From f05397645cda3fdd71b9f77406c164167fe23ca6 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 2 Aug 2016 09:11:45 -0700 Subject: [PATCH 001/421] Updated --- windows/manage/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/index.md b/windows/manage/index.md index eba6dd0e9c..0a97df90fe 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -30,7 +30,7 @@ Learn about managing and updating Windows 10.

[Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)

-

The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.

+

The world’s first personal digital assistant helps get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.

[Manage corporate devices](manage-corporate-devices.md)

From ac72787183a5a5d850605af46c3de41047737471 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 2 Aug 2016 10:46:25 -0700 Subject: [PATCH 002/421] Fixed redirect link --- windows/whats-new/windows-update-for-business.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-update-for-business.md b/windows/whats-new/windows-update-for-business.md index 524ca03a0a..8b98b0496a 100644 --- a/windows/whats-new/windows-update-for-business.md +++ b/windows/whats-new/windows-update-for-business.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: TrudyHa -redirect_url: /whats-new/whats-new-windows-10-version-1507-and-1511 +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # What's new in Windows Update for Business? From f23793d212be148d029d02585dcf90d14ca71d97 Mon Sep 17 00:00:00 2001 From: saldana Date: Tue, 2 Aug 2016 23:20:40 +0000 Subject: [PATCH 003/421] Initialize open publishing repository: https://github.com/Microsoft/win-cpub-itpro-docs of branch live --- .openpublishing.publish.config.json | 183 ++++++++++++++++------------ education/TOC.md | 1 + education/index.md | 1 + itpro/hololens/TOC.md | 1 + itpro/hololens/docfx.json | 37 ++++++ itpro/hololens/index.md | 1 + 6 files changed, 147 insertions(+), 77 deletions(-) create mode 100644 education/TOC.md create mode 100644 education/index.md create mode 100644 itpro/hololens/TOC.md create mode 100644 itpro/hololens/docfx.json create mode 100644 itpro/hololens/index.md diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 469c22cfdc..ea19d92084 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -1,78 +1,107 @@ { - "build_entry_point": "", - "git_repository_url_open_to_public_contributors": "", - "docsets_to_publish": [ - { - "docset_name": "microsoft-edge", - "build_output_subfolder": "browsers/edge", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "internet-explorer", - "build_output_subfolder": "browsers/internet-explorer", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "windows", - "build_output_subfolder": "windows", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "surface", - "build_output_subfolder": "devices/surface", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "surface-hub", - "build_output_subfolder": "devices/surface-hub", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "mdop", - "build_output_subfolder": "mdop", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - }, - { - "docset_name": "education", - "build_output_subfolder": "education", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": "false", - "type_mapping": { - "Conceptual": "Content" - } - } - ], - "notification_subscribers": ["brianlic@microsoft.com"], - "branches_to_filter": [""] -} + "build_entry_point": "", + "need_generate_pdf": false, + "need_generate_intellisense": false, + "docsets_to_publish": [ + { + "docset_name": "education", + "build_source_folder": "education", + "build_output_subfolder": "education", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "internet-explorer", + "build_source_folder": "browsers/internet-explorer", + "build_output_subfolder": "browsers/internet-explorer", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "mdop", + "build_source_folder": "mdop", + "build_output_subfolder": "mdop", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "microsoft-edge", + "build_source_folder": "browsers/edge", + "build_output_subfolder": "browsers/edge", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "surface", + "build_source_folder": "devices/surface", + "build_output_subfolder": "devices/surface", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "surface-hub", + "build_source_folder": "devices/surface-hub", + "build_output_subfolder": "devices/surface-hub", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "windows", + "build_source_folder": "windows", + "build_output_subfolder": "windows", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content" + } + }, + { + "docset_name": "itpro-hololens", + "build_source_folder": "itpro/hololens", + "build_output_subfolder": "itpro-hololens", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "op" + } + ], + "notification_subscribers": [ + "brianlic@microsoft.com" + ], + "branches_to_filter": [ + "" + ], + "git_repository_url_open_to_public_contributors": "", + "skip_source_output_uploading": false, + "dependent_repositories": [] +} \ No newline at end of file diff --git a/education/TOC.md b/education/TOC.md new file mode 100644 index 0000000000..06913f7aef --- /dev/null +++ b/education/TOC.md @@ -0,0 +1 @@ +# [Index](index.md) \ No newline at end of file diff --git a/education/index.md b/education/index.md new file mode 100644 index 0000000000..beccdc8994 --- /dev/null +++ b/education/index.md @@ -0,0 +1 @@ +# Index test file for Open Publishing \ No newline at end of file diff --git a/itpro/hololens/TOC.md b/itpro/hololens/TOC.md new file mode 100644 index 0000000000..06913f7aef --- /dev/null +++ b/itpro/hololens/TOC.md @@ -0,0 +1 @@ +# [Index](index.md) \ No newline at end of file diff --git a/itpro/hololens/docfx.json b/itpro/hololens/docfx.json new file mode 100644 index 0000000000..24fe1da56d --- /dev/null +++ b/itpro/hololens/docfx.json @@ -0,0 +1,37 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md" + ], + "exclude": [ + "**/obj/**", + "itpro-hololens/**", + "**/includes/**" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "itpro-hololens/**", + "**/includes/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": {}, + "fileMetadata": {}, + "template": [ + null + ], + "dest": "itpro-hololens" + } +} \ No newline at end of file diff --git a/itpro/hololens/index.md b/itpro/hololens/index.md new file mode 100644 index 0000000000..beccdc8994 --- /dev/null +++ b/itpro/hololens/index.md @@ -0,0 +1 @@ +# Index test file for Open Publishing \ No newline at end of file From cf23ca14787eea774681a977abd02f02bba98b19 Mon Sep 17 00:00:00 2001 From: saldana Date: Tue, 2 Aug 2016 23:50:11 +0000 Subject: [PATCH 004/421] Initialize open publishing repository: https://github.com/Microsoft/win-cpub-itpro-docs of branch live --- .openpublishing.publish.config.json | 28 +++++++++++----------- itpro-hololens/TOC.md | 1 + itpro-hololens/docfx.json | 37 +++++++++++++++++++++++++++++ itpro-hololens/index.md | 1 + 4 files changed, 53 insertions(+), 14 deletions(-) create mode 100644 itpro-hololens/TOC.md create mode 100644 itpro-hololens/docfx.json create mode 100644 itpro-hololens/index.md diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index ea19d92084..ec7f86cf0e 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -25,6 +25,20 @@ "Conceptual": "Content" } }, + { + "docset_name": "itpro-hololens", + "build_source_folder": "itpro-hololens", + "build_output_subfolder": "itpro-hololens", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "op" + }, { "docset_name": "mdop", "build_source_folder": "mdop", @@ -79,20 +93,6 @@ "type_mapping": { "Conceptual": "Content" } - }, - { - "docset_name": "itpro-hololens", - "build_source_folder": "itpro/hololens", - "build_output_subfolder": "itpro-hololens", - "locale": "en-us", - "version": 0, - "open_to_public_contributors": false, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "op" } ], "notification_subscribers": [ diff --git a/itpro-hololens/TOC.md b/itpro-hololens/TOC.md new file mode 100644 index 0000000000..06913f7aef --- /dev/null +++ b/itpro-hololens/TOC.md @@ -0,0 +1 @@ +# [Index](index.md) \ No newline at end of file diff --git a/itpro-hololens/docfx.json b/itpro-hololens/docfx.json new file mode 100644 index 0000000000..24fe1da56d --- /dev/null +++ b/itpro-hololens/docfx.json @@ -0,0 +1,37 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md" + ], + "exclude": [ + "**/obj/**", + "itpro-hololens/**", + "**/includes/**" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "itpro-hololens/**", + "**/includes/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": {}, + "fileMetadata": {}, + "template": [ + null + ], + "dest": "itpro-hololens" + } +} \ No newline at end of file diff --git a/itpro-hololens/index.md b/itpro-hololens/index.md new file mode 100644 index 0000000000..beccdc8994 --- /dev/null +++ b/itpro-hololens/index.md @@ -0,0 +1 @@ +# Index test file for Open Publishing \ No newline at end of file From 9192267ec9daeb8775c0045191d2433308016788 Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 16:50:29 +0000 Subject: [PATCH 005/421] Initialize open publishing repository: https://github.com/Microsoft/win-cpub-itpro-docs of branch live --- .openpublishing.publish.config.json | 2 +- devices/hololens/TOC.md | 1 + devices/hololens/docfx.json | 37 +++++++++++++++++++++++++++++ devices/hololens/index.md | 1 + 4 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 devices/hololens/TOC.md create mode 100644 devices/hololens/docfx.json create mode 100644 devices/hololens/index.md diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index ec7f86cf0e..0e0a061c84 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -27,7 +27,7 @@ }, { "docset_name": "itpro-hololens", - "build_source_folder": "itpro-hololens", + "build_source_folder": "devices/hololens", "build_output_subfolder": "itpro-hololens", "locale": "en-us", "version": 0, diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md new file mode 100644 index 0000000000..06913f7aef --- /dev/null +++ b/devices/hololens/TOC.md @@ -0,0 +1 @@ +# [Index](index.md) \ No newline at end of file diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json new file mode 100644 index 0000000000..24fe1da56d --- /dev/null +++ b/devices/hololens/docfx.json @@ -0,0 +1,37 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md" + ], + "exclude": [ + "**/obj/**", + "itpro-hololens/**", + "**/includes/**" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "itpro-hololens/**", + "**/includes/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": {}, + "fileMetadata": {}, + "template": [ + null + ], + "dest": "itpro-hololens" + } +} \ No newline at end of file diff --git a/devices/hololens/index.md b/devices/hololens/index.md new file mode 100644 index 0000000000..beccdc8994 --- /dev/null +++ b/devices/hololens/index.md @@ -0,0 +1 @@ +# Index test file for Open Publishing \ No newline at end of file From 9d2bbc869b156fb4ec7f7d25ed3208f712bbb99d Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 09:52:31 -0700 Subject: [PATCH 006/421] Delete TOC.md --- itpro-hololens/TOC.md | 1 - 1 file changed, 1 deletion(-) delete mode 100644 itpro-hololens/TOC.md diff --git a/itpro-hololens/TOC.md b/itpro-hololens/TOC.md deleted file mode 100644 index 06913f7aef..0000000000 --- a/itpro-hololens/TOC.md +++ /dev/null @@ -1 +0,0 @@ -# [Index](index.md) \ No newline at end of file From ae2ffe16a89469744feb20f6994c4bfc517c42a3 Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 09:52:36 -0700 Subject: [PATCH 007/421] Delete docfx.json --- itpro-hololens/docfx.json | 37 ------------------------------------- 1 file changed, 37 deletions(-) delete mode 100644 itpro-hololens/docfx.json diff --git a/itpro-hololens/docfx.json b/itpro-hololens/docfx.json deleted file mode 100644 index 24fe1da56d..0000000000 --- a/itpro-hololens/docfx.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md" - ], - "exclude": [ - "**/obj/**", - "itpro-hololens/**", - "**/includes/**" - ] - } - ], - "resource": [ - { - "files": [ - "**/*.png", - "**/*.jpg" - ], - "exclude": [ - "**/obj/**", - "itpro-hololens/**", - "**/includes/**" - ] - } - ], - "overwrite": [], - "externalReference": [], - "globalMetadata": {}, - "fileMetadata": {}, - "template": [ - null - ], - "dest": "itpro-hololens" - } -} \ No newline at end of file From d77f3f6da34e4609cf30dbfe6ba62fe529987e44 Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 09:52:52 -0700 Subject: [PATCH 008/421] Delete index.md --- itpro-hololens/index.md | 1 - 1 file changed, 1 deletion(-) delete mode 100644 itpro-hololens/index.md diff --git a/itpro-hololens/index.md b/itpro-hololens/index.md deleted file mode 100644 index beccdc8994..0000000000 --- a/itpro-hololens/index.md +++ /dev/null @@ -1 +0,0 @@ -# Index test file for Open Publishing \ No newline at end of file From bdcace964b6f9a234b013ae47b30bc54d2e256a5 Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 09:54:02 -0700 Subject: [PATCH 009/421] Delete TOC.md --- itpro/hololens/TOC.md | 1 - 1 file changed, 1 deletion(-) delete mode 100644 itpro/hololens/TOC.md diff --git a/itpro/hololens/TOC.md b/itpro/hololens/TOC.md deleted file mode 100644 index 06913f7aef..0000000000 --- a/itpro/hololens/TOC.md +++ /dev/null @@ -1 +0,0 @@ -# [Index](index.md) \ No newline at end of file From 1e12fbef54ecaf29e24fee927c1caa50563daa76 Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 09:54:07 -0700 Subject: [PATCH 010/421] Delete docfx.json --- itpro/hololens/docfx.json | 37 ------------------------------------- 1 file changed, 37 deletions(-) delete mode 100644 itpro/hololens/docfx.json diff --git a/itpro/hololens/docfx.json b/itpro/hololens/docfx.json deleted file mode 100644 index 24fe1da56d..0000000000 --- a/itpro/hololens/docfx.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md" - ], - "exclude": [ - "**/obj/**", - "itpro-hololens/**", - "**/includes/**" - ] - } - ], - "resource": [ - { - "files": [ - "**/*.png", - "**/*.jpg" - ], - "exclude": [ - "**/obj/**", - "itpro-hololens/**", - "**/includes/**" - ] - } - ], - "overwrite": [], - "externalReference": [], - "globalMetadata": {}, - "fileMetadata": {}, - "template": [ - null - ], - "dest": "itpro-hololens" - } -} \ No newline at end of file From bc028b5feddfbc2bc8ae1e1ac000e05d68f15a9d Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 09:54:12 -0700 Subject: [PATCH 011/421] Delete index.md --- itpro/hololens/index.md | 1 - 1 file changed, 1 deletion(-) delete mode 100644 itpro/hololens/index.md diff --git a/itpro/hololens/index.md b/itpro/hololens/index.md deleted file mode 100644 index beccdc8994..0000000000 --- a/itpro/hololens/index.md +++ /dev/null @@ -1 +0,0 @@ -# Index test file for Open Publishing \ No newline at end of file From 8d59e2481aad54df31b16518c5f9f8198517cad5 Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 09:54:47 -0700 Subject: [PATCH 012/421] Update .openpublishing.publish.config.json --- .openpublishing.publish.config.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 0e0a061c84..2358d61c40 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -28,7 +28,7 @@ { "docset_name": "itpro-hololens", "build_source_folder": "devices/hololens", - "build_output_subfolder": "itpro-hololens", + "build_output_subfolder": "devices/hololens", "locale": "en-us", "version": 0, "open_to_public_contributors": false, @@ -104,4 +104,4 @@ "git_repository_url_open_to_public_contributors": "", "skip_source_output_uploading": false, "dependent_repositories": [] -} \ No newline at end of file +} From 507f4139319ff1866c9e92ff971f9288e7e4e5bb Mon Sep 17 00:00:00 2001 From: saldana Date: Wed, 3 Aug 2016 10:03:54 -0700 Subject: [PATCH 013/421] Update docfx.json --- devices/hololens/docfx.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index 24fe1da56d..c6dc9e418d 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -7,7 +7,7 @@ ], "exclude": [ "**/obj/**", - "itpro-hololens/**", + "devices/hololens/**", "**/includes/**" ] } @@ -20,7 +20,7 @@ ], "exclude": [ "**/obj/**", - "itpro-hololens/**", + "devices/hololens/**", "**/includes/**" ] } @@ -32,6 +32,6 @@ "template": [ null ], - "dest": "itpro-hololens" + "dest": "devices/hololens" } -} \ No newline at end of file +} From 2b769f55af4939871b7289a15583c0171bc4970f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 3 Aug 2016 11:23:31 -0700 Subject: [PATCH 014/421] Fixed broken table --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index c8012d34ec..953959ba8d 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -13,7 +13,9 @@ author: brianlic-msft This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). ## August 2016 -- [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |New | +|New or changed topic | Description | +|----------------------|-------------| +|[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |New | ## RELEASE: Windows 10, version 1607 From 1dcee2fa8823bcd86ed70904041e31a601883543 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 4 Aug 2016 09:43:51 -0700 Subject: [PATCH 015/421] Windows 10 Mobile, version 1607 updates --- .../windows-10-mobile-security-guide.md | 541 ++--- windows/manage/windows-10-mobile-and-mdm.md | 2001 ++++++++--------- 2 files changed, 1069 insertions(+), 1473 deletions(-) diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index 0cb9c52700..4f36cf04e5 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -1,6 +1,6 @@ --- title: Windows 10 Mobile security guide (Windows 10) -description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. +description: This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. ms.assetid: D51EF508-699E-4A68-A7CD-91D821A97205 keywords: data protection, encryption, malware resistance, smartphone, device, Windows Store ms.prod: w10 @@ -9,246 +9,158 @@ ms.sitesec: library ms.pagetype: security, mobile author: AMeeus --- - # Windows 10 Mobile security guide -**Applies to** -- Windows 10 Mobile +*Applies to Windows 10 Mobile, version 1511 and Windows Mobile, version 1607* -This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. +>This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. -## Overview +Smartphones now serve as a primary productivity tool for business workers and, just like desktops or laptops, need to be secured against malware and data theft. Protecting these devices can be challenging due to the wide range of device operating systems and configurations and the fact that many employees use their own personal devices. IT needs to secure corporate assets on every device, but also ensure the privacy of the user’s personal apps and data. +Windows 10 Mobile addresses these security concerns directly, whether workers are using personal or corporate-owned devices. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. These technologies include: +- **Windows Hello for Business** Enhanced identity and access control features ensure that only authorized users can access corporate data and resources. Windows Hello simplifies multifactor authentication (MFA) deployment and use, offering PIN, companion device, and biometric authentication methods. +- **Windows Information Protection** Automatic data separation keeps corporate information from being shared with personal data and apps. +- **Malware resistance** Multi-layered protections built into the device hardware, startup processes, and app platform help reduce the threat of malware that can compromise employee devices. -Windows 10 Mobile is specifically designed for smartphones and small tablets. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. Several broad categories of security work went into Windows 10 Mobile: +This guide helps IT administrators better understand the security features in Windows 10 Mobile, which can be used to improve protection against unauthorized access, data leakage, and malware. -- **Identity and access control.** Microsoft has greatly enhanced identity and access control features to simplify and improve the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). (Windows Hello requires either a specialized illuminated infrared \[IR\] camera for facial recognition and iris detection or a finger print reader that supports the Windows Biometric Framework.) -- **Data protection.** Confidential data is better protected from compromise than ever before. Windows 10 Mobile uses several data-protection technologies and delivers them in a user-friendly and IT-manageable way. -- **Malware resistance.**Windows 10 Mobile helps protect critical system resources and apps to reduce the threat of malware, including support for enterprise-grade secure hardware and Secure Boot. -- **App platform security.** The Windows 10 Mobile enterprise-grade secure app platform provides multiple layers of security. For example, Windows Store checks all apps for malware to help prevent malware from reaching devices. +**In this article:** +- Windows Hello for Business +- Windows Information Protection +- Malware resistance -In addition, AppContainer application isolation helps prevent any malicious app from compromising other apps. +## Windows Hello -This guide explains each of these technologies and how they help protect your Windows 10 Mobile devices. +Windows 10 Mobile includes Windows Hello, a simple, yet powerful, multifactor authentication solution that confirms a user’s identity before allowing access to corporate confidential information and resources. Multifactor authentication is a more secure alternative to password-based device security. Users dislike having to enter long, complex passwords – particularly on a mobile device touch screen – that corporate policy requires they change frequently. This leads to poor security practices like password reuse, written down passwords, or weak password creation. -## Identity and access control +Windows Hello offers a simple, cost-effective way to deploy multifactor authentication across your organization. Unlike smart cards, it does not require public key infrastructure or the implementation of additional hardware. Workers use a PIN, a companion device (like Microsoft Band), or biometrics to validate their identity for accessing corporate resources on their Azure Active Directory (Azure AD) registered Windows 10 Mobile device. -A fundamental component of security is the notion that a user has a unique identity and that that identity is either allowed or denied access to resources. This notion is traditionally known as access control, which has three parts: -- **Identification.** The user (subject) asserts a unique identity to the computer system for the purpose of accessing a resource (object), such as a file or an app. -- **Authentication.** Authentication is the process of proving the asserted identity and verifying that the subject is indeed the subject. -- **Authorization.** The system compares the authenticated subject’s access rights against the object’s permissions and either allows or denies the requested access. +Because Windows Hello is supported across all Windows 10 devices, organizations can uniformly implement multifactor authentication across their environment. Deploying Windows Hello on Windows 10 Mobile devices does require Azure AD (sold separately), but you can use Azure AD Connect to synchronize with your on-premises Active Directory services. -The way an operating system implements these components makes a difference in preventing attackers from accessing corporate data. Only users who prove their identities and are authorized to access that data can access it. In security, however, there are varying degrees of identity proof and many different requirements for authorization limits. The access control flexibility most corporate environments need presents a challenge for any operating system. Table 1 lists typical Windows access control challenges and the solutions that Windows 10 Mobile offers. +Windows Hello supports iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. -Table 1. Windows 10 Mobile solutions for typical access control challenges - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
Access control challengeWindows 10 Mobile solutions

Organizations frequently use passwords to authenticate users and provide access to business applications or the corporate network, because more trustworthy authentication alternatives are too complex and costly to deploy.

Windows Hello provides biometrics to identify the user and unlock the device that closely integrates with Microsoft Passport to identify, authenticate, and authorize users to access the corporate network or applications from their Windows 10 Mobile device with supporting biometric hardware.

When an organization uses smart cards, it must purchase a smart card reader, smart cards, and smart card management software. These solutions are complex and costly to implement; they also tend to delay mobile productivity.

Windows Hello with Microsoft Passport enables a simple and cost-effective MFA deployment across the organization, enhancing the business’ security stance.

Mobile device users must enter their password on a touch keyboard. Entering complex passwords in this way is error prone and less efficient than a keyboard.

Windows Hello helps enable iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. These biometric identification options are more convenient and more efficient than password-based logon.

Users dislike the need to enter long, complex passwords to log on to corporate services, especially passwords that must change frequently. This frustration often leads to password reuse, passwords written on notepads, and weak password composition.

Microsoft Passport allows users to sign in once and gain access to corporate resources without having to re-enter complex passwords. Authentication credentials are bound to the device through a built-in Trusted Platform Module (TPM) and cannot be removed.

-  -The following sections describe these challenges and solutions in more detail. +>**Note:** When Windows 10 first shipped, it included **Microsoft Passport** and **Windows Hello**, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the **Windows Hello** name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -### Microsoft Passport +### Secured credentials -Microsoft Passport provides strong MFA, fully integrated into Windows devices, to replace passwords. To authenticate, the user must have a Microsoft Azure Active Directory (Azure AD)–registered device and either a PIN or Windows Hello biometric gesture to unlock the device. Microsoft Passport is conceptually similar to a smart card but more flexible, as it doesn’t require a public key infrastructure or the implementation of additional hardware and supports biometric identification. +Windows Hello eliminates the use of passwords for login, reducing the risk that an attacker will steal and reuse a user’s credentials. Windows 10 Mobile devices are required to have a Trusted Platform Module (TPM), a microchip that enables advanced security features. The TPM creates encryption keys that are “wrapped” with the TPM’s own storage root key, which is itself stored within the TPM to prevent credentials from being compromised. Encryption keys created by the TPM can only be decrypted by the same TPM, which protects the key material from attackers who want to capture and reuse it. -Microsoft Passport offers three significant advantages over the previous state of Windows authentication: it’s more flexible, it’s based on industry standards, and it more effectively mitigates risks. -### It's effective +To compromise Windows Hello credentials, an attacker would need access to the physical device, and then find a way to spoof the user’s biometric identity or guess his or her PIN. All of this would have to be accomplished before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. With TPM-based protection, an attacker’s window of opportunity for compromising a user’s credentials is greatly reduced. -Microsoft Passport eliminates the use of passwords for logon and so reduces the risk that an attacker will steal and reuse a user’s credentials. User key material, which includes the user’s private key, is available only on the device that generated it. The key material is protected with the TPM, which protects the key material from attackers who want to capture and reuse it. It is a Windows Hardware Certification Program requirement that every Windows 10 Mobile device include a TPM. +### Support for biometrics -To compromise a Microsoft Passport credential that the TPM protects, an attacker must have access to the physical device, and then find a way to spoof the user’s biometrics identity or guess his or her PIN—and all of this must be done before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. This technology greatly reduces an attacker’s window of opportunity for compromising a user’s credentials. +Biometrics help prevent credential theft and make it easier for users to login to their devices. Users always have their biometric identity with them – there is nothing to forget, lose, or leave behind. Attackers would need to have both access to the user’s device and be able to impersonate the user’s biometric identity to gain access to corporate resources, which is far more difficult than stealing a password. -### It's flexible +Windows Hello supports three biometric sensor scenarios: +- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. +- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. +- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. -Microsoft Passport offers unprecedented flexibility along with enterprise-grade security. +>Users must create an unlock PIN while they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. -Most importantly, Microsoft Passport works with biometrics or PINs and gives you options beyond long, complex passwords. Instead of users memorizing and retyping often-changed passwords, Microsoft Passport enables PIN- and biometrics-based identification through Windows Hello to identify users more securely. +All three of these biometric factors – face, finger, and iris – are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes or both eyes with and without eyeglasses or contact lenses. -The Windows 10 Mobile device that the user logs on to is an authentication factor, as well. The credentials used and the private key on the device are device specific and bound to the device’s TPM. +Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device, as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. -In the future, Microsoft Passport will also enable people to use Windows 10 Mobile devices as a remote credential when signing in to PCs running Windows 10. Users will use their PINs or biometrics to unlock their phones, and their phones will unlock their PCs. Phone sign-in with Microsoft Passport will make implementing MFA for scenarios where the user’s credentials must be physically separate from the PC the user is signing in to less costly and complex than other solutions. Phone sign-in will also make it easier for users and IT pros because users can use their phones to sign in to any corporate device instead of enrolling a user credential on each. +The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. -With Microsoft Passport, you gain flexibility in the data center, too. To deploy it for Windows 10 Mobile devices, you must set up Azure AD, but you don’t have to replace or remove your existing Active Directory environment. Using Azure AD Connect, organizations can synchronize these two directory services. Microsoft Passport builds on and adds to your existing infrastructure and allows you to federate with Azure AD. +### Companion devices -Microsoft Passport is also supported on the desktop, giving organizations a uniform way to implement strong authentication on all devices. This flexibility makes it simpler for Microsoft Passport to supplement existing smart card or token deployments for on-premises Windows PC scenarios, adding MFA to mobile devices and users who don’t currently have it for extra protection of sensitive resources or systems that these mobile devices access. +A Windows Hello companion device enables a physical device, like a wearable, to serve as a factor for validating the user’s identity before granting them access to their credentials. For instance, when the user has physical possession of a companion device they can easily, possibly even automatically, unlock their PC and authenticate with apps and websites. This type of device can be useful for smartphones or tablets that don’t have integrated biometric sensors or for industries where users need a faster, more convenient sign-in experience, such as retail. -### It's standardized +In some cases, the companion device for Windows Hello enables a physical device, like a phone, wearable, or other types of device to store all of the user’s credentials. Storage of the credentials on a mobile device makes it possible to use them on any supporting device, like a kiosk or family PC, and eliminates the need to enroll Windows Hello on each device. Companion devices also help enable organizations to meet regulatory requirements, such as Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS 140-2). -Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: the future lies with open, interoperable systems that allow secure authentication across a variety of devices, line-of-business (LOB) apps, and external applications and websites. To this end, a group of industry players formed the Fast Identity Online (FIDO) Alliance. The FIDO Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices as well as the problems users face in creating and remembering multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to authenticate users of online services securely. This new standard can allow any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms using a standardized set of interfaces and protocols. -In 2014, Microsoft joined the board of the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards and of course new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. +### Standards-based approach -### Windows Hello +The Fast Identity Online (FIDO) Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices and the problems users face in creating and remembering multiple user names and passwords. FIDO standards help reduce reliance on passwords to authenticate users of online services securely, allowing any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms. -Windows Hello is the new biometric framework for Windows 10. Because biometric identification is built directly into the operating system, it allows you to use your iris, face, or fingerprint to unlock your mobile device. Windows Hello unlocks Microsoft Passport credentials, which enable authentication to resources or relying parties such as software-as-a-service applications like Microsoft Office 365. -Windows Hello supports three biometric sensor options that are suitable for enterprise scenarios: +In 2014, Microsoft joined the board of the FIDO Alliance. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards. Microsoft has contributed Windows Hello technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for both enterprises and consumers. -- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. -- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. -- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. -> **Note:**  Users must create an unlock PIN before they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. -  -All three of these biometric factors—the face, the finger, and the iris—are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes; or both with and without eyeglasses or contact lenses. +## Windows Information Protection -Spoofing biometric data is often a big concern in enterprise environments. Microsoft employs several anti-spoofing techniques in Windows 10 Mobile that verify the trustworthiness of the biometric device as well as guard against intentional collision with stored biometric measurements. These techniques help improve the false-acceptance rate (the rate at which spoofed biometric data is accepted as authentic) while maintaining the overall usability and manageability of MFA. +Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This fluidity increases the potential for sensitive corporate data to be accidentally compromised. -The biometric image collected at enrollment is converted into an algorithmic form that cannot be converted back into the original image. Only the algorithmic form is kept; the actual biometric image is removed from the device after conversion. Windows 10 Mobile devices both encrypt the algorithmic form of the biometric data and bind the encrypted data to the device, both of which help prevent someone from removing the data from the phone. As a result, the biometric information that Windows Hello uses is a local gesture and doesn’t roam among the user’s devices. +Inadvertent disclosure is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. It’s easy to imagine that an employee using work email on their personal phone could unintentionally save an attachment containing sensitive company information to personal cloud storage, which could be shared with unauthorized people. This accidental sharing of corporate data is just one example of the challenges common to using mobile devices in the workplace. To prevent this type of data leakage, most solutions require users to login with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. -Windows Hello offers several major benefits. First, it helps to address the problems of credential theft and sharing because an attacker must obtain the mobile phone and impersonate the user’s biometric identity, which is more difficult than stealing a device unlock password. Second, the use of biometrics gives users an authenticator that’s always with them—there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, enterprise-grade secure method for logging on to their Windows 10 Mobile device. Finally, there’s nothing additional to deploy, because Microsoft built Windows Hello support directly into the operating system. All you need is a device that includes a supported biometric sensor. +Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data secure and personal data private. Because corporate data is always protected, users cannot inadvertently copy it or share it with unauthorized users or apps. Key features include: +- Automatically tag personal and corporate data. +- Protect data while it’s at rest on local or removable storage. +- Control which apps can access corporate data. +- Control which apps can access a virtual private network (VPN) connection. +- Prevent users from copying corporate data to public locations. +- Help ensure business data is inaccessible when the device is in a locked state. -The device that senses the biometric factors must report the data to Windows Hello quickly and accurately. For this reason, Microsoft determines which factors and devices are trustworthy and accurate prior to their inclusion in Windows Hello. For more information, see [Windows 10 specifications](http://go.microsoft.com/fwlink/p/?LinkId=722908). +### Enlightened apps -## Data protection +Third-party data loss protection solutions usually require developers to wrap their apps. However, Windows Information Protection builds this intelligence right into Windows 10 Mobile so most apps require nothing extra to prevent inappropriate corporate data sharing. -Windows 10 Mobile continues to provide solutions that help protect information against unauthorized access and disclosure. +Windows Information Protection classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data will be encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default. +When you do not want all data encrypted by default – because it would create a poor user experience – developers should consider enlightening apps by adding code and compiling them using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that: +- Don’t use common controls for saving files. +- Don’t use common controls for text boxes. +- Work on personal and enterprise data simultaneously (e.g., contact apps that display personal and enterprise data in a single view or a browser that displays personal and enterprise web pages on tabs within a single instance). -### Device encryption -Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating system and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. +In many cases, most apps don’t require enlightenment for them to use Windows Information Protection. Simply adding them to the allow list is the only step you need to take. Line-of-Business (LOB) apps are a good example of where this works well because they only handle corporate data. -You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. Table 2 lists the policies you can change to customize device encryption on Windows 10 Mobile devices. +**When is app enlightenment required?** +- **Required** + - App needs to work with both personal and enterprise data. +- **Recommended** + - App handles only corporate data, but needs to modify a file (such as a configuration file) in order to launch, uninstall itself, update etc. Without enlightenment you wouldn’t be able to properly revoke these apps. + - App needs to access enterprise data, while protection under lock is activated. +- **Not required** + - App handles only corporate data + - App handles only personal data -Table 2. Windows 10 cryptography policies - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
Area namePolicy nameDescription

Cryptography

Allow FIPS Algorithm Policy

Enable or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled.

BitLocker

Encryption Method

Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one.

Cryptography

TLS Cipher Suite

This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections.

-  -For a complete list of policies available, see [Policy CSP](https://technet.microsoft.com/library/dn904962.aspx). +### Data leakage control -### Enterprise data protection +To configure Windows Information Protection in a Mobile Device Management (MDM) solution that supports it, simply add authorized apps to the allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, unauthorized apps will not have access to enterprise data. -Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This situation increases the potential for compromise of sensitive corporate data. +Windows Information Protection works seamlessly until users try to access enterprise data with or paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but Window Information Protection can block users from copying enterprise data from an authorized app to an unauthorized app. Likewise, it will block users from using an unauthorized app to open a file that contains enterprise data. -One growing risk is authorized users’ accidental disclosure of sensitive data—a risk that is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. One example is common among organizations: an employee connects his or her personal phone to the company’s Microsoft Exchange Server instance for email. He or she uses the phone to work on email that includes attachments with sensitive data. When sending the email, the user accidentally copies a supplier. Content protection is only as strong as the weakest link, and in this example, the unintended sharing of sensitive data with unauthorized people might not have been prevented with standard data encryption. +The extent to which users will be prevented from copying and pasting data from authorized apps to unauthorized apps or locations on the web depends on which protection level is set: +- **Block.** Windows Information Protection blocks users from completing the operation. +- **Override.** Windows Information Protection notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. +- **Audit.** Windows Information Protection does not block or notify users but logs the operation in the audit log. +- **Off.** Windows Information Protection does not block or notify users and does not log operations in the audit log. -In Windows 10 Mobile, Windows Information Protection (WIP) helps separate personal and enterprise data and prevent data leakage. Key features include its ability to: +### Data separation -- Automatically tag personal and corporate data. -- Protect data while it’s at rest on local or removable storage. -- Control which apps can access corporate data. -- Control which apps can access a virtual private network (VPN) connection. -- Prevent users from copying corporate data to public locations. +Most third-party solutions require an app wrapper that directs enterprise data into a password-protected container and keeps personal data outside the container. Depending on the implementation, this may require two different versions of the same apps to be running on the device: one for personal data and another for enterprise data. -> **Note:** WIP is currently being tested in select customer evaluation programs. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip). -  -### Enlightenment +Windows Information Protection provides data separation without requiring a container or special version of an app to access business or personal data. There is no separate login required to see your corporate data or open your corporate applications. Windows Information Protection identifies enterprise data and encrypts it to only enterprise use. Data separation is automatic and seamless. -Third-party data loss protection solutions usually require developers to wrap their apps. In contrast, WIP puts the intelligence in Windows 10 Mobile so that it doesn’t require wrappers. As a result, most apps require nothing extra to work with WIP. +### Encryption -WIP can enforce policy without the need for an app to change. This means that an app that always handles business data (such as an LOB app) can be added to the allowed list and will always encrypt all data that it handles. However, if the app does not use common controls, cut and paste operations from this app to a non-enterprise app will silently fail. In addition, if the app needs to handle personal data, this data will also be encrypted. -Therefore, to improve the user experience, in some cases, developers should enlighten their apps by adding code to and compiling them to use the WIP application programming interfaces. Those cases include apps that: -- Don’t use common controls for saving files. -- Don’t use common controls for text boxes. -- Work on personal and enterprise data simultaneously (for example, contact apps that display personal and enterprise data in a single view; a browser that displays personal and enterprise web pages on tabs within a single instance). +Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating systems and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored – even if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. -Figure 1 summarizes when an app might require enlightenment to work with WIP. Microsoft Word is a good example. Not only can Word access personal and enterprise data simultaneously, but it can also transmit enterprise data (for example, email attachments containing enterprise data). +You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. The list below shows the policies you can change to customize device encryption on Windows 10 Mobile devices. +- Cryptography + - Allow FIPS Algorithm: This policy enables or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled. + - TLS Cipher Suite: This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections. +- BitLocker + - Encryption Method: Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one. -In any case, most apps don’t require enlightenment for them to use WIP protection. Simply adding them to the WIP allow list is all you must do. Because unenlightened apps cannot automatically tag data as personal or enterprise, if they are in a WIP policy, they treat all data as enterprise data. An LOB app is a good example. Adding an LOB app to a WIP policy protects all data that the app handles. Another example is a legacy app that cannot be updated, which you can add to a WIP policy and use without even being aware that WIP exists. +To help make the device even more secured against outside interference, Windows 10 Mobile also now includes protection-under-lock. That means that encryption keys are removed from memory whenever a device is locked. Apps are unable to access sensitive data while the device is in a locked state, so hackers and malware have no way to find and co-opt keys. Everything is locked up tight with the TPM until the user unlocks the device with Windows Hello. -![figure 1](images/mobile-security-guide-fig1.png) +### Government Certifications -Figure 1. When is enlightenment required? - -### Data leakage control - -To configure WIP in an MDM solution that supports it, add authorized apps to the WIP allow list. When a device running Windows 10 Mobile enrolls in the MDM solution, apps that this policy doesn’t authorize won’t have access to enterprise data. - -WIP works seamlessly until users try to access enterprise data with or try to paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but WIP blocks users from copying enterprise data from an authorized app to an unauthorized app. Likewise, WIP blocks users from using an unauthorized app to open a file that contains enterprise data. -In addition, users cannot copy and paste data from authorized apps to unauthorized apps or locations on the Web without triggering one of the WIP protection levels: -- **Block.** WIP blocks users from completing the operation. -- **Override.** WIP notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. -- **Audit.** WIP does not block or notify users but logs the operation in the audit log. -- **Off.** WIP does not block or notify users and does not log operations in the audit log. - -### Data separation - -As the name suggests, data separation separates personal from enterprise data. Most third-party solutions require an app wrapper, and from here, enterprise data goes in a container while personal data is outside the container. Often, people must use two different apps for the same purpose: one for personal data and another for enterprise data. - -WIP provides the same data separation but neither uses containers nor requires a special version of an app to access business data, and then a second instance of it to access personal data. There are no containers, partitions, or special folders to physically separate personal and business data. Instead, Windows 10 Mobile is the access control broker, identifying enterprise data because it’s encrypted to the enterprise. Therefore, WIP provides data separation by virtue of encrypting enterprise data. - -### Visual cues - -In Windows 10 Mobile, visual cues indicate the status of WIP to users (see Figure 2): - -- **Start screen.** On the Start screen, apps that a WIP policy manages display a visual cue. -- **Files.** In File Explorer, a visual cue indicates whether a file or folder contains enterprise data and is therefore encrypted. -For example, Erwin is an employee at Fabrikam. He opens Microsoft Edge from the Start screen and sees that the tile indicates that a WIP policy manages the browser. Erwin opens the Fabrikam sales website and downloads a spreadsheet. In File Explorer, Erwin sees that the file he downloaded has a visual cue which indicates that it’s encrypted and contains enterprise data. When Erwin tries to paste data from that spreadsheet into an app that no WIP policy manages (for example, his Twitter app), Erwin might see a message that allows him to override protection while logging the action, depending on the protection level configured in the WIP policy. - -![figure 2](images/mobile-security-guide-fig2.png) - -Figure 2. Visual cues in WIP +Windows 10 Mobile supports both [FIPS 140 standards](http://csrc.nist.gov/groups/STM/cavp/validation.html) for cryptography and [Common Criteria](https://www.niap-ccevs.org/Product/Compliant.cfm?pid=10694) The FIPS 140 certification validates the effectiveness of the cryptographic algorithms used in Windows 10 Mobile. Microsoft has also received Common Criteria certification for Windows 10 Mobile running on Lumia 950, 950 XL, 550, 635, as well as Surface Pro 4, giving customers assurance that securety functionality is implemented properly. ## Malware resistance -Just as software has automated so much of our lives, malware has automated attacks on our devices. Those attacks are relentless. Malware is constantly changing, and when it infects a device, it can be difficult to detect and remove. -The best way to fight malware is to prevent the infection from happening. Windows 10 Mobile provides strong malware resistance because it takes advantage of secured hardware and protects both the startup process and the core operating system architecture. - -Table 3 lists specific malware threats and the mitigation that Windows 10 Mobile provides. - -Table 3. Threats and Windows 10 Mobile mitigations +The best way to fight malware is prevention. Windows 10 Mobile provides strong malware resistance through secured hardware, startup process defenses, core operating system architecture, and application-level protections. +The table below outlines how Windows 10 Mobile mitigates specific malware threats. --++ - + @@ -266,11 +178,11 @@ Table 3. Threats and Windows 10 Mobile mitigations - + - + @@ -291,249 +203,164 @@ Table 3. Threats and Windows 10 Mobile mitigations
ThreatWindows 10 Mobile mitigationWindows 10 Mobile mitigation

An app infects other apps or the operating system with malware.

