diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 2358d61c40..e06f28392e 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -9,7 +9,7 @@ "build_output_subfolder": "education", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -20,7 +20,7 @@ "build_output_subfolder": "browsers/internet-explorer", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -45,7 +45,7 @@ "build_output_subfolder": "mdop", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -56,7 +56,7 @@ "build_output_subfolder": "browsers/edge", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -67,7 +67,7 @@ "build_output_subfolder": "devices/surface", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -78,7 +78,7 @@ "build_output_subfolder": "devices/surface-hub", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -89,7 +89,7 @@ "build_output_subfolder": "windows", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -101,7 +101,8 @@ "branches_to_filter": [ "" ], - "git_repository_url_open_to_public_contributors": "", + "git_repository_url_open_to_public_contributors": "https://github.com/Microsoft/windows-itpro-docs", + "git_repository_branch_open_to_public_contributors": "master", "skip_source_output_uploading": false, "dependent_repositories": [] -} +} \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000000..7a759f8ecb --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,92 @@ +# Contributing to Windows IT professional documentation + +Thank you for your interest in the Windows IT professional documentation! We appreciate your feedback, edits, and additions to our docs. +This page covers the basic steps for contributing to our technical documentation. + +## Sign a CLA + +All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before contributing to any Microsoft repositories. +If you've already contributed to Microsoft repositories in the past, congratulations! +You've already completed this step. + +## Editing topics + +We've tried to make editing an existing, public file as simple as possible. + +>**Note**
+>At this time, only the English (en-us) content is available for editing. + +**To edit a topic** + +1. Go to the page on TechNet that you want to update, and then click **Contribute**. + + ![GitHub Web, showing the Contribute link](images/contribute-link.png) + +2. Log into (or sign up for) a GitHub account. + + You must have a GitHub account to get to the page that lets you edit a topic. + +3. Click the **Pencil** icon (in the red box) to edit the content. + + ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + +4. Using markdown language, make your changes to the topic. For info about how to edit content using markdown, see: + - **If you're linked to the Microsoft organization in GitHub:** [Windows Open Publishing Guide Home](http://aka.ms/windows-op-guide) + + - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) + +5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. + + ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + +6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. + + ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + + The **Comparing changes** screen appears to see what the changes are between your fork and the original content. + +7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. + + If there are no problems, you’ll see the message, **Able to merge**. + + ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + +8. Click **Create pull request**. + +9. Enter a title and description to give the approver the appropriate context about what’s in the request. + +10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. + +11. Click **Create pull request** again to actually submit the pull request. + + The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places: + + - [Windows 10](https://technet.microsoft.com/itpro/windows) + - [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) + - [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) + - [Surface](https://technet.microsoft.com/itpro/surface) + - [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) + - [Windows 10 for Education](https://technet.microsoft.com/edu/windows) + - [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) + +## Making more substantial changes + +To make substantial changes to an existing article, add or change images, or contribute a new article, you will need to create a local clone of the content. +For info about creating a fork or clone, see the GitHub help topic, [Fork a Repo](https://help.github.com/articles/fork-a-repo/). + +Fork the official repo into your personal GitHub account, and then clone the fork down to your local device. Work locally, then push your changes back into your fork. Then open a pull request back to the master branch of the official repo. + +## Using issues to provide feedback on documentation + +If you just want to provide feedback rather than directly modifying actual documentation pages, you can create an issue in the repository. + +At the top of a topic page you'll see an **Issues** tab. Click the tab and then click the **New issue** button. + +Be sure to include the topic title and the URL for the page you're submitting the issue for, if that page is different from the page you launched the **New issue** dialog from. + +## Resources + +You can use your favorite text editor to edit Markdown. We recommend [Visual Studio Code](https://code.visualstudio.com/), a free lightweight open source editor from Microsoft. + +You can learn the basics of Markdown in just a few minutes. To get started, check out [Mastering Markdown](https://guides.github.com/features/mastering-markdown/). + diff --git a/README.md b/README.md index f5b28b423b..fa13a55593 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,20 @@ -# win-cpub-itpro-docs -This repo hosts the WDG ITPro content that is published to TechNet. +# Windows IT professional documentation + +Welcome! This repository houses the docs that are written for IT professionals for the following products: + +- [Windows 10](https://technet.microsoft.com/itpro/windows) +- [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) +- [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) +- [Surface](https://technet.microsoft.com/itpro/surface) +- [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) +- [Windows 10 for Education](https://technet.microsoft.com/edu/windows) +- [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) + +## Contributing + +We actively merge contributions into this repository via [pull request](https://help.github.com/articles/using-pull-requests/) into the *master* branch. +If you are not a Microsoft employee, before you submit a pull request you must [sign a Contribution License Agreement](https://cla.microsoft.com/) to ensure that the community is free to use your submissions. +For more information on contributing, read our [contributions guide](CONTRIBUTING.md). + This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. - -English Handoff Folder Structure Demo! diff --git a/browsers/edge/Index.md b/browsers/edge/Index.md index c15b35774b..29090e5faa 100644 --- a/browsers/edge/Index.md +++ b/browsers/edge/Index.md @@ -6,6 +6,7 @@ ms.prod: edge ms.mktglfcycl: general ms.sitesec: library title: Microsoft Edge - Deployment Guide for IT Pros (Microsoft Edge for IT Pros) +localizationpriority: high --- # Microsoft Edge - Deployment Guide for IT Pros @@ -15,6 +16,8 @@ title: Microsoft Edge - Deployment Guide for IT Pros (Microsoft Edge for IT Pros - Windows 10 - Windows 10 Mobile +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge also introduces new features like Web Note, Reading View, and Cortana that you can use along with your normal web browsing abilities. Microsoft Edge lets you stay up-to-date through the Windows Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. @@ -47,11 +50,11 @@ However, if you're running web apps that continue to use: * legacy document modes -You'll need to keep running them using IE11. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](http://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can also use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. For info about Enterprise Mode and Edge, see [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md). +You'll need to keep running them using IE11. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can also use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. For info about Enterprise Mode and Edge, see [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md). ## Related topics -- [Download Internet Explorer 11](http://go.microsoft.com/fwlink/p/?linkid=290956) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](http://go.microsoft.com/fwlink/p/?LinkId=760644) -- [Internet Explorer 11 - FAQ for IT Pros](http://go.microsoft.com/fwlink/p/?LinkId=760645) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](http://go.microsoft.com/fwlink/p/?LinkId=760646) +- [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=290956) +- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760644) +- [Internet Explorer 11 - FAQ for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760645) +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](https://go.microsoft.com/fwlink/p/?LinkId=760646) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 22c69f91b8..c7e1e2fcd2 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -19,7 +19,7 @@ localizationpriority: high Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. -

**Note**
For more info about Group Policy, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](http://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](http://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](http://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows Powershell](http://go.microsoft.com/fwlink/p/?LinkId=617924). +

**Note**
For more info about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). This site provides links to the latest technical documentation, videos, and downloads for Group Policy. For more info about the tools you can use to change your Group Policy objects, see the Internet Explorer 11 topics, [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921), [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922), [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923), and [Group Policy and Windows Powershell](https://go.microsoft.com/fwlink/p/?LinkId=617924). ## Group Policy settings Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations: @@ -48,7 +48,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A |Show message when opening sites in Internet Explorer |Windows 10 Insider Preview |This policy setting lets you decide whether employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

If you enable this setting, employees see an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

If you disable or don’t configure this setting, the default app behavior occurs and no additional page appears. |**Enabled:** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11.

**Disabled or not configured (default):** Doesn’t show an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. | ## Using Microsoft Intune to manage your Mobile Data Management (MDM) settings for Microsoft Edge -If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( http://go.microsoft.com/fwlink/p/?LinkId=722885) page. +If you manage your policies using Intune, you'll want to use these MDM policy settings. You can see the full list of available policies, on the [Policy CSP]( https://go.microsoft.com/fwlink/p/?LinkId=722885) page.

**Note**
The **Supports** column uses these options: @@ -102,8 +102,8 @@ These are additional Windows 10-specific MDM policy settings that work with Mic |AllowSyncMySettings |Desktop |

| ## Related topics -* [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514) -* [Mobile Data Management (MDM) settings]( http://go.microsoft.com/fwlink/p/?LinkId=722885) +* [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514) +* [Mobile Data Management (MDM) settings]( https://go.microsoft.com/fwlink/p/?LinkId=722885)     diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index 1a8c85b533..4d6bfce510 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -19,7 +19,7 @@ localizationpriority: high If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11. Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. -

**Note**
If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy]( http://go.microsoft.com/fwlink/p/?LinkId=620714). +

**Note**
If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714). ## Fix specific websites @@ -27,7 +27,7 @@ Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScrip ![](images/wedge.gif) **To add sites to your list** -1. In the Enterprise Mode Site List Manager, click **Add**.

If you already have an existing site list, you can import it into the tool. After it's in the tool, the xml updates the list, checking **Open in IE** for each site. For info about importing the site list, see [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](http://go.microsoft.com/fwlink/p/?LinkId=618322).

![Enterprise Mode Site List Manager with Open in IE box](images/emie_open_in_ie.png) +1. In the Enterprise Mode Site List Manager, click **Add**.

If you already have an existing site list, you can import it into the tool. After it's in the tool, the xml updates the list, checking **Open in IE** for each site. For info about importing the site list, see [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](https://go.microsoft.com/fwlink/p/?LinkId=618322).

![Enterprise Mode Site List Manager with Open in IE box](images/emie_open_in_ie.png) 2. Type or paste the URL for the website that’s experiencing compatibility problems, like *<domain>*.com or *<domain>*.com/*<path>* into the **URL** box.

You don’t need to include the `http://` or `https://` designation. The tool will automatically try both versions during validation. @@ -37,11 +37,11 @@ Microsoft Edge doesn't support ActiveX controls, Browser Helper Objects, VBScrip 5. Click **Save** to validate your website and to add it to the site list for your enterprise.

If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your Group Policy setting. For more info, see [Turn on Enterprise Mode and use a site list](http://go.microsoft.com/fwlink/p/?LinkId=618952). +6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your Group Policy setting. For more info, see [Turn on Enterprise Mode and use a site list](https://go.microsoft.com/fwlink/p/?LinkId=618952). ### Set up Microsoft Edge to use the Enterprise Mode site list -You must turn on the **Use Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](http://go.microsoft.com/fwlink/p/?linkid=618377). +You must turn on the **Use Enterprise Mode Site List** Group Policy setting before Microsoft Edge can use the Enterprise Mode site list. This Group Policy applies to both Microsoft Edge and IE11, letting Microsoft Edge switch to IE11 as needed, based on the Enterprise Mode site list. For more info about IE11 and Enterprise Mode, see [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). ![](images/wedge.gif) **To turn on Enterprise Mode using Group Policy** @@ -70,7 +70,7 @@ You must turn on the **Use Enterprise Mode Site List** Group Policy setting befo ## Fix your intranet sites You can add the **Send all intranet traffic over to Internet Explorer** Group Policy setting for Windows 10 so that all of your intranet sites open in IE11. This means that even if your employees are using Microsoft Edge, they will automatically switch to IE11 while viewing the intranet. -

**Note**
If you want to use Group Policy to set IE as the default browser for Internet sites, you can find the info here, [Set the default browser using Group Policy]( http://go.microsoft.com/fwlink/p/?LinkId=620714). +

**Note**
If you want to use Group Policy to set IE as the default browser for Internet sites, you can find the info here, [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714). ![](images/wedge.gif) **To turn on Sends all intranet traffic over to Internet Explorer using Group Policy** @@ -81,11 +81,11 @@ You can add the **Send all intranet traffic over to Internet Explorer** Group Po 3. Refresh your policy in your organization and then view the affected sites in Microsoft Edge.

The site shows a message in Microsoft Edge, saying that the page needs IE. At the same time, the page opens in IE11; in a new frame if it's not yet running, or in a new tab if it is. ## Related topics -* [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](http://go.microsoft.com/fwlink/p/?LinkID=624035) -* [Enterprise Mode Site List Manager for Windows 7 and Windows 8.1 download](http://go.microsoft.com/fwlink/p/?LinkId=394378) -* [Enterprise Mode Site List Manager for Windows 10 download](http://go.microsoft.com/fwlink/?LinkId=746562) -* [Enterprise Mode for Internet Explorer 11 (IE11)](http://go.microsoft.com/fwlink/p/?linkid=618377) -* [Set the default browser using Group Policy]( http://go.microsoft.com/fwlink/p/?LinkId=620714) +* [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035) +* [Enterprise Mode Site List Manager for Windows 7 and Windows 8.1 download](https://go.microsoft.com/fwlink/p/?LinkId=394378) +* [Enterprise Mode Site List Manager for Windows 10 download](https://go.microsoft.com/fwlink/?LinkId=746562) +* [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377) +* [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714)     diff --git a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md index 436053d3ec..a3dcf46f40 100644 --- a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md +++ b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md @@ -21,7 +21,7 @@ localizationpriority: high - Windows 10 ## Enterprise guidance -Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](http://go.microsoft.com/fwlink/p/?linkid=290956). +Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10. diff --git a/browsers/edge/hardware-and-software-requirements.md b/browsers/edge/hardware-and-software-requirements.md index 2c56db269a..d423c37bd4 100644 --- a/browsers/edge/hardware-and-software-requirements.md +++ b/browsers/edge/hardware-and-software-requirements.md @@ -29,7 +29,7 @@ Some of the components in this table might also need additional system resources | Item | Minimum requirements | | ------------------ | -------------------------------------------- | | Computer/processor | 1 gigahertz (GHz) or faster (32-bit (x86) or 64-bit (x64)) | -| Operating system |

**Note**
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](http://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | +| Operating system |

**Note**
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | | Memory |

| | Hard drive space | | | DVD drive | DVD-ROM drive (if installing from a DVD-ROM) | diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index b0ec9a4b4f..f55624a429 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -23,23 +23,23 @@ ###[What is Enterprise Mode?](ie11-deploy-guide/what-is-enterprise-mode.md) ###[Set up Enterprise Mode logging and data collection](ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md) ###[Turn on Enterprise Mode and use a site list](ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md) -###[Enterprise Mode schema v.2 guidance for Windows 10 devices](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) -###[Enterprise Mode schema v.1 guidance for Windows 7 and Windows 8.1 devices](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) +###[Enterprise Mode schema v.2 guidance](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) +###[Enterprise Mode schema v.1 guidance](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) ###[Check for a new Enterprise Mode site list xml file](ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md) ###[Turn on local control and logging for Enterprise Mode](ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md) -###[Use the Enterprise Mode Site List Manager tool](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) -####[Add sites to the Enterprise Mode site list using the Windows 10 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) -####[Add sites to the Enterprise Mode site list using the Windows 7 and Windows 8.1 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Windows 10 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and Windows 8.1 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager tool](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) -####[Fix validation problems using the Enterprise Mode Site List Manager tool](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) -####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Save your site list to XML in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) -####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager tool](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) -####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager tool](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) -####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +###[Use the Enterprise Mode Site List Manager](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) +####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) +####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) +####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) +####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) +####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) +####[Fix validation problems using the Enterprise Mode Site List Manager](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) +####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +####[Save your site list to XML in the Enterprise Mode Site List Manager](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) +####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) +####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) +####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) ###[Using IE7 Enterprise Mode or IE8 Enterprise Mode](ie11-deploy-guide/using-enterprise-mode.md) ###[Fix web compatibility issues using document modes and the Enterprise Mode site list](ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) ###[Remove sites from a local Enterprise Mode site list](ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md index 816aad03bb..11347ac764 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md @@ -35,7 +35,7 @@ You use the ActiveX Installer Service (AXIS) and Group Policy to manage your Act - **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. -For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](http://go.microsoft.com/fwlink/p/?LinkId=214503). +For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index 99717bb268..a923c7b2dd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -99,7 +99,7 @@ After you’ve added all of your sites to the tool and saved the file to XML, yo ## Related topics - [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)     diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index 886cbed096..4770a4ffb0 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -108,7 +108,7 @@ You can save the file locally or to a network share. However, you must make sure After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) - [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index 6ae191787f..7e8c3c6910 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -53,7 +53,7 @@ You can save the file locally or to a network share. However, you must make sure After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)     diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index 6f22bf4dfc..b18fa646cd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -69,7 +69,7 @@ You can save the file locally or to a network share. However, you must make sure After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853)     diff --git a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md index 1774c25fd3..137b689b2f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md @@ -23,7 +23,7 @@ Administrative Templates are made up of a hierarchy of policy categories and sub - Text explanations about each setting and the supported version of Internet Explorer. -For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](http://go.microsoft.com/fwlink/p/?LinkId=214519). +For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). ## What are Administrative Templates? Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: @@ -34,7 +34,7 @@ Administrative Templates are XML-based, multi-language files that define the reg ## How do I store Administrative Templates? As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). -

**Important**
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see [Scenario 1: Editing the Local GPO Using ADMX Files](http://go.microsoft.com/fwlink/p/?LinkId=276810). +

**Important**
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see [Scenario 1: Editing the Local GPO Using ADMX Files](https://go.microsoft.com/fwlink/p/?LinkId=276810). ## Administrative Templates-related Group Policy settings When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. @@ -68,11 +68,11 @@ IE11 provides these new policy settings, which are editable in the Local Group P ## Editing Group Policy settings Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: -- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](http://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. +- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. -- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](http://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. +- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. ## Related topics -- [Administrative templates (.admx) for Windows 10 download](http://go.microsoft.com/fwlink/p/?LinkId=746579) -- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](http://go.microsoft.com/fwlink/p/?LinkId=746580) +- [Administrative templates (.admx) for Windows 10 download](https://go.microsoft.com/fwlink/p/?LinkId=746579) +- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md index ede7f497c1..a64b645896 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md @@ -32,7 +32,7 @@ If you experience issues while setting up your proxy server, you can try these t 2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. -3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](http://go.microsoft.com/fwlink/p/?LinkId=85652). +3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). ![](images/wedge.gif) **To check that you've turned on the correct settings** diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md index 9a5efa2a85..f49ab30704 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md @@ -37,7 +37,7 @@ For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry ## Updating your automatic configuration settings After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. -

**Important**
Your branding changes won't be added or updated if you've previously chosen the **Disable external branding of IE** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514). +

**Important**
Your branding changes won't be added or updated if you've previously chosen the **Disable external branding of IE** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). ![](images/wedge.gif) **To update your settings** @@ -51,7 +51,7 @@ After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like *http://share/test.ins*. + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `http://share/test.ins`. If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md index 4844421fea..b93b60f816 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md @@ -29,7 +29,7 @@ To use automatic detection, you have to set up your DHCP and DNS servers.

**No 2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). -3. Open the [DHCP Administrative Tool](http://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](http://go.microsoft.com/fwlink/p/?LinkId=294649). +3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). ![](images/wedge.gif) **To turn on automatic detection for DNS servers** @@ -37,7 +37,7 @@ To use automatic detection, you have to set up your DHCP and DNS servers.

**No 2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. -3. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](http://go.microsoft.com/fwlink/p/?LinkId=294651).  +3. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651).  4. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `http://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md index 3e63de28b0..119052b438 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md @@ -36,7 +36,7 @@ You have two options to restrict your users' ability to override the automatic c - **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. -- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=214514). +- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md index 00c6e38225..36de09f8ce 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md +++ b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md @@ -14,7 +14,7 @@ ms.sitesec: library # Browser cache changes and roaming profiles We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. -You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](http://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Windows Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](http://go.microsoft.com/fwlink/p/?LinkId=401545). +You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Windows Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). To get the best results while using roaming profiles, we strongly recommend the following: diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md index b1243f0790..fdd8ac9361 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md @@ -14,7 +14,9 @@ This topic lists new and updated topics in the Internet Explorer 11 documentatio ## August 2016 |New or changed topic | Description | |----------------------|-------------| -[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | +|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | ## July 2016 |New or changed topic | Description | diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md index da141bbcc1..cf90d5c6b3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md @@ -17,13 +17,13 @@ Before you install Internet Explorer 11, you should: - **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. -- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](http://go.microsoft.com/fwlink/p/?LinkId=214251) site. +- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. - **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](http://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](http://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](http://go.microsoft.com/fwlink/p/?linkid=276667). + - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://go.microsoft.com/fwlink/p/?linkid=276667). - - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](http://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](http://go.microsoft.com/fwlink/p/?LinkId=276669). + - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index ab5a60cbce..22d411f58d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -24,7 +24,7 @@ Before you start, you need to make sure you have the following: - Latest cumulative security update (for all supported versions of Internet Explorer): - 1. Go to the [Microsoft Security Bulletin](http://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. + 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) @@ -34,7 +34,7 @@ Before you start, you need to make sure you have the following: 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. -- [Setup and configuration package](http://go.microsoft.com/fwlink/p/?LinkId=517719), including: +- [Setup and configuration package](https://go.microsoft.com/fwlink/p/?LinkId=517719), including: - Configuration-related PowerShell scripts @@ -138,7 +138,7 @@ You need to set up your computers for data collection by running the provided Po **To set up Enterprise Site Discovery** -- Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1`. For more info, see [about Execution Policies](http://go.microsoft.com/fwlink/p/?linkid=517460). +- Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). ### WMI only: Set up your firewall for WMI data If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: @@ -465,7 +465,7 @@ You can completely remove the data stored on your employee’s computers. - `Remove-Item -Path 'HKCU:\Software\Microsoft\Internet Explorer\WMITelemetry'` ## Related topics -* [Enterprise Mode Site List Manager (schema v.2) download](http://go.microsoft.com/fwlink/?LinkId=746562) +* [Enterprise Mode Site List Manager (schema v.2) download](https://go.microsoft.com/fwlink/?LinkId=746562) * [Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md index 59d5f7b349..7a8162ee05 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md @@ -28,7 +28,7 @@ In addition, you can configure IE before, during, or after deployment, using the - **Group Policy**. Configures and enforces IE11 settings. For more information about settings and configuration options, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - **Unattend.xml**. Customizes some of the IE settings during your Windows installation. This option only applies if you're updating a Windows image with IE11.

**Note**
-You'll only see the new IE11 Unattend.xml settings if your Unattend.xml file's associated with a Windows image that includes the IE11 update. For more information about editing and using the Unattend.xml file, see [Unattended Windows Setup Reference](http://go.microsoft.com/fwlink/p/?LinkId=276788). For more information about using the Windows System Image Manager, see [Windows System Image Manager Technical Reference](http://go.microsoft.com/fwlink/p/?LinkId=276789). +You'll only see the new IE11 Unattend.xml settings if your Unattend.xml file's associated with a Windows image that includes the IE11 update. For more information about editing and using the Unattend.xml file, see [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788). For more information about using the Windows System Image Manager, see [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 16af47ddd2..360620938d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -34,8 +34,8 @@ If you delete a site by mistake, you’ll need to manually add it back using the - [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md index cc8ef4ae26..6654729ec6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md @@ -13,13 +13,13 @@ ms.sitesec: library # Deploy Internet Explorer 11 using software distribution tools If you already manage software distribution and updates on your network through software distribution tools, you can also use these tools for ongoing deployments of Internet Explorer. Software distribution tools include: -- **System Center R2 2012 System Center 2012 R2 Configuration Manager.** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [System Center R2 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkID=276664). +- **System Center R2 2012 System Center 2012 R2 Configuration Manager.** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664). -- **Windows Server Update Services (WSUS).** Download a single copy of the IE11 updates, caching them to local servers so your users' computers can receive the updates directly from the WSUS servers, instead of through Windows Update. For more information about using this tool, see [Windows Server Update Services](http://go.microsoft.com/fwlink/p/?LinkID=276790). +- **Windows Server Update Services (WSUS).** Download a single copy of the IE11 updates, caching them to local servers so your users' computers can receive the updates directly from the WSUS servers, instead of through Windows Update. For more information about using this tool, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). -- **Group Policy Software Installation.** Deploy and install IE11 on your user's computers through a combination of Group Policy and Microsoft Active Directory. For more information about using this tool, see [Group Policy Software Installation overview](http://go.microsoft.com/fwlink/p/?LinkId=296365). +- **Group Policy Software Installation.** Deploy and install IE11 on your user's computers through a combination of Group Policy and Microsoft Active Directory. For more information about using this tool, see [Group Policy Software Installation overview](https://go.microsoft.com/fwlink/p/?LinkId=296365). -- **Microsoft Deployment Toolkit (MDT).** Add the IE11 update to your deployment share, using MDT to update your previously-deployed Windows image. For more information about using this tool, see [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkID=331148). +- **Microsoft Deployment Toolkit (MDT).** Add the IE11 update to your deployment share, using MDT to update your previously-deployed Windows image. For more information about using this tool, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkID=331148).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md index bfea483922..affd42d162 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md @@ -22,10 +22,10 @@ ms.sitesec: library You can pin websites to the Windows 8.1 taskbar for quick access. You pin a website simply by dragging its tab to the taskbar. Some websites can also extend the icon’s Jump List. -The ability to pin websites to the Windows 8.1 taskbar can help make end users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to users. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=398474). +The ability to pin websites to the Windows 8.1 taskbar can help make end users in businesses more productive. As an IT professional, for example, you can pin intranet and SharePoint websites to the taskbar to make them immediately available to users. In this article, you learn how to deploy pinned websites by using Lite Touch Installation in the [Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=398474). ## Deploying pinned websites in MDT 2013 -This topic requires that you have a complete MDT 2013 deployment share that contains Windows 8.1 which comes with Internet Explorer 11. If you’re deploying to Windows 7 clients and need to learn how to add IE11 to an MDT 2013 deployment share as an update, see [Installing Internet Explorer 11 using Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=398475) in the TechNet library. +This topic requires that you have a complete MDT 2013 deployment share that contains Windows 8.1 which comes with Internet Explorer 11. If you’re deploying to Windows 7 clients and need to learn how to add IE11 to an MDT 2013 deployment share as an update, see [Installing Internet Explorer 11 using Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=398475) in the TechNet library. Deploying pinned websites in MDT 2013 is a 4-step process: @@ -101,13 +101,13 @@ With the .website files ready to copy to the **Public Links** folder on target c ## Updating intranet websites for pinning The MDT 2013 deployment share and task sequences are now ready to pin websites to the taskbar during deployment. This pinning feature can include intranet sites important in your organization. -You can make your intranet websites act more like applications by extending them to fully support the Windows 8.1 taskbar. This includes creating custom Jump Lists, thumbnail previews, and notifications. For info about extending your intranet websites, see [Pinned Sites Developer Documentation](http://go.microsoft.com/fwlink/p/?LinkId=398484) on MSDN. For more ideas about what to pin, see [Add-ons](http://go.microsoft.com/fwlink/p/?LinkId=398483) in the Internet Explorer Gallery. +You can make your intranet websites act more like applications by extending them to fully support the Windows 8.1 taskbar. This includes creating custom Jump Lists, thumbnail previews, and notifications. For info about extending your intranet websites, see [Pinned Sites Developer Documentation](https://go.microsoft.com/fwlink/p/?LinkId=398484) on MSDN. For more ideas about what to pin, see [Add-ons](https://go.microsoft.com/fwlink/p/?LinkId=398483) in the Internet Explorer Gallery. ## Related topics -- [Unattended Windows Setup Reference](http://go.microsoft.com/fwlink/p/?LinkId=276788) -- [Windows System Image Manager Technical Reference](http://go.microsoft.com/fwlink/p/?LinkId=276789) -- [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=331148) -- [Windows ADK Overview](http://go.microsoft.com/fwlink/p/?LinkId=276669) +- [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkId=276788) +- [Windows System Image Manager Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=276789) +- [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148) +- [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index 4b0660cb93..0be45f20c1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -26,7 +26,7 @@ Windows Internet Explorer 8 introduced document modes as a way to move from the This means that while Internet Explorer 11 will continue to support document modes, Microsoft Edge won’t. And because of that, it also means that if you want to use Microsoft Edge, you’re going to have to update your legacy webpages and apps to support modern features, browsers, and devices. **Note**
-For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](http://go.microsoft.com/fwlink/p/?LinkId=615953). +For specific details about the technologies and APIs that are no longer supported in Microsoft Edge, see [A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent](https://go.microsoft.com/fwlink/p/?LinkId=615953). ## What is document mode? Each release after Internet Explorer 8 has helped with the transition by introducing additional document modes that emulated previously supported versions, while also introducing support for features defined by industry standards. During this time, numerous websites and apps were updated to the latest and greatest industry standards, while many other sites and apps continued to simply rely on document modes to work properly. diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index 602456e9d1..7ebacccb8b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -38,8 +38,8 @@ If your change passes validation, it’s added to the global site list. If the u You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). ## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](http://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Download the Enterprise Mode Site List Manager (schema v.1)](http://go.microsoft.com/fwlink/p/?LinkID=394378) +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)   diff --git a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md index 0e467ceb7e..971612c41b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md @@ -16,7 +16,7 @@ Enhanced Protected Mode further restricts Protected Mode to deny potential attac You can use your company’s Group Policy to turn Enhanced Protected Mode on or off for all users. For more information, see the [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md) information in this guide. -For more information about Enhanced Protected Mode, see the [Enhanced Protected Mode](http://go.microsoft.com/fwlink/p/?LinkId=267512) post on IEBlog, and both the [Understanding Enhanced Protected Mode](http://go.microsoft.com/fwlink/p/?LinkId=282662) and the [Enhanced Protected Mode and Local Files](http://go.microsoft.com/fwlink/p/?LinkId=282663) blog posts on IEInternals. +For more information about Enhanced Protected Mode, see the [Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=267512) post on IEBlog, and both the [Understanding Enhanced Protected Mode](https://go.microsoft.com/fwlink/p/?LinkId=282662) and the [Enhanced Protected Mode and Local Files](https://go.microsoft.com/fwlink/p/?LinkId=282663) blog posts on IEInternals.   diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index 0530962b03..e78df6c4c1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -15,8 +15,9 @@ ms.sitesec: library **Applies to:** -- Windows 8.1 -- Windows 7 +- Windows 10 +- Windows 8.1 +- Windows 7 Use the Enterprise Mode Site List Manager (schema v.1) to create and update your Enterprise Mode site list for devices running the v.1 version of the schema, or the Enterprise Mode Site List Manager (schema v.2) to create and update your Enterprise Mode site list for devices running the v.2 version of the schema. We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). @@ -86,7 +87,19 @@ This table includes the elements used by the Enterprise Mode schema. <emie> <domain>contoso.com</domain> </emie> -</rules>> +</rules> +-or- +

For IPv6 ranges:

<rules version="205">
+  <emie>
+    <domain>[10.122.34.99]:8080</domain>
+  </emie>
+  </rules>
+-or- +

For IPv4 ranges:

<rules version="205">
+  <emie>
+    <domain>10.122.34.99:8080</domain>
+  </emie>
+  </rules>
Internet Explorer 11 and Microsoft Edge @@ -191,7 +204,6 @@ For example, say you want all of the sites in the contoso.com domain to open usi We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: - Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. - Don’t use wildcards. -- Don't use IP Addresses. - Don’t use query strings, ampersands break parsing. ## How to use trailing slashes @@ -283,5 +295,4 @@ If you want to target specific sites in your organization.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
    • - - + \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md index 1379a67bf3..5c003a24c1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md @@ -118,7 +118,15 @@ This table includes the elements used by the v.2 version of the Enterprise Mode <site url="contoso.com"> <compat-mode>default</compat-mode> <open-in>none</open-in> -</site>

    +</site> +-or- +

    For IPv4 ranges:

    <site url="10.122.34.99:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

    +-or- +

    For IPv6 ranges:

    <site url="[10.122.34.99]:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

    You can also use the self-closing version, <url="contoso.com" />, which also sets:

    @@ -230,7 +230,7 @@ If the system requirements of a locally installed application exceed the require

  • Download and install [KB2533623](http://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)

    • -

  • For computers running Microsoft Windows Server 2008 R2 SP1, download and install [KB2533623](http://go.microsoft.com/fwlink/?LinkId=286102 ) (http://go.microsoft.com/fwlink/?LinkId=286102)

    +

  • For computers running Microsoft Windows Server 2008 R2 SP1, download and install [KB2533623](https://go.microsoft.com/fwlink/?LinkId=286102 ) (https://go.microsoft.com/fwlink/?LinkId=286102)

    Important   @@ -313,7 +313,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve  

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x64)](http://www.microsoft.com/download/details.aspx?id=13523) (http://www.microsoft.com/download/details.aspx?id=13523)

    • -

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](http://go.microsoft.com/fwlink/?LinkId=267110) (http://go.microsoft.com/fwlink/?LinkId=267110)

    • +

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110) (https://go.microsoft.com/fwlink/?LinkId=267110)

  • 64-bit ASP.NET registration

    • The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server.

    @@ -345,7 +345,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve

    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.

    Reporting Server

    -
  • If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.
    • +
  • If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.

    • @@ -2512,8 +2513,8 @@ or Hang

    To troubleshoot this event:

    1. Run the scan again.
      2. -
    2. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      3. -
    3. Contact Microsoft Technical Support. +
    4. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
      5. +
    5. Contact Microsoft Technical Support.

    @@ -2753,8 +2754,8 @@ Use the information in these tables to help troubleshoot Windows Defender error
  • Update the definitions. Either:
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      2. -
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    3. Download the latest definitions from the Microsoft Malware Protection Center. +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

    • @@ -2996,8 +2997,8 @@ article.

  • Update the definitions. Either:
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      2. -
    2. Download the latest definitions from the Microsoft Malware Protection Center. -

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    3. Download the latest definitions from the Microsoft Malware Protection Center. +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

    • diff --git a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md index ff626bb1de..5973f94f6f 100644 --- a/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md +++ b/windows/keep-secure/trusted-platform-module-services-group-policy-settings.md @@ -22,33 +22,38 @@ The TPM Services Group Policy settings are located at: **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** -| Setting | Windows 10 | Windows Server 2012 R2, Windows 8.1 and Windows RT | Windows Server 2012, Windows 8 and Windows RT | Windows Server 2008 R2 and Windows 7 | Windows Server 2008 and Windows Vista | -| - | - | - | - | - | - | -| [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu) | X| X| X| X| X| -| [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)| X| X| X| X| X| -| [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) | X| X| X| X| X| -| [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| -| [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| X| X| X||| -| [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X||| -| [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)| X| X| X||| -| [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)| X| X| X|||| -  +| Setting | Windows 10, version 1607 | Windows 10, version 1511 and Windows 10, version 1507 | Windows Server 2012 R2, Windows 8.1 and Windows RT | Windows Server 2012, Windows 8 and Windows RT | Windows Server 2008 R2 and Windows 7 | Windows Server 2008 and Windows Vista | +| - | - | - | - | - | - | - | +| [Turn on TPM backup to Active Directory Domain Services](#bkmk-tpmgp-addsbu) | | X| X| X| X| X| +| [Configure the list of blocked TPM commands](#bkmk-tpmgp-clbtc)| X| X| X| X| X| X| +| [Ignore the default list of blocked TPM commands](#bkmk-tpmgp-idlb) | X| X| X| X| X| X| +| [Ignore the local list of blocked TPM commands](#bkmk-tpmgp-illb) | X| X| X| X| X| X| +| [Configure the level of TPM owner authorization information available to the operating system](#bkmk-tpmgp-oauthos)| | X| X| X||| +| [Standard User Lockout Duration](#bkmk-tpmgp-suld)| X| X| X| X||| +| [Standard User Individual Lockout Threshold](#bkmk-tpmgp-suilt)| X| X| X| X||| +| [Standard User Total Lockout Threshold](#bkmk-tpmgpsutlt)| X| X| X| X|||| + ### Turn on TPM backup to Active Directory Domain Services This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of TPM owner information. ->**Note:**  This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). -  +>[!NOTE] +>This policy setting applies to the Windows operating systems listed in the [version table](#bkmk-version-table). + + TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can be run only by the TPM owner. This hash authorizes the TPM to run these commands. ->**Important:**  To back up TPM owner information from a computer running Windows 10, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). -  -The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, on a local computer at the command prompt, type **tpm.msc** to open the TPM Management Console and select the action to **Initialize TPM**. If the TPM owner information is lost or is not available, limited TPM management is possible by running **tpm.msc**. +>[!IMPORTANT] +>To back up TPM owner information from a computer running Windows 10, version 1507, Windows 10, version 1511, Windows 8.1, or Windows 8, you might need to first set up appropriate schema extensions and access control settings on the domain so that the AD DS backup can succeed. Windows Server 2012 R2 and Windows Server 2012 include the required schema extensions by default. For more information, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). This functionality is discontinued starting with Windows 10, version 1607. If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. When this policy setting is enabled, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. +>[!NOTE] +> The **Turn on TPM backup to Active Directory Domain Services** is not available in the Windows 10, version 1607 and Windows Server 2016 and later versions of the ADMX files. + + ### Configure the list of blocked TPM commands This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows. @@ -99,10 +104,10 @@ This policy setting configures how much of the TPM owner authorization informati There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. - **Full**   This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. -- **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. When you use this setting, we recommend using external or remote storage for the full TPM owner authorization value—for example, backing up the value in Active Directory Domain Services (AD DS). +- **Delegated**   This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows. - **None**   This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. ->**Note:**  If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. If you are backing up the TPM owner authorization value to AD DS, the new owner authorization value is automatically backed up to AD DS when it is changed. +>**Note:**  If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid.   **Registry information** @@ -132,8 +137,6 @@ authorization to the TPM.   The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption. -The number of authorization failures that a TPM allows and how long it stays locked vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time, with fewer authorization failures, depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require that the system is on so enough clock cycles elapse before the TPM exits the lockout mode. - This setting helps administrators prevent the TPM hardware from entering a lockout mode by slowing the speed at which standard users can send commands that require authorization to the TPM. For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: @@ -176,8 +179,6 @@ For each standard user two thresholds apply. Exceeding either threshold will pre The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode, it is global for all users (including administrators) and for Windows features such as BitLocker Drive Encryption.. -The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. - An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure. diff --git a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md b/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md index 088acf33fa..0ab40df034 100644 --- a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md +++ b/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index cadbd4c872..2f238a4d6d 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Use the Windows Defender Advanced Threat Protection portal @@ -15,7 +16,7 @@ author: mjcaparas **Applies to:** - Windows 10 Enterprise -- Windows 10 Enterprise for Education +- Windows 10 Education - Windows 10 Pro - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/keep-secure/verify-that-network-traffic-is-authenticated.md b/windows/keep-secure/verify-that-network-traffic-is-authenticated.md index 03fcc34124..88ab773159 100644 --- a/windows/keep-secure/verify-that-network-traffic-is-authenticated.md +++ b/windows/keep-secure/verify-that-network-traffic-is-authenticated.md @@ -25,7 +25,7 @@ In these procedures, you confirm that the rules you deployed are working correct - **Encryption zone.** Similar to the main isolation zone, after you confirm that the network traffic to zone members is properly authenticated and encrypted, you must convert your zone rules from request mode to require mode. ->**Note:**  In addition to the steps shown in this procedure, you can also use network traffic capture tools such as Microsoft Network Monitor, which can be downloaded from . Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them. +>**Note:**  In addition to the steps shown in this procedure, you can also use network traffic capture tools such as Microsoft Network Monitor, which can be downloaded from . Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them.   diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index ef04831e0b..90c8e2aa2d 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # VPN profile options @@ -62,6 +62,6 @@ A VPN profile configured with LockDown secures the device to only allow network ## Learn more - [Learn how to configure VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) -- [VPNv2 configuration service provider (CSP) reference](http://go.microsoft.com/fwlink/p/?LinkId=617588) -- [How to Create VPN Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=618028) +- [VPNv2 configuration service provider (CSP) reference](https://go.microsoft.com/fwlink/p/?LinkId=617588) +- [How to Create VPN Profiles in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=618028) diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index b9bb671c49..4fb387f147 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -30,7 +30,7 @@ Even you can't use that PIN anywhere except on that specific device. If you want A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. -> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928). +> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928).   ## PIN is backed by hardware @@ -70,7 +70,7 @@ If you only had a biometric sign-in configured and, for any reason, were unable ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md)   \ No newline at end of file diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index 0cb9c52700..85ff61bf41 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -1,254 +1,167 @@ --- title: Windows 10 Mobile security guide (Windows 10) -description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. +description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. ms.assetid: D51EF508-699E-4A68-A7CD-91D821A97205 keywords: data protection, encryption, malware resistance, smartphone, device, Windows Store ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, mobile +localizationpriority: high author: AMeeus --- - # Windows 10 Mobile security guide -**Applies to** -- Windows 10 Mobile +*Applies to Windows 10 Mobile, version 1511 and Windows Mobile, version 1607* -This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. +>This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. -## Overview +Smartphones now serve as a primary productivity tool for business workers and, just like desktops or laptops, need to be secured against malware and data theft. Protecting these devices can be challenging due to the wide range of device operating systems and configurations and the fact that many employees use their own personal devices. IT needs to secure corporate assets on every device, but also ensure the privacy of the user’s personal apps and data. +Windows 10 Mobile addresses these security concerns directly, whether workers are using personal or corporate-owned devices. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. These technologies include: +- **Windows Hello for Business** Enhanced identity and access control features ensure that only authorized users can access corporate data and resources. Windows Hello simplifies multifactor authentication (MFA) deployment and use, offering PIN, companion device, and biometric authentication methods. +- **Windows Information Protection** Automatic data separation keeps corporate information from being shared with personal data and apps. +- **Malware resistance** Multi-layered protections built into the device hardware, startup processes, and app platform help reduce the threat of malware that can compromise employee devices. -Windows 10 Mobile is specifically designed for smartphones and small tablets. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. Several broad categories of security work went into Windows 10 Mobile: +This guide helps IT administrators better understand the security features in Windows 10 Mobile, which can be used to improve protection against unauthorized access, data leakage, and malware. -- **Identity and access control.** Microsoft has greatly enhanced identity and access control features to simplify and improve the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). (Windows Hello requires either a specialized illuminated infrared \[IR\] camera for facial recognition and iris detection or a finger print reader that supports the Windows Biometric Framework.) -- **Data protection.** Confidential data is better protected from compromise than ever before. Windows 10 Mobile uses several data-protection technologies and delivers them in a user-friendly and IT-manageable way. -- **Malware resistance.**Windows 10 Mobile helps protect critical system resources and apps to reduce the threat of malware, including support for enterprise-grade secure hardware and Secure Boot. -- **App platform security.** The Windows 10 Mobile enterprise-grade secure app platform provides multiple layers of security. For example, Windows Store checks all apps for malware to help prevent malware from reaching devices. +**In this article:** +- Windows Hello for Business +- Windows Information Protection +- Malware resistance -In addition, AppContainer application isolation helps prevent any malicious app from compromising other apps. +## Windows Hello -This guide explains each of these technologies and how they help protect your Windows 10 Mobile devices. +Windows 10 Mobile includes Windows Hello, a simple, yet powerful, multifactor authentication solution that confirms a user’s identity before allowing access to corporate confidential information and resources. Multifactor authentication is a more secure alternative to password-based device security. Users dislike having to enter long, complex passwords – particularly on a mobile device touch screen – that corporate policy requires they change frequently. This leads to poor security practices like password reuse, written down passwords, or weak password creation. -## Identity and access control +Windows Hello offers a simple, cost-effective way to deploy multifactor authentication across your organization. Unlike smart cards, it does not require public key infrastructure or the implementation of additional hardware. Workers use a PIN, a companion device (like Microsoft Band), or biometrics to validate their identity for accessing corporate resources on their Azure Active Directory (Azure AD) registered Windows 10 Mobile device. -A fundamental component of security is the notion that a user has a unique identity and that that identity is either allowed or denied access to resources. This notion is traditionally known as access control, which has three parts: -- **Identification.** The user (subject) asserts a unique identity to the computer system for the purpose of accessing a resource (object), such as a file or an app. -- **Authentication.** Authentication is the process of proving the asserted identity and verifying that the subject is indeed the subject. -- **Authorization.** The system compares the authenticated subject’s access rights against the object’s permissions and either allows or denies the requested access. +Because Windows Hello is supported across all Windows 10 devices, organizations can uniformly implement multifactor authentication across their environment. Deploying Windows Hello on Windows 10 Mobile devices does require Azure AD (sold separately), but you can use Azure AD Connect to synchronize with your on-premises Active Directory services. -The way an operating system implements these components makes a difference in preventing attackers from accessing corporate data. Only users who prove their identities and are authorized to access that data can access it. In security, however, there are varying degrees of identity proof and many different requirements for authorization limits. The access control flexibility most corporate environments need presents a challenge for any operating system. Table 1 lists typical Windows access control challenges and the solutions that Windows 10 Mobile offers. +Windows Hello supports iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. -Table 1. Windows 10 Mobile solutions for typical access control challenges - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Access control challengeWindows 10 Mobile solutions

    Organizations frequently use passwords to authenticate users and provide access to business applications or the corporate network, because more trustworthy authentication alternatives are too complex and costly to deploy.

    Windows Hello provides biometrics to identify the user and unlock the device that closely integrates with Microsoft Passport to identify, authenticate, and authorize users to access the corporate network or applications from their Windows 10 Mobile device with supporting biometric hardware.

    When an organization uses smart cards, it must purchase a smart card reader, smart cards, and smart card management software. These solutions are complex and costly to implement; they also tend to delay mobile productivity.

    Windows Hello with Microsoft Passport enables a simple and cost-effective MFA deployment across the organization, enhancing the business’ security stance.

    Mobile device users must enter their password on a touch keyboard. Entering complex passwords in this way is error prone and less efficient than a keyboard.

    Windows Hello helps enable iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. These biometric identification options are more convenient and more efficient than password-based logon.

    Users dislike the need to enter long, complex passwords to log on to corporate services, especially passwords that must change frequently. This frustration often leads to password reuse, passwords written on notepads, and weak password composition.

    Microsoft Passport allows users to sign in once and gain access to corporate resources without having to re-enter complex passwords. Authentication credentials are bound to the device through a built-in Trusted Platform Module (TPM) and cannot be removed.

    -  -The following sections describe these challenges and solutions in more detail. +>**Note:** When Windows 10 first shipped, it included **Microsoft Passport** and **Windows Hello**, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the **Windows Hello** name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -### Microsoft Passport +### Secured credentials -Microsoft Passport provides strong MFA, fully integrated into Windows devices, to replace passwords. To authenticate, the user must have a Microsoft Azure Active Directory (Azure AD)–registered device and either a PIN or Windows Hello biometric gesture to unlock the device. Microsoft Passport is conceptually similar to a smart card but more flexible, as it doesn’t require a public key infrastructure or the implementation of additional hardware and supports biometric identification. +Windows Hello eliminates the use of passwords for login, reducing the risk that an attacker will steal and reuse a user’s credentials. Windows 10 Mobile devices are required to have a Trusted Platform Module (TPM), a microchip that enables advanced security features. The TPM creates encryption keys that are “wrapped” with the TPM’s own storage root key, which is itself stored within the TPM to prevent credentials from being compromised. Encryption keys created by the TPM can only be decrypted by the same TPM, which protects the key material from attackers who want to capture and reuse it. -Microsoft Passport offers three significant advantages over the previous state of Windows authentication: it’s more flexible, it’s based on industry standards, and it more effectively mitigates risks. -### It's effective +To compromise Windows Hello credentials, an attacker would need access to the physical device, and then find a way to spoof the user’s biometric identity or guess his or her PIN. All of this would have to be accomplished before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. With TPM-based protection, an attacker’s window of opportunity for compromising a user’s credentials is greatly reduced. -Microsoft Passport eliminates the use of passwords for logon and so reduces the risk that an attacker will steal and reuse a user’s credentials. User key material, which includes the user’s private key, is available only on the device that generated it. The key material is protected with the TPM, which protects the key material from attackers who want to capture and reuse it. It is a Windows Hardware Certification Program requirement that every Windows 10 Mobile device include a TPM. +### Support for biometrics -To compromise a Microsoft Passport credential that the TPM protects, an attacker must have access to the physical device, and then find a way to spoof the user’s biometrics identity or guess his or her PIN—and all of this must be done before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. This technology greatly reduces an attacker’s window of opportunity for compromising a user’s credentials. +Biometrics help prevent credential theft and make it easier for users to login to their devices. Users always have their biometric identity with them – there is nothing to forget, lose, or leave behind. Attackers would need to have both access to the user’s device and be able to impersonate the user’s biometric identity to gain access to corporate resources, which is far more difficult than stealing a password. -### It's flexible +Windows Hello supports three biometric sensor scenarios: +- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. +- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. +- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. -Microsoft Passport offers unprecedented flexibility along with enterprise-grade security. +>Users must create an unlock PIN while they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. -Most importantly, Microsoft Passport works with biometrics or PINs and gives you options beyond long, complex passwords. Instead of users memorizing and retyping often-changed passwords, Microsoft Passport enables PIN- and biometrics-based identification through Windows Hello to identify users more securely. +All three of these biometric factors – face, finger, and iris – are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes or both eyes with and without eyeglasses or contact lenses. -The Windows 10 Mobile device that the user logs on to is an authentication factor, as well. The credentials used and the private key on the device are device specific and bound to the device’s TPM. +Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device, as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. -In the future, Microsoft Passport will also enable people to use Windows 10 Mobile devices as a remote credential when signing in to PCs running Windows 10. Users will use their PINs or biometrics to unlock their phones, and their phones will unlock their PCs. Phone sign-in with Microsoft Passport will make implementing MFA for scenarios where the user’s credentials must be physically separate from the PC the user is signing in to less costly and complex than other solutions. Phone sign-in will also make it easier for users and IT pros because users can use their phones to sign in to any corporate device instead of enrolling a user credential on each. +The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. -With Microsoft Passport, you gain flexibility in the data center, too. To deploy it for Windows 10 Mobile devices, you must set up Azure AD, but you don’t have to replace or remove your existing Active Directory environment. Using Azure AD Connect, organizations can synchronize these two directory services. Microsoft Passport builds on and adds to your existing infrastructure and allows you to federate with Azure AD. +### Companion devices -Microsoft Passport is also supported on the desktop, giving organizations a uniform way to implement strong authentication on all devices. This flexibility makes it simpler for Microsoft Passport to supplement existing smart card or token deployments for on-premises Windows PC scenarios, adding MFA to mobile devices and users who don’t currently have it for extra protection of sensitive resources or systems that these mobile devices access. +A Windows Hello companion device enables a physical device, like a wearable, to serve as a factor for validating the user’s identity before granting them access to their credentials. For instance, when the user has physical possession of a companion device they can easily, possibly even automatically, unlock their PC and authenticate with apps and websites. This type of device can be useful for smartphones or tablets that don’t have integrated biometric sensors or for industries where users need a faster, more convenient sign-in experience, such as retail. -### It's standardized +In some cases, the companion device for Windows Hello enables a physical device, like a phone, wearable, or other types of device to store all of the user’s credentials. Storage of the credentials on a mobile device makes it possible to use them on any supporting device, like a kiosk or family PC, and eliminates the need to enroll Windows Hello on each device. Companion devices also help enable organizations to meet regulatory requirements, such as Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS 140-2). -Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: the future lies with open, interoperable systems that allow secure authentication across a variety of devices, line-of-business (LOB) apps, and external applications and websites. To this end, a group of industry players formed the Fast Identity Online (FIDO) Alliance. The FIDO Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices as well as the problems users face in creating and remembering multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to authenticate users of online services securely. This new standard can allow any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms using a standardized set of interfaces and protocols. -In 2014, Microsoft joined the board of the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards and of course new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. +### Standards-based approach -### Windows Hello +The Fast Identity Online (FIDO) Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices and the problems users face in creating and remembering multiple user names and passwords. FIDO standards help reduce reliance on passwords to authenticate users of online services securely, allowing any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms. -Windows Hello is the new biometric framework for Windows 10. Because biometric identification is built directly into the operating system, it allows you to use your iris, face, or fingerprint to unlock your mobile device. Windows Hello unlocks Microsoft Passport credentials, which enable authentication to resources or relying parties such as software-as-a-service applications like Microsoft Office 365. -Windows Hello supports three biometric sensor options that are suitable for enterprise scenarios: +In 2014, Microsoft joined the board of the FIDO Alliance. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards. Microsoft has contributed Windows Hello technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for both enterprises and consumers. -- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. -- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. -- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. -> **Note:**  Users must create an unlock PIN before they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. -  -All three of these biometric factors—the face, the finger, and the iris—are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes; or both with and without eyeglasses or contact lenses. +## Windows Information Protection -Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. +Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This fluidity increases the potential for sensitive corporate data to be accidentally compromised. -The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. +Inadvertent disclosure is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. It’s easy to imagine that an employee using work email on their personal phone could unintentionally save an attachment containing sensitive company information to personal cloud storage, which could be shared with unauthorized people. This accidental sharing of corporate data is just one example of the challenges common to using mobile devices in the workplace. To prevent this type of data leakage, most solutions require users to login with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. -Windows Hello offers several major benefits. First, it helps to address the problems of credential theft and sharing because an attacker must obtain the mobile phone and impersonate the user’s biometric identity, which is more difficult than stealing a device unlock password. Second, the use of biometrics gives users an authenticator that’s always with them—there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, enterprise-grade secure method for logging on to their Windows 10 Mobile device. Finally, there’s nothing additional to deploy, because Microsoft built Windows Hello support directly into the operating system. All you need is a device that includes a supported biometric sensor. +Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data secure and personal data private. Because corporate data is always protected, users cannot inadvertently copy it or share it with unauthorized users or apps. Key features include: +- Automatically tag personal and corporate data. +- Protect data while it’s at rest on local or removable storage. +- Control which apps can access corporate data. +- Control which apps can access a virtual private network (VPN) connection. +- Prevent users from copying corporate data to public locations. +- Help ensure business data is inaccessible when the device is in a locked state. -The device that senses the biometric factors must report the data to Windows Hello quickly and accurately. For this reason, Microsoft determines which factors and devices are trustworthy and accurate prior to their inclusion in Windows Hello. For more information, see [Windows 10 specifications](http://go.microsoft.com/fwlink/p/?LinkId=722908). +### Enlightened apps -## Data protection +Third-party data loss protection solutions usually require developers to wrap their apps. However, Windows Information Protection builds this intelligence right into Windows 10 Mobile so most apps require nothing extra to prevent inappropriate corporate data sharing. -Windows 10 Mobile continues to provide solutions that help protect information against unauthorized access and disclosure. +Windows Information Protection classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data will be encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default. +When you do not want all data encrypted by default – because it would create a poor user experience – developers should consider enlightening apps by adding code and compiling them using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that: +- Don’t use common controls for saving files. +- Don’t use common controls for text boxes. +- Work on personal and enterprise data simultaneously (e.g., contact apps that display personal and enterprise data in a single view or a browser that displays personal and enterprise web pages on tabs within a single instance). -### Device encryption -Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating system and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. +In many cases, most apps don’t require enlightenment for them to use Windows Information Protection. Simply adding them to the allow list is the only step you need to take. Line-of-Business (LOB) apps are a good example of where this works well because they only handle corporate data. -You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. Table 2 lists the policies you can change to customize device encryption on Windows 10 Mobile devices. +**When is app enlightenment required?** +- **Required** + - App needs to work with both personal and enterprise data. +- **Recommended** + - App handles only corporate data, but needs to modify a file (such as a configuration file) in order to launch, uninstall itself, update etc. Without enlightenment you wouldn’t be able to properly revoke these apps. + - App needs to access enterprise data, while protection under lock is activated. +- **Not required** + - App handles only corporate data + - App handles only personal data -Table 2. Windows 10 cryptography policies - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Area namePolicy nameDescription

    Cryptography

    Allow FIPS Algorithm Policy

    Enable or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled.

    BitLocker

    Encryption Method

    Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one.

    Cryptography

    TLS Cipher Suite

    This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections.

    -  -For a complete list of policies available, see [Policy CSP](https://technet.microsoft.com/library/dn904962.aspx). +### Data leakage control -### Enterprise data protection +To configure Windows Information Protection in a Mobile Device Management (MDM) solution that supports it, simply add authorized apps to the allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, unauthorized apps will not have access to enterprise data. -Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This situation increases the potential for compromise of sensitive corporate data. +Windows Information Protection works seamlessly until users try to access enterprise data with or paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but Window Information Protection can block users from copying enterprise data from an authorized app to an unauthorized app. Likewise, it will block users from using an unauthorized app to open a file that contains enterprise data. -One growing risk is authorized users’ accidental disclosure of sensitive data—a risk that is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. One example is common among organizations: an employee connects his or her personal phone to the company’s Microsoft Exchange Server instance for email. He or she uses the phone to work on email that includes attachments with sensitive data. When sending the email, the user accidentally copies a supplier. Content protection is only as strong as the weakest link, and in this example, the unintended sharing of sensitive data with unauthorized people might not have been prevented with standard data encryption. +The extent to which users will be prevented from copying and pasting data from authorized apps to unauthorized apps or locations on the web depends on which protection level is set: +- **Block.** Windows Information Protection blocks users from completing the operation. +- **Override.** Windows Information Protection notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. +- **Audit.** Windows Information Protection does not block or notify users but logs the operation in the audit log. +- **Off.** Windows Information Protection does not block or notify users and does not log operations in the audit log. -In Windows 10 Mobile, Windows Information Protection (WIP) helps separate personal and enterprise data and prevent data leakage. Key features include its ability to: +### Data separation -- Automatically tag personal and corporate data. -- Protect data while it’s at rest on local or removable storage. -- Control which apps can access corporate data. -- Control which apps can access a virtual private network (VPN) connection. -- Prevent users from copying corporate data to public locations. +Most third-party solutions require an app wrapper that directs enterprise data into a password-protected container and keeps personal data outside the container. Depending on the implementation, this may require two different versions of the same apps to be running on the device: one for personal data and another for enterprise data. -> **Note:** WIP is currently being tested in select customer evaluation programs. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip). -  -### Enlightenment +Windows Information Protection provides data separation without requiring a container or special version of an app to access business or personal data. There is no separate login required to see your corporate data or open your corporate applications. Windows Information Protection identifies enterprise data and encrypts it to only enterprise use. Data separation is automatic and seamless. -Third-party data loss protection solutions usually require developers to wrap their apps. In contrast, WIP puts the intelligence in Windows 10 Mobile so that it doesn’t require wrappers. As a result, most apps require nothing extra to work with WIP. +### Encryption -WIP can enforce policy without the need for an app to change. This means that an app that always handles business data (such as an LOB app) can be added to the allowed list and will always encrypt all data that it handles. However, if the app does not use common controls, cut and paste operations from this app to a non-enterprise app will silently fail. In addition, if the app needs to handle personal data, this data will also be encrypted. -Therefore, to improve the user experience, in some cases, developers should enlighten their apps by adding code to and compiling them to use the WIP application programming interfaces. Those cases include apps that: -- Don’t use common controls for saving files. -- Don’t use common controls for text boxes. -- Work on personal and enterprise data simultaneously (for example, contact apps that display personal and enterprise data in a single view; a browser that displays personal and enterprise web pages on tabs within a single instance). +Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating systems and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored – even if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. -Figure 1 summarizes when an app might require enlightenment to work with WIP. Microsoft Word is a good example. Not only can Word access personal and enterprise data simultaneously, but it can also transmit enterprise data (for example, email attachments containing enterprise data). +You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. The list below shows the policies you can change to customize device encryption on Windows 10 Mobile devices. +- Cryptography + - Allow FIPS Algorithm: This policy enables or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled. + - TLS Cipher Suite: This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections. +- BitLocker + - Encryption Method: Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one. -In any case, most apps don’t require enlightenment for them to use WIP protection. Simply adding them to the WIP allow list is all you must do. Because unenlightened apps cannot automatically tag data as personal or enterprise, if they are in a WIP policy, they treat all data as enterprise data. An LOB app is a good example. Adding an LOB app to a WIP policy protects all data that the app handles. Another example is a legacy app that cannot be updated, which you can add to a WIP policy and use without even being aware that WIP exists. +To help make the device even more secured against outside interference, Windows 10 Mobile also now includes protection-under-lock. That means that encryption keys are removed from memory whenever a device is locked. Apps are unable to access sensitive data while the device is in a locked state, so hackers and malware have no way to find and co-opt keys. Everything is locked up tight with the TPM until the user unlocks the device with Windows Hello. -![figure 1](images/mobile-security-guide-fig1.png) +### Government Certifications -Figure 1. When is enlightenment required? - -### Data leakage control - -To configure WIP in an MDM solution that supports it, add authorized apps to the WIP allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, apps that this policy doesn’t authorize won’t have access to enterprise data. - -WIP works seamlessly until users try to access enterprise data with or try to paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but WIP blocks users from copying enterprise data from an authorized app to an unauthorized app. Likewise, WIP blocks users from using an unauthorized app to open a file that contains enterprise data. -In addition, users cannot copy and paste data from authorized apps to unauthorized apps or locations on the Web without triggering one of the WIP protection levels: -- **Block.** WIP blocks users from completing the operation. -- **Override.** WIP notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. -- **Audit.** WIP does not block or notify users but logs the operation in the audit log. -- **Off.** WIP does not block or notify users and does not log operations in the audit log. - -### Data separation - -As the name suggests, data separation separates personal from enterprise data. Most third-party solutions require an app wrapper, and from here, enterprise data goes in a container while personal data is outside the container. Often, people must use two different apps for the same purpose: one for personal data and another for enterprise data. - -WIP provides the same data separation but neither uses containers nor requires a special version of an app to access business data, and then a second instance of it to access personal data. There are no containers, partitions, or special folders to physically separate personal and business data. Instead, Windows 10 Mobile is the access control broker, identifying enterprise data because it’s encrypted to the enterprise. Therefore, WIP provides data separation by virtue of encrypting enterprise data. - -### Visual cues - -In Windows 10 Mobile, visual cues indicate the status of WIP to users (see Figure 2): - -- **Start screen.** On the Start screen, apps that a WIP policy manages display a visual cue. -- **Files.** In File Explorer, a visual cue indicates whether a file or folder contains enterprise data and is therefore encrypted. -For example, Erwin is an employee at Fabrikam. He opens Microsoft Edge from the Start screen and sees that the tile indicates that a WIP policy manages the browser. Erwin opens the Fabrikam sales website and downloads a spreadsheet. In File Explorer, Erwin sees that the file he downloaded has a visual cue which indicates that it’s encrypted and contains enterprise data. When Erwin tries to paste data from that spreadsheet into an app that no WIP policy manages (for example, his Twitter app), Erwin might see a message that allows him to override protection while logging the action, depending on the protection level configured in the WIP policy. - -![figure 2](images/mobile-security-guide-fig2.png) - -Figure 2. Visual cues in WIP +Windows 10 Mobile supports both [FIPS 140 standards](http://csrc.nist.gov/groups/STM/cavp/validation.html) for cryptography and [Common Criteria](https://www.niap-ccevs.org/Product/Compliant.cfm?pid=10694) The FIPS 140 certification validates the effectiveness of the cryptographic algorithms used in Windows 10 Mobile. Microsoft has also received Common Criteria certification for Windows 10 Mobile running on Lumia 950, 950 XL, 550, 635, as well as Surface Pro 4, giving customers assurance that securety functionality is implemented properly. ## Malware resistance -Just as software has automated so much of our lives, malware has automated attacks on our devices. Those attacks are relentless. Malware is constantly changing, and when it infects a device, it can be difficult to detect and remove. -The best way to fight malware is to prevent the infection from happening. Windows 10 Mobile provides strong malware resistance because it takes advantage of secured hardware and protects both the startup process and the core operating system architecture. - -Table 3 lists specific malware threats and the mitigation that Windows 10 Mobile provides. - -Table 3. Threats and Windows 10 Mobile mitigations +The best way to fight malware is prevention. Windows 10 Mobile provides strong malware resistance through secured hardware, startup process defenses, core operating system architecture, and application-level protections. +The table below outlines how Windows 10 Mobile mitigates specific malware threats. --++ - + @@ -266,11 +179,11 @@ Table 3. Threats and Windows 10 Mobile mitigations - + - + @@ -291,249 +204,164 @@ Table 3. Threats and Windows 10 Mobile mitigations
    ThreatWindows 10 Mobile mitigationWindows 10 Mobile mitigation

    An app infects other apps or the operating system with malware.

    All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.

    All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.

    An unauthorized app or malware attempts to start on the device.

    All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.

    All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.

