diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn index c7880180f3..2794193b88 100644 --- a/.acrolinx-config.edn +++ b/.acrolinx-config.edn @@ -2,40 +2,32 @@ :allowed-branchname-matches ["main" "release-.*"] :allowed-filename-matches ["windows/"] - :targets + :use-gh-statuses true + + :targets { :counts { - ;;:correctness 13 - ;;:total 15 ;; absolute flag count but i don't know the difference between this and issues - ;;:issues 15 ;; coming from the platform, will need to be tested. + ;;:correctness 13 + ;;:total 15 ;; + ;;:issues 15 ;; + ;;:correctness 13 ;; } :scores { ;;:terminology 100 - :qualityscore 80 ;; Confirmed with Hugo that you just comment out the single score and leave the structure in place + :qualityscore 80 ;; ;;:correctness 40 } } :guidance-profile "d2b6c2c8-00ee-47f1-8d10-b280cc3434c1" ;; Profile ID for "M365-specific" - :acrolinx-check-settings - { - "languageId" "en" - "ruleSetName" "Standard" - "requestedFlagTypes" ["CORRECTNESS" "SPELLING" "GRAMMAR" "STYLE" - "TERMINOLOGY_DEPRECATED" - "TERMINOLOGY_VALID" - "VOICE_GUIDANCE" - ] - "termSetNames" ["M365" "Products" "Microsoft"] - } - :template-header " -## Acrolinx Scorecards + +## Acrolinx Scorecards -**The minimum Acrolinx topic score of 80 is required for all MAGIC content merged to the default branch.** +**The minimum Acrolinx topic score of 80 is required for all Magic content merged to the default branch.** If you need a scoring exception for content in this PR, add the *Sign off* and the *Acrolinx exception* labels to the PR. The PubOps Team will review the exception request and may take one or more of the following actions: @@ -43,22 +35,26 @@ If you need a scoring exception for content in this PR, add the *Sign off* and t - Escalate the exception request to the Acrolinx Review Team for review. - Approve the exception and work with the GitHub Admin Team to merge the PR to the default branch. -For more information about the exception criteria and exception process, see [Minimum Acrolinx topic scores for publishing](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-min-score?branch=master). +For more information about the exception criteria and exception process, see [Minimum Acrolinx topic scores for publishing](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-min-score?branch=main). -Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology: +Select the total score link to review all feedback on clarity, consistency, tone, brand, terms, spelling, grammar, readability, and inclusive language. _You should fix all spelling errors regardless of your total score_. Fixing spelling errors helps maintain customer trust in overall content quality. -| Article | Score | Issues | Correctness
score | Scorecard | Processed | -| ------- | ----- | ------ | ------ | --------- | --------- | +| Article | Total score
(Required: 80) | Words + phrases
(Brand, terms) | Correctness
(Spelling, grammar) | Clarity
(Readability) | +|---------|:--------------:|:--------------------:|:------:|:---------:| " :template-change - "| ${s/file} | ${acrolinx/qualityscore} | ${acrolinx/flags/issues} | ${acrolinx/scores/correctness} | [link](${acrolinx/scorecard}) | ${s/status} | + "| ${s/status} ${s/file} | [${acrolinx/qualityscore}](${acrolinx/scorecard}) | ${acrolinx/scores/words_and_phrases} | ${acrolinx/scores/correctness} | ${acrolinx/scores/clarity} | " :template-footer " -**More info about Acrolinx** +**More information about Acrolinx** -Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see [Use the Visual Studio Code extension to run Acrolinx locally](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-vscode?branch=master). +- [Install Acrolinx locally for VSCode for Magic](https://review.docs.microsoft.com/office-authoring-guide/acrolinx-vscode?branch=main) +- [False positives or issues](https://aka.ms/acrolinxbug) +- [Request a new Acrolinx term](https://microsoft.sharepoint.com/teams/M365Dev2/SitePages/M365-terminology.aspx) +- [Troubleshooting issues with Acrolinx](https://review.docs.microsoft.com/help/contribute/acrolinx-error-messages) + " } diff --git