All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.

All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.

An unauthorized app or malware attempts to start on the device.

All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.

All Windows 10 Mobile apps must come from Windows Store or Windows Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.

User-level malware exploits a vulnerability in the system or an application and owns the device.
-  -> **Note:**  Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [http://www.uefi.org/specsandtesttools](http://go.microsoft.com/fwlink/p/?LinkId=722912). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. -  -The following sections describe these improvements in more detail. -### Enterprise-grade secure hardware +>**Note:** The Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [www.uefi.org/specs]( http://www.uefi.org/specs). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. -Taking full advantage of Windows 10 Mobile security features requires advancements in hardware-based security. These advances include UEFI with Secure Boot, TPM, and biometric sensors (hardware dependent). +### UEFI with Secure Boot -### UEFI with Secure Boot +When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. -When a Windows 10 Mobile device starts, it begins the process of loading the operating system by locating the bootloader in the device’s storage system. Without safeguards in place, the phone might simply hand control over to the bootloader without even determining whether it’s a trusted operating system or malware. +UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also helps to ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. + +UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and to try and hide its malicious behavior from the operating system. Firmware-based malware of this nature is typically called bootkits. -UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also help ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the mobile phone. -UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the mobile phone’s manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection against firmware-based malware that loads before Windows 10 Mobile and can successfully hide its malicious behavior from Windows 10 Mobile. Firmware-based malware of this nature is typically called a bootkit. When a mobile device with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that no one has modified it after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. -All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. -Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=722909). +All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx) -### Trusted Platform Module +### Trusted Platform Module -A Trusted Platform Module is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or mobile phone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. It is a Windows 10 Mobile device hardware certification requirement to include a TPM in every Windows 10 Mobile device. +A Trusted Platform Module (TPM) is a tamper-resistant cryptographic module that enhances the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a PC, tablet, or smartphone. A trusted computing platform is specially designed to work with the TPM to support privacy and security scenarios that software alone cannot achieve. A TPM is required to receive Windows 10 Mobile device hardware certification. -A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. +A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling a reliable report of the software used to start a platform. -The following list describes key functionality that a TPM provides in Windows 10 Mobile: -- **Manage cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. -- **Safeguard and report integrity measurements.**Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. -- **Prove a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware that masquerades as a TPM. +The following list describes key functionality that a TPM provides in Windows 10 Mobile: +- **Managing cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. +- **Safeguarding and reporting integrity measurements.** Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component – from firmware up through the drivers – and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. +- **Proving a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware masquerading as a TPM. -Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. -Many people assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements; therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. +Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. When the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since then, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection, as well as the ability to plug-in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. -> **Note:**  Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [Minimum hardware requirements](http://go.microsoft.com/fwlink/p/?LinkId=733964). -  -Several Windows 10 Mobile security features require TPM: -- Virtual smart cards -- Measured Boot -- Health attestation (requires TPM 2.0 or later) -Still other features will use the TPM if it is available. For example, Microsoft Passport does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Microsoft Passport. +Many assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements. Therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. -### Biometrics +>Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [minimum hardware requirements](https://technet.microsoft.com/library/dn915086.aspx) -Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. -Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by MFA features such as Microsoft Passport and Windows Hello. -In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue to integrate them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. +Several Windows 10 Mobile security features require TPM: +- Virtual smart cards +- Measured Boot +- Health attestation (requires TPM 2.0 or later) -### Enterprise-grade secure Windows startup +Still other features will use the TPM if it is available. For example, Windows Hello does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Windows Hello. -UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. +### Biometrics -### Trusted Boot +Windows 10 Mobile makes biometrics a core security feature. Microsoft has fully integrated biometrics into the Windows 10 Mobile security components, not just tacked it on top of the platform (as was the case in previous versions of Windows). This is a big change. Earlier biometric implementations were largely front-end methods that simplified authentication. Under the hood, the system used biometrics to access a password, which it then used for authentication behind the scenes. Biometrics may have provided convenience, but not necessarily enterprise-grade authentication. -When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. +Microsoft has been evangelizing the importance of enterprise-grade biometric sensors to the OEMs that create Windows 10 Mobile devices. These facial-recognition and iris-scanning sensors are fully supported by Windows Hello. -If someone has modified a file (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and attempt to automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. +In the future, Microsoft expects OEMs to produce even more advanced enterprise-grade biometric sensors and to continue integrating them into mobile devices. As a result, biometrics will become a commonplace authentication method as part of an MFA system. -### Measured Boot +### Trusted Boot -The biggest challenge with rootkits and bootkits in earlier versions of Windows was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution—and they had system-level privileges—rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). -Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. -Measured Boot focuses on acquiring the measurement data and protecting it against tampering. You must couple it, however, with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. +UEFI with Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the device, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. -### Device health attestation +When UEFI with Secure Boot verifies that it trusts the bootloader and starts Windows 10 Mobile, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (e.g., signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, and startup files. -Device health attestation is new feature in Windows 10 Mobile that helps prevent low-level malware infections. Device health attestation uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. -You can integrate Device health attestation with Microsoft Intune or non-Microsoft MDM solutions and combine these hardware-measured security properties with other device properties to gain an overall view of the device’s health and compliance state. From there, you can use this integration in a variety of scenarios, from detecting jailbroken devices to monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. +### Measured Boot -### Conditional Access +In earlier versions of Windows, the biggest challenge with rootkits and bootkits was that they could frequently be undetectable to the client. Because they often started before Windows defenses and the antimalware solution – and they had system-level privileges – rootkits and bootkits could completely disguise themselves while continuing to access system resources. Although UEFI with Secure Boot and Trusted Boot could prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (e.g., if someone compromised the signature used to sign a boot component, such as a non-Microsoft driver, and used it to sign a malicious one). -The example that follows shows how Windows 10 protective measures integrate and work with Intune and non-Microsoft MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile helps you monitor and verify compliance and how the security and trust rooted in the device hardware protect corporate resources end to end. +Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks. -When a user turns on a phone: -1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. -2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. -3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. -4. Devices that a Device health attestation-enabled MDM solution manage send a copy of this audit trail to the Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. -5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. -6. From your Device health attestation-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. -Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a Device health attestation-enabled MDM system like Intune that takes advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. +Measured Boot focuses on acquiring the measurement data and protecting it against tampering. To provide more complete security, it must be coupled with a service that can analyze the data to determine device health. -## App platform security +### Device Health Attestation -Applications built for Windows are designed to be secure and free of defects, but the reality is that human error can create vulnerabilities in code. When malicious users and software identify such vulnerabilities, they may attempt to manipulate data in memory in the hope that they can compromise the system and take control. +Device Health Attestation (DHA) is a new feature in Windows 10 Mobile that helps prevent low-level malware infections. DHA uses a device’s TPM and firmware to measure the critical security properties of the device’s BIOS and Windows startup processes. These measurements are made in such a way that even on a system infected with kernel-level malware or a rootkit, an attacker is unlikely to spoof the properties. -To mitigate these risks, Windows 10 Mobile includes a series of improvements to make it more difficult for malware to compromise the device. Windows 10 Mobile even enables organizations to choose which apps are allowed to run on mobile devices. In addition, it includes improvements that can dramatically reduce the likelihood that newly discovered vulnerabilities can be successful exploited. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. +You can use DHA with Microsoft Intune (sold separately) or a third-party MDM solution to combine hardware-measured security properties with other device properties and gain an overall view of the device’s health and compliance state. This integration can be useful in a variety of scenarios, including detecting jailbroken devices, monitoring device compliance, generating compliance reports, alerting users or administrators, initiating corrective action on the device, and managing conditional access to resources such as Office 365. -### Device Guard +The example that follows shows how Windows 10 protective measures integrate and work with Intune and third-party MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile can help you monitor and verify compliance and how the security and trust rooted in the device hardware can protect end-to-end corporate resources. -Device Guard is a feature set that consists of both hardware and software system integrity-hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. +When a user turns a phone on: +1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. +2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. +3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. +4. Devices that are DHA-enabled send a copy of this audit trail to the Microsoft Health Attestation service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. +6. From your DHA-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. +Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a DHA-enabled MDM system like Intune. It can take advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. -All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app doesn’t have a digital signature or is prevented by policy, or it does not come from a trusted store, it will not run on Windows 10 Mobile. +### Device Guard -Advanced hardware features (described earlier in the [Enterprise-grade secure hardware](#secure-hardware) section) drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. +Device Guard is a feature set that consists of both hardware and software system integrity–hardening features. These features revolutionize Windows operating system security by moving the entire operating system to a trust-nothing model. -### AppContainer +All apps on Windows 10 Mobile must be digitally signed and come from Windows Store or a trusted enterprise store. Device Guard implements policies that further restrict this. By default, Device Guard supports all apps from Windows Store. You can create policies that define the apps that can and cannot run on the Windows 10 Mobile device. If the app does not have a digital signature, is prevented by policy, or does not come from a trusted store, it will not run on Windows 10 Mobile. -The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer—a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. +Advanced hardware features, described above, drive these security offerings. By integrating these hardware features further into the core operating system, Windows 10 Mobile can use them in new ways. To deliver this additional security, Device Guard requires UEFI with Secure Boot. -The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer. A capability is a Windows 10 Mobile device resource such as geographical location information, camera, microphone, networking, and sensors. +### Address Space Layout Randomization -A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. In addition, access to other capabilities can be declared within the app code itself. Access to additional capabilities and privileges cannot be requested at run time, as can be done with traditional desktop applications. +One of the most common techniques used by attackers to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. -The AppContainer concept is advantageous for the following reasons: - -- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. -- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. -- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communications channels and data types. - -Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. - -The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect, however, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, we need redundant vulnerability mitigations. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. - -### Address Space Layout Randomization -One of the most common techniques attackers use to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data reside, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. - -Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. +Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. The below diagram illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. ![figure 3](images/mobile-security-guide-figure3.png) -Figure 3. ASLR at work +Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, applying it across the entire system rather than only in specific apps. With 64bit system and application processes that can take advantage of a vastly increased memory space, it is even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization becomes increasingly unique across devices, adding additional degrees of difficulty for repurposing successful exploits to another system. -Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, making it even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, making it even more difficult for a successful exploit that works on one system to work reliably on another. Microsoft also holistically applied ASLR across the entire system in Windows 10 Mobile rather than it working only on specific apps. +### Data Execution Prevention -### Data Execution Prevention +Malware depends on its ability to insert a malicious payload into memory with the hope that an unsuspecting user will execute it later. While ASLR makes that more difficult, Windows 10 Mobile extends that protection to prevent malware from running if written to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) substantially reduces the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read-only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. -Malware depends on its ability to put a malicious payload into memory with the hope that an unsuspecting user will execute it later. ASLR makes that much more difficult. - -Extending that protection, it would be great if you could prevent malware from running if it wrote to an area that you have allocated solely for the storage of information. Data Execution Prevention (DEP) does exactly that, substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the **No execute** bit on modern CPUs to mark blocks of memory as read only so that malware can’t use those blocks to execute malicious code. All Windows 10 and Windows 10 Mobile devices support DEP. - -### Windows heap +### Windows heap The heap is a location in memory that Windows uses to store dynamic application data. Microsoft continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that an attacker could use. -Windows 10 Mobile has several important improvements to the security of the heap over previous versions of Windows: +Windows 10 Mobile has made several important improvements to the security of the heap over previous versions of Windows: +- Internal data structures that the heap uses are better protected against memory corruption. +- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, making the allocation much less predictable. +- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. -- Internal data structures that the heap uses are better protected against memory corruption. -- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. -- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. +### Memory reservations -### Memory reservations +Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, making it more difficult for malware to overwrite critical system data structures in memory. -Microsoft reserves the lowest 64 KB of process memory for the operating system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. +### Control Flow Guard -### Control Flow Guard +When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known – they are written in the code itself. However, until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. -When Windows loads applications into memory, it allocates space to those applications based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships among the code locations are well known—they are written in the code itself—but until Windows 10 Mobile, the operating system didn’t enforce the flow among these locations, giving attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. -Windows 10 Mobile mitigates this kind of threat through the Control Flow Guard (CFG) feature. When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. +Windows 10 Mobile mitigates this kind of threat through Control Flow Guard (CFG). When a trusted application that its creator compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If CFG doesn’t trust the location, it immediately terminates the application as a potential security risk. -You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge and other Windows features take full advantage of CFG. +You cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when he or she compiles the application. Because browsers are a key entry point for attacks, Microsoft Edge takes full advantage of CFG. -### Protected processes +### Protected Processes -In general, preventing a computer security incident is more cost-effective than repairing the damage an incident can cause. For malware in particular, most security controls are designed to prevent an attack from being initially successful. The reasoning is that if malware cannot infect the system, the system is immune to malware. +Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, additional malware controls are required. +If malware is running on a system, you need to limit what it can do Protected Processes prevents untrusted processes from tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes broadly throughout the operating system. -Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, it cannot be the only type of malware control. +### AppContainer -The key security scenario is to assume that malware is running on a system but limit what it can do. Windows 10 Mobile has security controls and design features in place to reduce compromise from existing malware infections. Protected Processes is one such feature. +The Windows 10 Mobile security model is based on the principle of least privilege and uses isolation to achieve it. Every app and even portions of the operating system itself run inside their own isolated sandbox called an AppContainer – a secured isolation boundary within which an app and its processes can run. Each AppContainer is defined and implemented through a security policy. -With Protected Processes, Windows 10 Mobile prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes more broadly across the operating system. +The security policy of a specific AppContainer defines the operating system capabilities that apps have access to from within the AppContainer, such as geographical location information, camera, microphone, networking, or sensors. -### Store for Business +A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. Access to other capabilities can be declared within the app code itself. Unlike traditional desktop applications, access to additional capabilities and privileges cannot be requested at run time. -Store for Business allows IT pros to find, acquire, distribute, and manage apps for their organization. The model provides flexible ways to distribute apps, depending on the size of your organization, and does not require additional infrastructure in some scenarios. +The AppContainer concept is advantageous because it provides: +- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. +- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Windows Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. +- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communication channels and data types. -UWP apps are inherently more secure than typical applications because they are sandboxed, which restricts the app’s risk of compromise or tampering with in a way that would put the system, data, and other applications at risk. Windows Store can further reduce the likelihood that malware will infect devices by reviewing all applications that enter the Windows Store ecosystem before making them available. Store for Business extends this concept by enabling you to distribute custom LOB apps, and even some Windows Store apps, to Windows 10 Mobile devices through the same Windows Store infrastructure. +Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Windows Store displays the permissions that the app requires along with the app’s age rating and publisher. -Regardless of how users acquire UWP apps, they can use them with increased confidence. UWP apps run in an AppContainer sandbox with limited privileges and capabilities. For example, the apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. +The combination of Device Guard and AppContainer help to prevent unauthorized apps from running. In the event malware slips into the app ecosystem, the AppContainer helps to constrain the app and limit potential damage. The Windows 10 Mobile trust-nothing model doesn’t assume that any component is perfect. However, potential vulnerabilities in apps, AppContainers, and Windows 10 Mobile itself could give an attacker a chance to compromise a system. For this reason, redundant vulnerability mitigations are needed. The next several topics describe some of the redundant mitigations in Windows 10 Mobile. -In addition, all UWP apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is significantly limited and should be contained within the sandbox. Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. +### Microsoft Edge -The Windows Store app-distribution process and the app sandboxing capabilities of Windows 10 Mobile can dramatically reduce the likelihood that users encounter malicious apps on the system. +The web browser is a critical component of any security strategy. It is the user’s interface to the Internet, an environment teeming with malicious sites and potentially dangerous content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. -For more information about Store for Business, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). +Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: +- **Microsoft Edge on Windows 10 Mobile does not support extensions.** Microsoft Edge has built-in PDF viewing capability. +- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. +- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. -### App management +## Summary -An enterprise typically exerts some configuration and control over the apps installed on devices. In this way, the organization accomplishes several business goals, such managing software licenses, ensuring mandatory app deployment on required devices, and preventing the installation of unacceptable apps on corporate devices. +Windows 10 Mobile provides security on personal and corporate-owned devices to protect against unauthorized access, data leakage, and malware threats. All of the features covered in this paper – multifactor authentication, data separation, and malware resistance – are seamlessly incorporated into the operating system. This means enterprises are protected without compromising the productivity and ease of use that drives users to bring mobile devices into the workplace. -An important component in delivering on these goals is Store for Business, which builds on the Windows Store infrastructure that Microsoft hosts and enables you to deploy Windows Store apps across your Windows 10-based devices. Store for Business is both powerful and highly flexible. It allows you to extend and customize features without having to stand up new on-premises infrastructure. It supports and integrates with your existing MDM service but doesn’t require one. (Ask your MDM service vendor about integration with Store for Business.) You can configure Store for Business for a wide variety of scenarios, including online and offline licensing and different app-distribution options. For a more detailed description of the available Store for Business scenarios, see [Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md). +## Revision History -A web-based portal for IT pros simplifies Windows 10 Mobile app deployment. The familiar look of Windows Store was used to design the Store for Business experience. It showcases apps relevant to business use, hand-selected and sorted by category. The store can use Azure AD accounts for all users, linking them to a single, unique organizational identity. +November 2015 Updated for Windows 10 Mobile (version 1511) -Another key benefit is licensing. Store for Business enables you to track and manage licenses for all UWP apps. You can easily determine which users have installed specific apps, track remaining licenses left, and acquire new licenses directly through the web interface. Those new licenses are added within Store for Business and do not require complex export and import processes. As long as your clients are online and have Internet connectivity, the licensing scenario with Store for Business is a great improvement over manual licensing tasks. +July 2016 Updated for Windows 10 Mobile Anniversary Update (version 1607) -Store for Business allows you to find the right apps for your users, acquire them, manage app licenses, and distribute apps to individuals. The best way to understand Store for Business is to look at the steps involved in a common scenario: delivering apps to Windows 10 Mobile users without an MDM—specifically, deploying apps to Windows 10 Mobile users. In this scenario, you identify several apps that must be on each mobile device that are currently available for free in the Windows Store (for example, a VPN app for your Dell SonicWALL solution) and some internally developed LOB apps. - -### The IT side - -You begin the app deployment process by preparing the private store and the apps before your users receive their new Windows 10 Mobile devices. - -First, you open [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) and use an Azure AD account to log in. This account is linked to the company’s unique organizational identity and must have an Azure AD tenant. In addition, the account must have Azure AD Enterprise Admin permissions if this is the first time you’re using Store for Business. You can delegate later access through permissions within Store for Business. -Next, you locate and acquire any apps you want to deploy to the mobile devices, adding the apps and licenses to the organization’s inventory. - -Along with existing Windows Store apps, you can use Store for Business to manage custom LOB apps that are developed for your organization. First, you grant permission for a trusted app developer to submit the apps. You and the developer submit these apps through the [Windows Dev Center](http://go.microsoft.com/fwlink/p/?LinkId=722911), and they must be digitally signed with a trusted certificate. These apps are not published to the retail Windows Store catalog and are not visible to anyone outside the organization. - -You can deliver the apps through a private store within Windows Store. The next step, then, is for you to mark the app to be available in the private store, which you do through the Store for Business web portal. - -Alternatively, you can choose one of two other app-distribution options in Store for Business web portal: -- Assign the app to people in your organization by selecting one or more Azure AD identities -- Add the app to the organization’s private store, and allow all users to discover and install it. -For details about app distribution, see [Distribute apps using your private store](../manage/distribute-apps-from-your-private-store.md). - -The IT process for preparing Store for Business for app deployment is shown in Figure 4. - -![figure 4](images/mobile-security-guide-figure4.png) - -Figure 4. The IT process for Store for Business - -For details about the process of distributing apps through Store for Business, see [Find and acquire apps](../manage/find-and-acquire-apps-overview.md). - -### The user side - -After you have prepared Store for Business, the user side of the process takes over. This side of the process is designed to be user friendly, with the primary app deployment method—through Store for Business—streamlined and straightforward. This process doesn’t require an MDM system or any on-premises infrastructure. In fact, the user never sees the “for Business” label, just the familiar Windows Store. - -1. The user opens the Windows Store app on his or her Windows 10 Mobile device. - -2. The same Windows Store interface appears, with the addition of the private store you created. The private store appears as a new page, similar to Games and Music. The interface integrates the public Windows Store with the organization’s private store, which contains curated apps. - -3. The user simply selects and installs apps as usual. - -If the user wants to make a private purchase of apps, music, movies, or TV shows with his or her Microsoft account, that’s an option, as well. The user pays for and owns his or her purchase, independent of the company. This flexibility enables hybrid scenarios for devices in many bring your own device environments. - -### Microsoft Edge - -Windows 10 Mobile includes critical improvements designed to thwart attacks and malware. The environment is now more resistant to malware thanks to significant improvements to SmartScreen Filters. Internet browsing is a safer experience thanks to Microsoft Edge, a completely new browser. - -Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: -- **Microsoft Edge does not support non-Microsoft binary extensions.** Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions but includes no non-Microsoft binary extensions, such as ActiveX controls or Java. -- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. -- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. - -The web browser is a critical component of any security strategy, and for good reason: it is the user’s interface to the Internet, an environment teeming with malicious sites and nefarious content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. - -## Related topics - - -[Windows 10 security overview](windows-10-security-guide.md) - -[Windows 10 Mobile and MDM](../manage/windows-10-mobile-and-mdm.md) - -[Windows 10 and Windows 10 Mobile](../index.md) - -[Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) - -[Windows Store for Business overview](../whats-new/windows-store-for-business-overview.md) diff --git a/windows/manage/windows-10-mobile-and-mdm.md b/windows/manage/windows-10-mobile-and-mdm.md index a7d4e10a34..1124f9bd8e 100644 --- a/windows/manage/windows-10-mobile-and-mdm.md +++ b/windows/manage/windows-10-mobile-and-mdm.md @@ -1,75 +1,58 @@ --- -title: Windows 10 Mobile and mobile device management (Windows 10) -description: This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. +title: Windows 10 Mobile deployment and management guide (Windows 10) +description: This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E -keywords: telemetry, BYOD, MDM +keywords: Mobile, telemetry, BYOD, MDM ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile, devices, security author: AMeeus -localizationpriority: high --- -# Windows 10 Mobile and mobile device management +# Windows 10 Mobile deployment and management guide -**Applies to** -- Windows 10 Mobile +*Applies to: Windows 10 Mobile, version 1511 and Windows 10 Mobile, version 1607* -This guide provides an overview of the mobile device and app management technologies in the Windows 10 Mobile operating system. It describes how mobile device management (MDM) systems use the built-in device management client to deploy, configure, maintain, and support phones and small tablets running Windows 10 Mobile. +This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. -Bring Your Own Device (BYOD—that is, personal devices) and corporate devices are key scenarios that Windows 10 Mobile MDM capabilities support. The operating system offers a flexible approach to registering devices with directory services and MDM systems, and IT organizations can provision comprehensive device-configuration profiles based on their company’s need to control and secure mobile business data. -Windows 10 Mobile not only delivers more comprehensive, restrictive configuration settings than Windows Phone 8.1 did but also provides capabilities to deploy and manage apps built on the Universal Windows Platform (UWP). Companies can distribute apps directly from Windows Store or by using their MDM system. They can control and distribute custom line-of-business (LOB) apps the same way. +Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. +Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution. -## Overview +**In this article** +- Deploy +- Configure +- Apps +- Manage +- Retire -Organizations’ users increasingly depend on their mobile devices, but phones and tablets bring new and unfamiliar challenges for IT departments. IT must be able to deploy and manage mobile devices and apps quickly to support the business while balancing the growing need to protect corporate data because of evolving laws, regulations, and cybercrime. IT must ensure that the apps and data on those mobile devices are safe, especially on personal devices. Windows 10 Mobile helps organizations address these challenges by providing a robust, flexible, built-in MDM client. IT departments can use the MDM system of their choice to manage this client. -### Built-in MDM client +## Deploy + +Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which Mobile Device Management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. +Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or System Center Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050). + +### Deployment scenarios + +*Applies to: Corporate and personal devices* The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. -- **Device enrollment.** Users can enroll in the MDM system. On Windows 10, a user can register a device with Microsoft Azure Active Directory (Azure AD) and enroll in an MDM system at the same time so that the system can manage the device, the apps running on it, and the confidential data it holds. Enrollment establishes the management authority for the device. Only one management authority (or MDM enrollment) is possible at a time, which helps prevent unauthorized access to devices and ensures their stability and reliability. -- **Device management.** The MDM client allows the MDM system to configure policy settings; deploy apps and updates; and perform other management tasks, such as remotely wiping the device. The MDM system sends configuration requests and collects inventory through the MDM client. The client uses [configuration service providers (CSPs)](http://go.microsoft.com/fwlink/p/?LinkId=734049) to configure and inventory settings. A CSP is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. (The security architecture of Windows 10 Mobile prevents direct access to registry settings and operating system files. For more information, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md).) +Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. +Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Windows Store for Business, or by using their MDM system, which can also work with the Windows Store for Business for public store apps. +Knowing who owns the device and what the employee will use it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. -The MDM client is an integral part of Windows 10 Mobile. As a result, there is no need for an additional, custom MDM app to enroll the device or to allow an MDM system to manage it. All MDM systems have equal access to Windows 10 Mobile MDM application programming interfaces (APIs), so you can choose Microsoft Intune or a third-party MDM product to manage Windows 10 Mobile devices. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050). +For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. -### Windows 10 Mobile editions +For **corporate devices**, organizations have a lot more control. IT can provide a selected list of supported device models to employees, or they can directly purchase and preconfigure them. Because devices are owned by the company, employees can be limited as to how much they can personalize these devices. Security and privacy concerns may be easier to navigate, because the device falls entirely under existing company policy. -Every device that runs Windows 10 Mobile includes all the enterprise mobile device security and management capabilities the MDM client provides. Microsoft also offers an Enterprise edition of Windows 10 Mobile, which includes three additional capabilities. To enable these capabilities, you can provision a license file without reinstalling the operating system: +### Device enrollment -- **Ability to postpone software updates.**Windows 10 Mobile gets software updates directly from Windows Update, and you cannot curate updates prior to deployment. Windows 10 Mobile Enterprise, however, allows you to curate and validate updates prior to deploying them. -- **No limit on the number of self-signed LOB apps that you can deploy to a single device.** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device, more than 20 if your organization’s devices run Windows 10 Mobile Enterprise. -- **Set telemetry to security level.** The telemetry security level configures the operating system to gather only the telemetry information required to keep devices secured. +*Applies to: Corporate and personal devices* ->**Note:**  Your organization can opt to purchase a code signing certificate from Verisign to sign LOB apps or use [Windows Store for Business](windows-store-for-business.md) to obtain apps. With either method, you can distribute more than 20 apps to a single device without activating Windows 10 Mobile Enterprise on that device by using your MDM system. -  -To activate Windows 10 Mobile Enterprise on any Windows 10 Mobile device, use your company’s MDM system or a provisioning package to inject a license onto the device. You can download a Windows 10 Mobile Enterprise license from the Business Support Portal. +The way in which personal and corporate devices are enrolled into an MDM system differs. Your operations team should consider these differences when determining which approach is best for mobile workers in your organization. -### Lifecycle management - -Windows 10 Mobile supports end-to-end lifecycle device management to give companies control of their devices, data, and apps. Comprehensive MDM systems use the built-in MDM client to manage devices throughout their lifecycle, as Figure 1 illustrates. The remainder of this guide describes the operating system’s mobile device and app management capabilities through each phase of the lifecycle, showing how MDM systems use specific features. - -![figure 1](images/win10-mobile-mdm-fig1.png) - -Figure 1. Device management lifecycle - -## Device deployment - -Device deployment includes the initial registration and configuration of the device, including its enrollment with an MDM system. Sometimes, companies preinstall apps. The major factors in how you deploy devices and which controls you put in place are device ownership and how the user will use the device. This guide covers two scenarios: - -1. Companies allow users to personalize their devices because the users own the devices or because company policy doesn’t require tight controls (defined as *personal devices* in this guide). -2. Companies don’t allow users to personalize their devices or they limit personalization, usually because the organization owns the devices and security considerations are high (defined as *corporate devices* in this guide). - -Often, employees can choose devices from a list of supported models, or companies provide devices that they preconfigure, or bootstrap, with a baseline configuration. - -Microsoft recommends Azure AD Join and MDM enrollment and management for corporate devices and Azure AD Registration and MDM enrollment and management for personal devices. - -### Deployment scenarios - -Most organizations support both personal and corporate device scenarios. The infrastructure for these scenarios is similar, but the deployment process and configuration policies differ. Table 1 describes characteristics of the personal and corporate device scenarios. Activation of a device with an organizational identity is unique to Windows 10 Mobile. - -Table 1. Characteristics of personal and corporate device scenarios +**Device initialization and enrollment considerations** @@ -80,35 +63,49 @@ Table 1. Characteristics of personal and corporate device scenarios - - + + - - + + - - - + + + - - - + + +
Personal devicesCorporate devicesPersonal devicesCorporate devices
OwnershipUserOwnershipEmployee Organization
Primary usePersonalWorkDevice Innitialization + +In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device.The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). +Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity. +Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset. +
DeploymentThe primary identity on the device is a personal identity. A Microsoft account is the default option for Windows 10 Mobile.The primary identity on the device is an organizational identity. An Azure AD account is the default option for Windows 10 Mobile.Device Enrollment + +Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM). +MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). +The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM).
-  -### Identity management -People can use only one account to activate a device, so it’s imperative that your organization control which account you enable first. The account you choose will determine who controls the device and influence your management capabilities. The following list describes the impact that users’ identities have on management (Table 2 summarizes these considerations): +**Recommendation:** Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (AAD+MDM) and personal devices (MSA+AAD+MDM). This requires Azure AD Premium. -- **Personal identity.** In this scenario, employees use their Microsoft account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution. You can apply policies to help protect and contain corporate apps and data on the devices, designed to prevent intellectual property leaks, but users keep full control over personal activities, such as downloading and installing apps and games. -- **Organizational identity.** In this scenario, employees use their Azure AD account to register the device to Azure AD and automatically enroll it with the organization’s MDM solution. In this case, companies can block personal use of devices. Using organizational Identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization. +### Identity management -Table 2. Personal vs. organizational identity +*Applies to: Corporate and personal devices* + +Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities. + +>**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. + +The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. + +**Identity choice considerations for device management** @@ -119,1187 +116,959 @@ Table 2. Personal vs. organizational identity - - + + - - + + - - - + + + - - - + + + - - + + - - - + + + + + + + + + + + + + + + + + +
Personal identityCorporate identityPersonal identityWork identity
First account on the deviceMicrosoft accountFirst account on the deviceMicrosoft Account Azure AD account
Device sign-inUsers cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account.Users can unlock devices with an Azure AD account. Organizations can block the addition of a personal identity.Ease of enrollmentEmployees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+AAD+MDM).Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (AAD+MDM – requires Azure AD Premium).
User settings and data roaming across devicesUser and app settings roam across devices activated with the same personal identity over personal OneDrive.Windows 10 Mobile currently does not support users and app settings roaming over the enterprise cloud. It can block the roaming of personal cloud settings.Credential managementEmployees sign in to the device with Microsoft Account credentials. +Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account. +Employees sign in to the device with Azure AD credentials. +IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. +
Ability to block the use of a personal identity on the device
Ability to block the use of a personal identity on the device No Yes
Level of control

Organization can apply most* restrictive policies to devices, but they cannot remove the Microsoft account from them. Device users can reclaim full control over their devices by un-enrolling them from the organization’s MDM solution.

-
-Note   -

* MDM functionality on personal devices might be limited in the future.