    User-level malware exploits a vulnerability in the system or an application and owns the device.
    -  -> **Note:**  Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [http://www.uefi.org/specsandtesttools](http://go.microsoft.com/fwlink/p/?LinkId=722912). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. -  -The following sections describe these improvements in more detail. -### Enterprise-grade secure hardware +>**Note:** The Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [www.uefi.org/specs]( http://www.uefi.org/specs). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. -Taking full advantage of Windows 10 Mobile security features requires advancements in hardware-based security. These advances include UEFI with Secure Boot, TPM, and biometric sensors (hardware dependent). +### UEFI with Secure Boot -### UEFI with Secure Boot +When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. -When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. +UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also helps to ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. + +UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and to try and hide its malicious behavior from the operating system. Firmware-based malware of this nature is typically called bootkits. -UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also help ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. -UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and can successfully hide its malicious behavior from Windows 10 Mobile. Firmware-based malware of this nature is typically called a bootkit. When a mobile device with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that no one has modified it after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. -All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. -Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=722909). +All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx) -### Trusted Platform Module +### Trusted Platform Module -A Trusted Platform Module is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or mobile phone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. It is a Windows 10 Mobile device hardware certification requirement to include a TPM in every Windows 10 Mobile device. +A Trusted Platform Module (TPM) is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or smartphone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. A TPM is required to receive Windows 10 Mobile device hardware certification. -A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. +A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling a reliable report of the software used to start a platform. -The following list describes key functionality that a TPM provides in Windows 10 Mobile: -- **Manage cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. -- **Safeguard and report integrity measurements.**Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. -- **Prove a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware that masquerades as a TPM. +The following list describes key functionality that a TPM provides in Windows 10 Mobile: +- **Managing cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. +- **Safeguarding and reporting integrity measurements.** Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component – from firmware up through the drivers – and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. +- **Proving a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware masquerading as a TPM. -Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. -Many people assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements; therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. +Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. When the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since then, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection, as well as the ability to plug-in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. -> **Note:**  Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733964). -  -Several Windows 10 Mobile security features require TPM: -- Virtual smart cards -- Measured Boot -- Health attestation (requires TPM 2.0 or later) -Still other features will use the TPM if it is available. For example, Microsoft Passport does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Microsoft Passport. +Many assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements. Therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. -### Biometrics +>Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [minimum hardware requirements](https://technet.microsoft.com/library/dn915086.aspx) -Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. -Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by MFA features such as Microsoft Passport and Windows Hello. -In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue to integrate them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. +Several Windows 10 Mobile security features require TPM: +- Virtual smart cards +- Measured Boot +- Health attestation (requires TPM 2.0 or later) -### Enterprise-grade secure Windows startup +Still other features will use the TPM if it is available. For example, Windows Hello does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Windows Hello. -UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. +### Biometrics -### Trusted Boot +Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience, but not necessarily enterprise-grade authentication. -When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. +Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by Windows Hello. -If someone has modified a file (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and attempt to automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. +In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue integrating them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. -### Measured Boot +### Trusted Boot -The biggest challenge with rootkits and bootkits in earlier versions of Windows was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution—and they had system-level privileges—rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). -Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. -Measured Boot focuses on acquiring the measurement data and protecting it against tampering. You must couple it, however, with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. +UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the device, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. -### Device health attestation +When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (e.g., signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. -Device health attestation is new feature in Windows 10 Mobile that helps prevent low-level malware infections. Device health attestation uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. -You can integrate Device health attestation with Microsoft Intune or non-Microsoft MDM solutions and combine these hardware-measured security properties with other device properties to gain an overall view of the device’s health and compliance state. From there, you can use this integration in a variety of scenarios, from detecting jailbroken devices to monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. +### Measured Boot -### Conditional Access +In earlier versions of Windows, the biggest challenge with rootkits and bootkits was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution – and they had system-level privileges – rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (e.g., if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). -The example that follows shows how Windows 10 protective measures integrate and work with Intune and non-Microsoft MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile helps you monitor and verify compliance and how the security and trust rooted in the device hardware protect corporate resources end to end. +Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. -When a user turns on a phone: -1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. -2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. -3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. -4. Devices that a Device health attestation-enabled MDM solution manage send a copy of this audit trail to the Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. -5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. -6. From your Device health attestation-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. -Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a Device health attestation-enabled MDM system like Intune that takes advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. +Measured Boot focuses on acquiring the measurement data and protecting it against tampering. To provide more complete security, it must be coupled with a service that can analyze the data to determine device health. -## App platform security +### Device Health Attestation -Applications built for Windows are designed to be secure and free of defects, but the reality is that human error can create vulnerabilities in code. When malicious users and software identify such vulnerabilities, they may attempt to manipulate data in memory in the hope that they can compromise the system and take control. +Device Health Attestation (DHA) is a new feature in Windows 10 Mobile that helps prevent low-level malware infections. DHA uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. -To mitigate these risks, Windows 10 Mobile includes a series of improvements to make it more difficult for malware to compromise the device. Windows 10 Mobile even enables organizations to choose which apps are allowed to run on mobile devices. In addition, it includes improvements that can dramatically reduce the likelihood that newly discovered vulnerabilities can be successful exploited. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. +You can use DHA with Microsoft Intune (sold separately) or a third-party MDM solution to combine hardware-measured security properties with other device properties and gain an overall view of the device’s health and compliance state. This integration can be useful in a variety of scenarios, including detecting jailbroken devices, monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. -### Device Guard +The example that follows shows how Windows 10 protective measures integrate and work with Intune and third-party MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile can help you monitor and verify compliance and how the security and trust rooted in the device hardware can protect end-to-end corporate resources. -Device Guard is a feature set that consists of both hardware and software system integrity-hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. +When a user turns a phone on: +1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. +2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. +3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. +4. Devices that are DHA-enabled send a copy of this audit trail to the Microsoft Health Attestation service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. +6. From your DHA-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. +Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a DHA-enabled MDM system like Intune. It can take advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. -All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app doesn’t have a digital signature or is prevented by policy, or it does not come from a trusted store, it will not run on Windows 10 Mobile. +### Device Guard -Advanced hardware features (described earlier in the [Enterprise-grade secure hardware](#secure-hardware) section) drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. +Device Guard is a feature set that consists of both hardware and software system integrity–hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. -### AppContainer +All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app does not have a digital signature, is prevented by policy, or does not come from a trusted store, it will not run on Windows 10 Mobile. -The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer—a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. +Advanced hardware features, described above, drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. -The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer. A capability is a Windows 10 Mobile device resource such as geographical location information, camera, microphone, networking, and sensors. +### Address Space Layout Randomization -A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. In addition, access to other capabilities can be declared within the app code itself. Access to additional capabilities and privileges cannot be requested at run time, as can be done with traditional desktop applications. +One of the most common techniques used by attackers to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. -The AppContainer concept is advantageous for the following reasons: - -- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. -- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. -- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communications channels and data types. - -Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. - -The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect, however, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, we need redundant vulnerability mitigations. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. - -### Address Space Layout Randomization -One of the most common techniques attackers use to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. - -Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. +Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. The below diagram illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. ![figure 3](images/mobile-security-guide-figure3.png) -Figure 3. ASLR at work +Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, applying it across the entire system rather than only in specific apps. With 64bit system and application processes that can take advantage of a vastly increased memory space, it is even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization becomes increasingly unique across devices, adding additional degrees of difficulty for repurposing successful exploits to another system. -Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, making it even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, making it even more difficult for a successful exploit that works on one system to work reliably on another. Microsoft also holistically applied ASLR across the entire system in Windows 10 Mobile rather than it working only on specific apps. +### Data Execution Prevention -### Data Execution Prevention +Malware depends on its ability to insert a malicious payload into memory with the hope that an unsuspecting user will execute it later. While ASLR makes that more difficult, Windows 10 Mobile extends that protection to prevent malware from running if written to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) substantially reduces the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read-only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. -Malware depends on its ability to put a malicious payload into memory with the hope that an unsuspecting user will execute it later. ASLR makes that much more difficult. - -Extending that protection, it would be great if you could prevent malware from running if it wrote to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) does exactly that, substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. - -### Windows heap +### Windows heap The heap is a location in memory that Windows uses to store dynamic application data. Microsoft continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that an attacker could use. -Windows 10 Mobile has several important improvements to the security of the heap over previous versions of Windows: +Windows 10 Mobile has made several important improvements to the security of the heap over previous versions of Windows: +- Internal data structures that the heap uses are better protected against memory corruption. +- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, making the allocation much less predictable. +- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. -- Internal data structures that the heap uses are better protected against memory corruption. -- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. -- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. +### Memory reservations -### Memory reservations +Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, making it more difficult for malware to overwrite critical system data structures in memory. -Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. +### Control Flow Guard -### Control Flow Guard +When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known – they are written in the code itself. However, until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. -When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known—they are written in the code itself—but until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. -Windows 10 Mobile mitigates this kind of threat through the Control Flow Guard (CFG) feature. When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. +Windows 10 Mobile mitigates this kind of threat through Control Flow Guard (CFG). When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. -You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge and other Windows features take full advantage of CFG. +You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Because browsers are a key entry point for attacks, Microsoft Edge takes full advantage of CFG. -### Protected processes +### Protected Processes -In general, preventing a computer security incident is more cost-effective than repairing the damage an incident can cause. For malware in particular, most security controls are designed to prevent an attack from being initially successful. The reasoning is that if malware cannot infect the system, the system is immune to malware. +Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, additional malware controls are required. +If malware is running on a system, you need to limit what it can do Protected Processes prevents untrusted processes from tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes broadly throughout the operating system. -Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, it cannot be the only type of malware control. +### AppContainer -The key security scenario is to assume that malware is running on a system but limit what it can do. Windows 10 Mobile has security controls and design features in place to reduce compromise from existing malware infections. Protected Processes is one such feature. +The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer – a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. -With Protected Processes, Windows 10 Mobile prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes more broadly across the operating system. +The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer, such as geographical location information, camera, microphone, networking, or sensors. -### Store for Business +A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. Access to other capabilities can be declared within the app code itself. Unlike traditional desktop applications, access to additional capabilities and privileges cannot be requested at run time. -Store for Business allows IT pros to find, acquire, distribute, and manage apps for their organization. The model provides flexible ways to distribute apps, depending on the size of your organization, and does not require additional infrastructure in some scenarios. +The AppContainer concept is advantageous because it provides: +- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. +- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. +- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communication channels and data types. -UWP apps are inherently more secure than typical applications because they are sandboxed, which restricts the app’s risk of compromise or tampering with in a way that would put the system, data, and other applications at risk. Windows Store can further reduce the likelihood that malware will infect devices by reviewing all applications that enter the Windows Store ecosystem before making them available. Store for Business extends this concept by enabling you to distribute custom LOB apps, and even some Windows Store apps, to Windows 10 Mobile devices through the same Windows Store infrastructure. +Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. -Regardless of how users acquire UWP apps, they can use them with increased confidence. UWP apps run in an AppContainer sandbox with limited privileges and capabilities. For example, the apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. +The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect. However, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, redundant vulnerability mitigations are needed. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. -In addition, all UWP apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is significantly limited and should be contained within the sandbox. Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. +### Microsoft Edge -The Windows Store app-distribution process and the app sandboxing capabilities of Windows 10 Mobile can dramatically reduce the likelihood that users encounter malicious apps on the system. +The web browser is a critical component of any security strategy. It is the user’s interface to the Internet, an environment teeming with malicious sites and potentially dangerous content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. -For more information about Store for Business, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). +Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: +- **Microsoft Edge on Windows 10 Mobile does not support extensions.** Microsoft Edge has built-in PDF viewing capability. +- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. +- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. -### App management +## Summary -An enterprise typically exerts some configuration and control over the apps installed on devices. In this way, the organization accomplishes several business goals, such managing software licenses, ensuring mandatory app deployment on required devices, and preventing the installation of unacceptable apps on corporate devices. +Windows 10 Mobile provides security on personal and corporate-owned devices to protect against unauthorized access, data leakage, and malware threats. All of the features covered in this paper – multifactor authentication, data separation, and malware resistance – are seamlessly incorporated into the operating system. This means enterprises are protected without compromising the productivity and ease of use that drives users to bring mobile devices into the workplace. -An important component in delivering on these goals is Store for Business, which builds on the Windows Store infrastructure that Microsoft hosts and enables you to deploy Windows Store apps across your Windows 10-based devices. Store for Business is both powerful and highly flexible. It allows you to extend and customize features without having to stand up new on-premises infrastructure. It supports and integrates with your existing MDM service but doesn’t require one. (Ask your MDM service vendor about integration with Store for Business.) You can configure Store for Business for a wide variety of scenarios, including online and offline licensing and different app-distribution options. For a more detailed description of the available Store for Business scenarios, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). +## Revision History -A web-based portal for IT pros simplifies Windows 10 Mobile app deployment. The familiar look of Windows Store was used to design the Store for Business experience. It showcases apps relevant to business use, hand-selected and sorted by category. The store can use Azure AD accounts for all users, linking them to a single, unique organizational identity. +November 2015 Updated for Windows 10 Mobile (version 1511) -Another key benefit is licensing. Store for Business enables you to track and manage licenses for all UWP apps. You can easily determine which users have installed specific apps, track remaining licenses left, and acquire new licenses directly through the web interface. Those new licenses are added within Store for Business and do not require complex export and import processes. As long as your clients are online and have Internet connectivity, the licensing scenario with Store for Business is a great improvement over manual licensing tasks. +July 2016 Updated for Windows 10 Mobile Anniversary Update (version 1607) -Store for Business allows you to find the right apps for your users, acquire them, manage app licenses, and distribute apps to individuals. The best way to understand Store for Business is to look at the steps involved in a common scenario: delivering apps to Windows 10 Mobile users without an MDM—specifically, deploying apps to Windows 10 Mobile users. In this scenario, you identify several apps that must be on each mobile device that are currently available for free in the Windows Store (for example, a VPN app for your Dell SonicWALL solution) and some internally developed LOB apps. - -### The IT side - -You begin the app deployment process by preparing the private store and the apps before your users receive their new Windows 10 Mobile devices. - -First, you open [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) and use an Azure AD account to log in. This account is linked to the company’s unique organizational identity and must have an Azure AD tenant. In addition, the account must have Azure AD Enterprise Admin permissions if this is the first time you’re using Store for Business. You can delegate later access through permissions within Store for Business. -Next, you locate and acquire any apps you want to deploy to the mobile devices, adding the apps and licenses to the organization’s inventory. - -Along with existing Windows Store apps, you can use Store for Business to manage custom LOB apps that are developed for your organization. First, you grant permission for a trusted app developer to submit the apps. You and the developer submit these apps through the [Windows Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=722911), and they must be digitally signed with a trusted certificate. These apps are not published to the retail Windows Store catalog and are not visible to anyone outside the organization. - -You can deliver the apps through a private store within Windows Store. The next step, then, is for you to mark the app to be available in the private store, which you do through the Store for Business web portal. - -Alternatively, you can choose one of two other app-distribution options in Store for Business web portal: -- Assign the app to people in your organization by selecting one or more Azure AD identities -- Add the app to the organization’s private store, and allow all users to discover and install it. -For details about app distribution, see [Distribute apps using your private store](../manage/distribute-apps-from-your-private-store.md). - -The IT process for preparing Store for Business for app deployment is shown in Figure 4. - -![figure 4](images/mobile-security-guide-figure4.png) - -Figure 4. The IT process for Store for Business - -For details about the process of distributing apps through Store for Business, see [Find and acquire apps](../manage/find-and-acquire-apps-overview.md). - -### The user side - -After you have prepared Store for Business, the user side of the process takes over. This side of the process is designed to be user friendly, with the primary app deployment method—through Store for Business—streamlined and straightforward. This process doesn’t require an MDM system or any on-premises infrastructure. In fact, the user never sees the “for Business” label, just the familiar Windows Store. - -1. The user opens the Windows Store app on his or her Windows 10 Mobile device. - -2. The same Windows Store interface appears, with the addition of the private store you created. The private store appears as a new page, similar to Games and Music. The interface integrates the public Windows Store with the organization’s private store, which contains curated apps. - -3. The user simply selects and installs apps as usual. - -If the user wants to make a private purchase of apps, music, movies, or TV shows with his or her Microsoft account, that’s an option, as well. The user pays for and owns his or her purchase, independent of the company. This flexibility enables hybrid scenarios for devices in many bring your own device environments. - -### Microsoft Edge - -Windows 10 Mobile includes critical improvements designed to thwart attacks and malware. The environment is now more resistant to malware thanks to significant improvements to SmartScreen Filters. Internet browsing is a safer experience thanks to Microsoft Edge, a completely new browser. - -Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: -- **Microsoft Edge does not support non-Microsoft binary extensions.** Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions but includes no non-Microsoft binary extensions, such as ActiveX controls or Java. -- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. -- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. - -The web browser is a critical component of any security strategy, and for good reason: it is the user’s interface to the Internet, an environment teeming with malicious sites and nefarious content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. - -## Related topics - - -[Windows 10 security overview](windows-10-security-guide.md) - -[Windows 10 Mobile and MDM](../manage/windows-10-mobile-and-mdm.md) - -[Windows 10 and Windows 10 Mobile](../index.md) - -[Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) - -[Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md) diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 6a822ec11e..5ad7eddc7a 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -18,14 +18,14 @@ author: challum This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. Wherever possible, specific recommendations are provided to help you implement and configure Windows 10 security features. -## Introduction +#### Introduction Windows 10 is designed to protect against known and emerging security threats across the spectrum of attack vectors. Three broad categories of security work went into Windows 10: - [**Identity and access control**](#identity) features have been greatly expanded to both simplify and enhance the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). Another new feature is Credential Guard, which uses virtualization-based security (VBS) to help protect the Windows authentication subsystems and users’ credentials. - [**Information protection**](#information) that guards information at rest, in use, and in transit. In addition to BitLocker and BitLocker To Go for protection of data at rest, Windows 10 includes file-level encryption with Enterprise Data Protection that performs data separation and containment and, when combined with Rights Management services, can keep data encrypted when it leaves the corporate network. Windows 10 can also help keep data secure by using virtual private networks (VPNs) and Internet Protocol Security. - [**Malware resistance**](#malware) includes architectural changes that can isolate critical system and security components from threats. Several new features in Windows 10 help reduce the threat of malware, including VBS, Device Guard, Microsoft Edge, and an entirely new version of Windows Defender. In addition, the many antimalware features from the Windows 8.1 operating system— including AppContainers for application sandboxing and numerous boot-protection features, such as Trusted Boot—have been carried forward and improved in Windows 10. -## Identity and access control +## Identity and access control Traditionally, access control is a process that has three components: - **Identification** - when a user asserts a unique identity to the computer system for the purpose of gaining access to a resource, such as a file or a printer. In some definitions, the user is called the subject and the resource is the object. @@ -74,14 +74,14 @@ Table 1. Windows 10 solutions to typical access control challenges   The sections that follow describe these challenges and solutions in more detail. -**Microsoft Passport** +### Microsoft Passport Microsoft Passport provides strong two-factor authentication (2FA), fully integrated into Windows, and replaces passwords with the combination of an enrolled device and either a PIN or Windows Hello. Microsoft Passport is conceptually similar to smart cards but more flexible. Authentication is performed by using an asymmetric key pair instead of a string comparison (for example, password), and the user’s key material can be secured by using hardware. Unlike smart cards, Microsoft Passport does not require the extra infrastructure components required for smart card deployment. In particular, you do not need public key infrastructure (PKI). If you already use PKI – for example, in secure email or VPN authentication – you can use the existing infrastructure with Microsoft Passport. Microsoft Passport combines the major advantages of smart card technology – deployment flexibility for virtual smart cards and robust security for physical smart cards – without any of their drawbacks. Microsoft Passport offers three significant advantages over the current state of Windows authentication: It’s more flexible, it’s based on industry standards, and it effectively mitigates risks. The sections that follow look at each of these advantages in more detail. -**It’s flexible** +#### It’s flexible Microsoft Passport offers unprecedented flexibility. Although the format and use of passwords and smart cards is fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with biometric sensors and PINs. Next, you can use your PC or even your phone as one of the factors to authenticate on your PC. Finally, your user credentials can come from your PKI infrastructure, or Windows can create the credential itself. @@ -89,21 +89,19 @@ Microsoft Passport gives you options beyond long, complex passwords. Instead of With Microsoft Passport, you gain flexibility in the data center, too. To deploy it, you must add Windows Server 2016 domain controllers to your Active Directory environment, but you do not have to replace or remove your existing Active Directory servers: Microsoft Passport builds on and adds to your existing infrastructure. You can either add on premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport to your network. The choice of which users to enable for Microsoft Passport use is completely up to you – you choose which items to protect and which authentication factors you want to support. This flexibility makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding 2FA to users who do not currently have it, or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems. -**It’s standardized** +#### It’s standardized Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: The future lies with open, interoperable systems that allow secure authentication across a variety of devices, line of business (LOB) apps, and external applications and websites. To this end, a group of industry players formed FIDO, the Fast IDentity Online Alliance. The FIDO Alliance is a nonprofit organization intended to address the lack of interoperability among strong authentication devices, as well as the problems users face when they need to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. -In 2014, Microsoft joined the board of the [FIDO Alliance](http://go.microsoft.com/fwlink/p/?LinkId=626934). FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards, and of course, on new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. +In 2014, Microsoft joined the board of the [FIDO Alliance](https://go.microsoft.com/fwlink/p/?LinkId=626934). FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards, and of course, on new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. -**It’s effective** +#### It’s effective Microsoft Passport effectively mitigates two major security risks. First, it eliminates the use of passwords for logon and so reduces the risk that a nefarious attacker will steal and reuse the user’s credentials. User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Second, because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. This sets the bar magnitudes of order higher than password phishing attacks. -### - -**Windows Hello** +### Windows Hello Windows Hello is the name given to the new biometric sign-in option for Microsoft Passport. Because biometric authentication is built directly into the operating system, Windows Hello allows users to unlock their devices by using their face or fingerprint. From here, authentication to the devices and resources is enabled through a combination of the user’s unique biometric identifier and the device itself. @@ -117,7 +115,7 @@ Windows Hello supports two biometric sensor options that are suitable for enterp Windows Hello offers several major benefits. First, it addresses the problems of credential theft and sharing, because an attacker must obtain the device and impersonate the user’s biometric identity, which is more difficult than stealing a password or PIN. Second, the use of biometrics gives users an authenticator that’s always with them – there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for logging in to all their Windows devices. Finally, there’s nothing additional to deploy or manage. Because Windows Hello support is built directly into the operating system, there are no additional drivers to deploy. -**Brute-force attack resistance** +### Brute-force attack resistance A brute-force attack is the process used to break into a device simply by guessing a user’s password, PIN, or even his or her biometric identity over and over until the attacker gets it right. Over the last several versions of Windows, Microsoft has added features that dramatically reduce the chances that such an attack would succeed. @@ -126,7 +124,7 @@ Windows 8.1 and Windows 10 support an even more powerful – but optional – If you’re interested in learning how to configure brute-force protection, use a test Windows 10 PC on which BitLocker protection is enabled for the system drive, and then print the BitLocker recovery key to ensure that you have it available. Then, open the Local Group Policy Editor by running **gpedit.msc**, and go to Computer Configuration\\Windows Settings\\Security Settings\\Security Options. Open the policy **Interactive Login: Machine Account Lockout Threshold**, and set the value to **5**, as shown in Figure 1. -![figure 1](images/security-fig1-invalidaccess.png) +![Machine lockout threshold](images/security-fig1-invalidaccess.png "Machine lockout threshold") Figure 1. Set the number of invalid access attempts prior to lockout @@ -188,92 +186,105 @@ Table 2. Data Protection in Windows 10 and Windows 7 -  + The sections that follow describe these improvements in more detail. -**Prepare for drive and file encryption** +### Prepare for drive and file encryption The best type of security measures are transparent to the user during implementation and use. Every time there is a possible delay or difficulty because of a security feature, there is strong likelihood that users will try to bypass security. This situation is especially true for data protection, and that’s a scenario that organizations need to avoid. Whether you’re planning to encrypt entire volumes, removable devices, or individual files, Windows 10 meets your needs by providing streamlined, usable solutions. In fact, you can take several steps in advance to prepare for data encryption and make the deployment quick and smooth. -**TPM pre-provisioning** +#### TPM pre-provisioning In Windows 7, preparing the TPM for use offered a couple of challenges: -- You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. -- When you enable the TPM, it may require one or more restarts. + +* You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. +* When you enable the TPM, it may require one or more restarts. + Basically, it was a big hassle. If IT staff were provisioning new PCs, they could handle all of this, but if you wanted to add BitLocker to devices that were already in users’ hands, those users would have struggled with the technical challenges and would either call IT for support or simply leave BitLocker disabled. + Microsoft includes instrumentation in Windows 10 that enables the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated. -**Deploy hard drive encryption** +### Deploy hard drive encryption BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 10. -**Device encryption** +#### Device encryption Beginning in Windows 8.1, Windows automatically enables BitLocker device encryption on devices that support InstantGo. With Windows 10, Microsoft offers device encryption support on a much broader range of devices, including those that are InstantGo. Microsoft expects that most devices in the future will pass the testing requirements, which makes device encryption pervasive across modern Windows devices. Device encryption further protects the system by transparently implementing device-wide data encryption. Unlike a standard BitLocker implementation, device encryption is enabled automatically so that the device is always protected. The following list outlines how this happens: -- When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). -- If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. -- If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. -- Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. + +* When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). +* If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. +* If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. +* Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. + Microsoft recommends that device encryption be enabled on any systems that support it, but the automatic device encryption process can be prevented by changing the following registry setting: -- **Subkey**: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker -- **Value**: PreventDeviceEncryption equal to True (1) -- **Type**: REG\_DWORD +- **Subkey**: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker +- **Value**: PreventDeviceEncryption equal to True (1) +- **Type**: REG\_DWORD + Administrators can manage domain-joined devices that have device encryption enabled through Microsoft BitLocker Administration and Monitoring (MBAM). In this case, device encryption automatically makes additional BitLocker options available. No conversion or encryption is required, and MBAM can manage the full BitLocker policy set if any configuration changes are required. -**Used Disk Space Only encryption** +#### Used Disk Space Only encryption BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted, in which case traces of the confidential data could remain on portions of the drive marked as unused. But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 10 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. Exercise caution when encrypting only used space on an existing volume on which confidential data may have already been stored in an unencrypted state, however, because those sectors can be recovered through disk-recovery tools until they are overwritten by new encrypted data. In contrast, encrypting only used space on a brand-new volume can significantly decrease deployment time without the security risk because all new data will be encrypted as it is written to the disk. -**Encrypted hard drive support** +#### Encrypted hard drive support SEDs have been available for years, but Microsoft couldn’t support their use with some earlier versions of Windows because the drives lacked important key management features. Microsoft worked with storage vendors to improve the hardware capabilities, and now BitLocker supports the next generation of SEDs, which are called encrypted hard drives. Encrypted hard drives provide onboard cryptographic capabilities to encrypt data on drives, which improves both drive and system performance by offloading cryptographic calculations from the PC’s processor to the drive itself and rapidly encrypting the drive by using dedicated, purpose-built hardware. If you plan to use whole-drive encryption with Windows 10, Microsoft recommends that you investigate hard drive manufacturers and models to determine whether any of their encrypted hard drives meet your security and budget requirements. -For more information about encrypted hard drives, see [Encrypted Hard Drive](http://go.microsoft.com/fwlink/p/?LinkId=733880). +For more information about encrypted hard drives, see [Encrypted Hard Drive](https://go.microsoft.com/fwlink/p/?LinkId=733880). -**Preboot information protection** +### Preboot information protection An effective information protection implementation, like most security controls, considers usability as well as security. Users typically prefer a simple security experience. In fact, the more transparent a security solution becomes, the more likely users are to conform to it. It is crucial that organizations protect information on their PCs regardless of the state of the computer or the intent of users. This protection should not be cumbersome to users. One undesirable and previously commonplace situation is when the user is prompted for input during preboot, and then again during Windows logon. Challenging users for input more than once should be avoided. Windows 10 can enable a true SSO experience from the preboot environment on modern devices and in some cases even on older devices when robust information protection configurations are in place. The TPM in isolation is able to securely protect the BitLocker encryption key while it is at rest, and it can securely unlock the operating system drive. When the key is in use and thus in memory, a combination of hardware and Windows capabilities can secure the key and prevent unauthorized access through cold-boot attacks. Although other countermeasures like PIN-based unlock are available, they are not as user-friendly; depending on the devices’ configuration they may not offer additional security when it comes to key protection. For more information about how to configure BitLocker for SSO, see [BitLocker Countermeasures](bitlocker-countermeasures.md). -**Manage passwords and PINs** +### Manage passwords and PINs When BitLocker is enabled on a system drive and the PC has a TPM, you can choose to require that users type a PIN before BitLocker will unlock the drive. Such a PIN requirement can prevent an attacker who has physical access to a PC from even getting to the Windows logon, which makes it virtually impossible for the attacker to access or modify user data and system files. + Requiring a PIN at startup is a useful security feature because it acts as a second authentication factor (a second “something you know”). This configuration comes with some costs, however. One of the most significant is the need to change the PIN regularly. In enterprises that used BitLocker with Windows 7 and the Windows Vista operating system, users had to contact systems administrators to update their BitLocker PIN or password. This requirement not only increased management costs but made users less willing to change their BitLocker PIN or password on a regular basis. Windows 10 users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this feature reduce support costs, but it could improve security, too, because it encourages users to change their PINs and passwords more often. In addition, InstantGo devices do not require a PIN for startup: They are designed to start infrequently and have other mitigations in place that further reduce the attack surface of the system. For more information about how startup security works and the countermeasures that Windows 10 provides, see [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md). -**Configure Network Unlock** +### Configure Network Unlock Some organizations have location-specific data security requirements. This is most common in environments where high-value data is stored on PCs. The network environment may provide crucial data protection and enforce mandatory authentication; therefore, policy states that those PCs should not leave the building or be disconnected from the corporate network. Safeguards like physical security locks and geofencing may help enforce this policy as reactive controls. Beyond these, a proactive security control that grants data access only when the PC is connected to the corporate network is necessary. Network Unlock enables BitLocker-protected PCs to start automatically when connected to a wired corporate network on which Windows Deployment Services runs. Anytime the PC is not connected to the corporate network, a user must type a PIN to unlock the drive (if PIN-based unlock is enabled). Network Unlock requires the following infrastructure: -- Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) -- A server running Windows Server 2012 with the Windows Deployment Services role -- A server with the DHCP server role installed -For more information about how to configure Network Unlock, see [BitLocker: How to enable Network Unlock](http://go.microsoft.com/fwlink/p/?LinkId=733905). -**Microsoft BitLocker Administration and Monitoring** -Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: -- Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. -- Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. -- Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. -- Reduces the workload on the help desk to assist end users with BitLocker recovery requests. -- Enables end users to recover encrypted devices independently by using the Self-Service Portal. -- Enables security officers to easily audit access to recovery key information. -- Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. -- Enforces the BitLocker encryption policy options that you set for your enterprise. -- Integrates with existing management tools, such as System Center Configuration Manager. -- Offers an IT-customizable recovery user experience. -- Supports Windows 10. -For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](http://go.microsoft.com/fwlink/p/?LinkId=626935) on the MDOP TechCenter. +* Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) +* A server running Windows Server 2012 with the Windows Deployment Services role +* A server with the DHCP server role installed + +For more information about how to configure Network Unlock, see [BitLocker: How to enable Network Unlock](https://go.microsoft.com/fwlink/p/?LinkId=733905). + +### Microsoft BitLocker Administration and Monitoring + +>>>>>>> refs/remotes/origin/master +Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: + +* Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. +* Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. +* Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. +* Reduces the workload on the help desk to assist end users with BitLocker recovery requests. +* Enables end users to recover encrypted devices independently by using the Self-Service Portal. +* Enables security officers to easily audit access to recovery key information. +* Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. +* Enforces the BitLocker encryption policy options that you set for your enterprise. +* Integrates with existing management tools, such as System Center Configuration Manager. +* Offers an IT-customizable recovery user experience. +* Supports Windows 10. + +For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](https://go.microsoft.com/fwlink/p/?LinkId=626935) on the MDOP TechCenter. ## Malware resistance @@ -340,19 +351,21 @@ In Windows 10 and Windows Server 2016, client connections to the Active Director This change reduces the likelihood of man-in-the-middle attacks. - **What works differently?** If SMB signing and mutual authentication are unavailable, a Windows 10 or Windows Server 2016 computer won’t process domain-based Group Policy and scripts. -> **Note:** The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. +>[!NOTE] +>The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. -For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](http://go.microsoft.com/fwlink/p/?LinkId=789216) and [MS15-011 & MS15-014: Hardening Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=789215). +For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](https://go.microsoft.com/fwlink/p/?LinkId=789216) and [MS15-011 & MS15-014: Hardening Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=789215). -**Secure hardware** +#### Secure hardware Although Windows 10 is designed to run on almost any hardware capable of running Windows 8, Windows 7, or Windows Vista, taking full advantage of Windows 10 security requires advancements in hardware-based security, including UEFI with Secure Boot, CPU virtualization features (for example, Intel VT-x), CPU memory-protection features (for example, Intel VT-d), TPM, and biometric sensors. -**UEFI with Secure Boot** +#### UEFI with Secure Boot When a PC starts, it begins the process of loading the operating system by locating the bootloader on the PC’s hard drive. Without safeguards in place, the PC may simply hand control over to the bootloader without even determining whether it is a trusted operating system or malware. UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the device. + UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection from firmware bootkits. Thus, UEFI is the first link in the chain of trust. UEFI with Secure Boot became a hardware requirement starting with Windows 8 devices. If a PC supports UEFI, it must be enabled by default. It is possible to disable the Secure Boot feature on many devices, but Microsoft strongly discourages doing so because it dramatically reduces the security of the startup process. @@ -360,32 +373,36 @@ UEFI with Secure Boot became a hardware requirement starting with Windows 8 dev When a PC with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that it has not been modified after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. All Windows 8 certified PCs must meet several requirements related to Secure Boot: -- They must have Secure Boot enabled by default. -- They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. -- They must allow the user to add signatures and hashes to the UEFI database. -- They must allow the user to completely disable Secure Boot (although administrators can restrict this). + +* They must have Secure Boot enabled by default. +* They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. +* They must allow the user to add signatures and hashes to the UEFI database. +* They must allow the user to completely disable Secure Boot (although administrators can restrict this). This behavior doesn’t limit the choice of operating system. In fact, users typically have three options for running non-Microsoft operating systems: -- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI -CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](http://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](http://go.microsoft.com/fwlink/p/?LinkId=626937). - **Note**   - PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document. -   -- **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. -- **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. +- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI +CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](https://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](https://go.microsoft.com/fwlink/p/?LinkId=626937). - **Note**   - With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device. + >[!NOTE]  + >PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document.   -Windows, apps, and even malware cannot change the UEFI configuration. Instead, users must be physically present to manually boot a PC into a UEFI shell, and then change UEFI firmware settings. For more information about UEFI Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=626938). -**Virtualization-based security** +- **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. +- **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. + +>[!NOTE]   +>With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device. +   +Windows, apps, and even malware cannot change the UEFI configuration. Instead, users must be physically present to manually boot a PC into a UEFI shell, and then change UEFI firmware settings. For more information about UEFI Secure Boot, read [Protecting the pre-OS environment with UEFI](https://go.microsoft.com/fwlink/p/?LinkId=626938). + +#### Virtualization-based security One of the most powerful changes to Windows 10 is virtual-based security. Virtual-based security (VBS) takes advantage of advances in PC virtualization to change the game when it comes to protecting system components from compromise. VBS is able to isolate some of the most sensitive security components of Windows 10. These security components aren’t just isolated through application programming interface (API) restrictions or a middle-layer: They actually run in a different virtual environment and are isolated from the Windows 10 operating system itself. VBS and the isolation it provides is accomplished through the novel use of the Hyper V hypervisor. In this case, instead of running other operating systems on top of the hypervisor as virtual guests, the hypervisor supports running the VBS environment in parallel with Windows and enforces a tightly limited set of interactions and access between the environments. Think of the VBS environment as a miniature operating system: It has its own kernel and processes. Unlike Windows, however, the VBS environment runs a micro-kernel and only two processes called trustlets: + - **Local Security Authority (LSA)** enforces Windows authentication and authorization policies. LSA is a well-known security component that has been part of Windows since 1993. Sensitive portions of LSA are isolated within the VBS environment and are protected by a new feature called Credential Guard. - **Hypervisor-enforced code integrity** verifies the integrity of kernel-mode code prior to execution. This is a part of the [Device Guard](#device-guard) feature described later in this document. VBS provides two major improvements in Windows 10 security: a new trust boundary between key Windows system components and a secure execution environment within which they run. A trust boundary between key Windows system components is enabled though the VBS environment’s use of platform virtualization to isolate the VBS environment from the Windows operating system. Running the VBS environment and Windows operating system as guests on top of Hyper-V and the processor’s virtualization extensions inherently prevents the guests from interacting with each other outside the limited and highly structured communication channels between the trustlets within the VBS environment and Windows operating system. @@ -394,23 +411,25 @@ VBS acts as a secure execution environment because the architecture inherently p The VBS architecture is illustrated in Figure 2. -![figure 2](images/security-fig2-vbsarchitecture.png) +![Example of VBS architecture](images/security-fig2-vbsarchitecture-redo.png "Example of VBS architecture") Figure 2. The VBS architecture Note that VBS requires a system that includes: -- Windows 10 Enterprise Edition -- A-64-bit processor -- UEFI with Secure Boot -- Second-Level Address Translation (SLAT) technologies (for example, Intel Extended Page Tables \[EPT\], AMD Rapid Virtualization Indexing \[RVI\]) -- Virtualization extensions (for example, Intel VT-x, AMD RVI) -- I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) -- TPM 2.0 -**Trusted Platform Module** +* Windows 10 Enterprise Edition +* A 64-bit processor +* UEFI with Secure Boot +* Second-Level Address Translation (SLAT) technologies (for example, Intel Extended Page Tables \[EPT\], AMD Rapid Virtualization Indexing \[RVI\]) +* Virtualization extensions (for example, Intel VT-x, AMD RVI) +* I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) +* TPM 2.0 + +#### Trusted Platform Module A TPM is a tamper-resistant cryptographic module designed to enhance the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a personal computer, tablet, or phone. The computing platform is specially designed to work with the TPM to support privacy and security scenarios that cannot be achieved through software alone. A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, a key created in a TPM with the property that it can never be exported from the TPM really means the key cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. The functionality a TPM provides includes: + - **Cryptographic key management.** Create, store, and permit the use of keys in defined ways. - **Safeguarding and reporting integrity measurements.** Software used to boot the platform can be recorded in the TPM and used to establish trust in the software running on the platform. - **Prove a TPM is really a TPM.** The TPM’s capabilities are so central to protecting privacy and security that a TPM needs to be able to differentiate itself from malware that masquerades as a TPM. @@ -418,95 +437,112 @@ The functionality a TPM provides includes: Microsoft combined this small list of TPM benefits with Windows 10 and other hardware security technologies to provide practical security and privacy benefits. Among other functions, Windows 10 uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and the many other keys that the TPM is used to generate. Windows 10 also uses the TPM to securely record and protect integrity-related measurements of select hardware and Windows boot components for the [Measured Boot](#measure-boot) feature described later in this document. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the PC’s TPM. From there, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 PC. + Windows 10 supports TPM implementations that comply with either the 1.2 or 2.0 standards. Several improvements have been made in the TPM 2.0 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard was created in the early 2000s, these algorithms were considered cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that may be preferred in certain geographies or industries. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. TPM is usually assumed to be implanted in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 supports both discrete and firmware TPM that complies with the 2.0 standard (1.2 can only be discrete). Windows does not differentiate between discrete and firmware-based solutions because they must meet the same requirements; therefore, any Windows feature that can take advantage of TPM can use either implementation. -**Note**   -Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage. +>[!NOTE]  +>Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage.   Several Windows 10 security features require TPM: -- Virtual smart cards -- Measured Boot -- Health attestation (requires TPM 2.0 or later) -- InstantGo (requires TPM 2.0 or later) +* Virtual smart cards +* Measured Boot +* Health attestation (requires TPM 2.0 or later) +* InstantGo (requires TPM 2.0 or later) Other Windows 10 security features like BitLocker may take advantage of TPM if it is available but do not require it to work. An example of this is Microsoft Passport. All of these features are covered in this document. -**Biometrics** +#### Biometrics You read in the [Windows Hello](#windows-hello) section of this document that Windows 10 has built-in support for biometric hardware. Windows has included some amount of built-in biometric support since the Windows XP operating system, so what’s different about this in Windows 10? + Windows 10 makes biometrics a core security feature. Biometrics is fully integrated into the Windows 10 security components, not just tacked on as an extra part of a larger scheme. This is a big change. Earlier biometric implementations were largely front-end methods to simplify authentication. Under the hood, biometrics was used to access a password, which was then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. + Microsoft has evangelized the importance of enterprise-grade biometric sensors to the OEMs that create Windows PCs and peripherals. Many OEMs already ship systems that have integrated fingerprint sensors and are transitioning from swipe-based to touch-based sensors. Facial-recognition sensors were already available when Windows 10 launched and are becoming more commonplace as integrated system components. + In the future, Microsoft expects OEMs to produce even more enterprise-grade biometric sensors and to continue to integrate them into systems as well as provide separate peripherals. As a result, biometrics will become a commonplace authentication method as part of an MFA system. -**Secure Windows startup** +#### Secure Windows startup UEFI Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. -**Trusted Boot** +#### Trusted Boot When UEFI Secure Boot verifies that the bootloader is trusted and starts Windows, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM component. + If a file has been modified (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. -**Early Launch Antimalware** +#### Early Launch Antimalware Malware that targeted previous versions of Windows often attempted to start before the antimalware solution. To do this, some types of malware would update or replace a non-Microsoft–related driver that starts during the Windows startup process. The malicious driver would then use its system access privileges to modify critical parts of the system and disguise its presence so it could not be detected when the antimalware solution later started. + Early Launch Antimalware (ELAM) is part of the Trusted Boot feature set and is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures; doing so would delay startup too much. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete. + The design is simple but effective. ELAM is a component of a full-featured antimalware solution, and it helps prevent malicious drivers and apps from starting before the rest of the antimalware solution starts later during the boot process. Indeed, ELAM runs only for a few seconds each time a PC starts. Windows Defender in Windows 10 supports ELAM, as does Microsoft System Center 2012 Endpoint Protection and several non-Microsoft antimalware apps. + If you want to learn how to configure ELAM, you can use Group Policy settings to configure how ELAM responds to potentially malicious boot drivers. In the Group Policy Management Editor, go to Computer Configuration\\Administrative Templates\\System\\Early Launch Antimalware, and enable the **Boot-Start Driver Initialization Policy** setting. Now, you can select which driver classifications ELAM loads. When you select the **Good Only** setting, it provides the highest level of security, but test it thoroughly to ensure that it does not prevent users with healthy PCs from starting. -### - -**Measured Boot** +#### Measured Boot The biggest challenge with rootkits and bootkits in earlier versions of Windows is that they can frequently be undetectable to the client. Because they often start before Windows defenses and the antimalware solution and they have system-level privileges, rootkits and bootkits can completely disguise themselves while continuing to access system resources. Although UEFI Secure Boot and Trusted Boot can prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if UEFI with Secure Boot is disabled or if the signature used to sign a boot component, such as a non-Microsoft driver, has been compromised and is used to sign a malicious one). + Windows 10 implements the Measured Boot feature, which uses the TPM hardware component built into newer PCs to record a series of measurements for critical startup-related components, including firmware, Windows boot components, drivers, and even the ELAM driver. Because Measured Boot leverages the hardware-based security capabilities of TPM, which isolates and protects the measurement data from malware attacks, the log data is well protected against even sophisticated attacks. Measured Boot focuses on acquiring the measurement data and protecting it from tampering. It must be coupled with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. -**Verify device compliance for conditional access to corporate resources** +#### Verify device compliance for conditional access to corporate resources Measured Boot itself does not prevent malware from loading during the startup process – that is the job of Secure Boot, Device Guard, and ELAM. Instead, Measured Boot provides a TPM-protected audit log that allows a trusted remote health attestation service to evaluate the PC’s startup components, state, and overall configuration. If the health attestation service detects that the PC loaded an untrustworthy component and is therefore out of compliance, the service can block the PC’s access to specific network resources or the entire network. You can even couple a health attestation service with a management system to facilitate conditional access capabilities that can initiate the quarantine and remediation processes to fix an infected PC and return it to a compliant state. -![figure 3](images/security-fig3-healthattestation.png) +![Health Attestation in Windows 10](images/security-fig3-healthattestation.png "Health Attestation in Windows 10") Figure 3. Health Attestation in Windows 10 Figure 3 illustrates the following process for device compliance verification and conditional access implementation: 1. The PC uses the TPM to record measurements of the bootloader, boot drivers, and ELAM driver. The TPM prevents anyone from tampering with these measurements, so even if malware is successfully loaded, it will not be able to modify the measurements. These measurements are signed with an Attestation Identity Key (AIK) that is stored in the TPM. Because the TPM hardware has signed the measurements, malware cannot modify them without being detected. + 2. Health Attestation is not enabled by default and requires an enrollment with a mobile device management (MDM) server in order to enable it. If it is enabled, the health attestation client will contact a remote server, called a health attestation server. Microsoft provides a cloud-based Windows Health Attestation service that can help evaluate the health of a device. The health attestation client sends the signed measurements, the device’s TPM boot log, and an AIK certificate (if present), which lets the health attestation server verify that the key used to sign the measurements was issued to a trusted TPM. + 3. The health attestation server analyzes the measurements and boot log and creates a statement of device health. This statement is encrypted to help ensure the confidentiality of the data. + 4. A management system, such as an MDM server, can request that an enrolled device present a statement of device health. Windows 10 supports both Microsoft and non-Microsoft MDM server requests for device health. To prevent theft of device health statements and reuse from other devices, an MDM server sends the enrolled device a “number used only once” (nonce) request along with this request for the device health statement. + 5. The enrolled device digitally signs the nonce with its AIK (which is stored in the TPM) and sends the MDM server the encrypted statement of device health, the digitally signed nonce, and a signed boot counter, which asserts that the device has not been restarted since it obtained the statement of health. + 6. The MDM server can send the same data to the health attestation server. The server decrypts the statement of health, asserts that the boot counter in the statement matches the boot counter that was sent to the MDM server, and compiles a list of health attributes. + 7. The health attestation server sends this list of health attributes back to the MDM server. The MDM server now enforces access and compliance policies if configured to do so. + For a list of data points that the health attestation server verifies, along with a description of the data, see the [HealthAttestation CSP article on MSDN](http://go.microsoft.com/fwlink/p/?LinkId=626940). + The management system’s implementation determines which attributes within the statement of device health are evaluated when assessing a device’s health. Broadly speaking, the management server receives information about how the device booted, what kind of policy is enforced on the device, and how data on the device is secured. Depending on the implementation, the management server may add checks that go beyond what the statement of device health provides—for example, Windows patch level and other device attributes. + Based on these data points, the management server can determine whether the client is healthy and grant it access to either a limited quarantine network or to the full network. Individual network resources, such as servers, can also grant or deny access based on whether the remote attestation client were able to retrieve a valid health certification from the remote attestation server. + Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider the implementation of a management system, like Microsoft Intune, or any management solutions that take advantage of the Windows 10 cloud-based Health Attestation Server feature to detect and block devices that have been infected with advanced malware from network resources. -## Secure the Windows core +### Secure the Windows core Applications built for Windows are designed to be secure and free of defects, but the reality is that as long as human beings are writing code, vulnerabilities will continue to crop up. When identified, malicious users and software may attempt to exploit vulnerabilities by manipulating data in memory in the hope that they can bootstrap a successful exploit. + To mitigate these risks, Windows 10 includes core improvements to make it more difficult for malware to perform buffer overflow, heap spraying, and other low-level attacks and even which code is allowed to run on the PC. In addition, these improvements dramatically reduce the likelihood that newly discovered vulnerabilities result in a successful exploit. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. -### - -**Device Guard** +#### Device Guard Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation resulting in financial loss. Many of these nefarious attackers are sponsored by nation states that have ulterior motives and large cyber-terrorism budgets. These threats can enter a company through something as simple as an email and can permanently damage the organization’s reputation for securing employee and customer data and intellectual property, not to mention having a significant financial impact. The Windows 10 operating system introduces several new security features that help mitigate a large percentage of today’s known threats. It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until antimalware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already occurred. This signature-based system focuses on reacting to an infection and then ensuring that that particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer has often already been infected. The time between detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. In addition to antimalware solutions, “app control” or “whitelisting” technologies are available, including AppLocker. These perform single-instance or blanket allow or deny rules for running applications. In Windows 10, these types of solutions are most effective when deployed alongside the Windows 10 Device Guard feature. + Device Guard breaks the current model of detection first-block later and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model will provide Windows clients with the necessary security for modern threats and, when implemented, mitigates many of today’s threats from day one. -**Device Guard overview** +#### Device Guard overview Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new VBS options to protect the system core and the processes and drivers running in kernel mode—the trust-nothing model you see in mobile device operating systems. A key feature used with Device Guard is *configurable code integrity*, which allows your organization to choose exactly which software from trusted software publishers is allowed to run code on your client machines—exactly what has made mobile phone security on some platforms, such as Windows Mobile, so successful. Trusted applications are those signed directly (in other words, binaries) or indirectly by using a signed file that lists the hash values for application binaries that are considered trustworthy. In addition, Device Guard offers organizations a way to sign existing LOB applications so that they can trust their own code without the requirement that the application be rebuilt or packaged. Also, this same method of signing can provide organizations a way to trust non-Microsoft applications, including those that may not have been signed directly. Device Guard with configurable code integrity, Credential Guard, and AppLocker present the most complete security defense that any Microsoft product has ever been able to offer a Windows client. @@ -526,7 +562,7 @@ To deliver this additional security, Device Guard has the following hardware and Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. -**Configurable code integrity** +#### Configurable code integrity The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application running in user mode needs additional memory, the user mode process must request the resources from the kernel, not directly from RAM. @@ -534,33 +570,32 @@ Code integrity is the component of the Windows operating system that verifies th Historically, most malware has been unsigned. Simply by deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for the vast majority of current attacks. By using code integrity policies, an enterprise can also select exactly which binaries are allowed to run in both user mode and kernel mode based on the signer, binary hash, or both. When completely enforced, it makes user mode in Windows function like some mobile platforms, trusting and running only specific applications or specific signatures. This feature alone fundamentally changes security in an enterprise. This additional security is *not* limited to Windows apps and does *not* require an application rewrite to be compatible with your existing and possibly unsigned applications. You can run configurable code integrity independent of Device Guard, thus making it available to devices that don’t meet Device Guard hardware requirements. -**Hardware security features and VBS** +#### Hardware security features and VBS The core functionality and protection of Device Guard starts at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel VT x and AMD V, will be able to take advantage of a VBS environment that dramatically enhances Windows security by isolating critical Windows services from the operating system itself. This isolation is necessary, because you must assume that the operating system kernel will be compromised, and you need assurance that some processes will remain secure. -Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to protect all kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can’t happen in the first place. +Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can't happen in the first place. + Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dgwithcg) section. -**Device Guard with AppLocker** +#### Device Guard with AppLocker Although AppLocker is not considered a new Device Guard feature, you can use it to complement configurable code integrity functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which you could use code integrity policies alongside AppLocker rules. As a best practice, enforce code integrity policies at the most restrictive level possible for your organization, and then use AppLocker to fine-tune the restrictions to an even lower level. -**Note**   -One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. +>[!NOTE]   +>One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. In another example, you could enable a configurable code integrity policy to allow users to run all the apps from a specific publisher. To do so, you would add the publisher’s signature to the policy. If your organization decides that only specific apps from that publisher should be allowed to run, you would add the signature for the publisher to the configurable code integrity policy, and then use AppLocker to determine which specific apps can run.   AppLocker and Device Guard can run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. -### - -**Device Guard with Credential Guard** +#### Device Guard with Credential Guard Although Credential Guard isn’t a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against derived credential theft. Similar to virtualization-based protection of kernel mode through the Device Guard HVCI service, Credential Guard leverages hypervisor technology to protect the Windows authentication service (the LSA) and users’ derived credentials. This mitigation is targeted at preventing the use of pass-the-hash and pass-the-ticket techniques. Because Credential Guard uses VBS, it is decisive in its ability to prevent pass-the-hash and pass-the-ticket attacks from occurring on Windows 10 devices. Microsoft recognizes, however, that most organizations will have a blend of Windows versions running in their environments. Mitigations for devices not capable of running Credential Guard on both the client side and the server side are available to help with this scenario. Microsoft will be releasing details to TechNet regarding these additional mitigations in the near future. -**Unified manageability through Device Guard** +#### Unified manageability through Device Guard You can easily manage Device Guard features through the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: - **Group Policy.**Windows 10 provides an administrative template that you can use to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings with your existing Group Policy objects, which makes it simple to implement Device Guard features. In addition to the code integrity and hardware-based security features, Group Policy can help you manage your catalog files. @@ -569,19 +604,19 @@ You can easily manage Device Guard features through the familiar enterprise and - **Windows PowerShell.** You use Windows PowerShell primarily to create and service code integrity policies. These policies represent the most impactful component of Device Guard. These options provide the same experience you’re used to for management of your existing enterprise management solutions. -**Address Space Layout Randomization** +#### Address Space Layout Randomization One of the most common techniques used to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data have been placed, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 4 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. -![image 4](images/security-fig4-aslr.png) +![ASLR at work](images/security-fig4-aslr.png "ASLR at work") Figure 4. ASLR at work Although the ASLR implementation in Windows 7 was effective, it wasn’t applied holistically across the operating system, and the level of entropy (cryptographic randomization) wasn’t always at the highest possible level. To decrease the likelihood that sophisticated attacks such as heap spraying could succeed in the Windows 8 operating system, Microsoft applied ASLR holistically across the system and increased the level of entropy many times. The ASLR implementation in Windows 8 and Windows 10 is greatly improved over Windows 7, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, which makes it even more difficult for malware to predict where Windows 10 stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, which makes it even more difficult for a successful exploit that works on one system to work reliably on another. -**Data Execution Prevention** +#### Data Execution Prevention Malware depends on its ability to put a malicious payload into memory with the hope that it will be executed later, and ASLR will make that much more difficult. Wouldn’t it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? @@ -598,11 +633,11 @@ If you want to see which apps use DEP, complete these steps: You can now see which processes have DEP enabled. Figure 5 shows the processes running on a Windows 10 PC with a single process that does not support DEP. -![figure 5](images/security-fig5-dep.png) +![Processes with DEP enabled in Windows 10](images/security-fig5-dep.png "Processes with DEP enabled in Windows 10") Figure 5. Processes on which DEP has been enabled in Windows 10 -**Windows Heap** +#### Windows Heap The *heap* is a location in memory that Windows uses to store dynamic application data. Windows 10 continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that could be used as part of an attack. @@ -613,17 +648,19 @@ Windows 10 has several important improvements to the security of the heap over Windows 10 resolves known heap attacks that could be used to compromise a PC running previous versions of Windows. -**Memory reservations** +#### Memory reservations The lowest 64 KB of process memory is reserved for the system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. -**Control Flow Guard** +#### Control Flow Guard When applications are loaded into memory, they are allocated space based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships between the code locations are well known—they are written in the code itself—but previous to Windows 10, the flow between these locations was not enforced, which gives attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. + This kind of threat is mitigated in Windows 10 through the Control Flow Guard (CFG) feature. When a trusted application that was compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If the location is not trusted, the application is immediately terminated as a potential security risk. + An administrator cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when the application is compiled. Administrators should consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge, IE, and other Windows features take full advantage of CFG. -**Protected Processes** +#### Protected Processes Benjamin Franklin once said that "an ounce of prevention is worth a pound of cure." His wisdom directly applies to PC security. Most security controls are designed to prevent the initial infection point. The reasoning is that if malware cannot infect the system, the system is immune to malware. @@ -633,12 +670,12 @@ The key security scenario is to assume that malware is running on a system but l With Protected Processes, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes. Less trusted processes are prevented from interacting with and therefore attacking more trusted processes. Windows 10 uses Protected Processes more broadly across the operating system, and for the first time, you can put antimalware solutions into the protected process space, which helps make the system and antimalware solutions less susceptible to tampering by malware that does manage to get on the system. -## Secure the Windows desktop +### Secure the Windows desktop Windows 10 includes critical improvements to the Windows core and the desktop environment, where attacks and malware most frequently enter. The desktop environment is now more resistant to malware thanks to significant improvements to Windows Defender and SmartScreen Filters. Internet browsing is a safer experience because of Microsoft Edge, a completely new browser. The Windows Store reduces the likelihood that malware will infect devices by ensuring that all applications that enter the Windows Store ecosystem have been thoroughly reviewed before being made available. Universal Windows apps are inherently more secure than typical applications because they are sandboxed. Sandboxing restricts the application’s risk of being compromised or tampered with in a way that would put the system, data, and other applications at risk. The sections that follow describe Windows 10 improvements to application security in more detail. -**Microsoft Edge and Internet Explorer 11** +### Microsoft Edge and Internet Explorer 11 Browser security is a critical component of any security strategy, and for good reason: The browser is the user’s interface to the Internet, an environment that is quite literally overwhelmed with malicious sites and content waiting to attack. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. @@ -653,45 +690,49 @@ Microsoft includes an entirely new browser, Microsoft Edge, in Windows 10. Micr In addition to Microsoft Edge, Microsoft includes IE11 in Windows 10 primarily for backwards-compatibility with websites and binary extensions that do not work with Microsoft Edge. It should not be configured as the primary browser but rather as an optional or automatic switchover, as shown in Figure 6. -![figure 6](images/security-fig6-edge2.png) +![Configure Windows 10 for backwards-compatibility with IE11](images/security-fig6-edge2.png "Configure Windows 10 for backwards-compatibility with IE11") Figure 6. Configure Windows 10 to switch from Microsoft Edge to IE11 for backwards-compatibility. Microsoft’s recommendation is to use Microsoft Edge as the primary web browser because it provides compatibility with the modern web and the best possible security. For sites that require IE11 compatibility, including those that require binary extensions and plug ins, enable Enterprise mode and use the Enterprise Mode Site List to define which sites have the dependency. When configured, when users use Microsoft Edge and it identifies a site that requires IE11, they will automatically be switched to IE11. -**The SmartScreen Filter** +### The SmartScreen Filter Recent versions of Windows have many effective techniques to prevent malware from installing itself without the user’s knowledge. To work around those restrictions, malware attacks often use social engineering techniques to trick users into running software. For example, malware known as a Trojan horse pretends to be something useful, such as a utility, but carries an additional, malicious payload. + Starting with Windows Internet Explorer 8, the SmartScreen Filter has helped protect users from both malicious applications and nefarious websites by using the SmartScreen Filter’s application and URL reputation services. The SmartScreen Filter in Internet Explorer would check URLs and newly downloaded apps against an online reputation service that Microsoft maintained. If the app or URL were not known to be safe, SmartScreen Filter would warn the user or even prevent the app or URL from loading, depending on how systems administrators had configured Group Policy settings. + For Windows 10, Microsoft further developed the SmartScreen Filter by integrating its app reputation abilities into the operating system itself, which allows the filter to protect users regardless of the web browser they are using or the path that the app uses to arrive on the device (for example, email, USB flash drive). The first time a user runs an app that originates from the Internet, even if the user copied it from another PC, the SmartScreen Filter checks the reputation of the application by using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, the SmartScreen Filter warns the user or blocks execution entirely, depending on how the administrator has configured Group Policy (see Figure 7). -![figure 7](images/security-fig7-smartscreenfilter.png) +![SmartScreen Filter at work in Windows 10](images/security-fig7-smartscreenfilter.png "SmartScreen Filter at work in Windows 10") Figure 7. The SmartScreen Filter at work in Windows 10 By default, users have the option to bypass SmartScreen Filter protection so that it will not prevent a user from running a legitimate app. You can use Control Panel or Group Policy settings to disable the SmartScreen Filter or to completely prevent users from running apps that the SmartScreen Filter does not recognize. The Control Panel settings are shown in Figure 8. -![figure 8](images/security-fig8-smartscreenconfig.png) +![SmartScreen configuration options](images/security-fig8-smartscreenconfig.png "SmartScreen configuration options") Figure 8. The Windows SmartScreen configuration options in Control Panel -If you want to try the SmartScreen Filter, use Windows 7 to download this simulated (but not dangerous) malware file:[freevideo.exe](http://go.microsoft.com/fwlink/p/?LinkId=626943). Save it to your computer, and then run it from Windows Explorer. As shown in Figure 9, Windows runs the app without much warning. In Windows 7, you might receive a warning message about the app not having a certificate, but you can easily bypass it. +If you want to try the SmartScreen Filter, use Windows 7 to download this simulated (but not dangerous) malware file:[freevideo.exe](https://go.microsoft.com/fwlink/p/?LinkId=626943). Save it to your computer, and then run it from Windows Explorer. As shown in Figure 9, Windows runs the app without much warning. In Windows 7, you might receive a warning message about the app not having a certificate, but you can easily bypass it. -![figure 9](images/security-fig9-windows7allow.png) +![Windows 7 allows the app to run](images/security-fig9-windows7allow.png "Windows 7 allows the app to run") Figure 9. Windows 7 allows the app to run Now, repeat the test on a computer running Windows 10 by copying the file to a Windows 10 PC or by downloading the file again and saving it to your local computer. Run the file directly from File Explorer, and the SmartScreen Filter will warn you before it allows it to run. Microsoft’s data shows that for a vast majority of users, that extra warning is enough to save them from a malware infection. -**Universal Windows apps** +### Universal Windows apps The good news is that the download and use of Universal Windows apps or even Windows Classic applications (Win32) from the Windows Store will dramatically reduce the likelihood that you encounter malware on your PC because all apps go through a careful screening process before being made available in the store. Apps that organizations build and distribute through sideloading processes will need to be reviewed internally to ensure that they meet organizational security requirements. Regardless of how users acquire Universal Windows apps, they can use them with increased confidence. Unlike Windows Classic applications, which can run with elevated privileges and have potentially sweeping access to the system and data, Universal Windows apps run in an AppContainer sandbox with limited privileges and capabilities. For example, Universal Windows apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. + In addition, all Universal Windows apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is severely limited and should be contained within the sandbox. The Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. + In the end, the Windows Store app distribution process and the app sandboxing capabilities of Windows 10 will dramatically reduce the likelihood that users encounter malicious apps on the system. -**Windows Defender** +### Windows Defender Antimalware software, also generically called virus scanners, antivirus, and a host of other names, has been around for a long time. Microsoft shipped its first program in this category, Microsoft Anti-Virus, in 1993 for MS DOS 6.0. At the time, the approach of running a standalone MS DOS program to locate and remove viruses was sufficient. @@ -720,9 +761,9 @@ Figure 10. Windows Defender opt-in settings in Windows 10 Of course, system administrators have centralized control of all Windows Defender settings through Group Policy. The Windows Defender configuration settings are shown under Computer Configuration/Windows Components/Windows Defender, as shown in Figure 11. -![figure 11](images/security-fig11-defendersettings.png) +![Windows Defender settings in Group Policy](images/security-fig11-defendersettings.png "Windows Defender settings in Group Policy") -Figure 11. Windows Defender settings in Group Policy– the sample submission options are listed under MAPS +Figure 11. Windows Defender settings in Group Policy – the sample submission options are listed under MAPS **Tamper proofing** is the safeguarding of Windows Defender itself against malware attacks. Malware creators assume that antimalware software is implemented on most PCs. Many malware creators choose to overcome that obstacle by designing malware that modifies the antimalware software in some way, such as disabling real-time scanning or by hiding specific processes. Some malware goes as far as completely disabling the antimalware software while making it appear fully functional to the user. @@ -730,11 +771,12 @@ Windows Defender is designed to resist tampering; it uses several security techn **Empowerment of IT security professionals** means that Windows Defender gives IT pros the tools and configuration options necessary to make it an enterprise-class antimalware solution. It has numerous enterprise-level features that put it on par with the top products in this category: -- Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. -- Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. -- It includes integrated classic command-line and Windows PowerShell cmdlet support. -- Support for Windows Management Instrumentation reporting and application management is built in. -- Full integration with Group Policy offers complete IT configuration management. + +* Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. +* Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. +* It includes integrated classic command-line and Windows PowerShell cmdlet support. +* Support for Windows Management Instrumentation reporting and application management is built in. +* Full integration with Group Policy offers complete IT configuration management. In addition, Windows Defender now integrates the Windows Defender Offline Tool, which formerly required the creation of a bootable, standalone version of Windows Defender into the Windows Recovery Environment. This simplifies the process of remediating low-level malware infections, which may prove difficult to detect and remove with the antimalware solution running on the Windows desktop. You can update signatures for this environment automatically from within the Windows Defender Offline experience. @@ -747,16 +789,16 @@ Another security threat that customers face particularly in consumer and bring y Whenever non-Microsoft real-time protection is in an inoperable state (for example, disabled, expired) for 24 hours, Windows Defender automatically turns on to ensure that the device is protected. Windows attempts to help the user remediate the issue with the non-Microsoft antimalware solution by notifying him or her as early as 5 days before the software expires. If the solution expires, Windows enables Windows Defender and continues to remind the user to renew the non-Microsoft solution. When the user updates or reactivates the solution, Windows Defender is automatically disabled. In the end, the goal is to make sure that an operable antimalware solution is running at all times. -## Conclusion +#### Conclusion Windows 10 is the culmination of many years of effort from Microsoft, and its impact from a security perspective will be significant. Many of us still remember the years of Windows XP, when the attacks on the Windows operating system, applications, and data increased in volume and matured into serious threats. With the existing platforms and security solutions that you’ve likely deployed, you’re better defended than ever. But as attackers have become more advanced, there is no doubt that they have exceeded your ability to defend your organization and users. Evidence of this fact can be found in the news virtually every day as yet another major organization falls victim. Microsoft specifically designed Windows 10 to address these modern threats and tactics from the most advanced adversaries. It can truly change the game for your organization, and it can restore your advantage against those would like to make you their next victim. ## Related topics -[Windows 10 Specifications](http://go.microsoft.com/fwlink/p/?LinkId=625077 ) +[Windows 10 Specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077 ) -[HealthAttestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=626940 ) +[HealthAttestation CSP](https://go.microsoft.com/fwlink/p/?LinkId=626940 ) -[Making Windows 10 More Personal and More Secure with Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=626945) +[Making Windows 10 More Personal and More Secure with Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=626945) [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md) diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 108dd74507..4d3345f8a1 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Windows Defender Advanced Threat Protection @@ -15,10 +16,11 @@ author: mjcaparas **Applies to:** - Windows 10 Enterprise -- Windows 10 Enterprise for Education +- Windows 10 Education - Windows 10 Pro - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) +>For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy). Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service that enables enterprise customers to detect, investigate, and respond to advanced threats on their networks. diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index 71894a0846..8abf7c0806 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -8,44 +8,44 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- -# Enable the Block at First Sight feature in Windows 10 +# Block at First Sight **Applies to** - Windows 10, version 1607 +**Audience** + +- Network administrators + Block at First Sight is a feature of Windows Defender cloud protection that provides a way to detect and block new malware within seconds. -You can enable Block at First Sight with Group Policy or individually on endpoints. +It is enabled by default when certain pre-requisite settings are also enabled. In most cases, these pre-requisite settings are also enabled by default, so the feature is running without any intervention. -## Backend processing and near-instant determinations +## How it works -When a Windows Defender client encounters a suspicious but previously undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. +When a Windows Defender client encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. -If the cloud backend is unable to make a determination, a copy of the file is requested for additional processing and analysis in the cloud. +If the cloud backend is unable to make a determination, the file will be locked by Windows Defender while a copy is uploaded to the cloud. Only after the cloud has received the file will Windows Defender release the lock and let the file run. The cloud will perform additional analysis to reach a determination, blocking all future encounters of that file. -If the Block at First Sight feature is enabled on the client, the file will be locked by Windows Defender while a copy is uploaded to the cloud, processed, and a verdict returned to the client. Only after a determination is returned from the cloud will Windows Defender release the lock and let the file run. - -The file-based determination typically takes 1 to 4 seconds. +In many cases this process can reduce the response time to new malware from hours to seconds. > [!NOTE] > Suspicious file downloads requiring additional backend processing to reach a determination will be locked by Windows Defender on the first machine where the file is encountered, until it is finished uploading to the backend. Users will see a longer "Running security scan" message in the browser while the file is being uploaded. This might result in what appear to be slower download times for some files. -## Enable Block at First Sight +## Confirm Block at First Sight is enabled -### Use Group Policy to configure Block at First Sight +Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender deployments in enterprise networks. -You can use Group Policy to control whether Windows Defender will continue to lock a suspicious file until it is uploaded to the backend. +> [!IMPORTANT] +> There is no specific individual setting in System Center Configuration Manager to enable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. -This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. - -Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. - -**Configure pre-requisite cloud protection Group Policy settings:** +### Confirm Block at First Sight is enabled with Group Policy 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -55,28 +55,56 @@ Block at First Sight requires a number of Group Policy settings to be configured 5. Expand the tree to **Windows components > Windows Defender > MAPS** and configure the following Group Policies: - 1. Double-click the **Join Microsoft MAPS** setting and set the option to **Enabled**. Click **OK**. + 1. Double-click the **Join Microsoft MAPS** setting and ensure the option is set to **Enabled**. Click **OK**. - 1. Double-click the **Send file samples when further analysis is required** setting and set the option as **Enabled** and the additional options as either of the following: + 1. Double-click the **Send file samples when further analysis is required** setting and ensure the option is set to **Enabled** and the additional options are either of the following: 1. Send safe samples (1) 1. Send all samples (3) - > [!NOTE] + > [!WARNING] > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. - 1. Click OK after both Group Policies have been set. + 1. Click **OK**. 1. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender > Real-time Protection**: - 1. Double-click the **Scan all downloaded files and attachments** setting and set the option to **Enabled**. Click **OK**. + 1. Double-click the **Scan all downloaded files and attachments** setting and ensure the option is set to **Enabled**. Click **OK**. - 1. Double-click the **Turn off real-time protection** setting and set the option to **Disabled**. Click **OK**. + 1. Double-click the **Turn off real-time protection** setting and ensure the option is set to **Disabled**. Click **OK**. + +If you had to change any of the settings, you should re-deploy the Group Policy Object across your network to ensure all endpoints are covered. +### Confirm Block at First Sight is enabled with Windows Settings -**Enable Block at First Sight with Group Policy** +> [!NOTE] +> If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. + +You can confirm that Block at First Sight is enabled in Windows Settings. The feature is automatically enabled, as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. + +**Confirm Block at First Sight is enabled on individual clients** + +1. Open Windows Defender settings: + + a. Open the Windows Defender app and click **Settings**. + + b. On the main Windows Settings page, click **Update & Security** and then **Windows Defender**. + +2. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. + +## Disable Block at First Sight + +> [!WARNING] +> Disabling the Block at First Sight feature will lower the protection state of the endpoint and your network. + +> [!NOTE] +> You cannot disable Block at First Sight with System Center Configuration Manager + +You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. + +**Disable Block at First Sight with Group Policy** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -86,28 +114,14 @@ Block at First Sight requires a number of Group Policy settings to be configured 5. Expand the tree through **Windows components > Windows Defender > MAPS**. -1. Double-click the **Configure the ‘Block at First Sight’ feature** setting and set the option to **Enabled**. +1. Double-click the **Configure the ‘Block at First Sight’ feature** setting and set the option to **Disabled**. > [!NOTE] - > The Block at First Sight feature will not function if the pre-requisite group policies have not been correctly set. + > Disabling the Block at First Sight feature will not disable or alter the pre-requisite group policies. -### Manually enable Block at First Sight on individual clients - -To configure un-managed clients that are running Windows 10, Block at First Sight is automatically enabled as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. - -**Enable Block at First Sight on individual clients** - -1. Open Windows Defender settings: - - a. Open the Windows Defender app and click **Settings**. - - b. On the main Windows Settings page, click **Update & Security** and then **Windows Defender**. - -2. Switch **Cloud-based Protection** and **Automatic sample submission** to **On**. - -> [!NOTE] -> These settings will be overridden if the network administrator has configured their associated Group Policies. The settings will appear grayed out and you will not be able to modify them if they are being managed by Group Policy. ## Related topics - [Windows Defender in Windows 10](windows-defender-in-windows-10.md) + + diff --git a/windows/keep-secure/windows-defender-enhanced-notifications.md b/windows/keep-secure/windows-defender-enhanced-notifications.md index e7ce19cd26..e70fede4fd 100644 --- a/windows/keep-secure/windows-defender-enhanced-notifications.md +++ b/windows/keep-secure/windows-defender-enhanced-notifications.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- @@ -21,9 +22,9 @@ In Windows 10, application notifications about malware detection and remediation Notifications will appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications will also be seen in the **Notification Center**, and a summary of scans and threat detections will also appear at regular time intervals. -You can enable and disable enhanced notifications with the registry or in Windows Settings. +You can enable and disable enhanced notifications in Windows Settings. -## Configure enhanced notifications +## Disable notifications You can disable enhanced notifications on individual endpoints in Windows Settings. @@ -38,6 +39,8 @@ You can disable enhanced notifications on individual endpoints in Windows Settin ![Windows Defender enhanced notifications](images/defender/enhanced-notifications.png) + + ## Related topics -- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) \ No newline at end of file +- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/windows-defender-in-windows-10.md b/windows/keep-secure/windows-defender-in-windows-10.md index e052d1a3bb..7ad3e53061 100644 --- a/windows/keep-secure/windows-defender-in-windows-10.md +++ b/windows/keep-secure/windows-defender-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- diff --git a/windows/keep-secure/windows-defender-offline.md b/windows/keep-secure/windows-defender-offline.md index bdd1e45d8b..a90a308ed7 100644 --- a/windows/keep-secure/windows-defender-offline.md +++ b/windows/keep-secure/windows-defender-offline.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index c70e57a4b1..9b54a7e5a7 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -624,37 +624,37 @@ New-NetFirewallRule –DisplayName “Inbound Secure Bypass Rule" –Direction I For more information about Windows PowerShell concepts, see the following topics. -- [Windows PowerShell Getting Started Guide](http://go.microsoft.com/fwlink/p/?linkid=113440) +- [Windows PowerShell Getting Started Guide](https://go.microsoft.com/fwlink/p/?linkid=113440) -- [Windows PowerShell User Guide](http://go.microsoft.com/fwlink/p/?linkid=113441) +- [Windows PowerShell User Guide](https://go.microsoft.com/fwlink/p/?linkid=113441) -- [Windows PowerShell About Help Topics](http://go.microsoft.com/fwlink/p/?linkid=113206) +- [Windows PowerShell About Help Topics](https://go.microsoft.com/fwlink/p/?linkid=113206) -- [about\_Functions](http://go.microsoft.com/fwlink/p/?linkid=113231) +- [about\_Functions](https://go.microsoft.com/fwlink/p/?linkid=113231) -- [about\_Functions\_Advanced](http://go.microsoft.com/fwlink/p/?linkid=144511) +- [about\_Functions\_Advanced](https://go.microsoft.com/fwlink/p/?linkid=144511) -- [about\_Execution\_Policies](http://go.microsoft.com/fwlink/p/?linkid=135170) +- [about\_Execution\_Policies](https://go.microsoft.com/fwlink/p/?linkid=135170) -- [about\_Foreach](http://go.microsoft.com/fwlink/p/?linkid=113229) +- [about\_Foreach](https://go.microsoft.com/fwlink/p/?linkid=113229) -- [about\_Objects](http://go.microsoft.com/fwlink/p/?linkid=113241) +- [about\_Objects](https://go.microsoft.com/fwlink/p/?linkid=113241) -- [about\_Properties](http://go.microsoft.com/fwlink/p/?linkid=113249) +- [about\_Properties](https://go.microsoft.com/fwlink/p/?linkid=113249) -- [about\_While](http://go.microsoft.com/fwlink/p/?linkid=113275) +- [about\_While](https://go.microsoft.com/fwlink/p/?linkid=113275) -- [about\_Scripts](http://go.microsoft.com/fwlink/p/?linkid=144310) +- [about\_Scripts](https://go.microsoft.com/fwlink/p/?linkid=144310) -- [about\_Signing](http://go.microsoft.com/fwlink/p/?linkid=113268) +- [about\_Signing](https://go.microsoft.com/fwlink/p/?linkid=113268) -- [about\_Throw](http://go.microsoft.com/fwlink/p/?linkid=145153) +- [about\_Throw](https://go.microsoft.com/fwlink/p/?linkid=145153) -- [about\_PSSessions](http://go.microsoft.com/fwlink/p/?linkid=135181) +- [about\_PSSessions](https://go.microsoft.com/fwlink/p/?linkid=135181) -- [about\_Modules](http://go.microsoft.com/fwlink/p/?linkid=144311) +- [about\_Modules](https://go.microsoft.com/fwlink/p/?linkid=144311) -- [about\_Command\_Precedence](http://go.microsoft.com/fwlink/p/?linkid=113214) +- [about\_Command\_Precedence](https://go.microsoft.com/fwlink/p/?linkid=113214)   diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 9907572763..ca368e846f 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -78,8 +78,8 @@ To allow facial recognition, you must have devices with integrated special infra - [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - [Microsoft Passport guide](microsoft-passport-guide.md) -- [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) -- [PassportforWork CSP](http://go.microsoft.com/fwlink/p/?LinkId=708219) +- [Prepare people to use Windows Hello for Work](prepare-people-to-use-microsoft-passport.md) +- [PassportforWork CSP](https://go.microsoft.com/fwlink/p/?LinkId=708219)   diff --git a/windows/keep-secure/windows-security-baselines.md b/windows/keep-secure/windows-security-baselines.md index f0db2dc596..ee48d1325c 100644 --- a/windows/keep-secure/windows-security-baselines.md +++ b/windows/keep-secure/windows-security-baselines.md @@ -51,13 +51,13 @@ To help faster deployments and increase the ease of managing Windows, Microsoft ### Windows 10 security baselines - - [Windows 10, Version 1511 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799381) - - [Windows 10, Version 1507 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799380) + - [Windows 10, Version 1511 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799381) + - [Windows 10, Version 1507 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799380) ### Windows Server security baselines - - [Windows Server 2012 R2 security baseline](http://go.microsoft.com/fwlink/p/?LinkID=799382) + - [Windows Server 2012 R2 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799382) ## How can I monitor security baseline deployments? diff --git a/windows/keep-secure/wip-enterprise-overview.md b/windows/keep-secure/wip-enterprise-overview.md index 241479661a..2b0b45fd93 100644 --- a/windows/keep-secure/wip-enterprise-overview.md +++ b/windows/keep-secure/wip-enterprise-overview.md @@ -1,78 +1,5 @@ --- title: Windows Information Protection overview (Windows 10) description: Conceptual info about Windows Information Protection (WIP), formerly known as Windows Information Protection (WIP). -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -localizationpriority: high +redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip --- - -# Windows Information Protection (WIP) overview - -**Applies to:** - -- Windows 10 -- Windows 10 Mobile - -With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. - -Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. - - -## Benefits of WIP - -WIP provides: -- Obvious separation between personal and corporate data, without requiring employees to switch environments or apps. - -- Additional data protection for existing line-of-business apps without a need to update the apps. - -- Ability to wipe corporate data from devices while leaving personal data alone. - -- Use of audit reports for tracking issues and remedial actions. - -- Integration with your existing management system (Microsoft Intune, System Center Configuration Manager 2016, or your current mobile device management (MDM) system) to configure, deploy, and manage WIP for your company. - -## Enterprise scenarios -WIP currently addresses these enterprise scenarios: -- You can encrypt enterprise data on employee-owned and corporate-owned devices. - -- You can remotely wipe enterprise data off managed computers, including employee-owned computers, without affecting the personal data. - -- You can select specific apps that can access enterprise data, called "allowed apps" that are clearly recognizable to employees. You can also block non-protected apps from accessing enterprise data. - -- Your employees won't have their work otherwise interrupted while switching between personal and enterprise apps while the enterprise policies are in place. Switching environments or signing in multiple times isn’t required. - -## Why use WIP? -WIP gives you a new way to manage data policy enforcement for apps and documents, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune). - -- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. WIP helps make sure that your enterprise data is protected on both corporate and employee-owned devices, even when the employee isn’t using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally-maintained as enterprise data. - -- **Manage your enterprise documents, apps, and encryption modes.** - - - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using an WIP-protected device, WIP encrypts the data on the device. - - - **Using allowed apps.** Managed apps (apps that you've included on the allowed apps list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - - - **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are blocked from accessing your enterprise data, depending on your WIP management-mode. - - You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in your protected apps list. - - - **Deciding your level of data access.** WIP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your protected apps list. - - - **Data encryption at rest.** WIP helps protect enterprise data on local files and on removable media. - - Apps such as Microsoft Word work with WIP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens WIP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies WIP to the new document. - - - **Helping prevent accidental data disclosure to public spaces.** WIP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your protected apps list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your protected apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally. - - - **Helping prevent accidental data disclosure to removable media.** WIP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. - - - **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable. - -## Turn off WIP - -You can turn off all Windows Information Protection and restrictions, reverting to where you were pre-WIP, with no data loss. However, turning off WIP isn't recommended. If you choose to turn it off, you can always turn it back on, but WIP won't retain your decryption and policies info. - -## Related topics -- [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-edp.md) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index b46f78d870..19a65a7a57 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -16,6 +16,7 @@ ### [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) ### [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) ### [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +## [Create mandatory user profiles](mandatory-user-profile.md) ## [Lock down Windows 10](lock-down-windows-10.md) ### [Lockdown features from Windows Embedded 8.1 Industry](lockdown-features-windows-10.md) ### [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) @@ -35,14 +36,12 @@ ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [Configure devices without MDM](configure-devices-without-mdm.md) ## [Windows 10 servicing options](introduction-to-windows-10-servicing.md) -## [Application development for Windows as a service](application-development-for-windows-as-a-service.md) ## [Application Virtualization (App-V) for Windows](appv-for-windows.md) ### [Getting Started with App-V](appv-getting-started.md) -#### [About App-V](appv-about-appv.md) +#### [What's new in App-V](appv-about-appv.md) ##### [Release Notes for App-V](appv-release-notes-for-appv-for-windows.md) #### [Evaluating App-V](appv-evaluating-appv.md) #### [High Level Architecture for App-V](appv-high-level-architecture.md) -#### [Accessibility for App-V](appv-accessibility.md) ### [Planning for App-V](appv-planning-for-appv.md) #### [Preparing Your Environment for App-V](appv-preparing-your-environment.md) ##### [App-V Prerequisites](appv-prerequisites.md) @@ -54,17 +53,14 @@ ##### [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) ##### [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) ##### [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md) -##### [Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md) ##### [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md) ##### [Planning to Use Folder Redirection with App-V](appv-planning-folder-redirection-with-appv.md) #### [App-V Planning Checklist](appv-planning-checklist.md) ### [Deploying App-V](appv-deploying-appv.md) -#### [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) +#### [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) ##### [About Client Configuration Settings](appv-client-configuration-settings.md) ##### [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) -##### [How to Install the App-V Client for Shared Content Store Mode](appv-install-the-appv-client-for-shared-content-store-mode.md) ##### [How to Install the Sequencer](appv-install-the-sequencer.md) -##### [How to Modify App-V Client Configuration Using the ADMX Template and Group Policy](appv-modify-client-configuration-with-the-admx-template-and-group-policy.md) #### [Deploying the App-V Server](appv-deploying-the-appv-server.md) ##### [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) ##### [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) @@ -110,23 +106,22 @@ ##### [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md) ##### [How to Enable Only Administrators to Publish Packages by Using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md) #### [Using the App-V Client Management Console](appv-using-the-client-management-console.md) -##### [How to Access the Client Management Console](appv-accessing-the-client-management-console.md) -##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server ](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) #### [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) ##### [How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md) #### [Maintaining App-V](appv-maintaining-appv.md) ##### [How to Move the App-V Server to Another Computer](appv-move-the-appv-server-to-another-computer.md) -#### [Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) -##### [How to Load the PowerShell Cmdlets and Get Cmdlet Help ](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md) -##### [How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md) -##### [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md) -##### [How to Modify Client Configuration by Using PowerShell](appv-modify-client-configuration-with-powershell.md) -##### [How to Apply the User Configuration File by Using PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) -##### [How to Apply the Deployment Configuration File by Using PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) -##### [How to Sequence a Package by Using PowerShell ](appv-sequence-a-package-with-powershell.md) -##### [How to Create a Package Accelerator by Using PowerShell](appv-create-a-package-accelerator-with-powershell.md) -##### [How to Enable Reporting on the App-V Client by Using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) -##### [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md) +#### [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) +##### [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help ](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md) +##### [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md) +##### [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md) +##### [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) +##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) +##### [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) +##### [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) +##### [How to Sequence a Package by Using Windows PowerShell ](appv-sequence-a-package-with-powershell.md) +##### [How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md) +##### [How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) +##### [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md) ### [Troubleshooting App-V](appv-troubleshooting.md) ### [Technical Reference for App-V](appv-technical-reference.md) #### [Performance Guidance for Application Virtualization](appv-performance-guidance.md) @@ -159,7 +154,6 @@ #### [Sync Trigger Events for UE-V](uev-sync-trigger-events.md) #### [Synchronizing Microsoft Office with UE-V](uev-synchronizing-microsoft-office-with-uev.md) #### [Application Template Schema Reference for UE-V](uev-application-template-schema-reference.md) -#### [Accessibility for UE-V](uev-accessibility.md) #### [Security Considerations for UE-V](uev-security-considerations.md) ## [Windows Store for Business](windows-store-for-business.md) ### [Sign up and get started](sign-up-windows-store-for-business-overview.md) diff --git a/windows/manage/administrative-tools-in-windows-10.md b/windows/manage/administrative-tools-in-windows-10.md index cc42197767..0166bbda73 100644 --- a/windows/manage/administrative-tools-in-windows-10.md +++ b/windows/manage/administrative-tools-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: medium --- # Administrative Tools in Windows 10 @@ -30,23 +31,23 @@ If the content that is linked to a tool in the following list doesn't provide th   -- [Component Services]( http://go.microsoft.com/fwlink/p/?LinkId=708489) -- [Computer Management](http://go.microsoft.com/fwlink/p/?LinkId=708490) -- [Defragment and Optimize Drives](http://go.microsoft.com/fwlink/p/?LinkId=708488) -- [Disk Cleanup](http://go.microsoft.com/fwlink/p/?LinkID=698648) -- [Event Viewer](http://go.microsoft.com/fwlink/p/?LinkId=708491) -- [iSCSI Initiator](http://go.microsoft.com/fwlink/p/?LinkId=708492) -- [Local Security Policy](http://go.microsoft.com/fwlink/p/?LinkId=708493) -- [ODBC Data Sources]( http://go.microsoft.com/fwlink/p/?LinkId=708494) -- [Performance Monitor](http://go.microsoft.com/fwlink/p/?LinkId=708495) -- [Print Management](http://go.microsoft.com/fwlink/p/?LinkId=708496) -- [Resource Monitor](http://go.microsoft.com/fwlink/p/?LinkId=708497) -- [Services](http://go.microsoft.com/fwlink/p/?LinkId=708498) -- [System Configuration](http://go.microsoft.com/fwlink/p/?LinkId=708499) -- [System Information]( http://go.microsoft.com/fwlink/p/?LinkId=708500) -- [Task Scheduler](http://go.microsoft.com/fwlink/p/?LinkId=708501) -- [Windows Firewall with Advanced Security](http://go.microsoft.com/fwlink/p/?LinkId=708503) -- [Windows Memory Diagnostic]( http://go.microsoft.com/fwlink/p/?LinkId=708507) +- [Component Services]( https://go.microsoft.com/fwlink/p/?LinkId=708489) +- [Computer Management](https://go.microsoft.com/fwlink/p/?LinkId=708490) +- [Defragment and Optimize Drives](https://go.microsoft.com/fwlink/p/?LinkId=708488) +- [Disk Cleanup](https://go.microsoft.com/fwlink/p/?LinkID=698648) +- [Event Viewer](https://go.microsoft.com/fwlink/p/?LinkId=708491) +- [iSCSI Initiator](https://go.microsoft.com/fwlink/p/?LinkId=708492) +- [Local Security Policy](https://go.microsoft.com/fwlink/p/?LinkId=708493) +- [ODBC Data Sources]( https://go.microsoft.com/fwlink/p/?LinkId=708494) +- [Performance Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708495) +- [Print Management](https://go.microsoft.com/fwlink/p/?LinkId=708496) +- [Resource Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708497) +- [Services](https://go.microsoft.com/fwlink/p/?LinkId=708498) +- [System Configuration](https://go.microsoft.com/fwlink/p/?LinkId=708499) +- [System Information]( https://go.microsoft.com/fwlink/p/?LinkId=708500) +- [Task Scheduler](https://go.microsoft.com/fwlink/p/?LinkId=708501) +- [Windows Firewall with Advanced Security](https://go.microsoft.com/fwlink/p/?LinkId=708503) +- [Windows Memory Diagnostic]( https://go.microsoft.com/fwlink/p/?LinkId=708507)   diff --git a/windows/manage/app-inventory-management-windows-store-for-business.md b/windows/manage/app-inventory-management-windows-store-for-business.md index 2472c4a967..ec263eede3 100644 --- a/windows/manage/app-inventory-management-windows-store-for-business.md +++ b/windows/manage/app-inventory-management-windows-store-for-business.md @@ -169,7 +169,7 @@ For each app in your inventory, you can view and manage license details. This gi **To view license details** -1. Sign in to [Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=691845) +1. Sign in to [Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=691845) 2. Click **Manage**, and then choose **Inventory**. diff --git a/windows/manage/application-development-for-windows-as-a-service.md b/windows/manage/application-development-for-windows-as-a-service.md index dedc91d3cd..080fccc711 100644 --- a/windows/manage/application-development-for-windows-as-a-service.md +++ b/windows/manage/application-development-for-windows-as-a-service.md @@ -1,12 +1,13 @@ --- title: Application development for Windows as a service (Windows 10) -description: In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. +description: Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. ms.assetid: 28E0D103-B0EE-4B14-8680-6F30BD373ACF ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing -author: greg-lindsay +author: jdeckerMS +redirect_url: https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service --- # Application development for Windows as a service @@ -14,7 +15,7 @@ author: greg-lindsay **Applies to** - Windows 10 - Windows 10 Mobile -- Windows 10 IoT Core (IoT Core) +- Windows 10 IoT Core In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation, development, and delivery called [Windows as a service (WaaS)](introduction-to-windows-10-servicing.md). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle and provide feedback to Microsoft through an iterative methodology called flighting. @@ -25,6 +26,7 @@ Builds distributed as flights provide the Windows engineering team with signific Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis: **Feature updates** install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature updates contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed. Microsoft expects to publish an average of one to two new feature updates per year. + **Quality updates** deliver security issue resolutions and other important bug fixes. Quality updates will be provided to improve each feature currently in support, on a cadence of one or more times per month. Microsoft will continue publishing quality updates on Update Tuesday (sometimes referred to as Patch Tuesday). Additionally, Microsoft may publish additional quality updates for Windows 10 outside the Update Tuesday process when required to address customer needs. During Windows 10 development, Microsoft streamlined the Windows product engineering and release cycle so that we can deliver the features, experiences, and functionality customers want, more quickly than ever. We also created new ways to deliver and install feature updates and quality updates that simplify deployments and on-going management, broaden the base of employees who can be kept current with the latest Windows capabilities and experiences, and lower total cost of ownership. Hence we have implemented new servicing options – referred to as Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB) – that provide pragmatic solutions to keep more devices more current in enterprise environments than was previously possible. @@ -45,7 +47,7 @@ The traditional approach for supporting apps has been to release a new app versi In the Windows as a service model, Microsoft is making a commitment to maintaining the compatibility of the underlying OS. This means Microsoft will make a concerted effort to ensure that there are no breaking changes that impact the app ecosystem negatively. In this scenario, when there is a release of a Windows build, most apps (those with no kernel dependencies) will continue to work. -In view of this change, Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. Our mutual customers are better served by an application lifecycle approach. This means when an application version is released it will be supported for a certain period of time irrespective of however many Windows builds are released in the interim. The ISV makes a commitment to provide support for that specific version of the app as long as it is supported in the lifecycle. Microsoft follows a similar lifecycle approach for Windows that can be referenced [here](http://go.microsoft.com/fwlink/?LinkID=780549). +In view of this change, Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. Our mutual customers are better served by an application lifecycle approach. This means when an application version is released it will be supported for a certain period of time irrespective of however many Windows builds are released in the interim. The ISV makes a commitment to provide support for that specific version of the app as long as it is supported in the lifecycle. Microsoft follows a similar lifecycle approach for Windows that can be referenced [here](https://go.microsoft.com/fwlink/?LinkID=780549). This approach will reduce the burden of maintaining an app schedule that aligns with Windows releases. ISV partners should be free to release features or updates at their own cadence. We feel that our partners can keep their customer base updated with the latest app updates independent of a Windows release. In addition, our customers do not have to seek an explicit support statement whenever a Windows build is released. Here is an example of a support statement that covers how an app may be supported across different versions of the OS: @@ -60,7 +62,7 @@ In the following sections, you will find additional information about the steps We understand that compatibility matters to developers. ISVs and developers want to ensure their apps will run as expected on all supported versions of the Windows OS. Consumers and businesses have a key investment here—they want to ensure that the apps they have paid for will continue to work. We know that compatibility is the primary criteria for purchase decisions. Apps that are well written based on best practices will lead to much less code churn when a new Windows version is released and will reduce fragmentation—these apps have a reduced engineering investment to maintain, and a faster time to market. -In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8 we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought. +In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8, we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought. Windows 10 is the most compatible-by-design version of the OS to date. Here are some key ways we accomplished this: - **App telemetry**: This helps us understand app popularity in the Windows ecosystem to inform compatibility testing. - **ISV partnerships**: Work directly with external partners to provide them with data and help fix issues that our users experience. @@ -68,15 +70,15 @@ Windows 10 is the most compatible-by-design version of the OS to date. Here are - **Communication**: Tighter control over API changes and improved communication. - **Flighting and feedback loop**: Windows insiders receive flighted builds that help improve our ability to find compatibility issues before a final build is released to customers. This feedback process not only exposes bugs, but ensures we are shipping features our users want. -## Microsoft uses data to make Windows 10 better +## Best practices for app compatibility Microsoft uses diagnostic and usage data to identify and troubleshoot problems, improve our products and services, and provide our users with personalized experiences. The usage data we collect also extends to the apps that PCs in the Windows ecosystem are running. Based on what our customers use, we build our list to test these apps, devices, and drivers against new versions of the Windows OS. Windows 10 has been the most compatible version of Windows to-date, with over 90% compatibility against thousands of popular apps. The Windows Compatibility team commonly reaches out to our ISV partners to provide feedback if issues are discovered, so that we can partner together on solutions. Ideally, we’d like our common customers to be able to update Windows seamlessly and without losing functionality in either their OS or the apps they depend on for their productivity or entertainment. The following sections contain some best practices Microsoft recommends so you can ensure your apps are compatible with Windows 10. -**Windows version check** +### Windows version check -The OS version has been incremented with Windows 10. This means that the internal version number has been changed to 10.0. As in the past, we go to great lengths to maintain application and device compatibility after an OS version change. For most app categories (without any kernel dependencies) the change will not negatively impact app functionality, and existing apps will continue to work fine on Windows 10. +The OS version has been incremented with Windows 10. This means that the internal version number has been changed to 10.0. As in the past, we go to great lengths to maintain application and device compatibility after an OS version change. For most app categories (without any kernel dependencies), the change will not negatively impact app functionality, and existing apps will continue to work fine on Windows 10. The manifestation of this change is app-specific. This means any app that specifically checks for the OS version will get a higher version number, which can lead to one or more of the following situations: - App installers might not be able to install the app, and apps might not be able to start. @@ -87,20 +89,21 @@ Some apps perform a version check and simply pass a warning to users. However, t - If the app is dependent on specific API functionality, ensure you target the correct API version. - Ensure you detect the change via APISet or another public API, and do not use the version as a proxy for some feature or fix. If there are breaking changes and a proper check is not exposed, then that is a bug. - Ensure the app does NOT check for version in odd ways, such as via the registry, file versions, offsets, kernel mode, drivers, or other means. If the app absolutely needs to check the version, use the GetVersion APIs, which should return the major, minor, and build number. -- If you are using the [GetVersion](http://go.microsoft.com/fwlink/?LinkID=780555) API, remember that the behavior of this API has changed since Windows 8.1. +- If you are using the [GetVersion](https://go.microsoft.com/fwlink/?LinkID=780555) API, remember that the behavior of this API has changed since Windows 8.1. If you own apps such as antimalware or firewall apps, you should work through your usual feedback channels and via the Windows Insider program. -**Undocumented APIs** +### Undocumented APIs + Your apps should not call undocumented Windows APIs, or take dependency on specific Windows file exports or registry keys. This can lead to broken functionality, data loss, and potential security issues. If there is functionality your app requires that is not available, this is an opportunity to provide feedback through your usual feedback channels and via the Windows Insider program. -**Develop Universal Windows Platform (UWP) and Centennial apps** +### Develop Universal Windows Platform (UWP) and Centennial apps -We encourage all Win32 app ISVs to develop [Universal Windows Platform (UWP)](http://go.microsoft.com/fwlink/?LinkID=780560) and, specifically, [Centennial](http://go.microsoft.com/fwlink/?LinkID=780562) apps moving forward. There are great benefits to developing these app packages rather than using traditional Win32 installers. UWP apps are also supported in the [Windows Store](http://go.microsoft.com/fwlink/?LinkID=780563), so it’s easier for you to update your users to a consistent version automatically, lowering your support costs. +We encourage all Win32 app ISVs to develop [Universal Windows Platform (UWP)](https://go.microsoft.com/fwlink/?LinkID=780560) and, specifically, [Centennial](https://go.microsoft.com/fwlink/?LinkID=780562) apps moving forward. There are great benefits to developing these app packages rather than using traditional Win32 installers. UWP apps are also supported in the [Windows Store](https://go.microsoft.com/fwlink/?LinkID=780563), so it’s easier for you to update your users to a consistent version automatically, lowering your support costs. -If your Win32 app types do not work with the Centennial model, we highly recommend that you use the right installer and ensure this is fully tested. An installer is your user or customer’s first experience with your app, so ensure that this works well. All too often, this doesn’t work well or it hasn’t been fully tested for all scenarios. The [Windows App Certification Kit](http://go.microsoft.com/fwlink/?LinkID=780565) can help you test the install and uninstall of your Win32 app and help you identify use of undocumented APIs, as well as other basic performance-related best-practice issues, before your users do. +If your Win32 app types do not work with the Centennial model, we highly recommend that you use the right installer and ensure this is fully tested. An installer is your user or customer’s first experience with your app, so ensure that this works well. All too often, this doesn’t work well or it hasn’t been fully tested for all scenarios. The [Windows App Certification Kit](https://go.microsoft.com/fwlink/?LinkID=780565) can help you test the install and uninstall of your Win32 app and help you identify use of undocumented APIs, as well as other basic performance-related best-practice issues, before your users do. -**Best pratcices:** +**Best practices:** - Use installers that work for both 32-bit and 64-bit versions of Windows. - Design your installers to run on multiple scenarios (user or machine level). - Keep all Windows redistributables in the original packaging – if you repackage these, it’s possible that this will break the installer. @@ -112,8 +115,8 @@ Windows OS flighting refers to the interim builds available to Windows Insiders If your app is in the Store, you can flight your app via the Store, which means that your app will be available for our Windows Insider population to install. Users can install your app and you can receive preliminary feedback on your app before you release it to the general population. The follow sections outline the steps for testing your apps against Windows flighted builds. -**Step 1: Become a Windows Insider and participate in flighting** -As a [Windows Insider,](http://go.microsoft.com/fwlink/p/?LinkId=521639) you can help shape the future of Windows—your feedback will help us improve features and functionality in the platform. This is a vibrant community where you can connect with other enthusiasts, join forums, trade advice, and learn about upcoming Insider-only events. +### Step 1: Become a Windows Insider and participate in flighting +As a [Windows Insider,](https://go.microsoft.com/fwlink/p/?LinkId=521639) you can help shape the future of Windows—your feedback will help us improve features and functionality in the platform. This is a vibrant community where you can connect with other enthusiasts, join forums, trade advice, and learn about upcoming Insider-only events. Since you’ll have access to preview builds of Windows 10, Windows 10 Mobile, and the latest Windows SDK and Emulator, you’ll have all the tools at your disposal to develop great apps and explore what's new in the Universal Windows Platform and the Windows Store. @@ -127,7 +130,7 @@ Before you become a Windows Insider, please note that participation is intended - Know what an ISO file is and how to use it. - Aren't installing it on their everyday computer or device. -**Step 2: Test your scenarios** +### Step 2: Test your scenarios Once you have updated to a flighted build, the following are some sample test cases to help you get started on testing and gathering feedback. For most of these tests, ensure you cover both x86 and AMD64 systems. **Clean install test:** On a clean install of Windows 10, ensure your app is fully functional. If your app fails this test and the upgrade test, then it’s likely that the issue is caused by underlying OS changes or bugs in the app. @@ -149,12 +152,12 @@ If after investigation, the former is the case, be sure to use the Windows Insid - Sensors (accelerometer, fusion, and so on) - Camera -**Step 3: Provide feedback** +### Step 3: Provide feedback Let us know how your app is performing against flighted builds. As you discover issues with your app during testing, please log bugs via the partner portal if you have access, or through your Microsoft representative. We encourage this information so that we can build a quality experience for our users together. -**Step 4: Register on Windows 10** -The [Ready for Windows 10](http://go.microsoft.com/fwlink/?LinkID=780580) website is a directory of software that supports Windows 10. It’s intended for IT administrators at companies and organizations worldwide that are considering Windows 10 for their deployments. IT administrators can check the site to see whether software deployed in their enterprise is supported in Windows 10. +### Step 4: Register on Windows 10 +The [Ready for Windows 10](https://go.microsoft.com/fwlink/?LinkID=780580) website is a directory of software that supports Windows 10. It’s intended for IT administrators at companies and organizations worldwide that are considering Windows 10 for their deployments. IT administrators can check the site to see whether software deployed in their enterprise is supported in Windows 10. ## Related topics [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md) diff --git a/windows/manage/appv-about-appv.md b/windows/manage/appv-about-appv.md index 28dd41b085..ef43aeed3d 100644 --- a/windows/manage/appv-about-appv.md +++ b/windows/manage/appv-about-appv.md @@ -1,6 +1,6 @@ --- -title: About App-V (Windows 10) -description: About App-V +title: What's new in App-V for Windows 10 (Windows 10) +description: Information about what's new in App-V for Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,463 +9,46 @@ ms.prod: w10 --- -# About App-V for Windows +# What's new in App-V -Applies to: Windows 10, version 1607 +**Applies to** +- Windows 10, version 1607 -Review the following sections for information about significant changes that apply to Application Virtualization (App-V) for Windows: +Microsoft Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. -[App-V software prerequisites and supported configurations](#bkmk-51-prereq-configs) - -[Migrating to App-V](#bkmk-migrate-to-51) - -[What’s New in App-V](#bkmk-whatsnew) - -[App-V support for Windows 10](#bkmk-win10support) - -[App-V Management Console Changes](#bkmk-mgmtconsole) - -[Sequencer Improvements](#bkmk-seqimprove) - -[Improvements to Package Converter](#bkmk-pkgconvimprove) - -[Support for multiple scripts on a single event trigger](#bkmk-supmultscripts) - -[Hardcoded path to installation folder is redirected to virtual file system root](#bkmk-hardcodepath) - -## App-V for Windows software prerequisites and supported configurations +Application Virtualization (App-V) for Windows 10, version 1607, includes these new features and capabilities compared to App-V 5.1. See [App-V release notes](appv-release-notes-for-appv-for-windows.md) for more information about the App-V for Windows 10, version 1607 release. -Review the following topics for information about App-V for Windows software prerequisites and supported configurations. +## App-V is now a feature in Windows 10 - ---- - - - - - - - - - - - - - - - - -
    Links to prerequisites and supported configurations topicsDescription

    [App-V Prerequisites](appv-prerequisites.md)

    Prerequisite software that you must install before you can get started with App-V for Windows

    [App-V Supported Configurations](appv-supported-configurations.md)

    Supported operating systems and hardware requirements for the App-V server, sequencer, and client components

    +With Windows 10, version 1607 and later releases, Application Virtualization (App-V) is included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. + +For information about earlier versions of App-V, see [MDOP Information Experience](https://technet.microsoft.com/itpro/mdop/index). + +The changes in App-V for Windows 10, version 1607 impact already existing implementations of App-V in the following ways: + +- The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client. + +- The App-V application sequencer is available from the [Windows 10 Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. + +>**Note**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. + +For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) and [Migrating to App-V for Windows 10 from a previous version](appv-migrating-to-appv-from-a-previous-version.md). + +>**Important** +You can upgrade your existing App-V installation to Windows 10, version 1607 from App-V versions 5.0 SP2 and higher only. If you are using a previous version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you upgrade to Windows 10, version 1607.   -**Support for using Configuration Manager with App-V:** App-V supports System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. +## Support for System Center -## Upgrade to App-V for Windows - - -Use the following information to upgrade to App-V for Windows from earlier versions. See [Migrating to App-V for Windows from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) for more information. - -### Before you begin - -Review the following information before you start the upgrade: - - ---- - - - - - - - - - - - - - - - - - - - - -
    Items to review before upgradingDescription

    Components to upgrade, in any order

      -

    1. App-V Server

      2. -

    2. Sequencer

      3. -

    3. App-V Client or App-V Remote Desktop Services (RDS) Client

      4. -
    -
    -Note   -

    Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from [Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186).

    -
    -
    -  -

    Upgrading from App-V 4.x

    You cannot upgrade directly from App-V 4.x to App-V for Windows. You must first upgrade to App-V 5.0. For more information, see [Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md)

    - -

    Upgrading from App-V 5.0 or later

    You can upgrade to App-V for Windows directly from any of the following versions:

    -
      -

    • App-V 5.0

      • -

    • App-V 5.0 SP1

      • -

    • App-V 5.0 SP2

      • -

    • App-V 5.0 SP3

      • -
    -

    To upgrade to App-V for Windows, follow the steps in the remaining sections of this topic.

    -

    Packages and connection groups will continue to work with App-V for Windows as they currently do.

    -  - -### Steps to upgrade the App-V infrastructure - -Complete the following steps to upgrade each component of the App-V infrastructure to App-V for Windows. The following order is only a suggestion; you can upgrade components in any order. - - ---- - - - - - - - - - - - - - - - - - - - - -
    StepFor more information

    Step 1: Upgrade the App-V server components.

    -
    -Note   -

    If you are not using the App-V server, skip this step and go to the next step.

    -
    -
    -  -

    Follow these steps:

    -
      -

    1. Do one of the following, depending on the method you are using to upgrade the management database and/or reporting database:

      - ---- - - - - - - - - - - - - - - - - -
      Database upgrade methodStep

      Windows Installer

      Skip this step and go to step 2, “If you are upgrading the App-V server...”

      SQL scripts

      Follow the steps in [How to Deploy the App-V Databases by Using SQL Scripts](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts).

      -

    2. If you are upgrading to App-V for Windows server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 server](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/check-reg-key-svr).

      3. -

    3. Follow the steps in [How to Deploy the App-V server components](appv-deploy-the-appv-server.md)

      4. -

       

      -

    Step 2: Install the new App-V for Windows sequencer.

    See [How to Install the Sequencer](appv-install-the-sequencer.md).

    Step 3: Enable the in-box App-V client.

    See [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).

    - -  - -### Converting packages created using a prior version of App-V - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V for Windows, version 1607. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - ->**Note**   -App-V for Windows packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and so there is no need to convert App-V 5.0 packages to App-V for Windows packages. - -  - -## What’s New in App-V - - -These sections are for users who are already familiar with App-V and want to know what has changed in App-V for Windows. If you are not already familiar with App-V, you should start by reading [Planning for App-V](appv-planning-for-appv.md). - - -### App-V Management Console Changes - -This section compares the App-V for Windows Management Console’s current and previous functionality. - -### Silverlight is no longer required - -The Management Console UI no longer requires Silverlight. The Management Console is built on HTML5 and Javascript. - -### Notifications and messages are displayed individually in a dialog box - - ---- - - - - - - - - - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V for Windows

    Number of messages indicator:

    -

    On the title bar of the App-V Management Console, a number is now displayed next to a flag icon to indicate the number of messages that are waiting to be read.

    You could see only one message or error at a time, and you were unable to determine how many messages there were.

    Message appearance:

    -
      -

    • Messages that require user input appear in a separate dialog box that displays on top of the current page that you were viewing, and require a response before you can dismiss them.

      • -

    • Messages and errors appear in a list, with one beneath the other.

      • -

    You could see only one message or error at a time.

    Dismissing messages:

    -

    Use the Dismiss All link to dismiss all messages and errors at one time, or dismiss them one at a time.

    You could dismiss messages and errors only one at a time.

    - -  - -### Console pages are now separate URLs - - ---- - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V for Windows

    Each page in the console has a different URL, which enables you to bookmark specific pages for quick access in the future.

    -

    The number that appears in some URLs indicates the specific package. These numbers are unique.

    All console pages are accessed through the same URL.

    - -  - -### New, separate CONNECTION GROUPS page and menu option - - ---- - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V for Windows

    The CONNECTION GROUPS page is now part of the main menu, at the same level as the PACKAGES page.

    To open the CONNECTION GROUPS page, you navigate through the PACKAGES page.

    - -  - -### Menu options for packages have changed - - ---- - - - - - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V Windows

    The following options are now buttons that appear at the bottom of the PACKAGES page:

    -
      -

    • Add or Upgrade

      • -

    • Publish

      • -

    • Unpublish

      • -

    • Delete

      • -
    -

    The following options will still appear when you right-click a package to open the drop-down context menu:

    -
      -

    • Publish

      • -

    • Unpublish

      • -

    • Edit AD Access

      • -

    • Edit Deployment Config

      • -

    • Transfer deployment configuration from…

      • -

    • Transfer access and configuration from…

      • -

    • Delete

      • -
    -

    When you click Delete to remove a package, a dialog box opens and asks you to confirm that you want to delete the package.

    The Add or Upgrade option was a button at the top right of the PACKAGES page.

    -

    The Publish, Unpublish, and Delete options were available only if you right-clicked a package name in the packages list.

    The following package operations are now buttons on the package details page for each package:

    -
      -

    • Transfer (drop-down menu with the following options):

      -
        -

      • Transfer deployment configuration from…

        • -

      • Transfer access and configuration from…

        • -
      • -

    • Edit (connection groups and AD Access)

      • -

    • Unpublish

      • -

    • Delete

      • -

    • Edit Default Configuration

      • -

    These package options were available only if you right-clicked a package name in the packages list.

    - -  - -### Icons in left pane have new colors and text - -The colors of the icons in the left pane have been changed, and text added, to make the icons consistent with other Microsoft products. - -### Overview page has been removed - -In the left pane of the Management Console, the OVERVIEW menu option and its associated OVERVIEW page have been removed. - -### Sequencer Improvements - -The following improvements have been made to the package editor in the App-V Sequencer. - -#### Import and export the manifest file - -You can import and export the AppxManifest.xml file. To export the manifest file, select the **Advanced** tab and in the Manifest File box, click **Export...**. You can make changes to the manifest file, such as removing shell extensions or editing file type associations. - -After you make your changes, click **Import...** and select the file you edited. After you successfully import it back in, the manifest file is immediately updated within the package editor. - ->**Caution**   -When you import the file, your changes are validated against the XML schema. If the file is not valid, you will receive an error. Be aware that it is possible to import a file that is validated against the XML schema, but that might still fail to run for other reasons. - -  - -#### Addition of Windows 10 to operating systems list - -In the Deployment tab, Windows 10 32-bit and Windows 10-64 bit have been added to the list of operating systems for which you can sequence a package. If you select **Any Operating System**, Windows 10 is automatically included among the operating systems that the sequenced package will support. - -#### Current path displays at bottom of virtual registry editor - -In the Virtual Registry tab, the path now displays at the bottom of the virtual registry editor, which enables you to determine the currently selected key. Previously, you had to scroll through the registry tree to find the currently selected key. - -#### Combined “find and replace” dialog box and shortcut keys added in virtual registry editor - -In the virtual registry editor, shortcut keys have been added for the Find option (Ctrl+F), and a dialog box that combines the “find” and “replace” tasks has been added to enable you to find and replace values and data. To access this combined dialog box, select a key and do one of the following: - -- Press **Ctrl+H** - -- Right-click a key and select **Replace**. - -- Select **View** > **Virtual Registry** > **Replace**. - -Previously, the “Replace” dialog box did not exist, and you had to make changes manually. - -#### Rename registry keys and package files successfully - -You can rename virtual registry keys and files without experiencing Sequencer issues. Previously, the Sequencer stopped working if you tried to rename a key. - -#### Import and export virtual registry keys - -You can import and export virtual registry keys. To import a key, right-click the node under which to import the key, navigate to the key you want to import, and then click **Import**. To export a key, right-click the key and select **Export**. - -#### Import a directory into the virtual file system - -You can import a directory into the VFS. To import a directory, click the **Package Files** tab, and then click **View** > **Virtual File System** > **Import Directory**. If you try to import a directory that contains files that are already in the VFS, the import fails, and an explanatory message is displayed. Prior to App-V, you could not import directories. - -#### Import or export a VFS file without having to delete and then add it back to the package - -You can import files to or export files from the VFS without having to delete the file and then add it back to the package. For example, you might use this feature to export a change log to a local drive, edit the file using an external editor, and then re-import the file into the VFS. - -To export a file, select the **Package Files** tab, right-click the file in the VFS, click **Export**, and choose an export location from which you can make your edits. - -To import a file, select the **Package Files** tab and right-click the file that you had exported. Browse to the file that you edited, and then click **Import**. The imported file will overwrite the existing file. - -After you import a file, you must save the package by clicking **File** > **Save**. - -#### Menu for adding a package file has moved - -The menu option for adding a package file has been moved. To find the Add option, select the **Package Files** tab, then click **View** > **Virtual File System** > **Add File**. Previously, you right-clicked a folder under the VFS node, and chose **Add File**. - -#### Virtual registry node expands MACHINE and USER hives by default - -When you open the virtual registry, the MACHINE and USER hives are shown below the top-level REGISTRY node. Previously, you had to expand the REGISTRY node to show the hives beneath. - -#### Enable or disable Browser Helper Objects - -You can enable or disable Browser Helper Objects by selecting a new check box, Enable Browser Helper Objects, on the Advanced tab of the Sequencer user interface. If Browser Helper Objects: - -- Exist in the package and are enabled, the check box is selected by default. - -- Exist in the package and are disabled, the check box is clear by default. - -- Exist in the package, with one or more enabled and one or more disabled, the check box is set to indeterminate by default. - -- Do not exist in the package, the check box is disabled. - -### Improvements to Package Converter - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -For more information including examples, see [Migrating to App-V for Windows from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md). - -#### Support for multiple scripts on a single event trigger - -App-V supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you are converting from App-V 4.6 to App-V 5.0 or later. To enable the use of multiple scripts, App-V uses a script launcher application, named ScriptRunner.exe, which is installed as part of the App-V client installation. - -For more information, including a list of event triggers and the context under which scripts can be run, see the Scripts section in [About App-V Dynamic Configuration](appv-dynamic-configuration.md). +App-V supports System Center 2016 and System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. ## Have a suggestion for App-V? - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics [Release Notes for App-V](appv-release-notes-for-appv-for-windows.md) - -  - -  - - - - - diff --git a/windows/manage/appv-accessibility.md b/windows/manage/appv-accessibility.md index a77cc5c218..34a3ab0a09 100644 --- a/windows/manage/appv-accessibility.md +++ b/windows/manage/appv-accessibility.md @@ -1,169 +1,4 @@ --- title: Accessibility for App-V (Windows 10) -description: Accessibility for App-V -author: MaggiePucciEvans -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-getting-started --- - - -# Accessibility for App-V - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Keyboard Shortcuts for the App-V Management Server - - -Following are the keyboard Shortcuts for the App-V Management Server: - - ---- - - - - - - - - - - - - - - - - - - - - -
    To do thisPress

    Close a dialog box.

    Esc

    Perform the default action of a dialog box.

    Enter

    Refresh the current page of the App-V client console.

    F5

    - -  - -## Keyboard Shortcuts for the App-V Sequencer - - -Following are the keyboard shortcuts for the Virtual Registry tab in the package editor in the App-V Sequencer: - - ---- - - - - - - - - - - - - - - - - -
    To do thisPress

    Open the Find dialog box.

    CTRL + F

    Open the Replace dialog box.