a/windows/client-management/client-tools/add-remove-hide-features.md b/windows/client-management/client-tools/add-remove-hide-features.md index 6bcc413598..4fa8c60998 100644 --- a/windows/client-management/client-tools/add-remove-hide-features.md +++ b/windows/client-management/client-tools/add-remove-hide-features.md @@ -4,7 +4,7 @@ description: Learn how to add or remove Windows optional features using the Opti author: aczechowski ms.author: aaroncz manager: aaroncz -ms.date: 03/13/2024 +ms.date: 03/28/2024 ms.topic: how-to ms.service: windows-client ms.subservice: itpro-apps @@ -85,7 +85,7 @@ Once the **System > Optional features** pane is open, add a feature with the fol 1. Once all of the desired features are selected, select the **Next** button. - 1. Review the selected list of features and then select the **Install** button to add the selected features. + 1. Review the selected list of features and then select the **Add** button to add the selected features. ::: zone-end @@ -99,7 +99,7 @@ Once the **Optional features** pane is open, add a feature with the following st 1. Find the desired feature to add and then select the box next to the feature to add it. Multiple features can be selected. - 1. Once all of the desired features are selected, select the **Install** button. + 1. Once all of the desired features are selected, select the **Add** button. ::: zone-end @@ -115,7 +115,7 @@ Once the **System > Optional features** pane is open, remove a feature with the 1. Under **Installed features**, search for the feature that needs to be removed in the **Search installed features** search box, or scroll through the list of added features until the feature that needs to be removed is found. -1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Uninstall** button. +1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Remove** button. ::: zone-end @@ -125,7 +125,7 @@ Once the **Optional features** pane is open, remove a feature with the following 1. Under **Installed features**, search for the feature that needs to be removed in the **Find an installed optional feature** search box, or scroll through the list of added features until the feature that needs to be removed is found. -1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Uninstall** button. +1. Once the feature that needs to be removed is found, select the feature to expand it, and then select the **Remove** button. ::: zone-end diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 8608166976..2459acb9b0 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -3,7 +3,7 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: conceptual ms.subservice: windows-copilot -ms.date: 02/09/2024 +ms.date: 03/21/2024 ms.author: mstewart author: mestew appliesto: @@ -109,10 +109,12 @@ To verify that Copilot with commercial data protection is enabled for the user a 1. To verify that commercial data protection is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Copilot** is enabled for the user. -1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you'll find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes **Copilot**, and verify that it's listed as **On**. - - > [!Note] - > If you previously disabled Copilot with commercial data protection (formerly Bing Chat Enterprise) using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Copilot](/copilot/manage) for verifying that commercial data protection is enabled for your users. +1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you'll find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes **Copilot**, and verify that it's listed as **On**. If you previously disabled Copilot with commercial data protection (formerly Bing Chat Enterprise), see [Manage Copilot](/copilot/manage) for verifying that commercial data protection is enabled for your users. +1. Copilot with commercial data protection is used as the chat provider platform for users when the following conditions are met: + - Users have an eligible license, commercial data protection in Copilot is enabled, and the [Copilot in Windows user experience is