+WgI@~kZNd0l3GrcQ2#i&Yk1z$2+nj_S_dKf
zguoI}UD8OH!8|klmNBza6$%{@t#VGEgtWN+sD6Vq3^2=&VMy#`5JA~F6h+3+pgEcs#Qm2m|puh7!8#B(PnbxJT`
z;~3ZT;EO#7)$Y^1ln)UFwn>{xs))*IC-NihhZ!-$(@?4&1(qPJjF5&4Nt49DO#4a^
z?<9=HRSLfN5-O@gRjpk|9hTdKpe{#*h<^J=tdrenkwXChPgYiH>e5yP0wwv^NG(5OfP0`Y=ZuTIvnwk}I
zQtll+<<5sP*{K24Ljq2*ZEyFTkjjZ-tiDE5!HRHHtOVc1ou165WL4Dl)}02vt~n&m
z#1Kw{o{Yt`mGpUqQDW{!Z^$v+9#sXDPT6-upIr{0w-YqI*wKg4>N(%6(iqZ+5#;il
z8m_fyzv>F^yjrh1i>;Ic;M8=W)TGCw&LH!vZhFQu;XlEUd<`1J_#~|$n;zE%>FjKC
ziV8pHuaH=vNow(asD5#xNjw&1+siMi9V_x?SI6o2#u8cme8rV*NmadT->aL1lA}lS
z_}loo9hB5hT`B0IB2PI5GwwZb0V*_KHd4D)lx|PTD&DR+-o<
z=WExkt|Z~wsFx(whIcHN;}ap+{>Q}8ewet-DZeA|=Th}i1s$5b3WDc6g9`m1`^$eu
z!d6rzIVIBJX8Y19jKe*|e)70r5Ax`JzxhaBd@~0?cX(XjW6y-|nD0pCtN#A}%_rV}
zmW|H1hThbOLTQ&aITc4V60T4?ld2*_vq)BwK
zZ%jc28%f>CwM?y2cO{@dquEu)ZN*ncO6su}_Dr@WL|k!7idCrHI<@i2JKL``L8#A^
zS2L%0QBWHS4n=h=mMq5+f-S`Q9`gr1RlFQ@vTW26kmnLROBx#XDJh+K&RMR{qeFKambu2HB8ZnnZVQ6X!(<
zZ8R0y`kF_^Yxqv|!3|myNEu3g5xg_YLB<7*rG$0=(2yP{b{wR#F
zu|2+|wCs^CV-+{$HT|@c8tWyql^OiKIgD(zlw)2uCQ5kZcv`x<)q&sPw0NRT+-A?6
z#fD)?dxL!ZTr#grVC&PdP-E4wfGqn+P8FfR+kko$|FHlNt8Nq#D+H2GCBKNW@`x4U9
zl!NpG4KflaQHXa#LknVPj|f)KA-$G{cNQ+`kHlrZ)=H<`aiV==fCg$`MEL26;M@G^^Ny8y-x$`>+9ug
zUx@v_SGp1Q-mlLN|KH8d*MLU9DcGUkUnppQU0Yig>mIVK
z$$eH8{rKQ0*p8rhJoe`k9*$h%^
z=u?$r?Jj(3X%UKr;h}3t*ecj-A&JpoHG5PK0u4aqr6%eQ`+Qp+h9O+1N*7VX+Iqxq
zXbG-SzgMa6Lw0~glZwuUihV%qI(+3bYeBh3O4i7{=?dK;@s>RGQJUuoy!&5yd5`5E
zJt|{2t6e?2M$>rM@D*j2ogbybB@FqTx_;00t##p5ZiNXz@o<85b}`{J_<3qXFg=fYqm6$gSh91M3s$*ki-hwAHytX
zLozdl86j2yvmqQ>|01WTzNLD;=9t_c7%-DLm;`3Z>YsZEdG8TaDnx4&6Br_t3@6pP
zq_=OUXYG6ZT`yJb-u{nECFC2sSAX`!+&nayZ`ynfA-?#EGe7sZ#FM&
zjAd#K6@&&ebr{)${Zr(sJlII++q~v)qxVz69Xcb=l&w|d(oy3GGaF)Mih>&=-?7l4
zBI=p4R*l0s&Qm+FJM0Nibf*N#0eQbDFO1$G1_-FwOgq=1aCO+H{V!2@aUA@{%gMt8
z)5G1D@oxRed-{WN0TwI4C#NIT?gp5U_ktBlRtJ2LwGX#T2mka9X?l-)yJTH*(K*O+
zK#n|hBa=4&$k>O{{F>$~X9coIESskvBXnM#Dw&%6J5boLaB}0x9
zqsF9ghC_~idvIRW1uTQ{(IAV#{lTbIQIc))+WPlsq!0L*|JeHbjBcH>OM?F{Oiij
z)-I5{x6_@&Zl9jh1Ce_hJQVt$TR*+hPs8-7ycKB9+`}-ZVE9o?=(en$BqOm%u7r9B
z`-Mj$mb+~MS+>&S>;KNE*!7q_RND)&X++<8Aha)$s$b2%sj+XSq|e3|AB3hDH`e;E-U
z3dso$ZRsh$!6e`mN{Wqx?6T~oA!>#yEd~Q
zeM$YCjBG`VS-Nh}U{Hu3UU%3JqLn*;&QA5ieePzjdl(G=$!*oDX#z=egar1)XgU?E>{hA2-k-$m
zht$B
z6a~5%iLzK_caxRmYz+SO*I%g3xwf|{j4s4pc-~0iW+HtIriF!7KEa%vf7@h!2Xuwr
zcH#a@diNfCg@+8Ufgg8561DInE~3EOx6NWE7MJ!)_6C!DdPDNgZP>sSbA+fLt)LF~
zF8Ea+)%23n&sA;wqr}Jjl;=q3v+eO&dZ_p8D=`;QPZ|~$Spd6SQWv7v9cO)q@h8?S
zcf<7MhBkX9?Ox?x0+A8Y;u)g$ol~!J^-|K?0fhHx>N#y=z&3%cC$8g$dk)MQPvL}A
zcf4dcUl0$=fz2LE;7sNf^XacXLc5o#CKHnZH!p!OtGh`Ca~qyhyIxzMlYt^-Yf3$@
zEg11p`5(z;U;00X0#;ythvF`d^T<)JjJm(1mjnl!jKMpXu{pY-H*0vyL!FsTr&hOa
zQH3t1op&%v`%%l$Af`WzE%>Ztr
z^56i-_xsrX8yI->vPEq7vZwFVaIyNyLJ5FYk9@WvZ5USadJ9l4B3*TQ_Q&ytA6Hc5
zab*b($Od8P&Roi0JOa$6A;fUq)?dqV2iSrt-4>p^ivrzu58RQogqrZEq{j_M5K)2UQ*usn3WPBF{%4WClm1S_
z0Geoo@?d?9W{cfGdpQJ^CB52pL10_b;V{#9r5tuo+KTwFyj(JV@D8=yHrc`ELT_UF
zWZSKexU4bMEg+e3%N!xJww~25EDNoQPFg0HC`MDPQIWcw=9`oGcX*akSkWmlXuc)RK#J)4xpi=F&FaV
zY>SS;YTJGTOo~j!54f3hT?KX~r4T-O;~xCjkg@AgzaZZxwAO8P%j_nJ-s1rG2Z{dp
z4RI1DR0tb1vi0pwBOaJNx&>Pi~pc&s}@2k-7PaJ@PLdQPelu-T6pGii1+6cf+ejvy4a-
z`Ud_befrd+8n^29SJqk4)%w=e&_Rs^y6n9E;zJ36V_>O!K(R%yT)p70R*@O2f^wnj
z-Ev$sP1GS+XVImN#2m+1`3hL(I$1Dc=gJ9XNNkE+iXQ*u$J;R`S3TRzA@48*-${8?