    CTRL + H

    - -  - -### Access Any Command with a Few Keystrokes - -**Important**   -The information in this section only applies to the App-V sequencer. For specific information about the App-V server, see the Keyboard Shortcuts for the App-V Management Server section of this document. - -  - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - An underline appears beneath the keyboard shortcut for each feature that is available in the current view. - -2. Press the letter underlined in the keyboard shortcut for the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - -  - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    [http://www.learningally.org/](http://go.microsoft.com/fwlink/?linkid=239)

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - -  - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](http://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with App-V](appv-getting-started.md) - -  - -  - - - - - diff --git a/windows/manage/appv-accessing-the-client-management-console.md b/windows/manage/appv-accessing-the-client-management-console.md index 4c622c5423..d6ad0b2b1a 100644 --- a/windows/manage/appv-accessing-the-client-management-console.md +++ b/windows/manage/appv-accessing-the-client-management-console.md @@ -1,26 +1,4 @@ --- title: How to access the client management console (Windows 10) -description: How to access the client management console -author: MaggiePucciEvans -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-using-the-client-management-console --- - -# How to access the client management console - -Use the App-V client management console to manage packages on the computer running the App-V client. - -> [!NOTE] -To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V client. - -The client management console is available from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=41186). - -## Have a suggestion for App-V? - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related topics - -- [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md index 71e3960d3e..af573415ac 100644 --- a/windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Add or Remove an Administrator by Using the Management Console +**Applies to** +- Windows 10, version 1607 Use the following procedures to add or remove an administrator on the Microsoft Application Virtualization (App-V) server. @@ -28,18 +30,10 @@ Use the following procedures to add or remove an administrator on the Microsoft 2. Right-click the account to be removed from the list of administrators and select **Remove**. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md index a5f136d917..5a7ba35ca9 100644 --- a/windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Add or Upgrade Packages by Using the Management Console +**Applies to** +- Windows 10, version 1607 You can the following procedure to add or upgrade a package to the App-V Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. @@ -37,18 +39,10 @@ You can the following procedure to add or upgrade a package to the App-V Managem 5. Click **Close** to close the **Add or Upgrade Packages** page. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-administering-appv-with-powershell.md b/windows/manage/appv-administering-appv-with-powershell.md index 5d9ef4ace0..877ce78083 100644 --- a/windows/manage/appv-administering-appv-with-powershell.md +++ b/windows/manage/appv-administering-appv-with-powershell.md @@ -1,6 +1,6 @@ --- -title: Administering App-V by Using PowerShell (Windows 10) -description: Administering App-V by Using PowerShell +title: Administering App-V by Using Windows PowerShell (Windows 10) +description: Administering App-V by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,15 +9,17 @@ ms.prod: w10 --- -# Administering App-V by Using PowerShell +# Administering App-V by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 + +Microsoft Application Virtualization (App-V) provides Windows PowerShell cmdlets, which can help administrators perform various App-V tasks. The following sections provide more information about using Windows PowerShell with App-V. + +## How to administer App-V by using Windows PowerShell -Microsoft Application Virtualization (App-V) provides Windows PowerShell cmdlets, which can help administrators perform various App-V tasks. The following sections provide more information about using PowerShell with App-V. - -## How to administer App-V by using PowerShell - - -Use the following PowerShell procedures to perform various App-V tasks. +Use the following Windows PowerShell procedures to perform various App-V tasks. @@ -32,59 +34,64 @@ Use the following PowerShell procedures to perform various App-V tasks. - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - + - + + + + +

    [How to Load the PowerShell Cmdlets and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)

    Describes how to install the PowerShell cmdlets and find cmdlet help and examples.

    [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)

    Describes how to install the Windows PowerShell cmdlets and find cmdlet help and examples.

    [How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)

    Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell.

    [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)

    Describes how to manage the client package lifecycle on a stand-alone computer by using Windows PowerShell.

    [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)

    Describes how to manage connection groups using PowerShell.

    [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)

    Describes how to manage connection groups by using Windows PowerShell.

    [How to Modify Client Configuration by Using PowerShell](appv-modify-client-configuration-with-powershell.md)

    Describes how to modify the client using PowerShell.

    [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md)

    Describes how to modify the client by using Windows PowerShell.

    [How to Apply the User Configuration File by Using PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)

    Describes how to apply a user configuration file using PowerShell.

    [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)

    Describes how to apply a user configuration file by using Windows PowerShell.

    [How to Apply the Deployment Configuration File by Using PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)

    Describes how to apply a deployment configuration file using PowerShell.

    [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)

    Describes how to apply a deployment configuration file by using Windows PowerShell.

    [How to Sequence a Package by Using PowerShell](appv-sequence-a-package-with-powershell.md)

    Describes how to create a new package using PowerShell.

    [How to Sequence a Package by Using Windows PowerShell](appv-sequence-a-package-with-powershell.md)

    Describes how to create a new package by using Windows PowerShell.

    [How to Create a Package Accelerator by Using PowerShell](appv-create-a-package-accelerator-with-powershell.md)

    Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications.

    [How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)

    Describes how to create a package accelerator by using Windows PowerShell. You can use package accelerators automatically sequence large, complex applications.

    [How to Enable Reporting on the App-V Client by Using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)

    [How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)

    Describes how to enable the computer running the App-V to send reporting information.

    [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)

    [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)

    Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.

    [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) +

    Describes how to use Windows PowerShell to configure a client after you deploy the App-V management and publishing servers, and add the required packages and connection groups.
      **Important**   -Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for PowerShell. +Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for Windows PowerShell.   -## PowerShell Error Handling +## Windows PowerShell Error Handling -Use the following table for information about App-V PowerShell error handling. +Use the following table for information about Windows PowerShell error handling for App-V. @@ -110,8 +117,8 @@ Use the following table for information about App-V PowerShell error handling. - +

    Package name contains $

    If a package name contains the character ( $ ), you must use a single-quote ( ‘ ), for example,

    -

    Add-AppvClientPackage ‘Contoso$App.appv’

    If a package name contains the character ( $ ), you must use a single-quote ( ' ), for example,

    +

    Add-AppvClientPackage 'Contoso$App.appv'
    @@ -121,18 +128,9 @@ Use the following table for information about App-V PowerShell error handling. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-administering-virtual-applications-with-the-management-console.md b/windows/manage/appv-administering-virtual-applications-with-the-management-console.md index 0b47267c1a..a110cd87b5 100644 --- a/windows/manage/appv-administering-virtual-applications-with-the-management-console.md +++ b/windows/manage/appv-administering-virtual-applications-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # Administering App-V Virtual Applications by Using the Management Console +**Applies to** +- Windows 10, version 1607 Use the Microsoft Application Virtualization (App-V) management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V client. One or more management servers typically share a common data store for configuration and package information. @@ -94,7 +96,7 @@ JavaScript must be enabled on the browser that opens the Web Management Console. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for this App-V deployment diff --git a/windows/manage/appv-allow-administrators-to-enable-connection-groups.md b/windows/manage/appv-allow-administrators-to-enable-connection-groups.md index faef4d1c5f..8241c5edef 100644 --- a/windows/manage/appv-allow-administrators-to-enable-connection-groups.md +++ b/windows/manage/appv-allow-administrators-to-enable-connection-groups.md @@ -11,20 +11,20 @@ ms.prod: w10 # How to Allow Only Administrators to Enable Connection Groups +**Applies to** +- Windows 10, version 1607 You can configure the App-V client so that only administrators (not end users) can enable or disable connection groups. In earlier versions of App-V, you could not prevent end users from performing these tasks. -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - -  +**Note**
    +This feature is supported starting in App-V 5.0 SP3. Use one of the following methods to allow only administrators to enable or disable connection groups. --++ @@ -36,35 +36,25 @@ Use one of the following methods to allow only administrators to enable or disab +

    Computer Configuration > Administrative Templates > System > App-V > Publishing

    - - + +

    Example: Set-AppvClientConfiguration -RequirePublishAsAdmin 1

    Group Policy setting

    Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

    -

    Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing

    PowerShell cmdlet

    Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter.

    +

    Windows PowerShell cmdlet

    Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

    Parameter values:

    • 0 - False

    • 1 - True

    -

    Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1
    -  +## Have a suggestion for App-V? -**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Managing Connection Groups](appv-managing-connection-groups.md) - -  - -  - - - - - diff --git a/windows/manage/appv-application-publishing-and-client-interaction.md b/windows/manage/appv-application-publishing-and-client-interaction.md index 1d9ff36d03..b99eb36f43 100644 --- a/windows/manage/appv-application-publishing-and-client-interaction.md +++ b/windows/manage/appv-application-publishing-and-client-interaction.md @@ -11,6 +11,8 @@ ms.prod: w10 # Application Publishing and Client Interaction +**Applies to** +- Windows 10, version 1607 This article provides technical information about common App-V client operations and their integration with the local operating system. @@ -21,8 +23,8 @@ The Sequencer creates App-V packages and produces a virtualized application. The --++ @@ -65,9 +67,7 @@ The Sequencer creates App-V packages and produces a virtualized application. The
    -  - -For information about sequencing, see [Application Virtualization Sequencing Guide](http://go.microsoft.com/fwlink/?LinkID=269810). +For information about sequencing, see [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). ## What’s in the appv file? @@ -123,7 +123,7 @@ To change the default location of the package store during setup, see [Enable th ### Shared Content Store -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information on shared content store mode, see . +If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). > [!NOTE] > The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. @@ -232,7 +232,7 @@ The Package Store contains a pristine copy of the package files that have been s ### COW roaming -The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\**\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. +The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\*<username>*\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. ### COW local @@ -245,7 +245,7 @@ Before an application can access the package registry data, the App-V Client mus When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at `%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat`. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. -**Registry.dat from Package Store ** > **%ProgramData%\Microsoft\AppV\Client\Vreg\{VersionGuid}.dat** +**Registry.dat from Package Store** > **%ProgramData%\Microsoft\AppV\Client\Vreg\\{VersionGuid}.dat**   When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. @@ -383,11 +383,11 @@ App-V Packages are staged upon addition to the computer with the App-V Client. T ### Mounting packages -Packages can be explicitly loaded using the PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. +Packages can be explicitly loaded using the Windows PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. ### Streaming packages -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MAcHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the Windows PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: +The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the Windows PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: @@ -441,7 +441,7 @@ These settings affect the behavior of streaming App-V package assets to the clie ### Background streaming -The PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. +The Windows PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. ### Optimized streaming @@ -457,7 +457,7 @@ App-V Packages require updating throughout the lifecycle of the application. App ### Package removal -The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. +The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the Windows PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. ## Roaming registry and data @@ -485,8 +485,8 @@ App-V registry roaming falls into two scenarios, as shown in the following table
    --++ @@ -499,8 +499,8 @@ App-V registry roaming falls into two scenarios, as shown in the following table @@ -513,8 +513,8 @@ App-V registry roaming falls into two scenarios, as shown in the following table

    In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:

      -

    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\{UserSID}\REGISTRY\MACHINE\SOFTWARE

      • -

    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\Registry\User\{UserSID}\SOFTWARE

      • +

    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\{UserSID}\REGISTRY\MACHINE\SOFTWARE

      • +

    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\\Registry\User\\{UserSID}\SOFTWARE

    @@ -532,21 +532,21 @@ The following table shows local and roaming locations, when folder redirection h | VFS directory in package | Mapped location of backing store | | - | - | -| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\ProgramFilesX86 | -| SystemX86 | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\SystemX86 | -| Windows | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\Windows | -| appv\_ROOT | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\appv_ROOT| -| AppData | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\AppData | +| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | +| SystemX86 | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | +| Windows | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | +| appv\_ROOT | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv_ROOT| +| AppData | C:\Users\username\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\AppData | The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). | VFS directory in package | Mapped location of backing store | | - | - | -| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\ProgramFilesX86 | -| SystemX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\SystemX86 | -| Windows | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\Windows | -| appv_ROOT | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\appv\_ROOT | -| AppData | \\Fileserver\users\Local\roaming\Microsoft\AppV\Client\VFS\\AppData | +| ProgramFilesX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\ProgramFilesX86 | +| SystemX86 | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\SystemX86 | +| Windows | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\Windows | +| appv_ROOT | C:\Users\Local\AppData\Local\Microsoft\AppV\Client\VFS\\<GUID>\appv\_ROOT | +| AppData | \\Fileserver\users\Local\roaming\Microsoft\AppV\Client\VFS\\<GUID>\AppData |   The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: @@ -598,19 +598,15 @@ This process will re-create both the local and network locations for AppData and ## App-V client application lifecycle management -In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of PowerShell commands initiated on the computer running the App-V Client. +In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of Windows PowerShell commands initiated on the computer running the App-V Client. -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012 visit: . +This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177). -The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) or use Windows PowerShell: - -``` syntax -get-command *appv* -``` +The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell). ### Publishing refresh -The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following PowerShell cmdlets: +The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following Windows PowerShell cmdlets: - **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. @@ -628,7 +624,7 @@ The focus of the following sections is to detail the operations that occur durin ### Adding an App-V package -Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. +Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in Windows PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. **How to add an App-V package** @@ -990,7 +986,7 @@ The App-V Client supports publishing applications with support for COM integrati App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). -Details on App-V integration are available at: . +For details on App-V integration, see [Microsoft Application Virtualization 5.0 Integration](https://blogs.technet.microsoft.com/appv/2013/01/03/microsoft-application-virtualization-5-0-integration). ### Software clients and application capabilities @@ -1059,7 +1055,7 @@ For situations where there is more than one application that could register the The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: . +The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: [App Paths - A Virtual Application Extension in App-V 5.0](https://blogs.technet.microsoft.com/virtualworld/2012/12/12/app-paths-a-virtual-application-extension-in-app-v-5-0/). ### Virtual application @@ -1181,7 +1177,7 @@ App-V Packages contain the Manifest file inside of the appv package file, which ### Example for dynamic configuration files -The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information review the App-V Sequencing Guide at: [http://go.microsoft.com/fwlink/?LinkID=269810](http://go.microsoft.com/fwlink/?LinkID=269810). +The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). **Manifest** @@ -1288,4 +1284,4 @@ There are three specific categories of events recorded described below. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md index 5da620fe9f..c12c85996f 100644 --- a/windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md +++ b/windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Apply the Deployment Configuration File by Using PowerShell (Windows 10) -description: How to Apply the Deployment Configuration File by Using PowerShell +title: How to Apply the Deployment Configuration File by Using Windows PowerShell (Windows 10) +description: How to Apply the Deployment Configuration File by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,8 +9,10 @@ ms.prod: w10 --- -# How to Apply the Deployment Configuration File by Using PowerShell +# How to Apply the Deployment Configuration File by Using Windows PowerShell +**Applies to** +- Windows 10, version 1607 The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: @@ -18,31 +20,22 @@ The dynamic deployment configuration file is applied when a package is added or **c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** -**To Apply the Deployment Configuration File Using PowerShell** +**To Apply the Deployment Configuration File Using Windows PowerShell** -- To specify a new default set of configurations for all users who will run the package on a specific computer, using a PowerShell console type the following: +- To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, type the following: - **Add-AppVClientPackage –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** + `Add-AppVClientPackage -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml` - **Note**   + **Note**
    This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - **Set-AppVClientPackage –Name Myapp –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** + `Set-AppVClientPackage -Name Myapp -Path c:\Packages\Contoso\MyApp.appv -DynamicDeploymentConfiguration c:\Packages\Contoso\DynamicConfigurations\deploymentconfig.xml`   +## Have a suggestion for App-V? - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-apply-the-user-configuration-file-with-powershell.md b/windows/manage/appv-apply-the-user-configuration-file-with-powershell.md index b924e0df13..7874045e20 100644 --- a/windows/manage/appv-apply-the-user-configuration-file-with-powershell.md +++ b/windows/manage/appv-apply-the-user-configuration-file-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Apply the User Configuration File by Using PowerShell (Windows 10) -description: How to Apply the User Configuration File by Using PowerShell +title: How to Apply the User Configuration File by Using Windows PowerShell (Windows 10) +description: How to Apply the User Configuration File by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,8 +9,10 @@ ms.prod: w10 --- -# How to Apply the User Configuration File by Using PowerShell +# How to Apply the User Configuration File by Using Windows PowerShell +**Applies to** +- Windows 10, version 1607 The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. @@ -20,26 +22,19 @@ Use the following procedure to specify a user-specific configuration file. The f **To apply a user Configuration file** -1. To add the package to the computer using the PowerShell console type the following command: +1. To add the package to the computer using the Windows PowerShell console, type the following command: - **Add-AppVClientPackage c:\\Packages\\Contoso\\MyApp.appv**. + `Add-AppVClientPackage c:\Packages\Contoso\MyApp.appv` 2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: - **Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath c:\\Packages\\Contoso\\config.xml** + `Publish-AppVClientPackage $pkg -DynamicUserConfigurationPath c:\Packages\Contoso\config.xml` - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md index b41c87dd1b..bf7e512509 100644 --- a/windows/manage/appv-capacity-planning.md +++ b/windows/manage/appv-capacity-planning.md @@ -11,10 +11,12 @@ ms.prod: w10 # App-V Capacity Planning +**Applies to** +- Windows Server 2016 The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. -**Important**   +>**Important**   Use the information in this section only as a general guide for planning your App-V deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary.   @@ -22,12 +24,12 @@ Use the information in this section only as a general guide for planning your Ap ## Determine the Project Scope -Before you design the App-V infrastructure, you must determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. +Before you design the App-V infrastructure, determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization.

    Applications that are run as standard users

    When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

      -

    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

      • -

    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\REGISTRY\USER\{UserSID}\SOFTWARE

      • +

    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

      • +

    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\\{PkgGUID}\REGISTRY\USER\\{UserSID}\SOFTWARE

    The locations are enabled for roaming based on the operating system settings.
    --++ @@ -47,29 +49,21 @@ Before you design the App-V infrastructure, you must determine the project’s s
    -  - ## Determine Which App-V Infrastructure is Required - -**Important**   -Both of the following models require the App-V client to be installed on the computer where you plan to run virtual applications. - You can also manage your App-V environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). -  - - **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios: - With disconnected remote users who cannot connect to the App-V infrastructure. - - When you are running a software management system, such as Configuration Manager 2012. + - When you are running a software management system, such as System Center 2012 Configuration Manager. - When network bandwidth limitations inhibit electronic software distribution. -- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: +- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for App-V Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - **Important**   + >**Important**   The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V Supported Configurations](appv-supported-configurations.md).   @@ -937,7 +931,7 @@ Although there are a number of fault-tolerance strategies and technologies avail ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-client-configuration-settings.md b/windows/manage/appv-client-configuration-settings.md index 93b6745d4e..59e07c520f 100644 --- a/windows/manage/appv-client-configuration-settings.md +++ b/windows/manage/appv-client-configuration-settings.md @@ -10,104 +10,106 @@ ms.prod: w10 # About Client Configuration Settings -The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V Client configuration settings and explains their uses. You can use PowerShell to modify the client configuration settings. For more information about using PowerShell and App-V see [Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md). +**Applies to** +- Windows 10, version 1607 +The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V Client configuration settings and explains their uses. You can use Windows PowerShell to modify the client configuration settings. For more information about using Windows PowerShell and App-V see [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md). +You can use Group Policy to configure App-V client settings by using the Group Policy Management Console under **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. ## App-V Client Configuration Settings: Windows PowerShell The following table provides information about App-V client configuration settings that can be configured through Windows PowerShell cmdlets: -| **Name of option in Windows PowerShell**
    Type | Description | Cmdlet or cmdlets for setting | Disabled Policy State Keys and Values | +| Windows PowerShell cmdlet or cmdlets,
    **Option**
    Type | Description | Disabled Policy State Keys and Values | |------------|------------|------------|------------| -| **PackageInstallationRoot**
    String | Specifies directory where all new applications and updates will be installed. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **PackageSourceRoot**
    String | Overrides source location for downloading package content. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **AllowHighCostLaunch**
    True (enabled); False (Disabled state) | This setting controls whether virtualized applications are launched on Windows 10 machines connected via a metered network connection (For example, 4G). | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | 0 | -| **ReestablishmentRetries**
    Integer (0-99) | Specifies the number of times to retry a dropped session. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **ReestablishmentInterval**
    Integer (0-3600) | Specifies the number of seconds between attempts to reestablish a dropped session. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **LocationProvider**
    String | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **CertFilterForClientSsl**
    String | Specifies the path to a valid certificate in the certificate store. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **VerifyCertificateRevocationList**
    True(enabled); False(Disabled state) | Verifies Server certificate revocation status before steaming using HTTPS. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | 0 | -| **SharedContentStoreMode**
    True(enabled); False(Disabled state) | Specifies that streamed package contents will be not be saved to the local hard disk. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | 0 | -| **Name**
    String | Displays the name of publishing server. | Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **URL**
    String | Displays the URL of publishing server. | Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **GlobalRefreshEnabled**
    True(enabled); False(Disabled state) | Enables global publishing refresh (Boolean) | Set-AppvPublishingServer | False | -| **GlobalRefreshOnLogon**
    True(enabled); False(Disabled state) | Triggers a global publishing refresh on logon. ( Boolean) | Set-AppvPublishingServer | False | -| **GlobalRefreshInterval**
    Integer (0-744) | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. | Set-AppvPublishingServer | 0 | -| **GlobalRefreshIntervalUnit**
    0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | Set-AppvPublishingServer | 1 | -| **UserRefreshEnabled**
    True(enabled); False(Disabled state) | Enables user publishing refresh (Boolean) | Set-AppvPublishingServer | False | -| **UserRefreshOnLogon**
    True(enabled); False(Disabled state) | Triggers a user publishing refresh onlogon. ( Boolean)Word count (with spaces): 60 | Set-AppvPublishingServer | False | -| **UserRefreshInterval**
    Word count (with spaces): 85Integer (0-744 Hours) | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | Set-AppvPublishingServer | 0 | -| **UserRefreshIntervalUnit**
    0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | Set-AppvPublishingServer | 1 | -| **MigrationMode**
    True(enabled state); False (disabled state) | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | | -| **EnablePackageScripts**
    True(enabled); False(Disabled state) | Enables scripts defined in the package manifest of configuration files that should run. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | | -| **RoamingFileExclusions**
    String | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures' | Set-AppvClientConfiguration | | -| **RoamingRegistryExclusions**
    String | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **IntegrationRootUser**
    String | Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\\Microsoft\\AppV\\Client\\Integration. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **IntegrationRootGlobal**
    String | Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\\Microsoft\\AppV\\Client\\Integration | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **VirtualizableExtensions**
    String | A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](https://microsoft.sharepoint.com/teams/osg_core_dcp/cpub/partner/Shared%20Documents/APPV&UEV-for-Windows-RS1/App-V/App-V%20updated%20topics%20from%20JAN%20-%20PM%20reviews/appv-running-locally-installed-applications-inside-a-virtual-environment.md). | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written | -| **ReportingEnabled**
    True (enabled); False (Disabled state) | Enables the client to return information to a reporting server. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | False | -| **ReportingServerURL**
    String | Specifies the location on the reporting server where client information is saved. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **ReportingDataCacheLimit**
    Integer \[0-1024\] | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **ReportingDataBlockSize**
    Integer \[1024 - Unlimited\] | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **ReportingStartTime**
    Integer (0 – 23) | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
    **Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **ReportingInterval**
    Integer | Specifies the retry interval that the client will use to resend data to the reporting server. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\] | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Policy value not written (same as Not Configured) | -| **EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled) | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | | -| **EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Enables the publishing refresh progress bar for the computer running the App-V Client. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | | -| **HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Hides the publishing refresh progress bar. | Sync-AppvPublishingServer | | -| **ProcessesUsingVirtualComponents**
    String | Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | Set-AppvClientConfiguration,
    Set-AppvPublishingServer | Empty string. | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageInstallationRoot**
    String | Specifies directory where all new applications and updates will be installed. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageSourceRoot**
    String | Overrides source location for downloading package content. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-AllowHighCostLaunch**
    True (enabled); False (Disabled state) | This setting controls whether virtualized applications are launched on Windows 10 machines connected via a metered network connection (For example, 4G). | 0 | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentRetries**
    Integer (0-99) | Specifies the number of times to retry a dropped session. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentInterval**
    Integer (0-3600) | Specifies the number of seconds between attempts to reestablish a dropped session. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-LocationProvider**
    String | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-CertFilterForClientSsl**
    String | Specifies the path to a valid certificate in the certificate store. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VerifyCertificateRevocationList**
    True(enabled); False(Disabled state) | Verifies Server certificate revocation status before steaming using HTTPS. | 0 | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-SharedContentStoreMode**
    True(enabled); False(Disabled state) | Specifies that streamed package contents will be not be saved to the local hard disk. | 0 | +| Set-AppvPublishingServer

    **-Name**
    String | Displays the name of publishing server. | Policy value not written (same as Not Configured) | +| Set-AppvPublishingServer

    **-URL**
    String | Displays the URL of publishing server. | Policy value not written (same as Not Configured) | +| Set-AppvPublishingServer

    **-GlobalRefreshEnabled**
    True(enabled); False(Disabled state) | Enables global publishing refresh (Boolean) | False | +| Set-AppvPublishingServer

    **-GlobalRefreshOnLogon**
    True(enabled); False(Disabled state) | Triggers a global publishing refresh on logon. ( Boolean) | False | +| Set-AppvPublishingServer

    **-GlobalRefreshInterval**
    Integer (0-744) | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. | 0 | +| Set-AppvPublishingServer

    **-GlobalRefreshIntervalUnit**
    0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | 1 | +| Set-AppvPublishingServer

    **-UserRefreshEnabled**
    True(enabled); False(Disabled state) | Enables user publishing refresh (Boolean) | False | +| Set-AppvPublishingServer

    **-UserRefreshOnLogon**
    True(enabled); False(Disabled state) | Triggers a user publishing refresh onlogon. ( Boolean)Word count (with spaces): 60 | False | +| Set-AppvPublishingServer

    **-UserRefreshInterval**
    Word count (with spaces): 85Integer (0-744 Hours) | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | 0 | +| Set-AppvPublishingServer

    **-UserRefreshIntervalUnit**
    0 for hour, 1 for day | Specifies the interval unit (Hour 0-23, Day 0-31). | 1 | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-MigrationMode**
    True(enabled state); False (disabled state) | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePackageScripts**
    True(enabled); False(Disabled state) | Enables scripts defined in the package manifest of configuration files that should run. | | +| Set-AppvClientConfiguration

    **-RoamingFileExclusions**
    String | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures' | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-RoamingRegistryExclusions**
    String | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootUser**
    String | Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\\Microsoft\\AppV\\Client\\Integration. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootGlobal**
    String | Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\\Microsoft\\AppV\\Client\\Integration | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VirtualizableExtensions**
    String | A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md). | Policy value not written | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingEnabled**
    True (enabled); False (Disabled state) | Enables the client to return information to a reporting server. | False | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingServerURL**
    String | Specifies the location on the reporting server where client information is saved. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataCacheLimit**
    Integer \[0-1024\] | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataBlockSize**
    Integer \[1024 - Unlimited\] | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingStartTime**
    Integer (0 – 23) | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
    **Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingInterval**
    Integer | Specifies the retry interval that the client will use to resend data to the reporting server. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\] | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server. | Policy value not written (same as Not Configured) | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled) | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Enables the publishing refresh progress bar for the computer running the App-V Client. | | +| Sync-AppvPublishingServer

    **-HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Hides the publishing refresh progress bar. | | +| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ProcessesUsingVirtualComponents**
    String | Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | Empty string. | -## App-V Client Configuration Settings: Setup Flags and Registry Keys +## App-V Client Configuration Settings: Registry Keys -The following table provides information about App-V client configuration settings that can be configured through setup flags or in the registry: +The following table provides information about App-V client configuration settings that can be configured through the registry: -| **Setting name**
    Type | Setup Flag | Registry Key Value | Disabled Policy State Keys and Values | -|--------------------------------------------------------------------------------|---------------------------|-------------------------------------------------------------------------|---------------------------------------------------| -| **PackageInstallationRoot**
    String | PACKAGEINSTALLATIONROOT | Streaming\\PackageInstallationRoot | Policy value not written (same as Not Configured) | -| **PackageSourceRoot**
    String | PACKAGESOURCEROOT | Streaming\\PackageSourceRoot | Policy value not written (same as Not Configured) | -| **AllowHighCostLaunch**
    True (enabled); False (Disabled state) | Not available. | Streaming\\AllowHighCostLaunch | 0 | -| **ReestablishmentRetries**
    Integer (0-99) | Not available. | Streaming\\ReestablishmentRetries | Policy value not written (same as Not Configured) | -| **ReestablishmentInterval**
    Integer (0-3600) | Not available. | Streaming\\ReestablishmentInterval | Policy value not written (same as Not Configured) | -| **LocationProvider**
    String | Not available. | Streaming\\LocationProvider | Policy value not written (same as Not Configured) | -| **CertFilterForClientSsl**
    String | Not available. | Streaming\\CertFilterForClientSsl | Policy value not written (same as Not Configured) | -| **VerifyCertificateRevocationList**
    True(enabled); False(Disabled state) | Not available. | Streaming\\VerifyCertificateRevocationList | 0 | -| **SharedContentStoreMode**
    True(enabled); False(Disabled state) | SHAREDCONTENTSTOREMODE | Streaming\\SharedContentStoreMode | 0 | -| **Name**
    String | PUBLISHINGSERVERNAME | Publishing\\Servers{serverId}\\FriendlyName | Policy value not written (same as Not Configured) | -| **URL**
    String | PUBLISHINGSERVERURL | Publishing\\Servers{serverId}\\URL | Policy value not written (same as Not Configured) | -| **GlobalRefreshEnabled**
    True(enabled); False(Disabled state) | GLOBALREFRESHENABLED | Publishing\\Servers{serverId}\\GlobalEnabled | False | -| **GlobalRefreshOnLogon**
    True(enabled); False(Disabled state) | GLOBALREFRESHONLOGON | Publishing\\Servers{serverId}\\GlobalLogonRefresh | False | -| **GlobalRefreshInterval**
    Integer (0-744) | GLOBALREFRESHINTERVAL | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval | 0 | -| **GlobalRefreshIntervalUnit**
    0 for hour, 1 for day | GLOBALREFRESHINTERVALUNI | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit | 1 | -| **UserRefreshEnabled**
    True(enabled); False(Disabled state) | USERREFRESHENABLED | Publishing\\Servers{serverId}\\UserEnabled | False | -| **UserRefreshOnLogon**
    True(enabled); False(Disabled state) | USERREFRESHONLOGON | Publishing\\Servers{serverId}\\UserLogonRefresh | False | -| **UserRefreshInterval**
    Word count (with spaces): 85Integer (0-744 Hours) | USERREFRESHINTERVAL | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval | 0 | -| **UserRefreshIntervalUnit**
    0 for hour, 1 for day | USERREFRESHINTERVALUNIT | Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit | 1 | -| **MigrationMode**
    True(enabled state); False (disabled state) | MIGRATIONMODE | Coexistence\\MigrationMode | | -| **EnablePackageScripts**
    True(enabled); False(Disabled state) | ENABLEPACKAGESCRIPTS | \\Scripting\\EnablePackageScripts | | -| **RoamingFileExclusions**
    String | ROAMINGFILEEXCLUSIONS | | | -| **RoamingRegistryExclusions**
    String | ROAMINGREGISTRYEXCLUSIONS | Integration\\RoamingReglstryExclusions | Policy value not written (same as Not Configured) | -| **IntegrationRootUser**
    String | Not available. | Integration\\IntegrationRootUser | Policy value not written (same as Not Configured) | -| **IntegrationRootGlobal**
    String | Not available. | Integration\\IntegrationRootGlobal | Policy value not written (same as Not Configured) | -| **VirtualizableExtensions**
    String | Not available. | Integration\\VirtualizableExtensions | Policy value not written | -| **ReportingEnabled**
    True (enabled); False (Disabled state) | Not available. | Reporting\\EnableReporting | False | -| **ReportingServerURL**
    String | Not available. | Reporting\\ReportingServer | Policy value not written (same as Not Configured) | -| **ReportingDataCacheLimit**
    Integer \[0-1024\] | Not available. | Reporting\\DataCacheLimit | Policy value not written (same as Not Configured) | -| **ReportingDataBlockSize**
    Integer \[1024 - Unlimited\] | Not available. | Reporting\\DataBlockSize | Policy value not written (same as Not Configured) | -| **ReportingStartTime**
    Integer (0 – 23) | Not available. | Reporting\\ StartTime | Policy value not written (same as Not Configured) | -| **ReportingInterval**
    Integer | Not available. | Reporting\\RetryInterval | Policy value not written (same as Not Configured) | -| **ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\] | Not available. | Reporting\\RandomDelay | Policy value not written (same as Not Configured) | -| **EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled) | Not available. | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization | | -| **EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Not available. | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Publishing | | -| **HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | Not available. | | | -| **ProcessesUsingVirtualComponents**
    String | Not available. | Virtualization\\ProcessesUsingVirtualComponents | Empty string. | +| **Setting name**
    Type | Registry Key Value | Disabled Policy State Keys and Values | +|---------------------------|---------------------|---------------------------------------| +| **PackageInstallationRoot**
    String | Streaming\\PackageInstallationRoot | Policy value not written (same as Not Configured) | +| **PackageSourceRoot**
    String | Streaming\\PackageSourceRoot | Policy value not written (same as Not Configured) | +| **AllowHighCostLaunch**
    True (enabled); False (Disabled state) | Streaming\\AllowHighCostLaunch | 0 | +| **ReestablishmentRetries**
    Integer (0-99) | Streaming\\ReestablishmentRetries | Policy value not written (same as Not Configured) | +| **ReestablishmentInterval**
    Integer (0-3600) | Streaming\\ReestablishmentInterval | Policy value not written (same as Not Configured) | +| **LocationProvider**
    String | Streaming\\LocationProvider | Policy value not written (same as Not Configured) | +| **CertFilterForClientSsl**
    String | Streaming\\CertFilterForClientSsl | Policy value not written (same as Not Configured) | +| **VerifyCertificateRevocationList**
    True(enabled); False(Disabled state) | Streaming\\VerifyCertificateRevocationList | 0 | +| **SharedContentStoreMode**
    True(enabled); False(Disabled state) | Streaming\\SharedContentStoreMode | 0 | +| **Name**
    String | Publishing\\Servers{serverId}\\FriendlyName | Policy value not written (same as Not Configured) | +| **URL**
    String | Publishing\\Servers{serverId}\\URL | Policy value not written (same as Not Configured) | +| **GlobalRefreshEnabled**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\GlobalEnabled | False | +| **GlobalRefreshOnLogon**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\GlobalLogonRefresh | False | +| **GlobalRefreshInterval**
    Integer (0-744) | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval | 0 | +| **GlobalRefreshIntervalUnit**
    0 for hour, 1 for day | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit | 1 | +| **UserRefreshEnabled**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\UserEnabled | False | +| **UserRefreshOnLogon**
    True(enabled); False(Disabled state) | Publishing\\Servers{serverId}\\UserLogonRefresh | False | +| **UserRefreshInterval**
    Word count (with spaces): 85Integer (0-744 Hours) | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval | 0 | +| **UserRefreshIntervalUnit**
    0 for hour, 1 for day | Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit | 1 | +| **MigrationMode**
    True(enabled state); False (disabled state) | Coexistence\\MigrationMode | | +| **EnablePackageScripts**
    True(enabled); False(Disabled state) | \\Scripting\\EnablePackageScripts | | +| **RoamingFileExclusions**
    String | | | +| **RoamingRegistryExclusions**
    String | Integration\\RoamingReglstryExclusions | Policy value not written (same as Not Configured) | +| **IntegrationRootUser**
    String | Integration\\IntegrationRootUser | Policy value not written (same as Not Configured) | +| **IntegrationRootGlobal**
    String | Integration\\IntegrationRootGlobal | Policy value not written (same as Not Configured) | +| **VirtualizableExtensions**
    String | Integration\\VirtualizableExtensions | Policy value not written | +| **ReportingEnabled**
    True (enabled); False (Disabled state) | Reporting\\EnableReporting | False | +| **ReportingServerURL**
    String | Reporting\\ReportingServer | Policy value not written (same as Not Configured) | +| **ReportingDataCacheLimit**
    Integer \[0-1024\] | Reporting\\DataCacheLimit | Policy value not written (same as Not Configured) | +| **ReportingDataBlockSize**
    Integer \[1024 - Unlimited\] | Reporting\\DataBlockSize | Policy value not written (same as Not Configured) | +| **ReportingStartTime**
    Integer (0 – 23) | Reporting\\ StartTime | Policy value not written (same as Not Configured) | +| **ReportingInterval**
    Integer | Reporting\\RetryInterval | Policy value not written (same as Not Configured) | +| **ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\] | Reporting\\RandomDelay | Policy value not written (same as Not Configured) | +| **EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization | | +| **EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Publishing | | +| **HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled) | | | +| **ProcessesUsingVirtualComponents**
    String | Virtualization\\ProcessesUsingVirtualComponents | Empty string. | ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics -[Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) +[Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) -[How to Modify App-V Client Configuration Using the ADMX Template and Group Policy](appv-modify-client-configuration-with-the-admx-template-and-group-policy.md) diff --git a/windows/manage/appv-configure-access-to-packages-with-the-management-console.md b/windows/manage/appv-configure-access-to-packages-with-the-management-console.md index b2c55b2ab7..c01d1ba74b 100644 --- a/windows/manage/appv-configure-access-to-packages-with-the-management-console.md +++ b/windows/manage/appv-configure-access-to-packages-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Configure Access to Packages by Using the Management Console +**Applies to** +- Windows 10, version 1607 Before you deploy an App-V virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. @@ -55,18 +57,10 @@ Use the following procedure to configure access to virtualized packages. 3. To close the **AD ACCESS** page, click **Close**. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md index d05ca6113b..d0dd6dc5b9 100644 --- a/windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md +++ b/windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md @@ -11,94 +11,53 @@ ms.prod: w10 # How to Make a Connection Group Ignore the Package Version +**Applies to** +- Windows 10, version 1607 -Microsoft Application Virtualization (App-V) lets you configure a connection group to use any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. +Application Virtualization (App-V) lets you configure a connection group to use any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. -To upgrade a package in some earlier versions of App-V, you had to perform several steps, including disabling the connection group and modifying the connection group’s XML definition file. +You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group: - ---- - - - - - - - - - - - - -
    Task description with App-VHow to perform the task with App-V

    You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group.

    -

    How the feature works:

    -
      -

    • If the connection group has access to multiple versions of a package, the latest version is used.

      • -

    • If the connection group contains an optional package that has an incorrect version, the package is ignored and won’t block the connection group’s virtual environment from being created.

      • -

    • If the connection group contains a non-optional package that has an incorrect version, the connection group’s virtual environment cannot be created.

      • -
    		 ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    App-V Server – Management Console

      -

    1. In the Management Console, select CONNECTION GROUPS.

      2. -

    2. Select the correct connection group from the Connection Groups library.

      3. -

    3. Click EDIT in the CONNECTED PACKAGES pane.

      4. -

    4. Select Use Any Version check box next to the package name, and click Apply.

      5. -
    -

    For more about adding or upgrading packages, see [How to Add or Upgrade Packages by Using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md).

    App-V Client on a Stand-alone computer

      -

    1. Create the connection group XML document.

      2. -

    2. For the package to be upgraded, set the Package tag attribute VersionID to an asterisk (*).

      3. -

    3. Use the following cmdlet to add the connection group, and include the path to the connection group XML document:

      -

      Add-AppvClientConnectionGroup

      4. -

    4. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package:

      -
        -

      • RemoveAppvClientPackage

        • -

      • Add-AppvClientPackage

        • -

      • Publish-AppvClientPackage

        • -
      5. -
    -

    For more information, see [How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md).

    -
    -

     

    +- If the connection group has access to multiple versions of a package, the latest version is used. -  +- If the connection group contains an optional package that has an incorrect version, the package is ignored and won’t block the connection group’s virtual environment from being created. + +- If the connection group contains a non-optional package that has an incorrect version, the connection group’s virtual environment cannot be created. + +## To make a connection group ignore the package version by using the App-V Server Management Console + +1. In the Management Console, select **CONNECTION GROUPS**. + +2. Select the correct connection group from the Connection Groups library. + +3. Click **EDIT** in the CONNECTED PACKAGES pane. + +4. Select **Use Any Version** check box next to the package name, and click **Apply**. + +For more about adding or upgrading packages, see [How to Add or Upgrade Packages by Using the Management Console](appv-add-or-upgrade-packages-with-the-management-console.md). + +## To make a connection group ignore the package version from the App-V client on a stand-alone computer + +1. Create the connection group XML document. + +2. For the package to be upgraded, set the **Package** tag attribute **VersionID** to an asterisk (*). + +3. Use the following cmdlet to add the connection group, and include the path to the connection group XML document: + + `Add-AppvClientConnectionGroup` + +4. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package: + + - RemoveAppvClientPackage + - Add-AppvClientPackage + - Publish-AppvClientPackage + +For more information, see [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md). ## Have a suggestion for App-V? - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Managing Connection Groups](appv-managing-connection-groups.md) - -  - -  - - - - - diff --git a/windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md b/windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md index f3d3469885..14b25e2912 100644 --- a/windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md +++ b/windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md @@ -11,12 +11,14 @@ ms.prod: w10 # How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server +**Applies to** +- Windows 10, version 1607 Deploying packages and connection groups using the App-V publishing server is helpful because it offers single-point management and high scalability. Use the following steps to configure the App-V client to receive updates from the publishing server. -**Note**   +**Note**
    For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**.   @@ -27,56 +29,37 @@ For the following procedures the management server was installed on a computer n 2. To open the management console click the following link, open a browser and type the following: http://MyMgmtSrv/AppvManagement/Console.html in a web browser, and import, publish, and entitle all the packages and connection groups which will be necessary for a particular set of users. -3. On the computer running the App-V client, open an elevated PowerShell command prompt, run the following command: +3. On the computer running the App-V client, open an elevated Windows PowerShell command prompt, and run the following command: - **Add-AppvPublishingServer  -Name  ABC  -URL  http:// MyPubSrv/AppvPublishing** + `Add-AppvPublishingServer -Name ABC -URL http://MyPubSrv/AppvPublishing` This command will configure the specified publishing server. You should see output similar to the following: - + + ``` Id                        : 1 - SetByGroupPolicy          : False - Name                      : ABC - URL                       : http:// MyPubSrv/AppvPublishing - GlobalRefreshEnabled      : False - GlobalRefreshOnLogon      : False - GlobalRefreshInterval     : 0 - GlobalRefreshIntervalUnit : Day - UserRefreshEnabled        : True - UserRefreshOnLogon        : True - UserRefreshInterval       : 0 - UserRefreshIntervalUnit   : Day + ``` - The returned Id – in this case 1 +4. On the computer running the App-V client, open a Windows PowerShell command prompt, and type the following command: -4. On the computer running the App-V client, open a PowerShell command prompt, and type the following command: - - **Sync-AppvPublishingServer  -ServerId  1** + `Sync-AppvPublishingServer -ServerId 1` The command will query the publishing server for the packages and connection groups that need to be added or removed for this particular client based on the entitlements for the packages and connection groups as configured on the management server. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-connect-to-the-management-console.md b/windows/manage/appv-connect-to-the-management-console.md index ff0f1cc327..47da73bf11 100644 --- a/windows/manage/appv-connect-to-the-management-console.md +++ b/windows/manage/appv-connect-to-the-management-console.md @@ -10,17 +10,20 @@ ms.prod: w10 # How to Connect to the Management Console +**Applies to** +- Windows 10, version 1607 + Use the following procedure to connect to the App-V Management Console. **To connect to the App-V Management Console** -1. Open Internet Explorer browser and type the address for the App-V. For example, **http://\<_management server name_\>:\<_management service port number_\>/console.html**. +1. Open Internet Explorer browser and type the address for the App-V Management server. For example, **http://\<_management server name_\>:\<_management service port number_\>/console.html**. 2. To view different sections of the console, click the desired section in the navigation pane. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-connection-group-file.md b/windows/manage/appv-connection-group-file.md index cf82d7392b..a523cd8c6d 100644 --- a/windows/manage/appv-connection-group-file.md +++ b/windows/manage/appv-connection-group-file.md @@ -11,6 +11,8 @@ ms.prod: w10 # About the Connection Group File +**Applies to** +- Windows 10, version 1607 **In this topic:** @@ -201,91 +203,64 @@ The virtual application Microsoft Outlook is running in virtual environment **XY ## Supported virtual application connection configurations +The following application connection configurations are supported. - ---- - - - - - - - - - - - - - - - - - - - - -
    ConfigurationExample scenario

    An. exe file and plug-in (.dll)

      -

    • You want to distribute Microsoft Office to all users, but distribute a Microsoft Excel plug-in to only a subset of users.

      • -

    • Enable the connection group for the appropriate users.

      • -

    • Update each package individually as required.

      • -

    An. exe file and a middleware application

      -

    • You have an application requires a middleware application, or several applications that all depend on the same middleware runtime version.

      • -

    • All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime.

      • -

    • You can optionally combine multiple middleware applications into a single connection group.

      - ---- - - - - - - - - - - - - - - - - -
      ExampleExample description

      Virtual application connection group for the financial division

        -

      • Middleware application 1

        • -

      • Middleware application 2

        • -

      • Middleware application 3

        • -

      • Middleware application runtime

        • -

      Virtual application connection group for HR division

        -

      • Middleware application 5

        • -

      • Middleware application 6

        • -

      • Middleware application runtime

        • -
      -

       

      • -

    An. exe file and an .exe file

    You have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines.

    -

    Example:

    -

    If you are deploying Microsoft Lync 2010, you can use three packages:

    -
      -

    • Microsoft Office 2010

      • -

    • Microsoft Communicator 2007

      • -

    • Microsoft Lync 2010

      • -
    -

    You can manage the deployment using the following connection groups:

    -
      -

    • Microsoft Office 2010 and Microsoft Communicator 2007

      • -

    • Microsoft Office 2010 and Microsoft Lync 2010

      • -
    -

    When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group.

    +- **An. exe file and plug-in (.dll)**. For example, you might want to distribute Microsoft Office to all users, but distribute a Microsoft Excel plug-in to only a subset of users. + Enable the connection group for the appropriate users. Update each package individually as required. + +- **An. exe file and a middleware application**. You might have an application that requires a middleware application, or several applications that all depend on the same middleware runtime version. + + All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime. You can optionally combine multiple middleware applications into a single connection group. + + + + + + + + + + + + + + + + + + + + + + +
    ExampleExample description

    Virtual application connection group for the financial division

      +

    • Middleware application 1

      • +

    • Middleware application 2

      • +

    • Middleware application 3

      • +

    • Middleware application runtime

      • +

    Virtual application connection group for HR division

      +

    • Middleware application 5

      • +

    • Middleware application 6

      • +

    • Middleware application runtime

      • +
    + +- **An. exe file and an .exe file**. You might have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines. + + For example, if you are deploying Microsoft Lync 2010, you can use three packages: + - Microsoft Office 2010 + - Microsoft Communicator 2007 + - Microsoft Lync 2010

    + + You can manage the deployment using the following connection groups: + - Microsoft Office 2010 and Microsoft Communicator 2007 + - Microsoft Office 2010 and Microsoft Lync 2010

    + + When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-connection-group-virtual-environment.md b/windows/manage/appv-connection-group-virtual-environment.md index 8b3a5e00fc..78339b6533 100644 --- a/windows/manage/appv-connection-group-virtual-environment.md +++ b/windows/manage/appv-connection-group-virtual-environment.md @@ -11,6 +11,8 @@ ms.prod: w10 # About the Connection Group Virtual Environment +**Applies to** +- Windows 10, version 1607 **In this topic:** @@ -92,7 +94,7 @@ In the example above, when a virtualized application tries to find a specific fi ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md index 6ef26859d9..bb5c9776c7 100644 --- a/windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md +++ b/windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md @@ -11,6 +11,9 @@ ms.prod: w10 # How to Convert a Package Created in a Previous Version of App-V +**Applies to** +- Windows 10, version 1607 + You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V. > [!NOTE] @@ -54,7 +57,7 @@ When you convert packages from App-V 4.6 to App-V for Windows 10, the App-V for ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md index fab3419e83..467da82dda 100644 --- a/windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ b/windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -11,14 +11,16 @@ ms.prod: w10 # How to Create a Connection Group with User-Published and Globally Published Packages +**Applies to** +- Windows 10, version 1607 You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: -- [How to use PowerShell cmdlets to create the user-entitled connection groups](#bkmk-posh-userentitled-cg) +- [How to use Windows PowerShell cmdlets to create user-entitled connection groups](#how-to-use-powershell-cmdlets-to-create-user-entitled-connection-groups) -- [How to use the App-V Server to create the user-entitled connection groups](#bkmk-appvserver-userentitled-cg) +- [How to use the App-V Server to create user-entitled connection groups](#how-to-use-the-app-v-server-to-create-user-entitled-connection-groups) -**What to know before you start:** +## What to know before you start: @@ -46,27 +48,27 @@ You can create user-entitled connection groups that contain both user-published   -**How to use PowerShell cmdlets to create user-entitled connection groups** +## How to use Windows PowerShell cmdlets to create user-entitled connection groups 1. Add and publish packages by using the following commands: - - **Add-AppvClientPackage Pacakage1\_AppV\_file\_Path** - - **Add-AppvClientPackage Pacakage2\_AppV\_file\_Path** - - **Publish-AppvClientPackage -PackageId Package1\_ID -VersionId Package1\_Version ID -Global** - - **Publish-AppvClientPackage -PackageId Package2\_ID -VersionId Package2\_ID** + + ``` + Add-AppvClientPackage + Add-AppvClientPackage + Publish-AppvClientPackage -PackageId  -VersionId -Global + Publish-AppvClientPackage -PackageId -VersionId  + ``` 2. Create the connection group XML file. For more information, see [About the Connection Group File](appv-connection-group-file.md). 3. Add and publish the connection group by using the following commands: + + ``` + Add-AppvClientConnectionGroup + Enable-AppvClientConnectionGroup -GroupId  -VersionId + ``` - **Add-AppvClientConnectionGroup Connection\_Group\_XML\_file\_Path** - - **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID** - -**How to use the App-V Server to create user-entitled connection groups** +## How to use the App-V Server to create user-entitled connection groups 1. Open the App-V Management Console. @@ -74,7 +76,9 @@ You can create user-entitled connection groups that contain both user-published 3. Follow the instructions in [How to Create a Connection Group](appv-create-a-connection-group.md) to create the connection group, and add the user-published and globally published packages. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-create-a-connection-group.md b/windows/manage/appv-create-a-connection-group.md index 1f77e35d5d..3bbc7aa888 100644 --- a/windows/manage/appv-create-a-connection-group.md +++ b/windows/manage/appv-create-a-connection-group.md @@ -11,8 +11,10 @@ ms.prod: w10 # How to Create a Connection Group +**Applies to** +- Windows 10, version 1607 -Use these steps to create a connection group by using the App-V Management Console. To use PowerShell to create connection groups, see [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md). +Use these steps to create a connection group by using the App-V Management Console. To use Windows PowerShell to create connection groups, see [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md). When you place packages in a connection group, their package root paths are merged. If you remove packages, only the remaining packages maintain the merged root. @@ -32,27 +34,17 @@ When you place packages in a connection group, their package root paths are merg To reprioritize the applications in your connection group, use the arrows in the **PACKAGES IN** pane. - **Important**   + **Important**
    By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane. -   - 6. After adding all the applications and configuring Active Directory access, click **Apply**. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) [Managing Connection Groups](appv-managing-connection-groups.md) - -  - -  - - - - - diff --git a/windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md index 5ae5d599c7..82eb3a5165 100644 --- a/windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md +++ b/windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Create a Custom Configuration File by Using the App-V Management Console +**Applies to** +- Windows 10, version 1607 You can use a dynamic configuration to customize an App-V package for a specific user. However, you must first create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use the files. Creation of the file is an advanced manual operation. For general information about dynamic user configuration files, see, [About App-V Dynamic Configuration](appv-dynamic-configuration.md). @@ -29,20 +31,10 @@ Use the following procedure to create a Dynamic User Configuration file by using **Note**   To export a configuration while running on Windows Server, you must disable "IE Enhanced Security Configuration". If this is enabled and set to block downloads, you cannot download anything from the App-V Server. -   +## Have a suggestion for App-V? - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-create-a-package-accelerator-with-powershell.md b/windows/manage/appv-create-a-package-accelerator-with-powershell.md index 0694929374..fb7b1a1129 100644 --- a/windows/manage/appv-create-a-package-accelerator-with-powershell.md +++ b/windows/manage/appv-create-a-package-accelerator-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Create a Package Accelerator by Using PowerShell (Windows 10) -description: How to Create a Package Accelerator by Using PowerShell +title: How to Create a Package Accelerator by Using Windows PowerShell (Windows 10) +description: How to Create a Package Accelerator by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,8 +9,10 @@ ms.prod: w10 --- -# How to Create a Package Accelerator by Using PowerShell +# How to Create a Package Accelerator by Using Windows PowerShell +**Applies to** +- Windows 10, version 1607 App-V package accelerators automatically sequence large, complex applications. Additionally, when you apply an App-V package accelerator, you are not always required to manually install an application to create the virtualized package. @@ -18,7 +20,7 @@ App-V package accelerators automatically sequence large, complex applications. A 1. Install the App-V sequencer. For more information about installing the sequencer see [How to Install the Sequencer](appv-install-the-sequencer.md). -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. Use the **New-AppvPackageAccelerator** cmdlet. +2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. Use the **New-AppvPackageAccelerator** cmdlet. 3. To create a package accelerator, make sure that you have the .appv package to create an accelerator from, the installation media or installation files, and optionally a read me file for consumers of the accelerator to use. The following parameters are required to use the package accelerator cmdlet: @@ -34,22 +36,14 @@ App-V package accelerators automatically sequence large, complex applications. A **New-AppvPackageAccelerator -InputPackagePath <path to the .appv file> -Installer <path to the installer executable> -Path <directory of the output path>** - Additional optional parameters that can be used with the **New-AppvPackageAccelerator** cmdlet are displayed in the following list: + An additional optional parameter that can be used with the **New-AppvPackageAccelerator** cmdlet is as follows: - **AcceleratorDescriptionFile** - specifies the path to user created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be packaged with the package created using the package accelerator. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - -[Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) - -  - -  - - - - - +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-create-a-package-accelerator.md b/windows/manage/appv-create-a-package-accelerator.md index d9a8f4a96a..690438f968 100644 --- a/windows/manage/appv-create-a-package-accelerator.md +++ b/windows/manage/appv-create-a-package-accelerator.md @@ -11,66 +11,47 @@ ms.prod: w10 # How to Create a Package Accelerator +**Applies to** +- Windows 10, version 1607 App-V package accelerators automatically generate new virtual application packages. -**Note**   -You can use PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using PowerShell](appv-create-a-package-accelerator-with-powershell.md). - -  +>**Note**  You can use Windows PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md). Use the following procedure to create a package accelerator. -**Important**   -Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied. +>**Important** +> - Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied. +> - Before you begin the following procedure, perform the following: + - Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. + - Copy all required installation files associated with the virtual application package to the computer running the sequencer. +> - The App-V Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V Sequencer. -  +## To create a package accelerator -**Important**   -Before you begin the following procedure, you should perform the following: - -- Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. - -- Copy all required installation files associated with the virtual application package to the computer running the sequencer. - -  - -**To create a package accelerator** - -1. **Important**   - The App-V Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V Sequencer. - -   - - To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. +1. To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. 2. To start the App-V **Create Package Accelerator** wizard, in the App-V sequencer console, click **Tools** / **Create Accelerator**. 3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file). - **Tip**   + **Tip**
    Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - -   - + Click **Next**. 4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. - **Tip**   + **Tip**
    Copy the folder that contains the required installation files to the computer running the Sequencer. -   - 5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. 6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. - **Note**   + **Note**
    You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. -   - 7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**. 8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. @@ -83,25 +64,15 @@ Before you begin the following procedure, you should perform the following: 11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. - **Important**   + **Important**
    To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator. -   +## Have a suggestion for App-V? - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md) - -  - -  - - - - - diff --git a/windows/manage/appv-create-a-virtual-application-package-package-accelerator.md b/windows/manage/appv-create-a-virtual-application-package-package-accelerator.md index b502103844..4cae334e5e 100644 --- a/windows/manage/appv-create-a-virtual-application-package-package-accelerator.md +++ b/windows/manage/appv-create-a-virtual-application-package-package-accelerator.md @@ -11,62 +11,47 @@ ms.prod: w10 # How to Create a Virtual Application Package Using an App-V Package Accelerator - -**Important**   -The App-V Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V Sequencer. - -  +**Applies to** +- Windows 10, version 1607 Use the following procedure to create a virtual application package with the App-V Package Accelerator. -**Note**   -Before you start this procedure, copy the required Package Accelerator locally to the computer that runs the App-V Sequencer. You should also copy all required installation files for the package to a local directory on the computer that runs the Sequencer. This is the directory that you have to specify in step 5 of this procedure. - -  +> **Important**  The App-V Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V Sequencer. **To create a virtual application package with an App-V Package Accelerator** -1. To start the App-V Sequencer, on the computer that runs the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. +1. Be sure that the required Package Accelerator has been copied locally to the computer that runs the App-V Sequencer. Also copy all required installation files for the package to a local folder on the computer that runs the Sequencer. This is the folder that you have to specify in step 6 of this procedure. -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. +2. To start the App-V Sequencer, on the computer that runs the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -3. To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**. +3. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. - **Important**   - If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. +4. To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**. -   + > **Important**  If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. -4. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. +5. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. -5. On the **Select Installation Files** page, click **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, click **Browse** to select the folder. +6. On the **Select Installation Files** page, click **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, click **Browse** to select the folder. Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. - **Note**   - You can specify the following types of supported installation files: + > **Note**  You can specify the following types of supported installation files: + > - Windows Installer files (**.msi**) + > - Cabinet files (.cab) + > - Compressed files with a .zip file name extension + > - The actual application files + > The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. - - Windows Installer files (**.msi**) +7. If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page. - - Cabinet files (.cab) +8. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**. - - Compressed files with a .zip file name extension +9. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - The actual application files +10. To create the package, click **Create**. After the package is created, click **Next**. - The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. - -   - - If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page. - -6. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**. - -7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - To create the package, click **Create**. After the package is created, click **Next**. - -8. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements. +11. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements. If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step: @@ -78,24 +63,16 @@ Before you start this procedure, copy the required Package Accelerator locally t - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. - If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**. + If you do not want to configure the applications, click **Skip this step**, and then click **Next**. -9. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**. +12. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**. The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](appv-modify-an-existing-virtual-application-package.md). - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-create-and-use-a-project-template.md b/windows/manage/appv-create-and-use-a-project-template.md index fd57dc07d8..c6a0be63bb 100644 --- a/windows/manage/appv-create-and-use-a-project-template.md +++ b/windows/manage/appv-create-and-use-a-project-template.md @@ -11,13 +11,12 @@ ms.prod: w10 # How to Create and Use a Project Template +**Applies to** +- Windows 10, version 1607 You can use an App-V project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment. Using a project template can streamline the process of creating virtual application packages. -**Note**   -You can, and often should apply an App-V project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application. - -  +> **Note**  You can, and often should apply an App-V project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application. App-V project templates differ from App-V Application Accelerators because App-V Application Accelerators are application-specific, and App-V project templates can be applied to multiple applications. @@ -27,25 +26,19 @@ Use the following procedures to create and apply a new template. 1. To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -2. **Note**   - If the virtual application package is currently open in the App-V Sequencer console, skip to step 3 of this procedure. + > **Note**  If the virtual application package is currently open in the App-V Sequencer console, skip to step 3 of this procedure. -   - - To open the existing virtual application package that contains the settings you want to save with the App-V project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. +2. To open the existing virtual application package that contains the settings you want to save with the App-V project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. 3. In the App-V Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V project template. Click Save. - The new App-V project template is saved in the directory specified in step 3 of this procedure. + The new App-V project template is saved in the folder you specified. **To apply a project template** -1. **Important**   - Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported. +> **Important**  Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported. -   - - To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. +1. To start the App-V sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. 2. To create or upgrade a new virtual application package by using an App-V project template, click **File** / **New From Template**. @@ -53,18 +46,10 @@ Use the following procedures to create and apply a new template. Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-creating-and-managing-virtualized-applications.md b/windows/manage/appv-creating-and-managing-virtualized-applications.md index e04c94fc76..861034a883 100644 --- a/windows/manage/appv-creating-and-managing-virtualized-applications.md +++ b/windows/manage/appv-creating-and-managing-virtualized-applications.md @@ -11,6 +11,8 @@ ms.prod: w10 # Creating and Managing App-V Virtualized Applications +**Applies to** +- Windows 10, version 1607 After you have properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. @@ -203,9 +205,10 @@ The App-V Sequencer can detect common sequencing issues during sequencing. The * You can also find additional information about sequencing errors using the Windows Event Viewer. +## Have a suggestion for App-V? -## Other resources for the App-V sequencer +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Related topics - [Operations for App-V](appv-operations.md) - diff --git a/windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md index 3ec5082a93..09c76c884b 100644 --- a/windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md +++ b/windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console +**Applies to** +- Windows 10, version 1607 Use the following procedure to customize the virtual application extensions for an Active Directory (AD) group. @@ -28,18 +30,10 @@ Use the following procedure to customize the virtual application extensions for 5. To edit additional application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog, click **Overwrite** to complete the process. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-delete-a-connection-group.md b/windows/manage/appv-delete-a-connection-group.md index 41661c8b51..a81a30d908 100644 --- a/windows/manage/appv-delete-a-connection-group.md +++ b/windows/manage/appv-delete-a-connection-group.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Delete a Connection Group +**Applies to** +- Windows 10, version 1607 Use the following procedure to delete an existing App-V connection group. @@ -20,20 +22,12 @@ Use the following procedure to delete an existing App-V connection group. 2. Right-click the connection group to be removed, and select **delete**. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) [Managing Connection Groups](appv-managing-connection-groups.md) - -  - -  - - - - - diff --git a/windows/manage/appv-delete-a-package-with-the-management-console.md b/windows/manage/appv-delete-a-package-with-the-management-console.md index da05ce9efb..93cd94b4f0 100644 --- a/windows/manage/appv-delete-a-package-with-the-management-console.md +++ b/windows/manage/appv-delete-a-package-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Delete a Package in the Management Console +**Applies to** +- Windows 10, version 1607 Use the following procedure to delete an App-V package. @@ -20,18 +22,10 @@ Use the following procedure to delete an App-V package. 2. Click or right-click the package. Select **Delete** to remove the package. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md index a01fb30d6a..6a2ab10a6a 100644 --- a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md @@ -11,14 +11,17 @@ ms.prod: w10 # How to Deploy the App-V Databases by Using SQL Scripts +**Applies to** +- Windows Server 2016 + Use the following instructions to use SQL scripts, rather than the Windows Installer, to: - Install the App-V databases - Upgrade the App-V databases to a later version -> [!NOTE] -> If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V. +>**Note** +> If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V for Windows. ## How to install the App-V databases by using SQL scripts @@ -175,7 +178,7 @@ Steps to install "AppVReporting" schema in SQL SERVER. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md index b681e20927..d74a347576 100644 --- a/windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md +++ b/windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md @@ -10,6 +10,9 @@ ms.prod: w10 # How to deploy App-V packages using electronic software distribution +**Applies to** +- Windows 10, version 1607 + You can use an electronic software distribution (ESD) system to deploy App-V virtual applications to App-V clients. For component requirements and options for using an ESD to deploy App-V packages, see [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). @@ -20,7 +23,7 @@ Use one of the following methods to publish packages to App-V client computers w | - | - | | Functionality provided by a third-party ESD | Use the functionality in a third-party ESD.| | Stand-alone Windows Installer | Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V package file information used to configure a package and copies the required package files to the client. | -| Windows PowerShell | Use Windows PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V, see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md).| +| Windows PowerShell | Use Windows PowerShell cmdlets to deploy virtualized applications. For more information about using Windows PowerShell and App-V, see [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md).|   @@ -34,7 +37,7 @@ Use one of the following methods to publish packages to App-V client computers w ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-deploy-the-appv-server-with-a-script.md b/windows/manage/appv-deploy-the-appv-server-with-a-script.md index 919248523e..ddc30926a2 100644 --- a/windows/manage/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/manage/appv-deploy-the-appv-server-with-a-script.md @@ -1,6 +1,6 @@ ---- +--- title: How to Deploy the App-V Server Using a Script (Windows 10) -description: How to Deploy the App-V Server Using a Script +description: How to Deploy the App-V Server Using a Script author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -11,779 +11,435 @@ ms.prod: w10 # How to Deploy the App-V Server Using a Script +**Applies to** +- Windows Server 2016 In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. -**To Install the App-V server using a script** +**To install the App-V server using a script** -- Use the following tables for more information about installing the App-V server using the command line. +Use the following lists and tables for more information about installing the App-V server using the command line. - **Note**   - The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. +> **Note**  The information in the following lists and tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. -   +## How to use common parameters - **Common parameters and Examples** +## To install the Management server and Management database on a local machine -
    - - - - - - - - - - -

    To Install the Management server and Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /MANAGEMENT_DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /MANAGEMENT_DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: -   +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /MANAGEMENT_DB_NAME - - - - - - - - - - - -

    To Install the Management server using an existing Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    -

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    -

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

    +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use the following parameters: -   +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /MANAGEMENT_DB_NAME - - - - - - - - - - - -

    To install the Management server using an existing Management database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”

    -

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    -

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

    +### Example for using a custom instance of Microsoft SQL Server: -   +/appv_server_setup.exe /QUIET
    +/MANAGEMENT_SERVER
    +/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
    +/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
    +/MANAGEMENT_WEBSITE_PORT="8080"
    +/DB_PREDEPLOY_MANAGEMENT
    +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/MANAGEMENT_DB_NAME="AppVManagement" - - - - - - - - - - - -

    To Install the Management database and the Management Server on the same computer.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    -

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    -

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    +## To install the Management server using an existing Management database on a local machine -   +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: - - - - - - - - - - - -

    To install the Management database on a different computer than the Management server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    -

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    -

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_MANAGEMENT_DB_NAME -   +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: - - - - - - - - - - - -

    To Install the publishing server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /PUBLISHING_SERVER

      • -

    • /PUBLISHING_MGT_SERVER

      • -

    • /PUBLISHING_WEBSITE_NAME

      • -

    • /PUBLISHING_WEBSITE_PORT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /PUBLISHING_SERVER

    -

    /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”

    -

    /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”

    -

    /PUBLISHING_WEBSITE_PORT=”8081”

    +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /EXISTING_MANAGEMENT_DB_NAME -   +### Example for using a custom instance of Microsoft SQL Server: - - - - - - - - - - - -

    To Install the Reporting server and Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /REPORTING _DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _ADMINACCOUNT

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /REPORTING _DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -
      -

    • /appv_server_setup.exe /QUIET

      • -

    • /REPORTING_SERVER

      • -

    • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

      • -

    • /REPORTING_WEBSITE_PORT=”8082”

      • -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

      • -

    • /REPORTING_DB_NAME=”AppVReporting”

      • -
    +/appv_server_setup.exe /QUIET
    +/MANAGEMENT_SERVER
    +/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
    +/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
    +/MANAGEMENT_WEBSITE_PORT="8080"
    +/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
    +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
    +/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" -   +## To install the Management server using an existing Management database on a remote machine - - - - - - - - - - - -

    To Install the Reporting server and using an existing Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _ADMINACCOUNT

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /REPORTING_SERVER

    -

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    -

    /REPORTING_WEBSITE_PORT=”8082”

    -

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    -

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

    +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: -   +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_MANAGEMENT_DB_NAME - - - - - - - - - - - -

    To Install the Reporting server using an existing Reporting database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _ADMINACCOUNT

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /REPORTING_SERVER

    -

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    -

    /REPORTING_WEBSITE_PORT=”8082”

    -

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”

    -

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

    +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: -   +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /EXISTING_MANAGEMENT_DB_NAME - - - - - - - - - - - -

    To install the Reporting database on the same computer as the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_SERVER_MACHINE_USE_LOCAL

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_SERVER_MACHINE_USE_LOCAL

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_REPORTING

    -

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /REPORTING_DB_NAME=”AppVReporting”

    -

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    -

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    +### Example for using a custom instance of Microsoft SQL Server: -   +/appv_server_setup.exe /QUIET
    +/MANAGEMENT_SERVER
    +/MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup"
    +/MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service"
    +/MANAGEMENT_WEBSITE_PORT="8080"
    +/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="SqlServermachine.domainName"
    +/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName"
    +/EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" - - - - - - - - - - - -

    To install the Reporting database on a different computer than the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_REPORTING

    -

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /REPORTING_DB_NAME=”AppVReporting”

    -

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    -

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    +## To install the Management database and the Management Server on the same computer -   +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: - **Parameter Definitions** +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT - **General Parameters** +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /QUIET

    Specifies silent install.

    /UNINSTALL

    Specifies an uninstall.

    /LAYOUT

    Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.

    /LAYOUTDIR

    Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”

    /INSTALLDIR

    Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”

    /MUOPTIN

    Enables Microsoft Update. No value is expected

    /ACCEPTEULA

    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

    +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT -   +### Example for using a custom instance of Microsoft SQL Server: - **Management Server Installation Parameters** +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_MANAGEMENT
    +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/MANAGEMENT_DB_NAME="AppVManagement"
    +/MANAGEMENT_SERVER_MACHINE_USE_LOCAL
    +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /MANAGEMENT_SERVER

    Specifies that the management server will be installed. No value is expected

    /MANAGEMENT_ADMINACCOUNT

    Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".

    /MANAGEMENT_WEBSITE_NAME

    Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”

    MANAGEMENT_WEBSITE_PORT

    Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.

    +## To install the Management database on a different computer than the Management server -   +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: - **Parameters for the Management Server Database** +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /DB_PREDEPLOY_MANAGEMENT

    Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected

    /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance should be used. No value is expected.

    /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_DB_NAME

    Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”

    +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: -   +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_CUSTOM_SQLINSTANCE +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT - **Parameters for Installing Publishing Server** +### Example for using a custom instance of Microsoft SQL Server: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /PUBLISHING_SERVER

    Specifies that the Publishing Server will be installed. No value is expected

    /PUBLISHING_MGT_SERVER

    Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored

    /PUBLISHING_WEBSITE_NAME

    Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”

    /PUBLISHING_WEBSITE_PORT

    Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83

    +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_MANAGEMENT
    +/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/MANAGEMENT_DB_NAME="AppVManagement"
    +/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount"
    +/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -   +## To install the Publishing server - **Parameters for Reporting Server** +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /REPORTING_SERVER

    Specifies that the Reporting Server will be installed. No value is expected

    /REPORTING_WEBSITE_NAME

    Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"

    /REPORTING_WEBSITE_PORT

    Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82

    +- /PUBLISHING_SERVER +- /PUBLISHING_MGT_SERVER +- /PUBLISHING_WEBSITE_NAME +- /PUBLISHING_WEBSITE_PORT -   +### Example - **Parameters for using an Existing Reporting Server Database** +/appv_server_setup.exe /QUIET
    +/PUBLISHING_SERVER
    +/PUBLISHING_MGT_SERVER="http://ManagementServerName:ManagementPort"
    +/PUBLISHING_WEBSITE_NAME="Microsoft AppV Publishing Service"
    +/PUBLISHING_WEBSITE_PORT="8081" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.

    /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /EXISTING_ REPORTING _DB_NAME

    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISITING_REPORTING_DB_NAME="AppVReporting"

    +## To install the Reporting server and Reporting database on a local machine -   +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: - **Parameters for installing Reporting Server Database** +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT +- /REPORTING _DB_NAME - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /DB_PREDEPLOY_REPORTING

    Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected

    /REPORTING_DB_SQLINSTANCE_USE_DEFAULT

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /REPORTING_DB_NAME

    Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"

    +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: -   +- /REPORTING _SERVER +- /REPORTING _ADMINACCOUNT +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_CUSTOM_SQLINSTANCE +- /REPORTING _DB_NAME - **Parameters for using an existing Management Server Database** +### Example for using a custom instance of Microsoft SQL Server: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_NAME

    Specifies the name of the existing management database that should be used. Example usage: /EXISITING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    -

    -

    Have a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).

    +/appv_server_setup.exe /QUIET
    +/REPORTING_SERVER
    +/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
    +/REPORTING_WEBSITE_PORT="8082"
    +/DB_PREDEPLOY_REPORTING
    +/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/REPORTING_DB_NAME="AppVReporting" -   +## To install the Reporting server using an existing Reporting database on a local machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_REPORTING_DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /REPORTING _SERVER +- /REPORTING _ADMINACCOUNT +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +- /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE +- /EXISTING_REPORTING _DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/REPORTING_SERVER
    +/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
    +/REPORTING_WEBSITE_PORT="8082"
    +/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
    +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/EXITING_REPORTING_DB_NAME="AppVReporting" + +## To install the Reporting server using an existing Reporting database on a remote machine + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT +- /EXISTING_REPORTING _DB_NAME + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /REPORTING _SERVER +- /REPORTING _ADMINACCOUNT +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME +- /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE +- /EXISTING_REPORTING _DB_NAME + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/REPORTING_SERVER
    +/REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service"
    +/REPORTING_WEBSITE_PORT="8082"
    +/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="SqlServerMachine.DomainName"
    +/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/EXITING_REPORTING_DB_NAME="AppVReporting" + +## To install the Reporting database on the same computer as the Reporting server + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING_DB_SQLINSTANCE_USE_DEFAULT +- /REPORTING_DB_NAME +- /REPORTING_SERVER_MACHINE_USE_LOCAL +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_CUSTOM_SQLINSTANCE +- /REPORTING _DB_NAME +- /REPORTING_SERVER_MACHINE_USE_LOCAL +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +### Example for using a custom instance of Microsoft SQL Server: + +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_REPORTING
    +/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/REPORTING_DB_NAME="AppVReporting"
    +/REPORTING_SERVER_MACHINE_USE_LOCAL
    +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" + +## To install the Reporting database on a different computer than the Reporting server + +**Default instance of Microsoft SQL Server**: To use the default instance of Microsoft SQL Server, use the following parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT +- /REPORTING _DB_NAME +- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +**Custom instance of Microsoft SQL Server**: To use a custom instance of Microsoft SQL Server, use these parameters: + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_CUSTOM_SQLINSTANCE +- /REPORTING _DB_NAME +- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +### Example for using a custom instance of Microsoft SQL Server: + +Using a custom instance of Microsoft SQL Server example:
    +/appv_server_setup.exe /QUIET
    +/DB_PREDEPLOY_REPORTING
    +/REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName"
    +/REPORTING_DB_NAME="AppVReporting"
    +/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount"
    +/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" + +## Parameter definitions + +- [General parameters](#parameter-definitions-for-general-parameters) +- [Management Server installation parameters](#parameter-definitions-for-management-server-installation-parameters) +- [Management Server Database parameters](#parameter-definitions-for-the-management-server-database) +- [Publishing Server installation parameters](#parameter-definitions-for-publishing-server-installation-parameters) +- [Reporting Server parameters](#parameter-definitions-for-reporting-server) +- [Parameters for using an existing Reporting Server database](#parameters-for-using-an-existing-reporting-server-database) +- [Reporting Server database installation parameters](#parameter-definitions-for-reporting-server-database-installation) +- [Parameters for using an existing Management Server database](#parameters-for-using-an-existing-management-server-database) + +### Parameter definitions for general parameters + +| Parameter | Description | +|-----------|-------------| +| /QUIET | Specifies silent install. | +| /UNINSTALL | Specifies an uninstall. | +| /LAYOUT | Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected. | +| /LAYOUTDIR | Specifies the layout directory. Takes a string. For example, /LAYOUTDIR="C:\Application Virtualization Server" | +| /INSTALLDIR | Specifies the installation directory. Takes a string. E.g. /INSTALLDIR="C:\Program Files\Application Virtualization\Server" | +| /MUOPTIN | Enables Microsoft Update. No value is expected | +| /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage: **/ACCEPTEULA** or **/ACCEPTEULA=1**. | + +### Parameter definitions for Management Server installation parameters + +| Parameter | Description | +|-----------|-------------| +| /MANAGEMENT_SERVER | Specifies that the management server will be installed. No value is expected | +| /MANAGEMENT_ADMINACCOUNT | Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: **/MANAGEMENT_ADMINACCOUNT="mydomain\admin"**. If **/MANAGEMENT_SERVER** is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, **/MANAGEMENT_ADMINACCOUNT="mydomain\admin"**. | +| /MANAGEMENT_WEBSITE_NAME | Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME="Microsoft App-V Management Service" | +| /MANAGEMENT_WEBSITE_PORT | Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82. | + +### Parameter definitions for the Management Server Database + +| Parameter | Description | +|-----------|-------------| +| /DB\_PREDEPLOY\_MANAGEMENT | Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected | +| /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance should be used. No value is expected. | +| /MANAGEMENT_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: **/MANAGEMENT_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER"**. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. | +| /MANAGEMENT_DB_NAME | Specifies the name of the new management database that should be created. Example usage: **/MANAGEMENT_DB_NAME="AppVMgmtDB"**. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored. | +| /MANAGEMENT_SERVER_MACHINE_USE_LOCAL | Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | +| /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the management server will be installed on. Example usage: **/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="domain\computername"** | +| /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the management server. Example usage: **/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT ="domain\alias"** | + +### Parameter definitions for Publishing Server installation parameters + +| Parameter | Description | +|-----------|-------------| +| /PUBLISHING_SERVER | Specifies that the Publishing Server will be installed. No value is expected | +| /PUBLISHING_MGT_SERVER | Specifies the URL to Management Service the Publishing server will connect to. Example usage: **http://<management server name>:<Management server port number>**. If /PUBLISHING_SERVER is not used, this parameter will be ignored | +| /PUBLISHING_WEBSITE_NAME | Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME="Microsoft App-V Publishing Service" | +| /PUBLISHING_WEBSITE_PORT | Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83 | + +### Parameter definitions for Reporting Server + +| Parameter | Description | +|-----------|-------------| +| /REPORTING_SERVER | Specifies that the Reporting Server will be installed. No value is expected | +| /REPORTING_WEBSITE_NAME | Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService" | +| /REPORTING_WEBSITE_PORT | Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82 | + +   + +### Parameters for using an existing Reporting Server database + +| Parameter | Description | +|-----------|-------------| +| /EXISTING\_REPORTING\_DB_SQL_SERVER_USE_LOCAL | Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected. | +| /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="mycomputer1" | +| /EXISTING_REPORTING_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. | +| /EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER" | +| /EXISTING_REPORTING_DB_NAME | Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting" | + +### Parameter definitions for Reporting Server database installation + +| Parameter | Description | +|-----------|-------------| +| /DB\_PREDEPLOY\_REPORTING | Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected | +| /REPORTING_DB_SQLINSTANCE_USE_DEFAULT | Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_CUSTOM_SQLINSTANCE="MYSQLSERVER" | +| /REPORTING_DB_NAME | Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB" | +| /REPORTING_SERVER_MACHINE_USE_LOCAL | Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | +| /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername" | +| /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias" | + +### Parameters for using an existing Management Server database + +| Parameter | Description | +|-----------|-------------| +| /EXISTING\_MANAGEMENT\_DB_SQL_SERVER_USE_LOCAL | Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="mycomputer1" | +| /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that will be used. Example usage **/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE="AppVManagement"**. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_NAME | Specifies the name of the existing management database that should be used. Example usage: **/EXISTING_MANAGEMENT_DB_NAME="AppVMgmtDB"**. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored. | + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Deploying the App-V Server](appv-deploying-the-appv-server.md) - -  - -  - - - - - diff --git a/windows/manage/appv-deploy-the-appv-server.md b/windows/manage/appv-deploy-the-appv-server.md index 3838c1812c..2f9977d7b8 100644 --- a/windows/manage/appv-deploy-the-appv-server.md +++ b/windows/manage/appv-deploy-the-appv-server.md @@ -1,6 +1,6 @@ --- title: How to Deploy the App-V Server (Windows 10) -description: How to Deploy the App-V Server +description: How to Deploy the App-V Server in App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,13 +8,16 @@ ms.sitesec: library ms.prod: w10 --- -# How to Deploy the App-V server +# How to Deploy the App-V Server (new installation) -Use the following procedure to install the App-V server.. +**Applies to** +- Windows Server 2016 + +>**Important**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. **Before you start:** -- Ensure that you’ve installed prerequisite software. See [App-V Prerequisites](appv-prerequisites.md). +- Ensure that you’ve installed required software. See [App-V Prerequisites](appv-prerequisites.md). - Review the server section of [App-V security considerations](appv-security-considerations.md). @@ -26,13 +29,19 @@ Use the following procedure to install the App-V server.. **To install the App-V server** -1. Copy the App-V server installation files to the computer on which you want to install it. +1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: -2. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. + - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site. -3. Review and accept the license terms, and choose whether to enable Microsoft updates. + - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). -4. On the **Feature Selection** page, select all of the following components. +2. Copy the App-V server installation files to the computer on which you want to install it. + +3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. + +4. Review and accept the license terms, and choose whether to enable Microsoft updates. + +5. On the **Feature Selection** page, select all of the following components. | Component | Description | | - | - | @@ -42,21 +51,20 @@ Use the following procedure to install the App-V server.. | Reporting server | Provides App-V reporting services. | | Reporting database | Facilitates database predeployments for App-V reporting. | -5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. +6. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. -6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. +7. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. | Method | What you need to do | | - | - | | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
    Use the format **INSTANCENAME**. The assumed installation location is the local computer.
    Not supported: A server name using the format **ServerName**\\**INSTANCE**.| | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.| -7. On the **Configure** page, accept the default value **Use this local computer**. +8. On the **Configure** page, accept the default value **Use this local computer**. - > [!NOTE] - > If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. + >**Note** If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. -8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. +9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. | Method | What you need to do | | - | - | @@ -64,21 +72,21 @@ Use the following procedure to install the App-V server.. | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.| -9. On the **Configure** page, accept the default value: **Use this local computer**. +10. On the **Configure** page, accept the default value: **Use this local computer**. - > [!NOTE] + >**Note** > If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. -10. On the **Configure** (Management Server Configuration) page, specify the following: +11. On the **Configure** (Management Server Configuration) page, specify the following: | Item to configure | Description and examples | | - | - | - Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser
    After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.| - | **Website name**: Specify the custom name that will be used to run the publishing service.
    If you do not have a custom name, do not make any changes.| + | Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser

    After installation, you can add users or groups on the management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups to perform this action.| + | **Website name**: Specify the custom name that will be used to run the publishing service.
    | If you do not have a custom name, do not make any changes.| |**Port binding**: Specify a unique port number that will be used by App-V. | Example: **12345**
    Ensure that the port specified is not being used by another website. | -11. On the **Configure Publishing Server Configuration** page, specify the following: +12. On the **Configure Publishing Server Configuration** page, specify the following: | Item to configure | Description and examples | | - | - | @@ -86,16 +94,16 @@ Use the following procedure to install the App-V server.. | **Website name**: Specify the custom name that will be used to run the publishing service.| If you do not have a custom name, do not make any changes. | | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 54321
    Ensure that the port specified is not being used by another website. | -12. On the **Reporting Server** page, specify the following: +13. On the **Reporting Server** page, specify the following: | Item to configure | Description and examples | | - | - | | **Website name**: Specify the custom name that will be used to run the Reporting Service. | If you do not have a custom name, do not make any changes. | | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 55555
    Ensure that the port specified is not being used by another website. | -13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. +14. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. -14. To verify that the setup completed successfully, open a web browser, and type the following URL: +15. To verify that the setup completed successfully, open a web browser, and type the following URL: **http://\<_Management server machine name_\>:\<_Management service port number_\>/console.html**. @@ -103,7 +111,7 @@ Use the following procedure to install the App-V server.. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-deploying-appv.md b/windows/manage/appv-deploying-appv.md index 4afd68b171..53ad22d7a7 100644 --- a/windows/manage/appv-deploying-appv.md +++ b/windows/manage/appv-deploying-appv.md @@ -8,16 +8,19 @@ ms.sitesec: library ms.prod: w10 --- -# Deploying App-V +# Deploying App-V for Windows 10 -App-V supports a number of different deployment options. This section of the App-V Administrator’s Guide includes information you should consider about the deployment of App-V and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. +**Applies to** +- Windows 10, version 1607 + +App-V supports a number of different deployment options. Review this topic for information about the tasks that you must complete at different stages in your deployment. ## App-V Deployment Information -- [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) +- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) - This section describes how to install the App-V sequencer which is used to virtualize applications, and the App-V client which runs on target computers to facilitate virtualized packages. + This section describes how to install the App-V sequencer, which is used to virtualize applications, and how to enable the App-V client, which runs on target computers to facilitate virtualized packages. - [Deploying the App-V Server](appv-deploying-the-appv-server.md) @@ -44,4 +47,4 @@ App-V supports a number of different deployment options. This section of the App ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md index 694046b16c..dcf42974b4 100644 --- a/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md +++ b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md @@ -11,6 +11,8 @@ ms.prod: w10 # Deploying Microsoft Office 2010 by Using App-V +**Applies to** +- Windows 10, version 1607 You can create Office 2010 packages for Microsoft Application Virtualization (App-V) using one of the following methods: @@ -65,16 +67,16 @@ The following table shows the App-V versions, methods of Office package creation Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V, refer to the following link for detailed instructions: -[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330676) +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) ## Creating Office 2010 App-V packages using package accelerators Office 2010 App-V packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 10, Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator: -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](http://go.microsoft.com/fwlink/p/?LinkId=330677) +- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://gallery.technet.microsoft.com/App-V-50-Package-a29410db) -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](http://go.microsoft.com/fwlink/p/?LinkId=330678) +- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://gallery.technet.microsoft.com/App-V-50-Package-e7ef536b) For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md). @@ -87,7 +89,7 @@ You can deploy Office 2010 packages by using any of the following App-V deployme - App-V server -- Stand-alone through PowerShell commands +- Stand-alone through Windows PowerShell commands ## Office App-V package management and customization @@ -170,7 +172,7 @@ The following table provides a full list of supported integration points for Off

    Active X Controls:

    -

    For more information on ActiveX controls, refer to [ActiveX Control API Reference](http://go.microsoft.com/fwlink/p/?LinkId=331361).

    +

    For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://msdn.microsoft.com/library/office/ms440037(v=office.14).aspx).

    @@ -268,26 +270,26 @@ The following table provides a full list of supported integration points for Off **Office 2013 App-V Packages Additional Resources** -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](http://go.microsoft.com/fwlink/p/?LinkId=330680) +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509) **Office 2010 App-V Packages** -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330681) +[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399) -[Known issues when you create or use an App-V 5.0 Office 2010 package](http://go.microsoft.com/fwlink/p/?LinkId=330682) +[Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619) -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330676) +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) **Connection Groups** -[Deploying Connection Groups in Microsoft App-V v5](http://go.microsoft.com/fwlink/p/?LinkId=330683) - [Managing Connection Groups](appv-managing-connection-groups.md) +[Connection groups on the App-V team blog](https://blogs.technet.microsoft.com/gladiatormsft/tag/connection-groups/) + **Dynamic Configuration** [About App-V Dynamic Configuration](appv-dynamic-configuration.md) ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md index b092b860ba..90cdcd48d7 100644 --- a/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md @@ -11,6 +11,8 @@ ms.prod: w10 # Deploying Microsoft Office 2013 by Using App-V +**Applies to** +- Windows 10, version 1607 Use the information in this article to use Microsoft Application Virtualization (App-V), or later versions, to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and App-V. @@ -46,7 +48,7 @@ Use the following table to get information about supported versions of Office an -

    [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md#bkmk-office-vers-supp-appv)

    +

    [Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#bkmk-office-vers-supp-appv)

    • Supported versions of Office

    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

      • @@ -54,7 +56,7 @@ Use the following table to get information about supported versions of Office an
    -

    [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md#bkmk-plan-coexisting)

    +

    [Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#bkmk-plan-coexisting)

    Considerations for installing different versions of Office on the same computer

    @@ -133,7 +135,7 @@ The following table describes the recommended methods for excluding specific Off

    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

      • -

    • For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).

      • +

    • For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#BKMK_ExcludeAppElement).

    @@ -205,7 +207,7 @@ Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: -1. Download the [Office Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778). +1. Download the [Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778). 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. @@ -238,68 +240,10 @@ The XML file that is included in the Office Deployment Tool specifies the produc ``` - **Note**   + **Note**
    The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. -   - - The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    InputDescriptionExample

    Add element

    Specifies the products and languages to include in the package.

    N/A

    OfficeClientEdition (attribute of Add element)

    Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

    OfficeClientEdition="32"

    -

    OfficeClientEdition="64"

    Product element

    Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.

    Product ID ="O365ProPlusRetail "

    -

    Product ID ="VisioProRetail"

    -

    Product ID ="ProjectProRetail"

    -

    Product ID ="ProPlusVolume"

    -

    Product ID ="VisioProVolume"

    -

    Product ID = "ProjectProVolume"

    Language element

    Specifies the language supported in the applications

    Language ID="en-us"

    Version (attribute of Add element)

    Optional. Specifies a build to use for the package

    -

    Defaults to latest advertised build (as defined in v32.CAB at the Office source).

    15.1.2.3

    SourcePath (attribute of Add element)

    Specifies the location in which the applications will be saved to.

    Sourcepath = "\\Server\Office2013”

    - -   + The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. For more information, see [Customizable attributes and elements of the XML file](#customizable-attributes-and-elements-of-the-XML-file), later in this topic. After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. @@ -318,25 +262,72 @@ The XML file that is included in the Office Deployment Tool specifies the produc -

    \\server\Office2013

    +

    \\server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    -

    Setup.exe

    +

    setup.exe

    is the Office Deployment Tool.

    -

    /download

    +

    /download

    downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.

    -

    \\server\Office2013\Customconfig.xml

    +

    \\server\Office2013\Customconfig.xml

    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2013.

    -   +#### Customizable attributes and elements of the XML file + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Input and descriptionExample

    Add element:
    Specifies the products and languages to include in the package.

    N/A

    OfficeClientEdition (attribute of Add element):
    Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

    OfficeClientEdition="32"

    +

    OfficeClientEdition="64"

    Product element:
    Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.

    Product ID ="O365ProPlusRetail "

    +

    Product ID ="VisioProRetail"

    +

    Product ID ="ProjectProRetail"

    +

    Product ID ="ProPlusVolume"

    +

    Product ID ="VisioProVolume"

    +

    Product ID = "ProjectProVolume"

    Language element:
    Specifies the language supported in the applications.

    Language ID="en-us"

    Version (attribute of Add element):
    Optional. Specifies a build to use for the package. Defaults to latest advertised build (as defined in v32.CAB at the Office source).

    15.1.2.3

    SourcePath (attribute of Add element):
    Specifies the location in which the applications will be saved to.

    Sourcepath = "\\Server\Office2013”

    + +   ### Convert the Office applications into an App-V package @@ -388,122 +379,58 @@ After you download the Office 2013 applications through the Office Deployment To -  - -**How to convert the Office applications into an App-V package** +#### How to convert the Office applications into an App-V package 1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterWhat to change the value to

    SourcePath

    Point to the Office applications downloaded earlier.

    ProductID

    Specify the type of licensing, as shown in the following examples:

    -
      -

    • Subscription Licensing

      - 
      <Configuration>
-       <Add SourcePath= "\\server\Office 2013" OfficeClientEdition="32" >
-        <Product ID="O365ProPlusRetail">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProRetail">
-          <Language ID="en-us" />
-        </Product>
-      </Add>  
-    </Configuration>
      -

      In this example, the following changes were made to create a package with Subscription licensing:

      - - - - - - - - - - - - - - - - - - - -

      SourcePath

      is the path, which was changed to point to the Office applications that were downloaded earlier.

      Product ID

      for Office was changed to O365ProPlusRetail.

      Product ID

      for Visio was changed to VisioProRetail.

      -

       

      -

      • -

    • Volume Licensing

      - 
      <Configuration>
-       <Add SourcePath= "\\Server\Office2013" OfficeClientEdition="32" >
-        <Product ID="ProPlusVolume">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProVolume">
-          <Language ID="en-us" />
-        </Product>
-      </Add>  
-    </Configuration>
      -

      In this example, the following changes were made to create a package with Volume licensing:

      - - - - - - - - - - - - - - - - - - - -

      SourcePath

      is the path, which was changed to point to the Office applications that were downloaded earlier.

      Product ID

      for Office was changed to ProPlusVolume.

      Product ID

      for Visio was changed to VisioProVolume.

      -

       

      -

      • -

    ExcludeApp (optional)

    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

    PACKAGEGUID (optional)

    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

    -

    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.