enabled](#enable-the-copilot-in-windows-user-experience-for-windows-11-version-22h2-clients). + - Users are signed in with their Microsoft Entra ID (work accounts) + - Users can sign into Windows with their Microsoft Entra ID + - For Active Directory users on Windows 11, a Microsoft Entra ID in the Web Account Manager (WAM) authentication broker can be used. Entra IDs in Microsoft Edge profiles and Microsoft 365 Apps would both be in WAM. The following sample PowerShell script connects to Microsoft Graph and lists which users that have Copilot with commercial data protection enabled and disabled: diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 9d17406fe6..8af407de72 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -389,6 +389,13 @@ This policy controls the configuration under which winlogon sends MPR notificati +> [!NOTE] +> Starting in Windows Insiders build 25216, the behavior of EnableMPRNotifications policy was changed, and the Group Policy was updated with the following text: +> +> - **Friendly name**: Configure the transmission of the user's password in the content of MPR notifications sent by winlogon +> - **Description**: This policy controls whether the user's password is included in the content of MPR notifications sent by winlogon in the system. +> - If you disable this setting or do not configure it, winlogon sends MPR notifications with empty password fields of the user's authentication info. +> - If you enable this setting, winlogon sends MPR notifications containing the user's password in the authentication info. diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index 1df0f1e524..d4bcc4bdc1 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -19,7 +19,7 @@ The table below shows the applicability of Windows: The UnifiedWriteFilter (UWF) configuration service provider enables the IT administrator to remotely manage the UWF to help protect physical storage media including any writable storage type. -> **Note**  The UnifiedWriteFilter CSP is only supported in Windows 10 Enterprise and Windows 10 Education. +> **Note**  The UnifiedWriteFilter CSP is only supported in Windows 10/11 Enterprise and Windows 10/11 Education. The following example shows the UWF configuration service provider in tree format. ``` diff --git a/windows/deployment/do/mcc-isp-faq.yml b/windows/deployment/do/mcc-isp-faq.yml index 863ae62232..9f0d502be8 100644 --- a/windows/deployment/do/mcc-isp-faq.yml +++ b/windows/deployment/do/mcc-isp-faq.yml @@ -15,7 +15,7 @@ metadata: appliesto: - ✅ Windows 11 - ✅ Windows 10 - ms.date: 04/27/2023 + ms.date: 03/21/2024 title: Microsoft Connected Cache Frequently Asked Questions summary: | Frequently asked questions about Microsoft Connected Cache @@ -27,6 +27,8 @@ sections: answer: Yes. Microsoft Connected Cache is a free service. - question: What will Microsoft Connected Cache do for me? How will it impact our customers? answer: As an ISP, your network can benefit from reduced load on your backbone and improve customer download experience for supported Microsoft static content. It will also help you save on CDN costs. + - question: I already peer with Microsoft(8075). What benefit will I receive by adding Microsoft Connected Cache to my network? + answer: MCC complements peering by offloading static content that is served off of multiple CDNs such as Akamai, Lumen, Edgecast. Static content such as OS updates, Apps, Software installs etc. can't be served via 8075. So, even if you're peering with Microsoft, you can benefit from installing MCC. - question: Is there a non-disclosure agreement to sign? answer: No, a non-disclosure agreement isn't required. - question: What are the prerequisites and hardware requirements? @@ -40,29 +42,36 @@ sections: The following are recommended hardware configurations: - - [!INCLUDE [Microsoft Connected Cache Prerequisites](includes/mcc-prerequisites.md)] - + | Microsoft Connected Cache Machine Class | Scenario |Traffic Range| VM/Hardware Recommendation| + | -------- | -------- | -------- | -------- | + | Edge | For smaller ISPs or remote sites part of a larger network. |< 5 Gbps Peak| VM
Up to 8 cores