-
-
-  -
Organizations are free to apply the restrictive policies to devices that policy standards and compliance regulations require and prevent the user from un-enrolling the device from the enterprise.User settings and data roaming across multiple Windows devicesUser and app settings roam across all devices activated with the same personal identity through OneDrive.If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD- joined device, this will not be the case. Microsoft is investigating Enterprise roaming for a future release.
Level of controlOrganizations can apply most of the available restrictive policies to devices and disable the Microsoft account. You can prevent users from reclaiming full control over their devices by unenrolling them from the organization’s MDM solution or resetting the device. Legal limitations may apply. For more information, contact your legal department.Organizations are free to apply any restrictive policies to devices to bring them in line with corporate standards and compliance regulations. They can also prevent the user from unenrolling the device from the enterprise.
Information ProtectionYou can apply policies to help protect and contain corporate apps and data on the devices and prevent intellectual property leaks, but still provide employees with full control over personal activities like downloading and installing apps and games.Companies can block personal use of devices. Using organizational identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization.
App purchasesEmployees can purchase and install apps from the Store using a personal credit card.Employees can install apps from your Store for Business. Employees cannot install or purchase app from the Store without the addition of an MSA.
-  -### Infrastructure requirements -For both device scenarios, the essential infrastructure and tools required to deploy and manage Windows 10 Mobile devices include an Azure AD subscription and an MDM system. -Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid solution. Azure AD has three editions: Free, Basic, and Premium (see [Azure Active Directory editions](http://go.microsoft.com/fwlink/p/?LinkId=723980)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. Organizations that use Microsoft Office 365 or Intune are already using Azure AD. +>**Note:** In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities will change in the future. ->**Note:**  Most industry-leading MDM vendors already support integration with Azure AD or are working on integration. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://go.microsoft.com/fwlink/p/?LinkId=723981). -  -Users can enroll Windows 10 Mobile devices in third-party MDM systems without using an Azure AD organizational account. (By default, Intune uses Azure AD and includes a license). If your organization doesn’t use Azure AD, you must use a personal identity to activate devices and enable common scenarios, such as downloading apps from Windows Store. +### Infrastructure choices -Multiple MDM systems that support Windows 10 Mobile are available. Most support personal and corporate device deployment scenarios. Microsoft offers [Intune](http://go.microsoft.com/fwlink/p/?LinkId=723983), which is part of the [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) and a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management, so employees use the same credentials to enroll devices in Intune or sign in to Office 365. Intune supports devices that run other operating systems, as well, such as iOS and Android, to provide a complete MDM solution. +*Applies to: Corporate and personal devices* -You can also integrate Intune with System Center Configuration Manager to gain a single console in which to manage all devices—in the cloud and on premises. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=734051). For guidance on choosing between a stand-alone Intune installation and Intune integrated with Configuration Manager, see [Choose between Intune by itself or integrating Intune with System Center Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=723985). -In addition to Intune, other MDM providers support Windows 10 Mobile. Currently, the following MDM systems claim to support Windows 10 and Windows 10 Mobile: [AirWatch](http://go.microsoft.com/fwlink/p/?LinkId=723986), [Citrix](http://go.microsoft.com/fwlink/p/?LinkId=723987), [Lightspeed Systems](http://go.microsoft.com/fwlink/p/?LinkId=723988), [Matrix42](http://go.microsoft.com/fwlink/p/?LinkId=723989), [MobileIron](http://go.microsoft.com/fwlink/p/?LinkId=723990), [SAP](http://go.microsoft.com/fwlink/p/?LinkId=723991), [SOTI](http://go.microsoft.com/fwlink/p/?LinkId=723992), and [Symantec](http://go.microsoft.com/fwlink/p/?LinkId=723993). +For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/en-us/library/mt627908.aspx). -All MDM vendors have equal access to the [Windows 10 MDM APIs](http://go.microsoft.com/fwlink/p/?LinkId=734050). The extent to which they implement these APIs depends on the vendor. Contact your preferred MDM vendor to determine its level of support. +**Azure Active Directory** +Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](http://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. ->**Note:**  Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. -In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (for example, passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052). -  -### Provisioning +**Mobile Device Management** +Microsoft [Intune](http://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. +You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://technet.microsoft.com/en-us/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager. +Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://azure.microsoft.com/en-us/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. -Provisioning is new to Windows 10 and uses the MDM client in Windows 10 Mobile. You can create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10. -To assist users with MDM system enrollment, use a provisioning package. To do so, use the [Windows Imaging and Configuration Designer](http://go.microsoft.com/fwlink/p/?LinkId=733911) to create a provisioning package, and then install that package on the device. -Users can perform self-service MDM enrollment based on the following deployment scenarios: +>**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. +In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://technet.microsoft.com/en-us/library/ms.o365.cc.devicepolicy.aspx). -- **Corporate device.** During the out-of-the-box experience (OOBE), you can instruct the user to select **This device is owned by my organization** and join the device to Azure AD and the MDM system. -- **Personal device.** The user activates the device with a Microsoft account, but you can instruct him or her to register the device with Azure AD and enroll in Intune. To do so in Windows 10 Mobile, the user clicks, **Settings**, clicks **Accounts**, and then clicks **Work access**. -To automate MDM enrollment, use provisioning packages as follows: -- **Corporate device.** You can create a provisioning package and apply it to a corporate device before delivery to the user, or instruct the user to apply the package during OOBE. After application of the provisioning package, the OOBE process automatically chooses the enterprise path and requires the user to register the device with Azure AD and enroll it in the MDM system. -- **Personal device.** You can create a provisioning package and make it available to users who want to enroll their personal device in the enterprise. The user enrolls the device in the corporate MDM for further configuration by applying the provisioning package. To do so in Windows 10 Mobile, the user clicks **Settings**, clicks **Accounts**, and then clicks **Provisioning**). +**Cloud services** +On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. -Distribute provisioning packages to devices by publishing them in an easily accessible location (e.g., an email attachment or a web page). You can cryptographically sign or encrypt provisioning packages and require that the user enter a password to apply them. +**Windows Push Notification Services** +The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. +However, push notifications can affect battery life so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. Windows 10 Mobile disables the receipt of push notifications to save energy when battery saver is on. +However, there is an exception to this behavior. In Windows 10 Mobile, the Always allowed battery saver setting (found in the Settings app) allows apps to receive push notifications even when battery saver is on. Users can manually configure this list, or IT can use the MDM system to configure the battery saver settings URI scheme in Windows 10 Mobile (ms-settings:batterysaver-settings). -See [Build and apply a provisioning package](http://go.microsoft.com/fwlink/p/?LinkId=734054) for more information on creating provisioning packages. +For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). -## Device configuration +**Windows Update for Business** +Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. -The following sections describe the device configuration capabilities of the built-in Windows 10 Mobile MDM client. This client exposes the capabilities to any MDM system compatible with Windows 10. Configurable settings include: +**Windows Store for Business** +The Windows Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps. -- [Email accounts](#email) -- [Account restrictions](#restrictions) -- [Device lock restrictions](#device-lock) -- [Hardware restrictions](#hardware) -- [Certificate management](#certificate) -- [Wi-Fi](#wifi) -- [Proxy](#proxy) -- [Virtual private network (VPN)](#vpn) -- [Access point name (APN) profiles](#apn) -- [Data leak prevention](#data) -- [Storage management](#storage) +## Configure ->**Note:**  Although all the MDM settings this section describes are available in Windows 10 Mobile, not all MDM systems may show them in their user interface. In addition, naming may vary among MDM systems. Consult your MDM system’s documentation for more information. -  -### Email accounts +MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. What configuration settings you use will differ based on the deployment scenario, and corporate devices will offer IT the broadest range of control. -You can use your corporate MDM system to manage corporate email accounts. Define email account profiles in the MDM system, and then deploy them to devices. You would usually deploy these settings immediately after enrollment, regardless of scenario. +>**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. +Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors. -This capability extends to email systems that use EAS. Table 3 lists settings that you can configure in EAS email profiles. +### Account profile -Table 3. Windows 10 Mobile settings for EAS email profiles +*Applies to: Corporate devices* -| Setting | Description | -|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Email Address | The email address associated with the EAS account | -| Domain | The domain name of the Exchange Server instance | -| Account Name | A user-friendly name for the email account on the device | -| Password | The password for the email account | -| Server Name | The server name that the email account uses | -| User Name | The user name for the email account | -| Calendar Age Filter | The age of calendar items to be synchronized with the device (for example, synchronizing calendar items within the past 7 days) | -| Logging | The level of diagnostic logging | -| Mail Body Type | The email body format type: text, HTML, RTF, or Multipurpose Internet Mail Extensions | -| Mail HTML Truncation | The maximum size of an HTML-formatted email message before the message is synchronized to the device (Any HTML-formatted email message that exceeds this size is automatically truncated.) | -| Mail Plain Text Truncation | The maximum size of a text-formatted email message before the message is synchronized to the device (Any text-formatted email message that exceeds this size is automatically truncated.) | -| Schedule | The schedule for synchronizing email between the Exchange Server instance and the device | -| Use SSL | Establishes whether Secure Sockets Layer (SSL) is required when syncing | -| Mail Age Filter | The age of messages to be synchronized with the device (for example, synchronizing messages within the past 7 days) | -| Content Types | The content type that is synchronized (e.g., email, contacts, calendar, task items) | -  -Table 4 lists settings that you can configure in other email profiles. +Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. -Table 4. Windows 10 Mobile settings for other email profiles +- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Windows Store, Xbox, or Groove. +- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts. -| Setting | Description | -|-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------| -| User logon name | The user logon name for the email account | -| Outgoing authentication required | Whether the outgoing server requires authentication | -| Password | The password for the account in the **User logon name** field | -| Domain | The domain name for the account in the **User logon name** field | -| Days to download | How much email (measured in days) should be downloaded from the server | -| Incoming server | The incoming server name and port number, where the value format is *server\_name:port\_number* (The port number is optional.) | -| Send and receive schedule | The length of time (in minutes) between email send-and-receive updates | -| IMAP4 maximum attachment size | The maximum size for message attachments for Internet Message Access Protocol version 4 (IMAP4) accounts | -| Send mail display name | The name of the sender displayed on a sent email | -| Outgoing server | The outgoing server name and port number, where the value format is *server\_name:port\_number* (The port number is optional.) | -| Reply address | The user’s reply email address | -| Email service name | The name of the email service | -| Email service type | The email service type (for example, POP3, IMAP4). | -| Maximum receive message size | The maximum size (in bytes) of messages retrieved from the incoming email server (Messages that exceed this size are truncated to the maximum size.) | -| Delete message action | How messages are deleted on the server (Messages can either be permanently deleted or sent to the Trash folder.) | -| Use cellular only | Whether the account should be used only with cellular connections and not Wi-Fi connections | -| Content types to synchronize | The content types supported for synchronization (in other words, mail messages, contacts, calendar items) | -| Content synchronization server | The name of the content synchronization server, if it’s different from the email server | -| Calendar synchronization server | The name of the calendar synchronization server, if it’s different from the email server | -| Contact server requires SSL | Whether the contact server requires an SSL connection | -| Calendar server requires SSL | Whether the calendar server requires an SSL connection | -| Contact items synchronization schedule | The schedule for syncing contact items | -| Calendar items synchronization schedule | The schedule for syncing calendar items | -| Alternative SMTP email account | The display name associated with a user’s alternative Simple Mail Transfer Protocol (SMTP) email account | -| Alternate SMTP domain name | The domain name for the user’s alternative SMTP email account | -| Alternate SMTP account enabled | Whether the user’s alternative SMTP account is enabled | -| Alternate SMTP password | The password for the user’s alternative SMTP account | -| Incoming and outgoing servers require SSL | A group of properties that specify whether the incoming and outgoing email servers use SSL | -  -### Account restrictions +### Email accounts -On a corporate device registered with Azure AD and enrolled in the MDM system, you can control whether users can use a Microsoft account or add other consumer email accounts. Table 5 lists the settings that you can use to manage accounts on Windows 10 Mobile devices. +*Applies to: Corporate and personal devices* -Table 5. Windows 10 Mobile account management settings -| Setting | Description | -| - | -| -| Allow Microsoft Account | Specifies whether users are allowed to add a Microsoft account to the device after MDM enrollment and use this account for connection authentication and services, such as purchasing apps in Windows Store, or cloud-based consumer services, such as Xbox or Groove. If a device was activated with a Microsoft account, the MDM system would not be able to block that account from being used. | -| Allow Adding Non Microsoft Accounts | Specifies whether users are allowed to add email accounts other than Microsoft accounts after MDM enrollment. If **Allow Microsoft Account** is applied, user can also not use a Microsoft account. | -| Allow “Your Account” | Specifies whether users are able to change account configuration in the **Your Email and Accounts** panel in Settings.| -  -### Device lock restrictions +Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies. -It’s common sense to lock a device when it is not in use. Microsoft recommends that you secure Windows 10 Mobile devices and implement a device lock policy. A device password or PIN lock is a best practice for securing apps and data on devices. [Windows Hello](http://go.microsoft.com/fwlink/p/?LinkId=723994) is the name given to the new biometric sign-in option that allows users to use their face, iris, or fingerprints to unlock their compatible device, all of which Windows 10 supports. +- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920017(v=vs.85).aspx). +- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile. ->**Note:**  In addition to the device lock restrictions discussed in this section, Windows 10 supports Microsoft Passport for Work, which lets you access apps and services without a password. -  -Table 6 lists the MDM settings in Windows 10 Mobile that you can use to configure device lock restrictions. +### Device Lock restrictions -Table 6. Windows 10 Mobile device lock restrictions +*Applies to: Corporate and personal devices* + +It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](http://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices. + +>**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. +Companion devices must be paired with Windows 10 PC’s via Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires Pro or Enterprise edition on the Windows 10 PC being signed into. + +Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply. + +- **Device Password Enabled** Specifies whether users are required to use a device lock password. +- **Allow Simple Device Password** Whether users can use a simple password (e.g., 1111 or 1234). +- **Alphanumeric Device Password Required** Whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard. +- **Min Device Password Complex Characters** The number of password element types (i.e., uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. +- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.) +- **Min Device Password Length** The minimum number of characters required to create new passwords. +- **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock. +- **Allow Idle Return Without Password** Whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. +- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.) +- **Screen Timeout While Locked** The number of minutes before the lock screen times out (this policy influences device power management). +- **Allow Screen Timeout While Locked User Configuration** Whether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting). + +Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario. +Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. + +You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information. + +### Prevent changing of settings + +*Applies to: Corporate devices* + +Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change. + +- **Allow Your Account** Specifies whether users are able to change account configuration in the Your Email and Accounts panel in Settings +- **Allow VPN** Allows the user to change VPN settings +- **Allow Data Sense** Allows the user to change Data Sense settings +- **Allow Date Time** Allows the user to change data and time setting +- **Allow Edit Device Name** Allows users to change the device name +- **Allow Speech Model Update** Specifies whether the device will receive updates to the speech recognition and speech synthesis models (to improve accuracy and performance) + +### Hardware restrictions + +*Applies to: Corporate devices* + +Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi Fi. You can use hardware restrictions to control the availability of these features. + +The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. + +>**Note:** Some of these hardware restrictions provide connectivity and assist in data protection. + +- **Allow NFC:** Whether the NFC radio is enabled +- **Allow USB Connection:** Whether the USB connection is enabled (doesn’t affect USB charging) +- **Allow Bluetooth:** Whether users can enable and use the Bluetooth radio on their devices +- **Allow Bluetooth Advertising:** Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices +- **Allow Bluetooth Discoverable Mode:** Whether the device can discover other devices (e.g., headsets) +- **Allow Bluetooth pre-pairing** Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device +- **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect +- **Set Bluetooth Local Device Name:** The local Bluetooth device name +- **Allow Camera:** Whether the camera is enabled +- **Allow Storage Card:** Whether the storage card slot is enabled +- **Allow Voice Recording:** Whether the user can use the microphone to create voice recordings +- **Allow Location:** Whether the device can use the GPS sensor or other methods to determine location so applications can use location information + +### Certificates + +*Applies to: Personal and corporate devices* + +Certificates help improve security by providing account authentication, Wi Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. +To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes. +Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. +In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings. +Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](../keep-secure/installing-digital-certificates-on-windows-10-mobile.md). +Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. + +>**Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Windows Store. This Windows 10 Mobile app can help you: +- View a summary of all personal certificates +- View the details of individual certificates +- View the certificates used for VPN, Wi-Fi, and email authentication +- Identify which certificates may have expired +- Verify the certificate path and confirm that you have the correct intermediate and root CA certificates +- View the certificate keys stored in the device TPM + +### Wi-Fi profiles + +*Applies to: Corporate and personal devices* + +Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. +You can create multiple Wi-Fi profiles in your MDM system. The below table lists the Windows 10 Mobile Wi Fi connection profile settings that can be configured by administrators. + +- **SSID** The case-sensitive name of the Wi Fi network Service Set Identifier +- **Security type** The type of security the Wi Fi network uses; can be one of the following authentication types: + - Open 802.11 + - Shared 802.11 + - WPA-Enterprise 802.11 + - WPA-Personal 802.11 + - WPA2-Enterprise 802.11 + - WPA2-Personal 802.11 +- **Authentication encryption** The type of encryption the authentication uses; can be one of the following encryption methods: + - None (no encryption) + - Wired Equivalent Privacy + - Temporal Key Integrity Protocol + - Advanced Encryption Standard (AES) +- **Extensible Authentication Protocol Transport Layer Security (EAP-TLS)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication +- **Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication +- **Shared key** WPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication. +- **Proxy** The configuration of any network proxy that the Wi Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) +- **Disable Internet connectivity checks** Whether the Wi Fi connection should check for Internet connectivity +- **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file +- **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled + +In addition, you can set a few device wide Wi-Fi settings. +- **Allow Auto Connect to Wi Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks +- **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings +- **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled +- **Allow Internet Sharing** Allow or disallow Internet sharing +- **WLAN Scan Mode** How actively the device scans for Wi-Fi networks + +Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx). + +### APN profiles + +*Applies to: Corporate devices* + +An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. +An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. +You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles. + +- **APN name** The APN name +- *IP connection type* The IP connection type; set to one of the following values: + - IPv4 only + - IPv6 only + - IPv4 and IPv6 concurrently + - IPv6 with IPv4 provided by 46xlat +- **LTE attached** Whether the APN should be attached as part of an LTE Attach +- **APN class ID** The globally unique identifier that defines the APN class to the modem +- **APN authentication type** The APN authentication type; set to one of the following values: + - None + - Auto + - PAP + - CHAP + - MSCHAPv2 +- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type +- **Password** The password for the user account specified in User name +- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile +- **Always on** Whether the connection manager will automatically attempt to connect to the APN whenever it is available +- **Connection enabled** Specifies whether the APN connection is enabled +- **Allow user control** Allows users to connect with other APNs than the enterprise APN +- **Hide view** Whether the cellular UX will allow the user to view enterprise APNs + +Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn958617(v=vs.85).aspx). + +### Proxy + +*Applies to: Corporate devices* + +The below lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity. + +- **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection) +- **Bypass Local** Specifies if the proxy should be bypassed when local hosts are accessed by the device +- **Enable** Specifies if the proxy is enabled +- **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed +- **User Name** Specifies the username used to connect to the proxy +- **Password** Specifies the password used to connect to the proxy +- **Server** Specifies the name of the proxy server +- **Proxy connection type** The proxy connection type, supporting: Null proxy, HTTP, WAP, SOCKS4 +- **Port** The port number of the proxy connection + +For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914762(v=vs.85).aspx). + +### VPN + +*Applies to: Corporate and personal devices* + +Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Windows Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Windows Store using your MDM system (see App Management). + +You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile. +To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings: + +- **VPN Servers** The VPN server for the VPN profile +- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values: + - Split tunnel. Only network traffic destined to the intranet goes through the VPN connection + - Force tunnel. All traffic goes through the VPN connection +- **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic +- **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections) +- **Machine certificate** The machine certificate used for IKEv2-based VPN connections +- **EAP configuration** To create a single sign-on experience for VPN users using certificate authentication, you need to create an Extensible Authentication Protocol (EAP) configuration XML file and include it in the VPN profile +- **L2tpPsk** The pre-shared key used for an L2TP connection +- **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling + +>**Note:** The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard will walk you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. + +Windows Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: + +- **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address +- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (e.g., authentication information) that the plugin provider requires +- **Windows Store VPN plugin family name** Specifies the Windows Store package family name for the Windows Store–based VPN plugin + +In addition, you can specify per VPN Profile: + +- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list will automatically trigger the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +- **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface. +- **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile. +- **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. +- **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List. +- **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings. +- **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it. +- **Remember credentials** Whether the VPN connection caches credentials. +- **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi). +- **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy. +- **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance. +- **Lock Down VPN profile** A Lock Down VPN profile has the following characteristics: + - It is an always-on VPN profile. + - It can never be disconnected. + - If the VPN profile is not connected, the user has no network connectivity. + - No other VPN profiles can be connected or modified. +- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require. + +For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914776(v=vs.85).aspx) + +Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges. +- **Allow VPN** Whether users can change VPN settings +- **Allow VPN Over Cellular** Whether users can establish VPN connections over cellular networks +- **Allow VPN Over Cellular when Roaming** Whether users can establish VPN connections over cellular networks when roaming + +### Storage management + +*Applies to: Corporate and personal devices* + +Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage. The device encryption in Windows 10 Mobile helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. + +Windows 10 Mobile also has the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on so you don’t need to set a policy explicitly to enable it. + +The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. This gives users the flexibility to use an SD card while still protecting the confidential apps and data on it. + +You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards. + +Here is a list of MDM storage management settings that Windows 10 Mobile provides. + +- **Allow Storage Card** Whether the use of storage cards for data storage is allowed +- **Require Device Encryption** Whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) +- **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values: + - AES-Cipher Block Chaining (CBC) 128-bit + - AES-CBC 256-bit + - XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default) + - XTS-AES-256-bit +- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Whether the device allows or disallows the FIPS algorithm policy +- **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections +- **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive +- **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive + + +## Apps + +*Applies to: Corporate and personal devices* + +User productivity on mobile devices is often driven by apps. + +Windows 10 makes it possible to develop apps that work seamlessly across multiple devices using the Universal Windows Platform (UWP) for Windows apps. UWP converges the application platform for all devices running Windows 10 so that apps run without modification on all editions of Windows 10. This saves developers both time and resources, helping deliver apps to mobile users more quickly and efficiently. This write-once, run-anywhere model also boosts user productivity by providing a consistent, familiar app experience on any device type. + +For compatibility with existing apps, Windows Phone 8.1 apps still run on Windows 10 Mobile devices, easing the migration to the newest platform. Microsoft recommend migrating your apps to UWP to take full advantage of the improvements in Windows 10 Mobile. In addition, bridges have been developed to easily and quickly update existing Windows Phone 8.1 (Silverlight) and iOS apps to the UWP. + +Microsoft also made it easier for organizations to license and purchase UWP apps via Windows Store for Business and deploy them to employee devices using the Windows Store, or an MDM system, that can be integrated with the Windows Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security. + +To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/en-us/windows/uwp/porting/index). + +### Windows Store for Business: Sourcing the right app + +*Applies to: Corporate and personal devices* + +The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Windows Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Windows Store. With the Windows Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Windows Store, without the need for MSAs on Windows 10 devices. + +Windows Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices. + +Azure AD authenticated managers have access to Windows Store for Business functionality and settings, and store managers can create a private category of apps that are specific and private to their organization. (You can get more details about what specific Azure AD accounts have access to Windows Store for Business here). Windows Store for Business enables organizations to purchase app licenses for their organization and make apps available to their employees. In addition to commercially available apps, your developers can publish line-of-business (LOB) apps to Windows Store for Business by request. You can also integrate their Windows Store for Business subscriptions with their MDM systems, so the MDM system can distribute and manage apps from Windows Store for Business. + +Windows Store for Business supports app distribution under two licensing models: online and offline. + +The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps. +Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. + +Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps. + +Online licensed apps do not need to be transferred or downloaded from the Windows Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Windows Store for Business reclaims the license so it can be used for another user or on another device. + +To distribute an app offline (organization-managed), the app must be downloaded from the Windows Store for Business. This can be accomplished in the Windows Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Windows Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online licensing method. + +To install acquired Windows Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Windows Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required. + +Windows Store apps or LOB apps that have been uploaded to the Windows Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Windows Store certificates. LOB apps that are uploaded to the Windows Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. + +Learn more about the [Windows Store for Business](windows-store-for-business.md). + +### Managing apps + +*Applies to: Corporate devices* + +IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date. + +Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Windows Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Windows Store. + +For more details, see [AppLocker CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920019(v=vs.85).aspx). + +In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM. + +- **Allow All Trusted Apps** Whether users can sideload apps on the device. +- **Allow App Store Auto Update** Whether automatic updates of apps from Windows Store are allowed. +- **Allow Developer Unlock** Whether developer unlock is allowed. +- **Allow Shared User App Data** Whether multiple users of the same app can share data. +- **Allow Store** Whether Windows Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system. +- **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above. +- **Disable Store Originated Apps** Disables the launch of all apps from Windows Store that came pre-installed or were downloaded before the policy was applied. +- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. +- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card. +- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card. +- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](http://msdn.microsoft.com/en-us/library/windows/hardware/mt171093(v=vs.85).aspx) for more information). + +Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps) + +### Data leak prevention + +*Applies to: Corporate and personal devices* + +One of the biggest challenges in protecting corporate information on mobile devices is keeping that data separate from personal data. Most solutions available to create this data separation require users to login in with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. + +Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email. + +Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default. + +Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including: +- Microsoft Edge +- Microsoft People +- Mobile Office apps (Word, Excel, PowerPoint, and OneNote) +- Outlook Mail and Calendar +- Microsoft Photos +- Microsoft OneDrive +- Groove Music +- Microsoft Movies & TV +- Microsoft Messaging + +The following table lists the settings that can be configured for Windows Information Protection: +- **Enforcement level*** Set the enforcement level for information protection: + - Off (no protection) + - Silent mode (encrypt and audit only) + - Override mode (encrypt, prompt, and audit) + - Block mode (encrypt, block, and audit) +- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. +- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience. +- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured. +- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. +- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service. +- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long. +- **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection. +- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the Start menu. +- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection. +- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. +- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. +- **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected. + +>**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it. + +For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](../keep-secure/protect-enterprise-data-using-wip.md). + +### Managing user activities + +*Applies to: Corporate devices* + +On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks. + +- **Allow copy and paste** Whether users can copy and paste content +- **Allow Cortana** Whether users can use Cortana on the device (where available) +- **Allow device discovery** Whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) +- **Allow input personalization** Whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) +- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow screen capture** Whether users are allowed to capture screenshots on the device +- **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed +- **Allow sync my settings** Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) +- **Allow toasts notifications above lock screen** Whether users are able to view toast notification on the device lock screen +- **Allow voice recording** Whether users are allowed to perform voice recordings +- **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft +- **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher +- **Enable Offline Maps Auto Update** Disables the automatic download and update of map data +- **Allow Offline Maps Download Over Metered Connection** Allows the download and update of map data over metered connections + +You can find more details on the experience settings in Policy CSP. + +### Microsoft Edge + +*Applies to: Corporate and personal devices* + +MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection. + +The following settings for Microsoft Edge on Windows 10 Mobile can be managed. + +- **Allow Browser** Whether users can run Microsoft Edge on the device +- **Allow Do Not Track headers** Whether Do Not Track headers are allowed +- **Allow InPrivate** Whether users can use InPrivate browsing +- **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally +- **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar +- **Allow SmartScreen** Whether SmartScreen Filter is enabled +- **Cookies** Whether cookies are allowed +- **Favorites** Configure Favorite URLs +- **First Run URL** The URL to open when a user launches Microsoft Edge for the first time +- **Prevent SmartScreen Prompt Override** Whether users can override the SmartScreen warnings for URLs +- **Prevent Smart Screen Prompt Override for Files** Whether users can override the SmartScreen warnings for files + +## Manage + +In enterprise IT environments, the need for security and cost control must be balanced against the desire to provide users with the latest technologies. Since cyberattacks have become an everyday occurrence, it is important to properly maintain the state of your Windows 10 Mobile devices. IT needs to control configuration settings, keeping them from drifting out of compliance, as well as enforce which devices can access internal applications. Windows 10 Mobile delivers the mobile operations management capabilities necessary to ensure that devices are in compliance with corporate policy. + +### Servicing options + +**A streamlined update process** + +*Applies to: Corporate and personal devices* + +Microsoft has streamlined the Windows product engineering and release cycle so new features, experiences, and functionality demanded by the market can be delivered more quickly than ever before. Microsoft plans to deliver two Feature Updates per year (12-month period). Feature Updates establish a Current Branch or CB, and have an associated version. --+++ - - - - - - - - + + + - - + + + - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + +
SettingDescription
Device Password Enabled

Specifies whether users are required to use a device lock password

-
-Note   -

-
    -

  • When a device is registered with Azure AD and automatic MDM enrollment is not configured, the user will automatically be prompted to set a password PIN of at least six digits (simple PINs are not allowed).

    • -

  • If the device is capable of using biometric authentication, the user will be able to enroll an iris or other biometric gesture (depending on hardware) for device lock purposes. When a user uses a biometric gesture, he or she can still use the PIN as a fallback mechanism (for example, if the iris-recognition camera fails).

    • -
-
-
-  -
BranchVersionRelease Date
Allow Simple Device PasswordWhether users can use a simple password (for example, 1111 or 1234)Current Branch1511November 2015
Alphanumeric Device Password RequiredWhether users need to use an alphanumeric password When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard.Current Branch for Business1511March 2016
Min Device Password Complex CharactersThe number of password element types (in other words, uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords
Device Password ExpirationThe number of days before a password expires (Biometric data does not expire.)
Device Password HistoryThe number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.)
Min Device Password LengthThe minimum number of characters required to create new passwords
Max Inactivity Time Device LockThe number of minutes of inactivity before devices are locked and require a password to unlock
Allow Idle Return Without PasswordWhether users are required to re-authenticate when their devices return from a sleep state, before the inactivity time was reached
Max Device Password Failed AttemptsThe number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.)
Screen Timeout While LockedThe number of minutes before the lock screen times out (This policy influences the device’s power management.)
Allow Screen Timeout While Locked User ConfigurationWhether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the Screen Timeout While Locked setting if you disable this setting.)Current Branch1607July 2016
-  -### Hardware restrictions -Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can also use hardware restrictions to control the availability of these features. Table 7 lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. +Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. ->**Note:**  Some of these hardware restrictions provide connectivity and assist in data protection. Enterprise data protection is currently being tested in select customer evaluation programs. -  -Table 7. Windows 10 Mobile hardware restrictions +Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates. -| Setting | Description | -|--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------| -| Allow NFC | Whether the NFC radio is enabled | -| Allow USB Connection | Whether the USB connection is enabled (this setting doesn’t affect USB charging) | -| Allow Bluetooth | Whether users can enable and use the Bluetooth radio on their devices | -| Allow Bluetooth Advertising | Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices | -| Allow Bluetooth Discoverable Mode | Whether the device can discover other devices (for example, headsets) | -| Bluetooth Services Allowed List | The list of Bluetooth services and profiles to which the device can connect | -| Set Bluetooth Local Device Name | The local Bluetooth device name | -| Allow Wi-Fi | Whether the Wi-Fi radio is enabled | -| Allow Auto Connect to Wi-Fi Sense Hotspots | Whether the device can automatically connect to Wi-Fi hotspots and friends’ home networks that are shared through Wi-Fi Sense | -| Allow Manual Wi-Fi Configuration | Whether users can manually connect to Wi-Fi networks not specified in the MDM system’s list of configured Wi-Fi networks | -| WLAN Scan Mode | How actively the device scans for Wi-Fi networks (This setting is hardware dependent.) | -| Allow Camera | Whether the camera is enabled | -| Allow Storage Card | Whether the storage card slot is enabled | -| Allow Voice Recording | Whether the user can use the microphone to create voice recordings | -| Allow Location | Whether the device can use the GPS sensor or other methods to determine location so applications can use location information | -  -### Certificate management - -Managing certificates can be difficult for users, but certificates are pervasive for a variety of uses, including, account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users could manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates for their entire life cycle, from enrollment through renewal to revocation. You can use the Simple Certificate Enrollment Protocol (SCEP) and Personal Information Exchange (PFX) certificates files to install certificates on Windows 10 Mobile. Certificate management through SCEP and MDM systems is fully transparent to users and requires no user intervention, so it helps improve user productivity and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device. Table 8 lists the SCEP settings that the MDM client in Windows 10 Mobile provides. - -Table 8. Windows 10 Mobile SCEP certificate enrollment settings - -| Setting | Description | -|------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Certificate enrollment server URLs | The certificate enrollment servers (to specify multiple server URLs, separate the URLs with semicolons \[;\]) | -| SCEP enrollment challenge | The Base64-encoded SCEP enrollment challenge | -| Extended key use object identifiers | The object identifiers (OIDs) for extended key use | -| Key usage | The key usage bits for the certificate in decimal format | -| Subject name | The certificate subject name | -| Private key storage | Where to store the private key (in other words, the Trusted Platform Module \[TPM\], a software key storage provider \[KSP\], or the Microsoft Passport KSP) | -| Pending retry delay | How long the device will wait to retry when the SCEP server sends a pending status | -| Pending retry count | The number of times a device will retry when the SCEP server sends a pending status | -| Template name | The OID of the certificate template name | -| Private key length | The private key length (in other words, 1024, 2048, or 4096 bits; Microsoft Passport supports only the 2048 key length) | -| Certificate hash algorithm | The hash algorithm family (in other words, SHA-1, SHA-2, SHA-3; multiple hash algorithm families are separated by plus signs \[+\]) | -| Root CA thumbprint | The root CA thumbprint | -| Subject alternative names | Subject alternative names for the certificate (Use semicolons to separate multiple subject alternative names.) | -| Valid period | The unit of measure for the period of time the certificate is considered valid (in other words, days, months, or years) | -| Valid period units | The number of units of time that the certificate is considered valid (Use this setting with the **Valid Period** setting. For example, if this setting is **3** and **Valid Period** is **Years**, the certificate is valid for 3 years.) | -| Custom text to show in Microsoft Passport PIN prompt | The custom text to show on the Microsoft Passport PIN prompt during certificate enrollment | -| Thumbprint | The current certificate thumbprint, if certificate enrollment succeeds | -  -In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. Table 9 lists the Windows 10 Mobile PFX certificate deployment settings. - -Table 9. Windows 10 Mobile PFX certificate deployment settings - -| Setting | Description | -|-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Private key storage | Where to store the private key (in other words, the TPM, a software KSP, or the Microsoft Passport KSP) | -| Microsoft Passport container name | The tenant identifier of the Azure AD tenant from which the Microsoft Passport is derived, required only if you select **Microsoft Passport KSP** in **Private key storage** | -| PFX packet | The PFX packet with the exported and encrypted certificates and keys in Binary64 format | -| PFX packet password | The password that protects the PFX blob specified in **PFX packet** | -| PFX packet password encryption | Whether the MDM system encrypts the PFX certificate password with the MDM certificate | -| PFX private key export | Whether the PFX private key can be exported | -| Thumbprint | The thumbprint of the installed PFX certificate | -  -Use the **Allow Manual Root Certificate Installation** setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. - ->**Note:**  To diagnose certificate-related issues on Windows 10 Mobile devices, use the free [Certificates app](http://go.microsoft.com/fwlink/p/?LinkId=723996) in Windows Store. This Windows 10 Mobile app can help you: - -- View a summary of all personal certificates. -- View the details of individual certificates. -- View the certificates used for VPN, Wi-Fi, and email authentication. -- Identify which certificates may have expired. -- Verify the certificate path and confirm that you have the correct intermediate and root CA certificates. -- View the certificate keys stored in the device TPM. -  -### Wi-Fi - -People use Wi-Fi on their mobile devices as much as or more than cellular data. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but you can use your MDM system to fully configure Wi-Fi settings without user intervention. - -Table 10 lists the Windows 10 Mobile Wi-Fi connection profile settings. Use the information in this table to help you create Wi-Fi connection profiles in your MDM system. - -Table 10. Windows 10 Mobile Wi-Fi connection profile settings +Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary. --++++++ - - - - - - - - + + + + + + - - + + + + + - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + +
SettingDescription
SSIDThe case-sensitive name of the Wi-Fi network (service set identifier [SSID])Network connectionDescriptionAuto ScanAuto DownloadAuto InstallAuto Restart
Security typeThe type of security the Wi-Fi network uses; can be one of the following authentication types: -
    -

  • Open 802.11

    • -

  • Shared 802.11

    • -

  • WPA-Enterprise 802.11

    • -

  • WPA-Personal 802.11

    • -

  • WPA2-Enterprise 802.11

    • -

  • WPA2-Personal 802.11

    • -
Wi-FiDevice is connected to a personal or corporate Wi-Fi network (no data charges)YesYes/td> +YesYes – outside of Active Hours (forced restart after 7 days if user postpones restart)
Authentication encryptionThe type of encryption the authentication uses; can be one of the following encryption methods: -
    -

  • None (no encryption)

    • -

  • Wired Equivalent Privacy

    • -

  • Temporal Key Integrity Protocol

    • -

  • Advanced Encryption Standard (AES)

    • -
CellularDevice is only connected to a cellular network (standard data charges apply)Will skip a daily scan if scan was successfully completed in the last 5 daysWill only occur if update package is small and does not exceed the mobile operator data limit or the user clicks “download now”.Yes, if the user clicked “download now”Idem
Extensible Authentication Protocol Transport Layer Security (EAP-TLS)WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication
Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication
Shared keyWPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication.
ProxyThe configuration of any network proxy that the Wi-Fi connection requires (To specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address.)
Disable Internet connectivity checksWhether the Wi-Fi connection should check for Internet connectivity
Proxy auto-configuration URLA URL that specifies the proxy auto-configuration file
Enable Web Proxy Auto-Discovery Protocol (WPAD)Specifies whether WPAD is enabledCellular -- RoamingDevice is only connected to a cellular network and roaming charges applyNoNoNoIdem
-  -Table 11 lists the Windows 10 Mobile settings for managing Wi-Fi connectivity. -Table 11. Windows 10 Mobile Wi-Fi connectivity settings +**Keeping track of updates releases** -| Setting | Configuration | -|--------------------------------------------|----------------------------------------------------------------------------| -| Allow Auto Connect To Wi-Fi Sense Hotspots | Whether the device will automatically detect and connect to Wi-Fi networks | -| Allow Manual Wi-Fi Configuration | Whether the user can manually configure Wi-Fi settings | -| Allow Wi-Fi | Whether the Wi-Fi hardware is enabled | -| WLAN Scan Mode | How actively the device scans for Wi-Fi networks | -  -### Proxy +*Applies to: Corporate and Personal devices* -Apps running on Windows 10 Mobile (for example, Microsoft Edge) can use proxy connections to access Internet content, but Wi-Fi connections on the corporate intranet most typically use proxy connections, instead. You can define multiple proxies in Windows 10 Mobile. +Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/en-us/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](http://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about. ->**Note:**  Windows 10 Mobile also supports proxy auto-configuration (PAC) files, which can automatically configure proxy settings. The Web Proxy Auto-Discovery Protocol (WPAD) lets apps use Dynamic Host Configuration Protocol and Domain Name System (DNS) lookups to locate the PAC file. -  -Table 12 lists the Windows 10 Mobile settings for proxy connections. +>**Note:** +We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub -Table 12. Windows 10 Mobile proxy connection settings +**Windows as a Service** + +*Applies to: Corporate and Personal devices* + +Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure. + +Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below: --+++++ - - - - - - - - + + + + + - - + + + + - - + + + + + - - - - - - - - - - - - - - - - - - + + + + +
SettingsConfiguration
Proxy nameThe unique name of the proxy connectionServicing optionAvailability of new features for installationMinimum length of servicing lifetimeKey benefitsSupported editions
Proxy IDThe unique identifier for the proxy connectionWindows Insider BuildsAs appropriate during development cycle, released to Windows Insiders onlyVariable, until the next Insider build is released to Windows InsidersAllows Insiders to test new feature and application compatibility before a Feature Update is released/td> +Mobile
NameThe user-friendly name of the proxy connectionCurrent Branch (CB)Immediately after the Feature Update is published to Windows Update by MicrosoftMicrosoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer)Makes new features available to users as soon as possibleMobile & Mobile Enterprise
Server addressThe address of the proxy server, which can be the server FQDN or IP address
IP address typeThe IP address type that identifies the proxy server, which can be one of the following values: -
    -

  • IPV4

    • -

  • IPV6

    • -

  • E164

    • -

  • ALPHA

    • -
Proxy connection typeThe proxy connection type, which can be one of the following values: -
    -

  • ISA

    • -

  • WAP

    • -

  • SOCKS

    • -

  • NULL

    • -
PortsThe port information for the proxy connection; includes the following settings: -
    -

  • Port Name. The unique name of a port that the proxy connection uses, such as PORT0 or PORT1

    • -

  • Port Name/Port Nbr. The proxy connection port number for this port

    • -

  • Port Name/Services. The services that use this proxy connection port

    • -

  • Services/Service Name. The name of a service that uses the proxy connection

    • -

  • Services/Service Name/Service Name. The protocol associated with the parent port connection

    • -
Configuration referenceThe connection reference information for the proxy connection. The corporation determines the information in this optional setting.Current Branch for Business (CBB)A minimum of four months after the corresponding Feature Update is first published to Windows Update by MicrosoftA minimum of four months, though it potentially can be longerNoProvides additional time to test new feature before deploymentMobile Enterprise only
-  -### VPN -In addition to Wi-Fi, users often use a VPN to securely access apps and resources on their company’s intranet behind a firewall. Windows 10 Mobile supports several VPN vendors in addition to native Microsoft VPNs (such as Point to Point Tunneling Protocol \[PPTP\], Layer 2 Tunneling Protocol \ -[L2TP\], and Internet Key Exchange Protocol version 2 \[IKEv2\]), including: +**Enterprise Edition** -- IKEv2 -- IP security -- SSL VPN connections (which require a downloadable plug-in from the VPN server vendor) +*Applies to: Corporate devices* -You can configure Windows 10 Mobile to use auto-triggered VPN connections, as well. You define a VPN connection for each app that requires intranet connectivity. When users switch between apps, the operating system automatically establishes the VPN connection for that app. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 Mobile Enterprise edition. -With always-on VPN, Windows 10 Mobile can automatically start a VPN connection when a user signs-in, as well. The VPN stays connected until the user manually disconnects it. -MDM support for VPN connections in Windows 10 Mobile includes provisioning and updating VPN connection profiles and associating VPN connections with apps. You can create and provision VPN connection profiles, and then deploy them to managed devices that run Windows 10 Mobile. Table 13 lists the Windows 10 Mobile fields for VPN connection profiles. +Upgrading to Windows 10 Mobile Enterprise edition provides additional device and app management capabilities for organizations that want to: +- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 Mobile Enterprise edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released. +- **Deploy an unlimited number of self-signed LOB apps to a single device:** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device. To deploy more than 20 self-signed LOB apps, Windows 10 Mobile Enterprise is required. +- **Set the telemetry level:** Microsoft collects telemetry data to help keep Windows devices secure and to help Microsoft improve the quality of Windows and Microsoft services. An upgrade to Windows 10 Mobile Enterprise edition is required to set the telemetry level so that only telemetry information required to keep devices secured is gathered. -Table 13. Windows 10 Mobile VPN connection profile settings +To learn more about telemetry, visit [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). + +To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required. + +Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904983(v=vs.85).aspx) + +>**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. + +**Deferring and Approving Updates with MDM** + +*Applies to: Corporate devices with Enterprise edition* + +Once a device is upgraded to Windows 10 Mobile Enterprise edition, you can manage devices that receive updates from Windows Update (or Windows Update for Business) with a set of update policies. + +To control Feature Updates, you will need to move your devices to the Current Branch for Business (CBB) servicing option. A device that subscribes to CBB will wait for the next CBB to be published by Microsoft Update. While the device will wait for Feature Updates until the next CBB, Quality Updates will still be received by the device. + +To control monthly Quality Update additional deferral policies, need to be set to your desired deferral period. When Quality Updates are available for your Windows 10 Mobile devices from Windows Update, these updates will not install until your deferral period lapses. This gives IT Professionals some time to test the impact of the updates on devices and apps. + +Before updates are distributed and installed, you may want to test them for issues or application compatibility. IT pros have the ability require updates to be approved. This enables the MDM administrator to select and approve specific updates to be installed on a device and accept the EULA associated with the update on behalf of the user. Please remember that on Windows 10 Mobile all updates are packaged as a “OS updates” and never as individual fixes. + +You may want to choose to handle Quality Updates and Feature Updates in the same way and not wait for the next CBB to be released to your devices. This streamlines the release of updates using the same process for approval and release. You can apply different deferral period by type of update. In version 1607 Microsoft added additional policy settings to enable more granularity to control over updates. + +Once updates are being deployed to your devices, you may want to pause the rollout of updates to enterprise devices. +For example, after you start rolling out a quality update, certain phone models are adversely impacted or users are reporting a specific LOB app is not connecting and updating a database. Problems can occur that did not surface during initial testing. +IT professionals can pause updates to investigate and remediate unexpected issues. + +The following table summarizes applicable update policy settings by version of Windows 10 Mobile. All policy settings are backward compatible, and will be maintained in future Feature Updates. Consult the documentation of your MDM system to understand support for these settings in your MDM. --+++ - - - - - - - - + + + - - + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + +
SettingDescription
Native VPN protocol profile

The configuration information when the VPN uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP); includes the following settings:

-
    -

  • Servers. The VPN server for the VPN profile

    • -

  • Routing policy type. The type of routing policy the VPN profile uses; can be set to one of the following values:

    -
      -

    • Split tunnel. Only network traffic destined to the intranet goes through the VPN connection.

      • -

    • Force tunnel. All traffic goes through the VPN connection.

      • -
    • -

  • Tunneling protocol type. The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols; can be one the following values:

    -
      -

    • PPTP

      • -

    • L2TP

      • -

    • IKEv2

      • -

    • Automatic

      • -
    • -

  • User authentication method. The user authentication method for the VPN connection; can have a value of EAP or MSChapv2. Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections.

    • -

  • Machine certificate. The machine certificate used for IKEv2-based VPN connections.