    -
    - Note   -

    Even if you use unique package IDs, you can still deploy only one App-V package to a single device.

    -
    -
    -   -
    - -   + - **SourcePath**: Point to the Office applications downloaded earlier. + + - **ProductID**: Specify the type of licensing, as shown in the following examples: + - Subscription Licensing: + ``` + + + + + + + + + + + ``` + In this example, the following changes were made to create a package with Subscription licensing: + + **SourcePath** is the path, which was changed to point to the Office applications that were downloaded earlier.
    + **Product ID** for Office was changed to `O365ProPlusRetail`.
    + **Product ID** for Visio was changed to `VisioProRetail`. + + - Volume Licensing + ``` + + + + + + + + + + + ``` + In this example, the following changes were made to create a package with Volume licensing: + + **SourcePath** is the path, which was changed to point to the Office applications that were downloaded earlier.
    + **Product ID** for Office was changed to `ProPlusVolume`.
    + **Product ID** for Visio was changed to `VisioProVolume`. + + - **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath. + + - **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server. + + An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users. + + **Note**  Even if you use unique package IDs, you can still deploy only one App-V package to a single device. 2. Use the /packager command to convert the Office applications to an Office 2013 App-V package. @@ -522,40 +449,33 @@ After you download the Office 2013 applications through the Office Deployment To -

    \\server\Office2013

    +

    \\server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    -

    Setup.exe

    +

    setup.exe

    is the Office Deployment Tool.

    -

    /packager

    +

    /packager

    creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.

    -

    \\server\Office2013\Customconfig.xml

    +

    \\server\Office2013\Customconfig.xml

    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

    -

    \\server\share\Office 2013AppV

    +

    \\server\share\Office2013AppV

    specifies the location of the newly created Office App-V package.

    -   - After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - - - **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files. - - - **WorkingDir** - - **Note**   - To troubleshoot any issues, see the log files in the %temp% directory (default). - -   + **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files.
    + **WorkingDir** + + **Note**  To troubleshoot any issues, see the log files in the %temp% directory (default). 3. Verify that the Office 2013 App-V package works correctly: @@ -576,7 +496,7 @@ Deploy the App-V package for Office 2013 by using the same methods you use for a - App-V Server -- Stand-alone through PowerShell commands +- Stand-alone through Windows PowerShell commands ### Publishing prerequisites and requirements @@ -593,9 +513,9 @@ Deploy the App-V package for Office 2013 by using the same methods you use for a -

    Enable PowerShell scripting on the App-V clients

    +

    Enable Windows PowerShell scripting on the App-V clients

    To publish Office 2013 packages, you must run a script.

    -

    Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

    +

    Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:

    Set-AppvClientConfiguration –EnablePackageScripts 1
    @@ -639,20 +559,17 @@ Use the steps in this section to enable Office plug-ins with your Office package **To enable plug-ins for Office App-V packages** -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. +1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a Windows PowerShell cmdlet. 2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. 3. Create an App-V package that includes the desired plug-ins. -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. +4. Add a Connection Group through App-V server, System Center Configuration Manager, or a Windows PowerShell cmdlet. 5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. - **Important**   - The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package. - -   + **Important**  The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package. 6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package. @@ -793,7 +710,11 @@ An Office 2013 App-V Package with your chosen licensing will be successfully dep ### Deploying Visio 2013 and Project 2013 with Office -The following table describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. +This section describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. + +- **To package and publish Visio 2013 and Project 2013 with Office**: Include Visio 2013 and Project 2013 in the same package with Office. If you aren’t deploying Office, you can create a package that contains Visio and/or Project. + +- **To deploy Visio 2013 and Project 2013 to specific users**: Use one of the following methods: @@ -802,28 +723,8 @@ The following table describes the requirements and options for deploying Visio 2 - - - - - - - - - - - - - - -
    TaskDetails

    How do I package and publish Visio 2013 and Project 2013 with Office?

    You must include Visio 2013 and Project 2013 in the same package with Office.

    -

    If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](https://technet.microsoft.com/en-us/itpro/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions#bkmk-pkg-pub-reqs).

    How can I deploy Visio 2013 and Project 2013 to specific users?

    Use one of the following methods:

    - ---- - - - - + + @@ -841,55 +742,39 @@ The following table describes the requirements and options for deploying Visio 2

    1. Create a package that contains Office, Visio, and Project.

    2. Deploy the package to all users.

      3. -

    3. Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.

      4. +

    4. Use [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) to prevent specific users from using Visio and Project.

    If you want to......then use this methodGoalMethod
    -

     

    - -  ## Additional resources **Office 2013 App-V Packages Additional Resources** -[Office Deployment Tool for Click-to-Run](http://go.microsoft.com/fwlink/p/?LinkID=330672) +[Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778) -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](http://go.microsoft.com/fwlink/p/?LinkId=330680) +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509) **Office 2010 App-V Packages** -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330681) +[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399) -[Known issues when you create or use an App-V 5.0 Office 2010 package](http://go.microsoft.com/fwlink/p/?LinkId=330682) +[Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619) -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330676) +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) **Connection Groups** -[Deploying Connection Groups in Microsoft App-V v5](http://go.microsoft.com/fwlink/p/?LinkId=330683) - [Managing Connection Groups](appv-managing-connection-groups.md) +[Connection groups on the App-V team blog](https://blogs.technet.microsoft.com/gladiatormsft/tag/connection-groups/) + **Dynamic Configuration** [About App-V Dynamic Configuration](appv-dynamic-configuration.md) ## Have a suggestion for App-V? - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -  - -  - - - - - +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md index 40d840f195..77314ded8e 100644 --- a/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -11,15 +11,17 @@ ms.prod: w10 # Deploying App-V Packages by Using Electronic Software Distribution (ESD) +**Applies to** +- Windows 10, version 1607 You can deploy App-V packages using an Electronic Software Distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). -To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=281816) +To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682125.aspx#BKMK_Appv) ## How to deploy virtualized packages using an ESD -Describes the methods you can use to deploy App-V packages by using an ESD +Describes the methods you can use to deploy App-V packages by using an ESD. [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md) @@ -33,12 +35,12 @@ Explains how to configure the App-V client to enable only administrators to publ ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for using an ESD and App-V -Use the following link for more information about [App-V and Citrix Integration](http://go.microsoft.com/fwlink/?LinkId=330294 ) (http://go.microsoft.com/fwlink/?LinkId=330294). +Use the following link for more information about [App-V and Citrix Integration](https://www.microsoft.com/en-us/download/details.aspx?id=40885). [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-deploying-the-appv-sequencer-and-client.md b/windows/manage/appv-deploying-the-appv-sequencer-and-client.md index 19cb04b5f4..ca8397a1fe 100644 --- a/windows/manage/appv-deploying-the-appv-sequencer-and-client.md +++ b/windows/manage/appv-deploying-the-appv-sequencer-and-client.md @@ -1,6 +1,6 @@ --- -title: Deploy the App-V Sequencer and Client (Windows 10) -description: Deploying the App-V Sequencer and Client +title: Deploying the App-V Sequencer and Configuring the Client (Windows 10) +description: Deploying the App-V Sequencer and Configuring the Client author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,45 +9,39 @@ ms.prod: w10 --- -# Deploying the App-V Sequencer and Client +# Deploying the App-V Sequencer and Configuring the Client + +**Applies to** +- Windows 10, version 1607 The App-V Sequencer and client enable administrators to virtualize and run virtualized applications. ## Enable the client - The App-V client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and to double-click file types, so that they can start a virtualized application. The client can also obtain the virtual application content from the management server. > [!NOTE] -> In Windows 10, version 1607, App-V is included with the OS. You only need to enable it. +> In Windows 10, version 1607, App-V is included with the operating system. You only need to enable it. [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) ## Client Configuration Settings - -The App-V client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. - -[About Client Configuration Settings](appv-client-configuration-settings.md) +The App-V client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. For information about client settings that you can configure through Windows PowerShell or through the registry, see [About Client Configuration Settings](appv-client-configuration-settings.md). ## Configure the client by using the ADMX template and Group Policy You can use Group Policy to configure the client settings for the App-V client and the Remote Desktop Services client. - -Perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller. +To manage the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller. 1. Save the **.admx** file to the following directory: **Windows \\ PolicyDefinitions** 2. Save the **.adml** file to the following directory: **Windows \\ PolicyDefinitions \\ ** -After you have completed the preceding steps, you can manage the App-V client configuration settings with the **Group Policy Management** console. +After you have completed the preceding steps, you can use Group Policy to configure the client settings by using the Group Policy Management Console under **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. -The App-V client also stores its configuration in the registry. You can gather some useful information about the client if you understand the format of the data in the registry. You can also configure many client actions by changing registry entries. - -[How to Modify App-V Client Configuration Using the ADMX Template and Group Policy](appv-modify-client-configuration-with-the-admx-template-and-group-policy.md) - -## Deploy the client by using the Shared Content Store mode +## Understanding Shared Content Store mode for App-V clients The App-V Shared Content Store (SCS) mode enables the SCS App-V clients to run virtualized applications without saving any of the associated package data locally. All required virtualized package data is transmitted across the network; therefore, you should only use the SCS mode in environments with a fast connection. Both the Remote Desktop Services (RDS) and the standard version of the App-V client are supported with SCS mode. @@ -62,23 +56,33 @@ The SCS mode is helpful in the following scenarios: - Remote Desktop Services deployments -To use SCS in your environment, you must enable the App-V client to run in SCS mode. This setting should be specified during installation. By default, the client is not configured to use SCS mode. You should install the client by using the suggested procedure if you plan to use SCS. However, you can configure an existing App-V client to run in SCS mode by entering the following Windows PowerShell command on the computer that runs the App-V client: - -``` -set-AppvClientConfiguration -SharedContentStoreMode 1 -``` +To use SCS in your environment, you must configure the App-V client to run in SCS mode (it will not use SCS mode by default). There might be cases when the administrator pre-loads some virtual applications on the computer that runs the App-V client in SCS mode. This can be accomplished with Windows PowerShell commands to add, publish, and mount the package. For example, if a package is pre-loaded on all computers, the administrator could add, publish, and mount the package by using Windows PowerShell commands. The package would not stream across the network because it would be locally stored. -[How to Install the App-V Client for Shared Content Store Mode](appv-install-the-appv-client-for-shared-content-store-mode.md) +### Configure the Group Policy setting for the SCS Mode for App-V clients + +Use the following steps to locate and configure the Group Policy setting for the SCS Mode for App-V clients. + +1. In the Group Policy Management Console, navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Streaming**. + +2. Enable the **Set the Shared Content Mode (SCS) mode** setting. + +### Configure an individual client to use the SCS mode + +To configure the App-V client to run in SCS mode, on the client, enter the following Windows PowerShell command: + +``` +Set-AppvClientConfiguration -SharedContentStoreMode 1 +``` ## Deploy the Sequencer The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V client. The Sequencer helps provide a simple and predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. -For a list of changes in the App-V Sequencer, see [About App-V](appv-about-appv.md). +For a list of changes in the App-V Sequencer, see [What's new in App-V](appv-about-appv.md#bkmk-seqimprove). -[How to Install the Sequencer](appv-install-the-sequencer.md) +To deploy the sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). ## App-V Client and Sequencer logs @@ -87,11 +91,6 @@ You can use the App-V Sequencer log information to help troubleshoot the Sequenc **Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V**. Sequencer-related events are prepended with **AppV\_Sequencer**. Client-related events are prepended with **AppV\_Client**. -## Other resources for deploying the Sequencer and client - -- [Deploying App-V](appv-deploying-appv.md) -- [Planning for App-V](appv-planning-for-appv.md) - ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-deploying-the-appv-server.md b/windows/manage/appv-deploying-the-appv-server.md index 309a23843c..7cfca2fe26 100644 --- a/windows/manage/appv-deploying-the-appv-server.md +++ b/windows/manage/appv-deploying-the-appv-server.md @@ -1,6 +1,6 @@ --- title: Deploying the App-V Server (Windows 10) -description: Deploying the App-V Server +description: Deploying the App-V Server in App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,29 +8,37 @@ ms.sitesec: library ms.prod: w10 --- -# Deploying the App-V Server +# Deploying the App-V server -You can install the App-V server features by using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). +**Applies to** +- Windows Server 2016 -For information about deploying the App-V Server, see [About App-V](appv-about-appv.md). +>**Note**
    If you plan to use the App-V server components in your deployment, note that they reference App-V 5.x. This is because the App-V server components have not changed in App-V for Windows 10. + +You can install the Application Virtualization (App-V) server components using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). + +For information about deploying App-V for Windows 10, see [What's new in App-V](appv-about-appv.md). >**Important**
    Before you install and configure the App-V servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. ## Download and install App-V server components +>**Note**
    +If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. + App-V offers the following five server components, each of which serves a specific purpose in an App-V environment. - **Management server.** Use the App-V management server and console to manage your App-V infrastructure. See [Administering App-V with the management console](appv-administering-virtual-applications-with-the-management-console.md) for more information about the management server. - >**Note**
    If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you can still take advantage of the reporting and streaming capabilities in App-V. + >**Note**
    If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you may want to take advantage of the reporting and streaming capabilities in App-V. -- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to deploy the App-V server components](appv-deploy-the-appv-server.md) for more information about the management database. +- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the management database. - **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. See [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md) for more information about configuring the publishing server. - **Reporting server.** Use the App-V reporting server to generate reports that help you manage your App-V infrastructure. The reporting server requires a connection to the reporting database. See [About App-V reporting](appv-reporting.md) for more information about the reporting capabilities in App-V. -- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to deploy the App-V server](appv-deploy-the-appv-server.md) for more information about the reporting database. +- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the reporting database. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: @@ -38,8 +46,6 @@ All five App-V server components are included in the Microsoft Desktop Optimizat - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). - >**Note**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. - In large organizations, you might want to install more than one instance of the server components to get: - Fault tolerance for situations when one of the servers is unavailable. @@ -49,14 +55,14 @@ In large organizations, you might want to install more than one instance of the - Scalability to support a high load. For example, you can install additional servers behind a network load balancer. ## App-V standalone deployment -The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this topology for larger deployments. +The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are installed on a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this strategy for larger deployments. - [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) - [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) ## App-V Server distributed deployment -The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V Server components are deployed across multiple computers, based on the structure and requirements of the organization. +The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V server components are deployed across multiple computers, based on the structure and requirements of the organization. - [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) @@ -69,7 +75,7 @@ The distributed deployment topology can support a large App-V client base and it - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md) ## Using an Enterprise Software Distribution (ESD) solution and App-V -You can also deploy the App-V clients and packages by using an ESD without having to deploy App-V. The full capabilities for integration will vary depending on the ESD that you use. +You can also deploy packages by using an ESD. The full capabilities for integration will vary depending on the ESD that you use. >**Note**
    The App-V reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality. @@ -97,10 +103,10 @@ The reporting information will be maintained until it is successfully sent to th If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V reporting server and it must be deployed separately to generate the associated reports. -For more information, see [About App-V Reporting](appv-reporting.md) and [How to Enable Reporting on the App-V Client by Using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md). +For more information, see [About App-V Reporting](appv-reporting.md) and [How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md). ## Other resources for the App-V server - [Deploying App-V](appv-deploying-appv.md) ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file diff --git a/windows/manage/appv-deployment-checklist.md b/windows/manage/appv-deployment-checklist.md index 2def234fd2..cf1f4cf23e 100644 --- a/windows/manage/appv-deployment-checklist.md +++ b/windows/manage/appv-deployment-checklist.md @@ -11,11 +11,13 @@ ms.prod: w10 # App-V Deployment Checklist +**Applies to** +- Windows 10, version 1607 This checklist can be used to help you during an App-V deployment. -> [!NOTE] -> This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. +>**Note**
    +This checklist outlines the recommended steps and items to consider when deploying App-V features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. @@ -41,7 +43,7 @@ This checklist can be used to help you during an App-V deployment. - + @@ -69,7 +71,7 @@ This checklist can be used to help you during an App-V deployment. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-dynamic-configuration.md b/windows/manage/appv-dynamic-configuration.md index 9f39eb5a86..410da69b63 100644 --- a/windows/manage/appv-dynamic-configuration.md +++ b/windows/manage/appv-dynamic-configuration.md @@ -11,6 +11,9 @@ ms.prod: w10 # About App-V Dynamic Configuration +**Applies to** +- Windows 10, version 1607 + You can use the dynamic configuration to customize an App-V package for a user. Use the following information to create or edit an existing dynamic configuration file. When you edit the dynamic configuration file it customizes how an App-V package will run for a user or group. This helps to provide a more convenient method for package customization by removing the need to re-sequence packages using the desired settings, and provides a way to keep package content and custom settings independent. @@ -636,7 +639,7 @@ The following table describes the various script events and the context under wh ### Using multiple scripts on a single event trigger -App-V supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you convert from App-V 4.6 to App-V for Windows 10. To enable the use of multiple scripts, App-V uses a script launcher application, named ScriptRunner.exe, which is installed as part of the App-V client installation. +App-V supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you convert from App-V 4.6 to App-V for Windows 10. To enable the use of multiple scripts, App-V uses a script launcher application, named ScriptRunner.exe, which is included in the App-V client. **How to use multiple scripts on a single event trigger:** @@ -683,10 +686,10 @@ Using the following example file and table, modify the deployment or user config - +
      +

    • Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

      +

      For more information, see:
      [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md#bkmk-admin-only-posh-topic-cg)
      [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#bkmk-admins-pub-pkgs).

      • +

    • Enable the “Require publish as administrator” Group Policy setting for App-V Clients.

      +

      For more information, see [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md#bkmk-admin-pub-pkg-only-posh)

      • +
    +
    Checklist box

    Review the App-V supported configurations information to make sure selected client and server computers are supported for App-V feature installation.

    Review the App-V supported configurations information.

    [App-V Supported Configurations](appv-supported-configurations.md)

    ScriptRunner.exe

    The script launcher application that is installed as part of the App-V client installation.

    +

    The script launcher application that is included in the App-V client.

    Note   -

    Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:\Program Files\Microsoft Application Virtualization\Client folder.

    +

    Although ScriptRunner.exe is included in the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:\Program Files\Microsoft Application Virtualization\Client folder.

      @@ -731,12 +734,12 @@ To create the file manually, the information above in previous sections can be c ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics -[How to Apply the Deployment Configuration File by Using PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) +[How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) -[How to Apply the User Configuration File by Using PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) +[How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md index bf8851078f..bdf05bd7cd 100644 --- a/windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md +++ b/windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Enable Only Administrators to Publish Packages by Using an ESD +**Applies to** +- Windows 10, version 1607 Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you could not prevent end users from performing these tasks. @@ -18,19 +20,12 @@ Starting in App-V 5.0 SP3, you can configure the App-V client so that only admin 1. Navigate to the following Group Policy Object node: - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. + **Computer Configuration > Administrative Templates > System > App-V > Publishing**. 2. Enable the **Require publish as administrator** Group Policy setting. - To alternatively use PowerShell to set this item, see [How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#bkmk-admins-pub-pkgs). - - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -  - -  - - - + To instead use Windows PowerShell to set this item, see [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#bkmk-admins-pub-pkgs). +## Have a suggestion for App-V? +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md index 7451d59112..084189822a 100644 --- a/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ b/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Enable Reporting on the App-V Client by Using PowerShell (Windows 10) -description: How to Enable Reporting on the App-V Client by Using PowerShell +title: How to Enable Reporting on the App-V Client by Using Windows PowerShell (Windows 10) +description: How to Enable Reporting on the App-V Client by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,8 +9,10 @@ ms.prod: w10 --- -# How to Enable Reporting on the App-V Client by Using PowerShell +# How to Enable Reporting on the App-V Client by Using Windows PowerShell +**Applies to** +- Windows 10, version 1607 Use the following procedure to configure the App-V for reporting. @@ -18,12 +20,12 @@ Use the following procedure to configure the App-V for reporting. 1. Enable the App-V client. For more information, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). -2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings: +2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings: - - + + @@ -74,14 +76,14 @@ Use the following procedure to configure the App-V for reporting. 3. After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server. - Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet. + Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** cmdlet. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics -[Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-enable-the-app-v-desktop-client.md b/windows/manage/appv-enable-the-app-v-desktop-client.md index fe8bc4ffdc..7231debe95 100644 --- a/windows/manage/appv-enable-the-app-v-desktop-client.md +++ b/windows/manage/appv-enable-the-app-v-desktop-client.md @@ -1,6 +1,6 @@ --- -title: Enable the App-V desktop client (Windows 10) -description: Enable the App-V desktop client +title: Enable the App-V in-box client (Windows 10) +description: How to enable the App-V in-box client installed with Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,15 +8,18 @@ ms.sitesec: library ms.prod: w10 --- -# Enable the App-V desktop client +# Enable the App-V in-box client + +**Applies to** +- Windows 10, version 1607 The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. The client can also get virtual application content from the management server. -With Windows 10, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. +With Windows 10, version 1607, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. **To enable the App-V client with Group Policy:** -1. Open the device’s **Local Group Policy Editor**. +1. Open the device’s **Group Policy Editor**. 2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. @@ -28,14 +31,23 @@ With Windows 10, the App-V client is installed automatically. You need to enable 1. Open Windows PowerShell. -2. Type `Enable-Appv` and press Enter. +2. Type `Enable-Appv` and press ENTER. 3. Restart the device. -4. To verify that the App-V client is enabled on the device, enter **AppvClientEnabled** or **Get-AppvStatus** in Windows PowerShell. +4. To verify that the App-V client is enabled on the device, type `Get-AppvStatus` and press ENTER. -See [Using the client management console](appv-using-the-client-management-console.md) for information about configuring the App-V client. + +For information about configuring the App-V client, see: + +- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) + +- [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) + +- [Using the client management console](appv-using-the-client-management-console.md) + +- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-evaluating-appv.md b/windows/manage/appv-evaluating-appv.md index 20d2eba290..c125dd8975 100644 --- a/windows/manage/appv-evaluating-appv.md +++ b/windows/manage/appv-evaluating-appv.md @@ -1,6 +1,6 @@ --- title: Evaluating App-V (Windows 10) -description: Evaluating App-V +description: Evaluating App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -11,12 +11,14 @@ ms.prod: w10 # Evaluating App-V +**Applies to** +- Windows 10, version 1607 -Before you deploy pp-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only. +Before you deploy App-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only. ## Configure lab computers for App-V Evaluation -Use the following link for information about setting up the App-V sequencer on a computer in your lab environment. +Use the following links for information about setting up the App-V sequencer on a computer in your lab environment. ### Installing the App-V Sequencer and Creating Packages @@ -30,13 +32,13 @@ Use the following links for information about setting up the App-V sequencer and Use the following links for information about setting up the App-V server in your lab environment. -- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) +- [How to Deploy the App-V server](appv-deploy-the-appv-server.md) - [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) -### Installing the App-V Client +### Enabling the App-V Client -Use the following link for more information about creating and managing virtualized packages in your lab environment. +Use the following links for more information about creating and managing virtualized packages in your lab environment. - [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) @@ -44,7 +46,7 @@ Use the following link for more information about creating and managing virtuali ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-for-windows.md b/windows/manage/appv-for-windows.md index d127094cb6..aa08aead59 100644 --- a/windows/manage/appv-for-windows.md +++ b/windows/manage/appv-for-windows.md @@ -11,15 +11,16 @@ ms.prod: w10 # Application Virtualization (App-V) for Windows 10 overview +**Applies to** +- Windows 10, version 1607 -The topics in this section provides information and step-by-step procedures to help you administer App-V and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. +The topics in this section provide information and step-by-step procedures to help you administer App-V and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. [Getting Started with App-V](appv-getting-started.md) -- [About App-V](appv-about-appv.md) +- [What's new in App-V](appv-about-appv.md) - [Evaluating App-V](appv-evaluating-appv.md) - [High Level Architecture for App-V](appv-high-level-architecture.md) -- [Accessibility for App-V](appv-accessibility.md) [Planning for App-V](appv-planning-for-appv.md) @@ -31,7 +32,7 @@ The topics in this section provides information and step-by-step procedures to h [Deploying App-V](appv-deploying-appv.md) -- [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) +- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) - [Deploying the App-V Server](appv-deploying-the-appv-server.md) - [App-V Deployment Checklist](appv-deployment-checklist.md) - [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md) @@ -46,7 +47,7 @@ The topics in this section provides information and step-by-step procedures to h - [Using the App-V Client Management Console](appv-using-the-client-management-console.md) - [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) - [Maintaining App-V](appv-maintaining-appv.md) -- [Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) +- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) [Troubleshooting App-V](appv-troubleshooting.md) @@ -57,6 +58,6 @@ The topics in this section provides information and step-by-step procedures to h - [Viewing App-V Server Publishing Metadata](appv-viewing-appv-server-publishing-metadata.md) - [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md) -### Have a suggestion for App-V? +## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md index 2e33f78295..9a7b624486 100644 --- a/windows/manage/appv-getting-started.md +++ b/windows/manage/appv-getting-started.md @@ -1,6 +1,6 @@ --- title: Getting Started with App-V (Windows 10) -description: Getting Started with App-V +description: Getting Started with App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,9 +9,12 @@ ms.prod: w10 --- -# Getting Started with App-V +# Getting Started with App-V for Windows 10 -Microsoft Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. +**Applies to** +- Windows 10, version 1607 + +Microsoft Application Virtualization (App-V) for Windows 10 enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you are new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. For information about what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). @@ -30,18 +33,18 @@ To start using App-V to deliver virtual applications to users, you’ll need to | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](#_Deploying_the_App-V). | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215).
    You must have a MSDN subscription to download the MDOP ISO package.
    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. | -| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10.
    For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | -| App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit). | +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

    **Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:

    - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.

    - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).

    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. +| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.

    For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | +| App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | -For more information about these elements, see [High Level Architecture for App-V](appv-high-level-architecture.md). +For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For information about Microsoft training opportunities, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx). ## Getting started with App-V -- [About App-V](appv-about-appv.md) +- [What's new in App-V](appv-about-appv.md) Provides a high-level overview of App-V and how it can be used in your organization. @@ -53,10 +56,6 @@ If you are new to this product, we recommend that you read the documentation tho Provides a description of the App-V features and how they work together. -- [Accessibility for App-V](appv-accessibility.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - ## Other resources for this product @@ -74,5 +73,5 @@ If you are new to this product, we recommend that you read the documentation tho ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-high-level-architecture.md b/windows/manage/appv-high-level-architecture.md index 396b92d811..b44b2ca181 100644 --- a/windows/manage/appv-high-level-architecture.md +++ b/windows/manage/appv-high-level-architecture.md @@ -11,6 +11,8 @@ ms.prod: w10 # High Level Architecture for App-V +**Applies to** +- Windows 10, version 1607 Use the following information to help you simplify you Microsoft Application Virtualization (App-V) deployment. @@ -21,8 +23,8 @@ A typical App-V implementation consists of the following elements.
    --++ @@ -65,7 +67,7 @@ If you are using App-V with Electronic Software Distribution (ESD) you are not r ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md b/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md index fb6da496d4..77ee61220b 100644 --- a/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md +++ b/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md @@ -1,29 +1,4 @@ --- title: How to Install the App-V Client for Shared Content Store Mode (Windows 10) -description: How to Install the App-V Client for Shared Content Store Mode -author: MaggiePucciEvans -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client --- - - -# How to Install the App-V Client for Shared Content Store Mode - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) client so that it uses the App-V Shared Content Store (SCS) mode. You should ensure that all required prerequisites are installed on the computer you plan to install to. Use the following link to see [App-V Prerequisites](appv-prerequisites.md). - -**Enable the App-V client for SCS mode** - -1. In the Group Policy Management Console, navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V** > **Streaming**. - -2. Enable the **Set the Shared Content Mode (SCS) mode** setting. - -## Have a suggestion for App-V? - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related topics - -- [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) diff --git a/windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index 7bb1ffa822..60cde870db 100644 --- a/windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell (Windows 10) -description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell +title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell (Windows 10) +description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,10 +9,12 @@ ms.prod: w10 --- -# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell +# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell +**Applies to** +- Windows Server 2016 -Use the following PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. +Use the following Windows PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. Before attempting this procedure, you should read and understand the information and examples displayed in the following list: @@ -32,336 +34,97 @@ Before attempting this procedure, you should read and understand the information **To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** -1. Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**. +1. Copy the following script into a text editor and save it as a Windows PowerShell script file, for example **ConvertToSIDs.ps1**. -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. +2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. ``` syntax <# - ``` - - ``` syntax .SYNOPSIS - ``` - - ``` syntax - This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. - ``` - - ``` syntax + This Windows PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. .DESCRIPTION - ``` - - ``` syntax - This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. - ``` - - ``` syntax + This is a Windows PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. .INPUTS - ``` - - ``` syntax The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. - ``` - - ``` syntax .OUTPUTS - ``` - - ``` syntax A list of account names with the corresponding SID in standard and hexadecimal formats - ``` - - ``` syntax .EXAMPLE - ``` - - ``` syntax .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List - ``` - - ``` syntax .EXAMPLE - ``` - - ``` syntax $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") - ``` - - ``` syntax .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 - ``` - - ``` syntax -#> - ``` - - ``` syntax - ``` + #> []() []() - - ``` syntax function ConvertSIDToHexFormat - ``` - { - -    param(\[System.Security.Principal.SecurityIdentifier\]$sidToConvert) - - ``` syntax - ``` - - ``` syntax +    param([System.Security.Principal.SecurityIdentifier]$sidToConvert)    $sb = New-Object System.Text.StringBuilder - ``` - - ``` syntax     [int] $binLength = $sidToConvert.BinaryLength - ``` - - ``` syntax     [Byte[]] $byteArray = New-Object Byte[] $binLength - ``` - - ``` syntax    $sidToConvert.GetBinaryForm($byteArray, 0) - ``` - - ``` syntax    foreach($byte in $byteArray) - ``` - - ``` syntax    { - ``` - - ``` syntax    $sb.Append($byte.ToString("X2")) |Out-Null - ``` - - ``` syntax    } - ``` - - ``` syntax    return $sb.ToString() - ``` - - ``` syntax } - ``` - - ``` syntax [string[]]$myArgs = $args - ``` - - ``` syntax if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) - ``` - { - - ``` syntax [string]::Format("{0}====== Description ======{0}{0}" + - ``` - - ``` syntax "  Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + - ``` - - ``` syntax                "  Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + - ``` - - ``` syntax                "  The output is written to the console in the format 'Account name    SID as string   SID as hexadecimal'{0}" + - ``` - - ``` syntax -                "  And can be written out to a file using standard PowerShell redirection{0}" + - ``` - - ``` syntax +                "  And can be written out to a file using standard Windows PowerShell redirection{0}" +                "  Please specify user accounts in the format 'DOMAIN\username'{0}" + - ``` - - ``` syntax                "  Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + - ``` - - ``` syntax                "  For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + - ``` - - ``` syntax                "{0}====== Arguments ======{0}" + - ``` - - ``` syntax                "{0}  /?    Show this help message", [Environment]::NewLine) - ``` - - ``` syntax { - ``` - - ``` syntax else - ``` - - ``` syntax {      #If an array was passed in, try to split it - ``` - - ``` syntax     if($myArgs.Length -eq 1) - ``` - - ``` syntax     { - ``` - - ``` syntax         $myArgs = $myArgs.Split(' ') - ``` - - ``` syntax     } - ``` - - ``` syntax     #Parse the arguments for account names - ``` - - ``` syntax     foreach($accountName in $myArgs) - ``` - - ``` syntax     {    - ``` - - ``` syntax         [string[]] $splitString = $accountName.Split('\')  # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject - ``` - - ``` syntax         if($splitString.Length -ne 2) - ``` - - ``` syntax         { - ``` - - ``` syntax             $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) - ``` - - ``` syntax             Write-Error -Message $message - ``` - - ``` syntax             continue - ``` - - ``` syntax         } - ``` - - ``` syntax -         - ``` - - ``` syntax         #Convert any account names to SIDs - ``` - - ``` syntax         try - ``` - - ``` syntax         { - ``` - - ``` syntax             [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) - ``` - - ``` syntax             [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) - ``` - - ``` syntax         } - ``` - - ``` syntax         catch [System.Security.Principal.IdentityNotMappedException] - ``` - - ``` syntax         { - ``` - - ``` syntax             $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) - ``` - - ``` syntax             Write-Error -Message $message - ``` - - ``` syntax             continue - ``` - - ``` syntax         } - ``` - - ``` syntax         #Convert regular SID to binary format used by SQL - ``` - - ``` syntax         $hexSIDString = ConvertSIDToHexFormat $SID - ``` - - ``` syntax -                 $SIDs = New-Object PSObject - ``` - - ``` syntax         $SIDs | Add-Member NoteProperty Account $accountName - ``` - - ``` syntax         $SIDs | Add-Member NoteProperty SID $SID.ToString() - ``` - - ``` syntax         $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString - ``` - - ``` syntax         Write-Output $SIDs - ``` - - ``` syntax     } - ``` - - ``` syntax } ``` @@ -373,18 +136,10 @@ Before attempting this procedure, you should read and understand the information **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - -[Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) - -  - -  - - - - - +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md index f9978a7b46..d4cf994c82 100644 --- a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -1,6 +1,6 @@ --- title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services (Windows 10) -description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services +description: How to install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -11,14 +11,14 @@ ms.prod: w10 # How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services +**Applies to** +- Windows Server 2016 Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. -**Note**   +>**Note**   After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. -  - **To install the management database and the management server on separate computers** 1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. @@ -39,12 +39,8 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - **Note**   - If you plan to deploy the management server on the same computer you must select **Use this local computer**. - -   - - Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. + >**Note**   + If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. 8. To start the installation, click **Install**. @@ -66,14 +62,10 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance If you are using a custom database name, then select **Custom configuration** and type the database name. -7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. +7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: Domain\\MachineAccount. **Note**   - If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. - -   - - Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. + If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. 8. To start the installation, click **Install**. @@ -83,7 +75,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”**. + **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”** 3. After the extraction has been completed, to access the App-V database scripts and instructions readme file: @@ -94,24 +86,14 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. **Note**   - For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md). - -   + For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md).   5. Run the scripts on the computer running Microsoft SQL Server. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Deploying App-V](appv-deploying-appv.md) - -  - -  - - - - - diff --git a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md index de8e7c0416..1c9adffb02 100644 --- a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to install the Management Server on a Standalone Computer and Connect it to the Database +**Applies to** +- Windows Server 2016 Use the following procedure to install the management server on a standalone computer and connect it to the database. @@ -28,14 +30,8 @@ Use the following procedure to install the management server on a standalone com 6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - **Note**   - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - -   - - For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - - Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. + >**Note**   + If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. 7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation @@ -45,7 +41,9 @@ Use the following procedure to install the management server on a standalone com 9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md index f9f66a2120..d28bc0298f 100644 --- a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md @@ -1,6 +1,6 @@ --- title: How to Install the Publishing Server on a Remote Computer (Windows 10) -description: How to Install the Publishing Server on a Remote Computer +description: How to Install the App-V Publishing Server on a Remote Computer author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -11,6 +11,8 @@ ms.prod: w10 # How to Install the Publishing Server on a Remote Computer +**Applies to** +- Windows Server 2016 Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. @@ -44,25 +46,29 @@ Use the following procedure to install the publishing server on a separate compu 3. Type the name of this server and a description (if required) and click **Add**. -9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: +9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: - `` + ```syntax + + + - ` ` + + + - ` ` + - ` ` + - ` ` + - ` ` + + ``` - ` ` +## Have a suggestion for App-V? - `` - - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md index 5fbc775cc8..10915488b0 100644 --- a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -1,6 +1,6 @@ --- title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database (Windows 10) -description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database +description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -11,13 +11,12 @@ ms.prod: w10 # How to install the Reporting Server on a Standalone Computer and Connect it to the Database +**Applies to** +- Windows Server 2016 Use the following procedure to install the reporting server on a standalone computer and connect it to the database. -**Important**   -Before performing the following procedure you should read and understand [About App-V Reporting](appv-reporting.md). - -  +> **Important**  Before performing the following procedure you should read and understand [About App-V Reporting](appv-reporting.md). **To install the reporting server on a standalone computer and connect it to the database** @@ -34,13 +33,7 @@ Before performing the following procedure you should read and understand [About 6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. **Note**   - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - -   - - For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - - Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. + If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. 7. On the **Configure Reporting Server Configuration** page. @@ -50,7 +43,9 @@ Before performing the following procedure you should read and understand [About 8. Click **Install**. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics @@ -59,13 +54,4 @@ Before performing the following procedure you should read and understand [About [Deploying App-V](appv-deploying-appv.md) -[How to Enable Reporting on the App-V Client by Using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) - -  - -  - - - - - +[How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md) diff --git a/windows/manage/appv-install-the-sequencer.md b/windows/manage/appv-install-the-sequencer.md index 19d09c9a09..a84655d47d 100644 --- a/windows/manage/appv-install-the-sequencer.md +++ b/windows/manage/appv-install-the-sequencer.md @@ -11,6 +11,9 @@ ms.prod: w10 # Install the App-V Sequencer +**Applies to** +- Windows 10, version 1607 + Use the App-V Sequencer to convert Win32 applications into virtual packages for deployment to user devices. Those devices must be running the App-V client to allow users to interact with virtual applications. The App-V Sequencer is included in the Windows 10 Assessment and Deployment Kit (Windows ADK). @@ -51,7 +54,7 @@ For more information regarding the sequencer installation, you can view the erro ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index 110f5d08a1..2c29e70fd9 100644 --- a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -1,6 +1,6 @@ --- -title: How to Load the PowerShell Cmdlets and Get Cmdlet Help (Windows 10) -description: How to Load the PowerShell Cmdlets and Get Cmdlet Help +title: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help (Windows 10) +description: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,23 +9,25 @@ ms.prod: w10 --- -# How to Load the PowerShell Cmdlets and Get Cmdlet Help +# How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help +**Applies to** +- Windows 10, version 1607 What this topic covers: -- [Requirements for using PowerShell cmdlets](#bkmk-reqs-using-posh) +- [Requirements for using Windows PowerShell cmdlets](#bkmk-reqs-using-posh) -- [Loading the PowerShell cmdlets](#bkmk-load-cmdlets) +- [Loading the Windows PowerShell cmdlets](#bkmk-load-cmdlets) -- [Getting help for the PowerShell cmdlets](#bkmk-get-cmdlet-help) +- [Getting help for the Windows PowerShell cmdlets](#bkmk-get-cmdlet-help) -- [Displaying the help for a PowerShell cmdlet](#bkmk-display-help-cmdlet) +- [Displaying the help for a Windows PowerShell cmdlet](#bkmk-display-help-cmdlet) -## Requirements for using PowerShell cmdlets +## Requirements for using Windows PowerShell cmdlets -Review the following requirements for using the App-V PowerShell cmdlets: +Review the following requirements for using the Windows PowerShell cmdlets:
    @@ -71,42 +73,23 @@ Review the following requirements for using the App-V PowerShell cmdlets:

  • Unpublish-AppvClientPackage

    • To configure these cmdlets to require an elevated command prompt, use one of the following methods:

    -
    ---- - - - - - - - - - - - - - - - - -
    MethodMore resources

    Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

      -

    • [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md#bkmk-admin-only-posh-topic-cg)

      • -

    • [How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#bkmk-admins-pub-pkgs)

      • -

    Enable the “Require publish as administrator” Group Policy setting for App-V Clients.

    [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md#bkmk-admin-pub-pkg-only-posh)

    -

     
      -## Loading the PowerShell cmdlets +## Loading the Windows PowerShell cmdlets -To load the PowerShell cmdlet modules: +To load the Windows PowerShell cmdlet modules: 1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). @@ -141,30 +124,12 @@ To load the PowerShell cmdlet modules:   -## Getting help for the PowerShell cmdlets - +## Getting help for the Windows PowerShell cmdlets Starting in App-V 5.0 SP3, cmdlet help is available in two formats: - ---- - - - - - - - - - - - - - - - - -
    FormatDescription

    As a downloadable module

    To download the latest help after downloading the cmdlet module:

    -
      -

    1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

      2. -

    2. Type one of the following commands to load the cmdlets for the module you want:

      3. -
    +- **As a downloadable module**: To download the latest help after downloading the cmdlet module, open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE), and type one of the following commands: + @@ -191,33 +156,21 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
    -

     

    On TechNet as web pages

    See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx).

    -  +
    -## Displaying the help for a PowerShell cmdlet +- **On TechNet as web pages**: See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx). + +## Displaying the help for a Windows PowerShell cmdlet -To display help for a specific PowerShell cmdlet: +To display help for a specific Windows PowerShell cmdlet: 1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). 2. Type **Get-Help** <*cmdlet*>, for example, **Get-Help Publish-AppvClientPackage**. -**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -  - -  - - - +## Have a suggestion for App-V? +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-maintaining-appv.md b/windows/manage/appv-maintaining-appv.md index 6cf35b1731..32dae30bb0 100644 --- a/windows/manage/appv-maintaining-appv.md +++ b/windows/manage/appv-maintaining-appv.md @@ -11,27 +11,28 @@ ms.prod: w10 # Maintaining App-V +**Applies to** +- Windows 10, version 1607 -After you have completed all the necessary planning, and then deployment of App-V, you can use the following information to maintain the App-V infrastructure. +After you have deployed App-V for Windows 10, you can use the following information to maintain the App-V infrastructure. -## Move the App-V Server +## Moving the App-V server - -The App-V server connects to the App-V database. Therefore you can install the management component to any computer on the network and then connect it to the App-V database. +The App-V server connects to the App-V database. Therefore you can install the management component on any computer on the network and then connect it to the App-V database. [How to Move the App-V Server to Another Computer](appv-move-the-appv-server-to-another-computer.md) -## Determine if an App-V Application is Running Virtualized +## Determine if an App-V Application is Running Virtualized -Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V or above, should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. +Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. -Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. +Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.1 and later, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for maintaining App-V diff --git a/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md index 9386a9d9b2..694708f484 100644 --- a/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ b/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell (Windows 10) -description: How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell +title: How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell (Windows 10) +description: How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,10 +9,13 @@ ms.prod: w10 --- -# How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell +# How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell + +**Applies to** +- Windows 10, version 1607 -The following sections explain how to perform various management tasks on a stand-alone client computer by using PowerShell: +The following sections explain how to perform various management tasks on a stand-alone client computer by using Windows PowerShell: - [To return a list of packages](#bkmk-return-pkgs-standalone-posh) @@ -66,8 +69,8 @@ Use the following information to publish a package that has been added to a spec --++ @@ -167,24 +170,18 @@ Use the following information to remove a package from the computer. **Example**: Remove-AppvClientPackage “ContosoApplication” **Note**   -App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](http://go.microsoft.com/fwlink/?LinkId=324466). +App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://blogs.technet.microsoft.com/appv/2012/12/03/app-v-5-0-client-powershell-deep-dive/).   ## To enable only administrators to publish or unpublish packages - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - -  - -Use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages: +Starting in App-V 5.0 SP3, you can use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages:
    --++ @@ -211,12 +208,12 @@ To use the App-V Management console to set this configuration, see [How to Publi ## Understanding pending packages (UserPending and GlobalPending) -**Starting in App-V 5.0 SP2**: If you run a PowerShell cmdlet that affects a package that is currently in use, the task that you are trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows: +**Starting in App-V 5.0 SP2**: If you run a Windows PowerShell cmdlet that affects a package that is currently in use, the task that you are trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows:
    --++ @@ -271,24 +268,15 @@ The pending task will run later, according to the following rules:
    -  +For more information about pending tasks, see [Upgrading an in-use App-V package](appv-application-publishing-and-client-interaction.md#upgrading-an-in-use-app-v-package). -For more information about pending tasks, see [About App-V 5.0 SP2](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks). +## Have a suggestion for App-V? -**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) -[Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) - -  - -  - - - - +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md index b54a3e959a..3d52191607 100644 --- a/windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ b/windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell (Windows 10) -description: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell +title: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell (Windows 10) +description: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,12 +9,14 @@ ms.prod: w10 --- -# How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell +# How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell +**Applies to** +- Windows 10, version 1607 An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. -A connection group XML file defines the connection group that runs on the computer where you’ve installed the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](appv-connection-group-file.md). +A connection group XML file defines the connection group for the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](appv-connection-group-file.md). This topic explains the following procedures: @@ -81,8 +83,8 @@ This topic explains the following procedures:

    Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    -

    Disable -AppVClientConnectionGroup

    -

    Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    +

    Disable-AppVClientConnectionGroup

    +

    Disable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    @@ -115,32 +117,23 @@ This topic explains the following procedures:

    Set-AppvClientConfiguration

    -

    –RequirePublishAsAdmin

    +

    -RequirePublishAsAdmin

    • 0 - False

    • 1 - True

    -

    Set-AppvClientConfiguration –RequirePublishAsAdmin1

    +

    Set-AppvClientConfiguration -RequirePublishAsAdmin 1

    -   +## Have a suggestion for App-V? - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics [Operations for App-V](appv-operations.md) -[Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) - -  - -  - - - - - +[Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/manage/appv-managing-connection-groups.md b/windows/manage/appv-managing-connection-groups.md index f702b6c319..dad0496d45 100644 --- a/windows/manage/appv-managing-connection-groups.md +++ b/windows/manage/appv-managing-connection-groups.md @@ -11,15 +11,15 @@ ms.prod: w10 # Managing Connection Groups +**Applies to** +- Windows 10, version 1607 Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. **Note**   In some previous versions of App-V, connection groups were referred to as Dynamic Suite Composition. -  - -**In this topic:** +**In this section:** @@ -51,7 +51,14 @@ In some previous versions of App-V, connection groups were referred to as Dynami - + + + + + + + +

    [How to Publish a Connection Group](appv-publish-a-connection-group.md)

    Explains how to publish a connection group.

    [How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md)

    Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create.

    [How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md)

    Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups.
      @@ -59,7 +66,7 @@ In some previous versions of App-V, connection groups were referred to as Dynami ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for App-V connection groups diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index 87958fb0dd..ff212a6b60 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -1,6 +1,6 @@ --- title: Migrating to App-V from a Previous Version (Windows 10) -description: Migrating to App-V from a Previous Version +description: Migrating to App-V for Windows 10 from a previous version author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,18 +9,12 @@ ms.prod: w10 --- -# Migrating to App-V from a Previous Version +# Migrating to App-V from previous versions +**Applies to** +- Windows 10, version 1607 -With Microsoft Application Virtualization (App-V), you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V infrastructure. -However, you cannot migrate directly from App-V 4.x to App-V, you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) - -**Note**   -App-V packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V packages. - -For more information about the differences between App-V 4.6 and App-V, see the **Differences between App-4.6 and App-V 5.0 section** of [About App-V 5.0](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/about-app-v-50). - -  +To migrate from App-V 4.x to App-V for Windows 10, you must upgrade to App-V 5.x first. ## Improvements to the App-V Package Converter @@ -36,8 +30,8 @@ You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom -New in App-V -Prior to App-V +New in App-V for Windows 10 +Prior to App-V for Windows 10 @@ -168,7 +162,8 @@ ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\ ## Converting packages created using a prior version of App-V -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. +Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses Windows PowerShell to convert packages and can help automate the process if you have many packages that require conversion. App-V packages created with App-V 5.x don't need to be converted. + **Important**   After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. @@ -206,52 +201,15 @@ After you convert an existing package you should test the package prior to deplo   -When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. +When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. **Note**   -It is recommended that you use the App-V sequencer for converting critical applications or applications that need to take advantage of features. See, [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). +It is recommended that you use the App-V sequencer for converting critical applications or applications that need to take advantage of features. See [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V sequencer. -  - [How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md) -## Migrating Clients - - -The following table displays the recommended method for upgrading clients. - - ---- - - - - - - - - - - - - - - - - -
    TaskMore Information

    Upgrade your environment to the latest version of App-V 4.6

    [Application Virtualization Deployment and Upgrade Considerations](https://technet.microsoft.com/en-us/itpro/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy).

    Sequence and roll out App-V packages. As needed, unpublish App-V 4.6 packages.

    [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md).

    - -  - -**Important**   -You must be running the latest version of App-V 4.6 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section. - -  - ## Migrating the App-V Server Full Infrastructure @@ -270,20 +228,20 @@ There is no direct method to upgrade to a full App-V infrastructure. Use the inf -

    Upgrade your environment to the latest version of App-V 4.6.

    -

    [Application Virtualization Deployment and Upgrade Considerations](https://technet.microsoft.com/en-us/itpro/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy).

    +

    Review prerequisites.

    +

    [App-V Server prerequisite software](appv-prerequisites.md#app-v-server-prerequisite-software).

    -

    Deploy App-V version of the client.

    +

    Enable the App-V client.

    [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).

    -

    Install App-V server.

    +

    Install App-V Server.

    [How to Deploy the App-V Server](appv-deploy-the-appv-server.md).

    Migrate existing packages.

    -

    See the Converting packages created using a prior version of App-V section of this article.

    +

    See [Converting packages created using a prior version of App-V](#converting-packages-created-using-a-prior-version-of-app-v) earlier in this topic.

    @@ -291,10 +249,10 @@ There is no direct method to upgrade to a full App-V infrastructure. Use the inf ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other resources for performing App-V migration tasks - [Operations for App-V](appv-operations.md) -- [A simplified Microsoft App-V Management Server upgrade procedure](http://go.microsoft.com/fwlink/p/?LinkId=786330) +- [A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://blogs.technet.microsoft.com/appv/2015/09/23/a-simplified-microsoft-app-v-5-1-management-server-upgrade-procedure/) diff --git a/windows/manage/appv-modify-an-existing-virtual-application-package.md b/windows/manage/appv-modify-an-existing-virtual-application-package.md index b3b9a5bea2..5c84ac6d8d 100644 --- a/windows/manage/appv-modify-an-existing-virtual-application-package.md +++ b/windows/manage/appv-modify-an-existing-virtual-application-package.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to Modify an Existing Virtual Application Package +**Applies to** +- Windows 10, version 1607 This topic explains how to: @@ -161,18 +163,10 @@ This topic explains how to: 13. On the **Completion** page, click **Close**. The package is now available in the sequencer. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-modify-client-configuration-with-powershell.md b/windows/manage/appv-modify-client-configuration-with-powershell.md index 0d76bd1169..ef256839b0 100644 --- a/windows/manage/appv-modify-client-configuration-with-powershell.md +++ b/windows/manage/appv-modify-client-configuration-with-powershell.md @@ -1,6 +1,6 @@ --- -title: How to Modify Client Configuration by Using PowerShell (Windows 10) -description: How to Modify Client Configuration by Using PowerShell +title: How to Modify Client Configuration by Using Windows PowerShell (Windows 10) +description: How to Modify Client Configuration by Using Windows PowerShell author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,16 +9,16 @@ ms.prod: w10 --- -# How to Modify Client Configuration by Using PowerShell +# How to Modify Client Configuration by Using Windows PowerShell +**Applies to** +- Windows 10, version 1607 Use the following procedure to configure the App-V client configuration. -**To modify App-V client configuration using PowerShell** +1. To configure the client settings using Windows PowerShell, use the **Set-AppvClientConfiguration** cmdlet. For more information about installing Windows PowerShell, and a list of cmdlets see, [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md). -1. To configure the client settings using PowerShell, use the **Set-AppvClientConfiguration** cmdlet. For more information about installing PowerShell, and a list of cmdlets see, [How to Load the PowerShell Cmdlets and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md). - -2. To modify the client configuration, open a PowerShell Command prompt and run the following cmdlet **Set-AppvClientConfiguration** with any required parameters. For example: +2. To modify the client configuration, open a Windows PowerShell Command prompt and run **Set-AppvClientConfiguration** with any required parameters. For example: `$config = Get-AppvClientConfiguration` @@ -26,18 +26,11 @@ Use the following procedure to configure the App-V client configuration. `Set-AppcClientConfiguration –Name1 MyConfig –Name2 “xyz”` - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). + +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md b/windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md index a71950444f..5d1058e257 100644 --- a/windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md +++ b/windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md @@ -1,23 +1,4 @@ --- title: How to Modify App-V Client Configuration Using the ADMX Template and Group Policy (Windows 10) -description: How to Modify App-V Client Configuration Using the ADMX Template and Group Policy -author: MaggiePucciEvans -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client --- - -# How to Modify App-V client configuration using the ADMX template and Group Policy - -You can use Group Policy to configure App-V client settings by using the Group Policy Management Console under **Computer Configuration** > **Policies** > **Administrative Templates** > **System** > **App-V**. - -## Have a suggestion for App-V? - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related topics - -- [Deploying App-V](appv-deploying-appv.md) - -- [About Client Configuration Settings](appv-client-configuration-settings.md) diff --git a/windows/manage/appv-move-the-appv-server-to-another-computer.md b/windows/manage/appv-move-the-appv-server-to-another-computer.md index dbbb6a80a6..f883d31e98 100644 --- a/windows/manage/appv-move-the-appv-server-to-another-computer.md +++ b/windows/manage/appv-move-the-appv-server-to-another-computer.md @@ -9,32 +9,26 @@ ms.prod: w10 --- -# How to Move the App-V Server to Another Computer +# How to move the App-V server to another computer +**Applies to** +- Windows Server 2016 Use the following information to create a new management server console in your environment. ## To create a new management server console -The following list displays the steps necessary to create a new management server console: +Follow these steps to create a new management server console: -1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V Server](appv-deploying-the-appv-server.md). +1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V server](appv-deploying-the-appv-server.md). 2. After you have completed the installation, use the following link to connect it to the App-V database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md). -**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-operations.md b/windows/manage/appv-operations.md index 96cdf448fb..d8fe8b05e6 100644 --- a/windows/manage/appv-operations.md +++ b/windows/manage/appv-operations.md @@ -11,6 +11,8 @@ ms.prod: w10 # Operations for App-V +**Applies to** +- Windows 10, version 1607 This section of the Microsoft Application Virtualization (App-V) Administrator’s Guide includes information about the various types of App-V administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. @@ -41,14 +43,14 @@ This section of the Microsoft Application Virtualization (App-V) Administrator Provides instructions for migrating to App-V from a previous version. -- [Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md) +- [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md) Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V server tasks. ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Other Resources for App-V Operations diff --git a/windows/manage/appv-performance-guidance.md b/windows/manage/appv-performance-guidance.md index d5e0a70918..e0a277bf9c 100644 --- a/windows/manage/appv-performance-guidance.md +++ b/windows/manage/appv-performance-guidance.md @@ -11,6 +11,8 @@ ms.prod: w10 # Performance Guidance for Application Virtualization +**Applies to** +- Windows 10, version 1607 Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. @@ -20,14 +22,12 @@ You should read and understand the following information before reading this doc - [Application Virtualization (App-V) overview](appv-for-windows.md) -- [App-V 5 SP2 Application Publishing and Client Interaction](http://go.microsoft.com/fwlink/?LinkId=395206) +- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) -- [Microsoft Application Virtualization Sequencing Guide](http://go.microsoft.com/fwlink/?LinkId=269953) +- [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760) **Note**   -Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. - -  +Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk * review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. Finally, this document will provide you with the information to configure the computer running App-V client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). @@ -35,7 +35,6 @@ To help determine what information is relevant to your environment you should re ## App-V in stateful\* non-persistent deployments - This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. A number of conditions must be met and steps followed to provide the optimal user experience. Use the information in the following section for more information: @@ -50,7 +49,7 @@ Use the information in the following section for more information: - Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. -- Use UE-V 2.1 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. +- Use UE-V as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. [User Experience Walk-through](#bkmk-uewt) @@ -123,7 +122,7 @@ IT Administration   -### Usage Scenario +### Usage Scenarios As you review the two scenarios, keep in mind that these approach the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. @@ -141,9 +140,9 @@ As you review the two scenarios, keep in mind that these approach the extremes.

    To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.

    -

    The following describes many performance improvements in stateful non-persistent deployments. For more information, see the Sequencing Steps to Optimize Packages for Publishing Performance and reference to App-V Sequencing Guide in the See Also section of this document.

    +

    The following describes many performance improvements in stateful non-persistent deployments. For more information, see [Sequencing Steps to Optimize Packages for Publishing Performance](#sequencing-steps-to-optimize-packages-for-publishing-performance) later in this topic.

    The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.

    -

    The impact of this alteration is detailed in the User Experience Walkthrough section of this document.

    +

    The impact of this alteration is detailed in the [User Experience Walk-through](#bkmk-uewt) section of this document.

    @@ -171,9 +170,9 @@ The following table displays the required steps to prepare the base image and th

      -

    • Install the App-V client version of the client.

      • -

    • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

      • -

    • Configure for Shared Content Store (SCS) mode. For more information see [How to Install the App-V Client for Shared Content Store Mode](appv-install-the-appv-client-for-shared-content-store-mode.md).

      • +

    • Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).

      • +

    • Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

      • +

    • Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).

    • Configure Preserve User Integrations on Login Registry DWORD.

    • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.

    • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.

      • @@ -191,9 +190,9 @@ The following table displays the required steps to prepare the base image and th

      -

    • Install the App-V client version of the client.

      • -

    • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

      • -

    • Configure for Shared Content Store (SCS) mode. For more information see [How to Install the App-V Client for Shared Content Store Mode](appv-install-the-appv-client-for-shared-content-store-mode.md).

      • +

    • Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).

      • +

    • Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

      • +

    • Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).

    • Configure Preserve User Integrations on Login Registry DWORD.

    • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.

    • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.

      • @@ -225,8 +224,7 @@ The following table displays the required steps to prepare the base image and th

      Shared Content Store (SCS) Mode

        -

      • Configurable in PowerShell using Set- AppvClientConfiguration –SharedContentStoreMode, or

        • -

      • During installation of the App-V client.

        • +

      • Configurable in Windows PowerShell with `Set-AppvClientConfiguration -SharedContentStoreMode 1`
        or configurable with Group Policy, as described in [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).

      When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).

      This helps to conserve local storage and minimize disk I/O per second (IOPS).

      @@ -246,7 +244,7 @@ The following table displays the required steps to prepare the base image and th

      MaxConcurrentPublishingRefresh

        -

      • Configure in the Registry under HKEY_LOCAL_MACHINE \Software \ Microsoft \ AppV \Client \ Publishing.

        • +

      • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Publishing.

      • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.

      • The App-V client service and computer do not need to be restarted.

      @@ -261,23 +259,25 @@ The following table displays the required steps to prepare the base image and th ### Configure UE-V solution for App-V Approach -We recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. +We recommend using User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. -For more information see [Getting Started With User Experience Virtualization 2.0](https://technet.microsoft.com/library/dn458926.aspx) +For more information, see: -In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](http://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458926.aspx). +- [User Experience Virtualization (UE-V) for Windows 10 overview](uev-for-windows.md) + +- [Get Started with UE-V](uev-getting-started.md) + +In essence all that is required is to enable the UE-V service and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](http://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information about UE-V templates, see [User Experience Virtualization (UE-V) for Windows 10 overview](uev-for-windows.md). **Note**   -Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. +Without performing an additional configuration step, User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. -UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following 2 scenarios, because the net result will be that the shortcut will be valid on one but not all devices. +UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following two scenarios, because the net result will be that the shortcut will be valid on one but not all devices. - If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. - If a user has an application installed on one device but not another with .lnk files enabled. -  - **Important**   This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. @@ -285,7 +285,7 @@ This topic describes how to change the Windows registry by using Registry Editor Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types. -**Configure other User Profile Management (UPM) solution for App-V Approach** +## Configure other User Profile Management (UPM) solutions for App-V Approach The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. @@ -310,9 +310,9 @@ To enable an optimized login experience, for example the App-V approach for the With App-V when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during log on and/or after a specified refresh interval. In both cases a scheduled task is created. -In previous versions of App-V, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. With Hotfix Package 4 for Application Virtualization 5.0 SP2 the user refresh on log on was initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process delays the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. +In previous versions of App-V, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. Starting with Hotfix Package 4 for Application Virtualization 5.0 SP2 the user refresh on log on was initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process delays the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. -**User Integrations** +### User Integrations Registry – HKEY\_CURRENT\_USER @@ -324,7 +324,7 @@ Registry – HKEY\_CURRENT\_USER - Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths -**File Locations** +### File Locations - Root – “Environment Variable” APPDATA @@ -342,12 +342,6 @@ Registry – HKEY\_CURRENT\_USER Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk -**Microsoft User Experience Virtualization (UE-V)** - -Additionally, we recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -For more information see [Getting Started With User Experience Virtualization 1.0](http://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](http://technet.microsoft.com/library/jj679972.aspx). - ### User Experience Walk-through This following is a step-by-step walk-through of the App-V and UPM operations and the expectations users should expect. @@ -446,13 +440,11 @@ In a non-persistent environment, it is unlikely these pended operations will be The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. -**.NET NGEN Blog and Script (Highly Recommended)** + -About NGEN technology +**.NET NGEN Blog (Highly Recommended)** -- [How to speed up NGEN optimaztion](http://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) - -- [Script](http://aka.ms/DrainNGenQueue) +- [How to speed up NGEN optimization](http://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) **Windows Server and Server Roles** @@ -486,7 +478,6 @@ Server Performance Tuning Guidelines for ## Sequencing Steps to Optimize Packages for Publishing Performance - Several App-V features facilitate new scenarios or enable new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. @@ -507,7 +498,7 @@ Several App-V features facilitate new scenarios or enable new customer deploymen - - + diff --git a/windows/manage/configure-devices-without-mdm.md b/windows/manage/configure-devices-without-mdm.md index 175c61bf6e..b28734a5f6 100644 --- a/windows/manage/configure-devices-without-mdm.md +++ b/windows/manage/configure-devices-without-mdm.md @@ -71,7 +71,7 @@ Provisioning packages are simple for employees to install. And when they remove   -For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( http://go.microsoft.com/fwlink/p/?LinkId=619012). +For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). ## Create a provisioning package @@ -125,7 +125,7 @@ When you run Windows ICD, you have several options for creating your package. 3. Name your project, and click **Next**. 4. Choose **All Windows editions**, **All Windows desktop editions**, or **All Windows mobile editions**, depending on the devices you intend to provision, and click **Next**. 5. On **New project**, click **Finish**. The workspace for your package opens. -6. Configure settings. [Learn more about specific settings in provisioning packages.]( http://go.microsoft.com/fwlink/p/?LinkId=615916) +6. Configure settings. [Learn more about specific settings in provisioning packages.]( https://go.microsoft.com/fwlink/p/?LinkId=615916) 7. On the **File** menu, select **Save.** 8. On the **Export** menu, select **Provisioning package**. 9. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** @@ -155,7 +155,7 @@ When you run Windows ICD, you have several options for creating your package. - Email - USB tether (mobile only) -Learn more: [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkID=629651) +Learn more: [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkID=629651) ## Apply package @@ -186,9 +186,9 @@ On a mobile device, the employee goes to **Settings** > **Accounts** > **P ## Learn more -- [Provisioning Windows 10 Devices with New Tools](http://go.microsoft.com/fwlink/p/?LinkId=615921) +- [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) -- [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](http://go.microsoft.com/fwlink/p/?LinkId=615922) +- [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)   diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 377c8066cf..8a9777af29 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -1,1259 +1,4 @@ --- title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10) redirect_url: https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services ---- - -# Configure Windows 10 devices to stop data flow to Microsoft - -**Applies to** - -- Windows 10 - -If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). - -Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro. - -If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. - -Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, and the July release of Windows 10. However, you must use Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511 to manage them all. - -In Windows 10 Enterprise, version 1511 or Windows 10 Education, version 1511, you can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. - -We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization. - -Here's what's covered in this article: - -- [Info management settings](#bkmk-othersettings) - - - [1. Cortana](#bkmk-cortana) - - - [1.1 Cortana Group Policies](#bkmk-cortana-gp) - - - [1.2 Cortana MDM policies](#bkmk-cortana-mdm) - - - [1.3 Cortana Windows Provisioning](#bkmk-cortana-prov) - - - [2. Date & Time](#bkmk-datetime) - - - [3. Device metadata retrieval](#bkmk-devinst) - - - [4. Font streaming](#font-streaming) - - - [5. Insider Preview builds](#bkmk-previewbuilds) - - - [6. Internet Explorer](#bkmk-ie) - - - [6.1 Internet Explorer Group Policies](#bkmk-ie-gp) - - - [6.2 ActiveX control blocking](#bkmk-ie-activex) - - - [7. Live Tiles](#live-tiles) - - - [8. Mail synchronization](#bkmk-mailsync) - - - [9. Microsoft Edge](#bkmk-edge) - - - [9.1 Microsoft Edge Group Policies](#bkmk-edgegp) - - - [9.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) - - - [9.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) - - - [10. Network Connection Status Indicator](#bkmk-ncsi) - - - [11. Offline maps](#bkmk-offlinemaps) - - - [12. OneDrive](#bkmk-onedrive) - - - [13. Preinstalled apps](#bkmk-preinstalledapps) - - - [14. Settings > Privacy](#bkmk-settingssection) - - - [14.1 General](#bkmk-priv-general) - - - [14.2 Location](#bkmk-priv-location) - - - [14.3 Camera](#bkmk-priv-camera) - - - [14.4 Microphone](#bkmk-priv-microphone) - - - [14.5 Speech, inking, & typing](#bkmk-priv-speech) - - - [14.6 Account info](#bkmk-priv-accounts) - - - [14.7 Contacts](#bkmk-priv-contacts) - - - [14.8 Calendar](#bkmk-priv-calendar) - - - [14.9 Call history](#bkmk-priv-callhistory) - - - [14.10 Email](#bkmk-priv-email) - - - [14.11 Messaging](#bkmk-priv-messaging) - - - [14.12 Radios](#bkmk-priv-radios) - - - [14.13 Other devices](#bkmk-priv-other-devices) - - - [14.14 Feedback & diagnostics](#bkmk-priv-feedback) - - - [14.15 Background apps](#bkmk-priv-background) - - - [15. Software Protection Platform](#bkmk-spp) - - - [16. Sync your settings](#bkmk-syncsettings) - - - [17. Teredo](#bkmk-teredo) - - - [18. Wi-Fi Sense](#bkmk-wifisense) - - - [19. Windows Defender](#bkmk-defender) - - - [20. Windows Media Player](#bkmk-wmp) - - - [21. Windows spotlight](#bkmk-spotlight) - - - [22. Windows Store](#bkmk-windowsstore) - - - [23. Windows Update Delivery Optimization](#bkmk-updates) - - - [23.1 Settings > Update & security](#bkmk-wudo-ui) - - - [23.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) - - - [23.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) - - - [23.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) - - - [24. Windows Update](#bkmk-wu) - -## What's new in Windows 10, version 1511 - - -Here's a list of changes that were made to this article for Windows 10, version 1511: - -- Added the following new sections: - - - [Mail synchronization](#bkmk-mailsync) - - - [Offline maps](#bkmk-offlinemaps) - - - [Windows spotlight](#bkmk-spotlight) - - - [Windows Store](#bkmk-windowsstore) - -- Added the following Group Policies: - - - Open a new tab with an empty tab - - - Configure corporate Home pages - - - Let Windows apps access location - - - Let Windows apps access the camera - - - Let Windows apps access the microphone - - - Let Windows apps access account information - - - Let Windows apps access contacts - - - Let Windows apps access the calendar - - - Let Windows apps access messaging - - - Let Windows apps control radios - - - Let Windows apps access trusted devices - - - Do not show feedback notifications - - - Turn off Automatic Download and Update of Map Data - - - Force a specific default lock screen image - -- Added the AllowLinguisticDataCollection MDM policy. - -- Added steps in the [Cortana](#bkmk-cortana) section on how to disable outbound traffic using Windows Firewall. - -- Changed the Windows Update section to apply system-wide settings, and not just per user. - -## Info management settings - - -This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. - -The settings in this section assume you are using Windows 10, version 1511 (currently available in the Current Branch and Current Branch for Business). They will also be included in the next update for the Long Term Servicing Branch. - -- [1. Cortana](#bkmk-cortana) - -- [2. Date & Time](#bkmk-datetime) - -- [3. Device metadata retrieval](#bkmk-devinst) - -- [4. Font streaming](#font-streaming) - -- [5. Insider Preview builds](#bkmk-previewbuilds) - -- [6. Internet Explorer](#bkmk-ie) - -- [7. Live Tiles](#live-tiles) - -- [8. Mail synchronization](#bkmk-mailsync) - -- [9. Microsoft Edge](#bkmk-edge) - -- [10. Network Connection Status Indicator](#bkmk-ncsi) - -- [11. Offline maps](#bkmk-offlinemaps) - -- [12. OneDrive](#bkmk-onedrive) - -- [13. Preinstalled apps](#bkmk-preinstalledapps) - -- [14. Settings > Privacy](#bkmk-settingssection) - -- [15. Software Protection Platform](#bkmk-spp) - -- [16. Sync your settings](#bkmk-syncsettings) - -- [17. Teredo](#bkmk-teredo) - -- [18. Wi-Fi Sense](#bkmk-wifisense) - -- [19. Windows Defender](#bkmk-defender) - -- [20. Windows Media Player](#bkmk-wmp) - -- [21. Windows spotlight](#bkmk-spotlight) - -- [22. Windows Store](#bkmk-windowsstore) - -- [23. Windows Update Delivery Optimization](#bkmk-updates) - -- [24. Windows Update](#bkmk-wu) - - -See the following table for a summary of the management settings. For more info, see its corresponding section. - -![Management settings table](images/settings-table.png) - -### 1. Cortana - -Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730683). - -### 1.1 Cortana Group Policies - -Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. - -| Policy | Description | -|------------------------------------------------------|---------------------------------------------------------------------------------------| -| Allow Cortana | Choose whether to let Cortana install and run on the device. | -| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | -| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
      Default: Disabled| -| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | -| Set what information is shared in Search | Control what information is shared with Bing in Search. | - -When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. - -1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. - -2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. - -3. On the **Rule Type** page, click **Program**, and then click **Next**. - -4. On the **Program** page, click **This program path**, type **%windir%\\systemapps\\Microsoft.Windows.Cortana\_cw5n1h2txyewy\\SearchUI.exe**, and then click **Next**. - -5. On the **Action** page, click **Block the connection**, and then click **Next**. - -6. On the **Profile** page, ensure that the **Domain**, **Private**, and **Public** check boxes are selected, and then click **Next**. - -7. On the **Name** page, type a name for the rule, such as **Cortana firewall configuration**, and then click **Finish.** - -8. Right-click the new rule, click **Properties**, and then click **Protocols and Ports**. - -9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. - - - For **Protocol type**, choose **TCP**. - - - For **Local port**, choose **All Ports**. - - - For **Remote port**, choose **All ports**. - -> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. - -### 1.2 Cortana MDM policies - -The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | -| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
      Default: Allowed| - -### 1.3 Cortana Windows Provisioning - -To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**. - -### 2. Date & Time - -You can prevent Windows from setting the time automatically. - -- To turn off the feature in the UI: **Settings** > **Time & language** > **Date & time** > **Set time automatically** - - -or- - -- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters** with a value of **NoSync**. - -### 3. Device metadata retrieval - -To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. - -### 4. Font streaming - -Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. - -To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. - -> **Note:** This may change in future versions of Windows. - -### 5. Insider Preview builds - -To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. - -- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Stop Insider builds**. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. - - -or- - -- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: - - - **0**. Users cannot make their devices available for downloading and installing preview software. - - - **1**. Users can make their devices available for downloading and installing preview software. - - - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. - - -or- - -- Create a provisioning package: **Runtime settings** > **Policies** > **System** > **AllowBuildPreview**, where: - - - **0**. Users cannot make their devices available for downloading and installing preview software. - - - **1**. Users can make their devices available for downloading and installing preview software. - - - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. - -### 6. Internet Explorer - -Use Group Policy to manage settings for Internet Explorer. - -### 6.1 Internet Explorer Group Policies - -Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
      Default: Enabled
      You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| -| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
      Default: Enabled| -| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
      Default: Disabled
      You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| -| Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
      Default: Enabled | -| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
      Default: Disabled| - -### 6.2 ActiveX control blocking - -ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). - -For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). - -### 7. Live Tiles - -To turn off Live Tiles: - -- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** - -### 8. Mail synchronization - -To turn off mail synchronization for Microsoft Accounts that are configured on a device: - -- In **Settings** > **Accounts** > **Your email and accounts**, remove any connected Microsoft Accounts. - - -or- - -- Remove any Microsoft Accounts from the Mail app. - - -or- - -- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device. - -To turn off the Windows Mail app: - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** - -### 9. Microsoft Edge - -Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). - -### 9.1 Microsoft Edge Group Policies - -Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. - -> **Note:** The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Turn off autofill | Choose whether employees can use autofill on websites.
      Default: Enabled | -| Allow employees to send Do Not Track headers | Choose whether employees can send Do Not Track headers.
      Default: Disabled | -| Turn off password manager | Choose whether employees can save passwords locally on their devices.
      Default: Enabled | -| Turn off address bar search suggestions | Choose whether the address bar shows search suggestions.
      Default: Enabled | -| Turn off the SmartScreen Filter | Choose whether SmartScreen is turned on or off.
      Default: Enabled | -| Open a new tab with an empty tab | Choose whether a new tab page appears.
      Default: Enabled | -| Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
      Set this to **about:blank** | - -### 9.2 Microsoft Edge MDM policies - -The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - -| Policy | Description | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Browser/AllowAutoFill | Choose whether employees can use autofill on websites.
      Default: Allowed | -| Browser/AllowDoNotTrack | Choose whether employees can send Do Not Track headers.
      Default: Not allowed | -| Browser/AllowPasswordManager | Choose whether employees can save passwords locally on their devices.
      Default: Allowed | -| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
      Default: Allowed | -| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
      Default: Allowed | - -### 9.3 Microsoft Edge Windows Provisioning - -Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. - -For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). - -### 10. Network Connection Status Indicator - -Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). - -You can turn off NCSI through Group Policy: - -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** - -> **Note** After you apply this policy, you must restart the device for the policy setting to take effect. - -### 11. Offline maps - -You can turn off the ability to download and update offline maps. - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** - -### 12. OneDrive - -To turn off OneDrive in your organization: - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** - -### 13. Preinstalled apps - -Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. - -To remove the News app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingNews | Remove-AppxPackage** - -To remove the Weather app: - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingWeather"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingWeather | Remove-AppxPackage** - -To remove the Money app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingFinance"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingFinance | Remove-AppxPackage** - -To remove the Sports app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingSports"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingSports | Remove-AppxPackage** - -To remove the Twitter app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "\*.Twitter"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage \*.Twitter | Remove-AppxPackage** - -To remove the XBOX app: - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.XboxApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.XboxApp | Remove-AppxPackage** - -To remove the Sway app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.Sway"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.Sway | Remove-AppxPackage** - -To remove the OneNote app: - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.Office.OneNote"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.OneNote | Remove-AppxPackage** - -To remove the Get Office app: - -- Right-click the app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.MicrosoftOfficeHub"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftOfficeHub | Remove-AppxPackage** - -To remove the Get Skype app: - -- Right-click the Sports app in Start, and then click **Uninstall**. - - -or- - -- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.SkypeApp"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** - - -and- - - Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** - -### 14. Settings > Privacy - -Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. - -- [14.1 General](#bkmk-general) - -- [14.2 Location](#bkmk-priv-location) - -- [14.3 Camera](#bkmk-priv-camera) - -- [14.4 Microphone](#bkmk-priv-microphone) - -- [14.5 Speech, inking, & typing](#bkmk-priv-speech) - -- [14.6 Account info](#bkmk-priv-accounts) - -- [14.7 Contacts](#bkmk-priv-contacts) - -- [14.8 Calendar](#bkmk-priv-calendar) - -- [14.9 Call history](#bkmk-priv-callhistory) - -- [14.10 Email](#bkmk-priv-email) - -- [14.11 Messaging](#bkmk-priv-messaging) - -- [14.12 Radios](#bkmk-priv-radios) - -- [14.13 Other devices](#bkmk-priv-other-devices) - -- [14.14 Feedback & diagnostics](#bkmk-priv-feedback) - -- [14.15 Background apps](#bkmk-priv-background) - -### 14.1 General - -**General** includes options that don't fall into other areas. - -To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: - -> **Note:** When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. - - -or- - -- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). - -To turn off **Turn on SmartScreen Filter to check web content (URLs) that Windows Store apps use**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Turn off the SmartScreen Filter**. - - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. - - -or- - -- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. - - -or- - -- Create a provisioning package, using: - - - For Internet Explorer: **Runtime settings** > **Policies** > **Browser** > **AllowSmartScreen** - - - For Microsoft Edge: **Runtime settings** > **Policies** > **MicrosoftEdge** > **AllowSmartScreen** - - -or- - -- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation**, with a value of 0 (zero). - -To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: - -> **Note: ** If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. - - - -- Turn off the feature in the UI. - - -or- - -- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: - - - **0**. Not allowed - - - **1**. Allowed (default) - -To turn off **Let websites provide locally relevant content by accessing my language list**: - -- Turn off the feature in the UI. - - -or- - -- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. - -### 14.2 Location - -In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. - -To turn off **Location for this device**: - -- Click the **Change** button in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. - - -or- - -- Apply the System/AllowLocation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Turned off and the employee can't turn it back on. - - - **1**. Turned on, but lets the employee choose whether to use it. (default) - - - **2**. Turned on and the employee can't turn it off. - - **Note** - You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). - - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where - - - **No**. Turns off location service. - - - **Yes**. Turns on location service. (default) - -To turn off **Location**: - -- Turn off the feature in the UI. - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** - - - Set the **Select a setting** box to **Force Deny**. - - -or- - -To turn off **Location history**: - -- Erase the history using the **Clear** button in the UI. - -To turn off **Choose apps that can use your location**: - -- Turn off each app using the UI. - -### 14.3 Camera - -In the **Camera** area, you can choose which apps can access a device's camera. - -To turn off **Let apps use my camera**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the camera** - - - Set the **Select a setting** box to **Force Deny**. - - -or- - -- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Apps can't use the camera. - - - **1**. Apps can use the camera. - - **Note** - You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx). - - -or- - -- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where: - - - **0**. Apps can't use the camera. - - - **1**. Apps can use the camera. - -To turn off **Choose apps that can use your camera**: - -- Turn off the feature in the UI for each app. - -### 14.4 Microphone - -In the **Microphone** area, you can choose which apps can access a device's microphone. - -To turn off **Let apps use my microphone**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the microphone** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can use your microphone**: - -- Turn off the feature in the UI for each app. - -### 14.5 Speech, inking, & typing - -In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. - -> **Note:** For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. - - - -To turn off the functionality: - -- Click the **Stop getting to know me** button, and then click **Turn off**. - - -or- - -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** - - -or- - -- Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero). - - -and- - - Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). - -### 14.6 Account info - -In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. - -To turn off **Let apps access my name, picture, and other account info**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose the apps that can access your account info**: - -- Turn off the feature in the UI for each app. - -### 14.7 Contacts - -In the **Contacts** area, you can choose which apps can access an employee's contacts list. - -To turn off **Choose apps that can access contacts**: - -- Turn off the feature in the UI for each app. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.8 Calendar - -In the **Calendar** area, you can choose which apps have access to an employee's calendar. - -To turn off **Let apps access my calendar**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can access calendar**: - -- Turn off the feature in the UI for each app. - -### 14.9 Call history - -In the **Call history** area, you can choose which apps have access to an employee's call history. - -To turn off **Let apps access my call history**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access call history** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.10 Email - -In the **Email** area, you can choose which apps have can access and send email. - -To turn off **Let apps access and send email**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access email** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.11 Messaging - -In the **Messaging** area, you can choose which apps can read or send messages. - -To turn off **Let apps read or send messages (text or MMS)**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access messaging** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can read or send messages**: - -- Turn off the feature in the UI for each app. - -### 14.12 Radios - -In the **Radios** area, you can choose which apps can turn a device's radio on or off. - -To turn off **Let apps control radios**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios** - - - Set the **Select a setting** box to **Force Deny**. - -To turn off **Choose apps that can control radios**: - -- Turn off the feature in the UI for each app. - -### 14.13 Other devices - -In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. - -To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**: - -- Turn off the feature in the UI. - -To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: - -- Turn off the feature in the UI. - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** - - - Set the **Select a setting** box to **Force Deny**. - -### 14.14 Feedback & diagnostics - -In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. - -To change how frequently **Windows should ask for my feedback**: - -**Note** -Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. - - - -- To change from **Automatically (Recommended)**, use the drop-down list in the UI. - - -or- - -- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications** - - -or- - -- Create the registry keys (REG\_DWORD type): - - - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds - - - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod - - Based on these settings: - - | Setting | PeriodInNanoSeconds | NumberOfSIUFInPeriod | - |---------------|-----------------------------|-----------------------------| - | Automatically | Delete the registry setting | Delete the registry setting | - | Never | 0 | 0 | - | Always | 100000000 | Delete the registry setting | - | Once a day | 864000000000 | 1 | - | Once a week | 6048000000000 | 1 | - - - -To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: - -- To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. - - > **Note:** You can't use the UI to change the telemetry level to **Security**. - - - - -or- - -- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** - - -or- - -- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Maps to the **Security** level. - - - **1**. Maps to the **Basic** level. - - - **2**. Maps to the **Enhanced** level. - - - **3**. Maps to the **Full** level. - - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where: - - - **0**. Maps to the **Security** level. - - - **1**. Maps to the **Basic** level. - - - **2**. Maps to the **Enhanced** level. - - - **3**. Maps to the **Full** level. - -### 14.15 Background apps - -In the **Background Apps** area, you can choose which apps can run in the background. - -To turn off **Let apps run in the background**: - -- Turn off the feature in the UI for each app. - -### 15. Software Protection Platform - -Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy: - -**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation** - -The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. - -### 16. Sync your settings - -You can control if your settings are synchronized: - -- In the UI: **Settings** > **Accounts** > **Sync your settings** - - -or- - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync** - - -or- - -- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. - - -or- - -- Create a provisioning package, using **Runtime settings** > **Policies** > **Experience** > **AllowSyncMySettings**, where - - - **No**. Settings are not synchronized. - - - **Yes**. Settings are synchronized. (default) - -To turn off Messaging cloud sync: - -- Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). - -### 17. Teredo - -You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). - -- From an elevated command prompt, run **netsh interface teredo set state disabled** - -### 18. Wi-Fi Sense - -Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. - -To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**: - -- Turn off the feature in the UI. - - -or- - -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**. - - -or- - -- Create a new REG\_DWORD registry setting called **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config**, with a value of 0 (zero). - - -or- - -- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). - - -or- - -- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). - -When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. - -### 19. Windows Defender - -You can opt out of the Microsoft Antimalware Protection Service. - -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** - - -or- - -- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - - -or- - -- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). - - -and- - - From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0** - -You can stop sending file samples back to Microsoft. - -- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. - - -or- - -- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Always prompt. - - - **1**. (default) Send safe samples automatically. - - - **2**. Never send. - - - **3**. Send all samples automatically. - - -or- - -- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to 0 (zero) to always prompt or 2 to never send. - -You can stop downloading definition updates: - -- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. - - -and- - -- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. - -You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. - -### 20. Windows Media Player - -To remove Windows Media Player: - -- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. - - -or- - -- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** - -### 21. Windows spotlight - -Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy. - -- Configure the following in **Settings**: - - - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Show me tips, tricks, and more on the lock screen**. - - - **Personalization** > **Start** > **Occasionally show suggestions in Start**. - - - **System** > **Notifications & actions** > **Show me tips about Windows**. - - -or- - -- Apply the Group Policies: - - - **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**. - - Add a location in the **Path to local lock screen image** box. - - - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. - - **Note** This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. - - - - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows Tips**. - - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. - -For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md). - -### 22. Windows Store - -You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. - -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. - -### 23. Windows Update Delivery Optimization - -Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. - -By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. - -Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization. - -### 23.1 Settings > Update & security - -You can set up Delivery Optimization from the **Settings** UI. - -- Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. - -### 23.2 Delivery Optimization Group Policies - -You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. - -| Policy | Description | -|---------------------------|-----------------------------------------------------------------------------------------------------| -| Download Mode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

      • None. Turns off Delivery Optimization.

      • Group. Gets or sends updates and apps to PCs on the same local network domain.

      • Internet. Gets or sends updates and apps to PCs on the Internet.

      • LAN. Gets or sends updates and apps to PCs on the same NAT only.

      | -| Group ID | Lets you provide a Group ID that limits which PCs can share apps and updates.
      ** Note** This ID must be a GUID.| -| Max Cache Age | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
      The default value is 259200 seconds (3 days).| -| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
      The default value is 20, which represents 20% of the disk.| -| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
      The default value is 0, which means unlimited possible bandwidth.| - -### 23.3 Delivery Optimization MDM policies - -The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - -| Policy | Description | -|---------------------------|-----------------------------------------------------------------------------------------------------| -| DeliveryOptimization/DODownloadMode | Lets you choose where Delivery Optimization gets or sends updates and apps, including

      • 0. Turns off Delivery Optimization.

      • 1. Gets or sends updates and apps to PCs on the same NAT only.

      • 2. Gets or sends updates and apps to PCs on the same local network domain.