Up to 16-GB memory

1 500 GB SSD| + | Metro POP | For ISPs, IXs, or Transit Providers serving a moderate amount of traffic in a network that might require one of more cache nodes. |5 to 20 Gbps Peak| VM or hardware

16 cores*

32-GB memory

2 - 3 500-GB SSDs each| + |Data Center|For ISPs, IXs, or Transit Providers serving a large amount traffic daily and might require deployment of multiple cache nodes.|20 to 40 Gbps Peak| Hardware, see sample spec below:

32 or more cores*

64 or more GB memory

4 - 6 500 - 1-TB SSDs** each | + + *Requires systems (chipset, CPU, motherboard) with PCIe version 3, or higher. + + **Drive speeds are important and to achieve higher egress, we recommend SSD NVMe in m.2 PCIe slot (version 4, or higher). + We have one customer who is able to achieve mid-30s Gbps egress rate using the following hardware specification: - Dell PowerEdge R330 - 2 x Intel(R) Xeon(R) CPU E5-2630 v3 @ 2.40 GHz, total 32 core - 48 GB, Micron Technology 18ASF1G72PDZ-2G1A1, Speed: 2133 MT/s - 4 - Transcend SSD230s 1 TB SATA Drives Intel Corporation Ethernet 10G 2P X520 Adapter (Link Aggregated) - - question: Will I need to provide hardware BareMetal server or VM? - answer: Microsoft Connected Cache is a software-only caching solution and will require you to provide your own server to host the software. + - question: Do I need to provide hardware BareMetal server or VM? + answer: Microsoft Connected Cache is a software-only caching solution and requires you to provide your own server to host the software. - question: Can we use hard drives instead of SSDs? answer: We highly recommend using SSDs as Microsoft Connected Cache is a read intensive application. We also recommend using multiple drives to improve performance. - - question: Will I need to manually enter the CIDR blocks? If I have multiple cache nodes, should I configure a subset of CIDR blocks to each cache node? - answer: You can choose to route your traffic using manual CIDR blocks or BGP. If you have multiple Microsoft Connected Cache(s), you can allocate subsets of CIDR blocks to each cache node if you wish. However, since Microsoft Connected Cache has automatic load balancing, we recommend adding all of your traffic to all of your cache nodes. + - question: Do I need to manually enter the CIDR blocks? If I have multiple cache nodes, should I configure a subset of CIDR blocks to each cache node? + answer: You can choose to route your traffic using manual CIDR blocks or BGP. If you have multiple Microsoft Connected Caches, you can allocate subsets of CIDR blocks to each cache node if you wish. However, since Microsoft Connected Cache has automatic load balancing, we recommend adding all of your traffic to all of your cache nodes. - question: Should I add any load balancing mechanism? - answer: You don't need to add any load balancing. Our service will take care of routing traffic if you have multiple cache nodes serving the same CIDR blocks based on the reported health of the cache node. - - question: How many Microsoft Connected Cache instances will I need? How do we set up if we support multiple countries or regions? - answer: As stated in the table above, the recommended configuration will achieve near the maximum possible egress of 40 Gbps with a two-port link aggregated NIC and four cache drives. We have a feature coming soon that will help you estimate the number of cache nodes needed. If your ISP spans multiple countries or regions, you can set up separate cache nodes per country or region. + answer: You don't need to add any load balancing. Our service takes care of routing traffic if you have multiple cache nodes serving the same CIDR blocks based on the reported health of the cache node. + - question: How many Microsoft Connected Cache instances do I need? How do we set up if we support multiple countries or regions? + answer: As stated in the recommended hardware table, the recommended configuration achieves near the maximum possible egress of 40 Gbps with a two-port link aggregated NIC and four cache drives. We have a feature coming soon that helps you estimate the number of cache nodes needed. If your ISP spans multiple countries or regions, you can set up separate cache nodes per country or region. - question: Where should we install Microsoft Connected Cache? answer: You are in control of your hardware and you can pick the location based on your traffic and end customers. You can choose the location where you have your routers or where you have dense traffic or any other parameters. - question: How long would a piece of content live within the Microsoft Connected Cache? Is content purged from the cache? - answer: Once a request for said content is