zV|RJw&6fUk6EzIv@X1<;g?dN7eJ{DdG;$k!|1&*xsNOi+o>nO^88qrtl~Usfd{;&1
zOLj<5lrEv2jD#eqO&mG^{Ny^aV2r3-HIW(HGA?QEFRP?PzW$Sh;3M46^n7pKpt0S$
z+=g;2bEqm=8+dI7dOjkNjzBnz^XBhtQNu-ws23A5>*t8?s=c=_&n;UW=5b
z9ay0Mdd%k2#5Y|D>+Yv!N*8BBn0k6;I;7Ff841!CxessrZN-nHLVb-qOgi@(U_V0{
zX!G}!xrR0<3{&KXoNJhX!t@WX)$Db*XpzYLHR)fe>?wB4*K>NOD_oM9y7!>%ES1V`
zJ=8$6^d^+1@sMOhpdpr_&lP;we_)F^r?43-|9B!~tajzYi@J)KN+6)cV
z@uoLLPrJR`JFga1;V%z*zZh$^Y_VEh+wE^8d7{?B7^|O#K(wsAG518iUd_MJcmWKc
zo-0ESQq}BeMFEMn2CFmqa|vd>^xp5R9iyFPloLc*-G@zAsw>~km^1)xlXyo&X5ur@
zhBz!40-$f8F^?ExcvUZ&R=tP;VJB(D0`mZ8dEt6!p^E{(G)3`vZAO+G*bCIsDvtO_
zk9^2|HULtv*>qeQeAb^R$w(8Z#mQgB!9P>zoePE^8t-E>vakm6)H~)P87_^YbhT4z
zfJzbRocekcqmPH9cJEHpR>@%G-^WpoTeOIRsa;i5AOk=8Ci6Su&BfER^^5uGDcvu1
zQgT>bG)Rr(E|WUIG#i4^s?lG3*5}$%7`4pp8M$=tne>!Ant`**7k_Odex>;fbbEO^
zgGm?DV@`L)rsPfR@m#)naS>v}ssm{aMypgCmr;Mn-ocwCAm)Cyr-8BjvsYw{n#k3d
zZ@*7Husy|V>^MFl0Sp`?>KFo%(TbL3(hL2L0)93{k>I_6*mf9$Z$OE)GqC;IjAtYt
zlT<6Gu($b?FWuc)&V2Xo{*wp%{o}&qS0W{Or*eiH1N-=XIt{kF`+>K%JDDoqmRPp>wlAmU#N~bUyVsQ@G`>8N&&~KJbKe4c|NHGo>y8650
zY5o#7b~rq)ofB-H8?D_~Dy=Obccc-`42c{cl5`5TTS7bRbwyZ4BK=|SJ$HNgBU9Z4
zveze^Y4X3{@ZM7TpWN?5AUC#d4Yi@KXRzyC9(8(li<&o-!lmp@h{&_@Q-liPp#R)y{)3|M
z#Y0$iFeBk#reAl`%ozl>t;IO+;zbG84$Fz`N)Jf?!fIC$@sl&lmsvo52?iz;WJ-TVZXsJvS
z{W)D)beb7mv&+Zd-#L&q`A#aEN1`ST_U;d5XP)F8&aMUYX_`2gQo=Yp+CF|Kq`Esz
zOidME{z=)*%%UP4Be#^_;>#8_Ja7oheE(t3wfS{VidQ=!^dH
zpLHh}gBIoS4DW8&ZNPyf`xK
zB$;L*xb|f;H_J;RiFdd`t10-yZifn_JBb1q3q;0T%*kWdigsYuy=@$+qFgCm3qF`b(Vv%na}U
zkG)~*Sc1K9mYQ4QFp}$wx>F?eN6Fypfya&0xYq^QeYn>jdokmg`Md79JT=KYcF8<$
zxH}&?o=4Y=b1kD^0@r1Lo-Jg-8t_XR4=Aqs*&xu?8s5s)Wk7By4~z4@PWP`0yh)Xz
z0Y=@fj2L{JN<{GtB}We?3r7&Ng=bULC5}w^=gwd73L=N{DpZWpry0r;aoO`(#=o__
zfa4$Y(6Qw3!g*2o4kr=R%gx3qIJ?jj(Rn59K>4*?WuE8J5J@O{<{kf&Qx)`g(Jn9F
z5MHEL8V!Bn@v;JblK~E)lmQo(%wtb3z~f|3zVA8`ZdPgunkgN>)AVlFz#MD^RFn^2
z=@ySFup66%f+uV(@a6fj$+5zxs}KQ1EONXZ&~89R8M@rF}paF8}lTRIak*
zK~HP<_ZJ>f3Y2?&Qos-OU^c1f&Pt~u@A%fq)>o3wQ*NVf*~sdf*);iqfYn@<=-%3}
zms{#zg^Z3p-fnB3SxOpbo{7DvH~7$YyICXHGQ4cZu}CBA@=-zl=pK3dI5*({nj(7e
zT4V^JNMMFOk|=kjrloFmaa&amWF<0jTJ5)BzgPR0U?;kVEw38Mfw1fQBM~TZf%srT
z(agxs1Im@iHAslbd=Y{t^34@DY}BhDJQG^s2hH38oXA(<8L*ZE?mV1deYK3PZ+0~Yk>d%dGR%g?R+
z>17}3MhaBk-3vvJ
z1vvNwyS;gpo>ifr_u;^+qaD92^T5DAn1EE6SgBOAc^qW0YR8gXvgF+S)y~w{{+fHiN5Qe8JGKg3@P?jVYHF(dPo5rM^6~X`?EVLbe!(K}
zjEDT^lh>4f>%gl&|D~jb|E^vAQ*}7~KT)Om?^Tcg+xt^=zy7=W!#d^{l@YY2{JT
zpibW$Vq`DZL%WEVqMNvbJN+kteuWE`g2}8C+Ju=YD%Z`P0fre|)jd
zJWa{-NoV#bOF4eMh)t8#y!%Sn7-^)EU@$ZmWBNh5L(Mt+OWFk;xr-?s3ctsb``36}
z>FMc?wD-BWw-E*LbQ;BZm)s-iT<<;u(t8f&ZI2YpUyR_Fl?%Z~vvPk>NPQmLt55y*
z@+>sRU}(78aNe{>spfj@OW6eHi4vxr_+-qWT!X25)}Xy$t+R^z+lv*Cn^j1ET^)ke
z=9tQ>qrRv@t{yX>So85e!E9p9^RKIiIc
zIboTE78~})sEZaEmymzq6~o!hNjIxw-U9|r%b&bd`!V+hBa8n-wXIL1ZkxhlhE9S(
zhO#x`PW280=k!QOqKIAx98l)y?p~G`L|Gg08Oqa3(NB@n8tMSR%!lq}Yd9Wxza8cJ
zu)r}j;N}%Y$#A7tGO~Ycp40>2Y99@)%r$pnMp6`PLjh{&YeT+0sI!^PofBukj8BG-
zQXj1)i}+Ad(9Dp}%2;{Ik5lo(RhgOBhqMPB`;6_>MGZ2BHw9;QUggCv
z!0(!YN*>!hihhPXCF?E4T|Vahn7bltkDYZ~3Ak571JZhVQ;t3Yap-+nleu|JK3qkr
zYVCY_i~O8d8_=OK`g>-F)yu6@@IxgY<{cJ@oifQ3^XhAMYuK(7zZV%M-9$;B7h>AK
zebzAeKi-$^oHuT^9>xrfoMCL&3K*zw#k~?9cVeY}!UB-JIX-#T4}4&p4uCn($1L47
z+b0f<@)d(?d^zPZrY{RTZ;QHH$>ZPPhet%V^K-~$=;q29vP+Y`ALLRk9TYTEuJiM|
zihWm2lQaAfFW|k$G)_@->b3I0eU$s4l?|Qt0
zHlYuG1}$}i|FYknxY^xqu`-9Nrd4-(WQos|nQt>P3nUM@L?N=|)Mv5bnu$bkQmq{`mZ+4%hMYN}KTZyYQS;1!&em
z30dAm2Q?(CsQB!qpxhfcfRxOIar>gA@RLlZNG<|aq2ig}FPJiW%~oUY)hhN(xwmNQ
zLx-i$uS|A->f^uM&9&*E<&xSx&8?CjKg997-am3gqng3mqxCDPo}fMwSA8S@rYp9w