      • 3. Gets or sends updates and apps to PCs on the Internet.

      | -| DeliveryOptimization/DOGroupID | Lets you provide a Group ID that limits which PCs can share apps and updates.
      ** Note** This ID must be a GUID.| -| DeliveryOptimization/DOMaxCacheAge | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache.
      The default value is 259200 seconds (3 days).| -| DeliveryOptimization/DOMaxCacheSize | Lets you specify the maximum cache size as a percentage of disk size.
      The default value is 20, which represents 20% of the disk.| -| DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
      The default value is 0, which means unlimited possible bandwidth.| - - -### 23.4 Delivery Optimization Windows Provisioning - -If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies - -Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. - -1. Open Windows ICD, and then click **New provisioning package**. - -2. In the **Name** box, type a name for the provisioning package, and then click **Next.** - -3. Click the **Common to all Windows editions** option, click **Next**, and then click **Finish**. - -4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. - -For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). - -### 24. Windows Update - -You can turn off Windows Update by setting the following registry entries: - -- Add a REG\_DWORD value called **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. - - -and- - -- Add a REG\_DWORD value called **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1. - -You can turn off automatic updates by doing one of the following. This is not recommended. - -- Add a REG\_DWORD value called **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5. - - -or- - -- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - - - **0**. Notify the user before downloading the update. - - - **1**. Auto install the update and then notify the user to schedule a device restart. - - - **2** (default). Auto install and restart. - - - **3**. Auto install and restart at a specified time. - - - **4**. Auto install and restart without end-user control. - - - **5**. Turn off automatic updates. - -To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). +--- \ No newline at end of file diff --git a/windows/manage/configure-windows-10-taskbar.md b/windows/manage/configure-windows-10-taskbar.md index b96590c3b1..8f9c046ff2 100644 --- a/windows/manage/configure-windows-10-taskbar.md +++ b/windows/manage/configure-windows-10-taskbar.md @@ -6,7 +6,7 @@ ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Configure Windows 10 taskbar @@ -15,7 +15,7 @@ Starting in Windows 10, version 1607, administrators can pin additional apps to > [!NOTE] > The only aspect of the taskbar that can currently be configured by the layout modification XML file is the layout. -You can specify different taskbar configurations based on device locale and region. There is no limit on the number of apps that you can pin. You specify apps using the [Application User Model ID (AUMID)](http://go.microsoft.com/fwlink/p/?LinkId=614867) or Desktop Application Link Path (the local path to the application). +You can specify different taskbar configurations based on device locale and region. There is no limit on the number of apps that you can pin. You specify apps using the [Application User Model ID (AUMID)](https://go.microsoft.com/fwlink/p/?LinkId=614867) or Desktop Application Link Path (the local path to the application). If you specify an app to be pinned that is not installed on the computer, it won't appear on the taskbar. @@ -35,11 +35,14 @@ To configure the taskbar: 1. Create the XML file. * If you are also [customizing the Start layout](customize-and-export-start-layout.md), use `Export-StartLayout` to create the XML, and then add the `` section from the following sample to the file. * If you are only configuring the taskbar, use the following sample to create a layout modification XML file. -2. Edit and save the XML file. You can use [AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867) or Desktop Application Link Path to identify the apps to pin to the taskbar. - * Use `` and [AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867) to pin Universal Windows Platform apps. +2. Edit and save the XML file. You can use [AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867) or Desktop Application Link Path to identify the apps to pin to the taskbar. + * Use `` and [AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867) to pin Universal Windows Platform apps. * Use `` and Desktop Application Link Path to pin desktop applications. 3. Apply the layout modification XML file to devices using [Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) or a [provisioning package created in Windows Imaging and Configuration Designer (Windows ICD)](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md). +>[!IMPORTANT] +>If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. + ### Tips for finding AUMID and Desktop Application Link Path In the layout modification XML file, you will need to add entries for applications in the XML markup. In order to pin an application, you need either its AUMID or Desktop Application Link Path. @@ -153,7 +156,7 @@ If you only want to remove some of the default pinned apps, you would use this m - + @@ -172,7 +175,7 @@ If you only want to remove some of the default pinned apps, you would use this m ## Configure taskbar by country or region -The following example shows you how to configure taskbars by country or region. When you specify one or more country or region in ``, the pinned apps in that section are only pinned on computers that are configured for that country or region. When specifying taskbar configuration by country or region, the taskbar will concatenate pinlists together so long as the target computer meets the country or region requirements. If no country or region is specified for a `` node, it will apply to every country and region. +The following example shows you how to configure taskbars by country or region. When the layout is applied to a computer, if there is no `` node with a region tag for the current region, the first `` node that has no specified region will be applied. When you specify one or more countries or regions in a `` node, the specified apps are pinned on computers configured for any of the specified countries or regions. ```xml @@ -229,7 +232,7 @@ The resulting taskbar for computers in any other country region: > [!NOTE] -> [Look up country and region codes (use the ISO Short column)](http://go.microsoft.com/fwlink/p/?LinkId=786445) +> [Look up country and region codes (use the ISO Short column)](https://go.microsoft.com/fwlink/p/?LinkId=786445) diff --git a/windows/manage/configure-windows-telemetry-in-your-organization.md b/windows/manage/configure-windows-telemetry-in-your-organization.md index 9965ade8d5..37c473d289 100644 --- a/windows/manage/configure-windows-telemetry-in-your-organization.md +++ b/windows/manage/configure-windows-telemetry-in-your-organization.md @@ -31,9 +31,10 @@ To frame a discussion about telemetry, it is important to understand Microsoft This article applies to Windows and Windows Server telemetry only. Other Microsoft or third-party apps, such as System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager, might send data to their cloud services in ways that are inconsistent with this guide. Their publishers are responsible for notifying users of their privacy policies, telemetry controls, and so on. This article describes the types of telemetry we may gather, the ways you might manage it in your organization, and some examples of how telemetry can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers. - Use this article to make informed decisions about how you might configure telemetry in your organization. Telemetry is a term that means different things to different people and organizations. For the purpose of this article, we discuss telemetry as system data that is uploaded by the Connected User Experience and Telemetry component. The telemetry data is used to help keep Windows devices secure by identifying malware trends and other threats and to help Microsoft improve the quality of Windows and Microsoft services. +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. + ## Overview In previous versions of Windows and Windows Server, Microsoft used telemetry to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016, you can control telemetry streams by using the Privacy option in Settings, Group Policy, or MDM. @@ -66,7 +67,7 @@ Telemetry can sometimes be confused with functional data. Some Windows component There are subtle differences between telemetry and functional data. Windows collects and sends telemetry in the background automatically. You can control how much information is gathered by setting the telemetry level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data. -If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services). +If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services). The following are specific examples of functional data: @@ -150,7 +151,7 @@ The following table defines the endpoints for telemetry services: ### Data use and access -The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). Microsoft may share business reports with OEMs and third party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. +The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. ### Retention @@ -377,15 +378,15 @@ There are a few more settings that you can turn off that may send telemetry info FAQs -- [Cortana, Search, and privacy](http://windows.microsoft.com/en-us/windows-10/cortana-privacy-faq) -- [Windows 10 feedback, diagnostics, and privacy](http://windows.microsoft.com/en-us/windows-10/feedback-diagnostics-privacy-faq) -- [Windows 10 camera and privacy](http://windows.microsoft.com/en-us/windows-10/camera-privacy-faq) -- [Windows 10 location service and privacy](http://windows.microsoft.com/en-us/windows-10/location-service-privacy) -- [Microsoft Edge and privacy](http://windows.microsoft.com/en-us/windows-10/edge-privacy-faq) -- [Windows 10 speech, inking, typing, and privacy](http://windows.microsoft.com/en-us/windows-10/speech-inking-typing-privacy-faq) -- [Windows Hello and privacy](http://windows.microsoft.com/en-us/windows-10/windows-hello-privacy-faq) -- [Wi-Fi Sense](http://windows.microsoft.com/en-us/windows-10/wi-fi-sense-faq) -- [Windows Update Delivery Optimization](http://windows.microsoft.com/en-us/windows-10/windows-update-delivery-optimization-faq) +- [Cortana, Search, and privacy](http://windows.microsoft.com/windows-10/cortana-privacy-faq) +- [Windows 10 feedback, diagnostics, and privacy](http://windows.microsoft.com/windows-10/feedback-diagnostics-privacy-faq) +- [Windows 10 camera and privacy](http://windows.microsoft.com/windows-10/camera-privacy-faq) +- [Windows 10 location service and privacy](http://windows.microsoft.com/windows-10/location-service-privacy) +- [Microsoft Edge and privacy](http://windows.microsoft.com/windows-10/edge-privacy-faq) +- [Windows 10 speech, inking, typing, and privacy](http://windows.microsoft.com/windows-10/speech-inking-typing-privacy-faq) +- [Windows Hello and privacy](http://windows.microsoft.com/windows-10/windows-hello-privacy-faq) +- [Wi-Fi Sense](http://windows.microsoft.com/windows-10/wi-fi-sense-faq) +- [Windows Update Delivery Optimization](http://windows.microsoft.com/windows-10/windows-update-delivery-optimization-faq) Blogs @@ -393,11 +394,11 @@ Blogs Privacy Statement -- [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement) +- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) TechNet -- [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) Web Pages diff --git a/windows/manage/customize-and-export-start-layout.md b/windows/manage/customize-and-export-start-layout.md index 68d1056ac3..87f206380e 100644 --- a/windows/manage/customize-and-export-start-layout.md +++ b/windows/manage/customize-and-export-start-layout.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Customize and export Start layout @@ -19,7 +19,7 @@ localizationpriority: medium **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout. @@ -74,7 +74,7 @@ To prepare a Start layout for export, you simply customize the Start layout on a ## Export the Start layout -When you have the Start layout that you want your users to see, use the [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet in Windows PowerShell to export the Start layout to an .xml file. +When you have the Start layout that you want your users to see, use the [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet in Windows PowerShell to export the Start layout to an .xml file. **To export the Start layout to an .xml file** @@ -86,7 +86,7 @@ When you have the Start layout that you want your users to see, use the [Export- In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml). - Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet does not append the file name extension, and the policy settings require the extension. + Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet does not append the file name extension, and the policy settings require the extension. Example of a layout file produced by `Export-StartLayout`: diff --git a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md index 6c7c63c9cd..d0d6b868e6 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Customize Windows 10 Start and taskbar with Group Policy @@ -19,7 +19,7 @@ localizationpriority: medium **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Enterprise and Windows 10 Education, you can use a Group Policy Object (GPO) to deploy a customized Start and taskbar layout to users in a domain. No reimaging is required, and the layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. @@ -37,24 +37,24 @@ When a full Start layout is applied with this method, the users cannot pin, unpi Start and taskbar layout control using Group Policy is supported in Windows 10 Enterprise and Windows 10 Education, Version 1607. Start and taskbar layout control is not supported in Windows 10 Pro. -The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](http://go.microsoft.com/fwlink/p/?LinkId=691687) in the Microsoft Knowledge Base. +The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](https://go.microsoft.com/fwlink/p/?LinkId=691687) in the Microsoft Knowledge Base. ## How Start layout control works Three features enable Start and taskbar layout control: -- The [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkID=620879) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. +- The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkID=620879) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. **Note**   - To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. + To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. - [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. - In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. **Note**   -To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( http://go.microsoft.com/fwlink/p/?LinkId=620863). +To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863).   @@ -69,7 +69,7 @@ The GPO can be configured from any computer on which the necessary ADMX and ADML The .xml file with the Start and taskbar layout must be located on shared network storage that is available to the users’ computers when they sign in and the users must have Read-only access to the file. If the file is not available at sign-in, Start and the taskbar are not customized during the session, and the user can make changes to Start. -For information about deploying GPOs in a domain, see [Working with Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=620889). +For information about deploying GPOs in a domain, see [Working with Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=620889). ## Use Group Policy to apply a customized Start layout on the local computer @@ -77,9 +77,9 @@ For information about deploying GPOs in a domain, see [Working with Group Policy You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**. **Note**   -This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment), later in this topic. +This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment). -This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=620881). The guide was written for Windows Vista and the procedures still apply to Windows 10. +This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=620881). The guide was written for Windows Vista and the procedures still apply to Windows 10.   diff --git a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md index 2e17e4b129..cf6a6dab79 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md @@ -19,7 +19,7 @@ localizationpriority: medium **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Enterprise and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start layout to users. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. @@ -40,11 +40,11 @@ Two features enable Start layout control: - The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. **Note**   - To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. + To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet.   -- In MDM, you set the path to the .xml file that defines the Start layout using an OMA-URI setting, which is based on the [Policy configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=623244). +- In MDM, you set the path to the .xml file that defines the Start layout using an OMA-URI setting, which is based on the [Policy configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=623244). ## Create a policy for your customized Start layout @@ -139,7 +139,7 @@ This example uses Microsoft Intune to configure an MDM policy that applies a cus [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -[Use Windows 10 custom policies to manage device settings with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=616316) +[Use Windows 10 custom policies to manage device settings with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=616316)   diff --git a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 2fcd71d6ad..aca87ef5cc 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -19,10 +19,13 @@ localizationpriority: medium **Looking for consumer information?** -- [Customize the Start menu](http://go.microsoft.com/fwlink/p/?LinkId=623630) +- [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Enterprise and Windows 10 Education, version 1607, you can use a provisioning package that you create with Windows Imaging and Configuration Designer (ICD) tool to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. +>[!IMPORTANT] +>If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. + **Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) ## How Start layout control works @@ -33,7 +36,7 @@ Three features enable Start and taskbar layout control: - The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. **Note**   - To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. + To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet. - [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. @@ -43,7 +46,7 @@ Three features enable Start and taskbar layout control: ## Create a provisioning package that contains a customized Start layout -Use the [Imaging and Configuration Designer (ICD) tool](http://go.microsoft.com/fwlink/p/?LinkID=525483) included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that applies a customized Start and taskbar layout. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) +Use the [Imaging and Configuration Designer (ICD) tool](https://go.microsoft.com/fwlink/p/?LinkID=525483) included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that applies a customized Start and taskbar layout. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) > **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. @@ -61,7 +64,7 @@ When you build a provisioning package, you may include sensitive information in 6. Expand **Runtime settings** > **Start**, and click **StartLayout**. -7. Specify the path and file name of the Start layout .xml that you created with the [Export-StartLayout](http://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet. +7. Specify the path and file name of the Start layout .xml that you created with the [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet. 8. On the **File** menu, select **Save.** diff --git a/windows/manage/diagnostics-for-mdm-devices.md b/windows/manage/diagnostics-for-mdm-devices.md deleted file mode 100644 index 32998541e9..0000000000 --- a/windows/manage/diagnostics-for-mdm-devices.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Diagnostics for Windows 10 devices (Windows 10) -description: Device Policy State log in Windows 10, Version 1607, collects info about policies. -keywords: ["mdm", "udiag", "device policy", "mdmdiagnostics"] -ms.prod: W10 -ms.mktglfcycl: manage -ms.sitesec: library -author: jdeckerMS ---- - -# Diagnostics for Windows 10 devices - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -(which SKUs?) - -(this isn't really MDM-managed only, is it? It can be done locally/email?) - -Two new diagnostic tools for Windows 10, version 1607, help IT administrators diagnose and resolve issues with remote devices enrolled in mobile device management (MDM): the [Device Policy State Log](#device-policy-state-log) and [UDiag](#udiag). Windows 10 for desktop editions and Windows 10 Mobile make it simple for users to export log files that you can then analyze with these tools. - -## Export management log files - -Go to **Settings > Accounts > Work access > Export your management log files**. - -![Export your management log files](images/export-mgt-desktop.png) - -- On desktop devices, the file is saved to C:/Users/Public/Public Documents/MDMDiagnostics/MDMDiagReport.xml -- On phones, the file is saved to *phone*/Documents/MDMDiagnostics/MDMDiagReport.xml - -The MDMDiagReport.xml can be used with [Device Policy State Log](#device-policy-state-log) and [UDiag](#udiag) to help you resolve issues. - -## Device Policy State Log - -The Device Policy State Log collects information on the state of policies applied to the device to help you determine which sources are applying policies or configurations to the device. Help desk personnel can use this log to diagnose and resolve issues with a remote device. - -After you obtain the management log file from the user's device, run the mdmReportGenerator.ps1 script on log to create report. (download mdmReportGenerator.ps1 and mdmDiagnoseHelpers.psm1) This PowerShell script asks you to enter the name of the management log file and a name for the report that it will create, as shown in the following example: - -![Enter file name for input and output](images/mdm-diag-report-powershell.png) - -The script produces the report in html format. There are two sections to the report, Configuration and Policy Information. - - The configuration section lists the GUID of the sources that are applying configurations to the device. - - ![Configuration source Exachange ActiveSync](images/config-source.png) - -The policy information section displays information about the specific policies that are being enforced and on the device. For each policy, you will see the Area grouping, the Policy name, its default and current value, and the configuration source. You can compare the configuration source GUID in the policy information section to the GUIDs in the configuration section to identify the source of the policy. - -![Policies applied by a configuration source](images/config-policy.png) - - -## UDiag - -The UDiag tool applies rules to Event Tracing for Windows (ETW) files to help determine the root cause of an issue. - -(download UDiag) - -To analyze MDMDiagReport.xml using UDiag -1. Open UDiag, and select Device Management. -2. Select your source for the log files ("cab of logs" or "directory of logs") - -Investigating log content, identifying patterns, and adding a root cause analysis to the database (Advanced users/providers) - -1. While at the 'Root Causes List' panel, click the 'Diagnose' button at the bottom. -2. You will then be brought to the Diagnosis panel where you can investigate and tag root causes from the content - - Evidence Groups: When a set of logs are loaded into UDiag, the contents are processed (e.g. ETW) and organized into evidence groups. - - Decision Tree View: This view shows the loaded decision tree for the current topic/topic area. When a decision node is selected, a user can modify the regular expression and add/edit/delete an RCA for that node. Any RCA matches found in the current log set will have an 'RCA' label that is either Red or Yellow. - - Evidence View: Selecting an evidence group loads its content into this evidence view. Use this view to investigate issues and determine root causes. Drag and drop lines from the Evidence View into the Decision Tree View, to build your root cause analysis pattern. ([Learn more about techniques for root cause analysis.](https://technet.microsoft.com/en-us/library/cc543298.aspx)) - - - - - - Can admin pull logs without user action? [DK] Yes via the diagnostic log CSP - - - - "Run PowerShell script to process the file" – is that the user doing it? How can this workflow work in an enterprise where employees aren't computer-savvy? [DK] This is intended to be done by the help desk guy. - - Where did (user|admin) get mdmReportGenerator.ps1? [DK] Publishing on DLC later this summer - - In Viewing the report, how does the admin make sense of the source GUIDs? [DK] Correlates the value in the table with the entries at the top of the page. - - UDiag – where does admin get this? [DK] Publishing on DLC later this summer - - Can admins create custom rule sets? [DK] Right now, no. but open to feedback on this. - - - -Link to [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx) - -[Diagnostics capability for devices managed by any MDM provider.](https://microsoft.sharepoint.com/teams/osg_core_ens/mgmt/OSMan Wiki/MDM Diagnostics - Generating and Processing Log files.aspx) - -[Redstone spec](https://microsoft.sharepoint.com/teams/specstore/_layouts/15/WopiFrame.aspx?sourcedoc=%7b7E8742A2-03A1-451C-BA07-F2573B044CBF%7d&file=DM%20-%20MDM%20Diagnostics-RS.docx&action=default&DefaultItemOpen=1) - -## Related topics - -[DiagnosticLog CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt219118.aspx) - -[Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120.aspx) \ No newline at end of file diff --git a/windows/manage/find-and-acquire-apps-overview.md b/windows/manage/find-and-acquire-apps-overview.md index 8faea40ea2..30ca08ff48 100644 --- a/windows/manage/find-and-acquire-apps-overview.md +++ b/windows/manage/find-and-acquire-apps-overview.md @@ -40,6 +40,10 @@ Use the Windows Store for Business to find apps for your organization. You can a + + + + diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md index 37005acc03..40c5250e62 100644 --- a/windows/manage/group-policies-for-enterprise-and-education-editions.md +++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md @@ -1,6 +1,6 @@ --- -title: Group Policies that apply only to Windows 10 Enterprise and Education Editions (Windows 10) -description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise and Windows 10 Education. +title: Group Policy settings that apply only to Windows 10 Enterprise and Education Editions (Windows 10) +description: Use this topic to learn about Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -8,13 +8,13 @@ author: brianlic-msft localizationpriority: high --- -# Group Policies that apply only to Windows 10 Enterprise and Education Editions +# Group Policy settings that apply only to Windows 10 Enterprise and Education Editions **Applies to** - Windows 10 -In Windows 10, version 1607, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education. +In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education. | Policy name | Policy path | Comments | | --- | --- | --- | diff --git a/windows/manage/how-it-pros-can-use-configuration-service-providers.md b/windows/manage/how-it-pros-can-use-configuration-service-providers.md index a61e88337b..26ab03140f 100644 --- a/windows/manage/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/manage/how-it-pros-can-use-configuration-service-providers.md @@ -19,7 +19,7 @@ localizationpriority: medium Configuration service providers (CSPs) expose device configuration settings in Windows 10. This topic is written for people who have no experience with CSPs. -The CSPs are documented on the [Hardware Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. +The CSPs are documented on the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. **Note**   The explanation of CSPs and CSP documentation also apply to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. @@ -33,9 +33,9 @@ A CSP is an interface in the client operating system between configuration setti Starting in Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. In the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. -Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](http://go.microsoft.com/fwlink/p/?LinkId=717438) contains the settings to create a Wi-Fi profile. +Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkId=717438) contains the settings to create a Wi-Fi profile. -CSPs are behind many of the management tasks and policies for Windows 10 in Microsoft Intune and non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244). +CSPs are behind many of the management tasks and policies for Windows 10 in Microsoft Intune and non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). ![how intune maps to csp](images/policytocsp.png) @@ -49,7 +49,7 @@ The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. -[Learn how to use the WMI Bridge Provider with PowerShell.](http://go.microsoft.com/fwlink/p/?LinkId=761090) +[Learn how to use the WMI Bridge Provider with PowerShell.](https://go.microsoft.com/fwlink/p/?LinkId=761090) ## Why should you learn about CSPs? @@ -58,11 +58,11 @@ Generally, enterprises rely on Group Policy or MDM to configure and manage devic In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management, or you want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. -In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](../index.md) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) which links to the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. +In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](../index.md) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. ### CSPs in Windows Imaging and Configuration Designer (ICD) -You can use Windows Imaging and Configuration Designer (ICD) to create [provisioning packages](http://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE) and after devices are set up. You can use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows ICD are based on CSPs. +You can use Windows Imaging and Configuration Designer (ICD) to create [provisioning packages](https://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE) and after devices are set up. You can use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows ICD are based on CSPs. Many settings in Windows ICD will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. @@ -72,20 +72,20 @@ Many settings in Windows ICD will display documentation for that setting in the ### CSPs in MDM -Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might simply be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](http://go.microsoft.com/fwlink/p/?LinkId=717390). +Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might simply be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). -When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](http://go.microsoft.com/fwlink/p/?LinkID=616316) to deploy settings. Intune documents [a partial list of settings](http://go.microsoft.com/fwlink/p/?LinkID=616317) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](http://go.microsoft.com/fwlink/p/?LinkId=717390) to locate that information. +When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](https://go.microsoft.com/fwlink/p/?LinkID=616316) to deploy settings. Intune documents [a partial list of settings](https://go.microsoft.com/fwlink/p/?LinkID=616317) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](https://go.microsoft.com/fwlink/p/?LinkId=717390) to locate that information. ### CSPs in Lockdown XML -Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=618601). +Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). ## How do you use the CSP documentation? -All CSPs in Windows 10 are documented in the [Configuration service provider reference](http://go.microsoft.com/fwlink/p/?LinkId=717390). +All CSPs in Windows 10 are documented in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). -The [main CSP topic](http://go.microsoft.com/fwlink/p/?LinkId=717390) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. +The [main CSP topic](https://go.microsoft.com/fwlink/p/?LinkId=717390) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. ![csp per windows edition](images/csptable.png) @@ -93,11 +93,11 @@ The documentation for each CSP follows the same structure. After an introduction The full path to a specific configuration setting is represented by its Open Mobile Alliance - Uniform Resource Identifier (OMA-URI). The URI is relative to the devices’ root node (MSFT, for example). Features supported by a particular CSP can be set by addressing the complete OMA-URI path. -The following example shows the diagram for the [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes and rectangular elements are settings or policies for which a value must be supplied. +The following example shows the diagram for the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes and rectangular elements are settings or policies for which a value must be supplied. ![assigned access csp tree](images/provisioning-csp-assignedaccess.png) -The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see it uses the [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608). +The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see it uses the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). ```XML ./Vendor/MSFT/AssignedAccess/KioskModeApp @@ -109,7 +109,7 @@ When an element in the diagram uses italic font, it indicates a placeholder for After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed. -For example, in the [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608), the setting is **KioskModeApp**. The documentation tells you that the value for **KioskModeApp** is a JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. +For example, in the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608), the setting is **KioskModeApp**. The documentation tells you that the value for **KioskModeApp** is a JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. The documentation for most CSPs will also include an XML example. @@ -118,7 +118,7 @@ The documentation for most CSPs will also include an XML example. CSPs provide access to a number of settings useful to enterprises. This section introduces two CSPs that an enterprise might find particularly useful. -- [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601) +- [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. @@ -132,7 +132,7 @@ CSPs provide access to a number of settings useful to enterprises. This section - Restricting access to the context menu. - Enabling or disabling tile manipulation. - Creating role-specific configurations. -- [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244) +- [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. @@ -156,63 +156,63 @@ CSPs provide access to a number of settings useful to enterprises. This section Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: -- [ActiveSync CSP](http://go.microsoft.com/fwlink/p/?LinkId=723219) -- [Application CSP](http://go.microsoft.com/fwlink/p/?LinkId=723220) -- [AppLocker CSP](http://go.microsoft.com/fwlink/p/?LinkID=626609) -- [AssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=626608) -- [Bootstrap CSP](http://go.microsoft.com/fwlink/p/?LinkId=723224) -- [BrowserFavorite CSP](http://go.microsoft.com/fwlink/p/?LinkId=723428) -- [CellularSettings CSP](http://go.microsoft.com/fwlink/p/?LinkId=723427) -- [CertificateStore CSP](http://go.microsoft.com/fwlink/p/?LinkId=723225) -- [ClientCertificateInstall CSP](http://go.microsoft.com/fwlink/p/?LinkId=723226) -- [CM\_CellularEntries CSP](http://go.microsoft.com/fwlink/p/?LinkId=723426) -- [CM\_ProxyEntries CSP](http://go.microsoft.com/fwlink/p/?LinkId=723425) -- [CMPolicy CSP](http://go.microsoft.com/fwlink/p/?LinkId=723424) -- [Defender CSP](http://go.microsoft.com/fwlink/p/?LinkId=723227) -- [DevDetail CSP](http://go.microsoft.com/fwlink/p/?LinkId=723228) -- [DeviceInstanceService CSP](http://go.microsoft.com/fwlink/p/?LinkId=723275) -- [DeviceLock CSP](http://go.microsoft.com/fwlink/p/?LinkId=723370) -- [DeviceStatus CSP](http://go.microsoft.com/fwlink/p/?LinkId=723229) -- [DevInfo CSP](http://go.microsoft.com/fwlink/p/?LinkId=723230) -- [DiagnosticLog CSP](http://go.microsoft.com/fwlink/p/?LinkId=723231) -- [DMAcc CSP](http://go.microsoft.com/fwlink/p/?LinkId=723232) -- [DMClient CSP](http://go.microsoft.com/fwlink/p/?LinkId=723233) -- [Email2 CSP](http://go.microsoft.com/fwlink/p/?LinkId=723234) -- [EnterpriseAPN CSP](http://go.microsoft.com/fwlink/p/?LinkId=723235) -- [EnterpriseAppManagement CSP](http://go.microsoft.com/fwlink/p/?LinkId=723237) -- [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601) -- [EnterpriseDesktopAppManagement CSP](http://go.microsoft.com/fwlink/p/?LinkId=723236) -- [EnterpriseExt CSP](http://go.microsoft.com/fwlink/p/?LinkId=723423) -- [EnterpriseExtFileSystem CSP](http://go.microsoft.com/fwlink/p/?LinkID=703716) -- [EnterpriseModernAppManagement CSP](http://go.microsoft.com/fwlink/p/?LinkId=723257) -- [FileSystem CSP](http://go.microsoft.com/fwlink/p/?LinkId=723422) -- [HealthAttestation CSP](http://go.microsoft.com/fwlink/p/?LinkId=723258) -- [HotSpot CSP](http://go.microsoft.com/fwlink/p/?LinkId=723421) -- [Maps CSP](http://go.microsoft.com/fwlink/p/?LinkId=723420) -- [NAP CSP](http://go.microsoft.com/fwlink/p/?LinkId=723419) -- [NAPDEF CSP](http://go.microsoft.com/fwlink/p/?LinkId=723371) -- [NodeCache CSP]( http://go.microsoft.com/fwlink/p/?LinkId=723265) -- [PassportForWork CSP](http://go.microsoft.com/fwlink/p/?LinkID=692070) -- [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkID=623244) -- [PolicyManager CSP]( http://go.microsoft.com/fwlink/p/?LinkId=723418) -- [Provisioning CSP](http://go.microsoft.com/fwlink/p/?LinkId=723266) -- [Proxy CSP]( http://go.microsoft.com/fwlink/p/?LinkId=723372) -- [PXLOGICAL CSP](http://go.microsoft.com/fwlink/p/?LinkId=723374) -- [Registry CSP](http://go.microsoft.com/fwlink/p/?LinkId=723417) -- [RemoteFind CSP](http://go.microsoft.com/fwlink/p/?LinkId=723267) -- [RemoteWipe CSP](http://go.microsoft.com/fwlink/p/?LinkID=703714) -- [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkId=723375) -- [RootCATrustedCertificates CSP](http://go.microsoft.com/fwlink/p/?LinkId=723270) -- [SecurityPolicy CSP](http://go.microsoft.com/fwlink/p/?LinkId=723376) -- [Storage CSP](http://go.microsoft.com/fwlink/p/?LinkId=723377) -- [SUPL CSP](http://go.microsoft.com/fwlink/p/?LinkId=723378) -- [UnifiedWriteFilter CSP](http://go.microsoft.com/fwlink/p/?LinkId=723272) -- [Update CSP](http://go.microsoft.com/fwlink/p/?LinkId=723271) -- [VPN CSP](http://go.microsoft.com/fwlink/p/?LinkId=723416) -- [VPNv2 CSP](http://go.microsoft.com/fwlink/p/?LinkID=617588) -- [Wi-Fi CSP](http://go.microsoft.com/fwlink/p/?LinkID=71743) -- [WindowsLicensing CSP](http://go.microsoft.com/fwlink/p/?LinkId=723274) -- [WindowsSecurityAuditing CSP](http://go.microsoft.com/fwlink/p/?LinkId=723415) +- [ActiveSync CSP](https://go.microsoft.com/fwlink/p/?LinkId=723219) +- [Application CSP](https://go.microsoft.com/fwlink/p/?LinkId=723220) +- [AppLocker CSP](https://go.microsoft.com/fwlink/p/?LinkID=626609) +- [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608) +- [Bootstrap CSP](https://go.microsoft.com/fwlink/p/?LinkId=723224) +- [BrowserFavorite CSP](https://go.microsoft.com/fwlink/p/?LinkId=723428) +- [CellularSettings CSP](https://go.microsoft.com/fwlink/p/?LinkId=723427) +- [CertificateStore CSP](https://go.microsoft.com/fwlink/p/?LinkId=723225) +- [ClientCertificateInstall CSP](https://go.microsoft.com/fwlink/p/?LinkId=723226) +- [CM\_CellularEntries CSP](https://go.microsoft.com/fwlink/p/?LinkId=723426) +- [CM\_ProxyEntries CSP](https://go.microsoft.com/fwlink/p/?LinkId=723425) +- [CMPolicy CSP](https://go.microsoft.com/fwlink/p/?LinkId=723424) +- [Defender CSP](https://go.microsoft.com/fwlink/p/?LinkId=723227) +- [DevDetail CSP](https://go.microsoft.com/fwlink/p/?LinkId=723228) +- [DeviceInstanceService CSP](https://go.microsoft.com/fwlink/p/?LinkId=723275) +- [DeviceLock CSP](https://go.microsoft.com/fwlink/p/?LinkId=723370) +- [DeviceStatus CSP](https://go.microsoft.com/fwlink/p/?LinkId=723229) +- [DevInfo CSP](https://go.microsoft.com/fwlink/p/?LinkId=723230) +- [DiagnosticLog CSP](https://go.microsoft.com/fwlink/p/?LinkId=723231) +- [DMAcc CSP](https://go.microsoft.com/fwlink/p/?LinkId=723232) +- [DMClient CSP](https://go.microsoft.com/fwlink/p/?LinkId=723233) +- [Email2 CSP](https://go.microsoft.com/fwlink/p/?LinkId=723234) +- [EnterpriseAPN CSP](https://go.microsoft.com/fwlink/p/?LinkId=723235) +- [EnterpriseAppManagement CSP](https://go.microsoft.com/fwlink/p/?LinkId=723237) +- [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) +- [EnterpriseDesktopAppManagement CSP](https://go.microsoft.com/fwlink/p/?LinkId=723236) +- [EnterpriseExt CSP](https://go.microsoft.com/fwlink/p/?LinkId=723423) +- [EnterpriseExtFileSystem CSP](https://go.microsoft.com/fwlink/p/?LinkID=703716) +- [EnterpriseModernAppManagement CSP](https://go.microsoft.com/fwlink/p/?LinkId=723257) +- [FileSystem CSP](https://go.microsoft.com/fwlink/p/?LinkId=723422) +- [HealthAttestation CSP](https://go.microsoft.com/fwlink/p/?LinkId=723258) +- [HotSpot CSP](https://go.microsoft.com/fwlink/p/?LinkId=723421) +- [Maps CSP](https://go.microsoft.com/fwlink/p/?LinkId=723420) +- [NAP CSP](https://go.microsoft.com/fwlink/p/?LinkId=723419) +- [NAPDEF CSP](https://go.microsoft.com/fwlink/p/?LinkId=723371) +- [NodeCache CSP]( https://go.microsoft.com/fwlink/p/?LinkId=723265) +- [PassportForWork CSP](https://go.microsoft.com/fwlink/p/?LinkID=692070) +- [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) +- [PolicyManager CSP]( https://go.microsoft.com/fwlink/p/?LinkId=723418) +- [Provisioning CSP](https://go.microsoft.com/fwlink/p/?LinkId=723266) +- [Proxy CSP]( https://go.microsoft.com/fwlink/p/?LinkId=723372) +- [PXLOGICAL CSP](https://go.microsoft.com/fwlink/p/?LinkId=723374) +- [Registry CSP](https://go.microsoft.com/fwlink/p/?LinkId=723417) +- [RemoteFind CSP](https://go.microsoft.com/fwlink/p/?LinkId=723267) +- [RemoteWipe CSP](https://go.microsoft.com/fwlink/p/?LinkID=703714) +- [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkId=723375) +- [RootCATrustedCertificates CSP](https://go.microsoft.com/fwlink/p/?LinkId=723270) +- [SecurityPolicy CSP](https://go.microsoft.com/fwlink/p/?LinkId=723376) +- [Storage CSP](https://go.microsoft.com/fwlink/p/?LinkId=723377) +- [SUPL CSP](https://go.microsoft.com/fwlink/p/?LinkId=723378) +- [UnifiedWriteFilter CSP](https://go.microsoft.com/fwlink/p/?LinkId=723272) +- [Update CSP](https://go.microsoft.com/fwlink/p/?LinkId=723271) +- [VPN CSP](https://go.microsoft.com/fwlink/p/?LinkId=723416) +- [VPNv2 CSP](https://go.microsoft.com/fwlink/p/?LinkID=617588) +- [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkID=71743) +- [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723274) +- [WindowsSecurityAuditing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723415) ## Related topics diff --git a/windows/manage/images/checklistbox.gif b/windows/manage/images/checklistbox.gif index 8af13c51d1..44cf17b07b 100644 Binary files a/windows/manage/images/checklistbox.gif and b/windows/manage/images/checklistbox.gif differ diff --git a/windows/manage/images/checklistdone.png b/windows/manage/images/checklistdone.png new file mode 100644 index 0000000000..7e53f74d0e Binary files /dev/null and b/windows/manage/images/checklistdone.png differ diff --git a/windows/manage/images/copy-to-change.png b/windows/manage/images/copy-to-change.png new file mode 100644 index 0000000000..21aa250c0c Binary files /dev/null and b/windows/manage/images/copy-to-change.png differ diff --git a/windows/manage/images/copy-to-path.png b/windows/manage/images/copy-to-path.png new file mode 100644 index 0000000000..1ef00fc86b Binary files /dev/null and b/windows/manage/images/copy-to-path.png differ diff --git a/windows/manage/images/copy-to.PNG b/windows/manage/images/copy-to.PNG new file mode 100644 index 0000000000..dad84cedc8 Binary files /dev/null and b/windows/manage/images/copy-to.PNG differ diff --git a/windows/manage/images/gp-branch.png b/windows/manage/images/gp-branch.png new file mode 100644 index 0000000000..997bcc830a Binary files /dev/null and b/windows/manage/images/gp-branch.png differ diff --git a/windows/manage/images/gp-exclude-drivers.png b/windows/manage/images/gp-exclude-drivers.png new file mode 100644 index 0000000000..0010749139 Binary files /dev/null and b/windows/manage/images/gp-exclude-drivers.png differ diff --git a/windows/manage/images/gp-feature.png b/windows/manage/images/gp-feature.png new file mode 100644 index 0000000000..b862d545d4 Binary files /dev/null and b/windows/manage/images/gp-feature.png differ diff --git a/windows/manage/images/gp-quality.png b/windows/manage/images/gp-quality.png new file mode 100644 index 0000000000..d7ff30172d Binary files /dev/null and b/windows/manage/images/gp-quality.png differ diff --git a/windows/manage/images/settings-table.png b/windows/manage/images/settings-table.png deleted file mode 100644 index ada56513fc..0000000000 Binary files a/windows/manage/images/settings-table.png and /dev/null differ diff --git a/windows/manage/images/sysprep-error.png b/windows/manage/images/sysprep-error.png new file mode 100644 index 0000000000..aa004efbb6 Binary files /dev/null and b/windows/manage/images/sysprep-error.png differ diff --git a/windows/manage/images/waas-do-fig1.png b/windows/manage/images/waas-do-fig1.png new file mode 100644 index 0000000000..e739d0b670 Binary files /dev/null and b/windows/manage/images/waas-do-fig1.png differ diff --git a/windows/manage/images/waas-do-fig2.png b/windows/manage/images/waas-do-fig2.png new file mode 100644 index 0000000000..0c315fddaa Binary files /dev/null and b/windows/manage/images/waas-do-fig2.png differ diff --git a/windows/manage/images/waas-do-fig3.png b/windows/manage/images/waas-do-fig3.png new file mode 100644 index 0000000000..66ac342b51 Binary files /dev/null and b/windows/manage/images/waas-do-fig3.png differ diff --git a/windows/manage/images/waas-do-fig4.png b/windows/manage/images/waas-do-fig4.png new file mode 100644 index 0000000000..3de9605bac Binary files /dev/null and b/windows/manage/images/waas-do-fig4.png differ diff --git a/windows/manage/images/waas-overview-patch.png b/windows/manage/images/waas-overview-patch.png new file mode 100644 index 0000000000..b16c211c59 Binary files /dev/null and b/windows/manage/images/waas-overview-patch.png differ diff --git a/windows/manage/images/waas-overview-timeline.png b/windows/manage/images/waas-overview-timeline.png new file mode 100644 index 0000000000..8488b2b680 Binary files /dev/null and b/windows/manage/images/waas-overview-timeline.png differ diff --git a/windows/manage/images/waas-rings.png b/windows/manage/images/waas-rings.png new file mode 100644 index 0000000000..a5446f3dff Binary files /dev/null and b/windows/manage/images/waas-rings.png differ diff --git a/windows/manage/images/waas-sccm-fig1.png b/windows/manage/images/waas-sccm-fig1.png new file mode 100644 index 0000000000..7557888301 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig1.png differ diff --git a/windows/manage/images/waas-sccm-fig10.png b/windows/manage/images/waas-sccm-fig10.png new file mode 100644 index 0000000000..b029618b67 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig10.png differ diff --git a/windows/manage/images/waas-sccm-fig11.png b/windows/manage/images/waas-sccm-fig11.png new file mode 100644 index 0000000000..fc6528e7ef Binary files /dev/null and b/windows/manage/images/waas-sccm-fig11.png differ diff --git a/windows/manage/images/waas-sccm-fig12.png b/windows/manage/images/waas-sccm-fig12.png new file mode 100644 index 0000000000..87464dd5f1 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig12.png differ diff --git a/windows/manage/images/waas-sccm-fig2.png b/windows/manage/images/waas-sccm-fig2.png new file mode 100644 index 0000000000..a1d7183a7c Binary files /dev/null and b/windows/manage/images/waas-sccm-fig2.png differ diff --git a/windows/manage/images/waas-sccm-fig3.png b/windows/manage/images/waas-sccm-fig3.png new file mode 100644 index 0000000000..cd406d9c5d Binary files /dev/null and b/windows/manage/images/waas-sccm-fig3.png differ diff --git a/windows/manage/images/waas-sccm-fig4.png b/windows/manage/images/waas-sccm-fig4.png new file mode 100644 index 0000000000..782c5ca6ef Binary files /dev/null and b/windows/manage/images/waas-sccm-fig4.png differ diff --git a/windows/manage/images/waas-sccm-fig5.png b/windows/manage/images/waas-sccm-fig5.png new file mode 100644 index 0000000000..5f215dec58 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig5.png differ diff --git a/windows/manage/images/waas-sccm-fig6.png b/windows/manage/images/waas-sccm-fig6.png new file mode 100644 index 0000000000..bd7df6f6d2 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig6.png differ diff --git a/windows/manage/images/waas-sccm-fig7.png b/windows/manage/images/waas-sccm-fig7.png new file mode 100644 index 0000000000..5b7c37b6a1 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig7.png differ diff --git a/windows/manage/images/waas-sccm-fig8.png b/windows/manage/images/waas-sccm-fig8.png new file mode 100644 index 0000000000..1db4dae84a Binary files /dev/null and b/windows/manage/images/waas-sccm-fig8.png differ diff --git a/windows/manage/images/waas-sccm-fig9.png b/windows/manage/images/waas-sccm-fig9.png new file mode 100644 index 0000000000..632b859232 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig9.png differ diff --git a/windows/manage/images/waas-strategy-fig1.png b/windows/manage/images/waas-strategy-fig1.png new file mode 100644 index 0000000000..c12cc660de Binary files /dev/null and b/windows/manage/images/waas-strategy-fig1.png differ diff --git a/windows/manage/images/waas-wsus-fig1.png b/windows/manage/images/waas-wsus-fig1.png new file mode 100644 index 0000000000..1d0dd4cc6b Binary files /dev/null and b/windows/manage/images/waas-wsus-fig1.png differ diff --git a/windows/manage/images/waas-wsus-fig10.png b/windows/manage/images/waas-wsus-fig10.png new file mode 100644 index 0000000000..fe9f6a6447 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig10.png differ diff --git a/windows/manage/images/waas-wsus-fig11.png b/windows/manage/images/waas-wsus-fig11.png new file mode 100644 index 0000000000..0ad08f70c2 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig11.png differ diff --git a/windows/manage/images/waas-wsus-fig12.png b/windows/manage/images/waas-wsus-fig12.png new file mode 100644 index 0000000000..fa9fb5c7a4 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig12.png differ diff --git a/windows/manage/images/waas-wsus-fig13.png b/windows/manage/images/waas-wsus-fig13.png new file mode 100644 index 0000000000..d2e916dc48 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig13.png differ diff --git a/windows/manage/images/waas-wsus-fig14.png b/windows/manage/images/waas-wsus-fig14.png new file mode 100644 index 0000000000..a0c8e30736 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig14.png differ diff --git a/windows/manage/images/waas-wsus-fig15.png b/windows/manage/images/waas-wsus-fig15.png new file mode 100644 index 0000000000..fd59e9ce23 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig15.png differ diff --git a/windows/manage/images/waas-wsus-fig16.png b/windows/manage/images/waas-wsus-fig16.png new file mode 100644 index 0000000000..57a34228d9 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig16.png differ diff --git a/windows/manage/images/waas-wsus-fig17.png b/windows/manage/images/waas-wsus-fig17.png new file mode 100644 index 0000000000..13e755e456 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig17.png differ diff --git a/windows/manage/images/waas-wsus-fig18.png b/windows/manage/images/waas-wsus-fig18.png new file mode 100644 index 0000000000..0b13e936fb Binary files /dev/null and b/windows/manage/images/waas-wsus-fig18.png differ diff --git a/windows/manage/images/waas-wsus-fig19.png b/windows/manage/images/waas-wsus-fig19.png new file mode 100644 index 0000000000..b67d17a56e Binary files /dev/null and b/windows/manage/images/waas-wsus-fig19.png differ diff --git a/windows/manage/images/waas-wsus-fig2.png b/windows/manage/images/waas-wsus-fig2.png new file mode 100644 index 0000000000..ff273ea10f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig2.png differ diff --git a/windows/manage/images/waas-wsus-fig20.png b/windows/manage/images/waas-wsus-fig20.png new file mode 100644 index 0000000000..58fa43444f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig20.png differ diff --git a/windows/manage/images/waas-wsus-fig3.png b/windows/manage/images/waas-wsus-fig3.png new file mode 100644 index 0000000000..1247e2f874 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig3.png differ diff --git a/windows/manage/images/waas-wsus-fig4.png b/windows/manage/images/waas-wsus-fig4.png new file mode 100644 index 0000000000..9fbc673814 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig4.png differ diff --git a/windows/manage/images/waas-wsus-fig5.png b/windows/manage/images/waas-wsus-fig5.png new file mode 100644 index 0000000000..7068f487cd Binary files /dev/null and b/windows/manage/images/waas-wsus-fig5.png differ diff --git a/windows/manage/images/waas-wsus-fig6.png b/windows/manage/images/waas-wsus-fig6.png new file mode 100644 index 0000000000..6256f5d617 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig6.png differ diff --git a/windows/manage/images/waas-wsus-fig7.png b/windows/manage/images/waas-wsus-fig7.png new file mode 100644 index 0000000000..69d3e6fe6f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig7.png differ diff --git a/windows/manage/images/waas-wsus-fig8.png b/windows/manage/images/waas-wsus-fig8.png new file mode 100644 index 0000000000..8ec17f2741 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig8.png differ diff --git a/windows/manage/images/waas-wsus-fig9.png b/windows/manage/images/waas-wsus-fig9.png new file mode 100644 index 0000000000..dd430897ff Binary files /dev/null and b/windows/manage/images/waas-wsus-fig9.png differ diff --git a/windows/manage/images/waas-wufb-gp-broad.png b/windows/manage/images/waas-wufb-gp-broad.png new file mode 100644 index 0000000000..9fdd9e97f1 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-broad.png differ diff --git a/windows/manage/images/waas-wufb-gp-cb2-settings.png b/windows/manage/images/waas-wufb-gp-cb2-settings.png new file mode 100644 index 0000000000..97dc6ce41a Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cb2-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cb2.png b/windows/manage/images/waas-wufb-gp-cb2.png new file mode 100644 index 0000000000..9be7638ed7 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cb2.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb1-settings.png b/windows/manage/images/waas-wufb-gp-cbb1-settings.png new file mode 100644 index 0000000000..dae9866faf Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb1-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb2-settings.png b/windows/manage/images/waas-wufb-gp-cbb2-settings.png new file mode 100644 index 0000000000..2aa7bc212c Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb2-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb2q-settings.png b/windows/manage/images/waas-wufb-gp-cbb2q-settings.png new file mode 100644 index 0000000000..8076b5a99e Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb2q-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-create.png b/windows/manage/images/waas-wufb-gp-create.png new file mode 100644 index 0000000000..63c2ce74aa Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-create.png differ diff --git a/windows/manage/images/waas-wufb-gp-edit-defer.png b/windows/manage/images/waas-wufb-gp-edit-defer.png new file mode 100644 index 0000000000..40da5b7709 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-edit-defer.png differ diff --git a/windows/manage/images/waas-wufb-gp-edit.png b/windows/manage/images/waas-wufb-gp-edit.png new file mode 100644 index 0000000000..e39bc829ff Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-edit.png differ diff --git a/windows/manage/images/waas-wufb-gp-scope-cb2.png b/windows/manage/images/waas-wufb-gp-scope-cb2.png new file mode 100644 index 0000000000..bb29adf5e1 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-scope-cb2.png differ diff --git a/windows/manage/images/waas-wufb-gp-scope.png b/windows/manage/images/waas-wufb-gp-scope.png new file mode 100644 index 0000000000..b8e6863c82 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-scope.png differ diff --git a/windows/manage/images/waas-wufb-intune-cb2.png b/windows/manage/images/waas-wufb-intune-cb2.png new file mode 100644 index 0000000000..3e8c1ce19e Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cb2.png differ diff --git a/windows/manage/images/waas-wufb-intune-cbb1.png b/windows/manage/images/waas-wufb-intune-cbb1.png new file mode 100644 index 0000000000..6f1e815334 Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cbb1.png differ diff --git a/windows/manage/images/waas-wufb-intune-cbb2.png b/windows/manage/images/waas-wufb-intune-cbb2.png new file mode 100644 index 0000000000..b8eef5bb5e Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cbb2.png differ diff --git a/windows/manage/images/waas-wufb-intune-step11.png b/windows/manage/images/waas-wufb-intune-step11.png new file mode 100644 index 0000000000..48db2f63af Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step11.png differ diff --git a/windows/manage/images/waas-wufb-intune-step19.png b/windows/manage/images/waas-wufb-intune-step19.png new file mode 100644 index 0000000000..5a68ca7211 Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step19.png differ diff --git a/windows/manage/images/waas-wufb-intune-step2.png b/windows/manage/images/waas-wufb-intune-step2.png new file mode 100644 index 0000000000..1c7a8a1cae Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step2.png differ diff --git a/windows/manage/images/waas-wufb-intune-step7.png b/windows/manage/images/waas-wufb-intune-step7.png new file mode 100644 index 0000000000..daa96ba18c Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step7.png differ diff --git a/windows/manage/images/wufb-config1.png b/windows/manage/images/wufb-config1.png new file mode 100644 index 0000000000..76185e86fe Binary files /dev/null and b/windows/manage/images/wufb-config1.png differ diff --git a/windows/manage/images/wufb-config2.png b/windows/manage/images/wufb-config2.png new file mode 100644 index 0000000000..0ab09d4868 Binary files /dev/null and b/windows/manage/images/wufb-config2.png differ diff --git a/windows/manage/images/wufb-config3.png b/windows/manage/images/wufb-config3.png new file mode 100644 index 0000000000..a76d1569be Binary files /dev/null and b/windows/manage/images/wufb-config3.png differ diff --git a/windows/manage/images/wufb-do.png b/windows/manage/images/wufb-do.png new file mode 100644 index 0000000000..8d6c9d0b8a Binary files /dev/null and b/windows/manage/images/wufb-do.png differ diff --git a/windows/manage/images/wufb-groups.png b/windows/manage/images/wufb-groups.png new file mode 100644 index 0000000000..13cdea04b0 Binary files /dev/null and b/windows/manage/images/wufb-groups.png differ diff --git a/windows/manage/images/wufb-pause-feature.png b/windows/manage/images/wufb-pause-feature.png new file mode 100644 index 0000000000..afeac43e29 Binary files /dev/null and b/windows/manage/images/wufb-pause-feature.png differ diff --git a/windows/manage/images/wufb-qual.png b/windows/manage/images/wufb-qual.png new file mode 100644 index 0000000000..4a93408522 Binary files /dev/null and b/windows/manage/images/wufb-qual.png differ diff --git a/windows/manage/images/wufb-sccm.png b/windows/manage/images/wufb-sccm.png new file mode 100644 index 0000000000..1d568c1fe4 Binary files /dev/null and b/windows/manage/images/wufb-sccm.png differ diff --git a/windows/manage/index.md b/windows/manage/index.md index eba6dd0e9c..6f91d1ac21 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -30,11 +30,9 @@ Learn about managing and updating Windows 10. - - - - - + + + @@ -44,6 +42,7 @@ Learn about managing and updating Windows 10. + @@ -56,14 +55,7 @@ Learn about managing and updating Windows 10. - - - - - - - - + diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index 8e531b3827..65114bd167 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing -author: greg-lindsay +author: jdeckerMS --- # Windows 10 servicing options @@ -108,7 +108,7 @@ At the end of each approximately four month period, Microsoft executes a set of **The role of Windows Update for Business** -Although Windows 10 will enable IT administrators to defer installation of new feature upgrades using Windows Update, enterprises may also want additional control over how and when Windows Update installs releases. With this need in mind, Microsoft [announced Windows Update for Business](http://go.microsoft.com/fwlink/p/?LinkId=624798) in May of 2015. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing releases. This article will be updated with additional information about the role of Windows Update for Business in servicing Windows 10 devices as it becomes available. +Although Windows 10 will enable IT administrators to defer installation of new feature upgrades using Windows Update, enterprises may also want additional control over how and when Windows Update installs releases. With this need in mind, Microsoft [announced Windows Update for Business](https://go.microsoft.com/fwlink/p/?LinkId=624798) in May of 2015. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing releases. This article will be updated with additional information about the role of Windows Update for Business in servicing Windows 10 devices as it becomes available. ## Windows 10 servicing branches @@ -485,8 +485,8 @@ universal apps removed [Plan for Windows 10 deployment](../plan/index.md) -[Deploy Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624776) +[Deploy Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=624776) -[Manage and update Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624796) +[Manage and update Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=624796)     diff --git a/windows/manage/join-windows-10-mobile-to-azure-active-directory.md b/windows/manage/join-windows-10-mobile-to-azure-active-directory.md index 07b423dbf8..6c398d7d27 100644 --- a/windows/manage/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/manage/join-windows-10-mobile-to-azure-active-directory.md @@ -26,7 +26,7 @@ When a device running Windows 10 Mobile is joined to Azure AD, the device can e - Single sign-on (SSO) in applications like Mail, Word, and OneDrive using resources backed by Azure AD. -- SSO in Microsoft Edge browser to Azure AD-connected web applications like Office 365 Portal, Visual Studio, and more than [2500 non-Microsoft apps](http://go.microsoft.com/fwlink/p/?LinkID=746211). +- SSO in Microsoft Edge browser to Azure AD-connected web applications like Office 365 Portal, Visual Studio, and more than [2500 non-Microsoft apps](https://go.microsoft.com/fwlink/p/?LinkID=746211). - SSO to resources on-premises. @@ -41,7 +41,7 @@ When a device running Windows 10 Mobile is joined to Azure AD, the device can e Windows Phone 8.1 only supported the ability to connect the device to personal cloud services using a Microsoft account for authentication. This required creating Microsoft accounts to be used for work purposes. In Windows 10 Mobile, you have the ability to join devices directly to Azure AD without requiring a personal Microsoft account. -If you have existing Windows Phone 8.1 devices, the first thing to understand is whether the devices you have can be upgraded to Windows 10 Mobile. Microsoft will be releasing more information about upgrade availability soon. As more information becomes available, it will be posted at [How to get Windows 10 Mobile]( http://go.microsoft.com/fwlink/p/?LinkId=746312). Premier Enterprise customers that have a business need to postpone Windows 10 Mobile upgrade should contact their Technical Account Manager to understand what options may be available. +If you have existing Windows Phone 8.1 devices, the first thing to understand is whether the devices you have can be upgraded to Windows 10 Mobile. Microsoft will be releasing more information about upgrade availability soon. As more information becomes available, it will be posted at [How to get Windows 10 Mobile]( https://go.microsoft.com/fwlink/p/?LinkId=746312). Premier Enterprise customers that have a business need to postpone Windows 10 Mobile upgrade should contact their Technical Account Manager to understand what options may be available. Before upgrading and joining devices to Azure AD, you will want to consider existing data usage. How users are using the existing devices and what data is stored locally will vary for every customer. Are text messages used for work purposes and need to be backed up and available after the upgrade? Are there photos stored locally or stored associated with an Microsoft account? Are there device and app settings that to be retained? Are there contacts stored in the SIM or associated with an Microsoft account? You will need to explore methods for capturing and storing the data that needs to be retained before you join the devices to Azure AD. Photos, music files, and documents stored locally on the device can be copied from the device using a USB connection to a PC. @@ -58,9 +58,9 @@ Even though Azure AD Join on Windows 10 Mobile provides the best overall experi - You can add access to Azure AD-backed resources on the device without resetting the device. -However, neither of these methods provides SSO in the Windows Store or SSO to resources on-premises, and does not provide the ability to roam settings based on the Azure AD account using enterprise roaming. [Learn about enterprise state roaming in Azure AD.](http://go.microsoft.com/fwlink/p/?LinkId=734996) +However, neither of these methods provides SSO in the Windows Store or SSO to resources on-premises, and does not provide the ability to roam settings based on the Azure AD account using enterprise roaming. [Learn about enterprise state roaming in Azure AD.](https://go.microsoft.com/fwlink/p/?LinkId=734996) -Using **Settings** > **Accounts** > **Your email and accounts** > **Add work or school account**, users can add their Azure AD account to the device. Alternatively, a work account can be added when the user signs in to an application like Mail, Word, etc. If you [enable auto-enrollment in your MDM settings](http://go.microsoft.com/fwlink/p/?LinkID=691615), the device will automatically be enrolled in MDM. +Using **Settings** > **Accounts** > **Your email and accounts** > **Add work or school account**, users can add their Azure AD account to the device. Alternatively, a work account can be added when the user signs in to an application like Mail, Word, etc. If you [enable auto-enrollment in your MDM settings](https://go.microsoft.com/fwlink/p/?LinkID=691615), the device will automatically be enrolled in MDM. An added work account provides the same SSO experience in browser apps like Office 365 (Office portal, Outlook Web Access, Calendar, People, OneDrive), Azure AD profile and change password app, and Visual Studio. You get SSO to built-in applications like Mail, Calendar, People, OneDrive and files hosted on OneDrive without prompts for a password. In Office apps like Microsoft Word, Microsoft Excel, etc., you simply select the Azure AD account and you are able to open files without entering a password. @@ -71,7 +71,7 @@ An added work account provides the same SSO experience in browser apps like Offi Currently, Azure AD Join only supports self-provisioning, meaning the credentials of the user of the device must be used during the initial setup of the device. If your mobile operator prepares devices on your behalf, this will impact your ability to join the device to Azure AD. Many IT administrators may start with a desire to set up devices for their employees, but the Azure AD Join experience is optimized for end-users, including the option for automatic MDM enrollment. - By default, Azure AD is set up to allow devices to join and to allow users to use their corporate credentials on organizational-owned devices or personal devices. The blog post [Azure AD Join on Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkID=616791) has more information on where you can review your Azure AD settings. You can configure Azure AD to not allow anyone to join, to allow everyone in your organization to join, or you can select specific Azure AD groups which are allowed to join. + By default, Azure AD is set up to allow devices to join and to allow users to use their corporate credentials on organizational-owned devices or personal devices. The blog post [Azure AD Join on Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkID=616791) has more information on where you can review your Azure AD settings. You can configure Azure AD to not allow anyone to join, to allow everyone in your organization to join, or you can select specific Azure AD groups which are allowed to join. - **Device setup** @@ -79,11 +79,11 @@ An added work account provides the same SSO experience in browser apps like Offi - **Mobile device management** - An MDM service is required for managing Azure AD-joined devices. You can use MDM to push settings to devices, as well as application and certificates used by VPN, Wi-Fi, etc. Azure AD Premium or [Enterprise Mobility Suite (EMS)](http://go.microsoft.com/fwlink/p/?LinkID=723984) licenses are required to set up your Azure AD-joined devices to automatically enroll in MDM. [Learn more about setting up your Azure AD tenant for MDM auto-enrollment.](http://go.microsoft.com/fwlink/p/?LinkID=691615) + An MDM service is required for managing Azure AD-joined devices. You can use MDM to push settings to devices, as well as application and certificates used by VPN, Wi-Fi, etc. Azure AD Premium or [Enterprise Mobility Suite (EMS)](https://go.microsoft.com/fwlink/p/?LinkID=723984) licenses are required to set up your Azure AD-joined devices to automatically enroll in MDM. [Learn more about setting up your Azure AD tenant for MDM auto-enrollment.](https://go.microsoft.com/fwlink/p/?LinkID=691615) - **Microsoft Passport** - Creating a Microsoft Passport (PIN) is required on Windows 10 Mobile by default and cannot be disabled. [You can control Microsoft Passport policies](http://go.microsoft.com/fwlink/p/?LinkId=735079) using controls in MDM, such as Intune. Because the device is joined using organizational credentials, the device must have a PIN to unlock the device. Windows Hello (biometrics such as fingerprint or iris) can be used for Passport authentication. Creating a Microsoft Passport requires the user to perform an multi-factor authentication since the PIN is a strong authentication credential. [Learn more about Microsoft Passport for Azure AD.](http://go.microsoft.com/fwlink/p/?LinkId=735004) + Creating a Microsoft Passport (PIN) is required on Windows 10 Mobile by default and cannot be disabled. [You can control Microsoft Passport policies](https://go.microsoft.com/fwlink/p/?LinkId=735079) using controls in MDM, such as Intune. Because the device is joined using organizational credentials, the device must have a PIN to unlock the device. Windows Hello (biometrics such as fingerprint or iris) can be used for Passport authentication. Creating a Microsoft Passport requires the user to perform an multi-factor authentication since the PIN is a strong authentication credential. [Learn more about Microsoft Passport for Azure AD.](https://go.microsoft.com/fwlink/p/?LinkId=735004) - **Conditional access** diff --git a/windows/manage/lock-down-windows-10-to-specific-apps.md b/windows/manage/lock-down-windows-10-to-specific-apps.md index 71622d4902..a585ae2a4f 100644 --- a/windows/manage/lock-down-windows-10-to-specific-apps.md +++ b/windows/manage/lock-down-windows-10-to-specific-apps.md @@ -108,7 +108,7 @@ In addition to specifying the apps that users can run, you should also restrict   -To learn more about locking down features, see [Customizations for Windows 10 Enterprise](http://go.microsoft.com/fwlink/p/?LinkId=691442). +To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). ## Customize Start screen layout for the device diff --git a/windows/manage/lockdown-features-windows-10.md b/windows/manage/lockdown-features-windows-10.md index 555ec7ab73..c6eaa7e68d 100644 --- a/windows/manage/lockdown-features-windows-10.md +++ b/windows/manage/lockdown-features-windows-10.md @@ -34,33 +34,33 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be - + - - + + - - + + - - + + +

      Learn [how to use Shell Launcher to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Classic Windows application.

      - - + + - + - + +

      MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a [custom OMA-URI setting](https://go.microsoft.com/fwlink/p/?LinkID=616317) for AboveLock/AllowActionCenterNotifications.

      - - + + - + - - + + +

      Learn [how to use Assigned Access to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Universal Windows app.

      - - - + + + - - + + - - + + diff --git a/windows/manage/lockdown-xml.md b/windows/manage/lockdown-xml.md index 08bd7496c7..2e5addcac7 100644 --- a/windows/manage/lockdown-xml.md +++ b/windows/manage/lockdown-xml.md @@ -21,10 +21,10 @@ Windows 10 Mobile allows enterprises to lock down a device, define multiple use This topic provides example XML that you can use in your own lockdown XML file that can be included in a provisioning package or when using a mobile device management (MDM) solution to push lockdown settings to enrolled devices. -Lockdown XML is an XML file that contains settings for Windows 10 Mobile. When you deploy the lockdown XML file to a device, it is saved on the device as **wehlockdown.xml**. When the device boots, it looks for wehlockdown.xml and applies any settings configured in the file. In this topic, you'll learn how to create an XML file that contains all lockdown entries available in the AssignedAccessXml area of the [EnterpriseAssignedAccess configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=618601). +Lockdown XML is an XML file that contains settings for Windows 10 Mobile. When you deploy the lockdown XML file to a device, it is saved on the device as **wehlockdown.xml**. When the device boots, it looks for wehlockdown.xml and applies any settings configured in the file. In this topic, you'll learn how to create an XML file that contains all lockdown entries available in the AssignedAccessXml area of the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). > [!NOTE] -> On Windows 10 desktop editions, *assigned access* is a feature that lets you configure the device to run a single app above the lockscreen ([kiosk mode](set-up-a-device-for-anyone-to-use.md)). On a Windows 10 Mobile device, assigned access refers to the lockdown settings in AssignedAccessXml in the [EnterpriseAssignedAccess configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkID=618601). +> On Windows 10 desktop editions, *assigned access* is a feature that lets you configure the device to run a single app above the lockscreen ([kiosk mode](set-up-a-device-for-anyone-to-use.md)). On a Windows 10 Mobile device, assigned access refers to the lockdown settings in AssignedAccessXml in the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](how-it-pros-can-use-configuration-service-providers.md) first. @@ -266,7 +266,7 @@ In the following example, when a user presses the Search button, the phone diale ![XML for CSP Runner](images/CSPRunnerXML.jpg) -You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](http://go.microsoft.com/fwlink/p/?LinkID=717460) or [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx). +You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkID=717460) or [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx). CSPRunner is helpful when you are configuring a device to support multiple roles. It lets you apply different policies according to the role that is signed on. For example, Wi-Fi could be enabled for a supervisor role and disabled for a stocking clerk role. @@ -378,7 +378,7 @@ For a list of the settings and quick actions that you can allow or block, see [S If you have existing lockdown xml, you must update start screen size if your device has >=400epx on its short axis so that tiles on Start can fill all 8 columns if you want to use all 8 columns instead of 6, or use 6 columns instead of 4. - [Learn about effective pixel width (epx) for different device size classes.](http://go.microsoft.com/fwlink/p/?LinkId=733340) + [Learn about effective pixel width (epx) for different device size classes.](https://go.microsoft.com/fwlink/p/?LinkId=733340) ## Configure additional roles @@ -428,9 +428,9 @@ For a list of the settings and quick actions that you can allow or block, see [S ## Add lockdown XML to a provisioning package -Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) +Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK.](https://go.microsoft.com/fwlink/p/?LinkId=526740) -1. Follow the instructions at [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkID=629651) to create a project, selecting **Common to all Windows mobile editions** for your project. +1. Follow the instructions at [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkID=629651) to create a project, selecting **Common to all Windows mobile editions** for your project. 2. In **Available customizations**, go to **Runtime settings** > **EmbeddedLockdownProfiles** > **AssignedAccessXml**. @@ -467,12 +467,12 @@ Use the Windows ICD tool included in the Windows Assessment and Deployment Kit ( - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. -After you build the provisioning package, follow the instructions for [applying a provisioning package at runtime to Windows 10 Mobile](http://go.microsoft.com/fwlink/p/?LinkID=619164). +After you build the provisioning package, follow the instructions for [applying a provisioning package at runtime to Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=619164). ## Push lockdown XML using MDM -After you deploy your devices, you can still configure lockdown settings through your MDM solution if it supports the [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601). +After you deploy your devices, you can still configure lockdown settings through your MDM solution if it supports the [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601). To push lockdown settings to enrolled devices, use the AssignedAccessXML setting and use the lockdown XML as the value. The lockdown XML will be in a HandheldLockdown section that becomes XML embedded in XML, so the XML that you enter must use escaped characters (such as < in place of <). After the MDM provider pushes your lockdown settings to the device, the CSP processes the file and updates the device. diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index d1bedc3492..44413130fc 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -2,7 +2,7 @@ title: Manage connections from Windows operating system components to Microsoft services (Windows 10) description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 -keywords: privacy, manage connections to Microsoft +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -12,9 +12,12 @@ author: brianlic-msft # Manage connections from Windows operating system components to Microsoft services +[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + **Applies to** - Windows 10 +- Windows Server 2016 If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). @@ -22,127 +25,14 @@ Learn about the network connections that Windows components make to Microsoft an If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. -Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, Windows 10, version 1507, and Windows 10, version 1511. However, you must use Windows 10 Enterprise, version 1607 or Windows 10 Education, version 1607 to manage them all. +You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reason why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. -You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. -We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization. -Here's what's covered in this article: +## What's new in Windows 10, version 1607 and Windows Server 2016 -- [Info management settings](#bkmk-othersettings) - - - [1. Certificate trust lists](#certificate-trust-lists) - - - [2. Cortana](#bkmk-cortana) - - - [2.1 Cortana Group Policies](#bkmk-cortana-gp) - - - [2.2 Cortana MDM policies](#bkmk-cortana-mdm) - - - [2.3 Cortana Windows Provisioning](#bkmk-cortana-prov) - - - [3. Date & Time](#bkmk-datetime) - - - [4. Device metadata retrieval](#bkmk-devinst) - - - [5. Font streaming](#font-streaming) - - - [6. Insider Preview builds](#bkmk-previewbuilds) - - - [7. Internet Explorer](#bkmk-ie) - - - [7.1 Internet Explorer Group Policies](#bkmk-ie-gp) - - - [7.2 ActiveX control blocking](#bkmk-ie-activex) - - - [8. Live Tiles](#live-tiles) - - - [9. Mail synchronization](#bkmk-mailsync) - - - [10. Microsoft Account](#bkmk-microsoft-account) - - - [11. Microsoft Edge](#bkmk-edge) - - - [11.1 Microsoft Edge Group Policies](#bkmk-edgegp) - - - [11.2 Microsoft Edge MDM policies](#bkmk-edge-mdm) - - - [11.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov) - - - [12. Network Connection Status Indicator](#bkmk-ncsi) - - - [13. Offline maps](#bkmk-offlinemaps) - - - [14. OneDrive](#bkmk-onedrive) - - - [15. Preinstalled apps](#bkmk-preinstalledapps) - - - [16. Settings > Privacy](#bkmk-settingssection) - - - [16.1 General](#bkmk-priv-general) - - - [16.2 Location](#bkmk-priv-location) - - - [16.3 Camera](#bkmk-priv-camera) - - - [16.4 Microphone](#bkmk-priv-microphone) - - - [16.5 Notifications](#bkmk-priv-notifications) - - - [16.6 Speech, inking, & typing](#bkmk-priv-speech) - - - [16.7 Account info](#bkmk-priv-accounts) - - - [16.8 Contacts](#bkmk-priv-contacts) - - - [16.9 Calendar](#bkmk-priv-calendar) - - - [16.10 Call history](#bkmk-priv-callhistory) - - - [16.11 Email](#bkmk-priv-email) - - - [16.12 Messaging](#bkmk-priv-messaging) - - - [16.13 Radios](#bkmk-priv-radios) - - - [16.14 Other devices](#bkmk-priv-other-devices) - - - [16.15 Feedback & diagnostics](#bkmk-priv-feedback) - - - [16.16 Background apps](#bkmk-priv-background) - - - [17. Software Protection Platform](#bkmk-spp) - - - [18. Sync your settings](#bkmk-syncsettings) - - - [19. Teredo](#bkmk-teredo) - - - [20. Wi-Fi Sense](#bkmk-wifisense) - - - [21. Windows Defender](#bkmk-defender) - - - [22. Windows Media Player](#bkmk-wmp) - - - [23. Windows spotlight](#bkmk-spotlight) - - - [24. Windows Store](#bkmk-windowsstore) - - - [25. Windows Update Delivery Optimization](#bkmk-updates) - - - [25.1 Settings > Update & security](#bkmk-wudo-ui) - - - [25.2 Delivery Optimization Group Policies](#bkmk-wudo-gp) - - - [25.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm) - - - [25.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov) - - - [26. Windows Update](#bkmk-wu) - -## What's new in Windows 10, version 1607 - -Here's a list of changes that were made to this article for Windows 10, version 1607: +Here's a list of changes that were made to this article for Windows 10, version 1607 and Windows Server 2016: - Added instructions on how to turn off speech recognition and speech synthesis model updates in [14.5 Speech, inking, & typing](#bkmk-priv-speech). - Added instructions on how to turn off flip ahead with an Internet Explorer Group Policy. @@ -156,17 +46,117 @@ Here's a list of changes that were made to this article for Windows 10, version - Turn off unsolicited network traffic on the Offline Maps settings page - Turn off all Windows spotlight features -## Info management settings +## Settings -This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience. +The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. -The settings in this section assume you are using Windows 10, version 1607. They will also be included in the next update for the Long Term Servicing Branch. +If you're running Windows 10, they will be included in the next update for the Long Term Servicing Branch. -See the following table for a summary of the management settings. For more info, see its corresponding section. +### Settings for Windows 10 Enterprise, version 1607 -![Management settings table](images/settings-table.png) +See the following table for a summary of the management settings for Windows 10 Enterprise, version 1607. +| Setting | UI | Group Policy | MDM policy | Registry | Command line | +| - | :-: | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | | | | +| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | | ![Check mark](images/checkmark.png) | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | | +| [5. Font streaming](#font-streaming) | | | | ![Check mark](images/checkmark.png) | | +| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | | | +| [9. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | +| [10. Microsoft Account](#bkmk-microsoft-account) | | | | ![Check mark](images/checkmark.png) | | +| [11. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | | | +| [13. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [15. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [16. Settings > Privacy](#bkmk-settingssection) | | | | | | +|     [16.1 General](#bkmk-priv-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +|     [16.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +|     [16.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.13 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.14 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.15 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.16 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | | | | | +| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [18. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [19. Teredo](#bkmk-teredo) | | | | | ![Check mark](images/checkmark.png) | +| [20. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [22. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [23. Windows spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | | | +| [25. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | + +### Settings for Windows Server 2016 with Desktop Experience + +See the following table for a summary of the management settings for Windows Server 2016 with Desktop Experience. + +| Setting | UI | Group Policy | Registry | Command line | +| - | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | +| [5. Font streaming](#font-streaming) | | | ![Check mark](images/checkmark.png) | | +| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | | +| [10. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | | +| [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | | +| [16. Settings > Privacy](#bkmk-settingssection) | | | | | +|     [16.1 General](#bkmk-priv-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | | | +| [19. Teredo](#bkmk-teredo) | | | | ![Check mark](images/checkmark.png) | +| [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [22. Windows Media Player](#bkmk-wmp) | | | | ![Check mark](images/checkmark.png) | +| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | | +| [26. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | + +### Settings for Windows Server 2016 Server Core + +See the following table for a summary of the management settings for Windows Server 2016 Server Core. + +| Setting | Group Policy | Registry | Command line | +| - | :-: | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | | ![Check mark](images/checkmark.png) | | +| [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | | | +| [17. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | | | +| [19. Teredo](#bkmk-teredo) | | | ![Check mark](images/checkmark.png) | +| [21. Windows Defender](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | + +### Settings for Windows Server 2016 Nano Server + +See the following table for a summary of the management settings for Windows Server 2016 Nano Server. + +| Setting | Registry | Command line | +| - | :-: | :-: | :-: | :-: | :-: | +| [1. Certificate trust lists](#certificate-trust-lists) | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | +| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | +| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | | + +## Settings + +Use the following sections for more information about how to configure each setting. ### 1. Certificate trust lists @@ -174,40 +164,55 @@ A certificate trust list is a predefined list of items, such as a list of certif To turn off the automatic download of an updated certificate trust list, you can turn off automatic root updates, which also includes the disallowed certificate list and the pin rules list. +For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core: + - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Automatic Root Certificates Update** - -or- - -- Create a REG\_DWORD registry setting called **DisableRootAutoUpdate** in **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate**, with a value of 1. - -After that, do the following in a Group Policy: + -and- 1. Navigate to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Public Key Policies**. 2. Double-click **Certificate Path Validation Settings**. 3. On the **Network Retrieval** tab, select the **Define these policy settings** check box. 4. Clear the **Automatically update certificates in the Microsoft Root Certificate Program (recommended)** check box, and then click **OK**. + -or- -### 2. Cortana +- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, called **DisableRootAutoUpdate**, with a value of 1. -Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730683). + -and- -### 2.1 Cortana Group Policies +1. Navigate to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Public Key Policies**. +2. Double-click **Certificate Path Validation Settings**. +3. On the **Network Retrieval** tab, select the **Define these policy settings** check box. +4. Clear the **Automatically update certificates in the Microsoft Root Certificate Program (recommended)** check box, and then click **OK**. + +On Windows Server 2016 Nano Server: + +- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, called **DisableRootAutoUpdate**, with a value of 1. + +>[!NOTE] +>CRL and OCSP network traffic is currently whitelisted and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. + +### 2. Cortana and Search + +Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730683). + +### 2.1 Cortana and Search Group Policies Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**. | Policy | Description | |------------------------------------------------------|---------------------------------------------------------------------------------------| -| Allow Cortana | Choose whether to let Cortana install and run on the device. | -| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. | -| Do not allow web search | Choose whether to search the web from Windows Desktop Search.
      Default: Disabled| -| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. | -| Set what information is shared in Search | Control what information is shared with Bing in Search. | +| Allow Cortana | Choose whether to let Cortana install and run on the device.

      Disable this policy to turn off Cortana. | +| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results.

      Disable this policy to block access to location information for Cortana. | +| Do not allow web search | Choose whether to search the web from Windows Desktop Search.

      Enable this policy to remove the option to search the Internet from Cortana. | +| Don't search the web or display web results in Search| Choose whether to search the web from Cortana.

      Enable this policy to stop web queries and results from showing in Search. | +| Set what information is shared in Search | Control what information is shared with Bing in Search.

      If you enable this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. | -In Windows 10, version 1507 and Windows 10, version 1511, When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. +In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. >[!IMPORTANT] ->These steps are not required for devices running Windows 10, version 1607. +>These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016. 1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. @@ -235,19 +240,15 @@ In Windows 10, version 1507 and Windows 10, version 1511, When you enable the ** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer. -### 2.2 Cortana MDM policies +### 2.2 Cortana and Search MDM policies -The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). +For Windows 10 only, the following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Experience/AllowCortana | Choose whether to let Cortana install and run on the device. | | Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results.
      Default: Allowed| -### 2.3 Cortana Windows Provisioning - -To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**. - ### 3. Date & Time You can prevent Windows from setting the time automatically. @@ -264,16 +265,26 @@ To prevent Windows from retrieving device metadata from the Internet, apply the ### 5. Font streaming -Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. +Fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. -> [!NOTE] -> This may change in future versions of Windows. ### 6. Insider Preview builds -To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. +The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. + +> [!NOTE] +> This setting stops communication with the Windows Insider Preview service that checks for new builds. Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016. + +To turn off Insider Preview builds for a released version of Windows 10: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. + +To turn off Insider Preview builds for Windows 10: + +> [!NOTE] +> If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. - Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Insider Program** > **Stop Insider Preview builds**. @@ -303,11 +314,7 @@ To turn off Insider Preview builds if you're running a released version of Windo ### 7. Internet Explorer -Use Group Policy to manage settings for Internet Explorer. - -### 7.1 Internet Explorer Group Policies - -Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. +Use Group Policy to manage settings for Internet Explorer. You can find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -324,7 +331,7 @@ There are two more Group Policy objects that are used by Internet Explorer: | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
      Default: Enabled | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
      Default: Enabled | -### 7.2 ActiveX control blocking +### 7.1 ActiveX control blocking ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). @@ -358,12 +365,12 @@ To turn off the Windows Mail app: To prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. -- Change the **Start** REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentControlSet\\Services\\wlidsvc** to 4. +- Change the **Start** REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to 4. ### 11. Microsoft Edge -Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682). +Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682). ### 11.1 Microsoft Edge Group Policies @@ -407,17 +414,14 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http | Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions..
      Default: Allowed | | Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off.
      Default: Allowed | -### 11.3 Microsoft Edge Windows Provisioning - -Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**. For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). ### 12. Network Connection Status Indicator -Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). +Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). -In versions of Windows 10 prior to Windows 10, version 1607, the URL was http://www.msftncsi.com. +In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was http://www.msftncsi.com. You can turn off NCSI through Group Policy: @@ -615,7 +619,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Turn off the SmartScreen Filter**. +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure SmartScreen Filter**. Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. @@ -664,6 +668,10 @@ To turn off **Let apps on my other devices open apps and continue experiences on - Turn off the feature in the UI. + -or- + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Continue experiences on this device**. + To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**: - Turn off the feature in the UI. @@ -945,6 +953,10 @@ To turn off **Let apps automatically share and sync info with wireless devices t - Turn off the feature in the UI. + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps sync with devices** + To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: - Turn off the feature in the UI. @@ -1037,16 +1049,24 @@ To turn off **Let apps run in the background**: - Turn off the feature in the UI for each app. + - Set the **Select a setting** box to **Force Deny**. + ### 17. Software Protection Platform Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation** +For Windows 10: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client AVS Validation** -or- - Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled. +For Windows Server 2016 with Desktop Experience or Windows Server 2016 Server Core: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client AVS Validation** + The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. ### 18. Sync your settings @@ -1099,11 +1119,11 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha -or- -- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). +- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620909). -or- -- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). +- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620910). When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. @@ -1115,7 +1135,7 @@ You can disconnect from the Microsoft Antimalware Protection Service. -or- -- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). +- For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). -or- @@ -1131,7 +1151,7 @@ You can stop sending file samples back to Microsoft. -or- -- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: +- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - **0**. Always prompt. @@ -1153,7 +1173,7 @@ You can stop downloading definition updates: - Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. -You can stop Enhanced Notifications: +For Windows 10 only, you can stop Enhanced Notifications: - Turn off the feature in the UI. @@ -1161,7 +1181,7 @@ You can also use the registry to turn off Malicious Software Reporting Tool tele ### 22. Windows Media Player -To remove Windows Media Player: +To remove Windows Media Player on Windows 10: - From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**. @@ -1169,6 +1189,10 @@ To remove Windows Media Player: - Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** +To remove Windows Media Player on Windows Server 2016: + +- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** + ### 23. Windows spotlight Windows spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or through Group Policy. @@ -1212,7 +1236,7 @@ For more info, see [Windows Spotlight on the lock screen](../manage/windows-spot ### 24. Windows Store -You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. +You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. On Windows Server 2016, this will block Windows Store calls from Universal Windows Apps. - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. @@ -1261,7 +1285,7 @@ The following Delivery Optimization MDM policies are available in the [Policy CS If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies -Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. +Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](https://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization. 1. Open Windows ICD, and then click **New provisioning package**. @@ -1271,7 +1295,7 @@ Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windo 4. Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies. -For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684). +For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). ### 26. Windows Update @@ -1294,7 +1318,7 @@ You can turn off automatic updates by doing one of the following. This is not re -or- -- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: +- For Windows 10 only, apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - **0**. Notify the user before downloading the update. diff --git a/windows/manage/manage-corporate-devices.md b/windows/manage/manage-corporate-devices.md index c3bdd6979a..f96628d60a 100644 --- a/windows/manage/manage-corporate-devices.md +++ b/windows/manage/manage-corporate-devices.md @@ -8,7 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Manage corporate devices @@ -34,7 +34,7 @@ Your employees using devices that are owned by the organization can connect to A You can join a device running Windows 10 to an on-premises Active Directory domain after the first-run experience (sometimes called out-of-box experience or OOBE). You can add devices running Windows 10 to your existing Active Directory infrastructure and manage them just as you've always been used to managing PCs running Windows. -Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center 2012 R2 Configuration Manager. The following table shows the management support for Windows 10 in Configuration Manager. +Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center Configuration Manager (current branch). The following table shows the management support for Windows 10 in Configuration Manager.

      No Feature Block 1 (FB1, also known as Primary FB)

      No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch.If there are network limitations, FB1 will:

      +

      No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch. If there are network limitations, FB1 will:

      • Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.

      • Delay launch until the entire FB1 has been streamed.

        • @@ -540,9 +531,9 @@ Removing FB1 does not require the original application installer. After completi 3. Move to **Create Package**. -**PowerShell** - Update an Existing Virtual Application Package. +**Windows PowerShell** - Update an Existing Virtual Application Package. -1. Open an elevated PowerShell session. +1. Open an elevated Windows PowerShell session. 2. Import-module **appvsequencer**. @@ -623,7 +614,7 @@ When publishing a virtual application package, the App-V Client will detect if a   -### Disabling a Dynamic Configuration using Powershell +### Disabling a Dynamic Configuration by using Windows Powershell - For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without @@ -635,9 +626,9 @@ When publishing a virtual application package, the App-V Client will detect if a For documentation on How to Apply a Dynamic Configuration, see: -- [How to Apply the User Configuration File by Using PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) +- [How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md) -- [How to Apply the Deployment Configuration File by Using PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) +- [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md) @@ -657,7 +648,7 @@ For documentation on How to Apply a Dynamic Configuration, see: - @@ -681,18 +672,15 @@ For documentation on How to Apply a Dynamic Configuration, see: - Open AppxManifest.xml and locate the following: - <appv:Extension Category="AppV.Fonts"> + ``` + + + + + ``` - <appv:Fonts> + **Note**  If there are fonts marked as **DelayLoad**, those will not impact first launch. - <appv:Font Path="\[{Fonts}\]\\private\\CalibriL.ttf" DelayLoad="true"></appv:Font> - - **Note**   - If there are fonts marked as **DelayLoad**, those will not impact first launch. - -   - - </appv:Fonts> ### Excluding virtual fonts from the package @@ -702,11 +690,11 @@ Use the dynamic configuration file that best suits the user scope – deployment Fonts ---> - -<Fonts Enabled="false" /> - -<!-- +``` +--> + + - -Ensure newly added machine/ user is entitled to receive packages from the server configure in step #2. - -Sync and verify packages and/or connection groups pushed by the App-V server function correctly. - -Validate other package management commands (unpublish, remove etc.). - - - ## Verify that the in-box App-V client can receive and launch .appv packages 1. Add and publish a package using the following Windows PowerShell cmdlets: @@ -102,4 +95,4 @@ Validate other package management commands (unpublish, remove etc.). ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file diff --git a/windows/manage/appv-using-the-client-management-console.md b/windows/manage/appv-using-the-client-management-console.md index 64affa5f4b..c029733b1d 100644 --- a/windows/manage/appv-using-the-client-management-console.md +++ b/windows/manage/appv-using-the-client-management-console.md @@ -11,25 +11,38 @@ ms.prod: w10 # Using the App-V Client Management Console +**Applies to** +- Windows 10, version 1607 -This topic provides information about how you can configure and manage the Microsoft Application Virtualization (App-V) client. +This topic provides information about about using the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client. -## Modify App-V client configuration +## Obtain the client management console +The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=41186). -The App-V client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client or by using PowerShell or Group Policy. For more information about how to modify the client using PowerShell or Group Policy configuration see, [How to Modify Client Configuration by Using PowerShell](appv-modify-client-configuration-with-powershell.md). +> [!NOTE] +To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V client. + +## Options for managing the App-V client + +The App-V client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client, or you can use Windows PowerShell or Group Policy. For more information about configuring the client by using Windows PowerShell or Group Policy, see: + +- [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) + +- [How to Modify Client Configuration by Using Windows PowerShell](appv-modify-client-configuration-with-powershell.md) + +- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) ## The App-V client management console - -You can obtain information about the App-V client or perform specific tasks by using the App-V client management console. Many of the tasks that you can perform in the client management console you can also perform by using PowerShell. The associated PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use PowerShell, see [Administering App-V by Using PowerShell](appv-administering-appv-with-powershell.md). +You can obtain information about the App-V client or perform specific tasks by using the App-V client management console. Many of the tasks that you can perform in the client management console you can also perform by using Windows PowerShell. The associated Windows PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use Windows PowerShell, see [Administering App-V by Using Windows PowerShell](appv-administering-appv-with-powershell.md). The client management console contains the following described main tabs.

        Account for Synchronous Script Execution during Package Lifecycle.

        If script collateral is embedded in the package, Add (Powershell) may be significantly slower.

        +

        If script collateral is embedded in the package, Add cmdlets may be significantly slower.

        Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.

        Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.

        This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.

        --++ @@ -45,10 +58,10 @@ The client management console contains the following described main tabs.

      • Update – Use the Update tile to refresh a virtualized application or to receive a new virtualized package.

        The Last Refresh displays the current version of the virtualized package.

      • Download all virtual applications – Use the Download tile to download all of the packages provisioned to the current user.

        -

        (Associated PowerShell cmdlet: Mount-AppvClientPackage)

        +

        (Associated Windows PowerShell cmdlet: Mount-AppvClientPackage)

      • Work Offline – Use this tile to disallow all automatic and manual virtual application updates.

        -

        (Associated PowerShell cmdlet: Set-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled)

        • +

        (Associated Windows PowerShell cmdlet: Set-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled)

        @@ -59,33 +72,17 @@ The client management console contains the following described main tabs.

        App Connection Groups

        The APP CONNECTION GROUPS tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group.

        -

        (Associated PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.)

        +

        (Associated Windows PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.)
        -  - -[How to Access the Client Management Console](appv-accessing-the-client-management-console.md) - -[How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](appv-configure-the-client-to-receive-updates-from-the-publishing-server.md) - ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md index 5a89f2304c..be5ea2635f 100644 --- a/windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ b/windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md @@ -11,6 +11,8 @@ ms.prod: w10 # How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console +**Applies to** +- Windows 10, version 1607 Use the following procedure to view and configure default package extensions. @@ -28,18 +30,10 @@ Use the following procedure to view and configure default package extensions. 5. To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Operations for App-V](appv-operations.md) - -  - -  - - - - - diff --git a/windows/manage/appv-viewing-appv-server-publishing-metadata.md b/windows/manage/appv-viewing-appv-server-publishing-metadata.md index abfc25f877..c56544ab71 100644 --- a/windows/manage/appv-viewing-appv-server-publishing-metadata.md +++ b/windows/manage/appv-viewing-appv-server-publishing-metadata.md @@ -11,136 +11,67 @@ ms.prod: w10 # Viewing App-V Server Publishing Metadata +**Applies to** +- Windows Server 2016 -Use this procedure to view publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. +Use this procedure to view App-V Server publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. This article contains the following information: -- [App-V requirements for viewing publishing metadata](#bkmk-51-reqs-pub-meta) +- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) - [Syntax to use for viewing publishing metadata](#bkmk-syntax-view-pub-meta) -- [Query values for client operating system and version](#bkmk-values-query-pub-meta) +- [Query values for client operating system](#bkmk-values-query-pub-meta) -- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) +## Definition of publishing metadata -## App-V requirements for viewing publishing metadata +When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: +- Packages and connection groups that are entitled to the client computer. -In App-V, you must provide the following values in the address when you query the App-V Publishing server for metadata: +- Packages and connection groups that are entitled to the current user. - ---- - - - - - - - - - - - - - - - - -
        ValueAdditional details

        ClientVersion

        If you omit the ClientVersion parameter from the query, the metadata excludes the features that were new in App-V 5.0 SP3.

        ClientOS

        You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query.

        -

        If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata.

        +The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. -  +You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. ## Query syntax for viewing publishing metadata +This section provides information about queries for viewing publishing metadata for App-V 5.0 SP3 Server and App-V 5.1 server. The App-V server components have not changed since App-V 5.0 was released, so App-V 5.x Server is the version of the server used with App-V for Windows 10. -The following table provides the syntax and query examples. +**Query syntax** - ------ - - - - - - - - - - - - - - - - - - - - - - -
        Version of App-VQuery syntaxParameter descriptionsExample

        App-V 5.0 SP3 and App-V

        http://<PubServer>:<Publishing Port#>/?ClientVersion=<AppvClientVersion>&ClientOS=<OSStringValue>

        		 ---- - - - - - - - - - - - - - - - - - - - - - - - - -
        ParameterDescription

        <PubServer>

        Name of the App-V Publishing server.

        <Publishing Port#>

        Port to the App-V Publishing server, which you defined when you configured the Publishing server.

        ClientVersion=<AppvClientVersion>

        Version of the App-V client. Refer to the following table for the correct value to use.

        ClientOS=<OSStringValue>

        Operating system of the computer that is running the App-V client. Refer to the following table for the correct value to use.

        -

         

        -

        To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet.

        http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64

        -

        In the example:

        -
          -

        • A Windows Server 2012 R2 named “pubsvr01” hosts the Publishing service.

          • -

        • The Windows client is Windows 8.1 64-bit.

          • -

        App-V 5.0 through App-V 5.0 SP2

        http://<PubServer>:<Publishing Port#>/

        -
        -Note   -

        ClientVersion and ClientOS are supported only in App-V 5.0 SP3 and App-V.

        -
        -
        -  -

        See the information for App-V 5.0 SP3 and App-V.

        http://pubsvr01:2718

        -

        In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services.

        +`http://:/?ClientVersion=&ClientOS=` -  +For information about the variables in this syntax, see the table that follows. -## Query values for client operating system and version +**Query example** +`http://pubsvr01:2718/?ClientVersion=10.0.14393&ClientOS=WindowsClient_10.0_x64` -In your publishing metadata query, enter the string values that correspond to the client operating system and version that you’re using. +In this example: + +- A computer running Windows Server 2016 named “pubsvr01” hosts the Publishing service. + +- The Windows client is Windows 10, 64-bit. + +**Query parameter descriptions** + +The following table describes the parameters shown in the preceding **Query syntax**. + +| Parameter | Description | +|------------|---------------| +| `` | Name of the App-V Publishing server. | +| `` | Port to the App-V Publishing server, which you defined when you configured the Publishing server. | +| `ClientVersion=` | Windows 10 build number. You can obtain this number by running the following Windows PowerShell command:
        `(Get-CimInstance Win32_OperatingSystem).version` | +| `ClientOS=` | Operating system of the computer that is running the App-V client. Refer to the table that follows for the correct value.
        You can omit this parameter, with the result that only the packages that were sequenced to support all operating systems will appear in the metadata. | + +To get the name of the Publishing server and the port number (`http://:`) from the App-V client, look at the URL configuration of the Get-AppvPublishingServer Windows PowerShell cmdlet. + +## Query values for client operating system + +In your publishing metadata query, enter the string values that correspond to the client operating system that you’re using. @@ -207,16 +138,6 @@ In your publishing metadata query, enter the string values that correspond to th - - - - - - - - - - @@ -229,36 +150,11 @@ In your publishing metadata query, enter the string values that correspond to th

        WindowsServer_6.2_x86

        Windows 7

        64-bit

        WindowsClient_6.1_x64

        Windows 7

        32-bit

        WindowsClient_6.1_x86

        Windows Server 2008 R2

        64-bit

        WindowsServer_6.1_x64
        -  - -## Definition of publishing metadata - - -When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: - -- Packages and connection groups that are entitled to the client computer. - -- Packages and connection groups that are entitled to the current user. - -The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. - -You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. ## Have a suggestion for App-V? - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions on the [Application Virtualization feedback site](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
        For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Technical Reference for App-V](appv-technical-reference.md) - -  - -  - - - - - diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index 67f0217f4c..371cdedb8d 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -12,12 +12,23 @@ author: jdeckerMS This topic lists new and updated topics in the [Manage and update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## September 2016 + +| New or changed topic | Description | +| --- | --- | +| [Lockdown features from Windows Embedded 8.1 Industry](lockdown-features-windows-10.md) | Added Group Policy setting to replace Gesture Filter | +| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added content for Windows Server 2016 | +| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated the script for setting a custom shell using Shell Launcher. | ## August 2016 | New or changed topic | Description | | --- | --- | -| [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Updated sample XML for combined Start and taskbar layout | +| [Create mandatory user profiles](mandatory-user-profile.md) | New | +| [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Updated sample XML for combined Start and taskbar layout; added note to explain the difference between applying taskbar configuration by Group Policy and by provisioning package | +| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated instructions for exiting assigned access mode. | +| Application development for Windows as a service | Topic moved to MSDN: [Application development for Windows as a service](https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service) + ## RELEASE: Windows 10, version 1607 @@ -91,7 +102,7 @@ The topics in this library have been updated for Windows 10, version 1607 (also | ---|---| | [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) | New | | [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) | New | -|[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | New | +| [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | New | ## November 2015 diff --git a/windows/manage/changes-to-start-policies-in-windows-10.md b/windows/manage/changes-to-start-policies-in-windows-10.md index ad0589981e..743009e354 100644 --- a/windows/manage/changes-to-start-policies-in-windows-10.md +++ b/windows/manage/changes-to-start-policies-in-windows-10.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Changes to Group Policy settings for Windows 10 Start @@ -55,7 +55,7 @@ These policy settings are available in **Administrative Templates\\Start Menu an
      Prevent users from customizing their Start Screen

      Use this policy in conjunction with [CopyProfile](http://go.microsoft.com/fwlink/p/?LinkId=623229) or other methods for configuring the layout of Start to prevent users from changing it

      Use this policy in conjunction with [CopyProfile](https://go.microsoft.com/fwlink/p/?LinkId=623229) or other methods for configuring the layout of Start to prevent users from changing it
      Prevent users from uninstalling applications from Start

      Store for Business has thousands of apps from many different categories.

      [Acquire apps in the Windows Store for Business](acquire-apps-windows-store-for-business.md)

      You can acquire apps from the Windows Store for Business for your employees.

      [Working with line-of-business apps](working-with-line-of-business-apps.md)

      Your company can make line-of-business (LOB) applications available through Store for Business. These apps are custom to your company – they might be internal business apps, or apps specific to your business or industry.

      [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)

      The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.

      [Manage corporate devices](manage-corporate-devices.md)

      You can use the same management tools to manage all device types running Windows 10 : desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.

      The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.

      [Manage corporate devices](manage-corporate-devices.md)

      You can use the same management tools to manage all device types running Windows 10: desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.