made, NGINX will look at the cache control headers from the original acquisition. If that content has expired, NGINX will continue to serve the stale content while it's downloading the new content. We cache the content for 30 days. The content will be in the hot cache path (open handles and such) for 24 hrs, but will reside on disk for 30 days. The drive fills up and nginx will start to delete content based on its own algorithm, probably some combination of least recently used. + answer: Once a request for said content is made, NGINX looks at the cache control headers from the original acquisition. If that content is expired, NGINX continues to serve the stale content while it's downloading the new content. We cache the content for 30 days. The content will be in the hot cache path (open handles and such) for 24 hrs, but will reside on disk for 30 days. The drive fills up and nginx will start to delete content based on its own algorithm, probably some combination of least recently used. - question: What content is cached by Microsoft Connected Cache? answer: For more information about content cached, see [Delivery Optimization and Microsoft Connected Cache content endpoints - Windows Deployment](delivery-optimization-endpoints.md). - question: Does Microsoft Connected Cache support Xbox or Teams content? @@ -73,9 +82,9 @@ sections: answer: We have already successfully onboarded ISPs in many countries and regions around the world and have received positive feedback! However, you can always start off with a portion of your CIDR blocks to test out the performance of MCC before expanding to more customers. - question: How does Microsoft Connected Cache populate its content? answer: Microsoft Connected Cache is a cold cache warmed by client requests. The client requests content and that is what fills up the cache. There's no off-peak cache fill necessary. Microsoft Connected Cache will reach out to different CDN providers just like a client device would. The traffic flow from Microsoft Connected Cache will vary depending on how you currently transit to each of these CDN providers. The content can come from third party CDNs or from AFD. - - question: What CDNs will Microsoft Connected Cache pull content from? + - question: What CDNs does Microsoft Connected Cache pull content from? answer: | - Microsoft relies on a dynamic mix of 1st and 3rd party CDN providers to ensure enough capacity, redundancy, and performance for the delivery of Microsoft served content. Though we don't provide lists of the CDN vendors we utilize as they can change without notice, our endpoints are public knowledge. If someone were to perform a series of DNS lookups against our endpoints (tlu.dl.delivery.mp.microsoft.com for example), they would be able to determine which CDN or CDNs were in rotation at a given point in time: + Microsoft relies on a dynamic mix of 1st and 3rd party CDN providers to ensure enough capacity, redundancy, and performance for the delivery of Microsoft served content. Though we don't provide lists of the CDN vendors we utilize as they can change without notice, our endpoints are public knowledge. If someone were to perform a series of DNS lookups against our endpoints (tlu.dl.delivery.mp.microsoft.com for example), they would be able to determine which CDN or CDNs were in rotation at a given point in time: $ dig +noall +answer tlu.dl.delivery.mp.microsoft.com | grep -P "IN\tA" @@ -84,13 +93,13 @@ sections: $ whois 13.107.4.50|grep "Organization:" Organization: Microsoft Corporation (MSFT) - - question: I'm a network service provider and have downstream transit customers. If one of my downstream transit customers onboards to Microsoft Connected Cache, how will it affect my traffic? + - question: I'm a network service provider and have downstream transit customers. If one of my downstream transit customers onboards to Microsoft Connected Cache, how does it affect my traffic? answer: If a downstream customer deploys a Microsoft Connected Cache node, the cache controller will prefer the downstream ASN when handling that ASN's traffic. - question: I signed up for Microsoft Connected Cache, but I'm not receiving the verification email. What should I do? - answer: First, check that the email under the NOC role is correct in your PeeringDB page. If the email associated with NOC role is correct, search for an email from the sender "microsoft-noreply@microsoft.com" with the email subject - "Here's your Microsoft Connected Cache verification code" in your Spam folders. Still can't find it? Ensure that your email admin rules allow emails from the sender "microsoft-noreply@microsoft.com". + answer: First, check that the email under the NOC role