    • -

  • EAP configuration. An HTML-encoded XML blob of the EAP configuration. For more information about creating the EAP configuration XML blob, see [EAP configuration](http://go.microsoft.com/fwlink/p/?LinkId=734055). You can use the XML blob these steps create in the MDM system to create the VPN profile.

    • -
Activity (Policy)Version 1511 settingsVersion 1607 settings
VPN plugin profileWindows Store–based VPN plug-ins for the VPN connection; includes the following settings: -
    -

  • VPN servers. A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address.

    • -

  • Custom configuration. An HTML-encoded XML blob for SSL–VPN plug-in–specific configuration information (e.g., authentication information) that the plug-in provider requires.

    • -

  • Windows Store VPN plugin family name. Specifies the Windows Store package family name for the Windows Store–based VPN plug-in.

    • -
Subscribe device to CBB, to defer Feature UpdatesRequireDeferUpgrade + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release.BranchReadinessLevel + +Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers feature update for minimum of 4 months after Current Branch was release.
Defer UpdatesDeferUpdatePeriod + +Defer Quality Updates for 4 weeks or 28 daysDeferQualityUpdatePeriodInDays + +Defer Feature and Quality Updates for up to 30 days.
Approve UpdatesRequireUpdateApproval + +RequireUpdateApproval + +
Always on connectionWhether the VPN connects at user sign-in and stays connected until the user manually disconnects the VPN connection.
App trigger listA list of apps that automatically initiate the VPN connection. Each app trigger in the list includes the following settings: -
    -

  • App ID. The app identity for the app that automatically initiates the VPN connection Any apps in this list can send data through the VPN connection; set it to one of the following values:

    -
      -

    • Unique name of the Windows Store app (Package Family Name). The package family name is a unique name for each app. For example, the package family name for the Skype app is Microsoft.SkypeApp_kzf8qxf38zg5c.

      • -

    • Fully qualified path to the app (such as C:\Windows\System\Notepad.exe).

      • -

    • Kernel driver name.

      • -
    • -
DNS suffixesA comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List.
LockDown VPN profileWhether this VPN connection is a LockDown profile. A LockDown VPN profile has the following characteristics: -
    -

  • It is an always-on VPN profile.

    • -

  • It can never be disconnected.

    • -

  • If the VPN profile is not connected, the user has no network connectivity.

    • -

  • No other VPN profiles can be connected or modified.

    • -
-

You must delete a LockDown VPN profile before you can add, remove, or connect other VPN profiles.

Name Resolution Policy Table rulesA list of Name Resolution Policy Table rules for the VPN connection. Each rule in the list includes the following settings: -
    -

  • Domain name. The namespace for the policy; can be an FQDN or a domain suffix.

    • -

  • Domain name type. The type of namespace in Domain name; has a value of either FQDN or Suffix.

    • -

  • DNS servers. A comma-separated list of DNS server IP addresses to use for the namespace specified in Domain name.

    • -

  • Web proxy servers. The IP address for the web proxy server (if the intranet redirects traffic through a web proxy server).

    • -
ProxyAny post connection proxy support required for the VPN connection; includes the following settings: -
    -

  • Proxy server. Specifies the fully qualified host name or IP address of the proxy server when a specific proxy server is required.

    • -

  • Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings.

    • -
Remember credentialsWhether the VPN connection caches credentials.
Route listA list of routes to add to the routing table for the VPN connection. Each route in the list includes the following settings: -
    -

  • Address. The destination subnet address in IPv4 or IPv6 format (such as 192.168.0.0).

    • -

  • Prefix size. The portion of the address used to identify the destination subnet address (such as 16 to produce the subnet 192.168.0.0/16).

    • -
Traffic filter listA list of traffic rules that define the traffic that can be sent through the VPN connection. Each rule in the list includes the following settings: -
    -

  • App ID. The app identity for the traffic filter based on a specific app (app-based traffic filter). Any apps in this list can send data through the VPN connection; set to one of the following values:

    -
      -

    • Unique name of the Windows Store app (Package Family Name). The package family name is a unique name for each app. For example, the package family name for the Skype app is Microsoft.SkypeApp_kzf8qxf38zg5c.

      • -

    • Fully qualified path to the app (such as C:\Windows\System\Notepad.exe).

      • -

    • Kernel driver name.

      • -
    • -

  • Protocol. The IP protocol to use for the traffic filter rule (for example, TCP = 6, UDP = 17).

    • -

  • Local port ranges. Specifies a comma-separated list of local IP port ranges (for example, 100–180, 200, 300–350).

    • -

  • Remote port ranges. A comma-separated list of remote IP port ranges (for example, 100–180, 200, 300–350).

    • -

  • Local address ranges. A comma-separated list of local IP address ranges that are allowed to use the VPN connection (for example, 192.168.0.1–192.168.0.255, 172.16.10.0–172.16.10.255).

    • -

  • Remote address ranges. A comma-separated list of remote IP address ranges that are allowed to use the VPN connection (for example, 192.168.0.1–192.168.0.255, 172.16.10.0–172.16.10.255).

    • -

  • Routing policy type. The type of IP tunnel for the VPN connection; set to one of the following:

    -
      -

    • Split tunnel. Only traffic destined for the intranet is sent through the VPN connection.

      • -

    • Force tunnel. All traffic is sent through the VPN connection.

      • -
    • -
Trusted network detectionA comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible.Pause Update rollout once an approved update is being deployed, pausing the rollout of the update.PauseDeferrals + +Pause Feature Updates for up to 35 daysPauseQualityUpdates + +Pause Feature Updates for up to 35 days
-  -Table 14 lists the Windows 10 Mobile settings for managing VPN connections. These settings help you manage VPNs over cellular data connections, which in turn help reduce costs associated with roaming or data plan charges. - -Table 14. Windows 10 Mobile VPN management settings - -| Setting | Description | -|--------------------------------------|---------------------------------------------------------------------------------| -| Allow VPN | Whether users can change VPN settings | -| Allow VPN Over Cellular | Whether users can establish VPN connections over cellular networks | -| Allow VPN Over Cellular when Roaming | Whether users can establish VPN connections over cellular networks when roaming | -  -### APN profiles - -An APN defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. - -An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. Corporations in Europe and the Asia-Pacific use APNs, but they are not common in the United States. - -You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. Table 15 lists the MDM settings that Windows 10 Mobile supports for APN profiles. - -Table 15. Windows 10 Mobile APN profile settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingDescription
APN nameThe APN name
IP connection typeThe IP connection type; set to one of the following values: -
    -

  • IPv4 only

    • -

  • IPv6 only

    • -

  • IPv4 and IPv6 concurrently

    • -

  • IPv6 with IPv4 provided by 46xlat

    • -
LTE attachedWhether the APN should be attached as part of an LTE Attach
APN class IDThe globally unique identifier that defines the APN class to the modem
APN authentication typeThe APN authentication type; set to one of the following values: -
    -

  • None

    • -

  • Auto

    • -

  • PAP

    • -

  • CHAP

    • -

  • MSCHAPv2

    • -
User nameThe user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type
PasswordThe password for the user account specified in User name
Integrated circuit card IDThe integrated circuit card ID associated with the cellular connection profile
-  -### Data leak protection - -Some user experiences can risk corporate data stored on corporate devices. For example, allowing users to copy and paste information out of the organization’s LOB app can put data at risk. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data -and prevent data leaks. For example, you can prevent settings synchronization, copy-and-paste operations, and screen captures. Table 16 lists the MDM settings in Windows 10 Mobile that you can use to help prevent data leaks. - -Table 16. Windows 10 Mobile data leak protection settings - -| Setting | Description | -|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow copy and paste | Whether users can copy and paste content | -| Allow Cortana | Whether users can use Cortana on the device, where available | -| Allow device discovery | Whether the device discovery user experience is available on the lock screen (For example, this setting can control whether a device could discover a projector \[or other devices\] when the lock screen is displayed.) | -| Allow input personalization | Whether personally identifiable information can leave the device or be saved locally (for example, Cortana learning, inking, dictation) | -| Allow manual MDM unenrollment | Whether users are allowed to delete the workplace account (in other words, unenroll the device from the MDM system) | -| Allow screen capture | Whether users are allowed to capture screenshots on the device | -| Allow SIM error dialog prompt | Specifies whether to display a dialog prompt when no SIM card is installed | -| Allow sync my settings | Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) | -| Allow toasts notifications above lock screen | Whether users are able to view toast notification on the device lock screen | -| Allow voice recording | Whether users are allowed to perform voice recordings. | -  -### Storage management - -Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage by using the device encryption in Windows 10 Mobile. This encryption helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. - -A feature in Windows 10 Mobile is the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on, so you don’t need to set a policy explicitly to enable it. -The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. -You can disable the **Allow Storage Card** setting to prevent users from using SD cards altogether, but the primary advantage of the SD card app partition–encryption feature is that organizations can give users the flexibility to use an SD card while still protecting the confidential apps and data on it. - -If you don’t encrypt storage, you can help protect your corporate apps and data by using the **Restrict app data to the system volume** and **Restrict apps to the system volume** settings. They help ensure that users cannot copy your apps and data to SD cards. - -Table 17 lists the MDM storage-management settings that Windows 10 Mobile provides. - -Table 17. Windows 10 Mobile storage management settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingDescription
Allow Storage CardWhether users can use storage cards for device storage (This setting does not prevent programmatic access to the storage cards.)
Require Device EncryptionWhether internal storage is encrypted (When a device is encrypted, you cannot use a policy to turn encryption off.)
Encryption methodSpecifies the BitLocker drive encryption method and cipher strength; can be one of the following values: -
    -

  • AES-Cipher Block Chaining (CBC) 128-bit

    • -

  • AES-CBC 256-bit

    • -

  • XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default)

    • -

  • XTS-AES-256-bit

    • -
Allow Federal Information Processing Standard (FIPS) algorithm policyWhether the device allows or disallows the FIPS algorithm policy
SSL cipher suitesSpecifies a list of the allowed cryptographic cipher algorithms for SSL connections
Restrict app data to the system volumeSpecifies whether app data is restricted to the system drive
Restrict apps to the system volumeSpecifies whether apps are restricted to the system drive
-  -## App management - -Apps help improve user productivity on mobile devices. New to Windows 10 is the ability for organizations purchase apps from Windows Store for their employees and deploy those apps from Windows Store or an MDM system. App management is becoming a key capability of MDM systems, helping reduce the effort required to perform common app-related tasks, such as distributing apps, and protecting data through app policies. This section describes the app management features in Windows 10 Mobile and includes the following topics: - -- [Universal Windows Platform (UWP)](#uwp) -- [Sourcing the right app](#sourcing) -- [Windows Store for Business](#store) -- [Mobile application management (MAM) policies](#mam) -- [Microsoft Edge](#edge) - -### Universal Windows Platform - -Windows 10 introduces UWP, converging the application platform for all devices running some edition of Windows 10. UWP apps run without modification on all editions of Windows 10, and Windows Store now has apps that you can license and purchased for all your Windows 10 devices. Windows Phone 8.1 and Windows 8.1 apps still run on Windows 10 devices, but the MAM improvements in Windows 10 work only with UWP apps. See the [Guide to Universal Windows Platform (UWP) apps](http://go.microsoft.com/fwlink/p/?LinkId=734056) for additional information. - -### Sourcing the right app - -The first step in app management is to obtain the apps your users need, and you can now acquire apps from Windows Store. Developers can also create apps specific to an organization, known as *line-of-business (LOB) apps* (the developers of these apps are *LOB publishers*). An LOB developer (internal or external) can now publish these apps to Windows Store at your request, or you can obtain the app packages offline and distribute them through your MDM system. - -To install Windows Store or LOB apps, use the Windows Store cloud service or your MDM system to distribute the app packages. Your MDM system can deploy apps online by redirecting the user to a licensed app in Windows Store or offline by distributing a package that you downloaded from Windows Store (also called *sideloading*) on Windows 10 Mobile devices. You can fully automate the app deployment process so that no user intervention is required. - -IT administrators can obtain apps through Store for Business. Most apps can be distributed online, meaning that the user must be logged in to the device with an Azure AD account and have Internet access at the time of installation. To distribute an app offline, the developer must opt in. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online method. See [Windows Store for Business](windows-store-for-business.md) for additional information about apps obtained through Store for Business. -Windows Store apps are automatically trusted. For custom LOB apps developed internally or by a trusted software vendor, ensure that the device trusts the app signing certificate. There are two ways to establish this trust: use a signing certificate from a trusted source, or generate your own signing certificate and add your chain of trust to the trusted certificates on the device. You can install up to 20 self-signed apps on a Windows 10 Mobile device. When you purchase a signing certificate from a public CA, you can install more than 20 apps on a device, although you can install more than 20 self-signed apps per device with [Windows 10 Mobile Enterprise](#mobile-edition). - -Users can install apps from Windows Store that the organization purchases through the Store app on their device. If you allow your users to log in with a Microsoft account, the Store app on the device provides a unified method for installing personal and corporate apps. - -### Store for Business - -[Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) is a web portal that IT pros and purchasers use to find, acquire, manage, and distribute apps to Windows 10 devices. This online portal gives Azure AD authenticated managers access to Store for Business functionality and settings. Store managers can create a private section of Windows Store in which organizations can manage apps specific and private to them. Store for Business allows organizations to make apps available to their users and purchase app licenses for them. They can also integrate their Store for Business subscriptions with their MDM systems, so the MDM system can deploy apps from their free Store for Business subscription. - -The process for using Store for Business is as follows: - -1. Create a Store for Business subscription for your organization. -2. In the Store for Business portal, acquire apps from Windows Store (only free apps are available at this time). -3. In Store for Business, distribute apps to users, and manage the app licenses for the apps acquired in the previous step. -4. Integrate your MDM system with your organization’s Store for Business subscription. -5. Use your MDM system to deploy the apps. - -For more information about Store for Business, see [Windows Store for Business](windows-store-for-business.md). - -### Mobile application management (MAM) policies - -With MDM, you can manage Device Guard on Windows 10 Mobile and create an allow (whitelist) or deny (blacklist) list of apps. This capability extends to built-in apps, as well, such as phone, text messaging, email, and calendar. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. - -You can also control users’ access to Windows Store and whether the Store service updates apps automatically. You can manage all these capabilities through your MDM system. Table 18 lists the Windows 10 Mobile app management settings. - -Table 18. Windows 10 Mobile app management settings - -| Setting | Description | -|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow All Trusted Apps | Whether users can sideload apps on the device | -| Allow App Store Auto Update | Whether automatic updates of apps from Windows Store are allowed | -| Allow Developer Unlock | Whether developer unlock is allowed | -| Allow Shared User App Data | Whether multiple users of the same app can share data | -| Allow Store | Whether Windows Store app is allowed to run | -| Allow Windows Bridge For Android App Execution | Whether the Windows Bridge for Android app is allowed to run | -| Application Restrictions | An XML blob that defines the app restrictions for a device (The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher.) | -| Require Private Store Only | Whether the private store is exclusively available to users (If enabled, only the private store is available. If disabled, the retail catalog and private store are both available.) | -| Restrict App Data To System Volume | Whether app data is allowed only on the system drive | -| Restrict App To System Volume | Whether app installation is allowed only to the system drive | -| Start screen layout | An XML blob used to configure the Start screen (See [Start layout for Windows 10 Mobile editions](http://go.microsoft.com/fwlink/p/?LinkId=734057) for more information.) | -  -One potential security issue is that users can register as Windows 10 Mobile app developers and turn on developer features on their device, potentially installing apps from unknown sources and opening the device to malware threats. To prevent users from turning on developer features on their devices, set the **Disable development unlock (side loading)** policy, which you can configure through your MDM system. - -### Microsoft Edge - -MDM systems give you the ability to manage Microsoft Edge on mobile devices. Table 19 lists the Microsoft Edge settings for Windows 10 Mobile. - -Table 19. Microsoft Edge settings for Windows 10 Mobile - -| Setting | Description | -|-------------------------------------------------|-------------------------------------------------------------------------------------------------------| -| Allow Active Scripting | Whether active scripting is allowed | -| Allow Autofill | Whether values are automatically filled on websites | -| Allow Browser | Whether Internet Explorer is allowed on the device | -| Allow Cookies | Whether cookies are allowed | -| Allow Do Not Track headers | Whether Do Not Track headers are allowed | -| Allow InPrivate | Whether users can use InPrivate browsing | -| Allow Password Manager | Whether users can use Password Manager to save and manage passwords locally | -| Allow Search Suggestions in Address Bar | Whether search suggestions are shown in the address bar | -| Allow SmartScreen | Whether SmartScreen Filter is enabled | -| First Run URL | The URL to open when a user launches Microsoft Edge for the first time | -| Prevent Smart Screen Prompt Override For Files | Whether users can override the SmartScreen Filter warnings about downloading unverified files | -  -## Device operations - -In this section, you learn how MDM settings in Windows 10 Mobile enable the following scenarios: - -- [Device update](#device-update) -- [Device compliance monitoring](#device-comp) -- [Device inventory](#data-inv) -- [Remote assistance](#remote-assist) -- [Cloud services](#cloud-serv) - -### Device update - -To help protect mobile devices and their data, you must keep those devices updated. Windows Update automatically installs updates and upgrades when they become available. - -The device update features described in this section are available only in [Windows 10 Mobile Enterprise](#mobile-edition). You can use your MDM system to postpone system upgrades when you activate an Enterprise license on managed Windows 10 Mobile devices and control how updates and upgrades are applied. For example, you can disable updates altogether, defer updates and upgrades, and schedule the day and time to install updates, as you would with Windows Server Update Services (WSUS) on Windows 10 desktops running the [Current Branch for Business](introduction-to-windows-10-servicing.md). -Table 20 lists the Windows 10 Mobile Enterprise settings that you can use to configure updates and upgrades. - -Table 20. Windows 10 Mobile Enterprise update management settings - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingDescription
Allow automatic updateThe automatic update behavior for scanning, downloading, and installing updates; the behavior can be one of the following: -
    -

  • Notify users prior to downloading updates.

    • -

  • Automatically install updates, and then notify users to schedule a restart (this is the default behavior).

    • -

  • Automatically install and restart devices with user notification.

    • -

  • Automatically install and restart devices at a specified time.

    • -

  • Automatically install and restart devices without user interaction.

    • -

  • Turn off automatic updates.

    • -
Allow non Microsoft signed updateWhether automatic updates will accept updates that entities other than Microsoft have signed
Allow update serviceWhether devices can obtain updates from Windows Update, WSUS, or Windows Store
Monthly security updates deferredWhether monthly updates (for example, security patches) are deferred (You can defer updates up to 4 weeks.)
Nonsecurity upgrades deferredWhether nonsecurity upgrades are deferred (You can defer upgrades up to 4 weeks.)
Pause update deferralsWhether the device should skip an update cycle (This setting is valid only when you configure devices to defer updates or upgrades.)
Require update approvalWhether approval is required before updates can be installed on devices (If approval is required, any updates that have an End User License Agreement [EULA] are automatically accepted on the user’s behalf.)
Schedule install timeThe scheduled time at which updates are installed
Scheduled install dayThe schedule of days on which updates are installed
Update deferral periodHow long updates should be deferred
Update service URLThe name of a WSUS server from which to download updates instead of Windows Update
Upgrade deferral periodHow long Windows 10 Mobile upgrades should be deferred
-  -In addition to configuring how Windows 10 Mobile Enterprise obtains updates, you can manage individual Windows 10 Mobile updates. Table 21 provides information about approved updates to help you control the rollout of new updates to Windows 10 Mobile Enterprise devices. - -Table 21. Windows 10 Mobile Enterprise approved update information - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingDescription
Approved updatesA list of approved updates. Each update in the list includes the Approved Time setting, which specifies the update approval time. Any approved updates automatically accept EULAs on behalf of users.
Failed updatesA list of updates that failed during installation. Each update in the list includes the following settings: -
    -

  • H Result. The update failure code

    • -

  • Status. The failed update state (for example, download, install)

    • -
Installed updatesA list of updates that are installed on the device.
Installable updatesA list of updates that are available for installation. Each update in the list includes the following settings: -
    -

  • Type. The type of update available for installation, set to one of the following values:

    -
      -

    • 0 (no type)

      • -

    • 1 (security)

      • -

    • 2 (critical)

      • -
    • -

  • Revision Number. The revision number for the update used to get metadata for the update during synchronization.