      [Windows Spotlight on the lock screen](windows-spotlight.md)

      [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)

      Organizations might want to deploy a customized Start screen and menu to devices running Windows 10 Enterprise or Windows 10 Education. A standard Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes.

      [Create mandatory user profiles](mandatory-user-profile.md)

      Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings.

      [Lock down Windows 10](lock-down-windows-10.md)

      Enterprises often need to manage how people use corporate devices. Windows 10 provides a number of features and methods to help you lock down specific parts of a Windows 10 device.

      [Configure devices without MDM](configure-devices-without-mdm.md)

      Create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile, or Windows 10 Mobile Enterprise.

      [Windows 10 servicing options](introduction-to-windows-10-servicing.md)

      This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and Windows 10 IoT Core (IoT Core) and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles.

      [Application development for Windows as a service](application-development-for-windows-as-a-service.md)

      In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation, development, and delivery called [Windows as a service (WaaS)](introduction-to-windows-10-servicing.md). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle and provide feedback to Microsoft through an iterative methodology called flighting.

      [Windows 10 servicing options](introduction-to-windows-10-servicing.md)This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and Windows 10 IoT Core (IoT Core) and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles.

      [Application Virtualization for Windows (App-V)](appv-for-windows.md)

      When you deploy Application Virtualization (App-V) in your orgnazation, you can deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Windows Store, and interact with them as if they were installed locally.

      [Hibernate Once/Resume Many (HORM)](http://go.microsoft.com/fwlink/p/?LinkId=626758): Quick boot to device

      [Hibernate Once/Resume Many (HORM)](https://go.microsoft.com/fwlink/p/?LinkId=626758): Quick boot to device

      		 N/A

      HORM is supported in Windows 10, version 1607.

      [Unified Write Filter](http://go.microsoft.com/fwlink/p/?LinkId=626757): protect a device's physical storage media

      		[Unified Write Filter](http://go.microsoft.com/fwlink/p/?LinkId=626607)

      [Unified Write Filter](https://go.microsoft.com/fwlink/p/?LinkId=626757): protect a device's physical storage media

      		[Unified Write Filter](https://msdn.microsoft.com/en-us/library/windows/hardware/mt572001.aspx)

      The Unified Write Filter is continued in Windows 10, with the exception of HORM which has been deprecated.

      [Keyboard Filter]( http://go.microsoft.com/fwlink/p/?LinkId=626761): block hotkeys and other key combinations

      		[Keyboard Filter](http://go.microsoft.com/fwlink/p/?LinkId=708391)

      [Keyboard Filter]( https://go.microsoft.com/fwlink/p/?LinkId=626761): block hotkeys and other key combinations

      		[Keyboard Filter](https://go.microsoft.com/fwlink/p/?LinkId=708391)

      Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via Turn Windows Features On/Off. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.

      [Shell Launcher](http://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Classic Windows application on sign-on

      		[Shell Launcher](http://go.microsoft.com/fwlink/p/?LinkId=618603)

      [Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Classic Windows application on sign-on

      		[Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=618603)

      Shell Launcher continues in Windows 10. It is now configurable in Windows ICD under the SMISettings category.

      -

      Learn [how to use Shell Launcher to create a kiosk device](http://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Classic Windows application.

      [Application Launcher]( http://go.microsoft.com/fwlink/p/?LinkId=626675): launch a Universal Windows Platform (UWP) app on sign-on

      		[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608)

      [Application Launcher]( https://go.microsoft.com/fwlink/p/?LinkId=626675): launch a Universal Windows Platform (UWP) app on sign-on

      		[Assigned Access](https://go.microsoft.com/fwlink/p/?LinkId=626608)

      The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.

      [Dialog Filter](http://go.microsoft.com/fwlink/p/?LinkId=626762): suppress system dialogs and control which processes can run

      [Dialog Filter](https://go.microsoft.com/fwlink/p/?LinkId=626762): suppress system dialogs and control which processes can run

      		 [AppLocker](../keep-secure/applocker-overview.md)

      Dialog Filter has been deprecated for Windows 10. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.

        @@ -69,44 +69,44 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be

      [Toast Notification Filter]( http://go.microsoft.com/fwlink/p/?LinkId=626673): suppress toast notifications

      [Toast Notification Filter]( https://go.microsoft.com/fwlink/p/?LinkId=626673): suppress toast notifications

      		 Mobile device management (MDM) and Group Policy

      Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of non-critical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps.

      Group Policy: User Configuration > Administrative Templates > Start Menu and Taskbar > Notifications

      -

      MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a [custom OMA-URI setting](http://go.microsoft.com/fwlink/p/?LinkID=616317) for AboveLock/AllowActionCenterNotifications.

      [Embedded Lockdown Manager](http://go.microsoft.com/fwlink/p/?LinkId=626763): configure lockdown features

      		[Windows Imaging and Configuration Designer (ICD)](http://go.microsoft.com/fwlink/p/?LinkID=525483)

      [Embedded Lockdown Manager](https://go.microsoft.com/fwlink/p/?LinkId=626763): configure lockdown features

      		[Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkID=525483)

      The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.

      [USB Filter](http://go.microsoft.com/fwlink/p/?LinkId=626674): restrict USB devices and peripherals on system

      [USB Filter](https://go.microsoft.com/fwlink/p/?LinkId=626674): restrict USB devices and peripherals on system

      		 MDM and Group Policy

      The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.

      Group Policy: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

      MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow removable storage or Allow USB connection (Windows 10 Mobile only).

      [Assigned Access](http://go.microsoft.com/fwlink/p/?LinkID=613653): launch a UWP app on sign-in and lock access to system

      		[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608)

      [Assigned Access](https://go.microsoft.com/fwlink/p/?LinkID=613653): launch a UWP app on sign-in and lock access to system

      		[Assigned Access](https://go.microsoft.com/fwlink/p/?LinkId=626608)

      Assigned Access has undergone significant improvement for Windows 10. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and non-critical system notifications, but it also applied some of these limitations to other accounts on the device.

      In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.

      -

      Learn [how to use Assigned Access to create a kiosk device](http://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Universal Windows app.

      [Gesture Filter](http://go.microsoft.com/fwlink/p/?LinkId=626672): block swipes from top, left, and right edges of screen

      		[Assigned Access](http://go.microsoft.com/fwlink/p/?LinkId=626608)

      The capabilities of Gesture Filter have been consolidated into Assigned Access for Windows 10. In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. For Windows 10, Charms have been removed, and blocking the closing or switching of apps is part of Assigned Access.

      [Gesture Filter](https://go.microsoft.com/fwlink/p/?LinkId=626672): block swipes from top, left, and right edges of screen

      		MDM and Group Policy

      In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the [Allow edge swipe](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#LockDown_AllowEdgeSwipe) policy.

      [Custom Logon]( http://go.microsoft.com/fwlink/p/?LinkId=626759): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown

      		[Embedded Logon](http://go.microsoft.com/fwlink/p/?LinkId=626760)

      [Custom Logon]( https://go.microsoft.com/fwlink/p/?LinkId=626759): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown

      		[Embedded Logon](https://go.microsoft.com/fwlink/p/?LinkId=626760)

      No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.

      [Unbranded Boot](http://go.microsoft.com/fwlink/p/?LinkId=626872): custom brand a device by removing or replacing Windows boot UI elements

      		[Unbranded Boot](http://go.microsoft.com/fwlink/p/?LinkId=626873)

      [Unbranded Boot](https://go.microsoft.com/fwlink/p/?LinkId=626872): custom brand a device by removing or replacing Windows boot UI elements

      		[Unbranded Boot](https://go.microsoft.com/fwlink/p/?LinkId=626873)

      No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.
      @@ -49,7 +49,7 @@ Desktop devices running Windows 10 that are joined to an Active Directory domai - + @@ -71,7 +71,7 @@ Devices joined to Azure AD can be managed using Microsoft Intune or other mobile ![mdm options for mobile, desktop, and iot through device lifecycle](images/mdm.png) -For flexibility in identity and management, you can combine Active Directory and Azure AD. Learn about [integrating Active Directory and Azure Active Directory for a hybrid identity solution](http://go.microsoft.com/fwlink/p/?LinkId=613209). +For flexibility in identity and management, you can combine Active Directory and Azure AD. Learn about [integrating Active Directory and Azure Active Directory for a hybrid identity solution](https://go.microsoft.com/fwlink/p/?LinkId=613209). ## How setting conflicts are resolved @@ -92,7 +92,7 @@ When setting values that do not have a security implication conflict, last write Devices running Windows 10 include a built-in agent that can be used by MDM servers to enroll and manage devices. MDM servers do not need to create a separate agent or client to install on devices running Windows 10. -For more information about the MDM protocols, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkID=533172). +For more information about the MDM protocols, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkID=533172). ## Learn more @@ -100,19 +100,19 @@ For more information about the MDM protocols, see [Mobile device management](htt [Azure AD, Microsoft Intune and Windows 10 - Using the cloud to modernize enterprise mobility](https://blogs.technet.microsoft.com/enterprisemobility/2015/06/12/azure-ad-microsoft-intune-and-windows-10-using-the-cloud-to-modernize-enterprise-mobility/) -[Microsoft Intune End User Enrollment Guide](http://go.microsoft.com/fwlink/p/?LinkID=617169) +[Microsoft Intune End User Enrollment Guide](https://go.microsoft.com/fwlink/p/?LinkID=617169) -[Azure AD Join on Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkId=616791) +[Azure AD Join on Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616791) -[Azure AD support for Windows 10](http://go.microsoft.com/fwlink/p/?LinkID=615765) +[Azure AD support for Windows 10](https://go.microsoft.com/fwlink/p/?LinkID=615765) -[Windows 10 and Azure Active Directory: Embracing the Cloud](http://go.microsoft.com/fwlink/p/?LinkId=615768) +[Windows 10 and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) -[How to manage Windows 10 devices using Intune](http://go.microsoft.com/fwlink/p/?LinkId=613620) +[How to manage Windows 10 devices using Intune](https://go.microsoft.com/fwlink/p/?LinkId=613620) -[Using Intune alone and with Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=613207) +[Using Intune alone and with Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=613207) -Microsoft Virtual Academy course: [System Center 2012 R2 Configuration Manager & Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=613208) +Microsoft Virtual Academy course: [System Center 2012 R2 Configuration Manager & Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=613208) ## Related topics diff --git a/windows/manage/manage-cortana-in-enterprise.md b/windows/manage/manage-cortana-in-enterprise.md index 7b756a7a18..36b77add2e 100644 --- a/windows/manage/manage-cortana-in-enterprise.md +++ b/windows/manage/manage-cortana-in-enterprise.md @@ -15,6 +15,8 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. ## Cortana integration with Office 365 @@ -24,27 +26,27 @@ But Cortana works even harder when she connects to Office 365, helping employees **More info:** -- For specific info about what you need to know as a company administrator, including how to turn off Cortana with Office 365, see the [Cortana integration with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=717378) support topic. +- For specific info about what you need to know as a company administrator, including how to turn off Cortana with Office 365, see the [Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717378) support topic. -- For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=717379). +- For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717379). ## Cortana and Power BI Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana answers using the full capabilities of Power BI Desktop. **More info:** -- For specific info about how to start using Power BI and Cortana integration, how to customize your data results, and how to use the “Hey Cortana” functionality, see the [Power BI: Announcing Power BI integration with Cortana and new ways to quickly find insights in your data](http://go.microsoft.com/fwlink/p/?LinkId=717382) blog. +- For specific info about how to start using Power BI and Cortana integration, how to customize your data results, and how to use the “Hey Cortana” functionality, see the [Power BI: Announcing Power BI integration with Cortana and new ways to quickly find insights in your data](https://go.microsoft.com/fwlink/p/?LinkId=717382) blog. ## Cortana and Microsoft Dynamics CRM Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. **More info:** -- For more info about Preview features, see [What are Preview features and how do I enable them?](http://go.microsoft.com/fwlink/p/?LinkId=746817). -- For more info about Cortana, see [What is Cortana?](http://go.microsoft.com/fwlink/p/?LinkId=746818). -- For more info about CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](http://go.microsoft.com/fwlink/p/?LinkId=746819). +- For more info about Preview features, see [What are Preview features and how do I enable them?](https://go.microsoft.com/fwlink/p/?LinkId=746817). +- For more info about Cortana, see [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818). +- For more info about CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](https://go.microsoft.com/fwlink/p/?LinkId=746819). ## Cortana and privacy -We understand that there are concerns about Cortana and enterprise privacy, so we’ve put together the [Cortana, Search, and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=717383) topic that covers many of the frequently asked questions. These questions include things such as what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. +We understand that there are concerns about Cortana and enterprise privacy, so we’ve put together the [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=717383) topic that covers many of the frequently asked questions. These questions include things such as what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. ## Set up Cortana using Group Policy and MDM policies Set up and manage Cortana by using the following Group Policy and mobile device management (MDM) policies. @@ -62,11 +64,11 @@ Set up and manage Cortana by using the following Group Policy and mobile device |Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana |Experience/AllowCortana |Specifies whether employees can use Cortana.

      **Important**
      Cortana won’t work if this setting is turned off (disabled). However, employees can still perform local searches even with Cortana turned off. | **More info:** -- For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=717381). +- For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=717381). ## Related topics -- [Cortana and Windows](http://go.microsoft.com/fwlink/p/?LinkId=717384) -- [Cortana for developers](http://go.microsoft.com/fwlink/p/?LinkId=717385) +- [Cortana and Windows](https://go.microsoft.com/fwlink/p/?LinkId=717384) +- [Cortana for developers](https://go.microsoft.com/fwlink/p/?LinkId=717385)   diff --git a/windows/manage/manage-tips-and-suggestions.md b/windows/manage/manage-tips-and-suggestions.md index f64642592b..2fbb2e3cda 100644 --- a/windows/manage/manage-tips-and-suggestions.md +++ b/windows/manage/manage-tips-and-suggestions.md @@ -7,7 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Manage Windows 10 and Windows Store tips, tricks, and suggestions diff --git a/windows/manage/manage-users-and-groups-windows-store-for-business.md b/windows/manage/manage-users-and-groups-windows-store-for-business.md index e445c7f72b..23783a767d 100644 --- a/windows/manage/manage-users-and-groups-windows-store-for-business.md +++ b/windows/manage/manage-users-and-groups-windows-store-for-business.md @@ -33,20 +33,20 @@ Azure AD is an Azure service that provides identity and access management capabi - Integrate with on-premises Active Directory. -For more information on Azure AD, see [About Office 365 and Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](http://go.microsoft.com/fwlink/p/?LinkId=708611). +For more information on Azure AD, see [About Office 365 and Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](https://go.microsoft.com/fwlink/p/?LinkId=708611). ## Add user accounts to your Azure AD directory If you created a new Azure AD directory when you signed up for Store for Business, you'll have a directory set up with one user account - the global administrator. That global administrator can add user accounts to your Azure AD directory. However, adding user accounts to your Azure AD directory will not give those employees access to Store for Business. You'll need to assign Store for Business roles to your employees. For more information, see [Roles and permissions in the Store for Business.](roles-and-permissions-windows-store-for-business.md) -You can use the [Office 365 admin dashboard](http://go.microsoft.com/fwlink/p/?LinkId=708616) or [Azure management portal](http://go.microsoft.com/fwlink/p/?LinkId=691086) to add user accounts to your Azure AD directory. If you'll be using Azure management portal, you'll need an active subscription to [Azure management portal](http://go.microsoft.com/fwlink/p/?LinkId=708617). +You can use the [Office 365 admin dashboard](https://go.microsoft.com/fwlink/p/?LinkId=708616) or [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=691086) to add user accounts to your Azure AD directory. If you'll be using Azure management portal, you'll need an active subscription to [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=708617). For more information, see: -- [Add user accounts using Office 365 admin dashboard](http://go.microsoft.com/fwlink/p/?LinkId=708618) +- [Add user accounts using Office 365 admin dashboard](https://go.microsoft.com/fwlink/p/?LinkId=708618) -- [Add user accounts using Azure management portal](http://go.microsoft.com/fwlink/p/?LinkId=708619) +- [Add user accounts using Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=708619)   diff --git a/windows/manage/manage-wifi-sense-in-enterprise.md b/windows/manage/manage-wifi-sense-in-enterprise.md index 6f26bd1a70..6f0d6a2526 100644 --- a/windows/manage/manage-wifi-sense-in-enterprise.md +++ b/windows/manage/manage-wifi-sense-in-enterprise.md @@ -17,6 +17,8 @@ localizationpriority: medium - Windows 10 - Windows 10 Mobile +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). + Wi-Fi Sense learns about open Wi-Fi hotspots your Windows PC or Windows phone connects to by collecting information about the network, like whether the open Wi-Fi network has a high-quality connection to the Internet. By using that information from your device and from other Wi-Fi Sense customers' devices too, Wi-Fi Sense builds a database of these high-quality networks. When you’re in range of one of these Wi-Fi hotspots, you automatically get connected to it. The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your PC with Windows 10. @@ -50,7 +52,7 @@ You can manage your Wi-Fi Sense settings by using registry keys and the Registry 1. Open your Registry Editor and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config\` 2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**. -

      Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see [How to configure Wi-Fi Sense on Windows 10 in an enterprise](http://go.microsoft.com/fwlink/p/?LinkId=620959). +

      Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see [How to configure Wi-Fi Sense on Windows 10 in an enterprise](https://go.microsoft.com/fwlink/p/?LinkId=620959). ![Registry Editor, showing the creation of a new DWORD value](images/wifisense-registry.png) @@ -60,7 +62,7 @@ You can manage your Wi-Fi Sense settings by changing the Windows provisioning se **To set up Wi-Fi Sense using WiFISenseAllowed** - Change the Windows Provisioning setting, **WiFISenseAllowed**, to **0**. -

      Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620909). +

      Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620909). ### Using Unattended Windows Setup settings If your company still uses Unattend, you can manage your Wi-Fi Sense settings by changing the Unattended Windows Setup setting, **WiFiSenseAllowed**. @@ -68,7 +70,7 @@ If your company still uses Unattend, you can manage your Wi-Fi Sense settings by **To set up Wi-Fi Sense using WiFISenseAllowed** - Change the Unattended Windows Setup setting, **WiFISenseAllowed**, to **0**. -

      Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, [WiFiSenseAllowed](http://go.microsoft.com/fwlink/p/?LinkId=620910). +

      Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620910). ### How employees can change their own Wi-Fi Sense settings If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. @@ -84,8 +86,8 @@ Even if you selected **Automatically connect to networks shared by your contacts If you select the **Share network with my contacts** check box the first time you connect to a new network, the network won’t be shared. ## Related topics -- [Wi-Fi Sense and Privacy](http://go.microsoft.com/fwlink/p/?LinkId=620911) -- [How to configure Wi-Fi Sense on Windows 10 in an enterprise](http://go.microsoft.com/fwlink/p/?LinkId=620959) +- [Wi-Fi Sense and Privacy](https://go.microsoft.com/fwlink/p/?LinkId=620911) +- [How to configure Wi-Fi Sense on Windows 10 in an enterprise](https://go.microsoft.com/fwlink/p/?LinkId=620959)   diff --git a/windows/manage/mandatory-user-profile.md b/windows/manage/mandatory-user-profile.md new file mode 100644 index 0000000000..5a19dddc3e --- /dev/null +++ b/windows/manage/mandatory-user-profile.md @@ -0,0 +1,171 @@ +--- +title: Create mandatory user profiles (Windows 10) +description: A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. +keywords: [".man","ntuser"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +--- + +# Create mandatory user profiles + + +**Applies to** + +- Windows 10 + +> [!NOTE] +> When a mandatory profile is applied to a PC running Windows 10, version 1511, some features such as Universal Windows Platform (UWP) apps, the Start menu, Cortana, and Search, will not work correctly. This will be fixed in a future update. + +A mandatory user profile is a roaming user profile that has been pre-configured by an administrators to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. + +Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. + +When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. + +User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. + + +## Profile extension for each Windows version + +The name of the folder in which you store the mandatory profile must use the correct extension for the operating system it will be applied to. The following table lists the correct extension for each operating system version. + +| Client operating system version | Server operating system version | Profile extension | +| --- | --- | --- | +| Windows XP | Windows Server 2003
      Windows Server 2003 R2 | none | +| Windows Vista
      Windows 7 | Windows Server 2008
      Windows Server 2008 R2 | v2 | +| Windows 8 | Windows Server 2012 | v3 | +| Windows 8.1 | Windows Server 2012 R2 | v4 | +| Windows 10, versions 1507 and 1511 | N/A | v5 | +| Windows 10, version 1607 (also known as the Anniversary Update) | Windows Server 2016 | v6 | + +For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). + +## How to create a mandatory user profile + +First, you create a default user profile with the customizations that you want, run Sysprep with CopyProfile set to **True** in the answer file, copy the customized default user profile to a network share, and then you rename the profile to make it mandatory. + +**To create a default user profile** + +1. Sign in to a computer running Windows 10 as a member of the local Administrator group. Do not use a domain account. + + > [!NOTE] + > Use a lab or extra computer running a clean installation of Windows 10 to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. + +2. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. + + >[!NOTE] + >Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). + +3. [Create an answer file (Unattend.xml)](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) that sets the [CopyProfile](https://msdn.microsoft.com/library/windows/hardware/dn922656.aspx) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. + +3. Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) cmdlet in Windows PowerShell to uninstall the following applications: + + - Microsoft.windowscommunicationsapps_8wekyb3d8bbwe + - Microsoft.BingWeather_8wekyb3d8bbwe + - Microsoft.DesktopAppInstaller_8wekyb3d8bbwe + - Microsoft.Getstarted_8wekyb3d8bbwe + - Microsoft.Windows.Photos_8wekyb3d8bbwe + - Microsoft.WindowsCamera_8wekyb3d8bbwe + - Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe + - Microsoft.WindowsStore_8wekyb3d8bbwe + - Microsoft.XboxApp_8wekyb3d8bbwe + - Microsoft.XboxIdentityProvider_8wekyb3d8bbwe + - Microsoft.ZuneMusic_8wekyb3d8bbwe + + >[!NOTE] + >Uninstalling these apps will decrease sign-in time. If your deployment needs any of these apps, you can leave them installed. + +3. At a command prompt, type the following command and press **ENTER**. + + `sysprep /oobe /reboot /generalize /unattend:unattend.xml` + + (Sysprep.exe is located at: C:\Windows\System32\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) + + >[!TIP] + >If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\System32\Sysprep\Panther\setupact.log and look for an entry like the following: + + >![Microsoft Bing Translator package](images/sysprep-error.png) + + >Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. + +5. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. + +6. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. + +7. In **User Profiles**, click **Default Profile**, and then click **Copy To**. + + ![Example of UI](images/copy-to.png) + +8. In **Copy To**, under **Permitted to use**, click **Change**. + + ![Example of UI](images/copy-to-change.png) + +9. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. + +10. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#extension) for the operating system version. For example, the folder name must end with “.v6” to identify it as a user profile folder for Windows 10, version 1607. + + - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. + - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. + + ![Example of UI](images/copy-to-path.png) + +9. Click **OK** to copy the default user profile. + + +**To make the user profile mandatory** + + +3. In File Explorer, open the folder where you stored the copy of the profile. + + >[!NOTE] + >If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. + +1. Rename `Ntuser.dat` to `Ntuser.man`. + +## How to apply a mandatory user profile to users + +In a domain, you modify properties for the user account to point to the mandatory profile in a shared folder residing on the server. + +**To apply a mandatory user profile to users** + +1. Open **Active Directory Users and Computers** (dsa.msc). + +2. Navigate to the user account that you will assign the mandatory profile to. + +3. Right-click the user name and open **Properties**. + +4. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\profile.v6, you would enter \\\\*server*\profile. + +5. Click **OK**. + +It may take some time for this change to replicate to all domain controllers. + + + +## Apply policies to improve sign-in time + +When a user is configured with a mandatory profile, Windows 10 starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the following Group Policy settings. + +- Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled +- Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled +- Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled + + + + + + + + + +## Related topics + +- [Manage Windows 10 Start layout and taskbar options](windows-10-start-layout-options-and-policies.md) +- [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) +- [Windows Spotlight on the lock screen](windows-spotlight.md) +- [Configure devices without MDM](configure-devices-without-mdm.md) + + + diff --git a/windows/manage/new-policies-for-windows-10.md b/windows/manage/new-policies-for-windows-10.md index 6dc1d6a75b..873c393efd 100644 --- a/windows/manage/new-policies-for-windows-10.md +++ b/windows/manage/new-policies-for-windows-10.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # New policies for Windows 10 @@ -18,9 +18,9 @@ localizationpriority: medium - Windows 10 - Windows 10 Mobile -Windows 10 includes the following new policies for management, in addition to policies that were available for Windows 8.1 and Windows Phone 8.1. [Download the complete set of Administrative Template (.admx) files for Windows 10](http://go.microsoft.com/fwlink/p/?LinkID=625081). +Windows 10 includes the following new policies for management, in addition to policies that were available for Windows 8.1 and Windows Phone 8.1. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://go.microsoft.com/fwlink/p/?LinkID=625081). -## New GPOs in Windows 10 +## New Group Policy settings in Windows 10 There are some new policy settings in Group Policy for devices running Windows 10 , such as: @@ -41,11 +41,11 @@ There are some new policy settings in Group Policy for devices running Windows  - Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu -- [Microsoft Passport](http://go.microsoft.com/fwlink/p/?LinkId=623294) +- [Microsoft Passport](https://go.microsoft.com/fwlink/p/?LinkId=623294) - Windows Updates for Business -For a spreadsheet of Group Policy settings included in Windows, see [Group Policy Settings Reference for Windows and Windows Server](http://go.microsoft.com/fwlink/p/?LinkId=613627). +For a spreadsheet of Group Policy settings included in Windows, see [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=613627). ## New MDM policies @@ -66,7 +66,7 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, Wind - Security -- [VPN](http://go.microsoft.com/fwlink/p/?LinkId=623295) and enterprise Wi-Fi management +- [VPN](https://go.microsoft.com/fwlink/p/?LinkId=623295) and enterprise Wi-Fi management - Certificate management @@ -74,9 +74,9 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, Wind - Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu -If you use Microsoft Intune for MDM, you can [configure custom policies](http://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](http://go.microsoft.com/fwlink/p/?LinkId=616317). +If you use Microsoft Intune for MDM, you can [configure custom policies](https://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616317). -No new [Exchange ActiveSync policies](http://go.microsoft.com/fwlink/p/?LinkId=613264). For more information, see the [ActiveSync configuration service provider](http://go.microsoft.com/fwlink/p/?LinkId=618944) technical reference. +No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId=613264). For more information, see the [ActiveSync configuration service provider](https://go.microsoft.com/fwlink/p/?LinkId=618944) technical reference. ## Related topics diff --git a/windows/manage/prerequisites-windows-store-for-business.md b/windows/manage/prerequisites-windows-store-for-business.md index 8c759e9d5d..0ca1be50d5 100644 --- a/windows/manage/prerequisites-windows-store-for-business.md +++ b/windows/manage/prerequisites-windows-store-for-business.md @@ -28,25 +28,20 @@ You'll need this software to work with Store for Business. ### Required - IT Pros that are administering Store for Business need a browser compatible with Store for Business running on a PC or mobile device. Supported browsers include: Internet Explorer 10 or later, Microsoft Edge, or current versions of Chrome or Firefox. - -- Employees using apps from Store for Business need Windows 10, version 1511 running on a PC or mobile device. +- Employees using apps from Store for Business need at least Windows 10, version 1511 running on a PC or mobile device. Microsoft Azure Active Directory (AD) accounts for your employees: - - IT Pros need Azure AD accounts to sign up for Store for Business, and then to sign in, get apps, distribute apps, and manage app licenses. - - Employees need Azure AD accounts when they access Store for Business content from Windows-based devices. - - If you use a management tool to distribute and manage online-licensed apps, all employees will need an Azure AD account. -For more information on Azure AD, see [About Office 365 and Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](http://go.microsoft.com/fwlink/p/?LinkId=708611). +For more information on Azure AD, see [About Office 365 and Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](https://go.microsoft.com/fwlink/p/?LinkId=708611). ### Optional While not required, you can use a management tool to distribute and manage apps. Using a management tool allows you to distribute content, scope app availability, and control when app updates are installed. This might make sense for larger organizations that already use a management tool. If you're considering using management tools, check with the management tool vendor to see if they support Store for Business. The management tool will need to: - Integrate with the Windows 10 management framework and Azure AD. - - Sync with the Store for Business inventory to distribute apps. ### Proxy configuration @@ -54,21 +49,15 @@ While not required, you can use a management tool to distribute and manage apps. If your organization restricts computers on your network from connecting to the Internet, there is a set of URLs that need to be available for devices to use Store for Business. Some of the Store for Business features use Windows Store app and Windows Store services. Devices using Store for Business – either to acquire, install, or update apps – will need access to these URLs. If you use a proxy server to block traffic, your configuration needs to allow these URLs: - login.live.com - - login.windows.net - - account.live.com - - clientconfig.passport.net - - windowsphone.com - - \*.wns.windows.com - - \*.microsoft.com - -- \*.msftncsi.com/ncsi.txt - +- www.msftncsi.com (prior to Windows 10, version 1607) +- www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com +starting with Windows 10, version 1607)     diff --git a/windows/manage/product-ids-in-windows-10-mobile.md b/windows/manage/product-ids-in-windows-10-mobile.md index fd249d0732..6fd085952b 100644 --- a/windows/manage/product-ids-in-windows-10-mobile.md +++ b/windows/manage/product-ids-in-windows-10-mobile.md @@ -233,7 +233,7 @@ The following table lists the product ID and AUMID for each app that is included ## Get product ID and AUMID for other apps -To get the product ID and AUMID for apps that are installed from Windows Store or installed locally ([side-loaded](http://go.microsoft.com/fwlink/p/?LinkID=623433)), use the following steps. +To get the product ID and AUMID for apps that are installed from Windows Store or installed locally ([side-loaded](https://go.microsoft.com/fwlink/p/?LinkID=623433)), use the following steps. **Prerequisites**: a device with an SD card inserted and all apps installed that you want to get IDs for diff --git a/windows/manage/reset-a-windows-10-mobile-device.md b/windows/manage/reset-a-windows-10-mobile-device.md index 5455485e1f..7a18801dd0 100644 --- a/windows/manage/reset-a-windows-10-mobile-device.md +++ b/windows/manage/reset-a-windows-10-mobile-device.md @@ -19,15 +19,15 @@ localizationpriority: high There are two methods for resetting a Windows 10 Mobile device: factory reset and "wipe and persist" reset. -- **Factory reset** restores the state of the device back to its first-boot state plus any update packages. The reset will not return device to the original factory state. To return the device to the original factory state, you must flash it with the original factory image.All the provisioning applied to the device by the enterprise will be lost and will need to be re-applied if needed. For details on what is removed or persists, see [Resetting a mobile device](http://go.microsoft.com/fwlink/p/?LinkID=703715). -- **"Wipe and persist" reset** preserves all the provisioning applied to the device before the reset. After the "wipe and persist" reset, all the preserved provisioning packages are automatically applied on the device and the data in the enterprise shared storage folder \\Data\\SharedData\\Enterprise\\Persistent is restored in that folder. For more information on the enterprise shared storage folder, see [EnterpriseExtFileSystem CSP](http://go.microsoft.com/fwlink/p/?LinkId=703716). +- **Factory reset** restores the state of the device back to its first-boot state plus any update packages. The reset will not return device to the original factory state. To return the device to the original factory state, you must flash it with the original factory image by using the [Windows Device Recovery Tool](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq). All the provisioning applied to the device by the enterprise will be lost and will need to be re-applied if needed. For details on what is removed or persists, see [Resetting a mobile device](https://go.microsoft.com/fwlink/p/?LinkID=703715). +- **"Wipe and persist" reset** preserves all the provisioning applied to the device before the reset. After the "wipe and persist" reset, all the preserved provisioning packages are automatically applied on the device and the data in the enterprise shared storage folder \\Data\\SharedData\\Enterprise\\Persistent is restored in that folder. For more information on the enterprise shared storage folder, see [EnterpriseExtFileSystem CSP](https://go.microsoft.com/fwlink/p/?LinkId=703716). You can trigger a reset using your mobile device management (MDM) service, or a user can trigger a reset in the user interface (UI) or by using hardware buttons. ## Reset using MDM -The remote wipe command is sent as an XML provisioning file to the device. Since the [RemoteWipe configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=703714) uses OMA DM and WAP, authentication between client and server and delivery of the XML provisioning file is handled by provisioning. The remote wipe command is implemented on the device by using the **ResetPhone** function. For more information about the data that is removed as a result of the remote wipe command, see [Resetting a mobile device](http://go.microsoft.com/fwlink/p/?LinkId=703715). +The remote wipe command is sent as an XML provisioning file to the device. Since the [RemoteWipe configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=703714) uses OMA DM and WAP, authentication between client and server and delivery of the XML provisioning file is handled by provisioning. The remote wipe command is implemented on the device by using the **ResetPhone** function. For more information about the data that is removed as a result of the remote wipe command, see [Resetting a mobile device](https://go.microsoft.com/fwlink/p/?LinkId=703715). To perform a factory reset, restoring the device back to its out-of-box state, use the following syncML. diff --git a/windows/manage/set-up-a-device-for-anyone-to-use.md b/windows/manage/set-up-a-device-for-anyone-to-use.md index 28b5f6a030..f274498ed1 100644 --- a/windows/manage/set-up-a-device-for-anyone-to-use.md +++ b/windows/manage/set-up-a-device-for-anyone-to-use.md @@ -20,7 +20,7 @@ localizationpriority: high **Looking for Windows Embedded 8.1 Industry information?** -- [Assigned Access]( http://go.microsoft.com/fwlink/p/?LinkId=613653) +- [Assigned Access]( https://go.microsoft.com/fwlink/p/?LinkId=613653) You can configure a device running Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile, or Windows 10 Mobile Enterprise as a kiosk device, so that users can only interact with a single application that you select. diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index 940a457a76..211f47f9c2 100644 --- a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -17,7 +17,7 @@ localizationpriority: high - Windows 10 -> **Looking for Windows Embedded 8.1 Industry information?** See [Assigned Access]( http://go.microsoft.com/fwlink/p/?LinkId=613653) +> **Looking for Windows Embedded 8.1 Industry information?** See [Assigned Access]( https://go.microsoft.com/fwlink/p/?LinkId=613653) A single-use or *kiosk* device is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). For a kiosk device to run a Universal Windows app, use the **assigned access** feature. For a kiosk device (Windows 10 Enterprise or Education) to run a Classic Windows application, use **Shell Launcher** to set a custom user interface as the shell. To return the device to the regular shell, see [Sign out of assigned access](#sign-out-of-assigned-access). @@ -82,9 +82,9 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo - A domain or local user account. -- A Universal Windows app that is installed or provisioned for that account and is an above lock screen app. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](http://go.microsoft.com/fwlink/p/?LinkId=708386). +- A Universal Windows app that is installed or provisioned for that account and is an above lock screen app. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](https://go.microsoft.com/fwlink/p/?LinkId=708386). - The app can be your own company app that you have made available in your own app Store. To set up assigned access using MDM or PowerShell, you also need the Application User Model ID (AUMID) for the app. [Learn how to get the AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867). + The app can be your own company app that you have made available in your own app Store. To set up assigned access using MDM or PowerShell, you also need the Application User Model ID (AUMID) for the app. [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). The Universal Windows app must be able to handle multiple views and cannot launch other apps or dialogs. @@ -111,9 +111,9 @@ To remove assigned access, in step 3, choose **Don't use assigned access**. Assigned Access has one setting, KioskModeApp. In the KioskModeApp setting, you enter the user account name and AUMID for the app to run in kiosk mode. -[Learn how to get the AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867). +[Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). -[See the technical reference for the Assigned Access configuration service provider.](http://go.microsoft.com/fwlink/p/?LinkId=626608) +[See the technical reference for the Assigned Access configuration service provider.](https://go.microsoft.com/fwlink/p/?LinkId=626608) ### Set up assigned access using Windows Imaging and Configuration Designer (ICD) @@ -177,7 +177,7 @@ When you build a provisioning package, you may include sensitive information in After you allow the package to be installed, the settings will be applied to the device -[Learn how to apply a provisioning package in audit mode or OOBE.](http://go.microsoft.com/fwlink/p/?LinkID=692012) +[Learn how to apply a provisioning package in audit mode or OOBE.](https://go.microsoft.com/fwlink/p/?LinkID=692012) ### Set up assigned access using Windows PowerShell @@ -202,11 +202,11 @@ Set-AssignedAccess -AppName -UserSID ``` > **Note:** To set up assigned access using `-AppName`, the user account that you specify for assigned access must have logged on at least once. -[Learn how to get the AUMID](http://go.microsoft.com/fwlink/p/?LinkId=614867). +[Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). [Learn how to get the AppName](https://msdn.microsoft.com/library/windows/hardware/mt620046%28v=vs.85%29.aspx) (see **Parameters**). -[Learn how to get the SID](http://go.microsoft.com/fwlink/p/?LinkId=615517). +[Learn how to get the SID](https://go.microsoft.com/fwlink/p/?LinkId=615517). To remove assigned access, using PowerShell, run the following cmdlet. @@ -224,7 +224,7 @@ Edit the registry to have an account automatically logged on. 1. Open Registry Editor (regedit.exe). **Note**   - If you are not familiar with Registry Editor, [learn how to modify the Windows registry](http://go.microsoft.com/fwlink/p/?LinkId=615002). + If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002).   2. Go to @@ -247,7 +247,7 @@ Edit the registry to have an account automatically logged on. ### Sign out of assigned access -To sign out of an assigned access account, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. +To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain signed in until an admin account opens **Task Manager** > **Users** and signs out the user account. If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: @@ -266,7 +266,7 @@ Using Shell Launcher, you can configure a kiosk device that runs a Classic Windo - A Classic Windows application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. -[See the technical reference for the shell launcher component.](http://go.microsoft.com/fwlink/p/?LinkId=618603) +[See the technical reference for the shell launcher component.](https://go.microsoft.com/fwlink/p/?LinkId=618603) ### Configure Shell Launcher @@ -283,28 +283,73 @@ Alternatively, you can turn on Shell Launcher using the Deployment Image Servici 1. Open a command prompt as an administrator. 2. Enter the following command. - -

      [Microsoft System Center Configuration Manager 2016](http://go.microsoft.com/fwlink/p/?LinkId=613622)

      [System Center Configuration Manager (current branch) ](https://technet.microsoft.com/en-us/library/mt346023.aspx)

      Client deployment, upgrade, and management with new and existing features
      - - - - - - - - - 
      Dism /online /Enable-Feature /FeatureName:Client-EmbeddedShellLauncher
      + + ``` + Dism /online /Enable-Feature /all /FeatureName:Client-EmbeddedShellLauncher + ``` **To set your custom shell** Modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device. ``` +# Check if shell launcher license is enabled +function Check-ShellLauncherLicenseEnabled +{ + [string]$source = @" +using System; +using System.Runtime.InteropServices; + +static class CheckShellLauncherLicense +{ + const int S_OK = 0; + + public static bool IsShellLauncherLicenseEnabled() + { + int enabled = 0; + + if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) { + enabled = 0; + } + + return (enabled != 0); + } + + static class NativeMethods + { + [DllImport("Slc.dll")] + internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value); + } + +} +"@ + + $type = Add-Type -TypeDefinition $source -PassThru + + return $type[0]::IsShellLauncherLicenseEnabled() +} + +[bool]$result = $false + +$result = Check-ShellLauncherLicenseEnabled +"`nShell Launcher license enabled is set to " + $result +if (-not($result)) +{ + "`nThis device doesn't have required license to use Shell Launcher" + exit +} + $COMPUTER = "localhost" $NAMESPACE = "root\standardcimv2\embedded" # Create a handle to the class instance so we can call the static methods. -$ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" +try { + $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" + } catch [Exception] { + write-host $_.Exception.Message; + write-host "Make sure Shell Launcher feature is enabled" + exit + } # This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group. @@ -319,7 +364,7 @@ function Get-UsernameSID($AccountName) { $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) return $NTUserSID.Value - + } # Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script. diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md index a8a83c428c..1a11ff9c20 100644 --- a/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md +++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md @@ -21,7 +21,7 @@ localizationpriority: high A device in kiosk mode runs a specified app with no access to other device functions, menus, or settings. You configure a device running Windows 10 Mobile or Windows 10 Mobile Enterprise for kiosk mode by using the Apps Corner feature. You can also use the Enterprise Assigned Access configuration service provider (CSP) to configure a kiosk experience. **Note**   -The specified app must be an above lock screen app. For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](http://go.microsoft.com/fwlink/p/?LinkId=708386). +The specified app must be an above lock screen app. For details on building an above lock screen app, see [Kiosk apps for assigned access: Best practices](https://go.microsoft.com/fwlink/p/?LinkId=708386).   @@ -70,7 +70,7 @@ Enterprise Assigned Access allows you to lock down your Windows 10 Mobile or Wi In AssignedAccessXml, for Application, you enter the product ID for the app to run in kiosk mode. Find product IDs at [Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md). -[See the technical reference for the Enterprise Assigned Access configuration service provider (CSP).](http://go.microsoft.com/fwlink/p/?LinkID=618601) +[See the technical reference for the Enterprise Assigned Access configuration service provider (CSP).](https://go.microsoft.com/fwlink/p/?LinkID=618601) ### Set up assigned access using Windows Imaging and Configuration Designer (ICD) @@ -79,7 +79,7 @@ When you build a provisioning package, you may include sensitive information in **To create and apply a provisioning package for a kiosk device** -1. Create an *AssignedAccess*.xml file that specifies the app the device will run. (You can name use any file name.) For instructions on AssignedAccessXml, see [EnterpriseAssignedAccess CSP](http://go.microsoft.com/fwlink/p/?LinkID=618601). +1. Create an *AssignedAccess*.xml file that specifies the app the device will run. (You can name use any file name.) For instructions on AssignedAccessXml, see [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601). **Note**   Do not escape the xml in *AssignedAccess*.xml file as Windows Imaging and Configuration Designer (ICD) will do that when building the package. Providing escaped xml in Windows ICD will cause building the package fail. @@ -178,7 +178,7 @@ When you build a provisioning package, you may include sensitive information in 5. Restart the device and verify that the runtime settings that were configured in the provisioning package were applied to the device. - [Learn how to apply a provisioning package in audit mode or OOBE.](http://go.microsoft.com/fwlink/p/?LinkID=692012) + [Learn how to apply a provisioning package in audit mode or OOBE.](https://go.microsoft.com/fwlink/p/?LinkID=692012) ## Related topics diff --git a/windows/manage/settings-that-can-be-locked-down.md b/windows/manage/settings-that-can-be-locked-down.md index fe4253fb64..c0348677ba 100644 --- a/windows/manage/settings-that-can-be-locked-down.md +++ b/windows/manage/settings-that-can-be-locked-down.md @@ -266,27 +266,27 @@ The following table lists the settings pages and page groups. Use the page name Narrator -SettingsPageEaseoOfAccessNarrator +SettingsPageEaseOfAccessNarrator Magnifier -SettingsPageEaseoOfAccessMagnifier +SettingsPageEaseOfAccessMagnifier High contrast -SettingsPageEaseoOfAccessHighContrast +SettingsPageEaseOfAccessHighContrast Closed captions -SettingsPageEaseoOfAccessClosedCaptioning +SettingsPageEaseOfAccessClosedCaptioning More options -SettingsPageEaseoOfAccessMoreOptions +SettingsPageEaseOfAccessMoreOptions Privacy diff --git a/windows/manage/sign-up-windows-store-for-business.md b/windows/manage/sign-up-windows-store-for-business.md index b64638e1a8..69d44f17e8 100644 --- a/windows/manage/sign-up-windows-store-for-business.md +++ b/windows/manage/sign-up-windows-store-for-business.md @@ -27,7 +27,7 @@ Before signing up for the Store for Business, make sure you're the global admini **To sign up for the Store for Business** -1. Go to [https://www.microsoft.com/business-store](http://go.microsoft.com/fwlink/p/?LinkId=691845), and click **Sign up**. +1. Go to [https://www.microsoft.com/business-store](https://go.microsoft.com/fwlink/p/?LinkId=691845), and click **Sign up**. - If you start the Store for Business sign up process, and don't have an Azure AD directory for your organization, we'll help you create one. For more info, see [Sign up for Azure AD accounts](#o365-welcome). diff --git a/windows/manage/stop-employees-from-using-the-windows-store.md b/windows/manage/stop-employees-from-using-the-windows-store.md index 7a21ec1cc1..c95b8cddad 100644 --- a/windows/manage/stop-employees-from-using-the-windows-store.md +++ b/windows/manage/stop-employees-from-using-the-windows-store.md @@ -80,7 +80,7 @@ If you have mobile devices in your organization that you upgraded from earlier v When your MDM tool supports Windows Store for Business, the MDM can use these CSPs to block Windows Store app: -- [Policy](http://go.microsoft.com/fwlink/p/?LinkId=717030) +- [Policy](https://go.microsoft.com/fwlink/p/?LinkId=717030) - [EnterpriseAssignedAccess](https://msdn.microsoft.com/library/windows/hardware/mt157024.aspx) (Windows 10 Mobile, only) diff --git a/windows/manage/troubleshoot-windows-store-for-business.md b/windows/manage/troubleshoot-windows-store-for-business.md index 6be281bae5..55a31b14ec 100644 --- a/windows/manage/troubleshoot-windows-store-for-business.md +++ b/windows/manage/troubleshoot-windows-store-for-business.md @@ -53,7 +53,7 @@ The private store for your organization is a page in the Windows Store app that ## Still having trouble? -If you are still having trouble using WSfB or installing the app, you can get more help on our [Support page](http://go.microsoft.com/fwlink/?LinkID=799757). +If you are still having trouble using WSfB or installing the app, you can get more help on our [Support page](https://go.microsoft.com/fwlink/?LinkID=799757).   diff --git a/windows/manage/uev-accessibility.md b/windows/manage/uev-accessibility.md index e54c168813..08416f8349 100644 --- a/windows/manage/uev-accessibility.md +++ b/windows/manage/uev-accessibility.md @@ -1,88 +1,4 @@ --- title: Accessibility for UE-V -description: Accessibility for UE-V -author: MaggiePucciEvans -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 ---- - - -# Accessibility for UE-V - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -You can access most commands by using two keystrokes. To use an access key: - -1. Press Alt. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter that is shown in the keyboard shortcut over the feature that you want to use. - -### Documentation in alternative formats - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally, formerly known as Recording for the Blind & Dyslexic, Inc. Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, use the following contact. - - ---- - - - - - - - - - - - - - - - - - - - - - - -

      Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

      -

      20 Roszel Road

      -

      Princeton, NJ 08540

      Telephone number from within the United States:

      (800) 221-4792

      Telephone number from outside the United States and Canada:

      (609) 452-0606

      Fax:

      (609) 987-8116

      [http://www.learningally.org/](http://go.microsoft.com/fwlink/p/?linkid=239)

      Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here.

      - -  - -### Customer service for people with hearing impairments - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time that the service is used. - -## For more information - - -For more information about how accessible technology for computers can help to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://www.microsoft.com/enable/default.aspx). - -## Have a suggestion for UE-V? - -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). - -## Related topics - -[Technical Reference for UE-V](uev-technical-reference.md) +redirect_url: https://technet.microsoft.com/itpro/windows/manage/uev-for-windows +--- \ No newline at end of file diff --git a/windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md index 081924a8c9..3b0c73a34d 100644 --- a/windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md +++ b/windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md @@ -11,11 +11,12 @@ ms.prod: w10 # Administering UE-V with Windows PowerShell and WMI +**Applies to** +- Windows 10, version 1607 User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks. The following sections provide more information about using Windows PowerShell in UE-V. -**Note**   -Administering UE-V with Windows PowerShell requires PowerShell 3.0 or higher. For a complete list of UE-V PowerShell cmdlets, see [UE-V Cmdlet Reference](http://go.microsoft.com/fwlink/p/?LinkId=393495). +> **Note**  Administering UE-V with Windows PowerShell requires PowerShell 3.0 or higher. For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx). ## Managing the UE-V service and packages by using Windows PowerShell and WMI @@ -32,8 +33,10 @@ After you create and deploy UE-V settings location templates, you can manage tho ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics -[Administering UE-V](uev-administering-uev.md) +- [Administering UE-V](uev-administering-uev.md) + +- [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) \ No newline at end of file diff --git a/windows/manage/uev-administering-uev.md b/windows/manage/uev-administering-uev.md index 83f4e99a1b..2c1455ebe3 100644 --- a/windows/manage/uev-administering-uev.md +++ b/windows/manage/uev-administering-uev.md @@ -11,6 +11,9 @@ ms.prod: w10 # Administering UE-V +**Applies to** +- Windows 10, version 1607 + After you finish deploying User Experience Virtualization (UE-V), you'll perform ongoing administrative tasks, such as managing the configuration of the UE-V service and recovering lost settings. These tasks are explained in the following sections. ## Managing UE-V configurations @@ -70,4 +73,4 @@ You can use UE-V with Microsoft Application Virtualization (App-V) to share sett ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-application-template-schema-reference.md b/windows/manage/uev-application-template-schema-reference.md index c5c7a98379..94bdd8dd75 100644 --- a/windows/manage/uev-application-template-schema-reference.md +++ b/windows/manage/uev-application-template-schema-reference.md @@ -11,6 +11,8 @@ ms.prod: w10 # Application Template Schema Reference for UE-V +**Applies to** +- Windows 10, version 1607 User Experience Virtualization (UE-V) uses XML settings location templates to define the desktop application settings and Windows settings that are captured and applied by UE-V. UE-V includes a set of default settings location templates. You can also create custom settings location templates with the UE-V template generator. @@ -955,7 +957,7 @@ Here is the SettingsLocationTemplate.xsd file showing its elements, child elemen ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md index e05fa13e99..888c3b7ee1 100644 --- a/windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md +++ b/windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md @@ -11,19 +11,21 @@ ms.prod: w10 # Changing the Frequency of UE-V Scheduled Tasks +**Applies to** +- Windows 10, version 1607 When the User Experience Virtualization (UE-V) service is enabled, it creates the following scheduled tasks: -- **Monitor Application Settings** +- [Monitor Application Settings](#monitor-application-settings) -- **Sync Controller Application** +- [Sync Controller Application](#sync-controller-application) -- **Synchronize Settings at Logoff** +- [Synchronize Settings at Logoff](#synchronize-settings-at-logoff) -- **Template Auto Update** +- [Template Auto Update](#template-auto-update) -**Note**   -These tasks must remain enabled as UE-V cannot function without them. +**Note**
      +These tasks must remain enabled, because UE-V cannot function without them. These scheduled tasks are not configurable with the UE-V tools. Administrators who want to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options. @@ -238,7 +240,7 @@ The following additional information applies to UE-V scheduled tasks: ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-configuring-uev-with-group-policy-objects.md b/windows/manage/uev-configuring-uev-with-group-policy-objects.md index 9bb13f98c6..4476ea26b3 100644 --- a/windows/manage/uev-configuring-uev-with-group-policy-objects.md +++ b/windows/manage/uev-configuring-uev-with-group-policy-objects.md @@ -11,6 +11,8 @@ ms.prod: w10 # Configuring UE-V with Group Policy Objects +**Applies to** +- Windows 10, version 1607 Some User Experience Virtualization (UE-V) Group Policy settings can be defined for computers, and other Group Policy settings can be defined for users. The Group Policy administrative templates for these settings are included in Windows 10, version 1607. @@ -161,7 +163,7 @@ In addition, Group Policy settings are available for many desktop applications a   -For more information about synchronizing Windows apps, see [Windows App List](http://technet.microsoft.com/library/dn458925.aspx#win8applist). +For more information about synchronizing Windows apps, see [Windows App List](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md#win8applist). **To configure computer-targeted Group Policy settings** @@ -189,7 +191,7 @@ The UE-V service uses the following order of precedence to determine synchroniza ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md index f6f6eb97fc..e18bff1e74 100644 --- a/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md +++ b/windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md @@ -11,6 +11,8 @@ ms.prod: w10 # Configuring UE-V with System Center Configuration Manager +**Applies to** +- Windows 10, version 1607 After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of System Center Configuration Manager (2012 SP1 or later) to apply consistent configurations across sites where UE-V and Configuration Manager are installed. @@ -158,7 +160,7 @@ It might be necessary to change the PowerShell execution policy to allow these s 3. Run this command on a machine running the ConfigMgr Admin Console: ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe –Site ABC –CabFilePath “C:\MyCabFiles\UevPolicyItem.cab” –ConfigurationFile “c:\AgentConfiguration.xml” + C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe -Site ABC -CabFilePath "C:\MyCabFiles\UevPolicyItem.cab" -ConfigurationFile "c:\AgentConfiguration.xml" ``` 4. Import the CAB file using ConfigMgr console or PowerShell Import-CMConfigurationItem @@ -203,7 +205,7 @@ The result is a baseline CAB file that is ready for import into Configuration Ma 3. Add the command and parameters to the .bat file that will generate the baseline. The following example creates a baseline that distributes Notepad and Calculator: ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe –Site “ABC” –TemplateFolder “C:\ProductionUevTemplates” –Register “MicrosoftNotepad.xml, MicrosoftCalculator.xml” –CabFilePath “C:\MyCabFiles\UevTemplateBaseline.cab” + C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe -Site "ABC" -TemplateFolder "C:\ProductionUevTemplates" -Register "MicrosoftNotepad.xml, MicrosoftCalculator.xml" -CabFilePath "C:\MyCabFiles\UevTemplateBaseline.cab" ``` 4. Run the .bat file to create UevTemplateBaseline.cab ready for import into Configuration Manager. @@ -224,13 +226,12 @@ To distribute a new Notepad template, you would perform these steps: ## Get the UE-V Configuration Pack - -The UE-V Configuration Pack for Configuration Manager 2012 SP1 or later can be downloaded [here](http://go.microsoft.com/fwlink/?LinkId=317263). +You can download the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/en-us/download/details.aspx?id=40913) from the Microsoft Download Center. ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-deploy-required-features.md b/windows/manage/uev-deploy-required-features.md index c3324cab35..8814f6f0c0 100644 --- a/windows/manage/uev-deploy-required-features.md +++ b/windows/manage/uev-deploy-required-features.md @@ -10,6 +10,9 @@ ms.prod: w10 # Deploy required UE-V features +**Applies to** +- Windows 10, version 1607 + To get up and running with User Experience Virtualization (UE-V), install and configure the following features. - [Deploy a settings storage location](#deploy-a-ue-v-settings-storage-location) that is accessible to end users. @@ -144,7 +147,7 @@ With Windows 10, version 1607 and later, the UE-V service is installed on user d ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/forums/home?forum=mdopuev). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-deploy-uev-for-custom-applications.md b/windows/manage/uev-deploy-uev-for-custom-applications.md index 120b0b4602..6a44f5decc 100644 --- a/windows/manage/uev-deploy-uev-for-custom-applications.md +++ b/windows/manage/uev-deploy-uev-for-custom-applications.md @@ -10,6 +10,9 @@ ms.prod: w10 # Use UE-V with custom applications +**Applies to** +- Windows 10, version 1607 + User Experience Virtualization (UE-V) uses XML files called ***settings location templates*** to monitor and synchronize application settings and Windows settings between user devices. By default, some settings location templates are included in UE-V. However, if you want to synchronize settings for desktop applications other than those included in the default templates, you can create your own custom settings location templates with the UE-V template generator. After you’ve reviewed [Prepare a UE-V Deployment](uev-prepare-for-deployment.md) and decided that you want to synchronize settings for custom applications (third-party, line-of-business, e.g.), you’ll need to deploy the features of UE-V described in this topic. @@ -238,7 +241,7 @@ Templates that are deployed by using an ESD system or Group Policy objects must ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-for-windows.md b/windows/manage/uev-for-windows.md index 96293f71db..1f4eaab35c 100644 --- a/windows/manage/uev-for-windows.md +++ b/windows/manage/uev-for-windows.md @@ -10,6 +10,9 @@ ms.prod: w10 # User Experience Virtualization (UE-V) for Windows 10 overview +**Applies to** +- Windows 10, version 1607 + Many users customize their settings for Windows and for specific applications. Customizable Windows settings include Windows Store appearance, language, background picture, font size, and accent colors. Customizable application settings include language, appearance, behavior, and user interface options. With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to. @@ -92,4 +95,4 @@ You can also [customize UE-V to synchronize settings](uev-deploy-uev-for-custom- ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-getting-started.md b/windows/manage/uev-getting-started.md index 42fdafe047..f2497cb4f5 100644 --- a/windows/manage/uev-getting-started.md +++ b/windows/manage/uev-getting-started.md @@ -10,7 +10,8 @@ ms.prod: w10 # Get Started with UE-V -Applies to: Windows 10, version 1607 +**Applies to** +- Windows 10, version 1607 Follow the steps in this topic to deploy User Experience Virtualization (UE-V) for the first time in a test environment. Evaluate UE-V to determine whether it’s the right solution to manage user settings across multiple devices within your enterprise. @@ -41,7 +42,7 @@ Before you proceed, ensure that your environment meets the following requirement ## Step 2: Deploy the settings storage location -You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. [Deploy a settings storage location](https://technet.microsoft.com/library/dn458891.aspx#ssl) provides more detailed information. +You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. For more information, see [Deploy a UE-V Settings Storage Location](uev-deploy-required-features.md#deploy-a-ue-v-settings-storage-location). **Create a network share** @@ -123,8 +124,11 @@ You’re ready to run a few tests on your UE-V evaluation deployment to see how 5. You can change the settings in Computer B back to the original Computer A settings. Then log off Computer B and log in to Computer A to verify the changes. -Other resources for this feature --------------------------------- +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + +## Other resources for this feature - [User Experience Virtualization overview](uev-for-windows.md) diff --git a/windows/manage/uev-manage-administrative-backup-and-restore.md b/windows/manage/uev-manage-administrative-backup-and-restore.md index 61f024d919..4b70595e59 100644 --- a/windows/manage/uev-manage-administrative-backup-and-restore.md +++ b/windows/manage/uev-manage-administrative-backup-and-restore.md @@ -11,6 +11,9 @@ ms.prod: w10 # Manage Administrative Backup and Restore in UE-V +**Applies to** +- Windows 10, version 1607 + As an administrator of User Experience Virtualization (UE-V), you can restore application and Windows settings to their original state. You can also restore additional settings when a user adopts a new device. ## Restore Settings in UE-V when a User Adopts a New Device @@ -31,7 +34,7 @@ When replacing a user’s device, UE-V automatically restores settings if the us You can also use the Windows PowerShell cmdlet, Restore-UevBackup, to restore settings from a different device. To clone the settings packages for the new device, use the following cmdlet in Windows PowerShell: ``` syntax -Restore-UevBackup –Machine +Restore-UevBackup -Machine ``` where <MachineName> is the computer name of the device. @@ -159,7 +162,7 @@ WMI and Windows PowerShell commands let you restore application and Windows sett ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-manage-configurations.md b/windows/manage/uev-manage-configurations.md index bfcb65c039..81dbad3d82 100644 --- a/windows/manage/uev-manage-configurations.md +++ b/windows/manage/uev-manage-configurations.md @@ -11,6 +11,8 @@ ms.prod: w10 # Manage Configurations for UE-V +**Applies to** +- Windows 10, version 1607 In the course of the User Experience Virtualization (UE-V) lifecycle, you have to manage the configuration of the UE-V service and also manage storage locations for resources such as settings package files. The following topics provide guidance for managing these UE-V resources. @@ -56,7 +58,7 @@ Here are some examples of UE-V configuration settings: ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md b/windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md index e28ebdbf9e..590e4d58c3 100644 --- a/windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md +++ b/windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md @@ -11,12 +11,15 @@ ms.prod: w10 # Managing UE-V Settings Location Templates Using Windows PowerShell and WMI +**Applies to** +- Windows 10, version 1607 -User Experience Virtualization (UE-V) uses XML settings location templates to define the settings that User Experience Virtualization captures and applies. UE-V includes a set of standard settings location templates. It also includes the UE-V template generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates, you can manage those templates by using Windows PowerShell and the Windows Management Instrumentation (WMI). For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://technet.microsoft.com/library/dn520275.aspx). +User Experience Virtualization (UE-V) uses XML settings location templates to define the settings that User Experience Virtualization captures and applies. UE-V includes a set of standard settings location templates. It also includes the UE-V template generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates, you can manage those templates by using Windows PowerShell and the Windows Management Instrumentation (WMI). + +> **Note**  For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx). ## Manage UE-V settings location templates by using Windows PowerShell - The WMI and Windows PowerShell features of UE-V include the ability to enable, disable, register, update, and unregister settings location templates. By using these features, you can automate the process of registering, updating, or unregistering templates with the UE-V service. You can also manually register templates by using WMI and Windows PowerShell commands. By using these features in conjunction with an electronic software distribution solution, Group Policy, or another automated deployment method such as a script, you can further automate that process. You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable, disable, or list templates. @@ -44,11 +47,11 @@ You must have administrator permissions to update, register, or unregister a set

      Lists all the settings location templates that are registered on the computer.

      -

      Get-UevTemplate –Application <string>

      +

      Get-UevTemplate -Application <string>

      Lists all the settings location templates that are registered on the computer where the application name or template name contains <string>.

      -

      Get-UevTemplate –TemplateID <string>

      +

      Get-UevTemplate -TemplateID <string>

      Lists all the settings location templates that are registered on the computer where the template ID contains <string>.

      @@ -76,7 +79,7 @@ You must have administrator permissions to update, register, or unregister a set

      Registers one or more settings location template with UE-V by using relative paths and/or wildcard characters in file paths. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

      -

      Register-UevTemplate –LiteralPath <template file path>[,<template file path>]

      +

      Register-UevTemplate -LiteralPath <template file path>[,<template file path>]

      Registers one or more settings location template with UE-V by using literal paths, where no characters can be interpreted as wildcard characters. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

      @@ -92,11 +95,11 @@ You must have administrator permissions to update, register, or unregister a set

      Updates one or more settings location templates with a more recent version of the template. Use relative paths and/or wildcard characters in the file paths. The new template should be a newer version than the existing template.

      -

      Update-UevTemplate –LiteralPath <template file path>[,<template file path>]

      +

      Update-UevTemplate -LiteralPath <template file path>[,<template file path>]

      Updates one or more settings location templates with a more recent version of the template. Use full paths to template files, where no characters can be interpreted as wildcard characters. The new template should be a newer version than the existing template.

      -

      Clear-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

      +

      Clear-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]

      Removes one or more Windows apps from the computer Windows app list.

      @@ -104,15 +107,15 @@ You must have administrator permissions to update, register, or unregister a set

      Removes Windows app from the current user Windows app list.

      -

      Clear-UevAppXPackage –Computer -All

      +

      Clear-UevAppXPackage -Computer -All

      Removes all Windows apps from the computer Windows app list.

      -

      Clear-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

      +

      Clear-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

      Removes one or more Windows apps from the current user Windows app list.

      -

      Clear-UevAppXPackage [–CurrentComputerUser] -All

      +

      Clear-UevAppXPackage [-CurrentComputerUser] -All

      Removes all Windows apps from the current user Windows app list.

      @@ -120,11 +123,11 @@ You must have administrator permissions to update, register, or unregister a set

      Disables a settings location template for the current user of the computer.

      -

      Disable-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

      +

      Disable-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]

      Disables one or more Windows apps in the computer Windows app list.

      -

      Disable-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

      +

      Disable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

      Disables one or more Windows apps in the current user Windows app list.

      @@ -132,11 +135,11 @@ You must have administrator permissions to update, register, or unregister a set

      Enables a settings location template for the current user of the computer.

      -

      Enable-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

      +

      Enable-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]

      Enables one or more Windows apps in the computer Windows app list.

      -

      Enable-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

      +

      Enable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

      Enables one or more Windows apps in the current user Windows app list.

      @@ -144,7 +147,7 @@ You must have administrator permissions to update, register, or unregister a set

      Determines whether one or more settings location templates comply with its XML schema. Can use relative paths and wildcard characters.

      -

      Test-UevTemplate –LiteralPath <template file path>[,<template file path>]

      +

      Test-UevTemplate -LiteralPath <template file path>[,<template file path>]

      Determines whether one or more settings location templates comply with its XML schema. The path must be a full path to the template file, but does not include wildcard characters.

      @@ -213,9 +216,9 @@ The enabled state is set in the current user section of the registry. **PolicyMachine** The enabled state is set in the policy section of the local computer section of the registry. -To get the user-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage –CurrentComputerUser` +To get the user-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage -CurrentComputerUser` -To get the computer-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage –Computer` +To get the computer-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage -Computer` For either parameter, CurrentComputerUser or Computer, the cmdlet returns a list of the Windows apps that are configured at the user or at the computer level. @@ -257,7 +260,7 @@ User Experience Virtualization provides the following set of WMI commands. Admin

      Lists all the settings location templates that are registered for the computer.

      -

      Invoke-WmiMethod –Namespace root\Microsoft\UEV –Class SettingsLocationTemplate –Name GetProcessInfoByTemplateId <template Id>

      +

      Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name GetProcessInfoByTemplateId <template Id>

      Gets the name of the program and version information, which depends on the template name.

      @@ -328,10 +331,12 @@ Where a list of Package Family Names is called by the WMI command, the list must ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics [Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) [Administering UE-V](uev-administering-uev.md) + +[User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) diff --git a/windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md b/windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md index fc1134e656..eeb54e2454 100644 --- a/windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md +++ b/windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md @@ -11,7 +11,12 @@ ms.prod: w10 # Managing the UE-V service and packages with Windows PowerShell and WMI -You can use Windows Management Instrumentation (WMI) and Windows PowerShell to manage User Experience Virtualization (UE-V) service configuration and synchronization behavior. For a complete list of UE-V PowerShell cmdlets, see [UE-V Cmdlet Reference](https://technet.microsoft.com/library/dn520275.aspx). +**Applies to** +- Windows 10, version 1607 + +You can use Windows Management Instrumentation (WMI) and Windows PowerShell to manage User Experience Virtualization (UE-V) service configuration and synchronization behavior. + +>**Note**  For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx). ## To configure the UE-V service with Windows PowerShell @@ -64,23 +69,23 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m

      Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.

      -

      Set-UevConfiguration -Computer –EnableDontSyncWindows8AppSettings

      +

      Set-UevConfiguration -Computer -EnableDontSyncWindows8AppSettings

      Configures the UE-V service to not synchronize any Windows apps for all users on the computer.

      -

      Set-UevConfiguration -CurrentComputerUser – EnableDontSyncWindows8AppSettings

      +

      Set-UevConfiguration -CurrentComputerUser -EnableDontSyncWindows8AppSettings

      Configures the UE-V service to not synchronize any Windows apps for the current computer user.

      -

      Set-UevConfiguration -Computer –EnableFirstUseNotification

      +

      Set-UevConfiguration -Computer -EnableFirstUseNotification

      Configures the UE-V service to display notification the first time the service runs for all users on the computer.

      -

      Set-UevConfiguration -Computer –DisableFirstUseNotification

      +

      Set-UevConfiguration -Computer -DisableFirstUseNotification

      Configures the UE-V service to not display notification the first time that the service runs for all users on the computer.

      -

      Set-UevConfiguration -Computer –EnableSettingsImportNotify

      +

      Set-UevConfiguration -Computer -EnableSettingsImportNotify

      Configures the UE-V service to notify all users on the computer when settings synchronization is delayed.

      Use the DisableSettingsImportNotify parameter to disable notification.

      @@ -90,27 +95,27 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m

      Use the DisableSettingsImportNotify parameter to disable notification.

      -

      Set-UevConfiguration -Computer –EnableSyncUnlistedWindows8Apps

      -

      Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).

      +

      Set-UevConfiguration -Computer -EnableSyncUnlistedWindows8Apps

      +

      Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).

      Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.

      Set-UevConfiguration -CurrentComputerUser - EnableSyncUnlistedWindows8Apps

      -

      Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).

      +

      Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).

      Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.

      -

      Set-UevConfiguration –Computer –DisableSync

      +

      Set-UevConfiguration -Computer -DisableSync

      Disables UE-V for all the users on the computer.

      Use the EnableSync parameter to enable or re-enable.

      -

      Set-UevConfiguration –CurrentComputerUser -DisableSync

      +

      Set-UevConfiguration -CurrentComputerUser -DisableSync

      Disables UE-V for the current user on the computer.

      Use the EnableSync parameter to enable or re-enable.

      -

      Set-UevConfiguration -Computer –EnableTrayIcon

      +

      Set-UevConfiguration -Computer -EnableTrayIcon

      Enables the UE-V icon in the notification area for all users of the computer.

      Use the DisableTrayIcon parameter to disable the icon.

      @@ -139,7 +144,7 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m

      Defines a per-user settings storage location.

      -

      Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog>

      +

      Set-UevConfiguration -Computer -SettingsTemplateCatalogPath <path to catalog>

      Sets the settings template catalog path for all users of the computer.

      @@ -159,11 +164,11 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m

      Set the synchronization time-out for the current user.

      -

      Clear-UevConfiguration –Computer -<setting name>

      +

      Clear-UevConfiguration -Computer -<setting name>

      Clears the specified setting for all users on the computer.

      -

      Clear-UevConfiguration –CurrentComputerUser -<setting name>

      +

      Clear-UevConfiguration -CurrentComputerUser -<setting name>

      Clears the specified setting for the current user only.

      @@ -241,7 +246,7 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m

      Displays the UE-V service configuration that is defined for a computer.

      -

      Get-WmiObject –Namespace root\Microsoft\Uev ConfigurationItem

      +

      Get-WmiObject -Namespace root\Microsoft\Uev ConfigurationItem

      Displays the details for each configuration item.

      @@ -339,10 +344,12 @@ When you are finished configuring the UE-V service with WMI and Windows PowerShe   ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics [Administering UE-V with Windows PowerShell and WMI](uev-administering-uev-with-windows-powershell-and-wmi.md) [Administering UE-V](uev-administering-uev.md) + +[User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) diff --git a/windows/manage/uev-migrating-settings-packages.md b/windows/manage/uev-migrating-settings-packages.md index 0bf674caeb..85bb7a71b0 100644 --- a/windows/manage/uev-migrating-settings-packages.md +++ b/windows/manage/uev-migrating-settings-packages.md @@ -11,6 +11,8 @@ ms.prod: w10 # Migrating UE-V settings packages +**Applies to** +- Windows 10, version 1607 In the lifecycle of a User Experience Virtualization (UE-V) deployment, you might have to relocate the user settings packages either when you migrate to a new server or when you perform backups. Settings packages might have to be migrated in the following scenarios: @@ -43,7 +45,7 @@ Simply copying the files and folders does not preserve the security settings and ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-prepare-for-deployment.md b/windows/manage/uev-prepare-for-deployment.md index a7735d20e4..0fa6f10ff2 100644 --- a/windows/manage/uev-prepare-for-deployment.md +++ b/windows/manage/uev-prepare-for-deployment.md @@ -10,7 +10,8 @@ ms.prod: w10 # Prepare a UE-V Deployment -Applies to: Windows 10, version 1607 +**Applies to** +- Windows 10, version 1607 Before you deploy User Experience Virtualization (UE-V), review this topic for important information about the type of deployment you’re planning and for preparations you can make beforehand so that your deployment is successful. If you leave this page, be sure to come back and read through the planning information in this topic. @@ -78,10 +79,11 @@ This section explains which settings are synchronized by default in UE-V, includ - A statement of support for Windows applications setting synchronization -See [Microsoft Authored Office 2016 UE-V Templates](https://www.microsoft.com/download/details.aspx?id=46367) to download a list of the specific Office 2016 settings that are synchronized by UE-V. +For downloadable UE-V templates, see: -To download a list of the Microsoft Office 2013 and 2010 settings that are synchronized by UE-V, see [User Experience Virtualization (UE-V) settings templates for Microsoft Office](https://www.microsoft.com/download/details.aspx?id=46367). +- [Microsoft Authored Office 2016 UE-V Templates](https://gallery.technet.microsoft.com/Authored-Office-2016-32-0dc05cd8) +- [User Experience Virtualization (UE-V) settings templates for Microsoft Office](https://www.microsoft.com/download/details.aspx?id=46367) (for Office 2013 and Office 2010) ### Desktop applications synchronized by default in UE-V @@ -302,9 +304,11 @@ The UE-V settings storage location and settings template catalog support storing - Format the storage volume with an NTFS file system. - +- The share can use Distributed File System (DFS) replication, but Distributed File System Replication (DFSR) is specifically not supported. Distributed File System Namespaces (DFSN) are supported. For detailed information, see: -- The share can use Distributed File System (DFS) replication, but Distributed File System Replication (DFSR) is specifically not supported. Distributed File System Namespaces (DFSN) are supported. For detailed information, see [Microsoft’s Support Statement Around Replicated User Profile Data](http://go.microsoft.com/fwlink/p/?LinkId=313991). + - [Information about roaming profiles from the Directory Services team](https://blogs.technet.microsoft.com/askds/tag/roaming-profiles/) + + - [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009) In addition, because SYSVOL uses DFSR for replication, SYSVOL cannot be used for UE-V data file replication. @@ -383,6 +387,10 @@ Install the UE-V template generator on the device that is used to create custom The UE-V template generator must be installed on a device that uses an NTFS file system. The UE-V template generator software requires .NET Framework 4. For more information, see [Use UE-V with custom applications](uev-deploy-uev-for-custom-applications.md). +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). + ## Other resources for this feature - [User Experience Virtualization overview](uev-for-windows.md) diff --git a/windows/manage/uev-privacy-statement.md b/windows/manage/uev-privacy-statement.md index 30e1e65622..eb9e64f8a1 100644 --- a/windows/manage/uev-privacy-statement.md +++ b/windows/manage/uev-privacy-statement.md @@ -1,156 +1,4 @@ --- title: User Experience Virtualization Privacy Statement -description: User Experience Virtualization Privacy Statement -author: jamiejdt -ms.assetid: c2919034-f2cf-48d6-b18e-4dd318252426 -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w8 ---- - - -# User Experience Virtualization Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft User Experience Virtualization (“UE-V”). This is a preliminary disclosure that focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft User Experience Virtualization allows the separation of settings from an application or operating system. Those settings can then be transferred to a remote storage location, eliminating the constraints of local storage and giving users the ability to have their settings follow them to other computers. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by UE-V may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -The privacy details for each UE-V feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of Your Information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to This Privacy Statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us [MSUEVPrivacy@microsoft.com](mailto:%20MSUEVPrivacy@microsoft.com). - -## Specific features - - -The remainder of this document will address the following specific features: - -### UE-V Generator - -**What This Feature Does**: - -The UE-V generator is used to create settings location templates. These templates allow users to roam the settings for their applications. - -**Information Collected, Processed, or Transmitted**: - -When creating a settings location template the UE-V generator uses a Lightweight Directory Access Protocol (LDAP) query to get username and email address of the current logged in user. This information is stored in the template as the template author name and template author email. None of this information is sent to Microsoft. - -If you plan to share settings location templates with anyone outside your organization you should review all the settings locations and ensure the settings location template do not contain any personal or company information. You can view the contents by opening the settings location template files using any XML viewer. The following are ways you can view and remove any personal or company information from the settings location template files before sharing with anyone outside your company: - -- **Template Author Name** – Specify a general, non-identifying name for the template author name or exclude this data from the template. - -- **Template Author Email** – Specify a general, non-identifying template author email or exclude this data from the template. - -**Use of Information**: - -The template author name and template author email can be used to identify the author of settings location template. If you share the template, the author name and email is viewable to all who use the template. No information is sent to Microsoft. - -**Choice/Control**:  - -To remove the template author name or template author email, start the UE-V generator application. Select **Edit a Settings Location Template**. Select the settings location template to edit from the recently used templates or Browse to the settings template file. Select **Next** to continue. On the Properties page, remove the data from the Template author name or Template author email text fields. Save the settings location template. - -## Customer Experience Improvement Program - - -**What This Feature Does:** - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We will not collect your name, address, or other contact information. - -**Information Collected, Processed, or Transmitted:** - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -**Use of Information:** - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -**Choice/Control:** - -You are offered the opportunity to participate in CEIP during setup of the UE-V Agent. If you choose to participate and later change your mind, you can turn off CEIP at any time by:Re-running the UE-V agent setup and opting out of CEIP or by setting the following registry key either manually or via Group Policy: - -``` syntax -Key = HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent -RegEntry name = CustomerExperienceImprovementProgram -Entry type REG_DWORD (Hexadecimal): -0 is off -1 is on -``` - -## Microsoft Error Reporting - - -**What This Feature Does:** - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with UE-V or other enabled applications to Microsoft and to receive information that may help you avoid or solve such problems. - -**Information Collected, Processed, or Transmitted:** - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . - -**Use of Information:** - -We use the error reporting data to solve customer problems and improve our software and services. - -**Choice/Control:** - -If you choose the recommended settings during Windows setup, you turn on automatic checking for solutions, which will send basic error reports and look for solutions to the problems reported. If you use automatic checking, you are not typically prompted to send basic information about errors to Microsoft. If a more detailed error report is required, you will be prompted to review it. You can change this setting at any time by going to Action Center in Control Panel. - -**Important Information:** - -Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at . - -UE-V will not modify the Microsoft Error Reporting preference and will honor the system setting in the Control Panel and/or the setting enforced via Group Policy. - -## Microsoft Update - - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at - -**Use of Information:** - -- For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -- Choice/Control: - - For details about controlling this feature, see the Update Services Privacy Statement at . - +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/uev-security-considerations +--- \ No newline at end of file diff --git a/windows/manage/uev-release-notes-1607.md b/windows/manage/uev-release-notes-1607.md index d28d61f312..416b8f4508 100644 --- a/windows/manage/uev-release-notes-1607.md +++ b/windows/manage/uev-release-notes-1607.md @@ -10,10 +10,26 @@ ms.prod: w10 # User Experience Virtualization (UE-V) Release Notes -Applies to: Windows 10, version 1607 +**Applies to** +- Windows 10, version 1607 This topic includes information required to successfully install and use UE-V that is not included in the User Experience Virtualization (UE-V) documentation. If there are differences between the information in this topic and other UE-V topics, the latest change should be considered authoritative. +### Company Settings Center removed in UE-V for Windows 10, version 1607 + +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. + +With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. + +Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. + +**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: + +- Contact IT Link Text +- Contact IT URL +- Tray Icon + + ### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked Version 1.0 of UE-V used Offline Files (Client Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607. @@ -84,22 +100,22 @@ This section contains hotfixes and KB articles for UE-V. | KB Article | Title | Link | |------------|---------|--------| -| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608/EN-US](http://support.microsoft.com/kb/3018608/EN-US) | -| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501/EN-US](http://support.microsoft.com/kb/2903501/EN-US) | -| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042/EN-US](http://support.microsoft.com/kb/2770042/EN-US) | -| 2847017 | UE-V settings replicated by Internet Explorer | [support.microsoft.com/kb/2847017/EN-US](http://support.microsoft.com/kb/2847017/EN-US) | -| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631/EN-US](http://support.microsoft.com/kb/2769631/EN-US) | -| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989/EN-US](http://support.microsoft.com/kb/2850989/EN-US) | -| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586/EN-US](http://support.microsoft.com/kb/2769586/EN-US) | -| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997/EN-US](http://support.microsoft.com/kb/2782997/EN-US) | -| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570/EN-US](http://support.microsoft.com/kb/2769570/EN-US) | -| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582/EN-US](http://support.microsoft.com/kb/2850582/EN-US) | -| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879/EN-US](http://support.microsoft.com/kb/3041879/EN-US) | -| 2843592 | Information on User Experience Virtualization and High Availability | [support.microsoft.com/kb/2843592/EN-US](http://support.microsoft.com/kb/2843592/EN-US) | +| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608](http://support.microsoft.com/kb/3018608) | +| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501](http://support.microsoft.com/kb/2903501) | +| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](http://support.microsoft.com/kb/2770042) | +| 2847017 | Internet Explorer settings replicated by UE-V | [support.microsoft.com/kb/2847017](http://support.microsoft.com/kb/2847017) | +| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631](http://support.microsoft.com/kb/2769631) | +| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989](http://support.microsoft.com/kb/2850989) | +| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586](http://support.microsoft.com/kb/2769586) | +| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](http://support.microsoft.com/kb/2782997) | +| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570](http://support.microsoft.com/kb/2769570) | +| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582](http://support.microsoft.com/kb/2850582) | +| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879](http://support.microsoft.com/kb/3041879) | +| 2843592 | Information on User Experience Virtualization and High Availability | [support.microsoft.com/kb/2843592](http://support.microsoft.com/kb/2843592) | ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). **Additional resources for this feature** diff --git a/windows/manage/uev-security-considerations.md b/windows/manage/uev-security-considerations.md index 2cfc34087e..11f3d82582 100644 --- a/windows/manage/uev-security-considerations.md +++ b/windows/manage/uev-security-considerations.md @@ -11,6 +11,8 @@ ms.prod: w10 # Security Considerations for UE-V +**Applies to** +- Windows 10, version 1607 This topic contains a brief overview of accounts and groups, log files, and other security-related considerations for User Experience Virtualization (UE-V). For more information, follow the links that are provided here. @@ -215,10 +217,22 @@ We strongly recommend that you do not pre-create folders. Instead, let the UE-V If you redirect UE-V settings to a user’s home directory or a custom Active Directory (AD) directory, ensure that the permissions on the directory are set appropriately for your organization. +### Review the contents of settings location templates and control access to them as needed + +When creating a settings location template, the UE-V generator uses a Lightweight Directory Access Protocol (LDAP) query to get username and email address of the current logged in user. This information is stored in the template as the template author name and template author email. (None of this information is sent to Microsoft.) + +If you plan to share settings location templates with anyone outside your organization you should review all the settings locations and ensure the settings location templates do not contain any personal or company information. You can view the contents by opening the settings location template files using any XML viewer. The following are ways you can view and remove any personal or company information from the settings location template files before sharing with anyone outside your company: + +- **Template Author Name** – Specify a general, non-identifying name for the template author name or exclude this data from the template. + +- **Template Author Email** – Specify a general, non-identifying template author email or exclude this data from the template. + +To remove the template author name or template author email, you can use the UE-V generator application. From the generator, select **Edit a Settings Location Template**. Select the settings location template to edit from the recently used templates or Browse to the settings template file. Select **Next** to continue. On the Properties page, remove the data from the Template author name or Template author email text fields. Save the settings location template. + ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-sync-methods.md b/windows/manage/uev-sync-methods.md index 7b78c035f0..f6f490523d 100644 --- a/windows/manage/uev-sync-methods.md +++ b/windows/manage/uev-sync-methods.md @@ -10,6 +10,8 @@ ms.prod: w10 # Sync Methods for UE-V +**Applies to** +- Windows 10, version 1607 The User Experience Virtualization (UE-V) service lets you synchronize users’ application and Windows settings with the settings storage location. The *Sync Method* configuration defines how the UE-V service uploads and downloads those settings to the settings storage location. UE-V includes a SyncMethod called the *SyncProvider*. For more information about trigger events that start the synchronization of application and Windows settings, see [Sync Trigger Events for UE-V](uev-sync-trigger-events.md). @@ -33,7 +35,7 @@ You can configure the sync method in these ways: ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
      For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-sync-trigger-events.md b/windows/manage/uev-sync-trigger-events.md index 811a463e97..46add6efc1 100644 --- a/windows/manage/uev-sync-trigger-events.md +++ b/windows/manage/uev-sync-trigger-events.md @@ -10,6 +10,8 @@ ms.prod: w10 # Sync Trigger Events for UE-V +**Applies to** +- Windows 10, version 1607 User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices. *Sync trigger events* define when the UE-V service synchronizes those settings with the settings storage location. For more information about Sync Method configuration, see [Sync Methods for UE-V](uev-sync-methods.md). @@ -34,7 +36,7 @@ The following table explains the trigger events for classic applications and Win

      Windows Logon

      • Application and Windows settings are imported to the local cache from the settings storage location.

        • -

      • [Asynchronous Windows settings](http://technet.microsoft.com/library/dn458932.aspx#autosyncsettings2) are applied.

        • +

      • [Asynchronous Windows settings](uev-prepare-for-deployment.md#windows-settings-synchronized-by-default) are applied.

      • Synchronous Windows settings will be applied during the next Windows logon.

      • Application settings will be applied when the application starts.

      @@ -88,7 +90,7 @@ The following table explains the trigger events for classic applications and Win

    • Asynchronous Windows settings are applied directly.

    • Application settings are applied when the application starts.

    • Both asynchronous and synchronous Windows settings are applied during the next Windows logon.

      • -

    • Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](http://technet.microsoft.com/library/dn458944.aspx) for more information.

      • +

    • Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](uev-changing-the-frequency-of-scheduled-tasks.md#monitor-application-settings) for more information.