zAt-gvahE|OIq#M+x6q?<0iZNRT+w&8^;lI@Lui@XME)Y7cXhro`SMMYou!W=Be>_t
z+GoI&1?rm}A-N$@a-hmV7t-3$5cVb+lSRj6ge1_&J!n$!Rxv=AT=!g;|NXJ)UxzrEI3-}%n^*4p_6S!wV6JkMRO>$>kZnnN{N
zCpoS;k7BYffM_drW0X~Vx4N|I;~#GsLyv)5gR)CXpdF7i?o@Jl2EHU5$H5>P8A8k6
zRkszk$J|TphWHPTlsPvQZ)>`p{QH|eCvnolmP5OuG}Hy
z@n=a*LvwSSpB-bg%59Pab8&RqQm#3wxKAGKOFNu>*wf90zIf{P0d-Q6A$o5{iE5#7
zu+DYxXuu^?rAj#N!h1gBLR%f{yQb~;%evk?a{fBq9L&8V#yxmyBwKZduKH{vU6a)M
z>tZXF@A@BPQW}Z$5+*ShQ>C=7wt0W+atk8|PCFQHC)cm}VFU;A+WfjFQD@;{t>SD<2T_k*6-uyAtC)jHNXD#
z6n7)ZVX4s9pb4sit&}x4cf01cTiC_0FxIeJf{$_CDL_Z$Of0l8tP!nrw2i++aTk<%
z%6R2^)u&LdYJie$cNzJ34CWeH_XNXTdrzhZhmuym~v3pI!Pr=+KoYRNv!G0Vf}Og
zX96bs`_s+|autX?4kRsqO<=N8-7^YH9?Gv5MbC$sb-kA{DJ+?awXuX+Xn~?bTbmgl
z4BmH`{ymI0rf}eKvCGTX}Gl>*g>5i0XafHkpYRXuri-lVpeVtWjKxvGYQJ5V7;wA>4j`*!Y`U
z_pRCm+x`p%orb6_v_a}v{K(3HM_Ecl2ANh1gjU#2EHJ9*JoxQ!pJ>4VUHg<0tK3X$
z7?JC3!Q+zK$pO2z2iZsI(?1g43~O$%h)GSxB4fbXF%1}}Lf&H9y-Z-?`3nG>9Tqf5j0(zRz~&?vwK*x&HGb+6&yO&9bKl}8uyaXF4t%41Id(|4R1Ba9nOoEt
zR`rgK4b7Le|8HT;{~v$bKMQ6f3^EXzC4!`sX6TMhxx^ZuOt`)bQrWAI?YGYK@o-d2@+eG+N_QDu|lZ3>GR9rVxCfN
zZ~DW4Eju>zSBZ-I5But{u9R}bX50`J{T!iN>{r}izE7I|HpR&hCuP|DFl0&NZHAVx1n!fK7EYQUIIQ^H03DN)^jFoZanSJ
z-F!*zABVdK1kTn>DROP&@Uo#~A8e*b0Hf}dbsO<7=U$Rd;9)&y29~4e#91Z9yjHg@
zre0gHs%n5YGFnT4@}(3%QFIwX9scNE<%9HojFl)wVLS!TVoD7yI_~z-NxHsmofjIA
z;9to;*xjm7V5RR`b+9z8tyi^hEc>~I!+*Mkqb;0$2IP3CDFs&pGv~6Db{ZKa6nr*w
zvO>=b^?S^B#l>SEMMc*~HdH)Ab7~O$3WqaPBPIMP>ur)8l6If64hMU#RO2j%^7N>h
zho|JZkH_@a-wyhEFG@Ql9^AM5e{^$3HV4%G_y)=bDjqnf$idB7fUli!X=aF@0J5@p
z#f^6E_|^nCGmT5;e^vz^MnD>x!9S6xe^s#;{|9Xhx$K3tsE8Jhly)kdivi=e748EV*G@QTxVLz
zu)F#Nk1uN~?Ux_uc>YVD{=7!#TijAwnWyNW!z=uD!?uD302bsgN+Zb{8f>hr5`|Zj
zh8?Vi-8W`cf8@AEm>c_Ef4c3AS5~{L(Lbcn!$+a;M0`ApO{v)4uWdmD#}N~Ly|9xrzW5hb{QaHYw`wCexA8H+BWwdX
z;ri$#RevToJGsA@+c-VksUm1(G@?W*=+G$~0t0~C<&Wap1Ik`O8*t8HQQ&QH7uT*v
zWMv>)5R@zbRMXHgd6W+OKFe?U3Ep}-%XlD+fNwE_&M}AG3q5aJ_4^ON!NqF&V>j#G
z@VnNH@FdnBi%D~q<=-K7tLTZ8;{KwheU;lGfk`<$r!J01&TgB1ScV5Ane6DN-y9Al
zwbo;QGlg}$4hE{UF!Fi$f7*mBKsjr%r=O=zb7q
zSjC<;YupGL^tq(Y_)j#H=8wPAW|`@_W>3n_IxB$LjksL9U<++#0Faruqx$f?jo_He
z18&{FL!Asit077PQIMD(Va0`x7_R7MRS1FEzLN8~nO^H#-FmvrkuAVM=-W^l6)`%tu8jQs7WN|G2kIKi$9MZdeYFFs2{^Tl&Cad@G5y?aa1KdwB;d
z=3JQ^MGpaI3VXWM;aTd_d?QTISr$Y$!uAIAh+EgX2s6YA(VNSPPuls?d{kO{8>0Zl
zn+3G;uc*Y=`uFnxv)iPoz!=9cSvMbVFR|Y$-H>W~=g!NlsEmPlA@am_L-rz>h?6uy
z2rhlio^a`5pnqn=D#t(2<7$@yU|GZtZU4K4s3^_ge}ITTmof|Jw-0D45e{^dii(6aeja*&!w1|?rh1IT
zej{VR=f%Es6-kqFn}{s&XFY?16PU?Tudd3iWlVZ*5_~9L!uDepOo>{RbqE&xLGv8^
zXDaknFZ5i|A&4$akN80fJ+FGL5n`YE6F}cZnNhU|fEj~!K8IV@XT-$I_McVB(NPB^
zHGivJq-=hk`tNRk`wo})|A#t}{<+9BG^bS#6V)H;&F2e875Sqh2c8LBpNkd
z{>ZvOO<<+=3r!TkPd~k+q~y|hI|msa)(Z}Z-b4SBb;d#K2dr^gR_-U2d@kz`nzJk4
zPHLR*0UAakbED#W`T`4+c2{3BL`s;HTBc}vc?)dr$4zq)s^_0;?YW(ZWU
zp3441<`4xuY7o+51jq>kmJvHCu3v!9{qcA%2k3{MyQnbQc!(rqKcTgoXB^&4F5x!5
zIQ~O5eDiOEH?tSfbgs?Y_#<3jWGUEh+t$cBNZ5nn-L8MmFHY7j=1;;yTZY!2y7dDLH3r8g)JuA>6y+R3Dna`U<11qO
zUg}feYEa5hMu`owj#NZ|-WzCluhOrcd@=_v2WM`5zwm>LyyFTyRf@Qi73b4Rw?yC#&kiLgr%=vm|6@w?eA?i)!u7feZ)$nARCI$A&(kv
z_UdBinBH5C13Zl`&|q+f7Xrh7p)-uqR)l8Vg~dsc%5+j%=I4-wg!pkuvwlKwxC=u<
zXoZ$24j)M?k#sH|Z9eOobyM;;jwvIVpkYjaNRj12q4L`5lP2}?(#?Ra{v@k`xK{$%SFs($FQ*eZ{MsrQ>pCHEJit8pBr4jztTLP
z3OTfy+puplR_(U-WTiZyEh$8@floB)YU`G&WKzDUUUv5LJq>LzSUKTAD8mz+Qh<<{l7#2xI;s2LPAc
z7Sontw&QRc0C}}J9u6RXVNS$v$~Qoji*knbQ?bg?<2(OQGS9mm3Y13*hl@jJh4fv0
zf72UtYB&TF`|6x(U&rLLgFq6|2~FjX`pj1=lgdWEHU*o0(}=>1%azc0JczX4dHE
zgZ4QMDP5r(HP?!C9flQynwSQ43!xa?