is correct in your PeeringDB page. If the email associated with NOC role is correct, search for an email from the sender "microsoft-noreply@microsoft.com" with the email subject - "Here's your Microsoft Connected Cache verification code" in your Spam folders. Still can't find it? Ensure that your email admin rules allow emails from the sender `microsoft-noreply@microsoft.com`. - question: I noticed I can set up BGP for routing. How does BGP routing work for Microsoft Connected Cache? answer: BGP routing can be set up as an automatic method of routing traffic. To learn more about how BGP is used with Microsoft Connected Cache, see [BGP Routing](mcc-isp-create-provision-deploy.md#bgp-routing). - question: I have an active MCC, but I'm noticing I hit the message limit for my IoT Hub each day. Does this affect my MCC performance and should I be concerned? - answer: Even when the quota of 8k messages is hit, the MCC functionality won't be affected. Your client devices will continue to download content as normal. You'll also not be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the early preview and isn't an issue during public preview. + answer: Even when the quota of 8k messages is hit, the MCC functionality isn't affected. Your client devices continue to download content as normal. You also won't be charged above the 8k message limit, so you don't need to worry at all about getting a paid plan. MCC will always be a free service. So if functionality isn't impacted, what is? Instead, messages about the configuration or edge deployment would be impacted. This means that if there was a request to update your MCC and the daily quota was reached, your MCC might not update. In that case, you would just need to wait for the next day to update. This is only a limitation of the early preview and isn't an issue during public preview. - question: What do I do if I need more support and have more questions even after reading this FAQ page? answer: For further support for Microsoft Connected Cache, visit [Troubleshooting Issues for Microsoft Connected Cache for ISP (public preview)](mcc-isp-support.md). diff --git a/windows/deployment/do/mcc-isp-overview.md b/windows/deployment/do/mcc-isp-overview.md index 60b248f3ae..e3474b59cb 100644 --- a/windows/deployment/do/mcc-isp-overview.md +++ b/windows/deployment/do/mcc-isp-overview.md @@ -13,7 +13,7 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Microsoft Connected Cache for ISPs -ms.date: 07/27/2023 +ms.date: 03/21/2024 --- # Microsoft Connected Cache for ISPs overview @@ -37,10 +37,15 @@ Microsoft Connected Cache uses Delivery Optimization as the backbone for Microso - Endpoint protection: Windows Defender definition updates - Xbox: Xbox Game Pass (PC only) -Do you peer with [Microsoft (ASN 8075)](/azure/internet-peering/)? Microsoft Connected Cache complements peering by offloading static content that is served off of multiple CDNs such as Akamai, Lumen, and Edgecast. Microsoft Peering mainly caches dynamic content - by onboarding to Microsoft Connected Cache, you'll cache static content that otherwise would be served from the CDN. - For the full list of content endpoints that Microsoft Connected Cache for ISPs supports, see [Microsoft Connected Cache content and services endpoints](delivery-optimization-endpoints.md). +### Are you already peering with 8075? + +MCC complements peering by offloading static content that is served off of multiple CDNs such as Akamai, Lumen, Edgecast. Static content such as OS updates, Apps, Software installs etc. can't be served via 8075. So, even if you're peering with Microsoft, you can benefit from installing MCC. + +:::image type="content" source="./media/mcc-isp-overview/mcc-isp-peeringvsmcc.png" alt-text="Chart containing Peering vs Cache Content Traffic." lightbox="./media/mcc-isp-overview/mcc-isp-peeringvsmcc.png"::: + + ## How MCC works :::image type="content" source="./images/mcc-isp-diagram.png" alt-text="Data flow diagram of how Microsoft Connected Cache works." lightbox="./images/mcc-isp-diagram.png"::: @@ -71,3 +76,18 @@ The following steps describe how MCC is provisioned and used: 1. Subsequent requests from end-user devices for content will be served from cache. 1. If the MCC node is unavailable, the client gets content from the CDN to ensure uninterrupted service for your subscribers. + +### Hardware recommendation + +The following are recommended hardware configurations based on traffic ranges: + +| Microsoft Connected Cache Machine Class | Scenario |Traffic Range| VM/Hardware Recommendation| +| -------- | -------- | -------- | -------- | +| Edge | For smaller ISPs or remote sites part of a larger network. |< 5 Gbps Peak| **VM**