    • -
Pending reboot updatesA list of updates that require a restart to complete update installation. Each update in the last has the Installed Time setting enabled, which specifies installation time for the update.
Last successful scan timeThe last time a successful update scan was completed.
Defer upgradeWhether the upgrade is deferred until the next update cycle.
-  - -### Device compliance monitoring - -You can use your MDM system to monitor compliance. Windows 10 Mobile provides audit information to track issues or perform remedial actions. This information helps you ensure that devices are configured to comply with organizational standards. - -You can also assess the health of devices that run Windows 10 Mobile and take enterprise policy actions. The process that the health attestation feature in Windows 10 Mobile uses is as follows: - -1. The health attestation client collects data used to verify device health. -2. The client forwards the data to the Health Attestation Service (HAS). -3. The HAS generates a Health Attestation Certificate. -4. The client forwards the Health Attestation Certificate and related information to the MDM system for verification. - -For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). - -Depending on the results of the health state validation, an MDM system can take one of the following actions: - -- Allow the device to access resources. -- Allow the device to access resources but identify the device for further investigation. -- Prevent the device from accessing resources. - -Table 21 lists data points that the HAS collects and evaluates from devices that run Windows 10 Mobile to determine the action to perform. For most of these data points, the MDM system can take one of the following actions: - -- Disallow all access. -- Disallow access to high-business-impact assets. -- Allow conditional access based on other data points that are present at evaluation time—for example, other attributes on the health certificate or a device’s past activities and trust history. -- Take one of the previous actions, and also place the device on a watch list to monitor it more closely for potential risks. -- Take corrective action, such as informing IT administrators to contact the owner and investigate the issue. - -Table 21. Windows 10 Mobile HAS data points - -| Data point | Description | -|----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Attestation Identity Key (AIK) present | Indicates that an AIK is present (in other words, the device can be trusted more than a device without an AIK). | -| Data Execution Prevention (DEP) enabled | Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. | -| BitLocker status | BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. | -| Secure Boot enabled | Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. | -| Code integrity enabled | Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. | -| Safe mode | Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. | -| Running Windows Preinstallation Environment (Windows PE) | Whether the device is running Windows PE. A device running Windows PE isn’t as secure as a device running Windows 10 Mobile. | -| Boot debug enabled | Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. | -| OS kernel debugging enabled | Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. | -| Test signing enabled | Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. | -| Boot Manager Version | The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). | -| Code integrity version | Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). | -| Secure Boot Configuration Policy (SBCP) present | Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. | -| Boot cycle whitelist | The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. | -  -### Device inventory - -Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely, and you can use the system’s reporting capabilities to analyze device resources and information. With this information, you can determine the current hardware and software resources of the device (for example, installed updates). - -Table 22 lists examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. - -Table 22. Windows 10 Mobile software and hardware inventory examples - -| Setting | Description | -| - | - | -| Installed enterprise apps | List of the enterprise apps installed on the device | -| Device name | The device name configured for the device | -| Firmware version | Version of firmware installed on the device | -| Operating system version | Version of the operating system installed on the device | -| Device local time | Local time on the device | -| Processor type | Processor type for the device | -| Device model | Model of the device as defined by the manufacturer | -| Device manufacturer | Manufacturer of the device | -| Device processor architecture | Processor architecture for the device | -| Device language | Language in use on the device | -| Phone number | Phone number assigned to the device | -| Roaming status | Indicates whether the device has a roaming cellular connection | -| International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) | Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user | | IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device | -| Wi-Fi media access control (MAC) address | MAC address assigned to the Wi-Fi adapter in the device | -| Wi-Fi DNS suffix and subnet mask | DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device | -| Secure Boot state | Indicates whether Secure Boot is enabled | -| Enterprise encryption policy compliance | Indicates whether the device is encrypted | -  -### Remote assistance - -The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: - -- **Remote lock.** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it but not immediately (for example, leaving the device at a customer site). -- **Remote PIN reset.** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost, and users are able to gain access to their devices quickly. -- **Remote ring.** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. -- **Remote find.** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. To configure Windows 10 Mobile remote find, use the settings in Table 23. The remote find feature returns the most current latitude, longitude, and altitude of the device. + +**Managing the Update Experience** + +*Applies to: Corporate devices with Enterprise edition* + +Set update client experience with [Allowautomaticupdate](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates. + +This can include: +- Notifying users prior to downloading updates. +- Automatically downloading updates, and then notifying users to schedule a restart (this is the default behavior if this policy is not configured). +- Automatically downloading and restarting devices with user notification. +- Automatically downloading and restarting devices at a specified time. +- Automatically downloading and restarting devices without user interaction. +- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates. + +In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.). + +**Managing the source of updates with MDM** + +*Applies to: Corporate devices with Enterprise edition* + +Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system. + +Learn more about [Windows Update for Business](../plan/windows-update-for-business.md). + +IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS. + +**Managing Updates with Windows Update Server** + +*Applies to: Corporate devices with Enterprise edition* + +When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices. + +Learn more about [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/en-us/windowsserver/bb332157.aspx) + +**Querying the device update status** + +*Applies to: Personal and corporate devices* + +In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates. + +The device update status query provides an overview of: +- Installed updates: A list of updates that are installed on the device. +- Installable updates: A list of updates that are available for installation. +- Failed updates: A list of updates that failed during installation, including indication of why the update failed. +- Pending reboot: A list of updates that require a restart to complete update installation. +- Last successful scan time: The last time a successful update scan was completed. +- Defer upgrade: Whether the upgrade is deferred until the next update cycle. + +### Device health + +*Applies to: Personal and corporate devices* + +Device Health Attestation (DHA) is another line of defense that is new to Windows 10 Mobile. It can be used to remotely detect devices that lack a secure configuration or have vulnerabilities that could allow them to be easily exploited by sophisticated attacks. + +Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN. + +The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. + +The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that: +- Run Windows 10 operating system (mobile phone or PC) +- Support Trusted Module Platform (TPM 1.2 or 2.0) in discrete of firmware format +- Are managed by a DHA-enabled device management solution (Intune or third-party MDM) +- Operate in cloud, hybrid, on-premises, and BYOD scenarios + +DHA-enabled device management solutions help IT managers create a unified security bar across all managed Windows 10 Mobile devices. This allows IT managers to: +- Collect hardware attested data (highly assured) data remotely +- Monitor device health compliance and detect devices that are vulnerable or could be exploited by sophisticated attacks +- Take actions against potentially compromised devices, such as: +- Trigger corrective actions remotely so offending device is inaccessible (lock, wipe, or brick the device) +- Prevent the device from getting access to high-value assets (conditional access) +- Trigger further investigation and monitoring (route the device to a honeypot for further monitoring) +- Simply alert the user or the admin to fix the issue + +>**Note:** Windows Device Health Attestation Service can be used for conditional access scenarios which may be enabled by Mobile Device Management solutions (e.g.: Microsoft Intune) and other types of management systems (e.g.: SCCM) purchased separately. + +For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](../keep-secure/windows-10-mobile-security-guide.md). + +Thisis a lists of attributes that are supported by DHA and can trigger the corrective actions mentioned above. +- **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK). +- **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. +- **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. +- **Secure Boot enabled** Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. +- **Code integrity enabled** Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. +- **Safe mode** Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. +- **Boot debug enabled** Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. +- **OS kernel debugging enabled** Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. +- **Test signing enabled** Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. +- **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). +- **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). +- **Secure Boot Configuration Policy (SBCP) present** Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. +- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. + +**Example scenario** + +Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. + +Here is what occurs when a smartphone is turned on: +1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. +2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. +3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. +4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. +6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. + +### Asset reporting + +*Applies to: Corporate devices with Enterprise edition* + +Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (e.g., installed updates). + +The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. + +- **Installed enterprise apps** List of the enterprise apps installed on the device +- **Device name** The device name configured for the device +- **Firmware version** Version of firmware installed on the device +- **Operating system version** Version of the operating system installed on the device +- **Device local time** Local time on the device +- **Processor type** Processor type for the device +- **Device model** Model of the device as defined by the manufacturer +- **Device manufacturer** Manufacturer of the device +- **Device processor architecture** Processor architecture for the device +- **Device language** Language in use on the device +- **Phone number** Phone number assigned to the device +- **Roaming status** Indicates whether the device has a roaming cellular connection +- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user +- **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device +- **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device +- **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device +- **Secure Boot state** Indicates whether Secure Boot is enabled +- **Enterprise encryption policy compliance** Indicates whether the device is encrypted + +### Manage telemetry + +*Applies to: Corporate devices with Windows 10 Mobile Enterprise edition* + +Microsoft uses telemetry (diagnostics, performance, and usage data) from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Telemetry helps keep Windows devices healthy, improve the operating system, and personalize features and services. + +You can control the level of data that telemetry systems collect. To configure devices, specify one of these levels in the Allow Telemetry setting with your MDM system. + +For more information, see [Configure Windows telemetry in Your organization](configure-windows-telemetry-in-your-organization.md). + +>**Note:** Telemetry can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. + +### Remote assistance + +*Applies to: Personal and corporate devices* + +The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: +- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (e.g., leaving the device at a customer site). +- **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices. +- **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. +- **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device. + +**Remote assistance policies** +- **Desired location accuracy** The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters +- **Maximum remote find** Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes +- **Remote find timeout** The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. -Table 23. Windows 10 Mobile remote find settings +>**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Windows Store. -| Setting | Description | -|---------------------------|---------------------------------------------------------------------------------------------------------------------------------| -| Desired location accuracy | The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters | -| Maximum remote find | Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes | -| Remote find timeout | The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds | -  -### Cloud services +## Retire -On mobile devices that run Windows 10 Mobile, users can easily connect to apps and data. As a result, they frequently connect to cloud services that provide user notifications and collect telemetry (usage data). Windows 10 Mobile enables organizations to manage how devices consume these cloud services. +*Applies to: Corporate and Personal devices* -**Manage push notifications** +Device retirement is the last phase of the device lifecycle, which in today’s business environment averages about 18 months. After that time period, employees want the productivity and performance improvements that come with the latest hardware. It’s important that devices being replaced with newer models are securely retired since you don’t want any company data to remain on discarded devices that could compromise the confidentiality of your data. This is typically not a problem with corporate devices, but it can be more challenging in a personal device scenario. You need to be able to selectively wipe all corporate data without impacting personal apps and data on the device. IT also needs a way to adequately support users who need to wipe devices that are lost or stolen. -The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. -Push notifications can affect battery life, however, so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. When battery saver is on, Windows 10 Mobile disables the receipt of push notifications to save energy. +Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected. -There is an exception to this behavior, however. In Windows 10 Mobile, the **Always allowed** battery saver settings (found in the Settings app) allow apps to receive push notifications even when battery saver is on. Users can manually configure this list, or you can use the MDM system to configure it—that is, you can use the battery saver settings URI scheme in Windows 10 Mobile (**ms-settings:batterysaver-settings**) to configure these settings. -For more information about push notifications, see [Windows Push Notification Services (WNS) overview](http://go.microsoft.com/fwlink/p/?LinkId=734060). +>**Note:** All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. -**Manage telemetry** +**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world. -As people use Windows 10 Mobile, it can collect performance and usage telemetry that helps Microsoft identify and troubleshoot problems as well as improve its products and services. Microsoft recommends that you select **Full** for this setting. -Microsoft employees, contractors, vendors, and partners might have access to relevant portions of the information that Windows 10 Mobile collects, but they are permitted to use the information only to repair or improve Microsoft products and services or third-party software and hardware designed for use with Microsoft products and services. +If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data. -You can control the level of data that MDM systems collect. Table 24 lists the data levels that Windows 10 Mobile collects and provides a brief description of each. To configure devices, specify one of these levels in the **Allow Telemetry** setting. -Table 24. Windows 10 Mobile data collection levels -| Level of data | Description | -|- | - | -| Security | Collects only the information required to keep Windows 10 Mobile enterprise-grade secure, including information about telemetry client settings, the Malicious Software Removal Tool, and Windows Defender. This level is available only on Windows 10 Enterprise, Windows 10 Education, and Windows 10 IoT Core. For Windows 10 Mobile, this setting disables Windows 10 Mobile telemetry. | -| Basic | Provides only the data vital to the operation of Windows 10 Mobile. This data level helps keep Windows 10 Mobile and apps running properly by letting Microsoft know the device’s capabilities, what’s installed, and whether Windows is operating correctly. This option also turns on basic error reporting back to Microsoft. By selecting this option, you allow Microsoft to provide updates through Windows Update, including malicious software protection through the Malicious Software Removal Tool. | -| Enhanced | Includes all Basic data plus data about how users use Windows 10 Mobile, such as how frequently or how long they use certain features or apps and which apps they use most often. This option also lets operating system collect enhanced diagnostic information, such as the memory state of a device when a system or app crash occurs, and measure reliability of devices, the operating system, and apps. | -| Full | Includes all Basic and Enhanced data and also turns on advanced diagnostic features that collect additional data from devices, such as system files or memory snapshots, which may unintentionally include parts of documents user are working on when a problem occurred. This information helps Microsoft further troubleshoot and fix problems. If an error report contains personal data, Microsoft does not use that information to identify, contact, or target advertising to users. | -  -## Device retirement +A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system. -Device retirement (unenrollment) is the last phase of the device life cycle. Historically, mobile device retirement has been a complex and difficult process for organizations. When the organization no longer needs devices, it must remove (wipe) corporate data from them. BYOD scenarios make retirement even more complex because users expect their personal apps and data to remain untouched. Therefore, organizations must remove their data without affecting users’ data. +**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. -You can remotely remove all corporate data from devices that run Windows 10 Mobile without affecting existing user data (partial or enterprise wipe). The help desk or the devices’ users can initiate device retirement. When retirement is complete, Windows 10 Mobile returns the devices to a consumer state, as they were before enrollment. The following list summarizes the corporate data removed from a device when it’s retired: +**Settings for personal or corporate device retirement** +- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow user to reset phone** Whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults -- Email accounts -- Enterprise-issued certificates -- Network profiles -- Enterprise-deployed apps -- Any data associated with the enterprise-deployed apps ->**Note:**  All these features are in addition to the device’s software and hardware factory reset features, which users can use to restore devices to their factory configuration. -  -To specify whether users can delete the workplace account in Control Panel and unenroll from the MDM system, enable the **Allow Manual MDM Unenrollment** setting. Table 25 lists additional Windows 10 remote wipe settings that you can use the MDM system to configure. - -Table 25. Windows 10 Mobile remote wipe settings - -| Setting | Description | -|-------------------------------|----------------------------------------------------------------------------------------------------------------------| -| Wipe | Specifies that a remote wipe of the device should be performed | -| Allow manual MDM unenrollment | Whether users are allowed to delete the workplace account (in other words, unenroll the device from the MDM system) | -| Allow user to reset phone | Whether users are allowed to use Control Panel or hardware key combinations to return the device to factory defaults | -  ## Related topics - [Mobile device management](http://go.microsoft.com/fwlink/p/?LinkId=734050) -- [Enterprise Mobility Suite](http://go.microsoft.com/fwlink/p/?LinkId=723984) +- [Enterprise Mobility + Security](http://go.microsoft.com/fwlink/p/?LinkId=723984) - [Overview of Mobile Device Management for Office 365](http://go.microsoft.com/fwlink/p/?LinkId=734052) - [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkId=722910) + + +## Revision History + +- November 2015 Updated for Windows 10 Mobile (version 1511) +- August 2016 Updated for Windows 10 Mobile Anniversary Update (version 1607) + From a87920d852bfe1ba4d9b794c7e6e2d978fc7b3ec Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 4 Aug 2016 10:26:44 -0700 Subject: [PATCH 016/421] adding beta disclaimer --- windows/keep-secure/windows-10-mobile-security-guide.md | 2 ++ windows/manage/windows-10-mobile-and-mdm.md | 2 ++ 2 files changed, 4 insertions(+) diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index 4f36cf04e5..e8dc63b513 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -13,6 +13,8 @@ author: AMeeus *Applies to Windows 10 Mobile, version 1511 and Windows Mobile, version 1607* +[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + >This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security. Smartphones now serve as a primary productivity tool for business workers and, just like desktops or laptops, need to be secured against malware and data theft. Protecting these devices can be challenging due to the wide range of device operating systems and configurations and the fact that many employees use their own personal devices. IT needs to secure corporate assets on every device, but also ensure the privacy of the user’s personal apps and data. diff --git a/windows/manage/windows-10-mobile-and-mdm.md b/windows/manage/windows-10-mobile-and-mdm.md index 1124f9bd8e..d68cac6b72 100644 --- a/windows/manage/windows-10-mobile-and-mdm.md +++ b/windows/manage/windows-10-mobile-and-mdm.md @@ -14,6 +14,8 @@ author: AMeeus *Applies to: Windows 10 Mobile, version 1511 and Windows 10 Mobile, version 1607* +[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. From f08a8f742ed34e7e5cf262df9ef48898a8e36326 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 5 Aug 2016 10:08:28 -0700 Subject: [PATCH 017/421] adding localizationpriority YAML metadata --- windows/keep-secure/windows-10-mobile-security-guide.md | 1 + windows/manage/windows-10-mobile-and-mdm.md | 1 + 2 files changed, 2 insertions(+) diff --git a/windows/keep-secure/windows-10-mobile-security-guide.md b/windows/keep-secure/windows-10-mobile-security-guide.md index e8dc63b513..54f7343cd7 100644 --- a/windows/keep-secure/windows-10-mobile-security-guide.md +++ b/windows/keep-secure/windows-10-mobile-security-guide.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, mobile +localizationpriority: high author: AMeeus --- # Windows 10 Mobile security guide diff --git a/windows/manage/windows-10-mobile-and-mdm.md b/windows/manage/windows-10-mobile-and-mdm.md index d68cac6b72..1ce5e8bf3f 100644 --- a/windows/manage/windows-10-mobile-and-mdm.md +++ b/windows/manage/windows-10-mobile-and-mdm.