zYjlH|;?%2WyikjJG
zjwO5@r{)`zWS6eanGWau#l0^8EuOX9ePXY*Ue4-m(pR(Qhi0W->3+CA%^i6CNA`ZD
zg0X|7u+oueRo~k3%26?l09(ZkBwr}K@)p6ySa7Sj>Hw6*u0gICwR$i*mQPw0IR7n{5Eiy%u+m({k8dg2>1$bmIiPtzsFtT92=|
zVX}GN_7?L2CDjf*`4G)TqlKIB!3!Nc@(1(=H>-ejL?fR~(hZqxY0(NGkjuuhD%`Q7
z6`qAQf+>AD=js{=UnIh;iTrFW(YEq}j;t6*q23QdfJ)3{hq(Hc%f0%ox`dQ-T-Kvl
zbmypmb5EVskB$c6F#w}>7*O7U)IY8QcHal|zpK>3>krtN$@u)C0LH+^oMe@`TrQvV
z7p8v6@F_hh1I`T}$gIKTJ2q!*VPPDGw!q*xDUj(*L1
zKEgccs5UHD?G=%)T-Yju8qNd(a;BK!Ji>WXj^AD7SI&T2$=j#210MGtlYp+ck;4)A
zXO@mmT&OcdQxEjhRluZ5{A|c{dxmGG$j2a8wK;*`!cjHnv;D8y2HxXA$-~=*BnTS{
zMYmKa`;&$bc}?Ct#xdp(lL!>bFEk{91qY5ZNk=i-{6xABr~m!=lj$!y-=DcN42D1B
zoxMGgk~KvYX=m9q?#Wbn%%QlTq3L$OGVfZla9=BnPr_h6dg-~o&McEDQdc?aSf1r*
zq99Cxxu3cksM}zna^9-~HI_?tzs3>GQXVq*2--RIK`|U9$5P^d)hX~qnufqx%G7!Q
zxk=uxuG||3dmlgK@CF#nWU?d>O6evEJVN?=I2E$1oRS5)9c0uy?Ymrcmg8reCEIk0;+
zPvS`%U(WD|t1PeA^5Bk~W@DI>alq+GqM~aeRM%>|475=r#w?#xg1S)oF`BC+
z$Nu?AzaodxlJo{K6fQ4d@7z1yyKBt51?E?6Y-n|Jx0EVPK>D2YgxHRVy*AF(i_$W}
z_>C&v8(5XJEd#YrwkLuR-UlpKYh`2FEIzr>+nc>uAQ5s)ObGaAhJvALLg-kOB!KH%u-QX?;!NGlM*!2f~smpu_wXS=q^{TJy
zt0SrtH->Gco;o{}?<5DE`PJ9`{qzVn0aCZq^|U%W=NQV=<)rlYHDbPWzqd)i`7y!l
z_4@@XG@R$HXkLpbb(G-J6m;ZZ-d>hF@Xu*Rv;UBFk<%U*@HM{=9gBW6JlnB
zuIQwR-xwD{pyD7WqZYosdpA?62tz#vBaofxPrM2$+!Yh}+us*?K;`B5
zDq~3|e307r`3sbD20^<;L*!#LOZT5-FO7Rm5|lOu?SB|``7wU{hRo`fj+A31=0)Wl
z?pyj&5+F9TqoHVAy_CDSX#FoLTgt4Eam{X`sm^#na2TENa{Ct2$?)4Re{?Zj+`BRa
z<~w*W3pncz0=fj*fItA3~qofTv@z@0~{%<{Wpr^&)Hv1rm4M|=Ejr2wi
zzm(Q)sNX1O4=E%5A&l0oX(sF;-?cd$-~$wV8HVXDmguWBfnGez3h=Jb0CAX|mitKQ
z;TtW{lRqVMDqOvGmE;9(ovPYDk%YgN&AgT!CkkI{h+osVBilX~FkOs*Y+-dpH14PzlZ{+l8|O2*=U#jw{iA8jGcg6^ysUf4
z<1xl~f_VqWmpRY#JL#B>2U7T)!8lfpc|5+FO?WrYVv%x!<-Mw~HkW_i&corxh1sSv
z8Q+5@qutjvG9JWHd)cB4b0}`s9n}Qty}i&4zpU-cRkn{{vkVg(sM)?%@6n}>Ju6Xo
zmeR`TKIW*(R;-&}88BPW%BWJx>KYA7%>RsZyZzX_vV({G?kOey!fDA(CS$Mr2a}Ie*2u
zjeg^{aYA`T`9dP3k-eZgYsYKdd!3AUVaS=W$k=2>^ZgxO1=<+zD?xNL5T+5bo^
zeWNxQcS??V1Im(R)hR39_N3t*>S7$6ALkc5fiFgLnJfU~!Tprx9R*eewq=QSSjAsr
zNY)_kWx552Hay@4O0GG37)?WBrPU+_1|rVM#fx50#ktn+w{O~4ZRPhs^tOa2qd-U@|s%)u=9w&H|w(ekZh%0ga<)b+rbxtkZ*+KMMbqRrgc+!x~QoCwZ)rIcHvcWUn
zprYbc`X)z~Tac4)Gr8L-kAh{>^Xkq8V>aB(oFm0K;5DX>?u{ePk>$;5x0MH?5}VS`
zkHVMN!V}?BPJ%;*+Ve#-!IX0!ROcYi=YI>2yQ_2F1w4G^lulnB77%kMZ$7
zQ4E^N+Q}bwasi*u8<{C(k0FTU;1eG;G;(ngsdUq>Uh-$|RS!L^BdUP=@U_D@Mw$zD
zk3c&3lA|2qOBCK^t5w0*F~q8aZvG|;c`gbR*|I0Ky1x-TM-7v2n!W*|^6%uWrk9rB
zOVXg=dbr8!VlxqmJxgcpj~8t>J-y7tyY}Rs#XY21{k5<58>3tu?dsE#uHb^nb#0^S
zx%VIU@UUp6K#x?2-Ryh8O%+aPQba(uX6~6H)*<7yp{LFPK+~LP+IRf-xEbDpX1MYw
zV`|bhbe-_FQcWK)S)uKb{s%aPtU>&=^DcnBaRk7F7=$iQ(HVuSTU_9XA=?d5gOpw!