    NA

    @@ -105,7 +107,7 @@ The following table explains the trigger events for classic applications and Win ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-synchronizing-microsoft-office-with-uev.md b/windows/manage/uev-synchronizing-microsoft-office-with-uev.md index 47aaa206af..784667ed37 100644 --- a/windows/manage/uev-synchronizing-microsoft-office-with-uev.md +++ b/windows/manage/uev-synchronizing-microsoft-office-with-uev.md @@ -11,16 +11,19 @@ ms.prod: w10 # Synchronizing Office with UE-V +**Applies to** +- Windows 10, version 1607 + Microsoft User Experience Virtualization (UE-V) supports the synchronization of Microsoft Office application settings. The combination of UE-V and App-V support for Office enables the same experience on virtualized instances of Office from any UE-V-enabled device or virtualized desktop. -To synchronize Office applications settings, you can download Office templates from the [Microsoft User Experience Virtualization (UE-V) Template Gallery](http://go.microsoft.com/fwlink/p/?LinkId=246589). This resource provides Microsoft-authored UE-V settings location templates as well as community-developed settings location templates. +To synchronize Office applications settings, you can download Office templates from the [User Experience Virtualization (UE-V) Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V&f%5B0%5D.Text=UE-V). This resource provides Microsoft-authored UE-V settings location templates as well as community-developed settings location templates. ## Microsoft Office support in UE-V UE-V includes settings location templates for Microsoft Office 2016, 2013, and 2010. In previous versions of UE-V, settings location templates for Office 2013 and Office 2010 were distributed and registered when you installed the UE-V agent. Now that UE-V is a feature in Windows 10, version 1607, settings location templates are installed when you install or upgrade to the new operating system. -These templates help synchronize users’ Office experience between devices. Microsoft Office 2016 settings roamed by Office 365 experience are not included in these settings. For a list of Office 365-specific settings, see [Overview of user and roaming settings for Office](http://go.microsoft.com/fwlink/p/?LinkId=391220). +These templates help synchronize users’ Office experience between devices. Microsoft Office 2016 settings roamed by Office 365 experience are not included in these settings. For a list of Office 365-specific settings, see [Overview of user and roaming settings for Office](https://technet.microsoft.com/library/jj733593.aspx). ## Synchronized Office Settings @@ -131,9 +134,9 @@ You can deploy UE-V settings location template with the following methods: - **Registering template with Template Catalog Path**. If you use the Settings Template Catalog Path to manage templates on users’ computers, copy the Office template into the folder defined in the UE-V service. The next time the Template Auto Update (ApplySettingsCatalog.exe) scheduled task runs, the settings location template will be registered on the device. For more information, see [Deploy a settings template catalog](uev-deploy-uev-for-custom-applications.md#deployasettingstemplatecatalog). -- **Registering template with Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to user devices. For more information, see the guidance provided in the documentation for the [System Center Configuration Pack for User Experience Virtualization](http://go.microsoft.com/fwlink/?LinkId=317263). +- **Registering template with Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to user devices. For more information, see the guidance provided in the documentation for the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/en-us/download/details.aspx?id=40913). ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-technical-reference.md b/windows/manage/uev-technical-reference.md index d8eec5847d..20adefafdf 100644 --- a/windows/manage/uev-technical-reference.md +++ b/windows/manage/uev-technical-reference.md @@ -11,6 +11,8 @@ ms.prod: w10 # Technical Reference for UE-V +**Applies to** +- Windows 10, version 1607 This technical reference section includes additional technical documentation about the various features of User Experience Virtualization (UE-V). This information is provided to help the administrator better understand UE-V. @@ -33,10 +35,6 @@ This technical reference section includes additional technical documentation abo Details the XML structure of UE-V settings location templates and provides guidance for editing these files. -- [Accessibility for UE-V](uev-accessibility.md) - - Describes features and services that make UE-V more accessible for people with disabilities. - - [Security Considerations for UE-V](uev-security-considerations.md) Provides a brief overview of accounts, groups, and other security-related considerations for UE-V. @@ -57,7 +55,7 @@ This technical reference section includes additional technical documentation abo ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc).   diff --git a/windows/manage/uev-troubleshooting.md b/windows/manage/uev-troubleshooting.md index bc48051f72..4060f14739 100644 --- a/windows/manage/uev-troubleshooting.md +++ b/windows/manage/uev-troubleshooting.md @@ -11,48 +11,20 @@ ms.prod: w10 # Troubleshooting UE-V +**Applies to** +- Windows 10, version 1607 -Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](http://go.microsoft.com/fwlink/p/?LinkId=224905). +For information that can help with troubleshooting UE-V for Windows 10, see: -## Find troubleshooting information +- [UE-V: List of Microsoft Support Knowledge Base Articles](http://social.technet.microsoft.com/wiki/contents/articles/14271.ue-v-list-of-microsoft-support-knowledge-base-articles.aspx) +- [User Experience Virtualization Release Notes](uev-release-notes-1607.md) -You can use the following information to find troubleshooting content or additional technical content for this product. +- [Technical Reference for UE-V](uev-technical-reference.md) +- [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc) -**To search the TechNet Wiki** - -1. Open a web browser and browse to the [TechNet Wiki](http://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Locate the **Search TechNet Wiki** search box and enter your search term. - -3. Review the search results for assistance. - -## Create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in TechNet Wiki, you can create your own TechNet Wiki article. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Open a web browser and browse to the [TechNet Wiki](http://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Sign in with your Microsoft account. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article** in the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template, which is named **Troubleshooting.html**, and then click **Insert**. - -6. Give the article a descriptive title, and then overwrite the template information as needed to create your article. - -7. After you review your article, add a tag that is named **Troubleshooting** and another tag for the product name. To add tags help other users find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for this feature - +## Other resources - [User Experience Virtualization overview](uev-for-windows.md) @@ -62,18 +34,6 @@ If you have a troubleshooting tip or a best practice to share that is not alread - [Administering UE-V](uev-administering-uev.md) -- [Technical reference for UE-V](uev-technical-reference.md) - ## Have a suggestion for UE-V? - -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). - -  - -  - - - - - +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). diff --git a/windows/manage/uev-upgrade-uev-from-previous-releases.md b/windows/manage/uev-upgrade-uev-from-previous-releases.md index acfd9ce64a..aa12c04977 100644 --- a/windows/manage/uev-upgrade-uev-from-previous-releases.md +++ b/windows/manage/uev-upgrade-uev-from-previous-releases.md @@ -10,7 +10,8 @@ ms.prod: w10 # Upgrade to UE-V for Windows 10 -Applies to: Windows 10, version 1607 +**Applies to** +- Windows 10, version 1607 If you’re already using UE-V 2.x and you’re planning to upgrade user devices to Windows 10, version 1607 or later releases, you need to make only a few adjustments to your existing environment. These steps are explained in more detail below. @@ -26,7 +27,7 @@ If you’re already using UE-V 2.x and you’re planning to upgrade user devices ## Upgrade user devices to Windows 10, version 1607 -Performing an in-place upgrade on user devices automatically installs the UE-V service, updates the settings location path, and migrates users' UE-V settings. See the [Windows 10 for IT Pros documentation](https://technet.microsoft.com/itpro/windows/index) for information about upgrading user devices to Windows 10. +Performing an in-place upgrade on user devices automatically installs the UE-V service, updates the settings location path, and migrates users' UE-V settings. See the [Windows 10 documentation for IT Pros](https://technet.microsoft.com/itpro/windows/deploy/index) for information about upgrading user devices to Windows 10. ## Verify that UE-V settings were migrated correctly @@ -90,6 +91,9 @@ The UE-V template generator is included in the Windows Assessment and Deployment 3. To open the generator, open the **Start** menu and navigate to **Windows Kits** > **Microsoft User Experience Virtualization (UE-V) Template Generator**. +## Have a suggestion for UE-V? + +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Other resources for this feature diff --git a/windows/manage/uev-using-uev-with-application-virtualization-applications.md b/windows/manage/uev-using-uev-with-application-virtualization-applications.md index 1f495c9b74..7d75a528a0 100644 --- a/windows/manage/uev-using-uev-with-application-virtualization-applications.md +++ b/windows/manage/uev-using-uev-with-application-virtualization-applications.md @@ -11,6 +11,8 @@ ms.prod: w10 # Using UE-V with Application Virtualization applications +**Applies to** +- Windows 10, version 1607 User Experience Virtualization (UE-V) supports Microsoft Application Virtualization (App-V) applications without any required modifications to either the App-V package or the UE-V template. However, an additional step is required because you cannot run the UE-V template generator directly on a virtualized App-V application. Instead, you must install the application locally, generate the template, and then apply the template to the virtualized application. UE-V supports App-V for Windows 10 packages and App-V 5.0 packages. @@ -37,7 +39,7 @@ UE-V monitors when an application opens by the program name and, optionally, by ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-whats-new-in-uev-for-windows.md b/windows/manage/uev-whats-new-in-uev-for-windows.md index f4192c7109..a7759f623e 100644 --- a/windows/manage/uev-whats-new-in-uev-for-windows.md +++ b/windows/manage/uev-whats-new-in-uev-for-windows.md @@ -10,7 +10,8 @@ ms.prod: w10 # What's New in UE-V -Applies to: Windows 10, version 1607 +**Applies to** +- Windows 10, version 1607 User Experience Virtualization (UE-V) for Windows 10, version 1607, includes these new features and capabilities compared to UE-V 2.1. See [UE-V Release notes](uev-release-notes-1607.md) for more information about the UE-V for Windows 10, version 1607 release. @@ -24,6 +25,10 @@ The changes in UE-V for Windows 10, version 1607 impact already existing impleme - The UE-V template generator is available from the Windows 10 ADK. In previous releases of UE-V, the template generator was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new template generator to create new settings location templates, existing settings location templates will continue to work. +- The Company Settings Center was removed and is no longer available on user devices. Users can no longer manage their synchronized settings. + +- The inbox templates such as Office 2016 and IE 10 are included as a part of Windows 10 and need to be manually registered with Powershell or Group policy before use. + For more information about how to configure an existing UE-V installation after upgrading user devices to Windows 10, see [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md). > **Important**  You can upgrade your existing UE-V installation to Windows 10 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10. @@ -32,11 +37,25 @@ For more information about how to configure an existing UE-V installation after UE-V for Windows 10 includes a new template generator, available from a new location. If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create settings location templates. The UE-V for Windows 10 template generator is now available in the [Windows 10 Assessment and Deployment Kit](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) (Windows ADK). +## Company Settings Center removed in UE-V for Windows 10, version 1607 + +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. + +With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. + +Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. + +**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: + +- Contact IT Link Text +- Contact IT URL +- Tray Icon + ## Compatibility with Microsoft Enterprise State Roaming With Windows 10, version 1607, users can synchronize Windows application settings and Windows operating system settings to Azure instead of to OneDrive. You can use the Windows 10 enterprise sync functionality together with UE-V on on-premises domain-joined devices only. -In hybrid cloud environments, UE-V can roam win32 applications on-premise while [Enterprise State Roaming](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) (ESR) can roam the rest, e.g., Windows and desktop settings, themes, colors, etc., to an Azure cloud installation. +In hybrid cloud environments, UE-V can roam Win32 applications on-premises while [Enterprise State Roaming](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) (ESR) can roam the rest, e.g., Windows and desktop settings, themes, colors, etc., to an Azure cloud installation. To configure UE-V to roam Windows desktop and application data only, change the following group policies: @@ -52,6 +71,7 @@ Additionally, to enable Windows 10 and UE-V to work together, configure these po - Disable “Sync Windows Settings” + ## Settings Synchronization Behavior Changed in UE-V for Windows 10 While earlier versions of UE-V roamed taskbar settings between Windows 10 devices, UE-V for Windows 10, version 1607 does not synchronize taskbar settings between devices running Windows 10 and devices running previous versions of Windows. @@ -86,11 +106,11 @@ To enable settings synchronization using UE-V, do one of the following: - Do not enable the Office 365 synchronization experience during Office 2013 installation -UE-V includes Office 2016, Office 2013, and Office 2010 templates. Office 2007 templates are no longer supported. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](http://go.microsoft.com/fwlink/p/?LinkID=246589). +UE-V includes Office 2016, Office 2013, and Office 2010 templates. Office 2007 templates are no longer supported. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get templates from the [User Experience Virtualization Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V&f%5B0%5D.Text=UE-V). ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md b/windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md index d708176c7f..056526037b 100644 --- a/windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md +++ b/windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md @@ -11,7 +11,8 @@ ms.prod: w10 # Working with custom UE-V templates and the UE-V template generator -Applies to: Windows 10, version 1607 +**Applies to** +- Windows 10, version 1607 User Experience Virtualization (UE-V) uses XML files called ***settings location templates*** to monitor and synchronize application settings and Windows settings between user devices. By default, some settings location templates are included in UE-V. However, if you want to synchronize settings for desktop applications other than those included in the default templates, you can create your own custom settings location templates with the UE-V template generator. You can also edit or validate custom settings location templates with the UE-V template generator. @@ -129,8 +130,7 @@ It is possible to create or edit settings location templates in an XML editor wi ## Share settings location templates with the Template Gallery - -The UE-V template gallery enables administrators to share their UE-V settings location templates. Upload your settings location templates to the gallery for other users to use, and download templates that other users have created. The UE-V template gallery is located on Microsoft TechNet [here](http://go.microsoft.com/fwlink/p/?LinkId=246589). +The [User Experience Virtualization Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V&f%5B0%5D.Text=UE-V) enables administrators to share their UE-V settings location templates. Upload your settings location templates to the gallery for other users to use, and download templates that other users have created. Before you share a settings location template on the UE-V template gallery, ensure it does not contain any personal or company information. You can use any XML viewer to open and view the contents of a settings location template file. The following template values should be reviewed before you share a template with anyone outside your company. @@ -143,7 +143,7 @@ Before you deploy any settings location template that you have downloaded from t ## Have a suggestion for UE-V? -Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). +Add or vote on suggestions on the [User Experience Virtualization feedback site](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization).
    For UE-V issues, use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-us/home?forum=mdopuev&filter=alltypes&sort=lastpostdesc). ## Related topics diff --git a/windows/manage/windows-10-mobile-and-mdm.md b/windows/manage/windows-10-mobile-and-mdm.md index a7d4e10a34..6e1b32d24a 100644 --- a/windows/manage/windows-10-mobile-and-mdm.md +++ b/windows/manage/windows-10-mobile-and-mdm.md @@ -1,75 +1,59 @@ --- -title: Windows 10 Mobile and mobile device management (Windows 10) -description: This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. +title: Windows 10 Mobile deployment and management guide (Windows 10) +description: This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E -keywords: telemetry, BYOD, MDM +keywords: Mobile, telemetry, BYOD, MDM ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile, devices, security -author: AMeeus localizationpriority: high +author: AMeeus --- -# Windows 10 Mobile and mobile device management +# Windows 10 Mobile deployment and management guide -**Applies to** -- Windows 10 Mobile +*Applies to: Windows 10 Mobile, version 1511 and Windows 10 Mobile, version 1607* -This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. It describes how mobile device management (MDM) systems use the built-in device management client to deploy, configure, maintain, and support phones and small tablets running Windows 10 Mobile. +This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. -Bring Your Own Device (BYOD—that is, personal devices) and corporate devices are key scenarios that Windows 10 Mobile MDM capabilities support. The operating system offers a flexible approach to registering devices with directory services and MDM systems, and IT organizations can provision comprehensive device-configuration profiles based on their company’s need to control and secure mobile business data. -Windows 10 Mobile not only delivers more comprehensive, restrictive configuration settings than Windows Phone 8.1 did but also provides capabilities to deploy and manage apps built on the Universal Windows Platform (UWP). Companies can distribute apps directly from Windows Store or by using their MDM system. They can control and distribute custom line-of-business (LOB) apps the same way. +Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. +Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution. -## Overview +**In this article** +- Deploy +- Configure +- Apps +- Manage +- Retire -Organizations’ users increasingly depend on their mobile devices, but phones and tablets bring new and unfamiliar challenges for IT departments. IT must be able to deploy and manage mobile devices and apps quickly to support the business while balancing the growing need to protect corporate data because of evolving laws, regulations, and cybercrime. IT must ensure that the apps and data on those mobile devices are safe, especially on personal devices. Windows 10 Mobile helps organizations address these challenges by providing a robust, flexible, built-in MDM client. IT departments can use the MDM system of their choice to manage this client. -### Built-in MDM client +## Deploy + +Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which Mobile Device Management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. +Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or System Center Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). + +### Deployment scenarios + +*Applies to: Corporate and personal devices* The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. -- **Device enrollment.** Users can enroll in the MDM system. On Windows 10, a user can register a device with Microsoft Azure Active Directory (Azure AD) and enroll in an MDM system at the same time so that the system can manage the device, the apps running on it, and the confidential data it holds. Enrollment establishes the management authority for the device. Only one management authority (or MDM enrollment) is possible at a time, which helps prevent unauthorized access to devices and ensures their stability and reliability. -- **Device management.** The MDM client allows the MDM system to configure policy settings; deploy apps and updates; and perform other management tasks, such as remotely wiping the device. The MDM system sends configuration requests and collects inventory through the MDM client. The client uses [configuration service providers (CSPs)](http://go.microsoft.com/fwlink/p/?LinkId=734049) to configure and inventory settings. A CSP is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. (The security architecture of Windows 10 Mobile prevents direct access to registry settings and operating system files. For more information, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md).) +Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. +Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Windows Store for Business, or by using their MDM system, which can also work with the Windows Store for Business for public store apps. +Knowing who owns the device and what the employee will use it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. -The MDM client is an integral part of Windows 10 Mobile. As a result, there is no need for an additional, custom MDM app to enroll the device or to allow an MDM system to manage it. All MDM systems have equal access to Windows 10 Mobile MDM application programming interfaces (APIs), so you can choose Microsoft Intune or a third-party MDM product to manage Windows 10 Mobile devices. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050). +For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. -### Windows 10 Mobile editions +For **corporate devices**, organizations have a lot more control. IT can provide a selected list of supported device models to employees, or they can directly purchase and preconfigure them. Because devices are owned by the company, employees can be limited as to how much they can personalize these devices. Security and privacy concerns may be easier to navigate, because the device falls entirely under existing company policy. -Every device that runs Windows 10 Mobile includes all the enterprise mobile device security and management capabilities the MDM client provides. Microsoft also offers an Enterprise edition of Windows 10 Mobile, which includes three additional capabilities. To enable these capabilities, you can provision a license file without reinstalling the operating system: +### Device enrollment -- **Ability to postpone software updates.**Windows 10 Mobile gets software updates directly from Windows Update, and you cannot curate updates prior to deployment. Windows 10 Mobile Enterprise, however, allows you to curate and validate updates prior to deploying them. -- **No limit on the number of self-signed LOB apps that you can deploy to a single device.** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device, more than 20 if your organization’s devices run Windows 10 Mobile Enterprise. -- **Set telemetry to security level.** The telemetry security level configures the operating system to gather only the telemetry information required to keep devices secured. +*Applies to: Corporate and personal devices* ->**Note:**  Your organization can opt to purchase a code signing certificate from Verisign to sign LOB apps or use [Windows Store for Business](windows-store-for-business.md) to obtain apps. With either method, you can distribute more than 20 apps to a single device without activating Windows 10 Mobile Enterprise on that device by using your MDM system. -  -To activate Windows 10 Mobile Enterprise on any Windows 10 Mobile device, use your company’s MDM system or a provisioning package to inject a license onto the device. You can download a Windows 10 Mobile Enterprise license from the Business Support Portal. +The way in which personal and corporate devices are enrolled into an MDM system differs. Your operations team should consider these differences when determining which approach is best for mobile workers in your organization. -### Lifecycle management - -Windows 10 Mobile supports end-to-end lifecycle device management to give companies control of their devices, data, and apps. Comprehensive MDM systems use the built-in MDM client to manage devices throughout their lifecycle, as Figure 1 illustrates. The remainder of this guide describes the operating system’s mobile device and app management capabilities through each phase of the lifecycle, showing how MDM systems use specific features. - -![figure 1](images/win10-mobile-mdm-fig1.png) - -Figure 1. Device management lifecycle - -## Device deployment - -Device deployment includes the initial registration and configuration of the device, including its enrollment with an MDM system. Sometimes, companies preinstall apps. The major factors in how you deploy devices and which controls you put in place are device ownership and how the user will use the device. This guide covers two scenarios: - -1. Companies allow users to personalize their devices because the users own the devices or because company policy doesn’t require tight controls (defined as *personal devices* in this guide). -2. Companies don’t allow users to personalize their devices or they limit personalization, usually because the organization owns the devices and security considerations are high (defined as *corporate devices* in this guide). - -Often, employees can choose devices from a list of supported models, or companies provide devices that they preconfigure, or bootstrap, with a baseline configuration. - -Microsoft recommends Azure AD Join and MDM enrollment and management for corporate devices and Azure AD Registration and MDM enrollment and management for personal devices. - -### Deployment scenarios - -Most organizations support both personal and corporate device scenarios. The infrastructure for these scenarios is similar, but the deployment process and configuration policies differ. Table 1 describes characteristics of the personal and corporate device scenarios. Activation of a device with an organizational identity is unique to Windows 10 Mobile. - -Table 1. Characteristics of personal and corporate device scenarios +**Device initialization and enrollment considerations** @@ -80,35 +64,49 @@ Table 1. Characteristics of personal and corporate device scenarios - - + + - - + + - - - + + + - - - + + +
    Personal devicesCorporate devicesPersonal devicesCorporate devices
    OwnershipUserOwnershipEmployee Organization
    Primary usePersonalWorkDevice Innitialization + +In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device.The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). +Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity. +Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset. +
    DeploymentThe primary identity on the device is a personal identity. A Microsoft account is the default option for Windows 10 Mobile.The primary identity on the device is an organizational identity. An Azure AD account is the default option for Windows 10 Mobile.Device Enrollment + +Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM). +MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). +The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM).
    -  -### Identity management -People can use only one account to activate a device, so it’s imperative that your organization control which account you enable first. The account you choose will determine who controls the device and influence your management capabilities. The following list describes the impact that users’ identities have on management (Table 2 summarizes these considerations): +**Recommendation:** Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (AAD+MDM) and personal devices (MSA+AAD+MDM). This requires Azure AD Premium. -- **Personal identity.** In this scenario, employees use their Microsoft account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution. You can apply policies to help protect and contain corporate apps and data on the devices, designed to prevent intellectual property leaks, but users keep full control over personal activities, such as downloading and installing apps and games. -- **Organizational identity.** In this scenario, employees use their Azure AD account to register the device to Azure AD and automatically enroll it with the organization’s MDM solution. In this case, companies can block personal use of devices. Using organizational Identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization. +### Identity management -Table 2. Personal vs. organizational identity +*Applies to: Corporate and personal devices* + +Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities. + +>**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. + +The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. + +**Identity choice considerations for device management** @@ -119,1187 +117,959 @@ Table 2. Personal vs. organizational identity - - + + - - + + - - - + + + - - - + + + - - + + - - - + + + + + + + + + + + + + + + + + +
    Personal identityCorporate identityPersonal identityWork identity
    First account on the deviceMicrosoft accountFirst account on the deviceMicrosoft Account Azure AD account
    Device sign-inUsers cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account.Users can unlock devices with an Azure AD account. Organizations can block the addition of a personal identity.Ease of enrollmentEmployees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+AAD+MDM).Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (AAD+MDM – requires Azure AD Premium).
    User settings and data roaming across devicesUser and app settings roam across devices activated with the same personal identity over personal OneDrive.Windows 10 Mobile currently does not support users and app settings roaming over the enterprise cloud. It can block the roaming of personal cloud settings.Credential managementEmployees sign in to the device with Microsoft Account credentials. +Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account. +Employees sign in to the device with Azure AD credentials. +IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. +
    Ability to block the use of a personal identity on the device
    Ability to block the use of a personal identity on the device No Yes
    Level of control

    Organization can apply most* restrictive policies to devices, but they cannot remove the Microsoft account from them. Device users can reclaim full control over their devices by un-enrolling them from the organization’s MDM solution.

    -
    -Note   -

    * MDM functionality on personal devices might be limited in the future.

    -
    -
    -  -
    		Organizations are free to apply the restrictive policies to devices that policy standards and compliance regulations require and prevent the user from un-enrolling the device from the enterprise.User settings and data roaming across multiple Windows devicesUser and app settings roam across all devices activated with the same personal identity through OneDrive.If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD- joined device, this will not be the case. Microsoft is investigating Enterprise roaming for a future release.
    Level of controlOrganizations can apply most of the available restrictive policies to devices and disable the Microsoft account. You can prevent users from reclaiming full control over their devices by unenrolling them from the organization’s MDM solution or resetting the device. Legal limitations may apply. For more information, contact your legal department.Organizations are free to apply any restrictive policies to devices to bring them in line with corporate standards and compliance regulations. They can also prevent the user from unenrolling the device from the enterprise.
    Information ProtectionYou can apply policies to help protect and contain corporate apps and data on the devices and prevent intellectual property leaks, but still provide employees with full control over personal activities like downloading and installing apps and games.Companies can block personal use of devices. Using organizational identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization.
    App purchasesEmployees can purchase and install apps from the Store using a personal credit card.Employees can install apps from your Store for Business. Employees cannot install or purchase app from the Store without the addition of an MSA.
    -  -### Infrastructure requirements -For both device scenarios, the essential infrastructure and tools required to deploy and manage Windows 10 Mobile devices include an Azure AD subscription and an MDM system. -Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid solution. Azure AD has three editions: Free, Basic, and Premium (see [Azure Active Directory editions](http://go.microsoft.com/fwlink/p/?LinkId=723980)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. Organizations that use Microsoft Office 365 or Intune are already using Azure AD. +>**Note:** In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities will change in the future. ->**Note:**  Most industry-leading MDM vendors already support integration with Azure AD or are working on integration. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://go.microsoft.com/fwlink/p/?LinkId=723981). -  -Users can enroll Windows 10 Mobile devices in third-party MDM systems without using an Azure AD organizational account. (By default, Intune uses Azure AD and includes a license). If your organization doesn’t use Azure AD, you must use a personal identity to activate devices and enable common scenarios, such as downloading apps from Windows Store. +### Infrastructure choices -Multiple MDM systems that support Windows 10 Mobile are available. Most support personal and corporate device deployment scenarios. Microsoft offers [Intune](http://go.microsoft.com/fwlink/p/?LinkId=723983), which is part of the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) and a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management, so employees use the same credentials to enroll devices in Intune or sign in to Office 365. Intune supports devices that run other operating systems, as well, such as iOS and Android, to provide a complete MDM solution. +*Applies to: Corporate and personal devices* -You can also integrate Intune with System Center Configuration Manager to gain a single console in which to manage all devices—in the cloud and on premises. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=734051). For guidance on choosing between a stand-alone Intune installation and Intune integrated with Configuration Manager, see [Choose between Intune by itself or integrating Intune with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=723985). -In addition to Intune, other MDM providers support Windows 10 Mobile. Currently, the following MDM systems claim to support Windows 10 and Windows 10 Mobile: [AirWatch](http://go.microsoft.com/fwlink/p/?LinkId=723986), [Citrix](http://go.microsoft.com/fwlink/p/?LinkId=723987), [Lightspeed Systems](http://go.microsoft.com/fwlink/p/?LinkId=723988), [Matrix42](http://go.microsoft.com/fwlink/p/?LinkId=723989), [MobileIron](http://go.microsoft.com/fwlink/p/?LinkId=723990), [SAP](http://go.microsoft.com/fwlink/p/?LinkId=723991), [SOTI](http://go.microsoft.com/fwlink/p/?LinkId=723992), and [Symantec](http://go.microsoft.com/fwlink/p/?LinkId=723993). +For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/en-us/library/mt627908.aspx). -All MDM vendors have equal access to the [Windows 10 MDM APIs](http://go.microsoft.com/fwlink/p/?LinkId=734050). The extent to which they implement these APIs depends on the vendor. Contact your preferred MDM vendor to determine its level of support. +**Azure Active Directory** +Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](http://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. ->**Note:**  Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. -In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (for example, passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052). -  -### Provisioning +**Mobile Device Management** +Microsoft [Intune](http://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. +You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://technet.microsoft.com/en-us/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager. +Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://azure.microsoft.com/en-us/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. -Provisioning is new to Windows 10 and uses the MDM client in Windows 10 Mobile. You can create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10. -To assist users with MDM system enrollment, use a provisioning package. To do so, use the [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) to create a provisioning package, and then install that package on the device. -Users can perform self-service MDM enrollment based on the following deployment scenarios: +>**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. +In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://technet.microsoft.com/en-us/library/ms.o365.cc.devicepolicy.aspx). -- **Corporate device.** During the out-of-the-box experience (OOBE), you can instruct the user to select **This device is owned by my organization** and join the device to Azure AD and the MDM system. -- **Personal device.** The user activates the device with a Microsoft account, but you can instruct him or her to register the device with Azure AD and enroll in Intune. To do so in Windows 10 Mobile, the user clicks, **Settings**, clicks **Accounts**, and then clicks **Work access**. -To automate MDM enrollment, use provisioning packages as follows: -- **Corporate device.** You can create a provisioning package and apply it to a corporate device before delivery to the user, or instruct the user to apply the package during OOBE. After application of the provisioning package, the OOBE process automatically chooses the enterprise path and requires the user to register the device with Azure AD and enroll it in the MDM system. -- **Personal device.** You can create a provisioning package and make it available to users who want to enroll their personal device in the enterprise. The user enrolls the device in the corporate MDM for further configuration by applying the provisioning package. To do so in Windows 10 Mobile, the user clicks **Settings**, clicks **Accounts**, and then clicks **Provisioning**). +**Cloud services** +On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. -Distribute provisioning packages to devices by publishing them in an easily accessible location (e.g., an email attachment or a web page). You can cryptographically sign or encrypt provisioning packages and require that the user enter a password to apply them. +**Windows Push Notification Services** +The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. +However, push notifications can affect battery life so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. Windows 10 Mobile disables the receipt of push notifications to save energy when battery saver is on. +However, there is an exception to this behavior. In Windows 10 Mobile, the Always allowed battery saver setting (found in the Settings app) allows apps to receive push notifications even when battery saver is on. Users can manually configure this list, or IT can use the MDM system to configure the battery saver settings URI scheme in Windows 10 Mobile (ms-settings:batterysaver-settings). -See [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=734054) for more information on creating provisioning packages. +For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). -## Device configuration +**Windows Update for Business** +Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. -The following sections describe the device configuration capabilities of the built-in Windows 10 Mobile MDM client. This client exposes the capabilities to any MDM system compatible with Windows 10. Configurable settings include: +**Windows Store for Business** +The Windows Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps. -- [Email accounts](#email) -- [Account restrictions](#restrictions) -- [Device lock restrictions](#device-lock) -- [Hardware restrictions](#hardware) -- [Certificate management](#certificate) -- [Wi-Fi](#wifi) -- [Proxy](#proxy) -- [Virtual private network (VPN)](#vpn) -- [Access point name (APN) profiles](#apn) -- [Data leak prevention](#data) -- [Storage management](#storage) +## Configure ->**Note:**  Although all the MDM settings this section describes are available in Windows 10 Mobile, not all MDM systems may show them in their user interface. In addition, naming may vary among MDM systems. Consult your MDM system’s documentation for more information. -  -### Email accounts +MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. What configuration settings you use will differ based on the deployment scenario, and corporate devices will offer IT the broadest range of control. -You can use your corporate MDM system to manage corporate email accounts. Define email account profiles in the MDM system, and then deploy them to devices. You would usually deploy these settings immediately after enrollment, regardless of scenario. +>**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. +Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors. -This capability extends to email systems that use EAS. Table 3 lists settings that you can configure in EAS email profiles. +### Account profile -Table 3. Windows 10 Mobile settings for EAS email profiles +*Applies to: Corporate devices* -| Setting | Description | -|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Email Address | The email address associated with the EAS account | -| Domain | The domain name of the Exchange Server instance | -| Account Name | A user-friendly name for the email account on the device | -| Password | The password for the email account | -| Server Name | The server name that the email account uses | -| User Name | The user name for the email account | -| Calendar Age Filter | The age of calendar items to be synchronized with the device (for example, synchronizing calendar items within the past 7 days) | -| Logging | The level of diagnostic logging | -| Mail Body Type | The email body format type: text, HTML, RTF, or Multipurpose Internet Mail Extensions | -| Mail HTML Truncation | The maximum size of an HTML-formatted email message before the message is synchronized to the device (Any HTML-formatted email message that exceeds this size is automatically truncated.) | -| Mail Plain Text Truncation | The maximum size of a text-formatted email message before the message is synchronized to the device (Any text-formatted email message that exceeds this size is automatically truncated.) | -| Schedule | The schedule for synchronizing email between the Exchange Server instance and the device | -| Use SSL | Establishes whether Secure Sockets Layer (SSL) is required when syncing | -| Mail Age Filter | The age of messages to be synchronized with the device (for example, synchronizing messages within the past 7 days) | -| Content Types | The content type that is synchronized (e.g., email, contacts, calendar, task items) | -  -Table 4 lists settings that you can configure in other email profiles. +Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. -Table 4. Windows 10 Mobile settings for other email profiles +- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Windows Store, Xbox, or Groove. +- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts. -| Setting | Description | -|-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------| -| User logon name | The user logon name for the email account | -| Outgoing authentication required | Whether the outgoing server requires authentication | -| Password | The password for the account in the **User logon name** field | -| Domain | The domain name for the account in the **User logon name** field | -| Days to download | How much email (measured in days) should be downloaded from the server | -| Incoming server | The incoming server name and port number, where the value format is *server\_name:port\_number* (The port number is optional.) | -| Send and receive schedule | The length of time (in minutes) between email send-and-receive updates | -| IMAP4 maximum attachment size | The maximum size for message attachments for Internet Message Access Protocol version 4 (IMAP4) accounts | -| Send mail display name | The name of the sender displayed on a sent email | -| Outgoing server | The outgoing server name and port number, where the value format is *server\_name:port\_number* (The port number is optional.) | -| Reply address | The user’s reply email address | -| Email service name | The name of the email service | -| Email service type | The email service type (for example, POP3, IMAP4). | -| Maximum receive message size | The maximum size (in bytes) of messages retrieved from the incoming email server (Messages that exceed this size are truncated to the maximum size.) | -| Delete message action | How messages are deleted on the server (Messages can either be permanently deleted or sent to the Trash folder.) | -| Use cellular only | Whether the account should be used only with cellular connections and not Wi-Fi connections | -| Content types to synchronize | The content types supported for synchronization (in other words, mail messages, contacts, calendar items) | -| Content synchronization server | The name of the content synchronization server, if it’s different from the email server | -| Calendar synchronization server | The name of the calendar synchronization server, if it’s different from the email server | -| Contact server requires SSL | Whether the contact server requires an SSL connection | -| Calendar server requires SSL | Whether the calendar server requires an SSL connection | -| Contact items synchronization schedule | The schedule for syncing contact items | -| Calendar items synchronization schedule | The schedule for syncing calendar items | -| Alternative SMTP email account | The display name associated with a user’s alternative Simple Mail Transfer Protocol (SMTP) email account | -| Alternate SMTP domain name | The domain name for the user’s alternative SMTP email account | -| Alternate SMTP account enabled | Whether the user’s alternative SMTP account is enabled | -| Alternate SMTP password | The password for the user’s alternative SMTP account | -| Incoming and outgoing servers require SSL | A group of properties that specify whether the incoming and outgoing email servers use SSL | -  -### Account restrictions +### Email accounts -On a corporate device registered with Azure AD and enrolled in the MDM system, you can control whether users can use a Microsoft account or add other consumer email accounts. Table 5 lists the settings that you can use to manage accounts on Windows 10 Mobile devices. +*Applies to: Corporate and personal devices* -Table 5. Windows 10 Mobile account management settings -| Setting | Description | -| - | -| -| Allow Microsoft Account | Specifies whether users are allowed to add a Microsoft account to the device after MDM enrollment and use this account for connection authentication and services, such as purchasing apps in Windows Store, or cloud-based consumer services, such as Xbox or Groove. If a device was activated with a Microsoft account, the MDM system would not be able to block that account from being used. | -| Allow Adding Non Microsoft Accounts | Specifies whether users are allowed to add email accounts other than Microsoft accounts after MDM enrollment. If **Allow Microsoft Account** is applied, user can also not use a Microsoft account. | -| Allow “Your Account” | Specifies whether users are able to change account configuration in the **Your Email and Accounts** panel in Settings.| -  -### Device lock restrictions +Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies. -It’s common sense to lock a device when it is not in use. Microsoft recommends that you secure Windows 10 Mobile devices and implement a device lock policy. A device password or PIN lock is a best practice for securing apps and data on devices. [Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=723994) is the name given to the new biometric sign-in option that allows users to use their face, iris, or fingerprints to unlock their compatible device, all of which Windows 10 supports. +- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920017(v=vs.85).aspx). +- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile. ->**Note:**  In addition to the device lock restrictions discussed in this section, Windows 10 supports Microsoft Passport for Work, which lets you access apps and services without a password. -  -Table 6 lists the MDM settings in Windows 10 Mobile that you can use to configure device lock restrictions. +### Device Lock restrictions -Table 6. Windows 10 Mobile device lock restrictions +*Applies to: Corporate and personal devices* + +It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](http://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices. + +>**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. +Companion devices must be paired with Windows 10 PC’s via Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires Pro or Enterprise edition on the Windows 10 PC being signed into. + +Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply. + +- **Device Password Enabled** Specifies whether users are required to use a device lock password. +- **Allow Simple Device Password** Whether users can use a simple password (e.g., 1111 or 1234). +- **Alphanumeric Device Password Required** Whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard. +- **Min Device Password Complex Characters** The number of password element types (i.e., uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. +- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.) +- **Min Device Password Length** The minimum number of characters required to create new passwords. +- **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock. +- **Allow Idle Return Without Password** Whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. +- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.) +- **Screen Timeout While Locked** The number of minutes before the lock screen times out (this policy influences device power management). +- **Allow Screen Timeout While Locked User Configuration** Whether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting). + +Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario. +Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. + +You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information. + +### Prevent changing of settings + +*Applies to: Corporate devices* + +Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change. + +- **Allow Your Account** Specifies whether users are able to change account configuration in the Your Email and Accounts panel in Settings +- **Allow VPN** Allows the user to change VPN settings +- **Allow Data Sense** Allows the user to change Data Sense settings +- **Allow Date Time** Allows the user to change data and time setting +- **Allow Edit Device Name** Allows users to change the device name +- **Allow Speech Model Update** Specifies whether the device will receive updates to the speech recognition and speech synthesis models (to improve accuracy and performance) + +### Hardware restrictions + +*Applies to: Corporate devices* + +Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi Fi. You can use hardware restrictions to control the availability of these features. + +The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. + +>**Note:** Some of these hardware restrictions provide connectivity and assist in data protection. + +- **Allow NFC:** Whether the NFC radio is enabled +- **Allow USB Connection:** Whether the USB connection is enabled (doesn’t affect USB charging) +- **Allow Bluetooth:** Whether users can enable and use the Bluetooth radio on their devices +- **Allow Bluetooth Advertising:** Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices +- **Allow Bluetooth Discoverable Mode:** Whether the device can discover other devices (e.g., headsets) +- **Allow Bluetooth pre-pairing** Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device +- **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect +- **Set Bluetooth Local Device Name:** The local Bluetooth device name +- **Allow Camera:** Whether the camera is enabled +- **Allow Storage Card:** Whether the storage card slot is enabled +- **Allow Voice Recording:** Whether the user can use the microphone to create voice recordings +- **Allow Location:** Whether the device can use the GPS sensor or other methods to determine location so applications can use location information + +### Certificates + +*Applies to: Personal and corporate devices* + +Certificates help improve security by providing account authentication, Wi Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. +To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes. +Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. +In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings. +Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](../keep-secure/installing-digital-certificates-on-windows-10-mobile.md). +Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. + +>**Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Windows Store. This Windows 10 Mobile app can help you: +- View a summary of all personal certificates +- View the details of individual certificates +- View the certificates used for VPN, Wi-Fi, and email authentication +- Identify which certificates may have expired +- Verify the certificate path and confirm that you have the correct intermediate and root CA certificates +- View the certificate keys stored in the device TPM + +### Wi-Fi profiles + +*Applies to: Corporate and personal devices* + +Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. +You can create multiple Wi-Fi profiles in your MDM system. The below table lists the Windows 10 Mobile Wi Fi connection profile settings that can be configured by administrators. + +- **SSID** The case-sensitive name of the Wi Fi network Service Set Identifier +- **Security type** The type of security the Wi Fi network uses; can be one of the following authentication types: + - Open 802.11 + - Shared 802.11 + - WPA-Enterprise 802.11 + - WPA-Personal 802.11 + - WPA2-Enterprise 802.11 + - WPA2-Personal 802.11 +- **Authentication encryption** The type of encryption the authentication uses; can be one of the following encryption methods: + - None (no encryption) + - Wired Equivalent Privacy + - Temporal Key Integrity Protocol + - Advanced Encryption Standard (AES) +- **Extensible Authentication Protocol Transport Layer Security (EAP-TLS)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication +- **Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication +- **Shared key** WPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication. +- **Proxy** The configuration of any network proxy that the Wi Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) +- **Disable Internet connectivity checks** Whether the Wi Fi connection should check for Internet connectivity +- **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file +- **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled + +In addition, you can set a few device wide Wi-Fi settings. +- **Allow Auto Connect to Wi Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks +- **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings +- **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled +- **Allow Internet Sharing** Allow or disallow Internet sharing +- **WLAN Scan Mode** How actively the device scans for Wi-Fi networks + +Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx). + +### APN profiles + +*Applies to: Corporate devices* + +An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. +An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. +You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles. + +- **APN name** The APN name +- *IP connection type* The IP connection type; set to one of the following values: + - IPv4 only + - IPv6 only + - IPv4 and IPv6 concurrently + - IPv6 with IPv4 provided by 46xlat +- **LTE attached** Whether the APN should be attached as part of an LTE Attach +- **APN class ID** The globally unique identifier that defines the APN class to the modem +- **APN authentication type** The APN authentication type; set to one of the following values: + - None + - Auto + - PAP + - CHAP + - MSCHAPv2 +- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type +- **Password** The password for the user account specified in User name +- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile +- **Always on** Whether the connection manager will automatically attempt to connect to the APN whenever it is available +- **Connection enabled** Specifies whether the APN connection is enabled +- **Allow user control** Allows users to connect with other APNs than the enterprise APN +- **Hide view** Whether the cellular UX will allow the user to view enterprise APNs + +Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn958617(v=vs.85).aspx). + +### Proxy + +*Applies to: Corporate devices* + +The below lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity. + +- **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection) +- **Bypass Local** Specifies if the proxy should be bypassed when local hosts are accessed by the device +- **Enable** Specifies if the proxy is enabled +- **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed +- **User Name** Specifies the username used to connect to the proxy +- **Password** Specifies the password used to connect to the proxy +- **Server** Specifies the name of the proxy server +- **Proxy connection type** The proxy connection type, supporting: Null proxy, HTTP, WAP, SOCKS4 +- **Port** The port number of the proxy connection + +For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914762(v=vs.85).aspx). + +### VPN + +*Applies to: Corporate and personal devices* + +Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Windows Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Windows Store using your MDM system (see App Management). + +You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile. +To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings: + +- **VPN Servers** The VPN server for the VPN profile +- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values: + - Split tunnel. Only network traffic destined to the intranet goes through the VPN connection + - Force tunnel. All traffic goes through the VPN connection +- **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic +- **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections) +- **Machine certificate** The machine certificate used for IKEv2-based VPN connections +- **EAP configuration** To create a single sign-on experience for VPN users using certificate authentication, you need to create an Extensible Authentication Protocol (EAP) configuration XML file and include it in the VPN profile +- **L2tpPsk** The pre-shared key used for an L2TP connection +- **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling + +>**Note:** The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard will walk you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. + +Windows Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: + +- **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address +- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (e.g., authentication information) that the plugin provider requires +- **Windows Store VPN plugin family name** Specifies the Windows Store package family name for the Windows Store–based VPN plugin + +In addition, you can specify per VPN Profile: + +- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list will automatically trigger the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +- **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface. +- **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile. +- **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. +- **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List. +- **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings. +- **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it. +- **Remember credentials** Whether the VPN connection caches credentials. +- **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi). +- **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy. +- **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance. +- **Lock Down VPN profile** A Lock Down VPN profile has the following characteristics: + - It is an always-on VPN profile. + - It can never be disconnected. + - If the VPN profile is not connected, the user has no network connectivity. + - No other VPN profiles can be connected or modified. +- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require. + +For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914776(v=vs.85).aspx) + +Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges. +- **Allow VPN** Whether users can change VPN settings +- **Allow VPN Over Cellular** Whether users can establish VPN connections over cellular networks +- **Allow VPN Over Cellular when Roaming** Whether users can establish VPN connections over cellular networks when roaming + +### Storage management + +*Applies to: Corporate and personal devices* + +Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage. The device encryption in Windows 10 Mobile helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. + +Windows 10 Mobile also has the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on so you don’t need to set a policy explicitly to enable it. + +The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. This gives users the flexibility to use an SD card while still protecting the confidential apps and data on it. + +You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards. + +Here is a list of MDM storage management settings that Windows 10 Mobile provides. + +- **Allow Storage Card** Whether the use of storage cards for data storage is allowed +- **Require Device Encryption** Whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) +- **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values: + - AES-Cipher Block Chaining (CBC) 128-bit + - AES-CBC 256-bit + - XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default) + - XTS-AES-256-bit +- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Whether the device allows or disallows the FIPS algorithm policy +- **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections +- **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive +- **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive + + +## Apps + +*Applies to: Corporate and personal devices* + +User productivity on mobile devices is often driven by apps. + +Windows 10 makes it possible to develop apps that work seamlessly across multiple devices using the Universal Windows Platform (UWP) for Windows apps. UWP converges the application platform for all devices running Windows 10 so that apps run without modification on all editions of Windows 10. This saves developers both time and resources, helping deliver apps to mobile users more quickly and efficiently. This write-once, run-anywhere model also boosts user productivity by providing a consistent, familiar app experience on any device type. + +For compatibility with existing apps, Windows Phone 8.1 apps still run on Windows 10 Mobile devices, easing the migration to the newest platform. Microsoft recommend migrating your apps to UWP to take full advantage of the improvements in Windows 10 Mobile. In addition, bridges have been developed to easily and quickly update existing Windows Phone 8.1 (Silverlight) and iOS apps to the UWP. + +Microsoft also made it easier for organizations to license and purchase UWP apps via Windows Store for Business and deploy them to employee devices using the Windows Store, or an MDM system, that can be integrated with the Windows Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security. + +To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/en-us/windows/uwp/porting/index). + +### Windows Store for Business: Sourcing the right app + +*Applies to: Corporate and personal devices* + +The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Windows Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Windows Store. With the Windows Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Windows Store, without the need for MSAs on Windows 10 devices. + +Windows Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices. + +Azure AD authenticated managers have access to Windows Store for Business functionality and settings, and store managers can create a private category of apps that are specific and private to their organization. (You can get more details about what specific Azure AD accounts have access to Windows Store for Business here). Windows Store for Business enables organizations to purchase app licenses for their organization and make apps available to their employees. In addition to commercially available apps, your developers can publish line-of-business (LOB) apps to Windows Store for Business by request. You can also integrate their Windows Store for Business subscriptions with their MDM systems, so the MDM system can distribute and manage apps from Windows Store for Business. + +Windows Store for Business supports app distribution under two licensing models: online and offline. + +The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps. +Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. + +Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps. + +Online licensed apps do not need to be transferred or downloaded from the Windows Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Windows Store for Business reclaims the license so it can be used for another user or on another device. + +To distribute an app offline (organization-managed), the app must be downloaded from the Windows Store for Business. This can be accomplished in the Windows Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Windows Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online licensing method. + +To install acquired Windows Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Windows Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required. + +Windows Store apps or LOB apps that have been uploaded to the Windows Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Windows Store certificates. LOB apps that are uploaded to the Windows Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. + +Learn more about the [Windows Store for Business](windows-store-for-business.md). + +### Managing apps + +*Applies to: Corporate devices* + +IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date. + +Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Windows Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Windows Store. + +For more details, see [AppLocker CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920019(v=vs.85).aspx). + +In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM. + +- **Allow All Trusted Apps** Whether users can sideload apps on the device. +- **Allow App Store Auto Update** Whether automatic updates of apps from Windows Store are allowed. +- **Allow Developer Unlock** Whether developer unlock is allowed. +- **Allow Shared User App Data** Whether multiple users of the same app can share data. +- **Allow Store** Whether Windows Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system. +- **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above. +- **Disable Store Originated Apps** Disables the launch of all apps from Windows Store that came pre-installed or were downloaded before the policy was applied. +- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. +- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card. +- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card. +- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](http://msdn.microsoft.com/en-us/library/windows/hardware/mt171093(v=vs.85).aspx) for more information). + +Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps) + +### Data leak prevention + +*Applies to: Corporate and personal devices* + +One of the biggest challenges in protecting corporate information on mobile devices is keeping that data separate from personal data. Most solutions available to create this data separation require users to login in with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. + +Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email. + +Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default. + +Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including: +- Microsoft Edge +- Microsoft People +- Mobile Office apps (Word, Excel, PowerPoint, and OneNote) +- Outlook Mail and Calendar +- Microsoft Photos +- Microsoft OneDrive +- Groove Music +- Microsoft Movies & TV +- Microsoft Messaging + +The following table lists the settings that can be configured for Windows Information Protection: +- **Enforcement level*** Set the enforcement level for information protection: + - Off (no protection) + - Silent mode (encrypt and audit only) + - Override mode (encrypt, prompt, and audit) + - Block mode (encrypt, block, and audit) +- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. +- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience. +- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured. +- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. +- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service. +- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long. +- **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection. +- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the Start menu. +- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection. +- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. +- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. +- **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected. + +>**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it. + +For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](../keep-secure/protect-enterprise-data-using-wip.md). + +### Managing user activities + +*Applies to: Corporate devices* + +On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks. + +- **Allow copy and paste** Whether users can copy and paste content +- **Allow Cortana** Whether users can use Cortana on the device (where available) +- **Allow device discovery** Whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) +- **Allow input personalization** Whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) +- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow screen capture** Whether users are allowed to capture screenshots on the device +- **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed +- **Allow sync my settings** Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) +- **Allow toasts notifications above lock screen** Whether users are able to view toast notification on the device lock screen +- **Allow voice recording** Whether users are allowed to perform voice recordings +- **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft +- **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher +- **Enable Offline Maps Auto Update** Disables the automatic download and update of map data +- **Allow Offline Maps Download Over Metered Connection** Allows the download and update of map data over metered connections + +You can find more details on the experience settings in Policy CSP. + +### Microsoft Edge + +*Applies to: Corporate and personal devices* + +MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection. + +The following settings for Microsoft Edge on Windows 10 Mobile can be managed. + +- **Allow Browser** Whether users can run Microsoft Edge on the device +- **Allow Do Not Track headers** Whether Do Not Track headers are allowed +- **Allow InPrivate** Whether users can use InPrivate browsing +- **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally +- **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar +- **Allow SmartScreen** Whether SmartScreen Filter is enabled +- **Cookies** Whether cookies are allowed +- **Favorites** Configure Favorite URLs +- **First Run URL** The URL to open when a user launches Microsoft Edge for the first time +- **Prevent SmartScreen Prompt Override** Whether users can override the SmartScreen warnings for URLs +- **Prevent Smart Screen Prompt Override for Files** Whether users can override the SmartScreen warnings for files + +## Manage + +In enterprise IT environments, the need for security and cost control must be balanced against the desire to provide users with the latest technologies. Since cyberattacks have become an everyday occurrence, it is important to properly maintain the state of your Windows 10 Mobile devices. IT needs to control configuration settings, keeping them from drifting out of compliance, as well as enforce which devices can access internal applications. Windows 10 Mobile delivers the mobile operations management capabilities necessary to ensure that devices are in compliance with corporate policy. + +### Servicing options + +**A streamlined update process** + +*Applies to: Corporate and personal devices* + +Microsoft has streamlined the Windows product engineering and release cycle so new features, experiences, and functionality demanded by the market can be delivered more quickly than ever before. Microsoft plans to deliver two Feature Updates per year (12-month period). Feature Updates establish a Current Branch or CB, and have an associated version. --+++ - - - - - - - - + + + - - + + + - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + +
    SettingDescription
    Device Password Enabled

    Specifies whether users are required to use a device lock password

    -
    -Note   -

    -
      -

    • When a device is registered with Azure AD and automatic MDM enrollment is not configured, the user will automatically be prompted to set a password PIN of at least six digits (simple PINs are not allowed).

      • -

    • If the device is capable of using biometric authentication, the user will be able to enroll an iris or other biometric gesture (depending on hardware) for device lock purposes. When a user uses a biometric gesture, he or she can still use the PIN as a fallback mechanism (for example, if the iris-recognition camera fails).

      • -
    -
    -
    -  -
    		BranchVersionRelease Date
    Allow Simple Device PasswordWhether users can use a simple password (for example, 1111 or 1234)Current Branch1511November 2015
    Alphanumeric Device Password RequiredWhether users need to use an alphanumeric password When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard.Current Branch for Business1511March 2016
    Min Device Password Complex CharactersThe number of password element types (in other words, uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords
    Device Password ExpirationThe number of days before a password expires (Biometric data does not expire.)
    Device Password HistoryThe number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.)
    Min Device Password LengthThe minimum number of characters required to create new passwords
    Max Inactivity Time Device LockThe number of minutes of inactivity before devices are locked and require a password to unlock
    Allow Idle Return Without PasswordWhether users are required to re-authenticate when their devices return from a sleep state, before the inactivity time was reached
    Max Device Password Failed AttemptsThe number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.)
    Screen Timeout While LockedThe number of minutes before the lock screen times out (This policy influences the device’s power management.)
    Allow Screen Timeout While Locked User ConfigurationWhether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the Screen Timeout While Locked setting if you disable this setting.)Current Branch1607July 2016
    -  -### Hardware restrictions -Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can also use hardware restrictions to control the availability of these features. Table 7 lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. +Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. ->**Note:**  Some of these hardware restrictions provide connectivity and assist in data protection. Enterprise data protection is currently being tested in select customer evaluation programs. -  -Table 7. Windows 10 Mobile hardware restrictions +Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates. -| Setting | Description | -|--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------| -| Allow NFC | Whether the NFC radio is enabled | -| Allow USB Connection | Whether the USB connection is enabled (this setting doesn’t affect USB charging) | -| Allow Bluetooth | Whether users can enable and use the Bluetooth radio on their devices | -| Allow Bluetooth Advertising | Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices | -| Allow Bluetooth Discoverable Mode | Whether the device can discover other devices (for example, headsets) | -| Bluetooth Services Allowed List | The list of Bluetooth services and profiles to which the device can connect | -| Set Bluetooth Local Device Name | The local Bluetooth device name | -| Allow Wi-Fi | Whether the Wi-Fi radio is enabled | -| Allow Auto Connect to Wi-Fi Sense Hotspots | Whether the device can automatically connect to Wi-Fi hotspots and friends’ home networks that are shared through Wi-Fi Sense | -| Allow Manual Wi-Fi Configuration | Whether users can manually connect to Wi-Fi networks not specified in the MDM system’s list of configured Wi-Fi networks | -| WLAN Scan Mode | How actively the device scans for Wi-Fi networks (This setting is hardware dependent.) | -| Allow Camera | Whether the camera is enabled | -| Allow Storage Card | Whether the storage card slot is enabled | -| Allow Voice Recording | Whether the user can use the microphone to create voice recordings | -| Allow Location | Whether the device can use the GPS sensor or other methods to determine location so applications can use location information | -  -### Certificate management - -Managing certificates can be difficult for users, but certificates are pervasive for a variety of uses, including, account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users could manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates for their entire life cycle, from enrollment through renewal to revocation. You can use the Simple Certificate Enrollment Protocol (SCEP) and Personal Information Exchange (PFX) certificates files to install certificates on Windows 10 Mobile. Certificate management through SCEP and MDM systems is fully transparent to users and requires no user intervention, so it helps improve user productivity and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device. Table 8 lists the SCEP settings that the MDM client in Windows 10 Mobile provides. - -Table 8. Windows 10 Mobile SCEP certificate enrollment settings - -| Setting | Description | -|------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Certificate enrollment server URLs | The certificate enrollment servers (to specify multiple server URLs, separate the URLs with semicolons \[;\]) | -| SCEP enrollment challenge | The Base64-encoded SCEP enrollment challenge | -| Extended key use object identifiers | The object identifiers (OIDs) for extended key use | -| Key usage | The key usage bits for the certificate in decimal format | -| Subject name | The certificate subject name | -| Private key storage | Where to store the private key (in other words, the Trusted Platform Module \[TPM\], a software key storage provider \[KSP\], or the Microsoft Passport KSP) | -| Pending retry delay | How long the device will wait to retry when the SCEP server sends a pending status | -| Pending retry count | The number of times a device will retry when the SCEP server sends a pending status | -| Template name | The OID of the certificate template name | -| Private key length | The private key length (in other words, 1024, 2048, or 4096 bits; Microsoft Passport supports only the 2048 key length) | -| Certificate hash algorithm | The hash algorithm family (in other words, SHA-1, SHA-2, SHA-3; multiple hash algorithm families are separated by plus signs \[+\]) | -| Root CA thumbprint | The root CA thumbprint | -| Subject alternative names | Subject alternative names for the certificate (Use semicolons to separate multiple subject alternative names.) | -| Valid period | The unit of measure for the period of time the certificate is considered valid (in other words, days, months, or years) | -| Valid period units | The number of units of time that the certificate is considered valid (Use this setting with the **Valid Period** setting. For example, if this setting is **3** and **Valid Period** is **Years**, the certificate is valid for 3 years.) | -| Custom text to show in Microsoft Passport PIN prompt | The custom text to show on the Microsoft Passport PIN prompt during certificate enrollment | -| Thumbprint | The current certificate thumbprint, if certificate enrollment succeeds | -  -In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. Table 9 lists the Windows 10 Mobile PFX certificate deployment settings. - -Table 9. Windows 10 Mobile PFX certificate deployment settings - -| Setting | Description | -|-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Private key storage | Where to store the private key (in other words, the TPM, a software KSP, or the Microsoft Passport KSP) | -| Microsoft Passport container name | The tenant identifier of the Azure AD tenant from which the Microsoft Passport is derived, required only if you select **Microsoft Passport KSP** in **Private key storage** | -| PFX packet | The PFX packet with the exported and encrypted certificates and keys in Binary64 format | -| PFX packet password | The password that protects the PFX blob specified in **PFX packet** | -| PFX packet password encryption | Whether the MDM system encrypts the PFX certificate password with the MDM certificate | -| PFX private key export | Whether the PFX private key can be exported | -| Thumbprint | The thumbprint of the installed PFX certificate | -  -Use the **Allow Manual Root Certificate Installation** setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. - ->**Note:**  To diagnose certificate-related issues on Windows 10 Mobile devices, use the free [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=723996) in Windows Store. This Windows 10 Mobile app can help you: - -- View a summary of all personal certificates. -- View the details of individual certificates. -- View the certificates used for VPN, Wi-Fi, and email authentication. -- Identify which certificates may have expired. -- Verify the certificate path and confirm that you have the correct intermediate and root CA certificates. -- View the certificate keys stored in the device TPM. -  -### Wi-Fi - -People use Wi-Fi on their mobile devices as much as or more than cellular data. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but you can use your MDM system to fully configure Wi-Fi settings without user intervention. - -Table 10 lists the Windows 10 Mobile Wi-Fi connection profile settings. Use the information in this table to help you create Wi-Fi connection profiles in your MDM system. - -Table 10. Windows 10 Mobile Wi-Fi connection profile settings +Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary. --++++++ - - - - - - - - + + + + + + - - + + + + + - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + +
    SettingDescription
    SSIDThe case-sensitive name of the Wi-Fi network (service set identifier [SSID])Network connectionDescriptionAuto ScanAuto DownloadAuto InstallAuto Restart
    Security typeThe type of security the Wi-Fi network uses; can be one of the following authentication types: -
      -

    • Open 802.11

      • -

    • Shared 802.11

      • -

    • WPA-Enterprise 802.11

      • -

    • WPA-Personal 802.11

      • -

    • WPA2-Enterprise 802.11

      • -

    • WPA2-Personal 802.11

      • -
    		Wi-FiDevice is connected to a personal or corporate Wi-Fi network (no data charges)YesYes/td> +YesYes – outside of Active Hours (forced restart after 7 days if user postpones restart)
    Authentication encryptionThe type of encryption the authentication uses; can be one of the following encryption methods: -
      -

    • None (no encryption)

      • -

    • Wired Equivalent Privacy

      • -

    • Temporal Key Integrity Protocol

      • -

    • Advanced Encryption Standard (AES)

      • -
    		CellularDevice is only connected to a cellular network (standard data charges apply)Will skip a daily scan if scan was successfully completed in the last 5 daysWill only occur if update package is small and does not exceed the mobile operator data limit or the user clicks “download now”.Yes, if the user clicked “download now”Idem
    Extensible Authentication Protocol Transport Layer Security (EAP-TLS)WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication
    Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication
    Shared keyWPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication.
    ProxyThe configuration of any network proxy that the Wi-Fi connection requires (To specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address.)
    Disable Internet connectivity checksWhether the Wi-Fi connection should check for Internet connectivity
    Proxy auto-configuration URLA URL that specifies the proxy auto-configuration file
    Enable Web Proxy Auto-Discovery Protocol (WPAD)Specifies whether WPAD is enabledCellular -- RoamingDevice is only connected to a cellular network and roaming charges applyNoNoNoIdem
    -  -Table 11 lists the Windows 10 Mobile settings for managing Wi-Fi connectivity. -Table 11. Windows 10 Mobile Wi-Fi connectivity settings +**Keeping track of updates releases** -| Setting | Configuration | -|--------------------------------------------|----------------------------------------------------------------------------| -| Allow Auto Connect To Wi-Fi Sense Hotspots | Whether the device will automatically detect and connect to Wi-Fi networks | -| Allow Manual Wi-Fi Configuration | Whether the user can manually configure Wi-Fi settings | -| Allow Wi-Fi | Whether the Wi-Fi hardware is enabled | -| WLAN Scan Mode | How actively the device scans for Wi-Fi networks | -  -### Proxy +*Applies to: Corporate and Personal devices* -Apps running on Windows 10 Mobile (for example, Microsoft Edge) can use proxy connections to access Internet content, but Wi-Fi connections on the corporate intranet most typically use proxy connections, instead. You can define multiple proxies in Windows 10 Mobile. +Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/en-us/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](http://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about. ->**Note:**  Windows 10 Mobile also supports proxy auto-configuration (PAC) files, which can automatically configure proxy settings. The Web Proxy Auto-Discovery Protocol (WPAD) lets apps use Dynamic Host Configuration Protocol and Domain Name System (DNS) lookups to locate the PAC file. -  -Table 12 lists the Windows 10 Mobile settings for proxy connections. +>**Note:** +We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub -Table 12. Windows 10 Mobile proxy connection settings +**Windows as a Service** + +*Applies to: Corporate and Personal devices* + +Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure. + +Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below: --+++++ - - - - - - - - + + + + + - - + + + + - - + + + + + - - - - - - - - - - - - - - - - - - + + + + +
    SettingsConfiguration
    Proxy nameThe unique name of the proxy connectionServicing optionAvailability of new features for installationMinimum length of servicing lifetimeKey benefitsSupported editions
    Proxy IDThe unique identifier for the proxy connectionWindows Insider BuildsAs appropriate during development cycle, released to Windows Insiders onlyVariable, until the next Insider build is released to Windows InsidersAllows Insiders to test new feature and application compatibility before a Feature Update is released/td> +Mobile
    NameThe user-friendly name of the proxy connectionCurrent Branch (CB)Immediately after the Feature Update is published to Windows Update by MicrosoftMicrosoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer)Makes new features available to users as soon as possibleMobile & Mobile Enterprise
    Server addressThe address of the proxy server, which can be the server FQDN or IP address
    IP address typeThe IP address type that identifies the proxy server, which can be one of the following values: -
      -

    • IPV4

      • -

    • IPV6

      • -

    • E164

      • -

    • ALPHA

      • -
    Proxy connection typeThe proxy connection type, which can be one of the following values: -
      -

    • ISA

      • -

    • WAP

      • -

    • SOCKS

      • -

    • NULL

      • -
    PortsThe port information for the proxy connection; includes the following settings: -
      -

    • Port Name. The unique name of a port that the proxy connection uses, such as PORT0 or PORT1

      • -

    • Port Name/Port Nbr. The proxy connection port number for this port

      • -

    • Port Name/Services. The services that use this proxy connection port

      • -

    • Services/Service Name. The name of a service that uses the proxy connection

      • -

    • Services/Service Name/Service Name. The protocol associated with the parent port connection

      • -
    Configuration referenceThe connection reference information for the proxy connection. The corporation determines the information in this optional setting.Current Branch for Business (CBB)A minimum of four months after the corresponding Feature Update is first published to Windows Update by MicrosoftA minimum of four months, though it potentially can be longerNoProvides additional time to test new feature before deploymentMobile Enterprise only
    -  -### VPN -In addition to Wi-Fi, users often use a VPN to securely access apps and resources on their company’s intranet behind a firewall. Windows 10 Mobile supports several VPN vendors in addition to native Microsoft VPNs (such as Point to Point Tunneling Protocol \[PPTP\], Layer 2 Tunneling Protocol \ -[L2TP\], and Internet Key Exchange Protocol version 2 \[IKEv2\]), including: +**Enterprise Edition** -- IKEv2 -- IP security -- SSL VPN connections (which require a downloadable plug-in from the VPN server vendor) +*Applies to: Corporate devices* -You can configure Windows 10 Mobile to use auto-triggered VPN connections, as well. You define a VPN connection for each app that requires intranet connectivity. When users switch between apps, the operating system automatically establishes the VPN connection for that app. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 Mobile Enterprise edition. -With always-on VPN, Windows 10 Mobile can automatically start a VPN connection when a user signs-in, as well. The VPN stays connected until the user manually disconnects it. -MDM support for VPN connections in Windows 10 Mobile includes provisioning and updating VPN connection profiles and associating VPN connections with apps. You can create and provision VPN connection profiles, and then deploy them to managed devices that run Windows 10 Mobile. Table 13 lists the Windows 10 Mobile fields for VPN connection profiles. +Upgrading to Windows 10 Mobile Enterprise edition provides additional device and app management capabilities for organizations that want to: +- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 Mobile Enterprise edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released. +- **Deploy an unlimited number of self-signed LOB apps to a single device:** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device. To deploy more than 20 self-signed LOB apps, Windows 10 Mobile Enterprise is required. +- **Set the telemetry level:** Microsoft collects telemetry data to help keep Windows devices secure and to help Microsoft improve the quality of Windows and Microsoft services. An upgrade to Windows 10 Mobile Enterprise edition is required to set the telemetry level so that only telemetry information required to keep devices secured is gathered. -Table 13. Windows 10 Mobile VPN connection profile settings +To learn more about telemetry, visit [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). + +To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required. + +Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904983(v=vs.85).aspx) + +>**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. + +**Deferring and Approving Updates with MDM** + +*Applies to: Corporate devices with Enterprise edition* + +Once a device is upgraded to Windows 10 Mobile Enterprise edition, you can manage devices that receive updates from Windows Update (or Windows Update for Business) with a set of update policies. + +To control Feature Updates, you will need to move your devices to the Current Branch for Business (CBB) servicing option. A device that subscribes to CBB will wait for the next CBB to be published by Microsoft Update. While the device will wait for Feature Updates until the next CBB, Quality Updates will still be received by the device. + +To control monthly Quality Update additional deferral policies, need to be set to your desired deferral period. When Quality Updates are available for your Windows 10 Mobile devices from Windows Update, these updates will not install until your deferral period lapses. This gives IT Professionals some time to test the impact of the updates on devices and apps. + +Before updates are distributed and installed, you may want to test them for issues or application compatibility. IT pros have the ability require updates to be approved. This enables the MDM administrator to select and approve specific updates to be installed on a device and accept the EULA associated with the update on behalf of the user. Please remember that on Windows 10 Mobile all updates are packaged as a “OS updates” and never as individual fixes. + +You may want to choose to handle Quality Updates and Feature Updates in the same way and not wait for the next CBB to be released to your devices. This streamlines the release of updates using the same process for approval and release. You can apply different deferral period by type of update. In version 1607 Microsoft added additional policy settings to enable more granularity to control over updates. + +Once updates are being deployed to your devices, you may want to pause the rollout of updates to enterprise devices. +For example, after you start rolling out a quality update, certain phone models are adversely impacted or users are reporting a specific LOB app is not connecting and updating a database. Problems can occur that did not surface during initial testing. +IT professionals can pause updates to investigate and remediate unexpected issues. + +The following table summarizes applicable update policy settings by version of Windows 10 Mobile. All policy settings are backward compatible, and will be maintained in future Feature Updates. Consult the documentation of your MDM system to understand support for these settings in your MDM. --+++ - - - - - - - - + + + - - + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + +
    SettingDescription
    Native VPN protocol profile

    The configuration information when the VPN uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP); includes the following settings:

    -
      -

    • Servers. The VPN server for the VPN profile

      • -

    • Routing policy type. The type of routing policy the VPN profile uses; can be set to one of the following values:

      -
        -

      • Split tunnel. Only network traffic destined to the intranet goes through the VPN connection.

        • -

      • Force tunnel. All traffic goes through the VPN connection.

        • -
      • -

    • Tunneling protocol type. The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols; can be one the following values:

      -
        -

      • PPTP

        • -

      • L2TP

        • -

      • IKEv2

        • -

      • Automatic

        • -
      • -

    • User authentication method. The user authentication method for the VPN connection; can have a value of EAP or MSChapv2. Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections.

      • -

    • Machine certificate. The machine certificate used for IKEv2-based VPN connections.

      • -

    • EAP configuration. An HTML-encoded XML blob of the EAP configuration. For more information about creating the EAP configuration XML blob, see [EAP configuration](http://go.microsoft.com/fwlink/p/?LinkId=734055). You can use the XML blob these steps create in the MDM system to create the VPN profile.

      • -
    		Activity (Policy)Version 1511 settingsVersion 1607 settings
    VPN plugin profileWindows Store–based VPN plug-ins for the VPN connection; includes the following settings: -
      -

    • VPN servers. A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address.

      • -

    • Custom configuration. An HTML-encoded XML blob for SSL–VPN plug-in–specific configuration information (e.g., authentication information) that the plug-in provider requires.

      • -

    • Windows Store VPN plugin family name. Specifies the Windows Store package family name for the Windows Store–based VPN plug-in.

      • -
    		Subscribe device to CBB, to defer Feature UpdatesRequireDeferUpgrade + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release.BranchReadinessLevel + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release.
    Defer UpdatesDeferUpdatePeriod + +Defer Quality Updates for 4 weeks or 28 daysDeferQualityUpdatePeriodInDays + +Defer Feature and Quality Updates for up to 30 days.
    Approve UpdatesRequireUpdateApproval + +RequireUpdateApproval + +
    Always on connectionWhether the VPN connects at user sign-in and stays connected until the user manually disconnects the VPN connection.
    App trigger listA list of apps that automatically initiate the VPN connection. Each app trigger in the list includes the following settings: -
      -

    • App ID. The app identity for the app that automatically initiates the VPN connection Any apps in this list can send data through the VPN connection; set it to one of the following values:

      -
        -

      • Unique name of the Windows Store app (Package Family Name). The package family name is a unique name for each app. For example, the package family name for the Skype app is Microsoft.SkypeApp_kzf8qxf38zg5c.

        • -

      • Fully qualified path to the app (such as C:\Windows\System\Notepad.exe).

        • -

      • Kernel driver name.

        • -
      • -
    DNS suffixesA comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List.
    LockDown VPN profileWhether this VPN connection is a LockDown profile. A LockDown VPN profile has the following characteristics: -
      -

    • It is an always-on VPN profile.

      • -

    • It can never be disconnected.

      • -

    • If the VPN profile is not connected, the user has no network connectivity.

      • -

    • No other VPN profiles can be connected or modified.

      • -
    -

    You must delete a LockDown VPN profile before you can add, remove, or connect other VPN profiles.

    Name Resolution Policy Table rulesA list of Name Resolution Policy Table rules for the VPN connection. Each rule in the list includes the following settings: -
      -

    • Domain name. The namespace for the policy; can be an FQDN or a domain suffix.

      • -

    • Domain name type. The type of namespace in Domain name; has a value of either FQDN or Suffix.

      • -

    • DNS servers. A comma-separated list of DNS server IP addresses to use for the namespace specified in Domain name.

      • -

    • Web proxy servers. The IP address for the web proxy server (if the intranet redirects traffic through a web proxy server).

      • -
    ProxyAny post connection proxy support required for the VPN connection; includes the following settings: -
      -

    • Proxy server. Specifies the fully qualified host name or IP address of the proxy server when a specific proxy server is required.

      • -

    • Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings.

      • -
    Remember credentialsWhether the VPN connection caches credentials.
    Route listA list of routes to add to the routing table for the VPN connection. Each route in the list includes the following settings: -
      -

    • Address. The destination subnet address in IPv4 or IPv6 format (such as 192.168.0.0).

      • -

    • Prefix size. The portion of the address used to identify the destination subnet address (such as 16 to produce the subnet 192.168.0.0/16).

      • -
    Traffic filter listA list of traffic rules that define the traffic that can be sent through the VPN connection. Each rule in the list includes the following settings: -
      -

    • App ID. The app identity for the traffic filter based on a specific app (app-based traffic filter). Any apps in this list can send data through the VPN connection; set to one of the following values:

      -
        -

      • Unique name of the Windows Store app (Package Family Name). The package family name is a unique name for each app. For example, the package family name for the Skype app is Microsoft.SkypeApp_kzf8qxf38zg5c.

        • -

      • Fully qualified path to the app (such as C:\Windows\System\Notepad.exe).

        • -

      • Kernel driver name.

        • -
      • -

    • Protocol. The IP protocol to use for the traffic filter rule (for example, TCP = 6, UDP = 17).

      • -

    • Local port ranges. Specifies a comma-separated list of local IP port ranges (for example, 100–180, 200, 300–350).

      • -

    • Remote port ranges. A comma-separated list of remote IP port ranges (for example, 100–180, 200, 300–350).

      • -

    • Local address ranges. A comma-separated list of local IP address ranges that are allowed to use the VPN connection (for example, 192.168.0.1–192.168.0.255, 172.16.10.0–172.16.10.255).

      • -

    • Remote address ranges. A comma-separated list of remote IP address ranges that are allowed to use the VPN connection (for example, 192.168.0.1–192.168.0.255, 172.16.10.0–172.16.10.255).

      • -

    • Routing policy type. The type of IP tunnel for the VPN connection; set to one of the following:

      -
        -

      • Split tunnel. Only traffic destined for the intranet is sent through the VPN connection.

        • -

      • Force tunnel. All traffic is sent through the VPN connection.

        • -
      • -
    Trusted network detectionA comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible.Pause Update rollout once an approved update is being deployed, pausing the rollout of the update.PauseDeferrals + +Pause Feature Updates for up to 35 daysPauseQualityUpdates + +Pause Feature Updates for up to 35 days
    -  -Table 14 lists the Windows 10 Mobile settings for managing VPN connections. These settings help you manage VPNs over cellular data connections, which in turn help reduce costs associated with roaming or data plan charges. - -Table 14. Windows 10 Mobile VPN management settings - -| Setting | Description | -|--------------------------------------|---------------------------------------------------------------------------------| -| Allow VPN | Whether users can change VPN settings | -| Allow VPN Over Cellular | Whether users can establish VPN connections over cellular networks | -| Allow VPN Over Cellular when Roaming | Whether users can establish VPN connections over cellular networks when roaming | -  -### APN profiles - -An APN defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. - -An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. Corporations in Europe and the Asia-Pacific use APNs, but they are not common in the United States. - -You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. Table 15 lists the MDM settings that Windows 10 Mobile supports for APN profiles. - -Table 15. Windows 10 Mobile APN profile settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    APN nameThe APN name
    IP connection typeThe IP connection type; set to one of the following values: -
      -

    • IPv4 only

      • -

    • IPv6 only

      • -

    • IPv4 and IPv6 concurrently

      • -

    • IPv6 with IPv4 provided by 46xlat

      • -
    LTE attachedWhether the APN should be attached as part of an LTE Attach
    APN class IDThe globally unique identifier that defines the APN class to the modem
    APN authentication typeThe APN authentication type; set to one of the following values: -
      -

    • None

      • -

    • Auto

      • -

    • PAP

      • -

    • CHAP

      • -

    • MSCHAPv2

      • -
    User nameThe user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type
    PasswordThe password for the user account specified in User name
    Integrated circuit card IDThe integrated circuit card ID associated with the cellular connection profile
    -  -### Data leak protection - -Some user experiences can risk corporate data stored on corporate devices. For example, allowing users to copy and paste information out of the organization’s LOB app can put data at risk. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data -and prevent data leaks. For example, you can prevent settings synchronization, copy-and-paste operations, and screen captures. Table 16 lists the MDM settings in Windows 10 Mobile that you can use to help prevent data leaks. - -Table 16. Windows 10 Mobile data leak protection settings - -| Setting | Description | -|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow copy and paste | Whether users can copy and paste content | -| Allow Cortana | Whether users can use Cortana on the device, where available | -| Allow device discovery | Whether the device discovery user experience is available on the lock screen (For example, this setting can control whether a device could discover a projector \[or other devices\] when the lock screen is displayed.) | -| Allow input personalization | Whether personally identifiable information can leave the device or be saved locally (for example, Cortana learning, inking, dictation) | -| Allow manual MDM unenrollment | Whether users are allowed to delete the workplace account (in other words, unenroll the device from the MDM system) | -| Allow screen capture | Whether users are allowed to capture screenshots on the device | -| Allow SIM error dialog prompt | Specifies whether to display a dialog prompt when no SIM card is installed | -| Allow sync my settings | Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) | -| Allow toasts notifications above lock screen | Whether users are able to view toast notification on the device lock screen | -| Allow voice recording | Whether users are allowed to perform voice recordings. | -  -### Storage management - -Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage by using the device encryption in Windows 10 Mobile. This encryption helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. - -A feature in Windows 10 Mobile is the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on, so you don’t need to set a policy explicitly to enable it. -The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. -You can disable the **Allow Storage Card** setting to prevent users from using SD cards altogether, but the primary advantage of the SD card app partition–encryption feature is that organizations can give users the flexibility to use an SD card while still protecting the confidential apps and data on it. - -If you don’t encrypt storage, you can help protect your corporate apps and data by using the **Restrict app data to the system volume** and **Restrict apps to the system volume** settings. They help ensure that users cannot copy your apps and data to SD cards. - -Table 17 lists the MDM storage-management settings that Windows 10 Mobile provides. - -Table 17. Windows 10 Mobile storage management settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    Allow Storage CardWhether users can use storage cards for device storage (This setting does not prevent programmatic access to the storage cards.)
    Require Device EncryptionWhether internal storage is encrypted (When a device is encrypted, you cannot use a policy to turn encryption off.)
    Encryption methodSpecifies the BitLocker drive encryption method and cipher strength; can be one of the following values: -
      -

    • AES-Cipher Block Chaining (CBC) 128-bit

      • -

    • AES-CBC 256-bit

      • -

    • XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default)

      • -

    • XTS-AES-256-bit

      • -
    Allow Federal Information Processing Standard (FIPS) algorithm policyWhether the device allows or disallows the FIPS algorithm policy
    SSL cipher suitesSpecifies a list of the allowed cryptographic cipher algorithms for SSL connections
    Restrict app data to the system volumeSpecifies whether app data is restricted to the system drive
    Restrict apps to the system volumeSpecifies whether apps are restricted to the system drive
    -  -## App management - -Apps help improve user productivity on mobile devices. New to Windows 10 is the ability for organizations purchase apps from Windows Store for their employees and deploy those apps from Windows Store or an MDM system. App management is becoming a key capability of MDM systems, helping reduce the effort required to perform common app-related tasks, such as distributing apps, and protecting data through app policies. This section describes the app management features in Windows 10 Mobile and includes the following topics: - -- [Universal Windows Platform (UWP)](#uwp) -- [Sourcing the right app](#sourcing) -- [Windows Store for Business](#store) -- [Mobile application management (MAM) policies](#mam) -- [Microsoft Edge](#edge) - -### Universal Windows Platform - -Windows 10 introduces UWP, converging the application platform for all devices running some edition of Windows 10. UWP apps run without modification on all editions of Windows 10, and Windows Store now has apps that you can license and purchased for all your Windows 10 devices. Windows Phone 8.1 and Windows 8.1 apps still run on Windows 10 devices, but the MAM improvements in Windows 10 work only with UWP apps. See the [Guide to Universal Windows Platform (UWP) apps](http://go.microsoft.com/fwlink/p/?LinkId=734056) for additional information. - -### Sourcing the right app - -The first step in app management is to obtain the apps your users need, and you can now acquire apps from Windows Store. Developers can also create apps specific to an organization, known as *line-of-business (LOB) apps* (the developers of these apps are *LOB publishers*). An LOB developer (internal or external) can now publish these apps to Windows Store at your request, or you can obtain the app packages offline and distribute them through your MDM system. - -To install Windows Store or LOB apps, use the Windows Store cloud service or your MDM system to distribute the app packages. Your MDM system can deploy apps online by redirecting the user to a licensed app in Windows Store or offline by distributing a package that you downloaded from Windows Store (also called *sideloading*) on Windows 10 Mobile devices. You can fully automate the app deployment process so that no user intervention is required. - -IT administrators can obtain apps through Store for Business. Most apps can be distributed online, meaning that the user must be logged in to the device with an Azure AD account and have Internet access at the time of installation. To distribute an app offline, the developer must opt in. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online method. See [Windows Store for Business](windows-store-for-business.md) for additional information about apps obtained through Store for Business. -Windows Store apps are automatically trusted. For custom LOB apps developed internally or by a trusted software vendor, ensure that the device trusts the app signing certificate. There are two ways to establish this trust: use a signing certificate from a trusted source, or generate your own signing certificate and add your chain of trust to the trusted certificates on the device. You can install up to 20 self-signed apps on a Windows 10 Mobile device. When you purchase a signing certificate from a public CA, you can install more than 20 apps on a device, although you can install more than 20 self-signed apps per device with [Windows 10 Mobile Enterprise](#mobile-edition). - -Users can install apps from Windows Store that the organization purchases through the Store app on their device. If you allow your users to log in with a Microsoft account, the Store app on the device provides a unified method for installing personal and corporate apps. - -### Store for Business - -[Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) is a web portal that IT pros and purchasers use to find, acquire, manage, and distribute apps to Windows 10 devices. This online portal gives Azure AD authenticated managers access to Store for Business functionality and settings. Store managers can create a private section of Windows Store in which organizations can manage apps specific and private to them. Store for Business allows organizations to make apps available to their users and purchase app licenses for them. They can also integrate their Store for Business subscriptions with their MDM systems, so the MDM system can deploy apps from their free Store for Business subscription. - -The process for using Store for Business is as follows: - -1. Create a Store for Business subscription for your organization. -2. In the Store for Business portal, acquire apps from Windows Store (only free apps are available at this time). -3. In Store for Business, distribute apps to users, and manage the app licenses for the apps acquired in the previous step. -4. Integrate your MDM system with your organization’s Store for Business subscription. -5. Use your MDM system to deploy the apps. - -For more information about Store for Business, see [Windows Store for Business](windows-store-for-business.md). - -### Mobile application management (MAM) policies - -With MDM, you can manage Device Guard on Windows 10 Mobile and create an allow (whitelist) or deny (blacklist) list of apps. This capability extends to built-in apps, as well, such as phone, text messaging, email, and calendar. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. - -You can also control users’ access to Windows Store and whether the Store service updates apps automatically. You can manage all these capabilities through your MDM system. Table 18 lists the Windows 10 Mobile app management settings. - -Table 18. Windows 10 Mobile app management settings - -| Setting | Description | -|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow All Trusted Apps | Whether users can sideload apps on the device | -| Allow App Store Auto Update | Whether automatic updates of apps from Windows Store are allowed | -| Allow Developer Unlock | Whether developer unlock is allowed | -| Allow Shared User App Data | Whether multiple users of the same app can share data | -| Allow Store | Whether Windows Store app is allowed to run | -| Allow Windows Bridge For Android App Execution | Whether the Windows Bridge for Android app is allowed to run | -| Application Restrictions | An XML blob that defines the app restrictions for a device (The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher.) | -| Require Private Store Only | Whether the private store is exclusively available to users (If enabled, only the private store is available. If disabled, the retail catalog and private store are both available.) | -| Restrict App Data To System Volume | Whether app data is allowed only on the system drive | -| Restrict App To System Volume | Whether app installation is allowed only to the system drive | -| Start screen layout | An XML blob used to configure the Start screen (See [Start layout for Windows 10 Mobile editions](http://go.microsoft.com/fwlink/p/?LinkId=734057) for more information.) | -  -One potential security issue is that users can register as Windows 10 Mobile app developers and turn on developer features on their device, potentially installing apps from unknown sources and opening the device to malware threats. To prevent users from turning on developer features on their devices, set the **Disable development unlock (side loading)** policy, which you can configure through your MDM system. - -### Microsoft Edge - -MDM systems give you the ability to manage Microsoft Edge on mobile devices. Table 19 lists the Microsoft Edge settings for Windows 10 Mobile. - -Table 19. Microsoft Edge settings for Windows 10 Mobile - -| Setting | Description | -|-------------------------------------------------|-------------------------------------------------------------------------------------------------------| -| Allow Active Scripting | Whether active scripting is allowed | -| Allow Autofill | Whether values are automatically filled on websites | -| Allow Browser | Whether Internet Explorer is allowed on the device | -| Allow Cookies | Whether cookies are allowed | -| Allow Do Not Track headers | Whether Do Not Track headers are allowed | -| Allow InPrivate | Whether users can use InPrivate browsing | -| Allow Password Manager | Whether users can use Password Manager to save and manage passwords locally | -| Allow Search Suggestions in Address Bar | Whether search suggestions are shown in the address bar | -| Allow SmartScreen | Whether SmartScreen Filter is enabled | -| First Run URL | The URL to open when a user launches Microsoft Edge for the first time | -| Prevent Smart Screen Prompt Override For Files | Whether users can override the SmartScreen Filter warnings about downloading unverified files | -  -## Device operations - -In this section, you learn how MDM settings in Windows 10 Mobile enable the following scenarios: - -- [Device update](#device-update) -- [Device compliance monitoring](#device-comp) -- [Device inventory](#data-inv) -- [Remote assistance](#remote-assist) -- [Cloud services](#cloud-serv) - -### Device update - -To help protect mobile devices and their data, you must keep those devices updated. Windows Update automatically installs updates and upgrades when they become available. - -The device update features described in this section are available only in [Windows 10 Mobile Enterprise](#mobile-edition). You can use your MDM system to postpone system upgrades when you activate an Enterprise license on managed Windows 10 Mobile devices and control how updates and upgrades are applied. For example, you can disable updates altogether, defer updates and upgrades, and schedule the day and time to install updates, as you would with Windows Server Update Services (WSUS) on Windows 10 desktops running the [Current Branch for Business](introduction-to-windows-10-servicing.md). -Table 20 lists the Windows 10 Mobile Enterprise settings that you can use to configure updates and upgrades. - -Table 20. Windows 10 Mobile Enterprise update management settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    Allow automatic updateThe automatic update behavior for scanning, downloading, and installing updates; the behavior can be one of the following: -
      -

    • Notify users prior to downloading updates.

      • -

    • Automatically install updates, and then notify users to schedule a restart (this is the default behavior).

      • -

    • Automatically install and restart devices with user notification.

      • -

    • Automatically install and restart devices at a specified time.

      • -

    • Automatically install and restart devices without user interaction.

      • -

    • Turn off automatic updates.

      • -
    Allow non Microsoft signed updateWhether automatic updates will accept updates that entities other than Microsoft have signed
    Allow update serviceWhether devices can obtain updates from Windows Update, WSUS, or Windows Store
    Monthly security updates deferredWhether monthly updates (for example, security patches) are deferred (You can defer updates up to 4 weeks.)
    Nonsecurity upgrades deferredWhether nonsecurity upgrades are deferred (You can defer upgrades up to 4 weeks.)
    Pause update deferralsWhether the device should skip an update cycle (This setting is valid only when you configure devices to defer updates or upgrades.)
    Require update approvalWhether approval is required before updates can be installed on devices (If approval is required, any updates that have an End User License Agreement [EULA] are automatically accepted on the user’s behalf.)
    Schedule install timeThe scheduled time at which updates are installed
    Scheduled install dayThe schedule of days on which updates are installed
    Update deferral periodHow long updates should be deferred
    Update service URLThe name of a WSUS server from which to download updates instead of Windows Update
    Upgrade deferral periodHow long Windows 10 Mobile upgrades should be deferred
    -  -In addition to configuring how Windows 10 Mobile Enterprise obtains updates, you can manage individual Windows 10 Mobile updates. Table 21 provides information about approved updates to help you control the rollout of new updates to Windows 10 Mobile Enterprise devices. - -Table 21. Windows 10 Mobile Enterprise approved update information - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription
    Approved updatesA list of approved updates. Each update in the list includes the Approved Time setting, which specifies the update approval time. Any approved updates automatically accept EULAs on behalf of users.
    Failed updatesA list of updates that failed during installation. Each update in the list includes the following settings: -
      -

    • H Result. The update failure code

      • -

    • Status. The failed update state (for example, download, install)

      • -
    Installed updatesA list of updates that are installed on the device.
    Installable updatesA list of updates that are available for installation. Each update in the list includes the following settings: -
      -

    • Type. The type of update available for installation, set to one of the following values:

      -
        -

      • 0 (no type)

        • -

      • 1 (security)

        • -

      • 2 (critical)

        • -
      • -

    • Revision Number. The revision number for the update used to get metadata for the update during synchronization.