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile, devices, security +localizationpriority: high author: AMeeus --- From b4855451c0b96485ba9716f3cc83457a76cb665f Mon Sep 17 00:00:00 2001 From: Iaan Date: Fri, 5 Aug 2016 14:25:59 -0700 Subject: [PATCH 018/421] Add locpri (medium) --- .../keep-secure/configure-windows-defender-in-windows-10.md | 1 + .../keep-secure/enable-pua-windows-defender-for-windows-10.md | 1 + .../get-started-with-windows-defender-for-windows-10.md | 1 + .../run-cmd-scan-windows-defender-for-windows-10.md | 1 + .../troubleshoot-windows-defender-in-windows-10.md | 1 + .../use-powershell-cmdlets-windows-defender-for-windows-10.md | 1 + windows/keep-secure/windows-defender-block-at-first-sight.md | 4 ++++ .../keep-secure/windows-defender-enhanced-notifications.md | 1 + windows/keep-secure/windows-defender-in-windows-10.md | 1 + windows/keep-secure/windows-defender-offline.md | 1 + 10 files changed, 13 insertions(+) diff --git a/windows/keep-secure/configure-windows-defender-in-windows-10.md b/windows/keep-secure/configure-windows-defender-in-windows-10.md index 71ec31b565..93469dafa2 100644 --- a/windows/keep-secure/configure-windows-defender-in-windows-10.md +++ b/windows/keep-secure/configure-windows-defender-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- diff --git a/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md b/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md index 72171eec5e..113656af14 100644 --- a/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md +++ b/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: detect ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: dulcemv --- diff --git a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md index fe5431ac69..f7c920bb4f 100644 --- a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md +++ b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- diff --git a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md index 595d3e6855..2234eebd86 100644 --- a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md +++ b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: mjcaparas --- diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md index a53f073958..3b12429458 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- diff --git a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md b/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md index 088acf33fa..0ab40df034 100644 --- a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md +++ b/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index 71894a0846..a132d23ada 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- @@ -21,6 +22,9 @@ Block at First Sight is a feature of Windows Defender cloud protection that prov You can enable Block at First Sight with Group Policy or individually on endpoints. +> [!NOTE] +> The Block at First Sight feature is not supported in System Center Configuration Manager. You can enable the pre-requisite settings in Configuration Manager, but you can only enable Black at First Sight with Group Policy or by manually changing the settings on individual endpoints. + ## Backend processing and near-instant determinations When a Windows Defender client encounters a suspicious but previously undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. diff --git a/windows/keep-secure/windows-defender-enhanced-notifications.md b/windows/keep-secure/windows-defender-enhanced-notifications.md index e7ce19cd26..c3f51393f2 100644 --- a/windows/keep-secure/windows-defender-enhanced-notifications.md +++ b/windows/keep-secure/windows-defender-enhanced-notifications.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- diff --git a/windows/keep-secure/windows-defender-in-windows-10.md b/windows/keep-secure/windows-defender-in-windows-10.md index e052d1a3bb..7ad3e53061 100644 --- a/windows/keep-secure/windows-defender-in-windows-10.md +++ b/windows/keep-secure/windows-defender-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: jasesso --- diff --git a/windows/keep-secure/windows-defender-offline.md b/windows/keep-secure/windows-defender-offline.md index bdd1e45d8b..a90a308ed7 100644 --- a/windows/keep-secure/windows-defender-offline.md +++ b/windows/keep-secure/windows-defender-offline.md @@ -8,6 +8,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security +localizationpriority: medium author: iaanw --- From b80bf5345d4b03ebfe61f5ed5484bd0df72b4ff8 Mon Sep 17 00:00:00 2001 From: Iaan Date: Fri, 5 Aug 2016 14:26:40 -0700 Subject: [PATCH 019/421] revoke note for settings --- windows/keep-secure/windows-defender-block-at-first-sight.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index a132d23ada..de89c2fde6 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -22,9 +22,6 @@ Block at First Sight is a feature of Windows Defender cloud protection that prov You can enable Block at First Sight with Group Policy or individually on endpoints. -> [!NOTE] -> The Block at First Sight feature is not supported in System Center Configuration Manager. You can enable the pre-requisite settings in Configuration Manager, but you can only enable Black at First Sight with Group Policy or by manually changing the settings on individual endpoints. - ## Backend processing and near-instant determinations When a Windows Defender client encounters a suspicious but previously undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. From f209543ff742461b2c339f9726721f932c8bd3c5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 8 Aug 2016 07:16:45 -0700 Subject: [PATCH 020/421] add Important --- windows/manage/configure-windows-10-taskbar.md | 3 +++ ...-10-start-screens-by-using-provisioning-packages-and-icd.md | 3 +++ 2 files changed, 6 insertions(+) diff --git a/windows/manage/configure-windows-10-taskbar.md b/windows/manage/configure-windows-10-taskbar.md index b96590c3b1..f0d73fc38c 100644 --- a/windows/manage/configure-windows-10-taskbar.md +++ b/windows/manage/configure-windows-10-taskbar.md @@ -40,6 +40,9 @@ To configure the taskbar: * Use `` and Desktop Application Link Path to pin desktop applications. 3. Apply the layout modification XML file to devices using [Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) or a [provisioning package created in Windows Imaging and Configuration Designer (Windows ICD)](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md). +>[!IMPORTANT] +>If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. + ### Tips for finding AUMID and Desktop Application Link Path In the layout modification XML file, you will need to add entries for applications in the XML markup. In order to pin an application, you need either its AUMID or Desktop Application Link Path. diff --git a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 2fcd71d6ad..b2cf0eebb1 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -23,6 +23,9 @@ localizationpriority: medium In Windows 10 Enterprise and Windows 10 Education, version 1607, you can use a provisioning package that you create with Windows Imaging and Configuration Designer (ICD) tool to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. +>[!IMPORTANT] +>If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. + **Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) ## How Start layout control works From 6c4e74f391ea99022eb9012b56602e0954791a7a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 8 Aug 2016 07:49:31 -0700 Subject: [PATCH 021/421] high traffic loc tags --- education/windows/windows-editions-for-education-customers.md | 1 + .../activate-using-active-directory-based-activation-client.md | 2 +- windows/deploy/activate-using-key-management-service-vamt.md | 2 +- windows/deploy/activate-windows-10-clients-vamt.md | 2 +- windows/deploy/install-configure-vamt.md | 1 + windows/deploy/install-kms-client-key-vamt.md | 1 + windows/deploy/install-product-key-vamt.md | 1 + windows/deploy/install-vamt.md | 1 + windows/deploy/provision-pcs-for-initial-deployment.md | 2 +- windows/deploy/provision-pcs-with-apps-and-certificates.md | 2 +- windows/deploy/provisioning-packages.md | 1 + windows/deploy/volume-activation-windows-10.md | 2 +- windows/keep-secure/microsoft-passport-guide.md | 1 + windows/keep-secure/vpn-profile-options.md | 2 +- windows/manage/administrative-tools-in-windows-10.md | 1 + windows/manage/changes-to-start-policies-in-windows-10.md | 2 +- windows/manage/configure-windows-10-taskbar.md | 2 +- windows/manage/customize-and-export-start-layout.md | 2 +- ...customize-windows-10-start-screens-by-using-group-policy.md | 2 +- windows/manage/index.md | 1 + windows/manage/introduction-to-windows-10-servicing.md | 1 + windows/manage/manage-corporate-devices.md | 2 +- windows/manage/manage-tips-and-suggestions.md | 2 +- windows/manage/new-policies-for-windows-10.md | 2 +- windows/manage/windows-10-start-layout-options-and-policies.md | 2 +- windows/manage/windows-spotlight.md | 2 +- windows/plan/windows-update-for-business.md | 3 ++- 27 files changed, 28 insertions(+), 17 deletions(-) diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index 9eccc9be96..adb0625f1e 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -7,6 +7,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu author: CelesteDG +localizationpriority: high --- # Windows 10 editions for education customers diff --git a/windows/deploy/activate-using-active-directory-based-activation-client.md b/windows/deploy/activate-using-active-directory-based-activation-client.md index cd91b2b614..9c8f4c7fa1 100644 --- a/windows/deploy/activate-using-active-directory-based-activation-client.md +++ b/windows/deploy/activate-using-active-directory-based-activation-client.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: greg-lindsay -localizationpriority: medium +localizationpriority: high --- # Activate using Active Directory-based activation diff --git a/windows/deploy/activate-using-key-management-service-vamt.md b/windows/deploy/activate-using-key-management-service-vamt.md index 3fc787f902..2bb06acd4e 100644 --- a/windows/deploy/activate-using-key-management-service-vamt.md +++ b/windows/deploy/activate-using-key-management-service-vamt.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Activate using Key Management Service diff --git a/windows/deploy/activate-windows-10-clients-vamt.md b/windows/deploy/activate-windows-10-clients-vamt.md index c110f8233c..478ceda691 100644 --- a/windows/deploy/activate-windows-10-clients-vamt.md +++ b/windows/deploy/activate-windows-10-clients-vamt.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Activate clients running Windows 10 diff --git a/windows/deploy/install-configure-vamt.md b/windows/deploy/install-configure-vamt.md index 49b3f8ec44..eb904768ad 100644 --- a/windows/deploy/install-configure-vamt.md +++ b/windows/deploy/install-configure-vamt.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS +localizationpriority: high --- # Install and Configure VAMT diff --git a/windows/deploy/install-kms-client-key-vamt.md b/windows/deploy/install-kms-client-key-vamt.md index 9605053d6a..f1774ca7c8 100644 --- a/windows/deploy/install-kms-client-key-vamt.md +++ b/windows/deploy/install-kms-client-key-vamt.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS +localizationpriority: high --- # Install a KMS Client Key diff --git a/windows/deploy/install-product-key-vamt.md b/windows/deploy/install-product-key-vamt.md index 71817b7b80..f03f3510df 100644 --- a/windows/deploy/install-product-key-vamt.md +++ b/windows/deploy/install-product-key-vamt.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS +localizationpriority: high --- # Install a Product Key diff --git a/windows/deploy/install-vamt.md b/windows/deploy/install-vamt.md index 07a9a72b5b..4be81d78de 100644 --- a/windows/deploy/install-vamt.md +++ b/windows/deploy/install-vamt.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS +localizationpriority: high --- # Install VAMT diff --git a/windows/deploy/provision-pcs-for-initial-deployment.md b/windows/deploy/provision-pcs-for-initial-deployment.md index d3692b2073..6daf655797 100644 --- a/windows/deploy/provision-pcs-for-initial-deployment.md +++ b/windows/deploy/provision-pcs-for-initial-deployment.md @@ -7,7 +7,7 @@ ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Provision PCs with common settings for initial deployment (simple provisioning) diff --git a/windows/deploy/provision-pcs-with-apps-and-certificates.md b/windows/deploy/provision-pcs-with-apps-and-certificates.md index 936f1b6f73..820e7ab47a 100644 --- a/windows/deploy/provision-pcs-with-apps-and-certificates.md +++ b/windows/deploy/provision-pcs-with-apps-and-certificates.md @@ -7,7 +7,7 @@ ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Provision PCs with apps and certificates for initial deployment (advanced provisioning) diff --git a/windows/deploy/provisioning-packages.md b/windows/deploy/provisioning-packages.md index 4630340ba6..fbeadf5826 100644 --- a/windows/deploy/provisioning-packages.md +++ b/windows/deploy/provisioning-packages.md @@ -7,6 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: mobile author: jdeckerMS +localizationpriority: high --- # Provisioning packages for Windows 10 diff --git a/windows/deploy/volume-activation-windows-10.md b/windows/deploy/volume-activation-windows-10.md index f1bda40ad4..594cb846f4 100644 --- a/windows/deploy/volume-activation-windows-10.md +++ b/windows/deploy/volume-activation-windows-10.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Volume Activation for Windows 10 diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index 45548bb40f..19858820e5 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -8,6 +8,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: security author: challum +localizationpriority: high --- # Microsoft Passport guide diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index ef04831e0b..8564ae357c 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # VPN profile options diff --git a/windows/manage/administrative-tools-in-windows-10.md b/windows/manage/administrative-tools-in-windows-10.md index cc42197767..ba99073d18 100644 --- a/windows/manage/administrative-tools-in-windows-10.md +++ b/windows/manage/administrative-tools-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS +localizationpriority: medium --- # Administrative Tools in Windows 10 diff --git a/windows/manage/changes-to-start-policies-in-windows-10.md b/windows/manage/changes-to-start-policies-in-windows-10.md index ad0589981e..a1f2799e53 100644 --- a/windows/manage/changes-to-start-policies-in-windows-10.md +++ b/windows/manage/changes-to-start-policies-in-windows-10.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Changes to Group Policy settings for Windows 10 Start diff --git a/windows/manage/configure-windows-10-taskbar.md b/windows/manage/configure-windows-10-taskbar.md index f0d73fc38c..aaa7856125 100644 --- a/windows/manage/configure-windows-10-taskbar.md +++ b/windows/manage/configure-windows-10-taskbar.md @@ -6,7 +6,7 @@ ms.prod: W10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Configure Windows 10 taskbar diff --git a/windows/manage/customize-and-export-start-layout.md b/windows/manage/customize-and-export-start-layout.md index 68d1056ac3..fca7068700 100644 --- a/windows/manage/customize-and-export-start-layout.md +++ b/windows/manage/customize-and-export-start-layout.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Customize and export Start layout diff --git a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md index 6c7c63c9cd..22fe513406 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Customize Windows 10 Start and taskbar with Group Policy diff --git a/windows/manage/index.md b/windows/manage/index.md index eba6dd0e9c..e3a69f2e47 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security author: jdeckerMS +localizationpriority: high --- # Manage and update Windows 10 diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index 8e531b3827..1e73d06398 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing author: greg-lindsay +localizationpriority: high --- # Windows 10 servicing options diff --git a/windows/manage/manage-corporate-devices.md b/windows/manage/manage-corporate-devices.md index c3bdd6979a..f291375dbb 100644 --- a/windows/manage/manage-corporate-devices.md +++ b/windows/manage/manage-corporate-devices.md @@ -8,7 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Manage corporate devices diff --git a/windows/manage/manage-tips-and-suggestions.md b/windows/manage/manage-tips-and-suggestions.md index f64642592b..2fbb2e3cda 100644 --- a/windows/manage/manage-tips-and-suggestions.md +++ b/windows/manage/manage-tips-and-suggestions.md @@ -7,7 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Manage Windows 10 and Windows Store tips, tricks, and suggestions diff --git a/windows/manage/new-policies-for-windows-10.md b/windows/manage/new-policies-for-windows-10.md index 6dc1d6a75b..15b40a44f3 100644 --- a/windows/manage/new-policies-for-windows-10.md +++ b/windows/manage/new-policies-for-windows-10.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # New policies for Windows 10 diff --git a/windows/manage/windows-10-start-layout-options-and-policies.md b/windows/manage/windows-10-start-layout-options-and-policies.md index c41206fb4c..5ad066ab3d 100644 --- a/windows/manage/windows-10-start-layout-options-and-policies.md +++ b/windows/manage/windows-10-start-layout-options-and-policies.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Manage Windows 10 Start and taskbar layout diff --git a/windows/manage/windows-spotlight.md b/windows/manage/windows-spotlight.md index 2af7597418..f6182e086b 100644 --- a/windows/manage/windows-spotlight.md +++ b/windows/manage/windows-spotlight.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Windows Spotlight on the lock screen diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index 67c4200203..f21911e790 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -7,7 +7,8 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing; devices -author: TrudyHa +author: jdeckerMS +localizationpriority: high --- # Windows Update for Business From 76d6c9b116734e22f00dab806d1e5615e30e89c9 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 8 Aug 2016 07:51:09 -0700 Subject: [PATCH 022/421] change history + loc tag --- .../deploy/use-the-volume-activation-management-tool-client.md | 2 +- .../manage/change-history-for-manage-and-update-windows-10.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deploy/use-the-volume-activation-management-tool-client.md b/windows/deploy/use-the-volume-activation-management-tool-client.md index 6eed17adf5..7efe6a23a3 100644 --- a/windows/deploy/use-the-volume-activation-management-tool-client.md +++ b/windows/deploy/use-the-volume-activation-management-tool-client.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Use the Volume Activation Management Tool diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index 67f0217f4c..f45e2f1553 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -17,7 +17,7 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | New or changed topic | Description | | --- | --- | -| [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Updated sample XML for combined Start and taskbar layout | +| [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Updated sample XML for combined Start and taskbar layout; added note to explain the difference between applying taskbar configuration by Group Policy and by provisioning package | ## RELEASE: Windows 10, version 1607 From 0871e047ed86519e82e7b29c41d14403246551bc Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Mon, 8 Aug 2016 08:03:11 -0700 Subject: [PATCH 023/421] Corrected improper usage of on-premise to on-premises --- windows/deploy/upgrade-analytics-get-started.md | 2 +- windows/deploy/upgrade-analytics-requirements.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index cb5931f6ba..61df9139e8 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -31,7 +31,7 @@ Each task is explained in detail in the following sections. ## Add Upgrade Analytics to Operations Management Suite -Upgrade Analytics is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/). +Upgrade Analytics is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/). If you are already using OMS, you’ll find Upgrade Analytics in the Solutions Gallery. Select the **Upgrade Analytics** tile in the gallery and then click **Add** on the solution's details page. Upgrade Analytics is now visible in your workspace. diff --git a/windows/deploy/upgrade-analytics-requirements.md b/windows/deploy/upgrade-analytics-requirements.md index 58fb28d579..5dc5a972e7 100644 --- a/windows/deploy/upgrade-analytics-requirements.md +++ b/windows/deploy/upgrade-analytics-requirements.md @@ -73,7 +73,7 @@ Before you get started configuring Upgrade Anatlyics, review the following tips **User authenticated proxies are not supported in this release.** User computers communicate with Microsoft through Windows telemetry. The Windows telemetry client runs in System context and requires a connection to various Microsoft telemetry endpoints. User authenticated proxies are not supported at this time. Work with your Network Administrator to ensure that user computers can communicate with telemetry endpoints. -**Upgrade Analytics does not support on-premise Windows deployments.** Upgrade Analytics is built as a cloud service, which allows Upgrade Analytics to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premise. +**Upgrade Analytics does not support on-premises Windows deployments.** Upgrade Analytics is built as a cloud service, which allows Upgrade Analytics to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premises. **In-region data storage requirements.** Windows telemetry data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Analytics solution in the Microsoft Operations Management Suite (OMS) portal. At the time this topic is being published, only OMS workspaces created in the East US and West Europe are supported. We’re adding support for additional regions and we’ll update this information when new international regions are supported. From a6bfb823e69a2f6ba876c456539874a7d605be99 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 8 Aug 2016 09:05:00 -0700 Subject: [PATCH 024/421] fix error --- .../customize-windows-10-start-screens-by-using-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md index 22fe513406..f2fbef8042 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-group-policy.md @@ -77,7 +77,7 @@ For information about deploying GPOs in a domain, see [Working with Group Policy You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**. **Note**   -This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment), later in this topic. +This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment). This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](http://go.microsoft.com/fwlink/p/?LinkId=620881). The guide was written for Windows Vista and the procedures still apply to Windows 10. From 40e1c8df764ed2bd127ecd781778f511e448751c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 8 Aug 2016 09:17:08 -0700 Subject: [PATCH 025/421] fixing typo in Group Policy --- windows/keep-secure/remote-credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/remote-credential-guard.md b/windows/keep-secure/remote-credential-guard.md index ce2fbc59b1..575cb5f7f2 100644 --- a/windows/keep-secure/remote-credential-guard.md +++ b/windows/keep-secure/remote-credential-guard.md @@ -61,7 +61,7 @@ You can use Remote Credential Guard on the client device by setting a Group Poli 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Credentials Delegation**. 2. Double-click **Restrict delegation of credentials to remote servers**. 3. In the **Use the following restricted mode** box: - - If you want to require either [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Remote Credential Guard, choose **Require Credential Guard**. In this configuration, Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Remote Credential Guard cannot be used. + - If you want to require either [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Remote Credential Guard, choose **Require Remote Credential Guard**. In this configuration, Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Remote Credential Guard cannot be used. > **Note:** Neither Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. From c900d894bfde8049ee3f55ab888babf8fe05d651 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Mon, 8 Aug 2016 10:36:51 -0700 Subject: [PATCH 026/421] Replace with better screenshot --- .../keep-secure/images/device-guard-gp.png | Bin 47736 -> 46125 bytes .../images/dg-fig7-enablevbsofkmci.png | Bin 48308 -> 66762 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/device-guard-gp.png b/windows/keep-secure/images/device-guard-gp.png index 169d2f245be210e8306e752823def4470bd97d10..c6713c2bf3b709dd878b4a1edbc5619d269d822d 100644 GIT binary patch literal 46125 zcmb??XH-*Nw=TUGL3&j|P!JG9ks48?3P^8K6aneI6GBmnG!^M3(t8sF2uLUbBE5$i zdWX<^$ldt9?>Xc9?m73KA7_uj(CnL&DeGlh13nN~%c;rX;8ezvU%Vs)K9f2t8M@)%P_R^a_XVJ+E&8SJoa^d>M962peomR3;BxI(NA}O9Rfg zYI^R_0GFmu91_0%>m%2`-DpW?F?loe;yiXYjuYD-72yMKl>g~ec#~Oo!8au%+$-Ik ztXH;PQ%LzwKO}39cQ&i~vew%e&CRA(ea^eLS$hVr`jS75!#RRsPhr`|LGeqbzDrEBW>})o z#yv`D>;?Ji=7ov7V__?H0%QH~zTa*2Qq)^BY=D&d@P$NxyB6!^;h}~y;k_B($Z5K( zsR&jwXIRp98@i zE;;0$E+aL!BI(iXxijtf>`RwA!eElmH{*8f_5$BiZONDiyRPhLLHO&4_=}V4Gy|^O z!iLCvHf6U2Wk z%Rs810|`K-od?y+E843}g?&=t4mPnCu117ARM)dfe@+?));Y4Jfl08_B&6TSXzEJu zXZX{lsV8*{r)yB&8m}X1&Q2tVD{ZQk9sLwb#3tau^TN__aX}3*AcfH~lgKB;)UOFE zJ$Lx_Unjr%wBd93B;3<�h#RIb(Qe+34A4)K$ll5edIv|7-<7^6<(Xk^MYZ7c^rZ_CV;WouwFp}x#eQlNbmr!ky)1!OB z>ju_%*%1%918#GASZ9(dvzcr@5)_T@G{9f)DIiFkmR10a=;;FGD^=!(iK3vpAg1k} zQ@)0SL5e(6e;P1&mqiaVBej!?3Lwe9+@35bJG&i#f${FVvZX4&+|hq{86v*39y`<2 zy=lj%62J-=iqkW`)1A>55*?*;Wo1@F-1f_qmMQNcb~@JW_aCfXe?1D%F4Cj+w7n9mCNZ#pJnBnQf`QOtbA>e*qf2O)ZJp zWBOd?BrCnNz)}-h)!V^*I%e4WL~{C>A>ZJwe(Bc=fZ_ASfx-nmcKC|&8|ykLLZwb2 zq9;q`E4zaqZ7wHqLsN>Lv_#UpY<06zg_bzPWG0L>HNZ?YweKM#r;4AFDpkktU8A2Q=W?O zG^8mpUEikN(>)OxU(eS+(sOG7P4eaIhzF;;Jy(oNT!1Hw0Fpk1n%;Zl_>0X{Nq#Ce zz1jHZ*Muc*=eS4DQ+C-Wcc;rEa1TVHQ`hz@7!n(zzO-(?zfW~wOkThDFp7r$&e=x@ zye{H(uqMstGJ^6$rZpv>y^oQ{{&X|0+X`N0Y!L@$GJK4#GY1~2!nbbm5!Ex?9}DBt z7wyHe0_HG{_TgL?bDv*Iga*PI&d37x&!DqTPFNf(ZE!~_b{Fk^o)2!@@58blZGl7c zFW2b(tx*(taoD`kl9tK++||d|o+zePwdRr0`l_wofIG_djKmE&AHRUN^?!)5&(75y z8^w)^D*Rwgq!`zG_@lw6=gAoncVTCwRhFt^Wbz|El!#SKk&NfC&X`BG&^E;mR|5Q= zHF0<$(SelReav1?z2&z$J9iJ$v>@k}b-#N<79kZ?nq$-Xdo(#z)5N!_X~R=*h}}0S zPG}TD_cqbQR({s6+vp@vh)agtxRo{kAq8=VlaJ#xq^Zou!;|+;{Ca!)8;CjTWQ+A= zKp7h41*^nGq@3TB-T4Uah}Ae{x;*x?-7Uwu-n?A$v#WqE(p|u$itc~i7r1~uLA0#) z+CCyIr)~O7=v0MJBNkA5$d5{TI@n6m&NF;wThPxW`eB18hmOd?%9n|rsrr?)ww-|z zOYWDh8G>dxpFwf3vV(0t6(0zmyW6d1uot0sJ4G!QTq2fGh%2B~=VK#>HrEZLg3 z8Xw4Ou>&@$-%AvxTVN^`_MdthYEL)t&o{fYPcHjrV#zOIsXGxH=+;8UgD*!2z=g3k z{GPEK?Zw~|>V|_o>W?ZI93c(}J$C<>%QKC>TM`(^uhhmp{a7NYS(?GHK?;VlUfULr zX-X&2rxq1s0|%_}?p!#&Mk8m0#J6squQlK*6Oa4alE8&B^3E=Xo*z)^$2>A4Ov8}> zkW+J-9M)R-73cm=sqm4uSKob~%9LaF*JrP(iJo!XW;&1o^MtaQa9Z8Z6Jv;bMv!NR z`4}hqBYY)W*9{yPL?hwA)JRLCxwJ=AUadu3x%XvMDGz~VxZKajh8|;PIOn{^0$BFZ z-n>Q7Q|*f*MsRDP^(FJ=%0Qy?CQ|rfJ=$ze8`eOAMe}3vpt}gi_T`@Rlar1a#{dK=ROokKk z+pzAnNFmqA=kJBl;o)~6GGr&8v)%e+#QDA9<8meUwC#1ZwYB#Lqi^Vguqgk1*sfUs z`bmKloTUm;(8B73h>k0s`Dusn$48twh?<`E>hEID4xT>Tov`!99Gcx^uv0K$FYlEP zSiDP-y`|}NjSGM}H-j!RpM+(NH3bxHo1AoR(nw?HDFQIdlin-!s7SK~?h7JxORQOP z3wkUqY8=hkF*QXBKbTBPlYUdGB=0zQJ4DetN-y4Q8)rQDot;>8Y9 zELCqyq584ChXF#5mCn4S@%-GmvAmRVaqN zBSUS)d_xwLQjIHR>P?cWpFD6&s?qv-uZyF5mudHOV{eqa+iU`hwC66{RB`8JK_Fzu zH>Y=;Wb?3BC;`7VcUky_w3pQA+T1JqVuLkgLx*RiiqW1ipXc~_nm92Kk=xU)a=xu3 zwv%@n8SGslhAp#?Ae53)H$pL`o8BQqzb;b@Xn`ml>^^CA9p zI@r9yl{o({OsqBLB{$P_xO9jC;(`N(&ma0bXR8Bz(h~*>6qst+r)g(@zV51FV%D<2 zdadcVumtbBjUh`99KWOCS8g_328n|SAkBxQ=6y29FF*>aTjSQSXu77$ZS-Xsb9U|@ zkV|3S70%wIu#TU4k_{chQc+w$`v+Z3dt>kMZXW&)CA0Fa7BesBZF=E#PL33YP#>|0 zU(Yh|60Y9#fA;PPbH_0l??s)gh_^|hUMYf(HP1}%l=V%5YuidHakSj3Z8UghU7}Sf7X^@2)^YEDiWfEwv4C&D zv-ln)_6hX<8cd+?M(WK)g+jbvBXT%|1>%3V8GFuG9yBae%jbj({=fFJAatZ$futZ74^FMHau<3@=!7FJU`PeJ^j=A!eSd1D`NbQmk35#2cGoybh z*bKr_Tc>6OkUp_o$onw}>1fJBxK(#)^~`uqoRmQ2_AAl881q=P{^@r*$$*|uof}W6 zd*p6M2>9tvNYt??ng1{pDBl-OtWWSBSq|&|dL))JJ_U~Us0mwq5?tjrJkwxaUc-pI z6O^3HS?M1LLHfqflVnuEamVuQWbuzS9^o0Y9;K}1b(-wmlELp5Nv9`0d41Myvstn4 z?eaTc2yPHIIU*(qS!7G6)_=a4SVoXt28o?eYxR>gnp*OgazxCy^cHBv)dnc0LC675 z+oLHYI=T)!ArQnIz_RVS;3t#m;;&vWPS&n;9na-)09j(n@+E^BbW7AV&oU;(ut_B;gcJ_?$49U1mg4M zlPnKcGJBf3hODe)N9Q~Xg{$ozMJ71PF2)Agm{9F0YP24Hx19r=?H9imj$bqE@~*ny zIo&V>{j9;{FhO*;#;E|lvYT2{T;gJRxn;JnC9W~Mg}NlZJRNVfvJKKp4+@3EHkBR3 zMPhHguc54~!>jQm%E#h|+0o@X*^1zMTnCWVtvSRk-#QHn@aKX`O_#g2ORc zNc>o7--~Qas*Ye07Mg_*vG#h0uVfEDKW0#}Wj%IiZY%oWx}@y&t^&WOq`}}o?PV`m zA?G{@MVb}7>t7+{U(FXPR-lwvWItTS0gDFC0fco95rwtAbC5 zedQeq+#!yY=Yr6h)gF9&HssPH;k`J>NCs_)b9{^n3zfb_!