zPxlKwpwn)iDamtF*PdLtrxf^=8QEa(4>W~bRXNm5zSG-iRk)}2{-m2=WqNw4TM}dA
zh_FBjcUVADZjYTv#v^nHN>PtrC(^r
z`TLuKBu|01Nz=Qeln$(cBcp*6twE^|%5x`J%2BfgFDkZ|;CKKS!y}GFbto(#sXU8W
zYR@0qqCb%&7O~o(fvrxUHOaQn7$THmh|bOzYW3`
z*DE-5UVWyjAbUm(0hq;sb{^fZ;-!85(~HrWl3lm_yatYU{?s=D5dSv$K%nQ3;m9fj
zQ-px*+fxP!>g{X{f5^{;edrHGMoZb++eaYUIW7gytL>Qv7O8`>O)NsoW9czcK)t>-
ze|76jdt>j=_uH5TMBgL=n$%z&@24VCx542zF%hA-XOuAV{WUMl$wAr}od-b%kr~ZI
zj1klvDdLq?t2yNhAPMpfa%wazko$t~zfozP4p2cR2hvl37N+%!(Z=XCKg)irm3qG
z(bXmeAJF?|t{XeMq0<@)b@EqNE3g3#=GZV67ThP*TpN07+6_a_y(bSFx>keaZO11M
zavU7sV79q$Y^P2n32qt0gy|XPTrV0pV$H1YmW}YKmGf4%
zS&-)RHT-Lt4uGvj*$sCG&d_PjLzK-RqsxGi+mnCx{mIVFDn%X>HZGDd)j{QBy{Jf)
z*L^{Vzpr$s7iaxs0nrn>f3LQOrMspZ4fBznqZ5whQ5wGHOGG#d=XTj|Wnrz7w?DG;
ztZK%M#Iw-CE1>n0rsafjfqNs1Ln{U@DwgSB%t^BZLH|@UkSWGrWqI(0HEsQdD0FQ_
z)WljoWf&%nGdJCj4f5Xvv1wpJ%z96{FRSK)9B7ls%G5Wxu_XPbS*RwI&{6bt9s?1^
zh${Iy^6U8-5H1iz!`n$F>4cbQ9iGglz^KlS7_!yF*bHY(~?fR&0TQ|xTWI>!9QO3+9LNca7LGxAcLEhb`BVL0*
zOfeVz(QbAOxY+^?&FlQ1%+^)6L*n!t4Okd*KY@dJXF*xDFBD*PUZ(=w)=*1De7B1E
z-)w5zgg52~Co0Om6q)X5dh-ZFbE$jAm|A8C8Q-h305a{zKUwS;_)rPjR
zZURr{aQ@`_{#%Ohe_j9>40!yvcKC0&)Sp6mt(Yb`J$yykP}*ND9Y6Wf(4QEr=iEx|
z>J}F?=;3fv&v4Vo(6OIL_Fz)+!;zZ`5QNcBC4G+ipA_uRUX;&H%n+cse3pOjFUxo4qQPYY(5&v
zstjO9a}N|pt8VIGKK5JoN&%#dmV4XgBm@0Vo?JEJJJBei+`dM3IhgrGN*Urv;iRKz
zeYl8M{w1oWVOJfSvQts}7Q5cr%(|z2JxuqOL&OQzF!aixixsXcj1>|^&abc#oNrev
zb7UZL|J0M6KKT>!f6l!Q0>d18ZHyH)el*PU6l<5g=r*j@v~WZNs`<9Ne~HV4rT-=*
zRQ_?HkNW;N8Oe|RYipa>6Xi7peT%EN(M1w_u{z`!j!1XDrwnpOW%!wIiF
z_8epz47xq?_-JU_uJdrI&~=TnT0IwOU=q)H5tcCp@7GxzqglZAymiR124xDAEG9
z`!3cyG?aP$C#&}*;u|+uAp8T}qdKr?)1hYcl#0BivYIzCCg@y7#zp?#&4)=?T7~m_O3LI#}i+0<;bY>-|
zNbvigxxOo(uDXsZ2tqqXD2=RZ9ClcPmH#2RV!*N&HPVfQcTBYRMY-QrPFq46KH;{r
zfVqUluC7H?Jt3dQm^OlKv}MwO#_&rwRNSjhroi6uw25fB7EzWIM-Ded%(1^0(*jsb
zUP;?S+0~Oaac>LOrf=siw9T@>-zX1U6%qCYIwTw(W=dc^1yvFxq@?WR?N4UC4#kGY3Zo^#y{sq7Oho!ErxFnT{WtOZ?8Aw=5NZB2C|0E^V)9XDq
z<XJD0)gj&OLZjz2BS^tWZX|IwOtL4HDL_vbvoi$p+5EjqSV
zeFpfHg@1QG{nH!&biMyY;QV(_8}M1cWBot&9sZ1m|MzZ7`=8Im{GVr!7VN)RmVeUw
z!42eY=Uo`^@(*7p5B4YbU>~Q57l40@?jEc$9$Y$)?{@&t2`I_HN7WZJ@O<46p>^VZ2
z+$S@|P77~2K6`5&=O_lfy`q>IenBqw?K{DTyY@NiYolaYH?7@Xs+?L^v?T5R38oud
z-$}m~V@ZSgDF1`Jd;7;+!e)vTT^qRUMx(KmxW{TSw!b?%I#Sack8-pxRu(l~@sa{c
zl*u>HPY1P&RASXrjxiql=$>fI6NA{O0LH;%*u}Nm{=eLCjEn(MLO4VcQqHRMV&wk#
z!9LM|d9oBsOd$kp6pKiOuSrp%F)?Mb!oFVqhF)M)ub&}OKxlEZh<`)}F1)?ZB)hXz
znOSI2d7x9Wfy|~p;^MEc7>p6vs}lnQKT?f$#Lw6vFn`~oI#xwwV20K32`}FK2MTz!
z83vPAS@_R+K)%h`SVQ%-H(dr5!tIOUoSzv#HNgueCI?KqUcI2wq+%$SM
z7Fr*@C}oU|SncPSMOu=%z%x-{lMNfkkpptMx(7wCD$}(y|5)|r^A{A9WXSe@o0?bI
zNsxR{4v808CtvmU+RyUg+IV7xaz)5NlBbjLk#4Q`F__IS?L_lN691z>R`42W(;Xn_J*eA2%VO7m82LWbv>y_xWxG`O^5Nd4k9N{BlHmFPc=F
zIn$W6kwgPs4pxtp|5joQL7y77(6<~OAmhDR=xE<<%oOrUDDA$OaHuV8u5*a4eE-&P
ze%jJYB|-k1rHBt@M89QuW|=2ax|Sot5IVZ}2Q1!`P@wvN~BI179}Mtf(JLOmSOQHi`y
z-(r$O(0lpW#gP?jxOn_wYyJI9?Q1h4)M=4J1>srEHQBtuX9Y5kx^X4P2xa~A+-5bN
z`3H9+3T=r~CT14G*ZK*xlx+XTjd_bws8x}9H3j!_1kDeAw0qMB|Dp+}*3k_!^y;(2
z4$L<$|@%cdKXY;?>tIzTJjVEs);kr(cgU<5oG=H?P0XPujFEC+xJqq758h%jjY;V6J
z7PTd^M1115Bv8(QQNg&q_411+RmS5^86;wycGksZNYP~n_Xq-lu*`e**_k5-2uk9t
zNRJPHfwau_+|Ua{o<|BS%g)6sz0&VK%sq9UbmCX@XLia4gT(O#-T~6*@=ZciV_^@*
zyTxpCcZDh^J`1WBNaMUBu(mCJuX4d6Lov?Zq};ZZmY}1`ag}c$aPOS|`oWF$KAXTUmj1Yx+nXE9#(k<$>dP&4l30!P(f|S9KW|u|kgM
zXCWrXz1Ah^J9g88yPgt9LaP^Uz~p8}OH|@!zirhmNI&g{KnhcwxA-Rq$(joRit8iu
zA2Tk&UUYGUAa}I-HiECjJacMz=Trt(RI2FT9m&K-O3P)toT=F$J=-|=D7`BZPu_Ur
zl<~QH*L|u2;fu$nY@;00UeZ3(h~!y)i+wj3PT}%f57*SO#;da{&6B?i
z^0E!Qq!X=2eOkzCEPV~lMx`sE5S0NrgoO)Yb(+GNZ4#0z$5rcv+Wej1(hE!f;HR6u
zyW#0O0a=G;ZQ&L-ni_r+pA_I*^scTUT9j_dpPn!aQ{y(Iwa+->o@qo&%?we}dWwqU
zffsHKNYv+j2zM3A)=R4g+oRmursxc6AE5?N264a)pGY0+3TFMl#ulT7cO;fE!K+tRgCqizLGb3z
zS^RI#CQyR;D9UH*VkXmAa65sIdvP7Ag>W?HwvQH$$}D?^XZP2@zC3H~vgEinYG1eE
z9)+yJcX(*EC^~;Fd^TcNyT629T?ab>o2UuNEwnwlulUhjr(vaMbUl1q^rcs_
zaLa0jU`5Yo)6gEK^{b9(5|zqYA?_*qmva<{Ty4`&QYyN`=};=IdEdM2jT`sntN`!^
z+~iCre0$WR<`0JB-FoF@i3$=-l3}_{fmCc4SGPKT_Cqh2yy4*?Rfvz=5+2R+@
z!r$!6o=CcH0{HJKCX@VVW?78d~t#)UQJ;M|sSlJxuo;2HYlH&qi?im&n
zsyPR5)^uS?9E0yW`ZjcfIb*mUeH1Z;o|N9C3zPAxXC02eOH2FAX~Om9vU#%MK%EmM
zS8j}Nr=~2hL_+`v>ZGtOb}5%75+9(tPv-
zw%X3>i6PB5fszzIaHNulB&jxU_&F#QO7HU4(n^{rHmRr-$ccl*zA@ck3S*lSg5
ze8$O*Bh1e_SW=8c@FOvAdEenu^SS0ahiX5E3di2*=lUfhJ=jh8+YYx!U8vr{Q`Zj-
zE3wSZipT{DJ-95y*ozr`W5GXcFtduJze*U=qyApR>proA@E+iKog{s-Hkp1%2PB@D