Up to 8 cores

Up to 16-GB memory

1 500 GB SSD| +| Metro POP | For ISPs, IXs, or Transit Providers serving a moderate amount of traffic in a network that might require one of more cache nodes. |5 to 20 Gbps Peak| **VM or hardware**

16 cores*

32-GB memory

2 - 3 500-GB SSDs each| +|Data Center|For ISPs, IXs, or Transit Providers serving a large amount traffic daily and might require deployment of multiple cache nodes.|20 to 40 Gbps Peak| **Hardware**, see sample spec below:

32 or more cores*

64 or more GB memory

4 - 6 500 - 1-TB SSDs** each | + +*Requires systems (chipset, CPU, motherboard) with PCIe version 3, or higher. + +**Drive speeds are important and to achieve higher egress, we recommend SSD NVMe in m.2 PCIe slot (version 4, or higher). + diff --git a/windows/deployment/do/media/mcc-isp-overview/mcc-isp-peeringvsmcc.png b/windows/deployment/do/media/mcc-isp-overview/mcc-isp-peeringvsmcc.png new file mode 100644 index 0000000000..de0852f52e Binary files /dev/null and b/windows/deployment/do/media/mcc-isp-overview/mcc-isp-peeringvsmcc.png differ diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md index b7245596bf..f0938f7fd7 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md @@ -80,10 +80,6 @@ To be eligible for Windows Autopatch management, devices must meet a minimum set - Device configuration - Office Click-to-run - Last Intune device check in completed within the last 28 days. -- Devices must have Serial Number, Model and Manufacturer. - -> [!NOTE] -> Windows Autopatch doesn't support device emulators that don't generate the serial number, model and manufacturer information. Devices that use a non-supported device emulator fail the **Intune or Cloud-Attached** prerequisite check. > [!IMPORTANT] > Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC. diff --git a/windows/deployment/windows-missing-fonts.md b/windows/deployment/windows-missing-fonts.md index d98de67b71..6cee49fa4f 100644 --- a/windows/deployment/windows-missing-fonts.md +++ b/windows/deployment/windows-missing-fonts.md @@ -7,7 +7,7 @@ author: frankroj ms.author: frankroj manager: aaroncz ms.topic: article -ms.date: 03/13/2024 +ms.date: 03/28/2024 ms.subservice: itpro-deploy zone_pivot_groups: windows-versions-11-10 appliesto: @@ -131,7 +131,7 @@ Once the **Language** pane is open, add the fonts associated with a language and 1. Drop down the menu below **Windows display language** to show all of the languages currently added to the device. -1. If the desired language isn't listed, add the fonts for the desired language by selecting the **+** button next to **Add a language**. +1. If the desired language isn't listed, add the fonts for the desired language by selecting the **+** button next to **Add a language** in the **Preferred languages** section. 1. In the **Choose a language to install** window that opens: @@ -203,7 +203,7 @@ Once the **System > Optional features** pane is open, add a supplemental font wi 1. Once all of the desired supplemental fonts are selected, select the **Next** button. - 1. Review the selected list of features and then select the **Install** button to add the selected features. + 1. Review the selected list of features and then select the **Add** button to add the selected features. ::: zone-end @@ -227,7 +227,7 @@ Once the **Optional features** pane is open, add a supplemental font with the fo 1. Find the desired supplemental font to add and then select the box next to the supplemental font to add it. Multiple supplemental fonts can be selected. - 1. Once all of the desired supplemental fonts are selected, select the **Install** button. + 1. Once all of the desired supplemental fonts are selected, select the **Add** button. ::: zone-end diff --git a/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md index f268f032bb..05fed4e21e 100644 --- a/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md +++ b/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md @@ -5,36 +5,34 @@ ms.localizationpriority: medium author: vinaypamnani-msft ms.author: vinpa manager: aaroncz -ms.date: 03/16/2023 +ms.date: 03/26/2024 ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Windows Defender Application Control and virtualization-based protection of code integrity -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and higher - -Windows includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they behave more like mobile devices. In this configuration, [**Windows Defender Application Control (WDAC)**](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) is used to restrict devices to run only approved apps, while the OS is hardened against kernel memory attacks using [**memory integrity**](../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md). +Windows includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they behave more like kiosk devices. In this configuration, [**Windows Defender Application Control (WDAC)**](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) is used to restrict devices to run only approved apps, while the OS is hardened against kernel memory attacks using [**memory integrity**](../../hardware-security/enable-virtualization-based-protection-of-code-integrity.md). > [!NOTE] > Memory integrity is sometimes referred to as *hypervisor-protected code integrity (HVCI)* or *hypervisor enforced code integrity*, and was originally released as part of *Device Guard*. Device Guard is no longer used except to locate memory integrity and VBS settings in Group Policy or the Windows registry. -WDAC policies and memory integrity are powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a strong protection capability for Windows devices. - -Using WDAC to restrict devices to only authorized apps has these advantages over other solutions: +WDAC policies and memory integrity are powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a strong protection capability for Windows devices. Using WDAC to restrict devices to only authorized apps has these advantages over other solutions: 1. The Windows kernel handles enforcement of WDAC policy and requires no other services or agents. -2. The WDAC policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run. -3. WDAC lets you set application control policy for any code that runs on Windows, including