      • -
    Pending reboot updatesA list of updates that require a restart to complete update installation. Each update in the last has the Installed Time setting enabled, which specifies installation time for the update.
    Last successful scan timeThe last time a successful update scan was completed.
    Defer upgradeWhether the upgrade is deferred until the next update cycle.
    -  - -### Device compliance monitoring - -You can use your MDM system to monitor compliance. Windows 10 Mobile provides audit information to track issues or perform remedial actions. This information helps you ensure that devices are configured to comply with organizational standards. - -You can also assess the health of devices that run Windows 10 Mobile and take enterprise policy actions. The process that the health attestation feature in Windows 10 Mobile uses is as follows: - -1. The health attestation client collects data used to verify device health. -2. The client forwards the data to the Health Attestation Service (HAS). -3. The HAS generates a Health Attestation Certificate. -4. The client forwards the Health Attestation Certificate and related information to the MDM system for verification. - -For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). - -Depending on the results of the health state validation, an MDM system can take one of the following actions: - -- Allow the device to access resources. -- Allow the device to access resources but identify the device for further investigation. -- Prevent the device from accessing resources. - -Table 21 lists data points that the HAS collects and evaluates from devices that run Windows 10 Mobile to determine the action to perform. For most of these data points, the MDM system can take one of the following actions: - -- Disallow all access. -- Disallow access to high-business-impact assets. -- Allow conditional access based on other data points that are present at evaluation time—for example, other attributes on the health certificate or a device’s past activities and trust history. -- Take one of the previous actions, and also place the device on a watch list to monitor it more closely for potential risks. -- Take corrective action, such as informing IT administrators to contact the owner and investigate the issue. - -Table 21. Windows 10 Mobile HAS data points - -| Data point | Description | -|----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Attestation Identity Key (AIK) present | Indicates that an AIK is present (in other words, the device can be trusted more than a device without an AIK). | -| Data Execution Prevention (DEP) enabled | Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. | -| BitLocker status | BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. | -| Secure Boot enabled | Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. | -| Code integrity enabled | Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. | -| Safe mode | Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. | -| Running Windows Preinstallation Environment (Windows PE) | Whether the device is running Windows PE. A device running Windows PE isn’t as secure as a device running Windows 10 Mobile. | -| Boot debug enabled | Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. | -| OS kernel debugging enabled | Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. | -| Test signing enabled | Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. | -| Boot Manager Version | The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). | -| Code integrity version | Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). | -| Secure Boot Configuration Policy (SBCP) present | Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. | -| Boot cycle whitelist | The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. | -  -### Device inventory - -Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely, and you can use the system’s reporting capabilities to analyze device resources and information. With this information, you can determine the current hardware and software resources of the device (for example, installed updates). - -Table 22 lists examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. - -Table 22. Windows 10 Mobile software and hardware inventory examples - -| Setting | Description | -| - | - | -| Installed enterprise apps | List of the enterprise apps installed on the device | -| Device name | The device name configured for the device | -| Firmware version | Version of firmware installed on the device | -| Operating system version | Version of the operating system installed on the device | -| Device local time | Local time on the device | -| Processor type | Processor type for the device | -| Device model | Model of the device as defined by the manufacturer | -| Device manufacturer | Manufacturer of the device | -| Device processor architecture | Processor architecture for the device | -| Device language | Language in use on the device | -| Phone number | Phone number assigned to the device | -| Roaming status | Indicates whether the device has a roaming cellular connection | -| International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) | Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user | | IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device | -| Wi-Fi media access control (MAC) address | MAC address assigned to the Wi-Fi adapter in the device | -| Wi-Fi DNS suffix and subnet mask | DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device | -| Secure Boot state | Indicates whether Secure Boot is enabled | -| Enterprise encryption policy compliance | Indicates whether the device is encrypted | -  -### Remote assistance - -The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: - -- **Remote lock.** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it but not immediately (for example, leaving the device at a customer site). -- **Remote PIN reset.** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost, and users are able to gain access to their devices quickly. -- **Remote ring.** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. -- **Remote find.** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. To configure Windows 10 Mobile remote find, use the settings in Table 23. The remote find feature returns the most current latitude, longitude, and altitude of the device. + +**Managing the Update Experience** + +*Applies to: Corporate devices with Enterprise edition* + +Set update client experience with [Allowautomaticupdate](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates. + +This can include: +- Notifying users prior to downloading updates. +- Automatically downloading updates, and then notifying users to schedule a restart (this is the default behavior if this policy is not configured). +- Automatically downloading and restarting devices with user notification. +- Automatically downloading and restarting devices at a specified time. +- Automatically downloading and restarting devices without user interaction. +- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates. + +In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.). + +**Managing the source of updates with MDM** + +*Applies to: Corporate devices with Enterprise edition* + +Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system. + +Learn more about [Windows Update for Business](../plan/windows-update-for-business.md). + +IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS. + +**Managing Updates with Windows Update Server** + +*Applies to: Corporate devices with Enterprise edition* + +When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices. + +Learn more about [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/en-us/windowsserver/bb332157.aspx) + +**Querying the device update status** + +*Applies to: Personal and corporate devices* + +In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates. + +The device update status query provides an overview of: +- Installed updates: A list of updates that are installed on the device. +- Installable updates: A list of updates that are available for installation. +- Failed updates: A list of updates that failed during installation, including indication of why the update failed. +- Pending reboot: A list of updates that require a restart to complete update installation. +- Last successful scan time: The last time a successful update scan was completed. +- Defer upgrade: Whether the upgrade is deferred until the next update cycle. + +### Device health + +*Applies to: Personal and corporate devices* + +Device Health Attestation (DHA) is another line of defense that is new to Windows 10 Mobile. It can be used to remotely detect devices that lack a secure configuration or have vulnerabilities that could allow them to be easily exploited by sophisticated attacks. + +Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN. + +The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. + +The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that: +- Run Windows 10 operating system (mobile phone or PC) +- Support Trusted Module Platform (TPM 1.2 or 2.0) in discrete of firmware format +- Are managed by a DHA-enabled device management solution (Intune or third-party MDM) +- Operate in cloud, hybrid, on-premises, and BYOD scenarios + +DHA-enabled device management solutions help IT managers create a unified security bar across all managed Windows 10 Mobile devices. This allows IT managers to: +- Collect hardware attested data (highly assured) data remotely +- Monitor device health compliance and detect devices that are vulnerable or could be exploited by sophisticated attacks +- Take actions against potentially compromised devices, such as: +- Trigger corrective actions remotely so offending device is inaccessible (lock, wipe, or brick the device) +- Prevent the device from getting access to high-value assets (conditional access) +- Trigger further investigation and monitoring (route the device to a honeypot for further monitoring) +- Simply alert the user or the admin to fix the issue + +>**Note:** Windows Device Health Attestation Service can be used for conditional access scenarios which may be enabled by Mobile Device Management solutions (e.g.: Microsoft Intune) and other types of management systems (e.g.: SCCM) purchased separately. + +For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). + +Thisis a lists of attributes that are supported by DHA and can trigger the corrective actions mentioned above. +- **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK). +- **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. +- **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. +- **Secure Boot enabled** Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. +- **Code integrity enabled** Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. +- **Safe mode** Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. +- **Boot debug enabled** Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. +- **OS kernel debugging enabled** Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. +- **Test signing enabled** Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. +- **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). +- **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). +- **Secure Boot Configuration Policy (SBCP) present** Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. +- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. + +**Example scenario** + +Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. + +Here is what occurs when a smartphone is turned on: +1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. +2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. +3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. +4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. +6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. + +### Asset reporting + +*Applies to: Corporate devices with Enterprise edition* + +Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (e.g., installed updates). + +The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. + +- **Installed enterprise apps** List of the enterprise apps installed on the device +- **Device name** The device name configured for the device +- **Firmware version** Version of firmware installed on the device +- **Operating system version** Version of the operating system installed on the device +- **Device local time** Local time on the device +- **Processor type** Processor type for the device +- **Device model** Model of the device as defined by the manufacturer +- **Device manufacturer** Manufacturer of the device +- **Device processor architecture** Processor architecture for the device +- **Device language** Language in use on the device +- **Phone number** Phone number assigned to the device +- **Roaming status** Indicates whether the device has a roaming cellular connection +- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user +- **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device +- **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device +- **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device +- **Secure Boot state** Indicates whether Secure Boot is enabled +- **Enterprise encryption policy compliance** Indicates whether the device is encrypted + +### Manage telemetry + +*Applies to: Corporate devices with Windows 10 Mobile Enterprise edition* + +Microsoft uses telemetry (diagnostics, performance, and usage data) from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Telemetry helps keep Windows devices healthy, improve the operating system, and personalize features and services. + +You can control the level of data that telemetry systems collect. To configure devices, specify one of these levels in the Allow Telemetry setting with your MDM system. + +For more information, see [Configure Windows telemetry in Your organization](configure-windows-telemetry-in-your-organization.md). + +>**Note:** Telemetry can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. + +### Remote assistance + +*Applies to: Personal and corporate devices* + +The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: +- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (e.g., leaving the device at a customer site). +- **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices. +- **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. +- **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device. + +**Remote assistance policies** +- **Desired location accuracy** The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters +- **Maximum remote find** Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes +- **Remote find timeout** The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. -Table 23. Windows 10 Mobile remote find settings +>**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Windows Store. -| Setting | Description | -|---------------------------|---------------------------------------------------------------------------------------------------------------------------------| -| Desired location accuracy | The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters | -| Maximum remote find | Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes | -| Remote find timeout | The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds | -  -### Cloud services +## Retire -On mobile devices that run Windows 10 Mobile, users can easily connect to apps and data. As a result, they frequently connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. +*Applies to: Corporate and Personal devices* -**Manage push notifications** +Device retirement is the last phase of the device lifecycle, which in today’s business environment averages about 18 months. After that time period, employees want the productivity and performance improvements that come with the latest hardware. It’s important that devices being replaced with newer models are securely retired since you don’t want any company data to remain on discarded devices that could compromise the confidentiality of your data. This is typically not a problem with corporate devices, but it can be more challenging in a personal device scenario. You need to be able to selectively wipe all corporate data without impacting personal apps and data on the device. IT also needs a way to adequately support users who need to wipe devices that are lost or stolen. -The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. -Push notifications can affect battery life, however, so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. When battery saver is on, Windows 10 Mobile disables the receipt of push notifications to save energy. +Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected. -There is an exception to this behavior, however. In Windows 10 Mobile, the **Always allowed** battery saver settings (found in the Settings app) allow apps to receive push notifications even when battery saver is on. Users can manually configure this list, or you can use the MDM system to configure it—that is, you can use the battery saver settings URI scheme in Windows 10 Mobile (**ms-settings:batterysaver-settings**) to configure these settings. -For more information about push notifications, see [Windows Push Notification Services (WNS) overview](http://go.microsoft.com/fwlink/p/?LinkId=734060). +>**Note:** All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. -**Manage telemetry** +**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world. -As people use Windows 10 Mobile, it can collect performance and usage telemetry that helps Microsoft identify and troubleshoot problems as well as improve its products and services. Microsoft recommends that you select **Full** for this setting. -Microsoft employees, contractors, vendors, and partners might have access to relevant portions of the information that Windows 10 Mobile collects, but they are permitted to use the information only to repair or improve Microsoft products and services or third-party software and hardware designed for use with Microsoft products and services. +If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data. -You can control the level of data that MDM systems collect. Table 24 lists the data levels that Windows 10 Mobile collects and provides a brief description of each. To configure devices, specify one of these levels in the **Allow Telemetry** setting. -Table 24. Windows 10 Mobile data collection levels -| Level of data | Description | -|- | - | -| Security | Collects only the information required to keep Windows 10 Mobile enterprise-grade secure, including information about telemetry client settings, the Malicious Software Removal Tool, and Windows Defender. This level is available only on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core. For Windows 10 Mobile, this setting disables Windows 10 Mobile telemetry. | -| Basic | Provides only the data vital to the operation of Windows 10 Mobile. This data level helps keep Windows 10 Mobile and apps running properly by letting Microsoft know the device’s capabilities, what’s installed, and whether Windows is operating correctly. This option also turns on basic error reporting back to Microsoft. By selecting this option, you allow Microsoft to provide updates through Windows Update, including malicious software protection through the Malicious Software Removal Tool. | -| Enhanced | Includes all Basic data plus data about how users use Windows 10 Mobile, such as how frequently or how long they use certain features or apps and which apps they use most often. This option also lets operating system collect enhanced diagnostic information, such as the memory state of a device when a system or app crash occurs, and measure reliability of devices, the operating system, and apps. | -| Full | Includes all Basic and Enhanced data and also turns on advanced diagnostic features that collect additional data from devices, such as system files or memory snapshots, which may unintentionally include parts of documents user are working on when a problem occurred. This information helps Microsoft further troubleshoot and fix problems. If an error report contains personal data, Microsoft does not use that information to identify, contact, or target advertising to users. | -  -## Device retirement +A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system. -Device retirement (unenrollment) is the last phase of the device life cycle. Historically, mobile device retirement has been a complex and difficult process for organizations. When the organization no longer needs devices, it must remove (wipe) corporate data from them. BYOD scenarios make retirement even more complex because users expect their personal apps and data to remain untouched. Therefore, organizations must remove their data without affecting users’ data. +**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. -You can remotely remove all corporate data from devices that run Windows 10 Mobile without affecting existing user data (partial or enterprise wipe). The help desk or the devices’ users can initiate device retirement. When retirement is complete, Windows 10 Mobile returns the devices to a consumer state, as they were before enrollment. The following list summarizes the corporate data removed from a device when it’s retired: +**Settings for personal or corporate device retirement** +- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow user to reset phone** Whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults -- Email accounts -- Enterprise-issued certificates -- Network profiles -- Enterprise-deployed apps -- Any data associated with the enterprise-deployed apps ->**Note:**  All these features are in addition to the device’s software and hardware factory reset features, which users can use to restore devices to their factory configuration. -  -To specify whether users can delete the workplace account in Control Panel and unenroll from the MDM system, enable the **Allow Manual MDM Unenrollment** setting. Table 25 lists additional Windows 10 remote wipe settings that you can use the MDM system to configure. - -Table 25. Windows 10 Mobile remote wipe settings - -| Setting | Description | -|-------------------------------|----------------------------------------------------------------------------------------------------------------------| -| Wipe | Specifies that a remote wipe of the device should be performed | -| Allow manual MDM unenrollment | Whether users are allowed to delete the workplace account (in other words, unenroll the device from the MDM system) | -| Allow user to reset phone | Whether users are allowed to use Control Panel or hardware key combinations to return the device to factory defaults | -  ## Related topics -- [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050) -- [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) -- [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052) -- [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) +- [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050) +- [Enterprise Mobility + Security](https://go.microsoft.com/fwlink/p/?LinkId=723984) +- [Overview of Mobile Device Management for Office 365](https://go.microsoft.com/fwlink/p/?LinkId=734052) +- [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=722910) + + +## Revision History + +- November 2015 Updated for Windows 10 Mobile (version 1511) +- August 2016 Updated for Windows 10 Mobile Anniversary Update (version 1607) + diff --git a/windows/manage/windows-10-start-layout-options-and-policies.md b/windows/manage/windows-10-start-layout-options-and-policies.md index c41206fb4c..93ebd58d4e 100644 --- a/windows/manage/windows-10-start-layout-options-and-policies.md +++ b/windows/manage/windows-10-start-layout-options-and-policies.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Manage Windows 10 Start and taskbar layout @@ -128,7 +128,7 @@ There are three categories of apps that might be pinned to a taskbar: * Apps pinned by the enterprise, such as in an unattended Windows setup **Note**   - The earlier method of using [TaskbarLinks](http://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file is deprecated in Windows 10, version 1607. + The earlier method of using [TaskbarLinks](https://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file is deprecated in Windows 10, version 1607. The following example shows how apps will be pinned - Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using XML to the right (green square). diff --git a/windows/manage/windows-spotlight.md b/windows/manage/windows-spotlight.md index 2af7597418..f6182e086b 100644 --- a/windows/manage/windows-spotlight.md +++ b/windows/manage/windows-spotlight.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Windows Spotlight on the lock screen diff --git a/windows/manage/windows-store-for-business-overview.md b/windows/manage/windows-store-for-business-overview.md index c6213c2a9e..6f8d654f82 100644 --- a/windows/manage/windows-store-for-business-overview.md +++ b/windows/manage/windows-store-for-business-overview.md @@ -25,7 +25,7 @@ With the new Windows Store for Business, organizations can make volume purchases Organizations of any size can benefit from using the Store for Business provides: -- **Scales to fit the size of your business** - For smaller businesses, with Azure AD accounts and Windows 10 devices, you can quickly have an end-to-end process for acquiring and distributing content using the Store for Business. For larger businesses, all the capabilities of the Store for Businessare available to you, or you can integrate the Store for Businesswith management tools, for greater control over access to apps and app updates. You can use existing work or school accounts. +- **Scales to fit the size of your business** - For smaller businesses, with Azure AD accounts and Windows 10 devices, you can quickly have an end-to-end process for acquiring and distributing content using the Store for Business. For larger businesses, all the capabilities of the Store for Business are available to you, or you can integrate the Store for Business with management tools, for greater control over access to apps and app updates. You can use existing work or school accounts. - **Bulk app acquisition** - Acquire apps in volume from the Store for Business. @@ -66,7 +66,7 @@ Microsoft Azure Active Directory (AD) accounts for your employees: - For offline-licensed apps, Azure AD accounts are not required for employees. -For more information on Azure AD, see [About Office 365 and Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](http://go.microsoft.com/fwlink/p/?LinkId=708611). +For more information on Azure AD, see [About Office 365 and Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](https://go.microsoft.com/fwlink/p/?LinkId=708611). ### Optional @@ -145,11 +145,11 @@ Once signed in to the Store for Business, you can browse and search for all prod - Universal Windows Platform apps -- Universal Windows apps, by device: Phone, Surface Hub, IOT devices , HoloLens +- Universal Windows apps, by device: Phone, Surface Hub, IOT devices, HoloLens Apps purchased from the Store for Business only work on Windows 10 devices. -Line-of-business (LOB) apps are also supported via the Business store. You can invite IT developers or ISVs to be LOB publishers for your organization. This allows them to submit apps via the developer center that are only available to your organization. These apps can be distributed using the distribution methods discussed in this topic. For more information, see Working with Line-of-Business apps. +Line-of-business (LOB) apps are also supported via the Business store. You can invite IT developers or ISVs to be LOB publishers for your organization. This allows them to submit apps via the developer center that are only available to your organization. These apps can be distributed using the distribution methods discussed in this topic. For more information, see [Working with Line-of-Business apps](working-with-line-of-business-apps.md). **App licensing model** @@ -265,7 +265,7 @@ Store for Business is currently available in these markets. ## ISVs and the Store for Business -Developers in your organization, or ISVs can create content specific to your organization. In the Store for Business, we call these app line-of-business (LOB) apps, and the devs that create them are LOB publishers. The process looks like this: +Developers in your organization, or ISVs can create content specific to your organization. In the Store for Business, we call these line-of-business (LOB) apps, and the devs that create them are LOB publishers. The process looks like this: - Admin invites devs to be LOB publishers for your organization. These devs can be internal devs, or external ISVs. diff --git a/windows/manage/working-with-line-of-business-apps.md b/windows/manage/working-with-line-of-business-apps.md index e0d0c284fe..f16e66fee9 100644 --- a/windows/manage/working-with-line-of-business-apps.md +++ b/windows/manage/working-with-line-of-business-apps.md @@ -22,7 +22,7 @@ Your company can make line-of-business (LOB) applications available through Wind Developers within your own company, or ISVs that you invite, can become LOB publishers and submit apps to the Windows Store for your company. Once a LOB publisher submits an app for your company, the app is only available to your company. LOB publishers submit apps through the Windows Dev Center using the same process as all apps that are in the Store, and then can be managed or deployed using the same process as any other app that has been acquired through the Store. -One advantage of making apps available through Store for Business is that the app has been signed by the Store, and uses the standard Store policies. For companies that can’t submit their application through the Windows Dev Center (for example, those needing additional capabilities or due to compliance purposes), [Sideloading](http://go.microsoft.com/fwlink/p/?LinkId=623433) is also supported in Windows 10. +One advantage of making apps available through Store for Business is that the app has been signed by the Store, and uses the standard Store policies. For companies that can’t submit their application through the Windows Dev Center (for example, those needing additional capabilities or due to compliance purposes), [Sideloading](https://go.microsoft.com/fwlink/p/?LinkId=623433) is also supported in Windows 10. ## Adding LOB apps to your private store @@ -39,7 +39,7 @@ What you'll have to set up: - Your company needs to be signed up with Store for Business. -- LOB publishers need to have an active developer account. To learn more about account options, see [Ready to sign up](http://go.microsoft.com/fwlink/p/?LinkId=623432). +- LOB publishers need to have an active developer account. To learn more about account options, see [Ready to sign up](https://go.microsoft.com/fwlink/p/?LinkId=623432). - LOB publishers need to have an app in the Store, or have an app ready to submit to the Store. @@ -49,7 +49,7 @@ For developers within your own organization, or ISVs you're working with to crea **To invite a developer to become an LOB publisher** -1. Sign in to the [Windows Store for Business]( http://go.microsoft.com/fwlink/p/?LinkId=623531). +1. Sign in to the [Windows Store for Business]( https://go.microsoft.com/fwlink/p/?LinkId=623531). 2. Click **Settings**, and then choose **LOB publishers**. 3. On the Line-of business publishers page, click **Add** to complete a form and send an email invitation to a developer.
    **Note** This needs to be the email address listed in contact info for the developer account. @@ -58,16 +58,16 @@ For developers within your own organization, or ISVs you're working with to crea The developer receives an email invite to become an LOB publisher for your company. Once they accept the invite, they can log in to the Windows Dev Center to create an app submission for your company. The info here assumes that devs or ISVs have an active developer account. -After an app is published and available in the Store, ISVs publish an updated version by creating another submission in their dashboard. Creating a new submission allows the ISV to make the changes required to create a LOB app for your company. To learn more about updates to an app submission, see [App submissions](http://go.microsoft.com/fwlink/p/?LinkId=623463) and [Distributing LOB apps to enterprises](http://go.microsoft.com/fwlink/p/?LinkId=627543). +After an app is published and available in the Store, ISVs publish an updated version by creating another submission in their dashboard. Creating a new submission allows the ISV to make the changes required to create a LOB app for your company. To learn more about updates to an app submission, see [App submissions](https://go.microsoft.com/fwlink/p/?LinkId=623463) and [Distributing LOB apps to enterprises](https://go.microsoft.com/fwlink/p/?LinkId=627543). **To create a new submission for an app** -1. Sign in to the [Windows Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=623486), go to your Dashboard, and click the app you want to make available as an LOB app. +1. Sign in to the [Windows Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=623486), go to your Dashboard, and click the app you want to make available as an LOB app. 2. On the App overview page, under **Action**, click **Update**. -OR- - Submit your app following the guidelines in [App submissions](http://go.microsoft.com/fwlink/p/?LinkId=623463). Be sure to completed steps 3 and 4 when you set app pricing and availability options. + Submit your app following the guidelines in [App submissions](https://go.microsoft.com/fwlink/p/?LinkId=623463). Be sure to completed steps 3 and 4 when you set app pricing and availability options. 3. On the **Pricing and availability** page, under **Distribution and visibility**, click **Line-of-business (LOB) distribution**, and then choose the enterprise(s) who will get the LOB app. No one else will have access to the app. 4. Under **Organizational licensing**, click **Show options**. @@ -80,7 +80,7 @@ After an app is published and available in the Store, ISVs publish an updated ve 5. Click **Save** to save your changes and start the app submission process. -For more information, see [Organizational licensing options]( http://go.microsoft.com/fwlink/p/?LinkId=708615) and [Distributing LOB apps to enterprises](http://go.microsoft.com/fwlink/p/?LinkId=627543).
    +For more information, see [Organizational licensing options]( https://go.microsoft.com/fwlink/p/?LinkId=708615) and [Distributing LOB apps to enterprises](https://go.microsoft.com/fwlink/p/?LinkId=627543).
    **Note** In order to get the LOB app, the organization must be located in a [supported market](https://technet.microsoft.com/itpro/windows/whats-new/windows-store-for-business-overview#supported-markets), and you must not have excluded that market when submitting your app. ### Add app to inventory (admin) diff --git a/windows/plan/change-history-for-plan-for-windows-10-deployment.md b/windows/plan/change-history-for-plan-for-windows-10-deployment.md index b584bf2f8d..fe06fd00a1 100644 --- a/windows/plan/change-history-for-plan-for-windows-10-deployment.md +++ b/windows/plan/change-history-for-plan-for-windows-10-deployment.md @@ -14,6 +14,7 @@ author: TrudyHa This topic lists new and updated topics in the [Plan for Windows 10 deployment](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). + ## RELEASE: Windows 10, version 1607 The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). diff --git a/windows/plan/chromebook-migration-guide.md b/windows/plan/chromebook-migration-guide.md index 12773fdd7e..8db7b3b57c 100644 --- a/windows/plan/chromebook-migration-guide.md +++ b/windows/plan/chromebook-migration-guide.md @@ -236,7 +236,7 @@ Assign the setting-migration priority based on how critical the setting is to th ## Plan for email migration Many of your users may be using Google Apps Gmail to manage their email, calendars, and contacts. You need to create the list of users you will migrate and the best time to perform the migration. -Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). +Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information, see [Migrate Google Apps mailboxes to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690252). **Identify the list of user mailboxes to migrate** @@ -244,7 +244,7 @@ In regards to creating the list of users you will migrate, it might seem that th Also, when you perform a migration it is a great time to verify that all user mailboxes are active. In many environments there are a significant number of mailboxes that were provisioned for users that are no longer a part of the institution (such as interns or student assistants). You can eliminate these users from your list of user mailboxes to migrate. -Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](http://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. +Create your list of user mailboxes to migrate in Excel 2016 based on the format described in step 7 in [Create a list of Gmail mailboxes to migrate](https://go.microsoft.com/fwlink/p/?LinkId=690253). If you follow this format, you can use the Microsoft Excel spreadsheet to perform the actual migration later in the process. **Identify companion devices that access Google Apps Gmail** @@ -252,7 +252,7 @@ In addition to Chromebook devices, users may have companion devices (smartphones After you have identified each companion device, verify the settings for the device that are used to access Office 365. You only need to test one type of each companion device. For example, if users use Android phones to access Google Apps Gmail mailboxes, configure the device to access Office 365 and then record those settings. You can publish those settings on a website or to your helpdesk staff so that users will know how to access their Office 365 mailbox. -In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690254). +In most instances, users will only need to provide in their Office 365 email account and password. However, you should verify this on each type of companion device. For more information about how to configure a companion device to work with Office 365, see [Compare how different mobile devices work with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690254). **Identify the optimal timing for the migration** Typically, the best time to perform the migration is between academic years or during semester breaks. Select the time of least activity for your institution. And during that time, the optimal time to perform the migration might be during an evening or over a weekend. @@ -571,9 +571,9 @@ Examine each of the following network infrastructure technologies and services a For more information that compares Internet bandwidth consumption for Chromebook and Windows devices, see the following resources: - - [Chromebook vs. Windows Notebook Network Traffic Analysis](http://go.microsoft.com/fwlink/p/?LinkId=690255) - - [Hidden Cost of Chromebook Deployments](http://go.microsoft.com/fwlink/p/?LinkId=690256) - - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](http://go.microsoft.com/fwlink/p/?LinkId=690257) + - [Chromebook vs. Windows Notebook Network Traffic Analysis](https://go.microsoft.com/fwlink/p/?LinkId=690255) + - [Hidden Cost of Chromebook Deployments](https://go.microsoft.com/fwlink/p/?LinkId=690256) + - [Microsoft Windows 8.1 Notebook vs. Chromebooks for Education](https://go.microsoft.com/fwlink/p/?LinkId=690257) - **Power.** Although not specifically a network infrastructure, you need to ensure your classrooms have adequate power. Chromebook and Windows devices should consume similar amounts of power. This means that your existing power outlets should support the same number of Windows devices. @@ -612,15 +612,15 @@ Table 7. Network infrastructure products and technologies and deployment resourc DHCP
      -

    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

      • -

    • [DHCP Deployment Guide](http://go.microsoft.com/fwlink/p/?LinkId=734021)

      • +

    • [Core Network Guide](https://go.microsoft.com/fwlink/p/?LinkId=733920)

      • +

    • [DHCP Deployment Guide](https://go.microsoft.com/fwlink/p/?LinkId=734021)

    DNS
      -

    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

      • -

    • [Deploying Domain Name System (DNS)](http://go.microsoft.com/fwlink/p/?LinkId=734022)

      • +

    • [Core Network Guide](https://go.microsoft.com/fwlink/p/?LinkId=733920)

      • +

    • [Deploying Domain Name System (DNS)](https://go.microsoft.com/fwlink/p/?LinkId=734022)

    @@ -650,16 +650,16 @@ Table 8. AD DS, Azure AD and deployment resources AD DS
      -

    • [Core Network Guide](http://go.microsoft.com/fwlink/p/?LinkId=733920)

      • -

    • [Active Directory Domain Services Overview](http://go.microsoft.com/fwlink/p/?LinkId=733909)

      • +

    • [Core Network Guide](https://go.microsoft.com/fwlink/p/?LinkId=733920)

      • +

    • [Active Directory Domain Services Overview](https://go.microsoft.com/fwlink/p/?LinkId=733909)

    Azure AD
      -

    • [Azure Active Directory documentation](http://go.microsoft.com/fwlink/p/?LinkId=690258)

      • -

    • [Manage and support Azure Active Directory Premium](http://go.microsoft.com/fwlink/p/?LinkId=690259)

      • -

    • [Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](http://go.microsoft.com/fwlink/p/?LinkId=690260)

      • +

    • [Azure Active Directory documentation](https://go.microsoft.com/fwlink/p/?LinkId=690258)

      • +

    • [Manage and support Azure Active Directory Premium](https://go.microsoft.com/fwlink/p/?LinkId=690259)

      • +

    • [Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](https://go.microsoft.com/fwlink/p/?LinkId=690260)

    @@ -689,38 +689,38 @@ Table 9. Management systems and deployment resources Windows provisioning packages
      -

    • [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918)

      • -

    • [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911)

      • -

    • [Step-By-Step: Building Windows 10 Provisioning Packages](http://go.microsoft.com/fwlink/p/?LinkId=690261)

      • +

    • [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkId=733918)

      • +

    • [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=733911)

      • +

    • [Step-By-Step: Building Windows 10 Provisioning Packages](https://go.microsoft.com/fwlink/p/?LinkId=690261)

    Group Policy
      -

    • [Core Network Companion Guide: Group Policy Deployment](http://go.microsoft.com/fwlink/p/?LinkId=733915)

      • -

    • [Deploying Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=734024)

      • +

    • [Core Network Companion Guide: Group Policy Deployment](https://go.microsoft.com/fwlink/p/?LinkId=733915)

      • +

    • [Deploying Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=734024)

    Configuration Manager
      -

    • [Site Administration for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733914)

      • -

    • [Deploying Clients for System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733919)

      • +

    • [Site Administration for System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733914)

      • +

    • [Deploying Clients for System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733919)

    Intune
      -

    • [Set up and manage devices with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=690262)

      • -

    • [Smoother Management Of Office 365 Deployments with Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690263)

      • -

    • [System Center 2012 R2 Configuration Manager & Windows Intune](http://go.microsoft.com/fwlink/p/?LinkId=690264)

      • +

    • [Set up and manage devices with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=690262)

      • +

    • [Smoother Management Of Office 365 Deployments with Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=690263)

      • +

    • [System Center 2012 R2 Configuration Manager & Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=690264)

    MDT
      -

    • [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324)

      • -

    • [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265)

      • +

    • [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=690324)

      • +

    • [Step-By-Step: Installing Windows 8.1 From A USB Key](https://go.microsoft.com/fwlink/p/?LinkId=690265)

    @@ -751,23 +751,23 @@ Table 10. Management systems and app deployment resources Group Policy
      -

    • [Editing an AppLocker Policy](http://go.microsoft.com/fwlink/p/?LinkId=734025)

      • -

    • [Group Policy Software Deployment Background](http://go.microsoft.com/fwlink/p/?LinkId=734026)

      • -

    • [Assigning and Publishing Software](http://go.microsoft.com/fwlink/p/?LinkId=734027)

      • +

    • [Editing an AppLocker Policy](https://go.microsoft.com/fwlink/p/?LinkId=734025)

      • +

    • [Group Policy Software Deployment Background](https://go.microsoft.com/fwlink/p/?LinkId=734026)

      • +

    • [Assigning and Publishing Software](https://go.microsoft.com/fwlink/p/?LinkId=734027)

    Configuration Manager
      -

    • [How to Deploy Applications in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733917)

      • -

    • [Application Management in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733907)

      • +

    • [How to Deploy Applications in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733917)

      • +

    • [Application Management in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733907)

    Intune
      -

    • [Deploy apps to mobile devices in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733913)

      • -

    • [Manage apps with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=733910)

      • +

    • [Deploy apps to mobile devices in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733913)

      • +

    • [Manage apps with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733910)

    @@ -792,13 +792,13 @@ If you do no want to migrate any user or device settings from the Chromebook dev In the [Plan for email migration](#plan-email-migrate) section, you identified the user mailboxes to migrate, identified the companion devices that access Google Apps Gmail, and identified the optimal timing for migration. You can perform this migration before or after you deploy the Windows devices. -Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690252). +Office 365 supports automated migration from Google Apps Gmail to Office 365. For more information on how to automate the migration from Google Apps Gmail to Office 365, see [Migrate Google Apps mailboxes to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690252). Alternatively, if you want to migrate to Office 365 from: - **On-premises Microsoft Exchange Server.** Use the following resources to migrate to Office 365 from an on-premises Microsoft Exchange Server: - - [Cutover Exchange Migration and Single Sign-On](http://go.microsoft.com/fwlink/p/?LinkId=690266) - - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690267) - - [Step-By-Step: Migrating from Exchange 2007 to Office 365](http://go.microsoft.com/fwlink/p/?LinkId=690268) + - [Cutover Exchange Migration and Single Sign-On](https://go.microsoft.com/fwlink/p/?LinkId=690266) + - [Step-By-Step: Migration of Exchange 2003 Server to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690267) + - [Step-By-Step: Migrating from Exchange 2007 to Office 365](https://go.microsoft.com/fwlink/p/?LinkId=690268) - **Another on-premises or cloud-based email service.** Follow the guidance from that vendor. ## Perform cloud storage migration @@ -832,11 +832,11 @@ For example, if you selected to deploy Windows devices by each classroom, start In some instances, you may receive the devices with Windows 10 already deployed, and want to use provisioning packages. In other cases, you may have a custom Windows 10 image that you want to deploy to the devices by using Configuration Manager and/or MDT. For information on how to deploy Windows 10 images to the devices, see the following resources: -- [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) -- [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=733918) -- [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](http://go.microsoft.com/fwlink/p/?LinkId=690324) -- [Step-By-Step: Installing Windows 8.1 From A USB Key](http://go.microsoft.com/fwlink/p/?LinkId=690265) -- [Operating System Deployment in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=733916) +- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=733911) +- [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkId=733918) +- [MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=690324) +- [Step-By-Step: Installing Windows 8.1 From A USB Key](https://go.microsoft.com/fwlink/p/?LinkId=690265) +- [Operating System Deployment in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=733916) In addition to the Windows 10 image deployment, you may need to perform the following tasks as a part of device deployment: @@ -848,7 +848,7 @@ In addition to the Windows 10 image deployment, you may need to perform the fol After you complete these steps, your management system should take over the day-to-day maintenance tasks for the Windows 10 devices. Verify that the user and device settings migrated correctly as you deploy each batch of Windows 10 devices. Continue this process until you deploy all Windows 10 devices. ## Related topics -- [Try it out: Windows 10 deployment (for education)](http://go.microsoft.com/fwlink/p/?LinkId=623254) -- [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255) +- [Try it out: Windows 10 deployment (for education)](https://go.microsoft.com/fwlink/p/?LinkId=623254) +- [Try it out: Windows 10 in the classroom](https://go.microsoft.com/fwlink/p/?LinkId=623255)     diff --git a/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md index 9e9c9f6ada..a27d633a60 100644 --- a/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md +++ b/windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md @@ -78,7 +78,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix blocks InstallShield from setting the value of RunAs registry keys to InteractiveUser Because InteractiveUser no longer has Administrator rights.

    Note   -

    For more detailed information about this application fix, see [Using the BlockRunAsInteractiveUser Fix](http://go.microsoft.com/fwlink/p/?LinkId=690328).

    +

    For more detailed information about this application fix, see [Using the BlockRunAsInteractiveUser Fix](https://go.microsoft.com/fwlink/p/?LinkId=690328).

      @@ -101,7 +101,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    You can control this fix further by entering the relevant registry keys as parameters that are separated by the ^ Symbol; for example: Software\MyCompany\Key1^Software\MyCompany\Key2.

    Note   -

    For more detailed information about this application fix, see [Using the CopyHKCUSettingsFromOtherUsers Fix](http://go.microsoft.com/fwlink/p/?LinkId=690329).

    +

    For more detailed information about this application fix, see [Using the CopyHKCUSettingsFromOtherUsers Fix](https://go.microsoft.com/fwlink/p/?LinkId=690329).

      @@ -118,7 +118,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix modifies the file path names to point to a new location on the hard disk.

    Note   -

    For more detailed information about the CorrectFilePaths application fix, see [Using the CorrectFilePaths Fix](http://go.microsoft.com/fwlink/p/?LinkId=690330). We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.

    +

    For more detailed information about the CorrectFilePaths application fix, see [Using the CorrectFilePaths Fix](https://go.microsoft.com/fwlink/p/?LinkId=690330). We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.

      @@ -130,7 +130,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix corrects the file paths that are used by the uninstallation process of an application.

    Note   -

    For more detailed information about this fix, see [Using the CorrectFilePathsUninstall Fix](http://go.microsoft.com/fwlink/p/?LinkId=690331). We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.

    +

    For more detailed information about this fix, see [Using the CorrectFilePathsUninstall Fix](https://go.microsoft.com/fwlink/p/?LinkId=690331). We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.

      @@ -142,7 +142,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the ShellExecute(Ex) calls, and then inspects the HWND value. If the value is invalid, this fix enables the call to use the currently active HWND value.

    Note   -

    For more detailed information about the CorrectShellExecuteHWND application fix, see [Using the CorrectShellExecuteHWND Fix](http://go.microsoft.com/fwlink/p/?LinkId=690332).

    +

    For more detailed information about the CorrectShellExecuteHWND application fix, see [Using the CorrectShellExecuteHWND Fix](https://go.microsoft.com/fwlink/p/?LinkId=690332).

      @@ -214,7 +214,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.

    Note   -

    For more detailed information about this application fix, see [Using the DisableDWM Fix]( http://go.microsoft.com/fwlink/p/?LinkId=690334).

    +

    For more detailed information about this application fix, see [Using the DisableDWM Fix]( https://go.microsoft.com/fwlink/p/?LinkId=690334).

      @@ -252,7 +252,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix handles the error code and attempts to recall the CreateProcess function together with requested elevation. If the fixed application already has a UAC manifest, the error code will be returned unchanged.

    Note   -

    For more detailed information about this application fix, see [Using the ElevateCreateProcess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690335).

    +

    For more detailed information about this application fix, see [Using the ElevateCreateProcess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690335).

      @@ -269,7 +269,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix determines the amount of free space, so that if the amount of free space is larger than 2 GB, the compatibility fix returns a value of 2 GB, but if the amount of free space is smaller than 2 GB, the compatibility fix returns the actual free space amount.

    Note   -

    For more detailed information about this application fix, see [Using the EmulateGetDiskFreeSpace Fix](http://go.microsoft.com/fwlink/p/?LinkId=690336).

    +

    For more detailed information about this application fix, see [Using the EmulateGetDiskFreeSpace Fix](https://go.microsoft.com/fwlink/p/?LinkId=690336).

      @@ -281,7 +281,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix forces applications that use the CompareStringW/LCMapString sorting table to use an older version of the table.

    Note   -

    For more detailed information about this e application fix, see [Using the EmulateSorting Fix](http://go.microsoft.com/fwlink/p/?LinkId=690337).

    +

    For more detailed information about this e application fix, see [Using the EmulateSorting Fix](https://go.microsoft.com/fwlink/p/?LinkId=690337).

      @@ -297,7 +297,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the computer to restart and finish the installation process by verifying and enabling that the SeShutdownPrivilege service privilege exists.

    Note   -

    For more detailed information about this application fix, see [Using the EnableRestarts Fix](http://go.microsoft.com/fwlink/p/?LinkId=690338).

    +

    For more detailed information about this application fix, see [Using the EnableRestarts Fix](https://go.microsoft.com/fwlink/p/?LinkId=690338).

      @@ -332,7 +332,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the GetCurrentThemeName API and returns the value for the Windows XP default theme, (Luna).

    Note   -

    For more detailed information about the FakeLunaTheme application fix, see [Using the FakeLunaTheme Fix](http://go.microsoft.com/fwlink/p/?LinkId=690339).

    +

    For more detailed information about the FakeLunaTheme application fix, see [Using the FakeLunaTheme Fix](https://go.microsoft.com/fwlink/p/?LinkId=690339).

      @@ -353,7 +353,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix allows the user to temporarily imitate being a part of the Administrators group by returning a value of True during the administrator check.

    Note   -

    For more detailed information about this application fix, see [Using the ForceAdminAccess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690342).

    +

    For more detailed information about this application fix, see [Using the ForceAdminAccess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690342).

      @@ -402,7 +402,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the RegisterRawInputDevices API and prevents the delivery of the WM_INPUT messages. This delivery failure forces the included hooks to be ignored and forces DInput to use Windows-specific hooks.

    Note   -

    For more detailed information about this application fix, see [Using the IgnoreAltTab Fix](http://go.microsoft.com/fwlink/p/?LinkId=690343).

    +

    For more detailed information about this application fix, see [Using the IgnoreAltTab Fix](https://go.microsoft.com/fwlink/p/?LinkId=690343).

      @@ -440,7 +440,7 @@ The following table lists the known compatibility fixes for all Windows operatin
    Note   -

    For more detailed information about this application fix, see [Using the IgnoreException Fix](http://go.microsoft.com/fwlink/p/?LinkId=690344).

    +

    For more detailed information about this application fix, see [Using the IgnoreException Fix](https://go.microsoft.com/fwlink/p/?LinkId=690344).

      @@ -462,7 +462,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the MessageBox* APIs and inspects them for specific message text. If matching text is found, the application continues without showing the message box.

    Note   -

    For more detailed information about this application fix, see [Using the IgnoreMessageBox Fix](http://go.microsoft.com/fwlink/p/?LinkId=690345).

    +

    For more detailed information about this application fix, see [Using the IgnoreMessageBox Fix](https://go.microsoft.com/fwlink/p/?LinkId=690345).

      @@ -491,7 +491,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix intercepts the function call to create the object and replaces the word Global with Local.

    Note   -

    For more detailed information about this application fix, see [Using the LocalMappedObject Fix](http://go.microsoft.com/fwlink/p/?LinkId=690346).

    +

    For more detailed information about this application fix, see [Using the LocalMappedObject Fix](https://go.microsoft.com/fwlink/p/?LinkId=690346).

      @@ -503,7 +503,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix locates any RunDLL.exe-based uninstallers and forces them to run with different credentials during the application installation. After it applies this fix, the installer will create a shortcut that specifies a matching string to run during the application installation, thereby enabling the uninstallation to occur later.

    Note   -

    For more detailed information about this application fix, see [Using the MakeShortcutRunas Fix]( http://go.microsoft.com/fwlink/p/?LinkId=690347)

    +

    For more detailed information about this application fix, see [Using the MakeShortcutRunas Fix]( https://go.microsoft.com/fwlink/p/?LinkId=690347)

      @@ -528,7 +528,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix reduces the security privilege levels on a specified set of files and folders.

    Note   -

    For more detailed information about this application fix, see [Using the OpenDirectoryACL Fix](http://go.microsoft.com/fwlink/p/?LinkId=690348).

    +

    For more detailed information about this application fix, see [Using the OpenDirectoryACL Fix](https://go.microsoft.com/fwlink/p/?LinkId=690348).

      @@ -603,7 +603,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables a child .exe file to run with elevated privileges when it is difficult to determine the parent process with either the ElevateCreateProcess fix or by marking the .exe files to RunAsAdmin.

    Note   -

    For more detailed information about this application fix, see [Using the RelaunchElevated Fix](http://go.microsoft.com/fwlink/p/?LinkId=690349).

    +

    For more detailed information about this application fix, see [Using the RelaunchElevated Fix](https://go.microsoft.com/fwlink/p/?LinkId=690349).

      @@ -620,7 +620,7 @@ The following table lists the known compatibility fixes for all Windows operatin

  • STANDARD_READ_RIGHTS

    Note   -

    For more detailed information about this application fix, see [Using the RetryOpenSCManagerwithReadAccess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690350).

    +

    For more detailed information about this application fix, see [Using the RetryOpenSCManagerwithReadAccess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690350).

      @@ -633,7 +633,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix retries the OpenService() API call and verifies that the user has Administrator rights, is not a Protected Administrator, and by using read-only access. Applications can test for the existence of a service by calling the OpenService() API but some applications ask for all access when making this check. This fix retries the call but only asking for read-only access. The user needs to be an administrator for this to work

    Note   -

    For more detailed information about this application fix, see [Using the RetryOpenServiceWithReadAccess Fix](http://go.microsoft.com/fwlink/p/?LinkId=690351).

    +

    For more detailed information about this application fix, see [Using the RetryOpenServiceWithReadAccess Fix](https://go.microsoft.com/fwlink/p/?LinkId=690351).

      @@ -645,7 +645,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the application to run by using elevated privileges. The fix is the equivalent of specifying requireAdministrator in an application manifest.

    Note   -

    For more detailed information about this application fix, see [Using the RunAsAdmin Fix](http://go.microsoft.com/fwlink/p/?LinkId=690353).

    +

    For more detailed information about this application fix, see [Using the RunAsAdmin Fix](https://go.microsoft.com/fwlink/p/?LinkId=690353).

      @@ -657,7 +657,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the application to run by using the highest available permissions. This is the equivalent of specifying highestAvailable in an application manifest.

    Note   -

    For more detailed information about this application fix, see [Using the RunAsHighest Fix](http://go.microsoft.com/fwlink/p/?LinkId=690355).

    +

    For more detailed information about this application fix, see [Using the RunAsHighest Fix](https://go.microsoft.com/fwlink/p/?LinkId=690355).

      @@ -669,7 +669,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix enables the application to run by using the privileges that are associated with the creation process, without requiring elevation. This is the equivalent of specifying asInvoker in an application manifest.

    Note   -

    For more detailed information about this application fix, see [Using the RunAsInvoker Fix](http://go.microsoft.com/fwlink/p/?LinkId=690356).

    +

    For more detailed information about this application fix, see [Using the RunAsInvoker Fix](https://go.microsoft.com/fwlink/p/?LinkId=690356).

      @@ -692,7 +692,7 @@ The following table lists the known compatibility fixes for all Windows operatin
    Note   -

    For more detailed information about this application fix, see [Using the SessionShim Fix](http://go.microsoft.com/fwlink/p/?LinkId=690358).

    +

    For more detailed information about this application fix, see [Using the SessionShim Fix](https://go.microsoft.com/fwlink/p/?LinkId=690358).

      @@ -727,7 +727,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix applies the specified compatibility fixes by modifying the export table and by nullifying the use of module inclusion and exclusion.

    Note   -

    For more information about this application fix, see [Using the ShimViaEAT Fix](http://go.microsoft.com/fwlink/p/?LinkId=690359).

    +

    For more information about this application fix, see [Using the ShimViaEAT Fix](https://go.microsoft.com/fwlink/p/?LinkId=690359).

      @@ -752,7 +752,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix flags the application as being an installer file (for example, setup.exe), and then prompts for elevation.

    Note   -

    For more detailed information about this application fix, see [Using the SpecificInstaller Fix]( http://go.microsoft.com/fwlink/p/?LinkId=690361).

    +

    For more detailed information about this application fix, see [Using the SpecificInstaller Fix]( https://go.microsoft.com/fwlink/p/?LinkId=690361).

      @@ -764,7 +764,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix flags the application to exclude it from detection by the GenericInstaller function.

    Note   -

    For more detailed information about this application fix, see [Using the SpecificNonInstaller Fix](http://go.microsoft.com/fwlink/p/?LinkId=690363).

    +

    For more detailed information about this application fix, see [Using the SpecificNonInstaller Fix](https://go.microsoft.com/fwlink/p/?LinkId=690363).

      @@ -795,7 +795,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    Where MessageString1 and MessageString2 reflect the message strings that can pass.

    Note   -

    Multiple message strings must be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableCustomMsgs Fix](http://go.microsoft.com/fwlink/p/?LinkId=690365).

    +

    Multiple message strings must be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableCustomMsgs Fix](https://go.microsoft.com/fwlink/p/?LinkId=690365).

      @@ -810,7 +810,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    Where 1055 reflects the first message ID, 1056 reflects the second message ID, and 1069 reflects the third message ID that can pass.

    Note   -

    Multiple messages can be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableStandardMsgs Fix [act]](http://go.microsoft.com/fwlink/p/?LinkId=690367).

    +

    Multiple messages can be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableStandardMsgs Fix [act]](https://go.microsoft.com/fwlink/p/?LinkId=690367).

      @@ -828,7 +828,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    VirtualRegistry

    The problem is indicated when a Component failed to be located error message displays when an application is started.

    The fix enables the registry functions to allow for virtualization, redirection, expansion values, version spoofing, the simulation of performance data counters, and so on.

    -

    For more detailed information about this application fix, see [Using the VirtualRegistry Fix](http://go.microsoft.com/fwlink/p/?LinkId=690368).

    +

    For more detailed information about this application fix, see [Using the VirtualRegistry Fix](https://go.microsoft.com/fwlink/p/?LinkId=690368).

    VirtualizeDeleteFile

    @@ -836,7 +836,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix makes the application's DeleteFile function call a virtual call in an effort to remedy the UAC and file virtualization issues that were introduced with Windows Vista. This fix also links other file APIs (for example, GetFileAttributes) to ensure that the virtualization of the file is deleted.

    Note   -

    For more detailed information about this application fix, see [Using the VirtualizeDeleteFile Fix](http://go.microsoft.com/fwlink/p/?LinkId=690369).

    +

    For more detailed information about this application fix, see [Using the VirtualizeDeleteFile Fix](https://go.microsoft.com/fwlink/p/?LinkId=690369).

      @@ -848,14 +848,14 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix redirects the HKCR write calls (HKLM) to the HKCU hive for a per-user COM registration. This operates much like the VirtualRegistry fix when you use the VirtualizeHKCR parameter; however, VirtualizeHKCRLite provides better performance.

    HKCR is a virtual merge of the HKCU\Software\Classes and HKLM\Software\Classes directories. The use of HKCU is preferred if an application is not elevated and is ignored if the application is elevated.

    You typically will use this compatibility fix in conjunction with the VirtualizeRegisterTypeLib fix.

    -

    For more detailed information about this application fix, see [Using the VirtualizeHKCRLite Fix](http://go.microsoft.com/fwlink/p/?LinkId=690370).

    +

    For more detailed information about this application fix, see [Using the VirtualizeHKCRLite Fix](https://go.microsoft.com/fwlink/p/?LinkId=690370).

    VirtualizeRegisterTypeLib

    The fix, when it is used with the VirtualizeHKCRLite fix, ensures that the type library and the COM class registration happen simultaneously. This functions much like the RegistryTypeLib fix when the RegisterTypeLibForUser parameter is used.

    Note   -

    For more detailed information about this application fix, see [Using the VirtualizeRegisterTypelib Fix](http://go.microsoft.com/fwlink/p/?LinkId=690371).

    +

    For more detailed information about this application fix, see [Using the VirtualizeRegisterTypelib Fix](https://go.microsoft.com/fwlink/p/?LinkId=690371).

      @@ -907,7 +907,7 @@ The following table lists the known compatibility fixes for all Windows operatin

  • Save the custom database.

    Note   -

    For more information about the WinXPSP2VersionLie application fix, see [Using the WinXPSP2VersionLie Fix](http://go.microsoft.com/fwlink/p/?LinkId=690374).

    +

    For more information about the WinXPSP2VersionLie application fix, see [Using the WinXPSP2VersionLie Fix](https://go.microsoft.com/fwlink/p/?LinkId=690374).

      @@ -923,7 +923,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    Where Component1.dll and Component2.dll reflect the components to be skipped.

    Note   -

    For more detailed information about this application fix, see [Using the WRPDllRegister Fix](http://go.microsoft.com/fwlink/p/?LinkId=690375).

    +

    For more detailed information about this application fix, see [Using the WRPDllRegister Fix](https://go.microsoft.com/fwlink/p/?LinkId=690375).

      @@ -935,7 +935,7 @@ The following table lists the known compatibility fixes for all Windows operatin

    The fix emulates the successful authentication and modification of file and registry APIs, so that the application can continue.

    Note   -

    For more detailed information about WRPMitigation, see [Using the WRPMitigation Fix](http://go.microsoft.com/fwlink/p/?LinkId=690376).

    +

    For more detailed information about WRPMitigation, see [Using the WRPMitigation Fix](https://go.microsoft.com/fwlink/p/?LinkId=690376).

      diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index 590e3606e6..b451e7b8aa 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -1256,8 +1256,8 @@ Now, you have identified the tasks you need to perform monthly, at the end of an ##Related resources
      -
    • [Try it out: Windows 10 deployment (for educational institutions)](http://go.microsoft.com/fwlink/p/?LinkId=623254)
      • -
    • [Try it out: Windows 10 in the classroom](http://go.microsoft.com/fwlink/p/?LinkId=623255)
      • -
    • [Chromebook migration guide](http://go.microsoft.com/fwlink/p/?LinkId=623249)
      • +
    • [Try it out: Windows 10 deployment (for educational institutions)](https://go.microsoft.com/fwlink/p/?LinkId=623254)
      • +
    • [Try it out: Windows 10 in the classroom](https://go.microsoft.com/fwlink/p/?LinkId=623255)
      • +
    • [Chromebook migration guide](https://go.microsoft.com/fwlink/p/?LinkId=623249)
    diff --git a/windows/plan/deployment-considerations-for-windows-to-go.md b/windows/plan/deployment-considerations-for-windows-to-go.md index 5ef6884c18..a1a32d6836 100644 --- a/windows/plan/deployment-considerations-for-windows-to-go.md +++ b/windows/plan/deployment-considerations-for-windows-to-go.md @@ -56,11 +56,11 @@ When a Windows To Go workspace is first used at the workplace, the Windows To Go When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee’s home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. **Tip**   -Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](http://go.microsoft.com/fwlink/p/?LinkId=619076). +Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076).   -DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](http://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](http://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. +DirectAccess can be used to ensure that the user can login with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](https://go.microsoft.com/fwlink/p/?LinkId=619077) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=619078). If you do not want to use DirectAccess as an alternative users could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network. ### Image deployment and drive provisioning considerations @@ -155,28 +155,28 @@ The following list of commonly used Wi-Fi network adapters that are not supporte

    Marvell

    Yukon 88E8001/8003/8010 PCI Gigabit Ethernet

    pci\ven_11ab&dev_4320&subsys_811a1043

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619080)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619082)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619080)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619082)

    Marvell

    Libertas 802.11b/g Wireless

    pci\ven_11ab&dev_1faa&subsys_6b001385&rev_03

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619128)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619129)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619128)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619129)

    Qualcomm

    Atheros AR6004 Wireless LAN Adapter

    sd\vid_0271&pid_0401

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619086)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619086)

    64-bit driver not available

    Qualcomm

    Atheros AR5BWB222 Wireless Network Adapter

    pci\ven_168c&dev_0034&subsys_20031a56

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619348)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619348)

    64-bit driver not available

    @@ -189,43 +189,43 @@ The following list of commonly used Wi-Fi network adapters that are not supporte

    Qualcomm

    Atheros AR5005G Wireless Network Adapter

    pci\ven_168c&dev_001a&subsys_04181468&rev_01

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619349)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619091)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619349)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619091)

    Ralink

    Wireless-G PCI Adapter

    pci\ven_1814&dev_0301&subsys_00551737&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619092)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619093)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619092)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619093)

    Ralink

    Turbo Wireless LAN Card

    pci\ven_1814&dev_0301&subsys_25611814&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619094)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619095)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619094)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619095)

    Ralink

    Wireless LAN Card V1

    pci\ven_1814&dev_0302&subsys_3a711186&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619097)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619098)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619097)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619098)

    Ralink

    D-Link AirPlus G DWL-G510 Wireless PCI Adapter(rev.C)

    pci\ven_1814&dev_0302&subsys_3c091186&rev_00

    -

    [32-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619099)

    -

    [64-bit driver](http://go.microsoft.com/fwlink/p/?LinkId=619100)

    +

    [32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619099)

    +

    [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619100)

      -IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](http://go.microsoft.com/fwlink/p/?LinkId=619079). +IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=619079). ### Application installation and domain join @@ -273,7 +273,7 @@ Enabling a system to always boot from USB first has implications that you should   -If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkID=618951). +If you are going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). ### Roaming between different firmware types diff --git a/windows/plan/index.md b/windows/plan/index.md index 1a3583938b..b692bf0504 100644 --- a/windows/plan/index.md +++ b/windows/plan/index.md @@ -15,11 +15,11 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildi ## In this section |Topic |Description | |------|------------| -|[Windows 10 servicing options](windows-10-servicing-options.md) |Windows 10 provides a new model for organizations to deploy and upgrade Windows by providing updates to features and capabilities through a continual process. | +| [Windows 10 servicing overview](windows-10-servicing-options.md) | Windows 10 provides a new model for organizations to deploy and upgrade Windows by providing updates to features and capabilities through a continual process. | |[Windows 10 deployment considerations](windows-10-deployment-considerations.md) |There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. | |[Windows 10 compatibility](windows-10-compatibility.md) |Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. | |[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) |There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. | -|[Windows Update for Business](windows-update-for-business.md) |Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. | +| [Windows Update for Business](windows-update-for-business.md) | Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. | |[Windows To Go: feature overview](windows-to-go-overview.md) |Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. | |[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) |The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. | |[Change history for Plan for Windows 10 deployment](change-history-for-plan-for-windows-10-deployment.md) |This topic lists new and updated topics in the Plan for Windows 10 deployment documentation for [Windows 10 and Windows 10 Mobile](../index.md). | @@ -30,14 +30,9 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildi - [Deploy Windows 10 with Configuration Manager and MDT 2013 Update 1](../deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) - [Upgrade to Windows 10 with MDT 2013 Update 1](../deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) - [Upgrade to Windows 10 with Configuration Manager](../deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md) -- [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) +- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=733911) - [Windows 10 and Windows 10 Mobile](../index.md)     - - - - - diff --git a/windows/plan/integration-with-management-solutions-.md b/windows/plan/integration-with-management-solutions-.md index 83dcaee001..73206e6baf 100644 --- a/windows/plan/integration-with-management-solutions-.md +++ b/windows/plan/integration-with-management-solutions-.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices -author: TrudyHa +author: jdeckerMS --- # Integration with management solutions diff --git a/windows/plan/prepare-your-organization-for-windows-to-go.md b/windows/plan/prepare-your-organization-for-windows-to-go.md index fabf25bc73..a5443fb11c 100644 --- a/windows/plan/prepare-your-organization-for-windows-to-go.md +++ b/windows/plan/prepare-your-organization-for-windows-to-go.md @@ -70,7 +70,7 @@ Because Windows To Go requires no additional software and minimal configuration, Windows To Go uses volume activation. You can use either Active Directory-based activation or KMS activation with Windows To Go. The Windows To Go workspace counts as another installation when assessing compliance with application licensing agreements. -Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Office 365 ProPlus, Office 365 ProPlus subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Office 365 ProPlus or Office 365 Enterprise SKUs containing Office 365 ProPlus via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](http://go.microsoft.com/fwlink/p/?LinkId=618922). +Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Office 365 ProPlus, Office 365 ProPlus subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Office 365 ProPlus or Office 365 Enterprise SKUs containing Office 365 ProPlus via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). You should investigate other software manufacturer’s licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. @@ -79,7 +79,7 @@ Using Multiple Activation Key (MAK) activation is not a supported activation met   -See [Plan for Volume Activation](http://go.microsoft.com/fwlink/p/?LinkId=618923) for more information about these activation methods and how they can be used in your organization. +See [Plan for Volume Activation](https://go.microsoft.com/fwlink/p/?LinkId=618923) for more information about these activation methods and how they can be used in your organization. ## Organizational unit structure and use of Group Policy Objects @@ -98,14 +98,14 @@ If you configure Windows To Go drives for scenarios where drives may remain unus ## User account and data management -People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user’s profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](http://go.microsoft.com/fwlink/p/?LinkId=618924). +People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user’s profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace. ## Remote connectivity -If you want Windows To Go to be able to connect back to organizational resources when it is being used off-premises a remote connectivity solution must be enabled. Windows Server 2012 DirectAccess can be used as can a virtual private network (VPN) solution. For more information about configuring a remote access solution, see the [Remote Access (DirectAccess, Routing and Remote Access) Overview](http://go.microsoft.com/fwlink/p/?LinkId=618925). +If you want Windows To Go to be able to connect back to organizational resources when it is being used off-premises a remote connectivity solution must be enabled. Windows Server 2012 DirectAccess can be used as can a virtual private network (VPN) solution. For more information about configuring a remote access solution, see the [Remote Access (DirectAccess, Routing and Remote Access) Overview](https://go.microsoft.com/fwlink/p/?LinkId=618925). ## Related topics diff --git a/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md b/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md index 999d2e6956..2cce8de874 100644 --- a/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md +++ b/windows/plan/security-and-data-protection-considerations-for-windows-to-go.md @@ -22,9 +22,9 @@ One of the most important requirements to consider when you plan your Windows To ## Backup and restore -As long as you are not saving data on the Windows To Go drive, there is no need for a backup and restore solution for Windows To Go. If you are saving data on the drive and are not using folder redirection and offline files, you should back up all of your data to a network location, such as cloud storage or a network share after each work session. Review the new and improved features described in [Supporting Information Workers with Reliable File Services and Storage](http://go.microsoft.com/fwlink/p/?LinkId=619102) for different solutions you could implement. +As long as you are not saving data on the Windows To Go drive, there is no need for a backup and restore solution for Windows To Go. If you are saving data on the drive and are not using folder redirection and offline files, you should back up all of your data to a network location, such as cloud storage or a network share after each work session. Review the new and improved features described in [Supporting Information Workers with Reliable File Services and Storage](https://go.microsoft.com/fwlink/p/?LinkId=619102) for different solutions you could implement. -If the USB drive fails for any reason, the standard process to restore the drive to working condition is to reformat and re-provision the drive with Windows To Go, so all data and customization on the drive will be lost. This is another reason why using roaming user profiles, folder redirection and offline files with Windows To Go is strongly recommended. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](http://go.microsoft.com/fwlink/p/?LinkId=618924). +If the USB drive fails for any reason, the standard process to restore the drive to working condition is to reformat and re-provision the drive with Windows To Go, so all data and customization on the drive will be lost. This is another reason why using roaming user profiles, folder redirection and offline files with Windows To Go is strongly recommended. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). ## BitLocker @@ -47,16 +47,16 @@ We recommend that you use the **NoDefaultDriveLetter** attribute when provisioni To prevent accidental data leakage between Windows To Go and the host system Windows 8 has a new SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. The default configuration for Windows To Go has this policy enabled. It is strongly recommended you do not change this policy to allow mounting of internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. -For more information, see [How to Configure Storage Area Network (SAN) Policy in Windows PE](http://go.microsoft.com/fwlink/p/?LinkId=619103). +For more information, see [How to Configure Storage Area Network (SAN) Policy in Windows PE](https://go.microsoft.com/fwlink/p/?LinkId=619103). ## Security certifications for Windows To Go Windows to Go is a core capability of Windows when it is deployed on the drive and is configured following the guidance for the applicable security certification. Solutions built using Windows To Go can be submitted for additional certifications by the solution provider that cover the solution provider’s specific hardware environment. For more details about Windows security certifications, see the following topics. -- [Windows Platform Common Criteria Certification](http://go.microsoft.com/fwlink/p/?LinkId=619104) +- [Windows Platform Common Criteria Certification](https://go.microsoft.com/fwlink/p/?LinkId=619104) -- [FIPS 140 Evaluation](http://go.microsoft.com/fwlink/p/?LinkId=619107) +- [FIPS 140 Evaluation](https://go.microsoft.com/fwlink/p/?LinkId=619107) ## Related topics diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index 618c4b80a0..6705747d10 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices -author: TrudyHa +author: jdeckerMS --- # Setup and deployment @@ -87,7 +87,7 @@ Windows Update for Business allows administrators to control when upgrades and u   -Administrators can control deferral periods with Group Policy Objects by using the [Local Group Policy Editor (GPEdit)](http://go.microsoft.com/fwlink/p/?LinkId=734030) or, for domain joined systems, [Group Policy Management Console (GPMC)](http://go.microsoft.com/fwlink/p/?LinkId=699325). For additional details on Group Policy management see [Group Policy management for IT pros](http://go.microsoft.com/fwlink/p/?LinkId=699282). +Administrators can control deferral periods with Group Policy Objects by using the [Local Group Policy Editor (GPEdit)](https://go.microsoft.com/fwlink/p/?LinkId=734030) or, for domain joined systems, [Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=699325). For additional details on Group Policy management see [Group Policy management for IT pros](https://go.microsoft.com/fwlink/p/?LinkId=699282). **Set different deferrals based on update classification in GPedit.msc** ![figure 4](images/wuforbusiness-fig4-localpoleditor.png) ![figure 5](images/wuforbusiness-fig5-deferupgrade.png) @@ -157,7 +157,7 @@ Delivery Optimization configuration settings can be viewed by going to: Settings You can use Group Policy to configure Windows Update Delivery Optimization. To do this, use the following steps: -1. Download the [Administrative Templates (.admx) file for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699283) from the Microsoft Download Center. +1. Download the [Administrative Templates (.admx) file for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=699283) from the Microsoft Download Center. 2. Copy the following files to the SYSVOL central store: - DeliveryOptimization.admx from C:\\Program Files (x86)\\Microsoft Group Policy\\Windows 10\\PolicyDefinitions - DeliveryOptimization.adml from C:\\Program Files (x86)\\Microsoft Group Policy\\Windows 10\\PolicyDefinitions\\en-US @@ -172,9 +172,9 @@ You can use Group Policy to configure Windows Update Delivery Optimization. To d Microsoft scanned this file for viruses, using the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to it. -For more information about Windows Update Delivery Optimization in Windows 10, see the [Windows Update Delivery Optimization FAQ](http://go.microsoft.com/fwlink/p/?LinkId=699284). +For more information about Windows Update Delivery Optimization in Windows 10, see the [Windows Update Delivery Optimization FAQ](https://go.microsoft.com/fwlink/p/?LinkId=699284). -For additional resources, see [How to use Group Policy to configure Windows Update Delivery Optimization in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=699288). +For additional resources, see [How to use Group Policy to configure Windows Update Delivery Optimization in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=699288). ## Related topics diff --git a/windows/plan/windows-10-compatibility.md b/windows/plan/windows-10-compatibility.md index 7466117367..013a715282 100644 --- a/windows/plan/windows-10-compatibility.md +++ b/windows/plan/windows-10-compatibility.md @@ -6,6 +6,7 @@ keywords: deploy, upgrade, update, appcompat ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: appcompat +localizationpriority: high ms.sitesec: library author: mtniehaus --- @@ -19,13 +20,13 @@ author: mtniehaus Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. -For full system requirements, see [Windows 10 specifications](http://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. +For full system requirements, see [Windows 10 specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. Existing desktop (Win32) application compatibility is also expected to be strong, with most existing applications working without any changes. Some applications that interface with Windows at a low level, those that use undocumented APIs, or those that do not follow recommended coding practices could experience issues. Existing Windows Store (WinRT) apps created for Windows 8 and Windows 8.1 should also continue to work, because compatibility can be validated against all the apps that have been submitted to the Windows Store. -For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](http://go.microsoft.com/fwlink/p/?LinkId=734031) +For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](https://go.microsoft.com/fwlink/p/?LinkId=734031) ## Recommended application testing process diff --git a/windows/plan/windows-10-deployment-considerations.md b/windows/plan/windows-10-deployment-considerations.md index cefe2e8c90..9c2cb27ef4 100644 --- a/windows/plan/windows-10-deployment-considerations.md +++ b/windows/plan/windows-10-deployment-considerations.md @@ -4,6 +4,7 @@ description: There are new deployment options in Windows 10 that help you simpl ms.assetid: A8DD6B37-1E11-4CD6-B588-92C2404219FE keywords: deploy, upgrade, update, in-place ms.prod: w10 +localizationpriority: high ms.mktglfcycl: plan ms.sitesec: library author: mtniehaus @@ -80,7 +81,7 @@ Note that the original Windows 8 release is only supported until January 2016. For existing Windows PCs running Windows Vista, you can perform wipe-and-load (OS refresh) deployments when you use compatible hardware. -Note that to take advantage of the limited-time free upgrade offer for PCs running Windows 7, Windows 8, or Windows 8.1, you must leverage an in-place upgrade, either from Windows Update or by using the upgrade media available from the [Windows 10 software download page](http://go.microsoft.com/fwlink/p/?LinkId=625073) to acquire a new Windows 10 license from the Windows Store. For more information, refer to the [Windows 10 FAQ](http://go.microsoft.com/fwlink/p/?LinkId=625074). +Note that to take advantage of the limited-time free upgrade offer for PCs running Windows 7, Windows 8, or Windows 8.1, you must leverage an in-place upgrade, either from Windows Update or by using the upgrade media available from the [Windows 10 software download page](https://go.microsoft.com/fwlink/p/?LinkId=625073) to acquire a new Windows 10 license from the Windows Store. For more information, refer to the [Windows 10 FAQ](https://go.microsoft.com/fwlink/p/?LinkId=625074). For organizations with Software Assurance for Windows, both in-place upgrade or wipe-and-load can be leveraged (with in-place upgrade being the preferred method, as previously discussed). @@ -91,9 +92,9 @@ For organizations that do not take advantage of the free upgrade offer and are n For new computers acquired with Windows 10 preinstalled, you can leverage dynamic provisioning scenarios to transform the device from its initial state into a fully-configured organization PC. There are two primary dynamic provisioning scenarios you can use: -- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](http://go.microsoft.com/fwlink/p/?LinkId=625075). +- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](https://go.microsoft.com/fwlink/p/?LinkId=625075). -- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=625076). +- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=625076). In either of these scenarios, you can make a variety of configuration changes to the PC: diff --git a/windows/plan/windows-10-infrastructure-requirements.md b/windows/plan/windows-10-infrastructure-requirements.md index f8a5b10095..be533cabf2 100644 --- a/windows/plan/windows-10-infrastructure-requirements.md +++ b/windows/plan/windows-10-infrastructure-requirements.md @@ -5,6 +5,7 @@ ms.assetid: B0FA27D9-A206-4E35-9AE6-74E70748BE64 keywords: deploy, upgrade, update, hardware ms.prod: w10 ms.mktglfcycl: plan +localizationpriority: high ms.sitesec: library author: mtniehaus --- @@ -28,11 +29,11 @@ For persistent VDI environments, carefully consider the I/O impact from upgradin ## Deployment tools -A new version of the Assessment and Deployment Toolkit (ADK) has been released to support Windows 10. This new version, available for download [here](http://go.microsoft.com/fwlink/p/?LinkId=526740), is required for Windows 10; you should not use earlier versions of the ADK to deploy Windows 10. It also supports the deployment of Windows 7, Windows 8, and Windows 8.1. +A new version of the Assessment and Deployment Toolkit (ADK) has been released to support Windows 10. This new version, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=526740), is required for Windows 10; you should not use earlier versions of the ADK to deploy Windows 10. It also supports the deployment of Windows 7, Windows 8, and Windows 8.1. Significant enhancements in the ADK for Windows 10 include new runtime provisioning capabilities, which leverage the Windows Imaging and Configuration Designer (Windows ICD), as well as updated versions of existing deployment tools (DISM, USMT, Windows PE, and more). -Microsoft Deployment Toolkit 2013 Update 1, available for download [here](http://go.microsoft.com/fwlink/p/?LinkId=625079), has also been updated to support Windows 10 and the new ADK; older versions do not support Windows 10. New in this release is task sequence support for Windows 10 in-place upgrades. +Microsoft Deployment Toolkit 2013 Update 1, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=625079), has also been updated to support Windows 10 and the new ADK; older versions do not support Windows 10. New in this release is task sequence support for Windows 10 in-place upgrades. For System Center Configuration Manager, Windows 10 support is offered with various releases: @@ -49,7 +50,7 @@ For more details about System Center Configuration Manager support for Windows  ## Management tools -In addition to System Center Configuration Manager, Windows 10 also leverages other tools for management. For Windows Server and Active Directory, existing supported versions are fully supported for Windows 10. New Group Policy templates will be needed to configure new settings available in Windows 10; these templates are available in the Windows 10 media images, and are available as a separate download [here](http://go.microsoft.com/fwlink/p/?LinkId=625081). See [Group Policy settings reference](http://go.microsoft.com/fwlink/p/?LinkId=625082) for a list of the new and modified policy settings. If you are using a central policy store, follow the steps outlined [here](http://go.microsoft.com/fwlink/p/?LinkId=625083) to update the ADMX files stored in that central store. +In addition to System Center Configuration Manager, Windows 10 also leverages other tools for management. For Windows Server and Active Directory, existing supported versions are fully supported for Windows 10. New Group Policy templates will be needed to configure new settings available in Windows 10; these templates are available in the Windows 10 media images, and are available as a separate download [here](https://go.microsoft.com/fwlink/p/?LinkId=625081). See [Group Policy settings reference](https://go.microsoft.com/fwlink/p/?LinkId=625082) for a list of the new and modified policy settings. If you are using a central policy store, follow the steps outlined [here](https://go.microsoft.com/fwlink/p/?LinkId=625083) to update the ADMX files stored in that central store. No new Active Directory schema updates or specific functional levels are currently required for core Windows 10 product functionality, although subsequent upgrades could require these to support new features. @@ -65,9 +66,9 @@ Microsoft Desktop Optimization Pack (MDOP) has been updated to support Windows    -For more information, see the [MDOP TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=625090). +For more information, see the [MDOP TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=625090). -For devices you manage with mobile device management (MDM) solutions such as Microsoft Intune, existing capabilities (provided initially in Windows 8.1) are fully supported in Windows 10; new Windows 10 MDM settings and capabilities will require updates to the MDM services. See [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=625084) for more information. +For devices you manage with mobile device management (MDM) solutions such as Microsoft Intune, existing capabilities (provided initially in Windows 8.1) are fully supported in Windows 10; new Windows 10 MDM settings and capabilities will require updates to the MDM services. See [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=625084) for more information. Windows Server Update Services (WSUS) requires some additional configuration to receive updates for Windows 10. Use the Windows Server Update Services admin tool and follow these instructions: @@ -81,7 +82,7 @@ Windows Server Update Services (WSUS) requires some additional configuration to Figure 1. WSUS product list with Windows 10 choices -Because Windows 10 updates are cumulative in nature, each month’s new update will supersede the previous month's. Consider leveraging “express installation” packages to reduce the size of the payload that needs to be sent to each PC each month; see [Express installation files](http://go.microsoft.com/fwlink/p/?LinkId=625086) for more information. (Note that this will increase the amount of disk storage needed by WSUS, and impacts all operating systems being managed with WSUS.) +Because Windows 10 updates are cumulative in nature, each month’s new update will supersede the previous month's. Consider leveraging “express installation” packages to reduce the size of the payload that needs to be sent to each PC each month; see [Express installation files](https://go.microsoft.com/fwlink/p/?LinkId=625086) for more information. (Note that this will increase the amount of disk storage needed by WSUS, and impacts all operating systems being managed with WSUS.) ## Activation @@ -91,15 +92,15 @@ Windows 10 volume license editions of Windows 10 will continue to support all | Product | Required update | |----------------------------------------|---------------------------------------------------------------------------------------------| | Windows 10 | None | -| Windows Server 2012 R2 and Windows 8.1 | [https://support.microsoft.com/kb/3058168](http://go.microsoft.com/fwlink/p/?LinkId=625087) | -| Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](http://go.microsoft.com/fwlink/p/?LinkId=625087) | +| Windows Server 2012 R2 and Windows 8.1 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | +| Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | | Windows Server 2008 R2 and Windows 7 | Available by October 2015 |   Additionally, new product keys will be needed for all types of volume license activation (KMS, MAK, and AD-based Activation); these keys are available on the Volume Licensing Service Center (VLSC) for customers with rights to the Windows 10 operating system. To find the needed keys: -- Sign into the [Volume Licensing Service Center (VLSC)](http://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. +- Sign into the [Volume Licensing Service Center (VLSC)](https://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. - For KMS keys, click **Licenses** and then select **Relationship Summary**. Click the appropriate active license ID, and then select **Product Keys** near the right side of the page. For KMS running on Windows Server, find the **Windows Srv 2012R2 DataCtr/Std KMS for Windows 10** product key; for KMS running on client operating systems, find the **Windows 10** product key. diff --git a/windows/plan/windows-10-servicing-options.md b/windows/plan/windows-10-servicing-options.md index 00418ae8ae..83af9a41f3 100644 --- a/windows/plan/windows-10-servicing-options.md +++ b/windows/plan/windows-10-servicing-options.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: servicing ms.sitesec: library -author: greg-lindsay +author: jdeckerMS --- # Windows 10 servicing overview diff --git a/windows/plan/windows-to-go-frequently-asked-questions.md b/windows/plan/windows-to-go-frequently-asked-questions.md index a9f0dfee6c..8170500400 100644 --- a/windows/plan/windows-to-go-frequently-asked-questions.md +++ b/windows/plan/windows-to-go-frequently-asked-questions.md @@ -127,7 +127,7 @@ Windows To Go can be deployed using standard Windows deployment tools like Diskp - A Windows 10 Enterprise or Windows 10 Education host PC that can be used to provision new USB keys -You can use a Windows PowerShell script to target several drives and scale your deployment for a large number of Windows To Go drives. You can also use a USB duplicator to duplicate a Windows To Go drive after it has been provisioned if you are creating a large number of drives. See the [Windows To Go Step by Step](http://go.microsoft.com/fwlink/p/?LinkId=618950) article on the TechNet wiki for a walkthrough of the drive creation process. +You can use a Windows PowerShell script to target several drives and scale your deployment for a large number of Windows To Go drives. You can also use a USB duplicator to duplicate a Windows To Go drive after it has been provisioned if you are creating a large number of drives. See the [Windows To Go Step by Step](https://go.microsoft.com/fwlink/p/?LinkId=618950) article on the TechNet wiki for a walkthrough of the drive creation process. ## Is Windows To Go supported on both USB 2.0 and USB 3.0 drives? @@ -152,7 +152,7 @@ Yes. Because USB 3.0 offers significantly faster speeds than USB 2.0, a Windows ## Can the user self-provision Windows To Go? -Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise and Windows 10 Education. Additionally, System Center 2012 Configuration Manager SP1 and later releases includes support for user self-provisioning of Windows To Go drives. Configuration Manager can be downloaded for evaluation from the [Microsoft TechNet Evaluation Center](http://go.microsoft.com/fwlink/p/?LinkID=618746). +Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise and Windows 10 Education. Additionally, System Center 2012 Configuration Manager SP1 and later releases includes support for user self-provisioning of Windows To Go drives. Configuration Manager can be downloaded for evaluation from the [Microsoft TechNet Evaluation Center](https://go.microsoft.com/fwlink/p/?LinkID=618746). ## How can Windows To Go be managed in an organization? @@ -186,7 +186,7 @@ After you have entered firmware setup, make sure that boot from USB is enabled. Alternatively, if your computer supports it, you can try to use the one-time boot menu (often F12), to select USB boot on a per-boot basis. -For more detailed instructions, see the wiki article, [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkID=618951). +For more detailed instructions, see the wiki article, [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951). **Warning**   Configuring a computer to boot from USB will cause your computer to attempt to boot from any bootable USB device connected to your computer. This potentially includes malicious devices. Users should be informed of this risk and instructed to not have any bootable USB storage devices plugged in to their computers except for their Windows To Go drive. @@ -312,7 +312,7 @@ The size constraints are the same as full Windows. To ensure that you have enoug ## Do I need to activate Windows To Go every time I roam? -No, Windows To Go requires volume activation; either using the [Key Management Service](http://go.microsoft.com/fwlink/p/?LinkId=619051) (KMS) server in your organization or using [Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=619053) based volume activation. The Windows To Go workspace will not need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or a through remote connection using DirectAccess or a virtual private network connection), once activated the machine will not need to be activated again until the activation validity interval has passed. In a KMS configuration the activation validity interval is 180 days. +No, Windows To Go requires volume activation; either using the [Key Management Service](https://go.microsoft.com/fwlink/p/?LinkId=619051) (KMS) server in your organization or using [Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=619053) based volume activation. The Windows To Go workspace will not need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or a through remote connection using DirectAccess or a virtual private network connection), once activated the machine will not need to be activated again until the activation validity interval has passed. In a KMS configuration the activation validity interval is 180 days. ## Can I use all Windows features on Windows To Go? @@ -346,12 +346,12 @@ Yes. You can use a combination of identifiers to determine if the currently runn Next, check if the **OperatingSystemSKU** property is equal to **4** (for Windows 10 Enterprise) or **121** (for Windows 10 Education). The combination of those two properties represents a Windows To Go workspace environment. -For more information, see the MSDN article on the [Win32\_OperatingSystem class](http://go.microsoft.com/fwlink/p/?LinkId=619059). +For more information, see the MSDN article on the [Win32\_OperatingSystem class](https://go.microsoft.com/fwlink/p/?LinkId=619059). ## How is Windows To Go licensed? -Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](http://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. +Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. ## Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive? @@ -383,7 +383,7 @@ You can reset the BitLocker system measurements to incorporate the new boot orde A message is displayed, informing you that your data will not be protected while BitLocker is suspended and asking if you want to suspend BitLocker Drive Encryption. Click **Yes** to continue and suspend BitLocker on the drive. -4. Restart the computer and enter the firmware settings to reset the boot order to boot from USB first. For more information on changing the boot order in the BIOS, see [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkId=618951) on the TechNet wiki. +4. Restart the computer and enter the firmware settings to reset the boot order to boot from USB first. For more information on changing the boot order in the BIOS, see [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) on the TechNet wiki. 5. Restart the computer again and then log on to the host computer using an account with administrator privileges. (Neither your Windows To Go drive nor any other USB drive should be inserted.) @@ -410,7 +410,7 @@ Reformatting the drive erases the data on the drive, but doesn’t reconfigure t   -2. Start the [diskpart](http://go.microsoft.com/fwlink/p/?LinkId=619070) command interpreter, by typing `diskpart` at the command prompt. +2. Start the [diskpart](https://go.microsoft.com/fwlink/p/?LinkId=619070) command interpreter, by typing `diskpart` at the command prompt. 3. Use the `select disk` command to identify the drive. If you do not know the drive number, use the `list` command to display the list of disks available. @@ -433,9 +433,9 @@ There is no support in Windows for upgrading a Windows To Go drive. Deployed Win ## Additional resources -- [Windows 10 forums](http://go.microsoft.com/fwlink/p/?LinkId=618949) +- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) -- [Windows To Go Step by Step Wiki](http://go.microsoft.com/fwlink/p/?LinkId=618950) +- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) - [Windows To Go: feature overview](windows-to-go-overview.md) diff --git a/windows/plan/windows-to-go-overview.md b/windows/plan/windows-to-go-overview.md index f00dfb55ea..4b1d981e94 100644 --- a/windows/plan/windows-to-go-overview.md +++ b/windows/plan/windows-to-go-overview.md @@ -19,7 +19,7 @@ author: mtniehaus Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. -PCs that meet the Windows 7 or later [certification requirements](http://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: +PCs that meet the Windows 7 or later [certification requirements](https://go.microsoft.com/fwlink/p/?LinkId=618711) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go is not intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some additional considerations that you should keep in mind before you start to use Windows To Go: - [Differences between Windows To Go and a typical installation of Windows](#bkmk-wtgdif) @@ -63,7 +63,7 @@ The applications that you want to use from the Windows To Go workspace should be Enterprises install Windows on a large group of computers either by using configuration management software (such as System Center Configuration Manager), or by using standard Windows deployment tools such as DiskPart and the Deployment Image Servicing and Management (DISM) tool. -These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](http://go.microsoft.com/fwlink/p/?LinkId=526803) to review deployment tools available. +These same tools can be used to provision Windows To Go drive, just as you would if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) to review deployment tools available. **Important**   Make sure you use the versions of the deployment tools provided for the version of Windows you are deploying. There have been many enhancements made to support Windows To Go. Using versions of the deployment tools released for earlier versions of Windows to provision a Windows To Go drive is not supported. @@ -104,26 +104,26 @@ Using a USB drive that has not been certified is not supported   -- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](http://go.microsoft.com/fwlink/p/?LinkId=618714)) +- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://go.microsoft.com/fwlink/p/?LinkId=618714)) -- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](http://go.microsoft.com/fwlink/p/?LinkId=618717)) +- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://go.microsoft.com/fwlink/p/?LinkId=618717)) -- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](http://go.microsoft.com/fwlink/p/?LinkId=618718)) +- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://go.microsoft.com/fwlink/p/?LinkId=618718)) -- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](http://go.microsoft.com/fwlink/p/?LinkId=618719)) +- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) -- Spyrus Portable Workplace ([http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) We recommend that you run the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Portable Workplace. -- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) **Important**   - You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720). + You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go please refer to [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720).   -- Spyrus Worksafe ([http://www.spyruswtg.com/](http://go.microsoft.com/fwlink/p/?LinkId=618720)) +- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) **Tip**   This device contains an embedded smart card. @@ -136,11 +136,11 @@ Using a USB drive that has not been certified is not supported Super Talent Express RC8 for Windows To Go - ([http://www.supertalent.com/wtg/](http://go.microsoft.com/fwlink/p/?LinkId=618721)) + ([http://www.supertalent.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618721)) -- Western Digital My Passport Enterprise ([http://www.wd.com/wtg](http://go.microsoft.com/fwlink/p/?LinkId=618722)) +- Western Digital My Passport Enterprise ([http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722)) - We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go.  For more information about the WD Compass utility please refer to [http://www.wd.com/wtg](http://go.microsoft.com/fwlink/p/?LinkId=618722) + We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go.  For more information about the WD Compass utility please refer to [http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722) **For host computers** @@ -249,16 +249,16 @@ In addition to the USB boot support in the BIOS, the Windows 10 image on your W ## Additional resources -- [Windows 10 forums](http://go.microsoft.com/fwlink/p/?LinkId=618949) +- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) -- [Windows To Go Step by Step Wiki](http://go.microsoft.com/fwlink/p/?LinkId=618950) +- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950) -- [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkId=618951) +- [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) ## Related topics -- [Deploy Windows To Go in your organization](http://go.microsoft.com/fwlink/p/?LinkId=619975) +- [Deploy Windows To Go in your organization](https://go.microsoft.com/fwlink/p/?LinkId=619975) - [Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md) diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index 67c4200203..93dcee04ac 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing; devices -author: TrudyHa +author: jdeckerMS --- # Windows Update for Business @@ -19,12 +19,12 @@ Get an overview of how you can implement and deploy a Windows Update for Busines ## Introduction -Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. By using [Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. -- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=699281). +- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281). -Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://go.microsoft.com/fwlink/p/?LinkId=734043) and [System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=734044). +Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](https://go.microsoft.com/fwlink/p/?LinkId=734043) and [System Center Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=734044). ## Deploy Windows Update for Business in your organization diff --git a/windows/whats-new/applocker.md b/windows/whats-new/applocker.md index 3cfd7a6582..2e082cd98c 100644 --- a/windows/whats-new/applocker.md +++ b/windows/whats-new/applocker.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft -redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in AppLocker? diff --git a/windows/whats-new/bitlocker.md b/windows/whats-new/bitlocker.md index 6db25cd066..9f0df242bf 100644 --- a/windows/whats-new/bitlocker.md +++ b/windows/whats-new/bitlocker.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security, mobile author: brianlic-msft -redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in BitLocker? diff --git a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md index 750a878d7d..a38cbf4702 100644 --- a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md +++ b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: TrudyHa +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/whats-new/index --- # Change history for What's new in Windows 10 diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md new file mode 100644 index 0000000000..9b385aa076 --- /dev/null +++ b/windows/whats-new/contribute-to-a-topic.md @@ -0,0 +1,71 @@ +--- +title: Edit an existing topic using the Contribute link +description: Instructions about how to edit an existing topic by using the Contribute link. +keywords: contribute, edit a topic +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +--- + +# Edit an existing topic using the Contribute link +You can now make suggestions and update existing, public content with a GitHub account and a simple click of a link. + +>**Note**
    +>At this time, only the English (en-us) content is available for editing. + +**To edit a topic** + +1. All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before contributing to any Microsoft repositories. +If you've already contributed to Microsoft repositories in the past, congratulations! +You've already completed this step. + +2. Go to the page on TechNet that you want to update, and then click **Contribute**. + + ![GitHub Web, showing the Contribute link](images/contribute-link.png) + +3. Log into (or sign up for) a GitHub account. + + You must have a GitHub account to get to the page that lets you edit a topic. + +4. Click the **Pencil** icon (in the red box) to edit the content. + + ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + +5. Using markdown language, make your changes to the topic. For info about how to edit content using markdown, see: + - **If you're linked to the Microsoft organization in GitHub:** [Windows Open Publishing Guide Home](http://aka.ms/windows-op-guide) + + - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) + +6. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. + + ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + +7. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. + + ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + + The **Comparing changes** screen appears to see what the changes are between your fork and the original content. + +8. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. + + If there are no problems, you’ll see the message, **Able to merge**. + + ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + +9. Click **Create pull request**. + +10. Enter a title and description to give the approver the appropriate context about what’s in the request. + +11. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. + +12. Click **Create pull request** again to actually submit the pull request. + + The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places: + + - [Windows 10](https://technet.microsoft.com/itpro/windows) + - [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) + - [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) + - [Surface](https://technet.microsoft.com/itpro/surface) + - [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) + - [Windows 10 for Education](https://technet.microsoft.com/edu/windows) + - [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) \ No newline at end of file diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index 4009a8845d..e42271af40 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft -redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/whats-new-windows-10-version-1507-and-1511 +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # Device Guard overview @@ -26,7 +26,7 @@ For details on how to implement Device Guard, see [Device Guard deployment guide ## Why use Device Guard With thousands of new malicious files created every day, using traditional methods like signature-based detection to fight against malware provides an inadequate defense against new attacks. Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an antivirus or other security solutions, to a mode where the operating system trusts only apps authorized by your enterprise. -Device Guard also helps protect against [zero day attacks](http://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](http://go.microsoft.com/fwlink/p/?LinkId=534210). +Device Guard also helps protect against [zero day attacks](https://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](https://go.microsoft.com/fwlink/p/?LinkId=534210). ## Virtualization-based security using Windows 10 Enterprise Hypervisor Windows 10 Enterprise Hypervisor introduces new capabilities around virtual trust levels, which helps Windows 10 Enterprise services to run in a protected environment, in isolation from the running operating system. Windows 10 Enterprise virtualization-based security helps protect kernel code integrity and helps to provide credential isolation for the local security authority (LSA). Letting the Kernel Code Integrity service run as a hypervisor-hosted service increases the level of protection around the root operating system, adding additional protections against any malware that compromises the kernel layer. diff --git a/windows/whats-new/images/compare-changes.png b/windows/whats-new/images/compare-changes.png new file mode 100644 index 0000000000..0d86db70f5 Binary files /dev/null and b/windows/whats-new/images/compare-changes.png differ diff --git a/windows/whats-new/images/contribute-link.png b/windows/whats-new/images/contribute-link.png new file mode 100644 index 0000000000..6b17e6dd56 Binary files /dev/null and b/windows/whats-new/images/contribute-link.png differ diff --git a/windows/whats-new/images/pencil-icon.png b/windows/whats-new/images/pencil-icon.png new file mode 100644 index 0000000000..82fe7852dd Binary files /dev/null and b/windows/whats-new/images/pencil-icon.png differ diff --git a/windows/whats-new/images/preview-changes.png b/windows/whats-new/images/preview-changes.png new file mode 100644 index 0000000000..f98b2c6443 Binary files /dev/null and b/windows/whats-new/images/preview-changes.png differ diff --git a/windows/whats-new/images/propose-file-change.png b/windows/whats-new/images/propose-file-change.png new file mode 100644 index 0000000000..aedbc07b16 Binary files /dev/null and b/windows/whats-new/images/propose-file-change.png differ diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index a49967a2c0..ff170bce3b 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -2,7 +2,7 @@ title: What's new in Windows 10 (Windows 10) description: Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Microsoft Passport, Device Guard, and more. ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 -keywords: ["What's new in Windows 10", "Windows 10", "anniversary update"] +keywords: ["What's new in Windows 10", "Windows 10", "anniversary update", "contribute", "edit topic"] ms.prod: w10 author: TrudyHa localizationpriority: high @@ -19,16 +19,15 @@ Windows 10 provides IT professionals with advanced protection against modern sec - [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) - -  +- [Edit an existing topic using the Contribute link](contribute-to-a-topic.md) ## Learn more - [Windows 10 roadmap](https://www.microsoft.com/en-us/WindowsForBusiness/windows-roadmap) - [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info) - [Windows 10 update history](https://support.microsoft.com/en-us/help/12387/windows-10-update-history) -- [Windows 10 content from Microsoft Ignite](http://go.microsoft.com/fwlink/p/?LinkId=613210) -- [Compare Windows 10 Editions](http://go.microsoft.com/fwlink/p/?LinkId=690485) +- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210) +- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485) diff --git a/windows/whats-new/security-auditing.md b/windows/whats-new/security-auditing.md index 8890adb735..8683fc520d 100644 --- a/windows/whats-new/security-auditing.md +++ b/windows/whats-new/security-auditing.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft ms.pagetype: security, mobile -redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/security-auditing-overview +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in security auditing? @@ -21,7 +21,7 @@ Security auditing is one of the most powerful tools that you can use to maintain ## New features in Windows 10, version 1511 -- The [WindowsSecurityAuditing](http://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](http://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. +- The [WindowsSecurityAuditing](https://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](https://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. ## New features in Windows 10 diff --git a/windows/whats-new/security.md b/windows/whats-new/security.md index ae44b5893e..f2d45edd95 100644 --- a/windows/whats-new/security.md +++ b/windows/whats-new/security.md @@ -190,8 +190,8 @@ Table 1. Windows 10 hardware requirements In this table, **R** stands for *recommended*, **Y** means that the hardware component is *required* for that Windows 10 feature, and **N** means that the hardware component is *not used* with that Windows 10 feature.   ## Related topics -[Windows 10 Specifications](http://go.microsoft.com/fwlink/p/?LinkId=717550) -[Making Windows 10 More Personal and More Secure with Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=717551) +[Windows 10 Specifications](https://go.microsoft.com/fwlink/p/?LinkId=717550) +[Making Windows 10 More Personal and More Secure with Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=717551) [Protect BitLocker from pre-boot attacks](../keep-secure/protect-bitlocker-from-pre-boot-attacks.md) [BitLocker Countermeasures](../keep-secure/bitlocker-countermeasures.md) [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md) diff --git a/windows/whats-new/user-account-control.md b/windows/whats-new/user-account-control.md index 3d41d3ca1d..4a670324d3 100644 --- a/windows/whats-new/user-account-control.md +++ b/windows/whats-new/user-account-control.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: brianlic-msft -redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/user-account-control-overview +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in User Account Control? diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 1e0c6c19dd..4dcad74254 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -70,7 +70,7 @@ With Windows 10, you can create provisioning packages that let you quickly and e ### Easier certificate management -For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](~/keep-secure/installing-digital-certificates-on-windows-10-mobile.md) +For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](~/keep-secure/installing-digital-certificates-on-windows-10-mobile.md) ### Microsoft Passport @@ -82,7 +82,7 @@ Microsoft Passport lets users authenticate to a Microsoft account, an Active Dir #### New Security auditing features in Windows 10, version 1511 -- The [WindowsSecurityAuditing](http://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](http://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. +- The [WindowsSecurityAuditing](https://go.microsoft.com/fwlink/p/?LinkId=690517) and [Reporting](https://go.microsoft.com/fwlink/p/?LinkId=690525) configuration service providers allow you to add security audit policies to mobile devices. #### New features in Windows 10, version 1507 @@ -249,9 +249,9 @@ Windows 10 provides mobile device management (MDM) capabilities for PCs, laptop MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Windows Store, VPN configuration, and more. -MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](http://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. +MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. -Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=533172) +Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=533172) ### Unenrollment @@ -272,7 +272,7 @@ Enterprises have the following identity and management choices. | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |  > **Note**   -With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](http://go.microsoft.com/fwlink/p/?LinkID=613512). +With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512).   ### Device lockdown @@ -310,13 +310,13 @@ For more information, see [Windows Store for Business overview](../manage/window Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. -By using [Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. -- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=699281). +- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281). Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](http://technet.microsoft.com/library/gg682129.aspx). @@ -334,7 +334,7 @@ Microsoft Edge takes you beyond just browsing to actively engaging with the web - **Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls. ### Enterprise guidance -Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](http://go.microsoft.com/fwlink/p/?linkid=290956). +Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Windows Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10. diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index 5d509f5ee2..7eb664abab 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -50,6 +50,15 @@ The Upgrade Analytics workflow steps you through the discovery and rationalizati [Learn more about planning and managing Windows upgrades with Windows Upgrade Analytics.](../deploy/manage-windows-upgrades-with-upgrade-analytics.md) +## Windows updates + +Windows 10, version 1607, provides administrators with increased control over updates by changing the update deferral increment from weeks to days. Other changes: + +- Quality Updates can be deferred up to 30 days and paused for 35 days +- Feature Updates can be deferred up to 180 days and paused for 60 days +- Update deferrals can be applied to both Current Branch (CB) and Current Branch for Business (CBB) +- Drivers can be excluded from udpates + ## Security ### Credential Guard and Device Guard diff --git a/windows/whats-new/windows-update-for-business.md b/windows/whats-new/windows-update-for-business.md index 524ca03a0a..4b69cf6ecd 100644 --- a/windows/whats-new/windows-update-for-business.md +++ b/windows/whats-new/windows-update-for-business.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: TrudyHa -redirect_url: /whats-new/whats-new-windows-10-version-1507-and-1511 +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in Windows Update for Business? @@ -21,13 +21,13 @@ Windows Update for Business enables information technology administrators to kee ## Benefits of Windows Update for Business -By using [Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth very efficient. -- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=699281). +- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281). Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](http://technet.microsoft.com/library/gg682129.aspx).