zG%1j)rzl)G!}r!l-g#t6-lVlra>G$!esu2n{xRi_Z+TV`3Yu4=G87m?wnuh<=sfM(
z!+STKFGO5qICm>9!NEKIZa1xWpv1kc=7W_|>5`5y51ukGxDOG@JXZb{IrZv*xp5d7
zkoJxq)<3t{O^R2_#;%?7VE@zs$PuFYPPn5np^6+rpGKa{1$vJ5I4;0zcUmngey`+c
z(aUq^IqMfT7(DyuReUVu9aUU*YYcOIhh~$^!4=D1Rv(`EUQyO4i!{*A_X9VyJ^G#G
zK2b!1%7L>Oq6itMv$#}^4u&dlyZ(WNB1gdDmvg=|pB(2WZ_f#LHOGcNho290q<%+a
zZhSU{&QHqo_?E@dT0!1UaYAHQd4&6%^qI3ZAj7jTsg5|jL)aO^x8hvj&5hF=6}5%e
zEqlPAk?H=A+)p3|Rbk$lleNI__3;`t2qk*EBnXoD6_U*}zEhp?HmOaa2KDQ0KuSop
z8WoqQB5t-gsg&%PZA-*d%YET%M!bOgxWAD5SU!`5NVBc)Lw-6DGPheaFVDeqK{i?Zsl?r^
z@!5&b{IBz{?i@(uFw+qT`n?N|-2W^gDbc=+QMbyi?lsPn)?Ig6>#gyuzf0{>$Tz`e
z`%1q%H7q$=P^l^+4>-mbO`hE`B-)_RVV<&XjF@qynQe6yzhm}*ui&=Oq~h!E_qUdY?@&CXK1ECOwY)U$p0mhcio
z8Lg96;M*Im^hx)zSXWtFo^TvCnx3w(jfX;j8;r~HSq!U_rV;5fK@sYRB{vw?=*cW~
zUrNyFn5v2C$`R2D+w7u^7!QR;X!@PH>)I(|=s(;H(Tz5KNCoSqzC`D8&e8htIQb4l
zN9QsA()Sxvq9dfUC+SfAU1pDI3K=+O+jMV=Z!pDG>JkrQaUQW
zo^#J1tE#q1$xLYkb5#?5xNZ_svV7Y
z=F>c5FyTovg8{vhg`?7_xYHH!^uxy%Kg><@S0)vTFq>RGk*>AbG?yzAe6~zp(rmt|
zPSmWn8=cwN-4Kv(h=eW_PJVJ(sn_G*pD4-IT>f~>c(lGYVf4^m35AtT3YTh=?{7&y
zS)J$5e+#BvAXb&I{_K+hI
zxdM3NHz`9q6_=&%D|vDF@^E%AcUc0q>qM7Tx#r6rXO@0`;{iPUTc21nBk3f~eV!e5
zN2P;g8Q0rfjI@8(%{i&xdCZ2!1@Wg?#;!w$B~+z`nePPo9HRlJ{-}}dtP{Sm?Q}Bx
z4bZU!!3{e%VFR`b@3ou(nwa?rt+^S-4kkJ#(Uxp#IDe?n7#1|)&U7kIs@HKFlXZFI
zJIF>uli7RJ!Bkb=J#iUZt6mO~>9&iBc|B^P{`#gSP$0zmhOA_k5m!Eq)p+iVQ|8oe
z*8f6dN9awxbB9&+$9rY0R~za_w<-`$bIOJhT`}34XU5Ac^<6?%!pBREOTDnB=t~`P
zcY*h5ojUqiIow1me>tJWsWDaA!1@e=V(hny0L7%ja~eqpuL>qB)FEUmTre5B&m@*|
zyTJJHXSV#mj|$vmVE-gp#+H%#B-eqM(m3akAn5qH;f43>-KvYrL-CIX=
z%hFAkUkupGo{23+V$IB?M?A|9&me$giu
z^sRqqhOT?94LPeDw>ceTPgyqWT{nl_Y#*c
zu}iB?cufykEczF9;3Bndpz4?WuEH5lJ0C?*u)afx8c<>nU#_)^1_qDB7fYvLg*Y4;
z)pXv5PJDrP2kQ^KbSyPn7US6jQ6?Dj)r74@sPUYe^U#E-@!^#-Wl0#cI_yA9`pkV;
zJvBj6BfgGT3?U@BXY5ua>pNu(K3_WeDHxOeecF|(69pJ?%Pl0U5Y{y^$mF;WR3yYU
zWbA&uBr34}tw_LFpm5MJ>Xw|?X#NM4`W&De)2rC55c?Y9Ro?MZW9xQbprc;hhP_X(
zQ`?H^3PkQ6r>c=i<~Mq4c+&Ej&OVWl9y69Ag{OdJxl~BF`Kt2JPaxr$Pny>|(4Zks
zczAR87;sDZd9vY0
zDFe;Lt-47^jmmfa6JHCOCgU=(&&Wu7Y5VpllcEY6i$;V)Y~2nznxz1~iGS(WbxO?p
zvx1|rp#*x~t&nfB8rm)x`RMWaCss2k2Z74d(*=`iMm?BGX6Nk0L;^-k$TYW7(+YdX
zwLZQDfv_G~RKoq1k1WQycfvjG*A<-|rJ+SyB8@fbpA1vi#Nb`6iZ)m#kY_%#d6M2Mj)4hnjl
zyJ^+Bk>lD=pMSL5$4`TvYWh#ZTfjE4Epl^1i7zf30)rk7Pw@JNX5}{`Lt^Us-s*uC
z{2lxEd@S-Qo=;ACtwt{ztB-Z~juNMZO7$Sj`~9=4aDpiz8i6Bx_~d}`R>ILM+jQ?v
z-7qkTbGdWEnslG3daV)PI-PddUBVHaU&f@
zfev@F+v$yX1Ch&T7S?Pc7P&;QADwv9-}w|qHOdHc$7u4Etz5-%@U}V2{zkO=D(mES
z%|!TP?A-L0yn-2LpK_(y#z_S(KRr2(WTVk~PXc;xPO9(L!nKCDUZb>$Y{m7DHaD1^
z(w%xL%QE&edArWL$JPvW8<%0{GK0cSaKFr)vC?5p&O?_;DmkTv>cONKU#^j_z7O55
zd`!-1-ex*2e3VrRtJ7MIN`V;XwGHKb5j}e6yE^oZ@;_1aAubU~X#D3JEGe47eo?+l
zcYyKfC7$gstBHw{WV3|CA$|gFS8)76-f8z2#{BdX2HmJxXDau^iGHdXeq>0T<$)|q
zOY+N&Jc5QOvYW6RR!c4Lo&(nx6EOT6pkLiK9+#Mgbs2=B{DzPp+jV|9K6jzSv`K=@
zMC0Y>Ym1S!i5#&nJl*4ZvBHl(6guJRLD8RI@_W2n)uC1cmT*P2kf1&dQZ?iKaRd3Y
z`?ormfw{Uh8$I-+ro(57rj_2kiW<-*S50u-FxyXb&Q|Z6y!!t8&UJEI%J&x5-()*E9U>9oXE4qw$t!5d`LDOg
z6_x!TSyJ>8BvF)A75n^hXN60&kU|m8ZYKWrNhe$T&c(WJdJx*Q=zCD^9n&5H2K8PG
z`nB%L2h06C8DHB=-=~E?e?u}#J9atQ9Q1?*UVVG1g-b8SOk`^LO@5)AvuTLD4ZdKO
zLH+fk`shDOsA_NY73ZqtSE~v_UXkBF>J`3&InV>(#h*rwh0`J{82^M!T#W$PsGftWFB4_Nu>mes!_5J<<8`(^X-UJhS!A
z{1NXt9lmvF+tj*o=b92%w3G*7U{$_rj2%@QH&tM3Dm|;qF?_*KXl(U;66s!U9#WDP
zXKWS*OE9Vi!`jqrDh>YJvuqf+q4T&E?#pH}gST0>d#+0W0z47C(@WRTBLi4q(8thO
zc>eax+eGr6m+%pY-zYNOL-fG>Nyx1x(n!KfkO+irCNlZ
zGLp%|mn8DlF7tY%m5C|g{EuAO1w%LgP9S!*AKc|&ysPIdtgR9Rhpsy9@CUt0@lsd?#H*7iGRj#l
z(`G9pO-K#URXn%`LJy}UjwMx|Tm@FiD9Se$RXBb{@rQe4Yot5ltI&7pFmpao^7Voz
zAxcl0?+_~-?nlfCob@06RXTSpOZDz=_xdwEV*b#&&0nc&`>TDX%DAGQ{<|;tEX`i@
zQ0`y)@Jiz8mkUU=>?x`H@n#+Ul`RjS(@J8KSK^C
zMhVik1#+y~6uuBNaKD&)dWq&{1~EIDPaByp7YC2l-aH!$y^Z3dm_ZOhaFcD_88={;f6v#(DH7RQOc2PSMQ@f=$ux$2Pa9O!2_3Fm$|P;WMWL@c~SBhgHN>xBQ#I8t_-iZ!Pq=XKEkXXh_8wn60
zgoqGAXQYLeL`6heA|(U}5TwNrLWGcnBm{l|=RM!~opavztZ%K4KUgeQNbYApH}~Gx
zzOHLO2=9O&b%;2dx2k!mZSM9;;+89Crw!jh2AoY<(pWPvddlR>tOMU`W>~C|Gt%W(
z?Xvc5ruzu*BQaGOm`wvSh*`3T$o2ESv~1&v`D|z2@LrmCDE?0(?Bdy*`qiD@AB_k{
zWnh2!Qj|CJimy>q0qFWEUhD+xbVXqAQhmew$z5`}E^&(GmGCv$c&;oArUSUPf>?3j
zFe#Xs48Vrj+@m?NH*Zo!*4geoRR53`{sZOJX1UPXe{77|tq<$0%
zOuF-y@*m_3e%rM1tVYe@xRqNfp{ke`C=CnAga#XL#a-Rdc@Uja8J+HZU})3SGy+}q+`HsA0$T#y$uI?a){
z0pRJKeio_d#m<+(XziC-@d-pHom_7vGH!}KgV8t
zyH4V+f0_I?{@nsECzt#4#>&=zYx6xOvY+k&wyei4^#1-{Qo{=riYPu^Iw!RVV~I9<
zc-(+nFZLYjG=kuAdDC#hR|{Nz-^4Nr7I+9%SBTc4Ph<3-dv-t$v>jXjkWk0|M~w}?