kernel mode drivers and even code that runs as part of Windows. -4. Customers can protect the WDAC policy even from local administrator tampering by digitally signing the policy. Changing signed policy requires both administrative privilege and access to the organization's digital signing process. Using signed policies makes it difficult for an attacker, including one who has managed to gain administrative privilege, to tamper with WDAC policy. -5. You can protect the entire WDAC enforcement mechanism with memory integrity. Even if a vulnerability exists in kernel mode code, memory integrity greatly reduces the likelihood that an attacker could successfully exploit it. Without memory integrity, an attacker who compromises the kernel could normally disable most system defenses, including application control policies enforced by WDAC or any other application control solution. +1. The WDAC policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run. +1. WDAC lets you set application control policy for any code that runs on Windows, including kernel mode drivers and even code that runs as part of Windows. +1. Customers can protect the WDAC policy even from local administrator tampering by digitally signing the policy. Changing signed policy requires both administrative privilege and access to the organization's digital signing process. Using signed policies makes it difficult for an attacker, including one who manages to gain administrative privilege, to tamper with WDAC policy. +1. You can protect the entire WDAC enforcement mechanism with memory integrity. Even if a vulnerability exists in kernel mode code, memory integrity greatly reduces the likelihood that an attacker could successfully exploit it. Without memory integrity, an attacker who compromises the kernel could normally disable most system defenses, including application control policies enforced by WDAC or any other application control solution. There are no direct dependencies between WDAC and memory integrity. You can deploy them individually or together and there's no order in which they must be deployed. -Memory integrity relies on Windows virtualization-based security, and has hardware, firmware, and kernel driver compatibility requirements that some older systems can't meet. +Memory integrity relies on Windows Virtualization-based security, and has hardware, firmware, and kernel driver compatibility requirements that some older systems can't meet. WDAC has no specific hardware or software requirements. diff --git a/windows/security/application-security/application-control/user-account-control/how-it-works.md b/windows/security/application-security/application-control/user-account-control/how-it-works.md index 27338890ca..628efba7cf 100644 --- a/windows/security/application-security/application-control/user-account-control/how-it-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-it-works.md @@ -1,8 +1,8 @@ --- -title: How User Account Control works +title: How User Account Control works description: Learn about User Account Control (UAC) components and how it interacts with the end users. ms.topic: concept-article -ms.date: 05/24/2023 +ms.date: 03/26/2024 --- # How User Account Control works @@ -26,7 +26,7 @@ To better understand how this process works, let's take a closer look at the Win The following diagram shows how the sign in process for an administrator differs from the sign in process for a standard user. -:::image type="content" source="images/uac-windows-logon-process.gif" alt-text="Diagram that describes the UAC Windows logon process."::: +:::image type="content" source="images/uac-windows-logon-process.gif" alt-text="Diagram that describes the UAC Windows sign-in process."::: By default, both standard and administrator users access resources and execute apps in the security context of a standard user.\ When a user signs in, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. @@ -91,9 +91,9 @@ The elevation process is further secured by directing the prompt to the *secure When an executable file requests elevation, the *interactive desktop*, also called the *user desktop*, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user selects **Yes** or **No**, the desktop switches back to the user desktop. > [!NOTE] -> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This is the same behavior of the currently supported Windows client OS versions. +> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This is the same behavior of the currently supported Windows client OS versions. -Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware doesn't gain elevation if the user selects **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt may be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. +Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware doesn't gain elevation if the user selects **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. While malware could present an imitation of the secure desktop, this issue can't occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token can't silently install when UAC is enabled, the user must explicitly provide consent by selecting **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon security policies. @@ -109,34 +109,34 @@ To better understand each component, review the following tables: |Component|Description| |--- |--- | -|

User performs operation requiring privilege|

If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.| -|

ShellExecute|

ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.| -|

CreateProcess|

If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.| +|User performs operation requiring privilege|If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.| +|ShellExecute|ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.| +|CreateProcess|If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.| ### System |Component|Description| |--- |--- | -|

Application Information service|

A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required. Depending on the configured policies, the user may give consent.| -|

Elevating an ActiveX install|

If ActiveX isn't installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.| -|

Check UAC slider level|

UAC has a slider to select from four levels of notification.