+wzGltDJrr<+4 z)c=`L;S=^+OD<0p?C?ROL(Ao1vrX;(+zru8Kh{B?qJcgUfyME{WZ4SQISPWOP&g3wR`Ql*A%2$pXru^Cxrqp@LhD2O+A%2FSSTs=~ z;=<*!)Yt`r?fT=5+Orh9-Q+%hBJ6<%_N@ohS8^HU%kG3d0teMVgKAJ`w=bdC4jTV8 z_}B@LVAegY4fKAuQ5Nkl44VO|IhO2XQs!jS=E0eoy<-5WS<(;Y6+`mRH6<6a(M|#T zBK~^lC`3NGpskUzs&;(yi&w*EhGU5e+NQjn1@S-r47NLo!V~&YqF&-9KEJ?d8igvXvbBd^ zEO1&})_~iWqj@X7Z>^l6ifRl{8lQWlSM-j5&Gs1Ukmg8WsQmX+Q$cF`S_{dJWr!yN zFFoX(#l9no5>O?K)uS4HuB96Wig`|#c`BXG(e?EYUyE+RYH)Xd(p&j)82Z3%jmwpA zBKU_z;L%RL?PeZJ;}lYLcWSHAn|01%Dt2zd^=5PfcMl67D{kJ7+d3zqpS0Xk9FJ=1 z7%tB8K`~{-S{8O5#2;7&(J-8Vz3%&$LiAtid`Z$=`P4D7(B_4{i+;`GbI`@}A~Q(! zoZ3ddp-q?PRvDEQa^Pw62)t?BW3E=k&MI@7v0&^ip`{@IoX2QpEcPX`@%Pu5^s#2D8_s_ zp)0YKWQ3kL_0{2b2Rf9PE~#&PQWb1bd|?B{K{wU!hS~K6>fZFjLqR)O(x8{HVv*ja z2&{jiZt=Y}D0b{5#BIb~8LKf9$%)uizi@N zGDC7_Xi;Ne>VP#({}}SZySHz*F!r*3TWg0HyY%{y(QfeGQ+fHNt-Di5dt2IaoW>=x z#rc!qX>OsOLyhThtNKyRBEeX;*5Wz_cbKl-={jyy`DyS7Y*bnNP%0l5)>|LAi!X5t zIn?`;P)@YOCV#HVkNd;tJ0k>@az1dqUr*RjU$d>o`|?d6;FefJdpCZXFec4?btjWO z=|KP72m97Y6~tL##RH;-!QdDtN@@#lY*$k(_Bz6=J?!~@82ZUNC!#pG9o!B*4?iGJ z8iW{{VKvrdNiHtpTOUdvKB=v*X$(T0mP6l1mKnsN&I4%OoQjo$CQlye8G+rRu@p{5 z5iFcPJ1#k~S?{;DVR)(oY`gmtB& z!-~_c{x*xA*~*+%;cd8G2xQ-gt(-&ZRVd%DyZQ6f0sc53T{P%=6m>v%(f4oQL?}gm znm?_2fES#eJI$9zy@TK9;0cC4;NhWm!%8eTTpx7;NxPX!j%=?lq2JqaqmM;0pHc?6 z3@RsK56gp4K8)&Tr?C&jBYyzAX}cgnmr*ay5i9CMVRoe)Ks1$*bI&Qr@iY??Q7{#{X2Pjz^>hBoyL>4Iz9c6 zAw7#8?S%?{3p1JfR8DpmHn3?6(YgG3J|+#+9GUG7@8W{POVE)=Zw}2I`s?Kv+zenEx=)`yh8nZ4248M@~bo!8epfE zS08kilX|qYMyN>paImfykpQwYnbvO>X*QlF-SmMT4zlDJFQkjBbn?xpSFCufZkZ@Lzf-RFL?v6!yle9IqP*OJIL#BNSKES7 znDc^SDds-Rg4d9^To15w^D(H+b)aP_v0EClZ&Qvha04#7$-OtY)A7_L4u=C%Yh}aZ zE?cLRa%Bsz=VvL`aWtS~AvKx$yE*hpo=k9R?BO@qODxuM5bQ#GIr{_snladN^9LH@ zw7t@F#rgaOHg7&EpI6PY_P+)QEnHyu{OawTq8Ydi_J?Nh^b5u4Hz)n&JMS@UNb0m8 z_}O@Af_Q*PG-vwomwGC;1fKIaEJ-vax}z^&P4Z~Z>4IdaETH1+44zp;%t^@AG*6{Z*)Uvu@^HkT=k2avMz05yH>bDwmYwIj7>Lj5==<0atmPDKXRbuQ*DAxcVy6sWXXeijX*8d{#8JH>9_ZiU z-n%MI>C(w6M25d%j_Y`%=@YTXB)})+AEkE+yv$!r%8tZeJjKWV_V<4i8Jhq54RQfG z#%8Knt`vKSNm@gRnX0!aM(*)^B*M-2>7iy zpG$%s`vBFh7^&_17QoBCu0LH)-6u02e;4S_j;bORUCD9&an`DES^KfCO$goW0z#y* z*X9z{u-)eZn(Juss;3$B=U<~R@9edA3QwDubon zWpn&>!u0F0Sp^ey7YEgZ>obQSpAQpb(NaO_tZI^98$mKxT$Q&EafQ>5Lk7=HWRR2p z0xPoOCH~RocnCV+xc4xM>}1Flw>?>~$y_Br^K zOuWw7h6}dKrH-%JMFA#|kllcfY;KlIb01Vj{_v|Q^TEs#gTuWV_tXCjf*0ohAT%_z zo5eIQPoOw1t56qYK~8J%#Ndm&?J}=dW%=k-3%YQAC@nJt@Mm<8((3-#Jo; zKF&%0^umeVtO3CZ{d&?(KT!>Kl?6vx$pa&U19@#_Y_3kJI>O#o8?<3D-G=-sM2KQ5 z2hvBTUw{t?@cR%}49Wn5Il=Yy^V8JTwalyQJaCw-UR!!xe|>Yx!1)@JXPo+7M_I`a zNU}|Dx!l{3$76Gz@ylNuSrOG7te&!ZX=7>Tq9A=UAv!(`_wh2X3uJWRy|Gc-ZO$COXa^6RDTE@JGvN8NXOCm{I4wkHJ{I zT2nR~WE6yO5BUp0bQadBacw@KCId@XkVE2lew?oEckg7CIE6Vd=|lckSV@GuV*2bg&#egY5Fl;BLL4jog~hR8bGL;p7OX;)l9z z&klEMFS0e$xdKeW5}PHDrA;(o?6I}ghaY<1T0;;AuYDxINMc}rdNbe?GWv?R5?D+$ z6nnl~1;ca$6OS|hSzBG$LQZG)rl@_g@sNOo6WyLZFqp?qWUhO8-vwjXS-YLpjh%n| zc-7ydLaqV>!or(fiI9=lfP-vcy5;PFl~k17qmkb423g&knrjW)ouh^#quzb^Vqdqz zTK9tCbeXGgSAYeU8vnfe;40cNd}MEs3_-r?g+q%uZSu|1jz$aIIfMgdDAH86Dm< z5%uUsR<9|SFlKaw)(SZM9;}qA2-1Fb zoUWsXo+d&gAm>MOLYMPG&X=bv8&Jy^d0iLrj19k^;BPngQXZ0cQ{i20GW2qX!>Xr* z6=G`~{bOTcA3xGapRHyC@gsK1!Q8OIl;2ML9L6Q2Im?v_EJL^oU%70>;_W_84{3=& z6XHL&V*cK)KCicf#x3Hm?(r#lOuqY@rFYfwdJu3`4#*;Fk^O7O`d`?P$f(TYI=Roz z&t2N+^=E-pWdQrT_Sw~<-r|b~;$qE=FS(TGW|Mg1E~P!P0@v?ov)K!AZh|R~>T*xU z0`r$5dNtDU_q=EvPiN6x>pkLt@LK7uJ(;#Eaq(w`7NKxw=x}n=}F?#8}JO)ICerfFK~YR_)$<))N)-z zIw&TF>S7#*N&eGiwZr6rYx6Xzn0W`eTT*J3Y)v^R?#jx;U4QWhLKZ(NI-f2jZp>Y+ zU|y}=nptL6m;KD%&*F3T zw|2yyd(px3RUe&9*p;u%*`HS&vPmVmA4yC{M8}%gdk7%w38m2E*^l)r$x=DL*0VJP zvJV}fl!Iy*jXfQ^x3&43?Wpg+sk>LuR-wu8X^k}>G|eoi{&GXMit5Vf;&U7DkjDrt z=48AtATLb6)F>Bw_!W4b_wT#;t8@0fvK7=X-6RVIkak|-CRfb=6;JCn{5c~#xErFB zYyEJv8Q7rgn-01%W_`upLC&k^+3NE=7Ss#gIlstr`Yv0A@o*^^`Gb?9mgt)T7P&Z^ zL4DHMVGFypmtz~iYmHzzWc`^qFL%NYcY>97d^KcD?~4}r)g-N*BEOCibT9AsTg@)n zfc~=Qr$C7C^ONH6-;ry;98I1q@`57}m`Mb{yTX7%*aADSHi*@%$OC^v^#q~N1==@a zX}HB%2Y;B#sPtOiY1k|dt#Od*n4fK!-A3ih{HniZOR~DXl`Zetyx^JAgnkdy(+S_AfdBX#xXLs6> zGZxs&@ZvoO$cd|BZ2We!0i2n7%i-5dUW#n31q*A>x0H@`0AyWRO}DO^np%&znAp12 z;hjZFW3$uW`uC-ziaF!qo?Axj7oBH=4v%b2?d;mtDcnElIFW!SPQ^6msU#gq`S@B%hK+v&jUm&9tRJW8rRGV0kW&ZDs$|-&?Vjq z4BB{Q`*q#cJ1W4N%IALY!m*3n#)Uv2Ow7#9*|D-k*!bO9NBpZV<;nG(|H8uG=>GSy z>wm!Oe}l&Z{%AiG=!v7;5V@u^PULCM+wNEir)6@hy)}Pu%2AMChCA4{DY&TtfHdd&phJRCaWEW zx(K~^k%8<&-7g(`&l)NKd$8LycVTzbA96IyXXO49oEIp8Evw-@;F*dXJ_Lzo0pFR) zdAp)xVp1xdi^ae>!3O4bx6rowe?sgN&wiuLS=~kYCKb`04)CQ5h+%umtq%~8fSuZ1 zjp3JC_DKQE9VR`P?QJ5x8axd~0w=Q&{2GG3Dt1(e+R=mFGQu*CAvU+Yw{VHn zQf!6oKfeP?Ol!}^LL;@2b$umIuAX7Z1@w$ zkt!S%&0Q(D;l`;|WhGf{?o_wG`A>}Tu+~P_T)|#DBk}FGMkF1UX9*jXKJkW*CTzAI zedg)wRxBtwj95wM;LXV$teR_&<*EE< z$T5gqwp7j2(}!|QP&7z80QnREAtbu~YpC-czh>Bc;ed)FuNXYN$WtysU%2hRi4&vx zW!yQG)SY^^GTpZc8R0hwhZCE({mc;YC@lkG&C}!N>C>cauzm2Kls5eL^Zy?7_&~1$ z{?OZUS=LJZv0$rr<-MszVvoJ34dAD~(={V0mq`aK&d6X@H3x@i)49xNi8!gl>)Q^_ z4rX4O&xeQ)7aF<`{)sks!n8GHJmg@Hb^ZxDc?bVR(AoLdpo5DB>R#PO^6tmeUa2>M z8Q!a#3uWzoem_EjnqBfU6o?&(bidq8moyFczTtj}dM1y#xoaausK zz~~e4Q{i0Hnzdqq5SI8@Cu#v%RY=VAVgmBv-*Z_A)#i!6g#|yp!S9ES#Hqc?b7$Wt zE7dg~2Fm!^R(_|rW#F^5W5L)r=gDtD6R(fsH~*6q^bQ!r*Ur>$48A6DB72nP#lq(~ z$?~te^D3OW+IYO_H-6vpzQRznBhf#ElI3pwNxIy)#I__Hd6=|7^)}Rl+9nIc&Z<2E z4{w-I51T2Txpm>n@cL)mT0;(v@PfLGocc1cYMH#Tj7blnw5s$xw_>a)9hwnpTf zt)>HgXel!GNdzHsdB*!dR{NlG|0?$o#oUxW=w~}}#I4@c?UMP%T>RQ(jrq%%Hm9L3 zZ9ISmDqGd}=jp1qL7fs$k)D!$wyjd=m;FFI)1d-19%O)@>o&b1^w11J3LsOr)9R>p z*;(&nzOwHTb`MR{mw6qi#rrgIor5+^IENu}qti9?D@iO`kfHH|u7}%dZh%v|jo-4D zO1CbIpGj;fp(vjy3AUksw87kVC?7i!o59;{K&SB~fBBaGp(V)Z@h5SwQU7X;d~7^6 z5%E5f?DyFGRxHmcybqSb0YA*mj{VWu^|Tkyd2vA0WYuTreTZSn%f{ z&}!zs!ciTknwl?ik#Qt`TipAowNcSr|2YQ=OEM*}FXf_9hr#>>O(qXNx-vd-Llkyu=7v2>3e?I9d?oa+#BYnw-c)&U50~A>+!!A!ovCmJ8jYC&+^+GMamz zP@z(2f*2%b)hu-8U1XPJOQ-i5NyaIXrJ%n%3-4PW^f!f&*jRPn&y?8YX5MyZtgb_a z6@<)K*Ts0Ho%!Tq0eBDlA-4w^O~`}v6QkifZr|C5zPOU!Q@q6o|2tV{YSOCqa2ZBf zh|7)6rYQ=xk=Nawwta>2jS>C9JA&iYb;0n0tUlQhKtZR-qClTPHbl+MbgLs@#|^=m zPv0Z>?WS2a+Cf*fQW3Ef8`0R2bFZ7f+$MA5N$GlP4HPSQ3O=w5^vwoHhooN0FA3`( z<4t$lp*8YIN5-Yom0O4PlGkK37LlXOj0;02#0Fy!euSN1*^^d`g_V@h+%FJi!BAyP z70(z2RP+n!*vFN~Mo9}EmNHDIh*y1TWBR1lYj&BTdg$opHx2k)k+oyX%0XGI=Uu4S<4P1wh~9qwECE(#|28Op?ovfR(@9tN`?Rc~Do z7&>-{JepZjl7IS=xICBS6?4-k>UwPP>BBR>vWbi5zGqKrP#GhP2NWIt=qe-pmC||{ znQ0jfN1iI!Q#)kW#N=Vg`G*ME^wYF@NYw-^ut{XEntdU675{wCf-mYs#QkX^f58bI z(Mn@<@s9A+Y1;1va|8O!x>an1%F~26%&FLY^IL%$loRI#gLNo(P48F4j1qiAGrI(Gv_AtI2!Yg z&I4pjYFBz>ym<4#7K8xn>I9!&i?y^Jc2}z=;5R(ax0d>KDI2DNZH0LUXU@8Q#w3~U zi;7}gq-Qo91E8-q173`r`{=4@j&f4m;f+`Cv%U{m8Erb1m4`1&%C{p*~&E7zrmYHu{*V&%FIulx-&@Rk8>&7G-%IyXWS+&^U6ovphE=su9_-x+oNUiihkI6^FES$j!`Sn1PB>@=z0C^HP*b6_%j z?nXbcd1EQ6FZ-D9y1hh7BaA7vJ>PH3$WAfND+dEo>y`ZQK+fJkq6niTp5GOaW5-vT z=l6qCbFA;xh@c8~q=RvA;Gk&69jq&1`rVc#5e1AqcbP&Dd^Ql9k~vRQ3FO!bQ`eC$ zLm=;Eo?@Qove2w{U7eS~+5Ru$zu#4s)p~lnr+kgoAfq+i6RQHzjv4*{QFj7qxs{MU z$ao&qqsv1!V8Rh2ok044;YnSB5nhMJ!n{W32~ERdQD?6OcKEBAHep<$=HcCrdxMFt zMq_1-7bCdO^07EHnxkHyW)Iz(#+F|+7uOU@Nq@Q5?<$i=6{!^?|GACIG+oZV@_u0M ztzDaK4f0gQy5$WEuXzdUrfmG4^SL*fy<1U|BC`RCZt%GVL*-yxdRD3Q-P4ZUG_sjI zk3&N$$zQdkuTDXs z m$3rU4b)0w|zM7|8eTaL8v={%QqhDzR{{FWAD^TEICV>m-M>o*3ea7!H3Z$ER; ziyhL8Z#G^zj*+Oq+k+zmURM^i@hp_9f{iKeNKp>7@SLWuL+6Ng7%1gIMs_BgK>>4_Oby;4_pa zyL6HH6qWpI|Fg@rXXf+uP%2naD@}beVp+o-rBZwZ`oe};oka&sp=PI!rANhc6rR&R zw(>a~=vmZSIB}Q-`KIV(ulPpA+n)nb>WA5=?AmX$6-q0^gaKj7PhJwV1CI#^i`yt( z75^=A^eCmKiSGqy{Aj7|T6}Xj9&Jy}0OWM)GKa&2W@FsZsZNc|;#1Bc z$+XWd17+M-ui0IdRBCwdCphNu0xZ>4!X{t`Ycc<2Q4cUdH2US;u;4=d1Zwi~^6}ZewiiSor9Y3k zEYh5`A^JmG{Wi;yt>`$me+)qUWdL`Ac+H5NBaINV00Xn<$>t~K(2}uWHT(euSDT42 zTom76ID`T`9q&jIyI9EOqT=PBeca702?YCrWReJ%agGF;n*hqdGk_VpBLC&(eTp3I z*+C()F=)BIQKC)A8<1YI@~i1BA@hy{8ADN)KaFzrWJE<@5kdZf&A-a-o4f-xI2 z7mo{wnM4r$XDfI1^{Ya#PV9dkjN>`NOo>cP5w#cx^odUf0Z1IfJ$AFv0zc2JSCcW* z&a1p**Y47w-UB<>X_NgCP{E}KvSl7ch=f$z@?BKvOm z9=r>MbIR+`89xw^I%^I59A04mj<|x)pdp}3-QN9h>yvE3in(1#)sZ{zw(?jw$D>#L z&TD6EV2tEL&lwU17a0pcLt0Ws7+Xk^fawc=bMtFJY%sya=&m?WAkbX$rz$zHfXodl zK2Wn0U77u;YSxriyuZfq!q!&a&Q=VloTw1jYzXSfS)K6+5*I2@PtL9;E}IH{*e4=0 ze3xz>@g@`K&=xO)hV{Z&QC>bW|L-EDrg$>F!ge==g0XLUd;c3AAW{!Tc*x7Es_|W; z0ijw6-M#oKPUg>m&#dIpo0`wX*x|j z!gkjGACK_9&UkfCm+s$~rT?hx=K9uV5B&4P_1=$n|M?~I4>R}wP{aS@u2v%DuCGH?#aLqb~{i!?nL}Nv-`8e6lLYasLeJb5UVop%3Y+mF4AbZgYSY0-{ra zv;(Sfn&NZ;%|tUWIR3*={Hn&#{vHS*L}66y0LgCI3W#x5>o&?F>6-SuqJTn9r;~dj zzQNHykNNko2OyF+mdUG+b#>!U-Cwpm6HH0IDWWfG@uod$auPUk5#?pt`Rt2b^Wwa%g7$E~xz0O7X14Y^S1fj3q_L-Sa6n`L7-{!HVT=Co$eW z2+%19`s<~s=7)?74v-ELu%h2wbMl0l?H>JLjwd&(c@IRr{R zb>d21Y#>{gJoZb>z~kQOFAH?Ori2j1GzQma3CvFYMsKbeW5!UT0Qc5qO77W{-!H6H zF2uCG@uBX`5q@jlDT7RUa-;)>L~=84+U1K`-v@F_83jqLQTM~~rJ}-54$)kWDetJQ z;7&w2Qo?~5dAorkrFkcB*$Ino@G|2ow3kFKcOyw2jQohfFvnVawZ7q&**oF*gTH)# zEqXaF6f&0~|MjJT8p<+Q+n9Yq@|98wUz__eu9+vxr$)2JVEE<(pHGLhm>3*BW0PaK z4zYPA@ipuGIoX8q(+_*Aa&hkT9}nI45g>2vrH9jwJ#O*YiKJ89Up`v-cX;|AcOAbV zl@!~Srm~PHd>;_p$R)S7e8xerE2Yt}G!?xq+i_a9x}R5WoUVrJ>JJS*enP;RKfC{X zm)!;9_)y>==^kgVxrg)f_(V-5V4mhzq`J-JHI9tT1Ti+vKdP+i%6SKjM~W}a?5k>P z+ImC8ISC!zj!eI;epC5q#_1DpA*}RWC$nZYJ??>!rL3w)*)^Y$%=0fEmCDtULjCJm z683^o9@DFl8jrok(mYh* zon2P1vBVYL=f!=0`Z0p|U(WIE#BZF(Elg2Ls|T&TU6A_ZF%_M~7Ps_QGSOIssI~b` zp>RWP#@8Hi$uBP}j)%HyvUvE~$)L%Dv@xK2aRIsH?d%cI94o%Xi`_OVAkg*2ukC-v zpZru%vFjbv^GTNbQjDh6^8A5yNDAuq7jP+NTJvN%fsF5kPh|&+l5XuN>o0A5Vc}57 zZ$$bS^LuDZE8G|3V%(?t2LE*;qD8Azkom^NO!z22P-L?~V=-<_TFK4+3^)fkJlCT} z$WzMHH#|)LN#X9QAmb6ICaw>ewElbdMk|P-%ApL&Q1DE1PFZCd^Sa{K>>e_Pkj1mh zH$K~ni*7CF^>g3oEcG)Q;oX?WuC9Y%-Ox56fGh z>$E1+wwVX%sH5B`7~PmPUb&ka6`8dPZQttfNoDl@RRUd%!1Y0jHdUcl@= z9heiFnZfc3Pj9K1E9sXMW!q;($zE+-4eVp5=R=cX@L`F)MM-_UK7CQhS7LmgSXzp+ zQ9)veBHj??8OK|;d}%|`V|*rO`2Dx!7ngLd+o1{2CUmH_T!(ymYA?%)<*hpg0^H%H zm-S&{$;~8!_N~=h8w2xWF=>v$i5ia_-t<3^9m)-L#(0{a`-+w>nbI+&`qr@|@hLh@ z97}d=*(&R2q`~9$w2yxrR~M`e<~XJ_4w>L_V`H|?mVSJ2JxCQCN?WUM$KSi__Tn5B zX&SF@?XX!=5~p!!uQyYIInGO-L4ARI^Er+zFfi(E`8FM;51i)vZF!d0-Y?=XGNH2; zVB;C*O76MV=%5FCgc%r-9PF07I^>6)$hd*KmY2#`{2Vp3I4M#rw7P!F)~wr7I$24f zp_X_{gM4BkFB!BFLy-G1by1W7ermA4tQuc`5NR(u$sS)P@C1`VnMHi~;D;NFnuM)J z?#83Xm@!*)$P^o0l7hjh!P3p1ElKui)W9V1Lo!8Bm3pf*3*Q}$#ub&F-D%N`yEW?W zuYdR4-H`$c{{6={79YObySq~7cp&=Mp+kY^y=V>G6~|Q{`UAkUnk*h)US$*d*zUfb zo?P&lso$1=g~h%Zg1|T3;e1Qk42D?zR9-C6e(A8^4?6C1Y85+#-gZw`T}EVNe5{0~ zTCfU!BJPmZH z+8sM*G9$X3*!S#v?UDEo_PM*0-vZaWss!*0%^QO(P$<18oXVawvQr3zkux6{z zT|FVz3}?QI!jx=tH!Wm=r|b)BIk)$Z4SP1wr1rSLlkZ)XI}hHg;2m&tlUJd9uBnMH zGfSUwoRbe!JJhRdJASaUbz{rCvqAB2^+O=Bzu-38Se&r=_$ovp`tglP3Y zFdPDjAHG0VJIINHgpa3WPb!$tuyvT`e`oLP0w))~q%_U|0PdaOD_DEl-mcKy z)03>s*E?BFS?`4wv-tMlR~)`9v43fJkfdhB3$JMpWTQ-j@;ihD0Q{c>WG@{be_zP} zY43S0CtIi7tVu~>VUu)!a}#22W9YMoc6N~ca~hULfQG1oKf}k$0U5`31*m_M;3Mh# z0@B8AH9SrPJ{OSuQ=u-r+(4&X)v5rc%X3V>7gO_}Lf%q=W7L78?w|X6&!@#`%w0Fr2Y}!J;x1TE!LbVMe=$OV-keW< zl$ah+S*?2@t;$jSeCb4K;B!p&vxddmoc)2^gnN~rII&u!cUwsorRHSYW!D5wq`p>2 zFY~@Jj!Y)zr1uMmFJDJE+KYq$Fwgiu5w_ZmnHjv{ztMOyv*6RllXs5%QM{al`PX?u zn}?;BS4Mb6!(VUQB8WA0t#l%6zfCR4N%_!d{aNjA*NBkx=WRWy{=5LHZb_GT&&?zJ zAYr_zdw}~D<>75flwSC!coPX&ajq^UpbpqZkiy~cWw+}`shz5JU`Lge&a){U4rcP3 zK8+N|?4WF$@pIQ?yPF`eIdSZ?SF#bW)HFt%u-szTaZJcbbruP!EqSr`IKH?MxAJEJ z*NxPsH@B!F%sLgP4c}TrkY=QSC@6w-H;nFPq$sh` z-Ka1+WFw@XGkw25&*%Gle&2s!J7?$Yocq4+>w4W{oofcA;?-k9zZX2_%=osmBIgDf z^nNNXd8F~q>Bxl5wYk%wmo7pRQmrp0^p=0jymvXY<5SfRYZi3>N-D4STqS~@#Q8n> zBVl{q(m$Y%w+kO`GL2|eyz}raX_)L1=NhQqSan_!{N0b{dwC={kF+j$vbECt-U-%U znmALd@5D03kvS3nC5kJv&Alx8Dqz60P?%4gZzh>ij>(@A1JQg|5}KUd1-9J2#@>IA{U;H?3FeGo2Sv%R%fqS$49H zJ(n)rl~s4ZkNhX`D^E8$8_~avrH#@Eew|~6QnMY*FopL#Y_`Il*cRU(Te#(?LO=7& zLBMP%ior>!Y!3k@pRPvo`y+kA1LV|W%gWEPEFQT;q#o3a*>si<`xSoF_a{#29`I>C zSt7aCE92C>kRn9eV>$F@S!&&q>z(UD|qBMKt? z66&Xt>3Qy zZZPrPA|`hpCo1!J{+HoWTv7T)hedMkHnM-KqCK+x>a4wIIZDC_X4%W1%#2juAFuQ1 z)zJtQ<9l9Q{@GRKfRepsh9Bs1{73p7{}4<*YPH#}w|$JwCtYW zfa4{7%x?QFkR<`O&-)F8PLVc;ekMkN__JhV>Dg8mel@GuV)e7 z5&12n0x@I{R3JxBV*C)j&NFG_JdXq=V=&Wrj$I5i&lM|Y-4j&htX|%V+PJJ}!x=29 zTrS1jf1M%H%%_a)-V#sBVQ?O4HoCu;%=#@YaK%J06b1>A7#2hmsW<3tU?4+!iSU>{ zh`^7a(`R1z?7rY`>tj*xMpJIV*@4C58=@Y+9$!b`PQ&+E$EZOcMHwchX}hCOxl2%c z+J<)(=a4tWNn7NF-XFZPyqK$84XA0`HU54(!GEnUU@?k)hsh&TxuSinlmRLJ-62Kq zL>_F3_F*I{2vI(+Z;NPUQ#TAdY+P5AQ}^Ab)A{fy`=_?hnmhj6iC1w36BfriUvJo_ zZ$P6I#$E4-1O%+fmb(&*CeRmdBZmNX0chT5tIYdnIJ1#t>0RWX3q~@d0wZHvAE{G; z_*BVbz}PPAzi2F}+E^M3+-REe*Bh~-J1dd`jt|mLzho3~ega0WF;Rg!`c7;YW_4A{ zWxCO$14?&%ZpAitJ3(;CiSR&4Cv zCH-Br2l*JG#=sbuHN7;E6Q?%5%o@0oBFTwpqI|NGL$@4X)NxI>w0nYht}_JRJgPOA zq5K;9I<;!6Ij-9KimwSRqR+}F1l}2_&+1cO$YvJzsKO^zD*_q0sx7i7^em9^@3UiX zrzR?$LIjI=+%-?udGQrL)h)zJ*4G{BPS?1TwF*2KF&Hm6b9y!DRb){)wpq{|m`Jc) zZ&Vf;nL6SBoeXkn2ZXyE;lW>;m4!`S&r!`^Rq~1N@r1u}lI*GY?8dO>c>~d=3=MgO zSCP-OaQjWhByAJ#8f94CL~bY1_S^-M!sPRtXVK7N*kY%PO|m3{!5gO;{1YBSA^X3 z`t{Q6;P>21%@o9WCD$tY=jRzSZFI^=P|5X9u2B!dD5O%V#)N9badqzI=ZCZkJYRUU zH6u`bhGHsHew}8vFz)fn31_Uc{wC~wHj%-LfxP9YYv3^hj(jm8wp6|_t6v5_u0i24 zjxl3-YFW0R@d-v49k|3+l{&r|U|dj!ustYD+(;j@L1_50fp3v+w(IH}gIv4h{s(L3 z(r56}6=2OM0IZo2iGNu$QU0Cv{{uCn6{^w(zKv~9)87~SESUTX)bCNCO1$+}Jbi-3)ryTtjq`5*=UOyntZ<&}L><+1~c zbzN+tGxK!0_tFXB%^ThCr{|WSCLPqn_YP)T0;yFzW~{?d)Nzns+zQI0QTKeZ_VRMc zWbZ`XMkKz#j*M!J?#unvew=RHc4-xh4$6-%l3wqYCog@!A_Mw#+T>I`%D>b2Sn|GChjlnNUTF`K)bK`(Cpj zLoFv=ePGC}E?#9ll zr@&q`_0CI9-RIE2o-hi<-55H@D4&oA@$l_s;h^&30RHK~T8+*XA%lRxOy6B$KE^=n z3@GfOYe`X2Cji?~zYx-5fN0WAW=6&>+&A*Q?qulJjt?poMg1t;sB!9u-o;zxQHL~7 zIP0n`xiZo=A~?<($47ASfv4$+ayk)tru6?7V-Xjo_+5Yy^le6tGSEGe2HYXH~na(VP`t<9Ox#jc%m>r*|ihHE0<@2!D55tA^#@R{(Hbdj*Mst z5nHeOG}`V2Z5!no2oU=maO@j;TO6Wf8I6AG^~1V#L@_d3EV5_?`r41~LtRCYN=}fAVuQs&^cU4dmN+40_<2mX7YLaGR?-d1ZP! zc>ck!o}{vr+kWPNxB8+#jDdL2&w6x{uC+y|eRqGq(F-ar!0!K0mC&c&EMZ9X<>Y?q zYOh=*#`(4SPDS$CDJTy*>J}dr0T~@s9$I_F8o8n0PD0*)c_Hri`*kN>`;y0rynfL& z&$j0MiuRIs;bFQT6b=pm)n4JAczPsk7|X@usj$yt8qPOi+;9NJttw&=!w1N2GXeM! zG<9HMi`e33vez(aAnKO=i|7O zcA6em^0X3h$=0n$0(Q+Av!JC5A~x==GlaN4WMj~*#&)PM?k+Y$g_|C+TTakPs!@+efc5 z9G^__0cyTh^g2+48+1iMRZ0$m9A!i#zIe5xMd;?C?pLzvTob9Zr=mcYUQ1edXR#8W zbhCMcGE*A%$dm&!c$l0kUyQUk_1QJ5&j*7mWe0GbadHEk526n(k~cgS{MiIv7VNY< zW2!!-&jDIWY5OA;!EE4^y^N;=>>_#lAcu94pJ-^G`&5m0&Ei~%C<1NZvKXAFF zkr>=~$l4Ba%>;hVB#TG87zj?M8sTTBn=jPtqqa@22Zn`zMysk=@J?nWs2@NJ3f`$h z5BVnm@TleojKN>xomMSIPlfpOQ&w7W53K(l$;gL$FM&QrR5Sl96MAY21DJ8ULe?o4 z?sS4Z)y=DHLDE{jzfPB3p7x)n+ifUgvf>4OHp^;J%VlgzLTb9%Z9POz%2$S>YPp&f z%lGS@B{8ns1xi?*n3dmp!Wgt6@_QG!E&A*wdq!50oUGXOgmL$0+Oe8$pUW;Vi4vM~jRD;)(PPu(3uR9Be#(61mGBMjC#C?$1@lJty>e^ zf{}QFD7-JNT=*}x`1{Flg3)nPCt0vtm%xp#lS=hyjV>jHz(0ZlaGbNA^B8E7)dA15 zSWbtf1WZ6;hS;ybTJcRnbLrX#Q6t5dsnH~SSjUG^-p0({DjU6lrXP0Xtw90x(}|yO zaFA#X3Pa!lmKg&{gGzf6T0pi<>UWWJ2>WDVqGo;(BXc*|ub&Q1 zOk$EbQ43Mkce&Zh&&m5VF<^+FJCQj}Ci+*dE21ZMEE zeiN2uHx2;*9idp1zpyzHCB{h%B&~y_@!Cm1g}D^kY7Znec9>mG7!_KyxkhH_?L@}* z`u#`)y&TDod~xRPR5ZO?+jm{_^Nm!eoOA-w7X4<+Pdj`R6TBFtCXM140##DxIL>)m zvYA<%eXDStITqYM{%KrCjmbzjLYJ{E$G)UXD!o>?$Aq-saJ4p32Bw{k9eh%xB*dxN2J%euDU2fGA35G%RI1(1Q_H?qZBK?a(fzq0ya@bwsOmDh4++K7Jm8g#-{^XB3<;-i*& z8}(S%P&_KTxvFa9uI%!r?B`vO>8EB#JxtrX6X+pEoG0pH?v3Nw8jnPDNkR$5R3WMi zvS9Js2MySkLh7cJldN_e<;zk6sVIrwuDs-$ESXrG9@xbILzKbG4|7!kr2{Diq`(ki zIP}ldL?lSpWbW;wimC?EN)xq9nsUckXILteaUXK+O+~V;2)pNtDp2wU)$kF0xxY3u zt!n)b5!GZ1H^Sg!(UO*6G-GEBJ7Ec=W(7qP^Ui)Q19Yc`o6)6jrXZCks?sksKG1aL z?fz0vFN!vSZonmtCUj3V@Y)R_5jdWHU|hh($Dkknp|L#*`NKTst)n9zKgKJ<`K^SB zFpI8D_a-g!7_3zEGHskKQm_+#&OJYmdO@jIztIAil!*0O3_sVne2THThw0lLRHqU!`HYvQmU z$xbs?lZhUHJ)pw~Wed16L?in$uGh)@SakZuL&(*B-mr0Bmq{vrg!pbMbbTX2orz@h zZm-_2Ht%G;IoWe3tGy8AM88#$%r6P7mJ-3}pZ9B3yqYL3FDj@fv`iK(@fcj)8E)@^ zDhEhfP^{pRS_ANBx^EvVk~Yl7MZD7eImX&~m-vmbGhq0LOLqG`lXH<@-@UdgZ66)Y zg)0FQBKq@K_akxfM_wnB3BqXi)0sxgGoM;ZdLef1DC3V4KKh5zo4gwzz7H&intYw& z=IPSs4RW6V=H~2g+^JL3&UWs_af5R=lo^7}rg;C@8QBMUl?9wY{psY_nX%73VsbGP43ZJvO z+usds#PWb`8#uMtOC;DncPJ_F@e#;9-f<(->ZC}k;LW4iTUdny($p_uAq6e(Fk>=E>UHbU6W_GfZx<0T#ZO7xJF9`ji!E z6nqt+IZZ1sbwc7?tt%&}p(L21E)Am$FDIm_x-F^4Bad-9?XJJC9UZrr`2~$EPz94Gima-8V!)~S?Lcws*`&+3}rzG!+#K}~mK)2yJfEjBe z;Z+lhP`WKwmYTT(oc8vUfhq2vvT~K51F1d`*`+OzugKED1D%8N1h+;UZL~t;*wvcZ z-+r+3&~nl><~W5tv;NKqzLDep(!24BpU!OwY4$8JIl%R6b4t!hYb-0)It+mxo z?CHQTnwTXu=Qii@&otr~UDs{n3%R1Sij;G+#`)6@RlvEh0(mCL8~*BLD}m(-BtzPh zESu=HA1s%aaIiz}R5PX1Z=%lQ8pDkT4SJ!_Yo;|1z_ z`uy?^1?Pzc;Kdl(aylxI$Rj_weK_V)Pr!dl27^6wFxDP?G6IR3hNp~GVHo_0W} z!x-yYfSS2wzr)x#&KgIo6ten_fB4Y?!St=zpcUU(92ROL%Cx=i`vr_SOe_ zQu|#r^R8-FI`OR{{Dq}BThE5s1sat;K=s-6Fu|I*|AX*TLFhw^s+%7aZkWW%xy>M> z(rHFRALme??XXpR_5*OC%_?!VEtH?%9o!K2JPApLoD>gTH_;Bf8Jb_TiklEP=>u~h zxL-GaN1U!Y@?$N<(~55)iGfw#b%&@z6o>MhinGpPGu@ix!uD)1xOpgf!dffPy)K78 zBr3O$XQ9}U-+$X+pgLERnN$W_lAa8e*T=!Wz;2SNM5cyI;i7a@=!RB`$Y>(P$TLiq z9P?9OV66{v3+}B?QPgquiMb~_$BeafdzNL~3pBi#ZBYLYj8Ts^qI(aLonU+yusT!+ ztnsJNPrNJM!K2kGc!OpK-i2mooaQzu^>#l>+^>*tcwPG9A#bFP7)QO>z3E&t)ie_J zZ!bh;wLHgl)KZCZFXx~G1PqgOXNPmKKMEANq2t`U1-KW$J1@SA&I{tHB_Fqv&Up94 z>jODjZtf?1w|T45-`9Igk?|t358Q_(B^!OP!vX7D*vQ|qsePd6#(~tZN;6?!^NyoD z`INA_a=0KIId$4dZnu+n~iy^bF=Ee zca2j;rME?=m&tkbL&=N2h*?PYijG3-dORgFbP7Lf=@29w9QKjhLP_gVTImy@M3p@l zRZb}?M31k?^JQe%swD;*MprJ)uay2!REW(q!IZI>iZ8siQK=~2bj78oP%{QEuSQEk zE)G^*VMUDzRZ|{o624b{NqWgJ6XIh2gQM&s>y9dL{Ltl7Jm0y2MipZL`_|1dpTo6R zopr@v@Ti#6k-(R>{3sPueJFC$*?+A{-LHYY-}Pm3Ly{Fj@cRSVIu?{OS|WO;UHP&M ziflM{+sR}Yirg4@`7*Kvir%0aqK&LABQO8Q2F&Tqx#RM5yX5>UOH7sWr`YmPR~=!5 zMQ}GsL#q8)1zLl0D8TepigV9$k~=Ow{SuJCP-<7zN(r%|Mf*0Keti?5Q!Oi@_TtN)fzfWoZR0b2(n_0WM^_m*+s;ywpW3;qWdjA?lBVVdR6x z(wkT4!e;*Z#{wzRa+%FW$5Cc5_&{+eRYHk3!a(qIv-d2qoU^SS zQ*ofW09TS8>a33-SzU@4k;z#yN30_sR^MqeO{ax_h8Z(Og3io2_dZ1(n`(PX{Ddt4 zEQ;C#q8yXcqI!1*fh?|Ve+-+gXioL3fvGM?tjA}?j?*A~_cK`%wrdJ|TGY#!!OJEd z@W(<_jkBaxJ}gSPn4f4>8;~I`u)fj=cw~jy#AZ7oxN6IW$+`9zatOe)#BX z<;>gNReF-ZMS2JJlE-=(e~Sxj1|Ic3(+ZPK&Iaz{4;rz&HEUq$M^%(HTO`BKnN(yJ z9TiCaS;8Y4RA}!j;z4EsJ8`>iyQ+k6uEw{9B8Ry4!n5>z41~y45GwMp@LFRhUi86Q zzxwqsFj>BR!3Qf6Btq>wPlU|~V#yZRv;cYC$yRkv$v32A1hOiodcFjh%Q?Mt3CHBE zC1PkC?UcJ?AJ8NvsJ>CsD$wwvNcr45!tpBV-SksfK9fT4z;np3?v($%qRs~~n)&w` zRce%B;rh73xUD@)PJ)MbShj{2rrrW`p(}L!MHnGHs^$4m!LtW$$7}tDpfd_>UDER+ zzm*9icn7Zs%}Z82z0AJHAN4O|lT%yVhpCNW@!-oRIG9qH+L398gNc`06<+-Ol9`F* z9Q`5?C}IEDreUR7zBY+6>W&S!g!K)|oRSy}OqQosxgxAvDf}s$44#AUB(z4}q<490 zFmSF>6w9-{R#&X%uSRz2PG%FwUuG5KnbMpI9yd^_aTeJL;Lnpfb*w)qe#7E~MhWty zyx?H3jFDh7Pi{lt;?D`~RpGO-Lurbj((%boxcv zaf~KL)TDqiPBJ`m7%<}T7xtuWxWwg#vi z!QekmBY*fq%-RJFLr&;tDl`0qla|qSU8m$e=i2j2(DA$*MDcP^45Q4qqN}A9^71`V z)jt8DJAczg#VojZm1izmj+}NhnaEvH$SP~kZkJVEVy7@Gm4c8>Yb8{YK>s};#LOF1 zeyk83AVZeMQK;X5Q#61CKF;W$%tr|{fZxof9vRl?ntXb1P1ik9Ql|08f@IFBNf~_D zh$%9xItuDBlX{gSbNH{>0c&SM->)Fv-c&PPp1t*}G14?$<+$hdl2vj!o+snZWhyoJ z-gbDsUf!KxfuRY3P6aQm%CSaPvge{O6VD}f2tB8DMf;`5<>lTLZIr}iV{*)sG0O~& zmzE3U)To)16Be12`wrJp;tYFn4O1R4t!;}WXCIV1Q79_^vtPnk8|S&_dFN)T{-1+~lPiZ_kY+lglMYomiHWX8N9JEv$;abm9gZgGjjm#xl{-h~xeK8` z0!#~x@LwZ`CA4-;&8)e@fMd{ghHe0|Z) zc%+bLZr;(X{eilpT;^f}GVJLiJ_&lQ#C;uuHkhVR6U=NxzX4(b|mkT?5EDi(v;%Onj}TO>I`02o0Is>J*Hc2(fl z#V-5T&BxuG{x1{9-vub#N^Ndy5e z3kj>u+#uTXgYHqrhQ`YDUWb_dX&CX_yMZ(DVMs^QhXm^$yj#x9p;PbT^M%ofE!&+!@7?vF>$KBvxMVZpjAPK+$7lv|^+- zfu>vjG<}tGXTP8QIkRkZ#FLBN-^o=ZS=q+Ka!Zjd1Y;bck=w`FYIm~=Z0GaH(IOg@ zJ(pX0+MdnzdlEyfL%iHGn|E*S_#yr3)WXcv(L1r(mHvClP7SL~kxH+jqB5Lk=PQfO zS7LMhTQ6xUtm3B{y3d-$E1b#AtTLCyZiAVgM`icW|DvwKb>y4fM{^|x&Jf^}Zt;vp zS0`xEZN(weJy(5KX#oAJ-LcQ2I(YEdFH)S`9GG3_;4q5~#GVVzQc;oW#TXHmOCdjW=p*C=^_@acmNPtGpWKkN;>U z)D$h5KCRw;RI9Ku@#a;*OWwM&S zdPo??7_~{25I*u$ejn5{`>%#}X)Hd`STDK4Y4f=y(xY1>i7R^hF`gMjC93Lqt-cT})l zZD)>A5^tTJhfVB zRU&-srkKW5wmi!;n_+A=8GTC40@}C|7x-&FBr*$L1;fB!TK(vRZ8TtNBZAQMaV^vH zmhG2AA!38^wZj%9o{)2!Mlje299%u8FS?fd`E1fgBeKUR| z!J)Vc3_5nu%6C#i6@U7)0Q-uinqyl~8{WOe61=JpRhYHi1O*QsrWp*=3aL~sp35$J z75qYbBJ_`-NbB~O@?@S`IN`9i&vM?OiT>-*d$tdw{v7ypaQ(wWZ}MD+iKc+pfE7aQ z6}RxTtt~`BOH**|BH(fyq?pI-9 zynjaK%D5qA_+L@!TesjE1xpci5p*x>=8vPo*xmtXIC~(U%M!@LzdrR4fV!9i6MvGj zXRG^ycm5X0ulUHrbz4B(n_*atF9J{^#D&%&p zTmrC0Gz5mPcPcj^O=pI*%6E*9+RB$2Rgr3zZ$z`^#O0?iy|D@p1H8{upE8B8mf-Z8 z8d$TUSwMhsU}?j0VTW=%?^udpg~`i}yW`rQMSxN4BW!rtAay11 zG3xHHE72eRSi@!MWbBlQq6nHzIkv$i>9|TxMZ!V2z1FPtgWv@{v~Ju6XCJgz!_kEp zWo{?Cv2IIs%%LQ$owV7Wd|LeQDZRle>W+v|`fS&( zSdb6qO#V9J{`%32(Fm)>4y~yL%HKp+4pseUXC90F@X7q6YJnhyzE|T1T?uy-4Uc$u zilsDof;8HN@Iw>w)l#qzO#>Ab0g{m~*tDg_%twp)aidK&jS}vQQKvtvzS91#`bt1{~L?iTic|4TIj&x`vR6f@vvdP-!5#LX`Qtc!nSGFwEs6}d2Clv_pPpQ65*!1v2o zK|&Y{6>vM%29IZ-eSe+;j3rlh+*M40U`s#+Y{u~TN8Dw>o$OKSC@h-^AA*K;?hh&4I0e{7e`{eYp*`+e;@3jurS?9|NhjeB9%~lo4EC(pF*2 zQ{+MM)vaIKCOSGin6-F|tB(egiX!4OS1eXKY)VazIp2hMhC_g5hrfGY(dUFBMc<^i zHsI=%n0);dNp$MSy-@O{G9P1E!FR9u-VHXj8Sv6&~$V|uofbDU{x`ou6* zv{9)h1+^D%@Dkp)Fmb+PQ=Mp_>g%)T)i2%UMKiXt_iCuTFV>*-a4u+PYvO>SD4id< z*)%HVT#yfHnk_lJTnMud{wdm*y7=w~74d9>TGQK|cFx*Tay?;TdqIYT_>6T9_HXeO zzI@%&!TxU+)Wl zxA)xX3NUSzrX_V>H&Eqk-H|amE7S+Co|NS}_MBD;^7%iiU$VmGq9p2n`N@1PK*0Zt zp{V{xdnRQAOwX^w6>z7&3i;mU29qBdf8E=%!ca$~7MJAN-aUg!P1O>*uP9Hd=B%^} z8-}>}21ViR#+8-nc7rR|+v2LYyTpK}s7x6krPWyr{umh^%mSh}VE+@uNAH6X`>NTS zZ*(*-68!LMco+1M&>xihhf4jghedo=1-BbQ%J0lo?u<~96dBqzuR7Hc^wJXUAU7A< zXYHBXhut~SJE?IRP^^hr7hbnH?VYI_|1&cwe^dP-i90azf(#nhq`Q7OZX6O`Dq#Th zIyOzniaVVf*2^(F7Rit$qxu~o0lU@QV8WI-e!d&OOSN9Vp${6z&IlBg?5@2;!2?xE z8W;siqB)*&B=SzVyXna^lVAW@xl&c?_sGrhZm0c(&z;TL( z#(U@r_Ys>T~fw$vNmDeZoUC8e|9x)Ew-Ube0SVS1e;taUBsmtyN2$|0v9Ws^i z*oF@(G!r%+R}hrYwNRUk?ab+p)u*=)wNAfPo@8)hceoPAL5h^5P2M=mzbewNx|e-I zu;^S->3Um4wR$IK4|`oX4FM|v?q~Q_&+sZVf>J}cuvf?hxZL-SQX8?Ma@hT$FF@Ci zT-CNV|dzsXo)1+$_ z``?Duo$c5xjXgpGsv^t zKW;K%^@)eJZPOoyfc(GN@bHnFKZ7(np2iS%0sLpZOqZ`763PP9i&HP`XBfAVfT(!# zn;yCUii!gjOZJI6rN>xa>68*7{mka=`W17De=C~DWG@<%vR>d2*min4^mw&1;SB>* zXV{!Ta17-}iA@6Ct<#;3?&uz~h{DHD8}PXN4Aj#d{#UN(aaWK6;+1URh8~m z#=|_f*)r8hhD!b!G}9vL#}-1Eo~88XDIm$PN3Ngu=sJ+W&JLy!(6))7l23Vg*eXPN z6ZY%@-&j{+Mc}s7lSVw(7_unf=+Dg{V|JdyTE%MxIMNd}_j; zbX+B^cLx_>_KHZ?wkQbUWEIriV);#v-LP6oHmWy%mtNqL0vxJ0wY^dF zgvnH=O@wO|T9Cc|sGM5z6T$N{N}rIF#rmTB!D!|Uf@n>RvfT_bbj-v##~8EkGgEXS z9Pd>~DA4lUz*ynFZAwMbe9&0LEzqzQNN#`}JJQ7L|L4atzpW_BApxy6(8GK7jNZiY zT?KLh$If)>=VSqdN0dGDPpnMccPzkuautQS;uUN$-T{R5_>f&qPw(-2=O% z?6_zKT0{sjNjX_!`Ec@ADi^wZE%B7`>OL9qCIbFqT2ATfy>W(}UykMsjU`VsdoVz` zNj+BflhXsr{rFP?80K7}uLnwhk!md5q8uD0seW>w-freSiaBDaD!QChWpi#ku4(^s zLIn=6EJPqxRO2d+K|bDK>W=0#uP^gts=^6IL5S1A__Nexw&DRGTP}CeT~T!zS)bDr7C>xG+vMC|ifT(7|?4hvEx=Qa*soptEU2o#+; z^VSvUL4*5&+#yo$Wy9}^HY&q%v52?^`on4V=k!6lxG=n<;#;p@0cdV}XPHF&7(J6# zTs?!3+WtRj5CHV_;*?G_Ls?yY>bfXlo31A#tMN4;wo`Tdiz;n*$G+HkJ!W>8d&5-g znBp_!vgFN~2jR9>qeoetO}<D(qpuYrg)H-*z$BpepS@La6-p(gk-qzZ+AVC3M|d zY?|U|1kd;Q`$QFG@5@Ukf+~!^K96X~*_ysg+f82X=D8Fk11s+DcI6ztOZN{Tpc$vzXfxMbh& z(3z~|He-O_D}6!Q$cu%n8nhL|x}B4p9a=?)dTdB^1VOST)%!dKK#y+kLYu2IXUhcC zJ6QD3s06T}1uL3|XK-egw6HN_Vfg@eRP3J*3@*HO^dGFy|Mvs`fAK=>-O_sG#l_VU126e_DZx4e!y(34 z+hdBJqEg+0ycB}neGwW0OaG8m)SPBQ!>p%0&c4f`p=;$Mv(&Wp;vRW90u0=s|GvRLAU52O zfVufDUeZH5S@v$Xt19Ja;2Y^(6%{bKHTFTTCx0bDUeqXi+M9OxEtJ}-?P;|0TD$y)+ci&sMo>~!>Ej(Ssf_K40B65sC$b|FSm)>4=T zYMa9a;mXa;DJmjnDCYU)?6Z8Ugv4u4TT3ne*-Hbv@8(*N@ zgzB|073K`YUfI#{&_cQg2~K!_q-#r)dw=VJX8L}H5`kf_w&vRtQCVH?`bj`t@P4xj zITLR-#WmDu!k3F!a)&E)B}*u@-%=TkC|V`7kOpgC{6=-PJ;2M~+3<-5#P7F}XhlLC zz?u)Of8+Qr!Gfmw?5BJLL^05uKgc`Nglq>})g+&XCS)4^3a~2K0kWaS)_d-Tr{Xx{_7u^}DY#OeuExDsbD%Uy{f<+{i zb=GkPV5}pH-A1SaLFPe7mt*kSAb?j3WG!p#!XZUp=`!AopVSOPhks zl%TLMqNMzh|Gt9dj_$A^0ODDB!jsab9>v6WwnhQ$q&N9~Px5;JZtA)nZud@yRG$zb zm=-XR;akQV_PV^rXZ39tL%A8tif7hVx^=iXxb8N*G;RBf!T}BZ0#3ybogtGiu}hc| zpXEQ^vgZDR_T|{$^FX}>w-5~~m1!5W*;uA9eCjxHiBRGUzvwGwHQ<1*zD!|Zgp479 zi74M#&0lSJe+E+Ss{OP2?a$*0tf*gRd!>BHThhN1|z(=P! zDl6AkoYOS5385k1k;63{4)e@(zwky59pnq3GzHiWb!68AtYXV=urb>RKqrObZ~=ci zbs1WI7CP$x-~z#!_@_Rf|!O7QQ7t9bg?ue2&SFTIC66SA9;}$_LJfR96?aiaox76X&W4_vYpvNQKg7 zO1%YQffwB7`Y7hoQUcZ)NVs&88JtW?pJ zUkp9Tvo({Fn77zU(9SphkZe`x`kCKqU7i#!=R(UF8x^!65N*@k z?E`VRsS*;>+u~`DXBV@Uj+U-90_G1n5PQL**q=6~HE_uNjVeAaJ5+<^#AfgqNq{_<&rW z|1o=^LmCc3;kOfVG4P?M7oE!vJYlF>@%q{0g=gCv`U`f!2n6fs$#-E1w-_-|G+DKY z{+iBk6#=l{I(AYTLeuwQqLoE&Hvcpuh7M5XQY7hf;-!qmH~bo!2v~HUuauW+QSx5c zDUY>Om@wMjy1xtUvfJs0|Fp_zu^TNFBD(U5f8S=4^>xluqjSm~t`CY-pqWN4M|YFR z-3^IJC}$$V_5|iwM~}eJi4C{&>B1zt2@M#B3G0In6-U++SqrG75a^MYZZ0$T2;f5p z+I4bw{cy`>0e{hST_$~L|2d+&uOdx)xSsm&t0}(>RG#8pk%pwGC+39rqpOMWtsAK1 zE)Po-MQJb&p&7(xPt~1qEfiKjW|4jU)gH6Pr3nglvdin50$_37o}=^Zw_v5?R160h)e zQwK+TD%v_XX=4_ybavJ%g}VnY?sC?IS;aD%8mf-s(vMIX!8hXUXQYlL?V7Bh;E&rY zz3rHJH@4q?w*^P_qoO0VnO+Q4ne1ZNOeJ29-To;a5b0=@|My&EcakBW!)$P?QnQ%f z4bwe&g;1kj)~qoPY|(*K?L>U&cKC#zE;BB81_h52A=NV6e+l!xxvuw1*z8c@V2<%ZPM&z> z9*o_PQ342Hd!M!Av05d|r~{J(R&sGB2JIa@F2i0BfIzhMvKaBNKGg2o=YOAdIV&SU zXTJUb6z1~WF6E<(gCf*VW!CCY94v{YVU`&I?PbKbk+rkZ9E$Bx|5;_e%-tHuaf22{ zdFgrbRMD40Wxk?1T3{w|xU#HgHCc^3NajQK7LeJDJ!09fXNbPcgC%Pfki>bu3i#qZ zrk96b&k97XOuqKWO=Oobz|85audEdGE|xd1s36%^t2J~Qd8vC?bL#!qL{!3woThXu z^Lm|utsHa0pP2Lr9qy`(={h>c@AhmQ+x^5Dd~YPQ%E}4XTz{ZpyNROkaggR2y=|V~ zTDvp`yb(4_Qdb{IT;2PhfoBGKHtzqM9NzbG2$vsozu-SL5^|Jb_UewRUu!H1XCsZ; zK|E<6L7)9u@R0BQkDF9``MjM6yHtom)+tO$NM%ha#q{GMT{5EUrtJSI>?)w5>bI{V zsDvUSf|7zFlEQ#PqomR)UD7Q%vrSw@?`T?!zk?ix0#?d>;nr=Va-kV-`wr0CARxt!4i(OLBLK{t_ZU&zrG zXT_2*%DBCb25LT|-BP5ArvYQxPw>R@K4S)ByXE^R^0_V|p6mqf!Q#>@wXN;8o9`0n z$Rl22hf5#x>*|*2!QvByile`KSt;#Q!X_QE%rL8UHkw6b_^vZF=(^(f(+iV4^Hq%< zF-g%>2ZG#DZsn?szh*XKJ1%1AJUzS@yCrIN1X5SV5OJx8HM@LCOH>CdD3!jSc<5oy z2I%P#%T^$J*s0kOSLyLg*Dg?+Z}hvuU{#l&-lMfE8p+Zc$&NOYw;(d!GVoG==7nH7=>YwMZhTi60LM(zyO-pbfpn1`2ECflOhu`otYQIdKs)2)&k zsn=s8u+uG&JTp3UXwVgx#b$k^GpV*$Wyar$D*rWKR<$%^*W_hSpv8Fe*^F~nnc+d) zxa~)W?S&8W0z4EddrxgALt$)IM{`F35tX;?T;hwc!lQ^!4^VA-qcH;d-sqK-rSp>` zoz=S{`lA`g~~T-db0%Fsb3NT(H z{Pq;}7e`$ScT%a&bn425nuI*lMWjq9`-E|Qn-29H==m(PmF}rd#h5)08@~KF+0ZSd z)+WX?#QsKGoBcX~$Qgi3i2}%^s{l1TVCpl4f=H^qm-PPS-K*Od8T*TIsv!tgV1j;% ziQ6yz5vE;SeaxH@81!8Zf@ume9tdI=ZptS8TO*N)o_# zzG2rB9|Z@;3HpC$=`x!HSHm}?9!1ydwUf6d91s=sF=B?fbcmbL=tAGF;>yv8O1T7| ztrD{1Rx#!RQ(Lox`Z0PqfSha9t+NzoBhAjSSYl9i8+lvD5h8BoGCOkP8Zk?6iJ;WP zpOT*jE(0;7G1O-pi@uHvF~MSc#%hF%Pcp+*$!!`M>(@lcFnMYg_iUu;`iICd5A#lh zk?uA50!$4hHdPRQDEVC&ZzI3{v-7bH1&Qk@0_B)uvy%0dd1#m01YT9O{p6BRPK*hE zcK;QPNeXnegeGH*=MJoz>InNbD^$BBS$0kQoM*xwLrkE`$9KaHEnwb$;#Rr-zP`N6 zsqy(eU2{Y9HRMvjWXR3cU3yj#Lr)a<03!KN^(0V{;eQomwbiZIDK+7VO}8P%_^FPm z(3e9F&lZ`L@ZzqCI)XC2$Z+@;`~!FQKYR8UtMV?u*_fGlz#2u#7r>1AcwZrlMXK>f z5(fpK>q*%7u)&HJ_bRq9jA>kG?<_kj`jBt+vpua_hoVsF({dP)Qr>jv8RkjFt3w{K zXa}N_j=U;F{GF%+_LH*d{##$q6m~@8$isxVo;{1$L~F3;^=%`iKOQl4*2hRI#$9>Z zCC0`oR1+z*#%78!=W^3g=?INs*gA1a?%LLlR%lU}47$1C%1?7mU2Pb$Z8O>T0&xZ6 zSNy$IhD7)C-Pp}R)HnqJQ9SbI7TzL{&D%9{ZF}tC08OvE|LR9`9D6s?`^(>$9cr$4 z+PY$tA{<#?wnVK|<)!e|oo`8x!Hrz0%6=pa?W4v$jW((AA|_~qe4ld$hT(Kb@8ZVT zW^)?5``Y%~+LaMs8^0DVB-$yEGFPuJax$NXQ2ZMOZ6nq37c%b@13_W<11W5p9Z)|l zio!cJJCFGtwsDJ&+QNs;dsma^wihBhd?919_1Iz6f;co|;vR~XoJ~OzCGv*IY-T$2 ziUXq&erF6%aelt09K6D?5q&94eYC7+f*Z8_IwA{WrX9@rU$I@6!)QrVcb*?u#*PkW z>3`zq3=*%Oo}#u3c`o0hxft;{1Umpr?%g#uZJ&ARv6s2$?YfNVs6RqIYr^T-@K1!Z zZ3HOnqz-a~K5rZ2piRcuzX3kTThT%aKb?_S#TSkho@&IzzbYV&NzZBlqBOhs>uQx& zyv9L++1<)@E;)A~X}P^mO@3BnRWw!qi)A4!n8aDBy z`EBPGNL%=(jdL89I`TCgxpwZQ-1X%Z*=!Oag%EDhDihh?N=54JdvE7FJL-);lxV5b zNL*39=53{QJsxpKkB1@VR zIEKXNE=DBl3;Uw6Lb-pzLAQ>)AI>p8Pv!n1Q2C`!zj0|tw3l*x^a{UZ!RTNu&bRiZ z@(M}brCrn_+tTLwCCk0M#seUJ0n?0$yrsxMcL6DdbK~jTUPk^yiVJrguXJdbPSoUWCI)i7E0uDxQWK(M^myfcr~zQcl53)u2A1Y3TVD8sjF0(`qHbAsAo=iQ=h zaVc8HUJ$qsDZb^jOcm{6Afu>!BB)}e!9Ghojed{Y@&MQcSG{(c$=QB2+{(q1`bm&B zo%vHuEiaVD`}j&e((=?92Dvz`3rlavYFot=E-=Dp^*z2VN1a zgLOIXminTg*nCA&Woo@?_;0TS>vzrfGybv!?)oJd@1wT2%IhPufAqBPj|FfQx%-SP z5nruvmw~JeD`VVwS@^Q&MLu~q=GB^7$k(MGm1dQD`62f>yqf7mQn*qC8Q)s@1D627 z5b^xssnJ|zSvdLGtYHW-qVLMfQeBB#6rc9YIe1ToaYsQvKP^Q@Zym&OHucO5hsgeYN<%0+6pVBQDVMIP0<~h_?mV*y#dW-o|`JTmpn-* zX!n=@QriyjUwW|Q*ltgNR_WpE9mc3SfA}$UI9>SW-<5{J0Xg-*O-G?sfGUi48)Ki^ zaOl~CG@W}W9{tSQh)PIQxbo6`<;sCh^sM>bk&yl87jephf8sv`th%oNbqVuDi$&lX z`@|eCzt1uHIJ_^YRj?ccL~YzAxD=g<5>^M^@+548Y-1J6#fUd)I#@O4MUqD>mMOVh zYCAP3s89pl>EGoM<|d`IZ&Yq<9Wc_TS%XKCIbQg={M%r)E1H&dAq&s#W)zls9SDh_ z@XdY#(wz`jkRSr>sG0kRO{loR!oFXPH?6zwYFKpzDR+}@2(xCs;I?7%wGz0zia>uH9S`(-*rVk_d|CPI0=JdjRGC7nw^Umh z#FJM^NYGHOXW>)(;I;V2*zkBYi&Z=Sxa9W+U97bR!jnLzQ?F*^G6wcz3hzS3BZ2E# zhbO(2JLJWptngh4T8tSW%Oy>3si*+!rCuiE2|fW#{AA6I#z081=ZB>!SI0(E+vQ= zwrK^DmQLqU-B%lvRSBHW4yhUFwXS0**_xV;qj&x!FhmHKR2=6)0%_OF~@@wr%iWXun%5R_WIT9z-rDtQ(=- z+I1!#{4hETn;5CBM{cy{hVeMNGp@AWIK8nCg6Ad?a8sIL$b5Tt*f`wjLQDw-Pp2LVwcglThcem zsmE$GT!o zo~W`-&P1da1l7;t(Z(p#>d*gR&paD$%{EV~@s?{(as0l5*^LKNfbIekjj%baE9Y?= z$PHNYBG=N7%a?UsEq+UBc($sQX6N`gfVv?-?6W%Ncpd9w{}a4Tyu7tdF;53vBbmg| zPvlQ&IOxH*MO^-lMNoPCx$=aA4O6kEcv`Z=)rkOpC)%mZR-B=Vw+zVU9QkI=*Yt8b zF8gtdO6pbT>=G;#^^$xs8?iHjPD8R+NOnF%XO-U>UGIGX*XL>=!62GaVgI>}HP&wlBJ z^**5X6#h4YOxnxS#*z}IOvZ~(4>V-*V({7k{w$4B{#B-sS*?mlm6xUKkgK| zY_FAO`Z0PFo9gqBN;@-`7Hv3~ou8?D^e}-D6_;+=?)FXA_`7;nr~)>@R@An;sK3Mx z*;hd$A5uT!oX#N}Sip*h)&_|Q{Z>UDwby`6w_Ns$`9#lz%L`98iARGy1=woVheXtI zIb!