z%zYZ;U-iJ+r@-wkzf;
zwK1^YmkAu$c}Qs7`{l-(Z^>P_cw0rU+edkO{^3t|YSX8Ejv=NmHwrF|`)=RFUwd#;
zba4Bs67e4!>#w-sJUZ9*Yn#QPnlwDwM>=`oao;J?uBO}yPcpVdDi4RT_z_YL^Ral)
zW$n+b`GI$Y5yCR@0?9zu9An&^kp((2bNkx%V{BcTg#sM;_+Q5|)N%jGYWh5pQY2cl5nAULhZTg+31Cjl1)8z)}Fvcn@v`oLYe5i2X!-*&K2xq%h
zLR58>6Lpm@ZaXb5PfJ4JT^aqw^Wci=B;~t6q*#3-+(VZ`vBIlG6q(g5t~Oh>Vn>=%
zDDaX-IMOYZ6V1tcnX9-9i=I0UFWZl-T{20Vrz=qE;6uT)OSBn&_9S#=O42$}#B&}M
z3|Y}cCblZhFvs2YtEyB{h?ACCig9@eA-Cf!huRDWy@%wl@_U`6P~}-=RmwFf`r@9A
zyWsT_IQxJ!dZa^Z`$0?$&|5rKKl#LtUOsiJ?TKn&`;Tj-5)P~;
z(zJGjbYsl^fMhadm=db`VoN(S?pX5m!j{|`-u8I>jSkb%bb6+DNrz`_zV`zq^W1!0
zN?v<}uHuc#a&TN)RO;(l7iuzk+QS*7htB#$e~}e>B3pWjkmmuVAp}qV0GEDjFYU=a
zq6d-$XO>o%2r8+-k_Nu}6+EcPzpdTgwby7)t
z$0DsWh8K6*o>||Q!V$t6YH9m&^cB{W3i;LD__#hp#`lnUR}ZNVbTUZrok-ajBGme%
zw2)qQ(d$5UWGg2wNU1b_!e#VzF{Y|lNd0xo!kvs}v`g}XscPFC>8S+ZAme=bIS_~F
zOsuGTel4%Ve*QQg_KH`F!Igy1kw7Z;Aq1<6gZVC_(F)f=6K622*mLrDiRDzgiRfUD`#bg+9JG|u-q
z&zWS_S=6j+q?y({l~z7a>8_(!;;Mu?(!v@b3Pbjo-z*v#J%76M(lcGo`$;egjN^Us
z!`zQ6&ysJc_3BjU5Z2Al@)Mue>|}#cR|$glC3zh0a#rDVOnZ#2q4o|owg^^h+348j
z$ysR_oX5uwG5q@kb}Wx}Nd6e3WkMP}3qX=4pvr48vn(H3CXfml0MF+Yl+H|Da>t(a
zgIvpU*%0_JIPjaR>@2#Tp785cA3oj8HA-?9-a*fdbl2<~uk$&RRTP{C(sv7wsSJUf
zNMoo;$i;u~9xSQgT}jk%alT{k-w&5cH@?VQ=$RVN3%@NDZL`5ySfwmC2Oi`Xzb`2e-I(2cu~`
zu+VmmH~Ah5^glORk?AHKT8R{da}Dg*%)}(#0y_xw2WE2FU*pT*T}rJ!?l5!o
zHV3I^+q>^Y$bpmT6JS8}ba_L|5ET{-R>R3Bw4Jr+Ec1PHu(O_lgyFnD-nMAdHZHFU
zFLh68ijU{5uqiX8Xu;N#fA-)OE5i%visBo0GKN8iIK*20SAE>7cr|>cvQEUdQC{QVzB?R`>9MGa)r2L;
ziG%I;t>g{nP1usT=LvFb8eQLi%oAhgb7k52=dwwmlPd2p(DEP9!JRg31=_D
zGKf|mPZ-yZ*VZ7EBit%|gk!!M@SvF!!t>XiLX4dQjHdM;y0dnDbs+k4yJ)}u{A}A;`H(}G
z$(*3TZWvHwCKt+tukRE$>IR3vDBss1K@+jH33d~sF0-DcV3Lv{sLGH*wjCK*F%5pn9p>9%
zXY1qVnS5mQn8E%0ipkGgHkN4c+2+QHJ$jc()L?(bCn4m%N)~$Xe!JbA{p(r1*(fo#
zr3H~ypoho~s*7;cLYGI{rT9ERx5n`Jt>1X#Pf<-1f*Nn)741@;mabNFaFYBKu-JIb
zBPI2C%1+#Bj;zdgn-wqtr-Zq@rS%2c5y{m!BUl|jPl&R%bc|e$8|K;Y7WF%0q;aR6
z*0`T|W|gFL-bX{-hLlU+)85VBH41_=sIY_PG#zc8NcXUUGJp*OSE
z)}u+pPIy9ytcIeD7;>$xtI%Bq0Q7^Q7JhVeT1p%uJH6Q2KgWcheqCky^PagR<*r~z
z@`AQKpRUvGtQ&+(;uq2@NGSYeqBO=aVg8c%+~}QUO-vjAqPVUnwSR7T&}gPUludD$
z740}LIP7^i*QgNQWI%&_Sd7Uvr7lz#3x^Jf(oD)-B3F%^CFucftA(NpcP-x%NtV=j
zBAdi_Nkzul*Hd^+WZp;Cno^00B0pwF+tKyX?w;K`b{f$4Kogg!$(I?HF1G=X|G`9{
zx0~u!OJ`AL)v#;g8S?RjP1oQxqt4fCpl1mgFCbkLA0E6&3gP_m3w;S(5IkSE=}>ue
z=j)IL->MtnMtVt?BJ1U%b1<_+6`kc7d_2qN@1$C2l6Y!2N8|p!har(
zZc5#ofhRfg8=TAUn+&(b%xwY0rTvVCqlM8nu;dv5EBAPVf->Zq!U3|>a2>kME-}43
z6mJyW6)vwd3AujcD5V~gTz{MBl>%m^3{DyVGtwm<9Q)T{BGgP%2qC>VVkAIQWI=jg
zDKM1S{`{BP>l7>d#EL&
zlCOt5eZ!iRP;IkB4JTyJEUv6dh@Z(@HFHIFDHs;4Krv@+;S1(jmcv9|qrFgcB?^_4%qg)f2_*A{bbr{M&LEK7c*6ZAz(cGqN2IAGp%C6oGOS&+ypRu(
z3OFc;to%7|s%!>5Qwbu$&Q)54nMNl)TH+%V-d%V4Pw4PjMX{wna%tywUnL+80L>OK
z)l7DO`y-dVuzB3jyfUB9=dP^^fjpkQh>3xxVM?ScqP}MB0$FJw_bsUa0aeg<9oUH^
zTPikZdgD|#c`2kQ%N1STfJ?D@`xiasn^i&(CAXZ7beczq$L{Phm{|Vd-rbE%bI<>G
zQ`nh3p7k~*i@oYTBg#xa>_DAP%QkKCWsOY`1)yB0`UWt2d(!>up+7n5pHx2ok~9_e
zHp15tX7j|)X}0^PNhz7!)&B*0+Tr-kq{(e^DVH`rx<1ra*D>+>&*ZG7qRa|tcIt_r
zHf?ukwZhrgUjFr&*i@k%TARLIp83N`1DM>ni~f4)2yBM%J~qEebq$kk!EAGXXQ`N9
z3JHGBUN;{$pI}AR5Lcy)wN-x@Om%IAXR~Nuivhy3opb*+3S5uU+dcoc;PT#a^#XXr
zaee&+{+@fCZ^Iym``LXio%NRpK)3=h*7bX;+tQz$(Qsk@Q!Kjq(NDA6-Zq3110Ki4
zAJW94ZP4;!Uc-0Xob96JGs3-&n?2a5z=!)8PXcCkB@1!Wj@O0dp1d*
z_m}Fcv4CVI>o~qMWAf$X^@UL4&Ojewf%I97ni2oWPTRd?naEEv>=?y)McT*A7do!>X%<5)qX}9-DoJB)g
zEo8nh64{UBC}EV>y{qd*Sg)p+gcobak(#V
zX;{4Vn5*!V`0-!mi-mo^Y>)2Ede*F1jB#}G2i^dm*w4VtoP*NORZcJMdaT;#z%d>y
ze(oSKz4}pOgmY>_`S6FaM=im
zAP63VcML{$uBJ!_PlQh`5Zme`S{dy=z{1qp;Gb=_DLN|7E3r#{x=yF?8u_;y
z(8%3k7I;Az$7SBal+>T!5n4z})FS_HNhVj{2?@EoeNvV6ono>u9
z)R5fo#|v$uOqr^UR?N$uO1yV4@X6$PCE&fhAy7;Tr*qwtH=&$DuBjo&
zPAZ@u+54w)P{zO)O6jZ>QVX;ii4j$S@tt@^U65$0gW5?7grA;tTkD=JZnlh<{$^_J
zpseB43u8sA+RR4RzglY)R%=Jmad+S-@o6KoOMI^YVyDnCCso@@Y;#2#G;2nmN#T1A
z!A^22gwqb-A;IavijR=Sp=gPSJjXSs=vxW#(z3>c&f#OWgYb@74MYfwah8X;w7R>!
zuFuOoXt>z`ZFOWmr_*8BD^(V}7pL3q>&^;M*(^P?3OuAlJ!YQwpfM;%zE-PEpz74T
zwx~T10-!+xv5)~@OX$UZ6*mW&PnMaiD``Tp??smzB|1HITNjHeKJ)F*wrJ6D#|9?1
zouvr=h{&4KvqMDzUTbzxZR{bT&}05>6NxXuUyCC%5fxKaG{qtlyw5k+(fxDNXESEb
z)ss4dNnjb&ybvx?MW&hiA4gS=ED@gYB2>RHS1jL`zw_@gd~rwEj{X}D&M&sc!wp}r
zdd?O{!wsDFwsV?qseA=|^}l_=%fgIprOW5ARnBxeEITbB)_
zo9xX!0PE@p#4{fi@;wJ&*lZfA6Jk`#iuTQ2g!aY4tvU2pYw7KU?&26r>9{mj-e<{R
z(8{K^VJLaOEFo#32Sy3yO{|z98E7T#FL75s6vD**TEQ|>rtQnF;~t`DMdfg~6FWEZ
z;<)M~J3;xU?p=eGKvbpE@XnAZ9bxfGX*w(V2{FwTD{$6p0&|jA$yTrH)?wk3H(
zB##OwtcI#m@-Rcs>_e7fVH?o&ja7Nul8#zzsO8#eL#?1(-Ok(tWLL&6b~noe-4ki7
zb+--_Y$c=>BzTH#vUEpFNZx?2@F&9r2lupCx5t#p=8%MCfdi}1`ZE!09q$DjCMD96
zHR}3<;SKAZR}9qbSi&Fgc^6v|eq_F94@{DK
ziQuV&6a@FeQ=$UeB#E5Ll(r~O%Gyf!`uX+q1_OfhlL8<{zpuR}{XSCD%kiKpU^JwM
zSuvTRg$5+qpo7Ut8xklNasYE7Vgp9hdw~IXI$$?
z^+Ake?F6r7Glnh$R4piHz@JmsjH9#Knz)nAu!Lp411rRHMTC9xoRnC!af9DF+Ufts
zT?B1&*An;Y#8fmP9tHvSu*`9{oFD`=Iwxk2~z|sf9$!!ttb7#Cz
zxwn4LTOCD`?wj-W?V_LbMzYTKi<=-8m-qE;cHTghL;nX=9y#4X;;x2UN@>m{U=V=S
zPENxZyf(A3wT4U86xm^5s09KS6P?t#*<*XleAp7h@8up
zo|s$Jt(q(qlnYP;7Z{c%w*giEU=CFU@q9mOcFvUM14wr)z>Shq?S6Wp3Dy1r#tYaC
zxnwq?(rq)OCN+O>yX^N`Vq}BYR%M;i(UuB9-7nA#1Ay
zS6Q(-u0lvrZTuMSI#SU#^QJL1iK^(+Y_}$R_LGZeO51D|Mg4-ob7rXz^_W_%)xo)-
z;}?E@lHV}w{^Eq`cB+l5FBj0!Yn#=Htv-B`{o}&dn`1l6W=d8rsO*vzY8{9hq|bMi
zQUyG0uSU5(VXdptXwCQr5bOf(FzLq}ptasLd)^WRK^Qq=KFkv5#$h`hGbjxthayi|
zJv#u
zcX3o)5ky*yiz>zY{9UC^H$i|sPz?Amx3Yb~p>)lm-)5BLeNCA=6iu;^xZHI4bE46>
zJWWtDYvfIlc^Nu1X3ldiao`w2!XfC1A28$1
z_#|_(Ep>)Z$Af3qnK3?e`P;i@m{d${)|-wtt&{PP+P@uazYFPd!5#21&9sg`)pIU`
zHJ1kaEw9Tv*X4&?r#{|Ngdr({_(N#(l93x|O*RsAO$P|ffUk-GqT*o+2H353X`N~t
ze~m@F{TpU_C^cu=TVXfLZDk&j``$^hsQZ%}cl2x+s((vU?;*ytVBdv6IY6sutK4^-
z^q{;=-fv>7(A>%^`%#i)a-?i}IQpaT{8dcR6}h$v=w>;`?=P$>IudQ_UXeRZ8>!!R
z9HQ_o$038!mzPxw)oF<#A-ej5{59p77I}w%Sbi&e_uU&6`n|+GSL|zx=z>u4W!Kus
z=|1R*+dp4_r5a*{E;*TYy`TH#`b;U-GIsE%dk1pBa<4kN*9%d3@L2O%@LU9H-vQYL
z7Dq-?WhgzHR#>kj6Ry6sNb|bJX3HGLT=)zVw@3l5od7yYL_8d1di(zqa#Hr0|AeIm
z`Hz;sAyYGjm9V%Sfrnx|dTkczhe|anUj!zMLjs23Hc>fd`~}S2Sfz1;A>Ii4QFN=X
zo9vi8%RD7!MqJ%M+Xv2%E@z_>Q<5rmsqo-B1hZ>{n~)&_rhZ|7%6{e5pf
zEZA)=pVAor(QPgE&o8<+U`@ITxR4?(Imzyv0|P*xLYp-i{WwiNlw*^7