%@l7052=q?W@XB+C~_E-W<)2H0mM#R^;J!o)xvkgdf`L()+T9*lndvu+E7Yc@4z<9{jgP7N`N?5!b*E#?fCZS9XyNYx0&^xWQ(IhLm1 zv=8p|AN*-N>@J?c@lcMp(?dv^Jiw26+R$m0FxIvxl2I@abf+p5!J4m4BYoP4Oz$W+ z5(1i;U>>0(Em2EifNMm$N~I*`-6 z(vbUFqwlVEDtoK5K*MU9&h`a{Kzb+2k_5Cbhx>qag0i~7bX4Lo@l{JNf3DG;#ON}^ zP7*^Fl2KRt2_dRVHf6oVrzUmHRMF}#JQCz-WD(Hp>%u7|+GEsvxCxbjZl{@Kz-)l% z>U(FM#GrV@isUH(q@JR-3DIise6fyL-dm7LDz3#0m%@OKC+hQ$RhtB@RVp_JYJtd@ zH1FHK3+1!V_saGqm%dM`1VfC{Er`lt%D#HEeX5KNIEtmDmCpvdUjzNL!{)N1aptlwid760yL_vO-!mQA?aPx{R=d?57b(dnfBTc87 zr|o)cHc~wy)eee2f88PTnm_!A-)Yxmr_@q)wTfU4p`#NNzDu+sc}eA$#1?&6oA;|^ zh4GBvc>+87B3RhnH@~aa3U`-Lx-VwIW4)k0=fwc_>d&O}mn&yyAZm9?)`F(V3}VOj zw^ZyyG*|wF_5R1MBUo5)n06jDJlNSV?V^3whJ24(>lD_g(VKoV&Ee)h!OjtI?}Mj= z$sez$NCn5gEwaDEshMRfq9rz76u*s_6439Bea*V%*|bL= zAC8D$iX4>=U*i0V^gD{Zwe?NE5^WM?{R?v>&suS-$8Oo4iQ6vPh3I%XeSFocKL?Ol zU*5n!G>=7yBfX`co*uBfS$2^1_&r{cxZ5^T%nD4tqjhU)snVaK)suA&s-lpFHUamP)l=&@7B%@Bb zdPgaKxV%=?bx_3pWFYDQ*$pdTO`LSvyS-0j%-vp>PR>ib0hHes(?UON8A13|gfcvwTpk=ns9 zFw;4TPY!R%>a~c?Tp+-Rj z(E92$QkQWy;&Iw6f69r>@?5>%m?mK9_w9Y28C~BBW>b&DwShCN))?Y56Ye7JcnItjk*l&tLmYe|Yvka=xE9u9VWgka z1)JjuHWo={tY>|x!Bh{xkXi$MYq_sq4*5Rpmb4PJVSLK+vUYhau;N|*y9nM@1RFlY z&H-z*uD^Ff{am_snCBL)M@l@;&h&ckn!uRWTEq(oG~N2lxgqDCy?& za)M=f{a505EIrR&PS4n#Y}Aw;MP4hjO&hM-VgI0n)I^icyNch5^bGM+DLRZGnGIk)y@nSpU&d9|M%bwkT?`xus#%g9GPha4^6o@%aR2N_T`r8kk)Iza)@ z#ih%#C?9rgQG3uD7CZ_OSU5U74I+k?PfiG|8m4Tk!7le(79oVkvd28D$ceY7iNp)9 zF}MDV=l1NJVEMd*nF+}MOp?hZXZGjSXZT7XoG zQAvUqepS2OO*!y*kR1U0lm)EY9J7KuvHd9*uPzbm^o+BvDJdRqi`T?eOiJC(Euyvd zHd{E-bd$N_6q|Wyf~jzlq~e6(9{v|O{cy$s$W+CPgtkyM_^4vwJoB2l$z1rZxA?q@ z-bMb0Di3m@cL8j9ajk#P7q@zWlW>`p!QeDOp5iR&B^`Rmr}t&K^lrzy&Nh||Pbaz5 zs7D^lwLjZ#V9%u_!vZOqe>ptszy5s zGSU8Xet7~m&iWnha`r`9=@O|eM`Lz-HNK=Q@!)navwQ2z0y_X z882ASS8Qn&J?u0QK@!psGYdhjFj?-!>2uTwQt~0^X8H88gxr{3Z{7+6^-r6<4uUkQ zwor@ppTkHY9qIDGmQjqb`;JF5+ICA;UwQA!PvdKkSeAJb4Y9sg%0g}^++woSyZYqq zB%zkRTrYp}txHA1tsUaL7F|Dpfzq(66x zv@yH4lFJtL{kyD3E%2Yi^_&?YjZ#pb5v?RMq4dTXBwr+vZN$E??wpZ)@g>empRwL# zu8L#FdzH*F``XiDFf4`8)i#&s{Yk|=Bo`0`iC zi`-?!Zd*}8)ID=we{nXqMev9E6rHS27O}#W4-`tzRV$G@yq9-gPyAk%?m2{(rCav+ z&$v-VqSB}3=%+>AhbxRW)?f`9Tt=_G+sB`HnNqTS%e4?_`cU!N!kZb!-Yj%$lB-MM zR{Dn_YDHdwVW!P|V&b1vj&x!7L3$qFK{LMm$B{nYE1TxjQD>GGKCmf#6l?nFpK+)^Mm5hX{ z-ZzVko2OL8!at7&!E%K;S^78vON=DM(Jvub1{3|eA$_YidVMvw)wq^#wn#~KbYy(B zN0jt()})W$aaU^Ln0#$@cSAJws(6BGt;-I>cz;&wvA4NJu6Kpy6+#n?>8@g!0Vso8 zVnWxSgiN#s_WK4#UkL&}!NuGxI=te_CeZ$vibDdkF4N=!?J zY!ip1cPO#XWN5hnx4yK+wWX%T%av>-P6h9GZmGuu*U&#Hw*OOA^+P~%K11>yq@7wlHHli9lIpPn$zxY@E;UK=um5kX(2r^v(M>LZ9 z-PP;$1Sd^z$Aya*<8L6ot|rouL7xjC^{;@`;jq6#ge8p575bn36C%u(=a2j6|NlDa zyjNx*2?!iYcscRlu(P)Q2=asDaIGgRyCG3{HiRGD_>CX&gW#jqK+@Y?8s9)^p96&L zPe>*JUR+apW^8qSd@KG>fN6Yj#Bofh^!x1p56H;_K;+3O7=UUHj(?rr|9jE@{6g;E zPab^f-U$vJ?$XBHAmG|<@@gmA1M0ezYiV?p_pI-V{nU6_gJu@fK2gy@mmA4(wxmV^ z|0MiKuUGiMI^z`5go0K2+643``peADm6WGE3;h|xW!bbZbHs6G%-`@--BW+C_Vgb? z$^Ssf{%tr>!mr=&?#?MJ?DpJro#-Md{+y5i|B_G~uOzgoYkJM&d&1Z{Q^Kdojcj|V z4eHfjoq^7q);)=`gsRs}K0>FO(|*&{hQ{tw%eZD&d~elL2?L+~ZR&0cJE4H_gkG2m zl7o5--t>Zl7iIdP)GqICFac)ubZ~K?QTLke-mr5dPj^uS6g|0j3oDd=7v2= zL|`9GIWMq;XsN%(byCmy>e6eLB*USuV5EUE-7)1A`;HY}V`mB496s|!qkP`fI^cGR z9iBwVG2a-pG92?&)zgpVetF`{VXNf#KTb>GddywS&vL;Vs<%|w5_?}|{bEHjd>H+n z+d{Iht^K}6rS30jScLf`K~-u>RmOH%L2T1;cKHR4RGE^4%W;L{vUHe;*e zKK_u&`t#dD=6qpCYorPSSRB~R7GaT}rGv{q3W$ zLh2?HTrA0d!K<6^hONF1$+QUZj}}y( zsV00nTDAE;oFx(N$YxiAI=gbc#dPY&kV-r2^|q>YEld2NWcLmN1LrrJ<|-&4>lf@OA4@f*u!^;kMxubc7+1cL?>zIEtws>W^wTlxqN)CY-w%J3cF z_()p)q#WDhzM?P|OgZ{v=xQCs9Z)fBt4P@(1R zsdKw}PP+{zH&!tp+QGk3{_J(#Q-*l;`)nF^1iy{wL@4-o5f?3^6u#pvZ$qU zkc($rbMWrvhpke{)DzA- z$)D$h!_A<*3N~V%Uq@2=v*W!@Qom%bRp=jO{zPm(I|%y;Z*TNEczSH!fN=+IOQnV% z&cYV$EKrKc+$F@6f}yPCFS@Z2BWG$D*y)L+@8A6A(y4N^EaOr_eEbgzHc;1H z*4xaL?g~p<8KQPMwW1kj+sx(U<+(s_mWFo%auW*Z!l~!*5@huc(XI@VD!G}Y!KQmYIazSyrsCww{^GvIgRV?)q{mtz z3<95rQW7LWtwt+;^L&X{ZaDF9IBjV-cr>wZD~+X*H8e2D;8DJvDH}jy<$Ldbl}nO; zwYd6n;^Y|uMD+(uKK?={MEiEM#JvJz7&Btt^Xcln#xpwJ(C>r{xg4yyIM zmoTLggvY!Dw2C0K_p$HVYCCQ7d{)MyJXu^tl^$8GoJzG?;Q&`nJ!!N!9^1STznr!# zoOf(QdO1T|z3c6GPD6;m+4pU6%!)2il!6skj6B=9WaOE`zC6o6Y)L?djGZwfzhXty z?SPPLNMk^$1K(S7)TytB(4pvg=lBfm&re${uT3^Dh!uqFGMVi^TcA)lXWp5a9r-r2 z9a}W7BB>0x>RD(`2vR+D1WZiMtXfwWrn%D^p; zNsgm3GIKA2YRarn@3SbrN!S0d@1)!MGMp3Q2<3)i3;Sk+k1{cDLh9)A9@+qB z;rY{aTXP1I?ZKB{{1gwIoyA zw0W02do+Pqh$;PlR`b&V3dpa{7LT?S zH(9iW)gntHvwL&#-X2Q1$!-T(6I+2?Mb>O7U;r3h1I^&yip{q`mc3`l$JsL^4eT}RmtDRemDX@gV5&tTv{$SaJYz-(l;oc!!ZGR6R zGQW3@RfQxY$C$?3l^7VOW`O$+*Y&AqD_yp#M4d{hBtHU&*Hf3l-6z6Mwy$dmDplCw z>Mq2mvHQoSxjp^wwiwe|n7 z;6$7X3eX80#ilY&9IesVoiIV29ZCB&D`(3cJaN*hpulH2_!-01;4>yZ(3PlHWqZ_E zQ~(JgLzROMm#_6o1Qf3)bS?m5JERdcNI8VN%KRE_%cxXyk2TDywK)1uk>NrhW8gc=>g84?s?!8{VJ1JRI{3KW#JpW zl&2;vuMI({{F6)34dI0`umbgG1{w9i+)dT&sFR{Y$Q>LQ6Km909N(q6-MQ)k5ZQVg zg}_>_5dF<1f%b?X3ZBxmK6wX5@7CYuB%A=oo<8ahffXvb@2L!TETwVPVz+0t zKrPzt_~pzns17^5sKy!>@zx#$RW(A3Mz3avm@A zg3$K8o<)S7p9Lkrc~fmPK|!)70j1q-Zn7CozrYdVsclAA1?Un(o>(?z@ZdgUo|f2* zrleDH_bB?85_>-=O;Szk=Z6yQXVYe9$|sn(b@p=_oz{cp6KCgU}sX}tpexkSd(BV|bW>l?()fG{Ve~^(M<{Rw?QWM0TLqo8H zUeGy#4o5Ff+sXV$`KoRIe9;ovyFXwu-bD62z!J;UVz{avkr{$Nu&RE1Df^5{_G^gF zKLnJf+y$_}VC8WDjQe*O9&pe1L70Q)5O9lvPu5e%LQqZ1Jw2V)Ecg#!_EA!rWTBhr)X16!Iul%HTGf zC4Gn~8m+E|lh^~WCUVXt(4RnK77Iw4iKObl7otn+3O<8%psDHHC;fvyNlG=Q4%}>$?!1@%3N6 zx)~NLL-scV25;@>N`HwzQJ|ah#yI%6ROWsQS!l94zos8cy@0*!)%~CVi?hOAWqWDCI7f39 zxAeW?P{)RVz9v7?-1w(%qCF36deIpmwK|THnOfC7Y+zF{n(AfaT8*U9YWk#s+_CS# z*6;OWB%_|7{`j1yQnDc$%0%*~$-o$JwpkyM0&k7b{)Q}6L(O@vcgvb_sRXVZbKGV! zd;*us)g8hKv=-`#24#h391#<~J=^3qJ05(>>p?TE0JJTv%`|C8mdT*PX?eM@ z=W9AH#{322ehkcdj|wa7`if#Qr+0XAD-EJ8l+?KOsaE>RR+s zM+*+Z>D=BY&9!CP!Yp>}R%#7W5Vow5@D> z9GX1_nL~v%m$^@PRSQ`~ZX!Z82JLf)N-im}6H?u1M9En8*W&O}I$qC>yJmhqChA(v zIC!I&@n61}rKBCYg|@`Nr(>+ZYW<;~?Lpf^`BZ4-AhG2m(RCc|yvmm^_cDHBPMiw^RZ=6xuO60c!AbY+s(9{1 zqAwE80dXRdq>#Un&#}Lg{QaA14R!k#)gl{Kj|#Eq#+a)@vVEq_aa$ zZ9UoO=H%F*gRroNgdZCb*iw1>yUZ;=r^)7{-yj;dit}bT`;#m$oeBEWl~l#6m)HJn zrkkazQ(2nPl4w>FRVLireA^>okvx)I6JZA0-ix!Td@&ko88aU3`+&FwDuD*o~SGt54v z!>Ge)tZ$zI2*XE)jzaq9Eear|z(DR=T0?1$T2Fbl=Us?CSKHfr#;4o?2DPEi=<$~@uw|in zudR+4AR^4c7!|Iou@ZGy!q1yUCXFN8HC`LW$qcFnIcPPamgLIY!FWUxx|>4p-@yrf zHs6R+U}QgnYQcmRsM15fVC^ybGtYZQeN?VX#vDow*7_mRK-dEk21DVx?g#uqv_F-B zEm*d6TZZpNMhpa-+$#nyjpGl!No5t zly2rmr)ejM;Z~+5pV~*v!)WHX6CV;s1|?2T+;;Cyg=>C(aDwNOa8n{JJm23sC);l{ zSRaV1r^kogHAY`*=^+<;2TQ}KnWM45J8;tkm4Fdu^-c{H00-4c3V{9R+Xh{!{mxDL z)<5BM^M&-P8=NQl*fgg@xK`aHUQ`Lu!;to4Q7fyXUX=j9n6Q}ZHb;AJdxj1t01p=6 z2SDe6S9yI@{ve7LkNInrTc#ss*87d_Vl>9!04%K9AXM4o=~y9?Ya^mgY%#)v zF5*Vf&Jff8rpv-}cEI9*p1f^y3*>Oir5gRFn(>iE&9q#6xP3V!$=74e#(Knfay! zzEoge>dn_ZF z=Xy$!4c>9|D|=$2GmV@2*gQf9n^Ao0-NyG6jzLn6xt#_RrMEkGht<{4i;hz+LYN| zlo-J0ef!kyIBNrj?;e7#M6?EljL8>i$cPRSDL*b`6d!iiXX{}l-j7&`)VSvJK3pyr zp{PGGpQS8D{4;~k`d;NFqw#2-0Dodo4h61zby}Djrg#g5e-IsB{>IX^8O-rIAhvgM`wkQQ(cqb6;Vd;mLQLPBQpQQL zCAR?NvN&T6<(t=lyON^jA#3Y6gXD9S6Kqs(YV!EJvKkqEs**L5Ja* zE*Nf~V5IYBhtK`^wTau^&S5(k9c&$MH$WX?36rrkG}N)Vt#b859w_&dvf$6^W+oMT z*$U*~!=5A1AwLsl`O;1RLu38$ba4|}*GNYeFEdCst42G)@ua2f*g{Ld1%o$fFh$aZ za<@R_JOk{16-xiS6}4uWt=6|2q7O3Li4&PQ~T0Kl?|G0^Lly)TEPnl)gTSd|ez~ zv2nLyoil6b&f3e#o%SKoB(3P7RwzcyJ-JWtWw#veUU1yw;JvEfj~&o$f-iCLaTxJ2 z3K~z>-q^}n*oTjK-j+<;x5f%O`A*^R@na6SRB9)>ERvH6-RuJ!ck(bSF3JUQ)OU&` zAnJ>xa=dl&w@dgbGiypIx=#M$#1z6Y*2mQ?{RUzP$0(5`u#O?(xItIDM_WBxJt9r? zOCGIm3Hn1V!b(?y<6jp(xE9ved>S)`XNOI-dS&pw2{h8k0H8xma)3LN%P&bs$=J%d z7Y{GS%;1!cq;@ait)`~Oe&#k}D?#6wK(({%%5|wzz{XeN*MWy&%!kaE6xt#Y9Q{l( zLj4}q?EFIb@W&duWeQoQP_rpd zkvOXf#!BpF4%?=ur{GW>Aj7AO4@6MD7h`hKGR1hF3i4+%z^|hy%R=!=rc&u*N?Dqm zLnc#;Fucz(;35++7N@CY=Q)G@hclOK)~i0|qI+oOgr&uK?e~@~I&;YhrN!#~A(1U= zsOL$KWPj7av87PpD<{w(u&ITF*Z)OvPQBkFK#nJ6J+!CYEK+<*)?NT2rGji0&4A+k zwKeW2N@o2H-C&ivC#XbZNj$VLqN8XGvK}LIKX2|Z>KIh$eZ?2_WXx}gG;jCk`ufyc z_XdB*+H_{_U64%Zhq!A=o6wC8`u@1y)L|wMc>g_4h~Zp+kt0dEV13hs&2wywj^RTD z>9lb^hj$_T&>z*;zw1Xpf19!@#P8Pa*J*7J>H7#T8U#_HpU$5~F9&@6E$92(Jqaf& zjx{${%IuF(l$hVn^GShv^5I!5Me^cB(TV!|V!zXeAmu4|k1 zh50JW)n?Emw{4RpZ;D*V^^piNV+<4uVFPQ!MX!RdLdD&>A;FOZ2A-ylooAB(*4<0B z9OEvv>!e99HHWFe*s+Oz1?4h+-DJc$orURrG~(dzndibaODvo6yTGH9SoZwaxpV)5 z`1~6V#3qXbWaUXwmTsRpiz?**V%{44OeuT6>r!;aIb|>9#}}cN(of41Vvop8RYG65 z7ITEb%OS20HmJt~Pa~28FU?tP>pnDiL<@w($iCy*ZR=g6|1^kU6JYg#egGZxtG=zr zc4O_-%r|uTzbw3DBD4}ZN%z7N1gvi_iiT7f7iDBz&^6Kz99>zDCq#~x` z_qK@ElDu>twik58Y`RXCuJ@pwwcKWO^IobWxphcji-1V&-$WScB*DkCSpj8-UM>040axN9f*>o)aYRDqoC`e;TNwopV(f zXVVqLS{*NR&#A4qZFJ{W1MFLEd#XQMwnt@0RvFurmT+5a+PQv~r%@N5s?ucV&mcU$ zD?^)FD|ya_bL$!z+eHPt+&xyj^V}TuI(y?KN5ulYr!)@sWNgovb%#Z#j$Go9Em)E= zPJGGj*_R7r$jI1>i1<|eKEj*h$bDMarjUV<+sz{j?)d21hu{cE2xYH)_8}4t{FI#; z$){6hoonf^H_+mq`0AkV8vi;i@8@^}P4YOmTXA}_I8st^(%~q+7}R`uP$Elw(LoK# zTIb-M`?y!m(O%cVJZ?8ft`XjP07ks`&!{nh260yV*4IWg}DsDbLA zreh;oYu9foCg9hkE*iAJ?iX@mfGVjXA@V_{h>#y_2q^|(P%=p5<5h7pB%SNTB{&ZYy~`iB0^ z@d^tx2)@1smKv-0uvg#K)AnI7oN%`yZKv2IaU!j7nJz+3{XPf(9sZ#l*~tR@o!ILh zNl^@{?_@#6-tv-n$MmAi`VCR~@`v4P*wy}%cS9CC&W8;MVczYPs5l$t;Q+4lV(evp zN3gaG&ga=jRhd34>f3|UKEgYB@&Uds_&ub9--``aW)%k@n>=M5R+2d#*sB1CLUgA| zcs2Ep&<{Vkl!9CEpeX*wRV)-n1xA!#TP+CDW>yrSiIRaX>E})1;bhZzP+|7JI9R}r zg;azAxVEokM;r;Dq?%XE-cV#QmI?(lepl8J{&O>K^jh#AK|!LO|MR-xjUkXef7isn zT_Zrw*DA0Vz`qoU=3EN*KUXH^?MYYI?ahd^ttjvlyir5&za%ECMD)(DhKeRtqbtFK zqRle?1&%$)R_;{D0wb1m+BSIwy!>(|=aHn>+w66@N6Zcb+>ekJnH&|_<3qXa_WvZN zl97=q&I=jXO3SzH@%2oO4nf#lp^|F7-^q7NIIEm*tKPoW-=^R%)KIh+7V8{{O)NYV zIz9d3)FK0Ry1+cnNKH$FJZPxuJQ`2VU5-_vH_lj8q%ijxY0h7qQ%tvGc~8A7X!ACW z(tLN=4y*W;csjr3FiZ=bcobeOY!Bu{lWTwXeZfAx!q^(liA>q-23es{Od7@_Ke8d7R%#yO9D;0_08v0up+3c2KL)@R_J3ec zVIc$W3uJ2(pdc1MpN9cRK!gxo@Oa#KPtUGa|}T$em**03s`F}0yF=N5EupDj;oo*DA-tP397D zbv>Qdqo5K&nG49cOP2z8Wx&uZRTyJ(HA=EQ80cRf=;Sh=KZr&$M|ejIJ)hyfxkldb zw()_u3j#6kHe4&LF^c^NWIz}IhN3g)9J~dwuBP*Hc9Dz1mHSbD%O^dAV^x9=x-EcCr!HH}ceq4-XgLr@Zk?b{jl+GtI z!+aH5Lk0w8@l=z{9>eTjdJ^kha*HjcOIk2Dr;V;{!maZyYQBVUQBB_`JYpW_ECk+| zlYT%Y2B}^8DEc$wa+^q7F{b2L$kt?cn*?u0VDR2M=?39@om6aL!CapP!*8pYSCQdw zsBL99$&7tX*F*K$GxQir%5qYSS4-ptv6FtIqVbtU)_q4TeXdZ6G$`7u(} ziT27l*||JmhKdVqV3G0g0bkx_Wl!2O8H^5^gu=RnC^vP|c*`K%+er>oXZ2LO*Bj&4 z`;upS9W(&nx&mV=1sR@z6|gQ8D7vC`eBS=a2GY# z0MbYMi~m><0|lu^D=v79!qCI>Qk+kzw3CG3m}kRld0aMIV_2Bp3SsqQKB$NSCaVF1 z|71~t2tLCTH8i3iH9d5d&Mljbq|z=BJe&*4e=QoSn^nei+J6_lHa>!nDY6_Ht zd6UZ#rZEWdW`sX%7ZplbCpe&wEQf4z%Z_mI0c_BB(pGjIVvUQ_g+=}yI~c}zao+b#U#X87NbL(=c@=u7`;UIH>)2?W2)BZ<@2}`wzF$^`x_of0u2|7)>8PV#~9 zCVXQ(vGIpT5xCBWKBx~le@)^t0+6cAMHB=p%HOPQX2jkBRr;bL2G}m?@rZbb!-f;) zjhX5$x|{C;+uz5GOO1<4a=bJXJ+g?@AOgBwxwj*D!4?H?MvHYjjubB7PbSKm7>oI1 z-B<3i?VqM`=4LV!Q48RRu(H)j>jOwpKN{WvI6tim;c|Ymm%OfN5aTuijY-7Uc9NWo z)83K{572tWd4b$hxSoWyyEx- zjSb1DCLyrNSo#MxyfW<2cMFl^a&6FCaxCIoJL!C0-DGqKn{Dd8Tcv4yvAjx1>&#z3 z?=SrJJ-dSQn&LbJ#QA_fd>s+!aI@rtUIOVoH~hgEs0}5N;*0QE2PQ)#(0EV!WAhSE z96C5?h$avPMkmHQrH@ACG%5LyP-R*R zfIDzaMU|vRsOGb?`GG>=z!?d8#AsSP;`A$qD>J2d(xUfIO zpG>}&51Nu5P2hG(JU9dTQPh1&YnJh=v8q|I5{Pq%1*Z!>%QM?@a|qlfUBIA?^P_!B zV{npq>s?b?uJAjkwE9S_dm|pYSrhwsT&gOL_%PNpkR}owMO^SSf;) zwo}0N8B;EkCpI+Vgst)1RVp~A64|{I%Bh0Bw)w$ycOQQ2S3EW%1%GHG{YVHBAH(RP zdaKeKzuNVVxQbULnguB-X=j!syGy!_VdLzU9sdr#dIEJ;-Q5qvI;rk%~B-07= zfIYj8cUEoISXi08POV6viw>04kqB}$Aqcg6;7B4>rEmJ`pUJhs!a#JMy_{9br}4dz z8aFx;F;|08*abmn`)a&~!;$)}{HCJmC0pG`cjPh>o{Le*n4ZwzuzdXMo+B!gqzGe{ zPv)vJ78;SuZ@LIn4{CItI@DX+0`LqKK$=f>gY-eGsLBTIQW)Q{zNUSL-F%X+qQoB# z#U$`2&wvu;r+_>kZy_k`vZ0?ys_v-igoh6<$p2F4*1Q-&gUh#8mEe+Q};~*s~@6DU+l*l41P_C z^n4GoHenBJL$pkWm_zUaRgZm}(q0SBS%vo`ZN%OpNIf1{EHmxIHd$f*M;o021ek~;r$OUcUNbn z{=PniM03dmw0envi8nXpA!lE_vEi)+9&!<{DlCQ7S#K}^5XAROG$&*28cFN_zP7RU zKXPJhRKpq0gBjozhUO#v*&g>UxB2t=&47_)LfKg8$%H3*k~S;Sx1t%lD8$~(vigcb zGg@YmNAoT|NmQ>T_GOh@3ukDFmc5JxBYJPwvL3zzBB0gjL- zKTVS7NSoA2zuGD#m*p4Rt-V7Kp6x>B?XO_)krB+I4~AHh0yR8RHK_+BC@v_qiA>$@cG{P(cE3>41>B_@$~mJvKKnofA5Es9*|*3Q{ok zH9JBMmg*f~S$r|Z!11IVn_vd1T|KA>g@myUNKNzyr_x%^>%hl3c)&-=H6Q?wTbc3f z4chB$$K&!YO{`h$>)oyP!_RfF*Y;Va=IcYn%3YEH3?N~YnUgv_mVL#!TS0eBfvQ+* zZPx4J)ayvB=udpw&d zYYU?6aQdKpv$fKlJ#~NGkf~9z<9j;+I!o2OLKEm{&J~(cOUt3WY=-Y-C;2w<^q*Ez(gXv z(SSURyl@a^8`}rp*ZaW7p6ucLo&LD$;{i`x2sQKZKwImYQ2KQ3`HZgbF{K}JQwYZ* zD_P&qelnhO#D(Id!gqDk*IO%PyfpxRZTchN#uJV9+NLiTM7=wzuSb5|uTQ+MR}>wW z`>LN|xdghPH2`zs)=uc&RWOWz&be=lI@&}4Kp3Vo6rdNi6#&qqxrCnFmo>N2E_tHJ zHekM`={3P(v3ngfQQ`6Gz9ABDd>woy%zr{;7vFx$J3l;O_~Ku$>qu3Kk9q)?oTkxa zs8?mTB$AP}N(8pN#7)hC1vI_BhUzUU}3SLfz}(^LUV)Tj3aH-hmsk zN}FvG0`b2v#g$+=kc%V{?waHpY$6vF;riE8=^GZK;*zDksUlBvcny_aAgnE$Qa*<^ zmoufQeQSDSVq-c|S5=b>mS1=8w;is@r5;*9-hXR3y_S7%C`(n2g~NDu@KrZlotcU8 zOibJLdGypHnR4~12K>A;+wl->RPOma@PXtmyMTc^ON&3zH64wq?Y8EMJgQx$90slqHL zIp^|A zrPK2E;@UolW8+$sP2X7UO_r`098IwXy$TO54_zRAP&Fw*Y;8+inD^Q~`Fr z-tG$uvT6f0Ym+kadu4dN?5GC?wJ>(v?5no~1qEfsAAeVRnoblK|J8AIHofbVNwa=( z!dgA%&uTf`xh(LJ9mq&}M%JWH%6`jnI6b@SdL19BxZx6tC~kH7 z!*V{P^O=y3bPU`CQeUuU6RMW)o#-w_SwVq1-BvD%o50AO%{oFgqP!(* zK+mH-Pw6uBQ?J*@&vdJWlfqA5wR|2`skg=6z>e^Gt+cbwMO&^8plBmfZ>SP(;y&u@ ztqMrDTsZJ=v_HNjZ3W;Vv$2>>)j)h%PY9MN`9*z0+vl3A56>(#^GJ=S$9>5ZSfgWB zJ43Ullb68aZab6=BNw4&z8vp{vKr7My){Lbi9fX0?0jM*X20%et_u}BmMe~7NC^y9~rEjDoNIW zoz36=tPM#k>;I$yQNdR}+N~A`*EbcR%X1WxnG~q6xX%A!Q*r>jiWOX-i*wAxuEx!} zFD1F_8wFlr3EQAOQMf+{kd8ileylxx--+by&>d(P?y5re*7zkas;$%H1w%mV*dWyt z`zTcZ&Aq7Sf)n+LBM7zkK4ho7~x zzCgWeK#sOWJ6R%4u@2LH`=&|LZ!&{>!uIRE_M^f?fjIG5?)(Ds174&~SEi*8&`ruk z9jxMZahMxG`A|?+VgVi+#+C zgzf1B@BQOW>Mk`MZLIC74Fa9##Zty`oN+_K9QUk_4zgh@}+0Ov|ZYfo}S zEIFrBNW+wA^t8nDN361bRg?z^CoGO&vq##Y!pW^y3^SbEM3kK(_6x6za1E}FqaAR z1vFM9E?~2xT{#xStLPYTkst@ftg-fy2P;Tg5nNI)OlQ!~m|%)9ge4-4w-hbpb9R;h zbG$R?A?RCR=MMm5B|QWV|GVn~IU3gRB@2ccGGxbSJCW#-E}*BH0Oqi4rZ8vFfH0!} zgg6NPy{k4`z4>Gcik`ALT~Kk&(H-Ho$%g#hS`od4b8*Koa=XPddkez(5-ZToLaTX8 zb~6!R%=mYJSEU%XGRJZAqn`j#E(Oss%_lDxSyaiR`aZv#>7Ah#UY5ru6;gCuJ2CYVK~&giNq?noM>C4j+NlO%*{JA} z#q5&?g~E)V%d~c5Qc7YzKc*KF!8s2HoIwzGHT&*R822?60jq4EV}(Xluw~0>DvM50 zFkAB)_%)iP6S29BN`8NT#4B3YRQbyt_;USPM-g>Mcf zPBmzvY$nM8+v*7K3n+%axMYHdRV4X5FL-!L4{QE7U=KLLsf1bN=Cf$zNNjR|?6eJx zS^AMK#$CIKmF8k7hD{=Yu%e~&ESBc5eshfUq(P|;{ zMODYFBJloryRlA^z6bnT=;E`;bL*_YyMTZd(AJq8GF+aNB~gfwnhyQ>V|o;ekjn?= zs0PDhHVYTb1EsujY!u}WO2-TQ2!lDi+DnFa0Yt3)!i?yP62Cyf4WXDIZfHgTKwxv7 z8D%aQzZ0ix1V2QsH#|cMs0DBqT?YcPcNMydV2Pc5s&#|}{o1p&rZ1~_ zt~BV*pgSiAkRY!Oaqr9iLOMGh9Qg8iw7VQTZH^c{VhG86fZ_b^Q)XV(SrNVjP2zQK?x$6vDdNUdt%2aThE=LtJx01r)7q^w1KN36_V?y%% zy^^W|Jc5x18fjg)`2<)+R{AOt-la`nM3N=f6H#|tH`y;(B(Cf@mcX z_6%C0d_*9u(mJs;X(yP2kMW~0f$Cu$W$n!89p#!zT!05;VN|pwy$A56)g!uX$yHKK1yr6AxF*#oVMf-YvIi z2;|x@pP14s(G33(SL>Lgv1wsReVw8Yw)y^hGyB}>T7j_eK#s0co@>7*Sjh4dxj!S{ zfeMv;(1v?_Kl^jPugA4q{Iq{UzW+_k$%M+0uwR{Ll)vc>^j~Md!I+hs8Q896H;6lb z{qsV{t@&4tyr}wvXxrQKsHvS0bmADu-R;{cOV(D^>5ugT# zI^R757(c#+Xk`THiY*43iy@f`FB5?wwWPv+^Ggp>PXUbMNZPm&)I#*>U{{~Nf(X)%VH-bRI+wD@_%UAWH()rs#BHYMwjnX$Z$+R6oK@;5jelr zT76SC7V`b+`ryfDKI9q3mdHo5uV5Y|BHEVIs*k7jk$$|K%7`(Z zQC#)8K@lf0RX!sZTngyL)f<84kn`rHOyz@su>&Kyi!s@6L`Cu%d0^<-rc>tgzWg*W z_pL(Q5B8@Cr2IXyCFtJxaTq6Ee57$E2^aZ?VI5_BsFpXW7{6e8XIyZdnwv0QMxY8~ z=k$I;b#ZvKf&)>p|3sS`6oD3O!B$}GZ|U|BDlbmv@Q?G=VVA!#;8UdhlCohfj`?&g z1^VnugBvVOG15|&!;~ruv_UaSF*)g=8# zQ;L@3#L#}W64mXz&*}k`rKG%czl2ow!gGq$T6TJUYaL{ToN`ie@1n1k1uC;4Xt1X9 zDM-cbT<#hc8_l1vrCY9!eUFIioggh0Fs+v8_8d*_i*1jw7~{avIf%WTkicH2SRk>| zqj7AKU2#(y2l1AyQMu2JFA!EaxN{2&D+PBk9ea|S8DhnmXEqC}0R%;Xw8z`7yv5^1 zzZxH!C}^iT4hLt~Dc5Uj{gG``e#<3T2H4+cy}deYlLyz)Oc~hLX~?sEyAlgEbg+n| z>!Ubm;O+YHktz|pLpl9w($W+3Ha8acPVNMF^k~UH=BeQYF_dv6?|`xSMujO>`Vbkd zEKH>SwFa@kl#a^^MCpB~?6{VFV{kbbf-7gJHO?GdXZLg1VQZO8cr+v_XI(+xR#-PE zkE~$(lR{_3Hg7&uyi6cvEy*kiZ=&QCbd5^VG`*{)smb_y=?zTLE~vKl2U}byV{XON z4imi*z5ZrDTIGkgy`uL=}#>poT`@%yhkZmQ?JtuY4g9ZC$xPk_MYG3}>L2 zub4hrKIrClU%^9rD<^@DJhYe9X((gVKg$h|rtOhumF-5G|eg9t3o_E1R5#c{ZF&R;h26i~u(5zqwK; zQW%goF_b(0LX!oNe;bBIW-O;|Si2w>)?)jxq&34Tz$&ll{VX`_H<{&>{6sn4Y6WlE z@72-R$VT6QF}%vJYrtOL3@NIN!Mi$_XTC^{iXUd<=0Ah13d}H4*5sKr%vIaFG8`up z19rUfa7(>`ZQh=@FEz3WAFlJ?yuB#O%iRRnE-{$ zK)(zr1J9t5l3LK6jx+rha7j2^w)LZt1tzB?zoOmC$#Lv^m1$I>Q)YE6a>wn8exCw6qrUVbnbX50{YHZ5 z2vS-Q6QHp%rF41tko}GG|0Ci9+F6wZ9&Mf>_X;!WWTIRo&S4HW>=Aa{Pi~jDAM~7# z)}fb~=qfza%PNLze%*-5gi}C0y8XV1d;9Jhra}8H3d>Dc?)Q;%0Hd|ie}Kbsbw5Lz>&Anx0_t8tzkj5m?T zv-7Ek7iA?MOktJ;fY(@nz79Wkzbiy>(Y01^p1K!<>MJSEp!Ebs^A&EOdEh6-mV^ls zV}4ZqFj2Nv*G_OS7N1Obk8N{$WAJ!klR{9WWQ5>0>TH^1ISDh;)<&O%a={Md>Y(Sq zLEx2RwgfI?EmcjRGJL8D+Xexe`N0MKH!crx$2TKS_7lTg%GB2ZwRGtJ zNuR??-e4qh$l7EbDxsCc(UfWW46<7op{uTOVT&GWmy!2Q6N#4a*GY`lV9URT= z+Mr*{nB}zWxc_UWm(c25E%isLo%GWA<3CUZHT;m<&&V}j2{XtX>wMP}1Dv6I3YE#V zSmVieb;c5Pi7bTr^HGo}@_6DCX(5kW$$sgpAYWY9zVp|awjpH@tS3Pg)&YVrgTtLH z3~RsLQ;Dv>C(p}Lg~IWhE|1#C&Z>(=`C|5^sm|>Y>hCIAakGvcA8u-Q~(KiRTTk$)zum4)=E>&Xo=d zCDp^(F5iD`*#EXjx+Moj^47F;PKz+iH8i=BvMF6yr&l!*`4aFlp^B)OfS;(DY&Bv_ zw>Sq^!o@1OP|<`uU&#BOA$&|IBBVC_2M6<1f8&B8gUiq_Bud5XXu-vj(6X$$LbSi& z&QDaNwObh*M{uQaEk`_Xe1QI|HAoPB^OyQ6V_={>>cq;Do{HWFddJ8ztsW=#&8;X< zAus_VfhC>TcaympBphNrw|;2eQ5_+ z6^HHb_r7&S($sDjJ+I>i{ba|D7u`JBqqDcPdx+6S8YiH+`w-cjIIg6Zm_YedCrKV$C z{*pBk?^ZG~Ad)JmjQ7FxU;HLG(V4(5djB@@s&)XmvTW~+%J0`Hm%#mhac){L5fHZy zY^*Id^W7L_@Bn<7{;AiW5&oOLj^+R z;iVdzisp=blLnp9or+DkLY`XU|3lkbKt-jdTtv zp@5PCD&5`9(9+%A2uOE-2h{hz_ulW`_5ZK+eQUXJX3jq6?DO<~p5L<%w5{6f&%EC| z&_AmPL;byIn^y*7{J(sXI|Q%we#@aG-vtW`{Pti2kWyf&bq|Oj0V!n*fC7aay#Ji# z0*XANp&ch4dwbc5)w!yTsSJ(TIQiN&MuRKD4jOp~K&s3UNR^M-639%t_w0~zx{ zNh*&cdLl;?l(OI><^=sCBOp_E|7i>~QG;~oI=?%(CT3@!{pU9FYA_OY2J_JI{$X*i zz-0e41&VdYjY;0KfgI>lxr0;s#~ChiS?hjA7b8lqV^LcXWLPTHBmwV^uE)$`BeJ>= zzS37gCDQlylXWJuW5SyPpSO1jzGj{IK=(p~&hyM&r|aH1 zg&wGm^IQ!-C5%56=5jKX;OZ6*-)*XZAJCXyZ10@SLrAW7FO>HMabKQnW59QT%|j@P zp)U{X6H;Mu)U+~Y&(uOHnPNB~bIo);nhd1{vsc?r=01U@Lm<89%COT%pr`bAh0WU} z;J0F^^A_af=bZ0FLe`&G?dF?E4JXrbBA(^W3`S$7G^+3e2MYzOSLbM9iG z8S1&YYy8sXbi&Pvi4aui{=MVb`qxvRJ7Bw{a$SS&Z7v)1{^sPI(|UoHcE4+kfnZD4PN zn}&*^4~L59J2}Vd{+B$=&o>LQxL{(iFv zX_;)+s;JDRr7Xdyx(8Jt3J*k;I_+cX!4UmEjU5}=vl0F}i-Dk)rc6QT`W+tC@%Bta zc2K}Jtuz^qM9&AYydF{{X3Qr~KoAOwJd*ZDr8S^r8{PSf>mTrAxcg>Mhpx+w!T!R{ zhV}Fr%S~Ix%YzLI7R(j0id7_^;$kto(3R{RyBSp@CaSNY{urz~#Xg!uQM*EdSaJqH z(+IoAbFn861W^V;MDa&$QOP33+h+FSKG|DsIfRjdXq$!eG1yW20~7rLcJ<7;9i`2k zE(hqGZP+DTJ8@aL|Jpc!@7nR-46J>hDzhN#w$ti6IK#AiE@c#&pJTdDE7$&@Jv2eI zSjNcIf%=7{$TzJG4dPky*1B5K9&5=UmfcYyAs}6IkHf3DDX!0wN@9E|meJfzIdF`l zHKn}z`1p_<*^6S}15_TGxb7$>e+1?~g(O^;$z8=WR9qkNyX~FSAJoiwY)y{%BGxh% zGhhXQ3g6)5BX7^#)REK|U(8}$c8|fY9k9J0%K!2b09lYD0l7qc-2a@U4yg0G>IH%H zBJb*7{|NAZNtQ>rcz3wX@qW8*IX>pN38Rc=di}g-N0KUkno9zbZOR);xF+Mga=3m# z<&U~XvsTrQK9x5RE;=2f`pG|bI_v?JsO*$1gZ3mpUw$6dDEGo~wf>eC4XV!k`H|Wc zJQ%8HWgn|x{rw?!Sb8<}6E6G7@4X%pLk4&(^63uO46GGH_pHfi9e4%g0*ug5-R5TE z-h^PA)YnyeT6h7K<&c89Lp6drFWJWv8?KpC9qSBVH;qoO7?zQ&q)n2ixk)m}cQiGM z9fhM@n4gz`GnB<>;=(9Q7>2@1WV;4EzE?z5(-(mV4UnXYMI~)E+RoG&{Q0t;xz}LS~i}gfnXjG>y@81uUso`iQplN{EXKWyOp6Gg>H*&!)cJufzx_72uT(%{UcwWtU z?j00pI;PGe8BkX;ef|OF39zKbW{)lS8hTDGhb>pWAus;Lo?XqTvKleA_iGxq){BQ3 zirPk>_frIYp7;_4Muo$3A16*{3$eFN{mN{mw&Zx`Y%!Vlc$6DKC-D|Gv364LzH<#f zZCc|$iHD!Xlbo&Bh4CF+V%+SO8;Uhe&r7Wx@R60Ak!p$Jy(!a;jrG&+{!rf`5t}=} z`2{Fq52Nxh&TC#f&6I%BVDFo-3QdQp?bu&4xKl>IdvIj(p^hH8}!1ITgSugJKTl zAT`|wQfi%l}CKmUsYrx4|kiu2dR17qxP^5qYDr ztr9nvL7mH)mPg;tnQ-PrhnL8oF^*&G!UE*z%W`sI4w6VClOpAh%)dTuhPbcfUCo4L zL7lJ9;;o5@x9cw_^UUGh2RFNUa&wC$lfy1ISz!{>HYcky4+=0W$M)ECj)!@@^K#L6rR0p=W7yQ#f%o)7$kUpU=t^PfK8H<|$511Q0a zIzN#gp_}xaVd(1$&%%yQZ!IW^jbF%YfMdAM%Yf263e-YC(|rgo^*Ae&8)BbLGt_q8 z-H@tb;ZOgC1EFQv;y*id7)d(Y(MND32fENDV#;+Z&o0TJN=t^EfS&h1igy$mfwZ@b zR(YI7_Szggq#Q<(4N_9l85A9;eLt(KH%1!wL{;8r5j>$<3v$68d>#jNKHAPRhY29u zFp#WC-NfH=djC9!i~k787SWAMMac>>ox0u=G^33*aGY<+#v-6KTIqRkpz99>Q8c8_ z*iyuhp#V(XK#FdkiSL7D*%t@`d5z}A^gCq^ZH4@_mcRHAgt`mX;~p>7V#~E{vTX(5 zF6!g-IH3%b};1B+D48X?DU{GT%-04snJZKd-E>nAWx##l|( zOXrsIUA?*O?8(at8=h?bL^63CQ$CXs^;)yT(((j+zO?c+-x;9=tcN+?A8DM!NY#A| zHX_|EEAZ%HHF)gd`f&WT%vdcrWD#eKtWb38Sh>!Jy}Jh==>EkRL- zArx}{Y^Q`K{$zeO1(~jO8L~hI9^y^?cX;EFx|;G;()BWuKBGLOYeaHZQy@1`?o^gdx62M`7NJMe+bZ|Mq@ zjhlFgy~-NzSgi*njrbh@p8sVFY4STAjs?q)`r{wFYKROLohLV;KL3d&*LhkMvd9Ui zEi}c(s7oh)z>WS+1)!Py!tEYw8%VSZ33QS2UaJS_o}TmfVF$V^%S4B^0sw$uynhWG z=5x&Z50`u5xnNggFzvdAf~(1bk?(Yr_GN39?mFsk5nNj2m(RZ_h?C-h^o{@`05>S* zQ=%>M$~&%J$+)3j8-dsavr#&+B|!L4|4qWq?{rVF{!+po$eJPieZ>Du5}`YL8@?gJ zXqW_GF86C2ivMx|NLDwn`9t(>4<%CAeLi{A?Vc_V=fNZkM4v>QX??rsqHi3Vv| zLl^~n9FlpCE(`cw7hvt88uVKwa!+vfeT7OD9tc2@OIhsrP_}0L7F7Jn90eFb4U$E7 zD)@6(nvARnB&>9G|K<^kjp%pMREs)tOr+Tr{orKDfLzJ^Nx zgya_W(@$uh2S5q*QdIFnq1;R-6wpdUx&$j_jd_~Ehw;`O;6hi;`^$QDUf0O1N&GOz zDMGI0H4M{}+Dpb{&qit`ZKZD97g*daChHZhjOn!Spslpdb?p_ASbHwOT%AysB)C08C1acR6W z4eX*9h3Z(=CKD^&viwB;bA+Ox^d}+?^5axXA#O$UzUApzi5SA7=5?V=S`~CW{m3G( zZrQlfwIg)oMI@8#p=i$1z>(IwCUuwPTxdgEoKeEWnSB*>S=ov8zG^>df5?*Z` zaISpka|tS6W8OO+>`3nz8iDjn7Y~268Cmw7rDRF99FORzQp-Cg=JKOvokr5TE=_YELbnxEu`420}_ z$0Xy3723@Ux?>|0DGcw$cfQb6UYEeIPipZ$U(ttIqnPecdN-5D{+ka#9%7WTtv^9GKM~3a2DQ*>J zZaZZu%6jzA&gInk)^w+L?ylT};^>yCD;C~^ZokMo9=uKtSysfgXcS=V$C!n*&2EH-F><17Q~%;N)yH*=)ghG!rk6M*XM{T2jZsDL%V574cwE_$_a1*$!` z{a6c?w~x6s8n+kPMI5XF0og%~+p8oS3N!&W_V0~`*8xlopw(Ug&gKth^lrWV$MgP$ z(%m^|6_y5m`~-MEc{0lxm{8EYFS#~_Y49{$^r;amOJc!K3i_R`QLZy@bg&M{p5_Gn zrsXGt>xx6&C7#|9_%giUmr4TTa*R(~1t?~A0VUL*;oQ~H6Xn2z$Nb&kPxc}xGK zFHb&xk5+FOMJIUG0U6f0$kW;@57qZRN_r=X*&FAAAXzf@iV@_O4Yipkc=sjq;y&r%B49C60D}EDoZ$Z& zeMsmu%xZ!;KRMNHYP(|LMu0H^zz+xj`~a-j8gDlNQe(*ME(k8)oy~aBEo90~q+B07 zn3{S(Z*B~iu%u6q8z0oa7;2WqwPl(tCuh=VQ4VvTbJP;IoLv(ll6=Bh4mW>5pG7Ej zH9Fq$;SEI!g0nZ7{4w}qs29;R|CyTns4ZVJB#=LDRVS-T{B6Xfxk7cRSP)M{o~4X^ z>W4km&>xVmyiUD}4}tUgaUd2$-Af~u2?3S4$~^NX8tIG*3IJMY_7xI5{GBUIQi$GY z^!Pb1y}1vb5-Y_(0Dh|Bjm?}8NQX{TY?1=k7E!3N6g_AdUos$_GHIibgO|A+50NAU zX%V52m5VwxuSZiPhxB14@>LM33v^u-gN8%cO@i}Ymj`@gW8X6KD-Ltci&ytEt!B3{ zi10VS8=;BwNWId`{f@?KpSQ7~B8qEGmQugIJ{Q)abLMUTG6g-IcbM{b9odRxc}02q1B;>e&~BgNhbN^k#vdvPM&X8U z5Z`3s*&=1}6r>zTZt%3DzSpGXM^Pb1`QFw+N>x!z{Hc{6Pa!iuRi2yYh1W1=G2M&Y z@r71T2K9Cfc{#~QHupfk*bNBbV|1L_27eng_N1TACQX@8Zed<#LAFo*k27=x%J~`{ zMSLkQ*U$*b9LlIemyUaTW50=2SeFDra@~yr@*=ZCgV>TOrsSu8>B<|Yrq@CH9m72& z`6m_lTd^!t37*_X*U?MBh{@=`wyzeIh$gZSOS;ZO+s{0AJpI-r-Il!lSXP1ktsS94{b#VjlEh$xL)dpo;=!~^oJLp z=nYGeGt9J?*@ueE*-XSLz+F|jn_Lqmqn(^YdVF+ogsvZ%`WM2p#>-RQQlxmNGx$ug zXQZm|iB3R%re>JJ;)%TV516IhCL#<~Bk9z}%w{$iqb4$?icC9Sxz4p`KeXdL02fu_ zEw83kkthz{U;J$HePEQkHC_w~@whZDjJlGyeyWsq9ILtPz5|zJ@ z0jTB2zR1D_*2o%P?QJBq$Ib}-p*4!4vG=QctX_jkMQ5W} z*(u?t3?SJ|9t#=OJP*&{SHxSm`x#*(&-sifTBZ8B+a4tNHVL-pjDCqD!$AJ=RE*}n zwJ0%_0nKply|Q!PzK`ltGzchZ%GqjBZ%c+2q$ZebAD2~=r>7rpVmN8xDn@gjDfk6X zr%de8n($iB>)k!_0d6A^5Au1+!C6ZyFH~;VDze=%W|_0dsqg*kS3=&}p~%~>Q(t2Z zUZc>l-e=hbAY?-TmMp;oDE~^{(k23$7}fKFKR!Kru5+khFG&0Irh4v6M8YUbb+M$x zpwr#r7Y4$@OxYJKujRl3IzH1>sV7{p>^D;99@61~)r=S|1l93+4C$a0iq z`(YfOQ$^BmH2}Pk_TY1eHS!E+jX87x(Bp#Oh>4aVBuHbNk@!kk z9Oasg^_IjbP<(QN84J{;GE-I($ejk2{s1Sk0LOmZ1|*>WRX134NOk&&V{xtqqjJ+i zI|s=(oV8xoyct*5wqtQHP5P<4Efc+d=6olwS#Ai0LF~@nS6d$S5h8R1HSQOZR*VBS zYY8jMm+OM~F^n;LOcgyA`nw)4ne!>aD^i77Yu1TAij`O>Y7)HmZT}-RY)4xeeU}q9o36@46-s2t0`N$5wf7n zLO&q6^KvGNeA~IA;(36g&+_{)3>BT72a=U;nOAr6dTSv}4#BM9CfuFlX$yu+VVvwD z8SYEL4ucs%tnMhx)XfUl*+jG1L}i#EV=qUG8IyIayIGft+GI(v+l<&$ASy(&BiSgi zZ}~Wy1*v}S9(4)TCvW`CR_k*yj8Bt=_hVT3G`jK!S}_h{{IyuV)GUdcPy0~gW%=gq zKU(em7|a!>ryomV+;kUu*;ziqY8H%S&4-d^PtaKATGGhW_BLcs3sld;)N2+e(PLHq z34ruzoMKKUnq-*-IF9(_h*xA$T`K6G_hPI~LUSme4iucU`1BBwqZDDIV@0JTN=je_ zANt-2Ibb6bU*P?G^etNGrmcn)!uW;o56|B>ir0dee*IW#uD3kr&mp{4jpQ=1~zYucJ^hn^<<1mQV&eTzZt5>`Lw8Za~;iX$Zm%GUdpL#LdTDQH;)NnWZ&iH7&A3L z%@`zXhAhSX9RH~PIk9Tp^!2e!5+h2PxQPAfkYm(A`Tm64tXHS-kb+wkwclj24CY z=M=WTh~axRf+fij`-dd9<{hnph}vHFS^Aq(YB=W)d6^7?_koP1Bc45NK(Gi?=sP?I z^H$<*kp6mdBmR2{IOQDbPQYCr8A6MqNFM z%d$ZhS%}sD{9~3j9yK^zYvZP>&?Vt*Ga&X}RAhGb?^^`LlBn?1LE1K&>UucLA)Px} zM{S=&2lPL2G_87sqC=g%-}Dy%iPYx5-++bQWYO(4fNDOz{V{kQYghq?S)jTnZ-HIA z$&5!mebXJK1f%>Ypc_XeH0I=cdZGKQjYs}*X}_AAYS=%z`xEJqI^khI(^*uFjdk}6 z97eko`bam0H?L?&8c*^?1h3yu%_K`7@Q=S~%AF@%QeQbD%8OZQF5wNJfv7XuO)Ge+d45|S zujTeRVydB)_urLjjedQ{NJSVTdcoOg?zC(j_DSVzCL!Y>F(N;NP z03nZQzO+=tm{h`nDRf9^Cg4|~|Ktycq8EFJY*9HY!NsUc?+Q#**NzLH5-Id;J&QLJ z)=F+l-ElmyE8@Pht3YP`iu)lZ=M44nOtpz{c;i8l;RTH7$Nt|;{()Bt@5lG$UZo_`l4OT{qwaHn-V z+O7Fm0{!$|g$1*Ki2V%<^_2AG1rpZ`M7q5ED7|cZaQ@**NAs46%RTOTx0v#(xQKuN z|C#ZlzV39IH%HVit>P`H;o-FD(a7`}1V_!t&-77}%)as~#Js*@l;Lc_B3T`o8EkG{ zw>8Bxe37WdrhaN5c&_>~{x#km=jONdczpwroEZ|_{N=h#89Sjzlrl|++cVh&JJcqZ zgQv1@$AAsTZE0JVYEHeY$TgzYTo}SS_qkk7of%*WZMxy`E8|Jkk;5(~_OB>(OYdKE1{73`x*StH$A*@s?++2#I4ZMn#KoHdswDw<$j zt7(pdy?KE!;4r`;`u$%au&9Kpb9#dPB;LIiXDq4ec8|OGEjGYPgnipvtj4hCIW>Ti zy?^I>H*|p7?!Q(h?;C}5NM~lYWvTZ0uOSHi=zl%5U<7ntOLyH9m&RmPQHUReEm4h4 zt;934hb41jU_SV0Iv+owbH?GA>6&^WRQ=m4SGmy}SBt^u=8luHHJK!Y^X4t(fS&Qj$z}d?$i)v2u^?UucOu^<%|gm1N{uN)79U-!nnPK?`=gwvz`0q}q+%P%M5j8) z%u%0iG_c6)0Id1d2WKdfNkxb*zX|tHM<54HC3O`y&yxKgRsm3ZqZsLCG24|=(=!vG z^;UPjgPLWFJXl8{{jn~h2#bJ{tmP+YWg^REa%4TuQ&$9I-2tw%U#}C#g*ZxF;%mJa z@I!J!bI3UgOwfx!_)j@m3GfGJ1iuZwy?48i1(xn_oDn>S=(K&tXHWlRpY+6w8k~VT z+TTpn-OAX2{T4@bw=8BQ0ANkv+c^Rm4rRb9wgXo2LhaS!j=#|ys>LM%%v~|_RgCrZ z2U&N|tPqnB>`OQAe?V&#Xvd60f(tYr8xQge*h1J(q?14NKGVNTQgL!#R=oc;Kq}dR zU#7c6(PY1vcbQAvhxs?)##ma<#~FAK?2^A@ZEg23?Oq2uJS}JcvdXA8*{?o9P24gu zTZ0TAgCpI?EL%&e6enk3^t*lMjFLR^D+BP4YUDlefW?+dYgS~v*O$o@o~gm_`+ zP~bTlAf-j?aPIO}_*$1RU+-?y-!Pl6_`oLw-jIWGHPWy5X%%;^{VN$QS#?%m;Dp|n zfGS(Hr`-$6rf;Rp!W7tMA>96h2Ls`0I;3CFd$5ZGa&vezsvutyv(?85IDG(@>=mDypN>V`FlIs;cpm- z-%H6~BsSC%sv^irnPz;M>0+rWvQyE~yGb3&Y9**4#@Eei_jJ7dqt;S_lA-b|Uoua{ zayIp}JPlm7fb60`1oV@s`x-giKDULmuHgeqy-60x(*uV+sZpHB@!4iT$jAGdfP%;^ zY->!Y{4x|_KcSND*B;Fnf0HsNb2#7V3oN9gvG)A^0mjQ7_>MooBF&`$#OVtW#N@oU z6?^&7a+JZsia!7Z;}f*|Ugy;wD+7}wd+zfSj0|*IqgfcR_dDte2zz`V+z(gWM`qum zq3O+rlA@d;)sTNu!~Ib~V4V-m1Y(o--oRWsbwIR0o*Dlx8=8pz=L#T}{`)|C^nKvI znXbV4?|&6dAaw)ezWYOgtIZ?57bt-iT8~{=5BHIKa9z_@60EU~WKO#yYyWbxZdS;3 zDDV%$pf(Y7VaGCk90zaRc6ym-q z+qEd*lWPx>3<+2$daYK*H$d69(21tI@7s6rwKYqx@ZEe|JF)vi(bNagXY(aL)ytAn zN);#KG&5y+jb8#pxm7EkHn1)EfU|y+{iF%9=Ebb6lo_uo?sB>Q*mr8N;OG^*$SoQKE}WPNZF_wVozJS1hPR*U9j8CzrYbX2cpP zuEge;rg}SKOq(mgd9J8qa-(u~x-j~uyh-I!MMp(xdMxzpcZ|vDUq3}@4D|`9O2Tmn z2ogRXj9s_y1w!Y;bK_LvLWSy+NYw==^9XZs##SH2?P}36R22o+y1BKydIeOSgcBPf zxk#;qA?y-OA1CowYjCTL{^(b32^6&H^;Eh%83B+$A?CGXzFBc`b z(r7xg^p9!Qu=aVAK zS?^gUM$lT$WT*3fZ2>9Pxs4A0|GRB_MB4#i`fReS;d z!&{;{P!H$li_gYOVFCHll(>qMb#6{{edBFAkp4Jv-sISi59ood+Z*)>6-S;4J`gQy zd2z1gj-~M$5u5RcB|DXTx1ctu+P(T?b*Z$K{F?DdRZVLxnE-dCy$|2Tntt;^?=jHg z-vZ&}5$sFtrxON${r*Rke@;P^XX_v={k$Q4Cf3#yW7X%ae@_9z46HwM{8k4l*w}WN zY9i+!8>$SQR^AkD5fdy(_DB|2%GZwGIiPt&q^Z81Prv2CF|tyRf4G)9+8HwVkZN`N z&7Dt1^RBA(qL{KwQ0vM39K7<}B)ft(tm#-$rpnbCzOOw`y%Ozf#vE>99YnLS8!`xV z8@&EALs~Zk7Xgl0v+zgF&6?PI#ATQ(bZTnxHqe=L^ex4p%KNY4OIIE-uH3^rcj(6* zzF4jgR%a;~Iret>B;sO%vV+y3xA2rnEsm)N(zg-r(7WQePG(1^``JpE+yRnymGpe2 zynY|T%Mf5>vUe`{nT%ctmMoOTm5cb6tu#T~82Z;r1tXbM?goB#8`#U>b^d9P@NTGo z`HH=_sm`20T_O`pVziW~Wrb)+S|9Gmi52@{x<((t_;E zjBH@Tiy2&_$As4Y`L`Vp!~$l76UsZIK7T|Jz!Nc`6g=HOgA??T)0nbORvqk_YQkPQ^o)I~cy%W5da&Occ645)p4V)2yred)+7Zf%f>Y*imr*s+XIFgHCdNor6dX&;*yGZFZUm&nzOT7fXiR%w z_E@osu?W!B#k@SQVjCCvGhnh-z&)<)+{DtArO*{2_>sD0$H_rsk>2mps8@~eT`c>b z1BQRuqr0Nd@3D8elmAw%{nsP>_YnDiylf&+ETcdS3A-gk4+)Wqz=v`j*}#ou@2ykc=AVFaO)XwNc)RkI5C7u6LQynLn!$ zzj_ESB@C&YV?F-aB>uKs^J%GIo72+HarHl~DI={m&84=Cxv^z=Py9xbv5Kf+)8>&b zyg5DRDd|R^rh|s_hN4ytw;n`3enxAV|5y&m7cLvcS&=%s_2>^3p4SSjyr_Mjt?@eV z>~d*z`;7rJ)e;L=lW5ZyxqjM=JhV+9)NE3j9K=#}Bntnd z?CMK3z9YA7F~8^Wui&$R0LbLv{Sj$)H-!4;ZnY|o#a4sV{fB*zyU%*39}Xwq&(lxP zq~F?sw=r{u5qEW)HgaTnh6X0vQ2#Nf=sE(P8in4mI*DB-S{5Sr>4#GIwCGiyhlvcjert3A70r)D%IUt-M{ z$90K{5An%%;&vS~zr~Bws0$-9bBc@1{6Zc?czBl2?k1%ZNy|}8t0|w!+$o-5+ftos zaVe5Fo~lQa=82RjyJg`oPXwD z@)qGtFNjp){1*>0?h%;PU`XI&f?ADSZ4M8+<5GrGbUY)C;fyN(P%p=3dMRpBv6QS; zg5<9cCD5L@hDjUHC&y8HlB+6BIzcN2boHAoFB{VNu{ZdAop)~&ib4p9= zyhmz%Ib0@*-add0`;SPpU4YMzh+`Y}MR6X>vCo>)eJ=In_4ns1WMyg4WY-(DYpN%8YD(m_azx0o7?4JQ}P2F^oKR=?A=yv=f zZ@PNgHKHB2dzlqGgFBX6%H%nVmy^FyiGgeyt;MQ%A)lvTzFzX8-|x3SYM9p1yB2$Y zbn$$MPL6-XekiP>`upbEajj%c1sO!;oBE?GnGyVBBtlaaM#bDN$Xo5i;6G=2?L5@C zI{D+*{$-5y8gxL1|NZBGQR{!U(e`=(u7%m^1rU_pj!!}KU4&>4cz}n;NsEGKsS}G;Z3gO!ep6wm>SZEVHqm5Hj1htaLZf@_UD!j%mDlV zz%%6n9lcVm*|$I}hkH7DS?W=M$tVoH?XtRUfZDJZn(E4s9XK9dsrfnpL_!U~HjVja zLgj3+vgy%4I~cUmt!iXm#Zn8J+X)azU2Jt1tTxn=*deDQ@J&bzXoZR}{c7TLCTdmd zc0^y5fWk`}mlmlP^6BRoDq^at_uY4o&jm|Wb|2!Bp$wEdom!7~;C--KFF6~fd` zL$c2Nv%VMK1FFFXoU3Md&r>|>yy9Z=m@bx&N>Sf=(l5`{lpvDjuma>8{rtQZ)Wf53 z$&w(cc5kK`m@tT`fwgg4XGKFyiTMCLaM2=?phL=CLq`awkKt1@rLcTTRlpEE~#oIHM3(rQKQDFFqOn^8*wp%z^9=nToO~mL=3jN<>0YHWFpXUbP ze!(h_f%MfTvP^H(RS7*(Tx?E@8Lo6G*4>Cd{a*hCe>M*3zd0tR0A6Jc`iSNSy!IN@ zkSR!e_m$w!*L4Ea+GBsWz84iaH!sgi`mUN-E-#NZ;ipAm+BYMFBp0VYtf$Y9uKKRF zXTs*(2TBou(+kPEk&&(!^D15*OO1KXlia}Jw?KaQ4aQB_&9;`O{XXovtOIsEakF-E z*_twj0oxf^Ai0chW~sA1<;A$(FFDaUi_)#KY6W9hzfgL!GmG8DOWtcQ7OzY`lzOFw zfsrshwV9#Nc&UFsZ1`ht{Q8&k#7Qmb?2HV_z}a&W5GWe?`Aex0lMc<>cb>GB@bZ?H zc_h*P>isA`-&en%7C-{u52%1`tR$Ro@0^p|oWpL8cTU5uH|&5-HYZ`Hu&bGqo5T3N zIp<9Z_~8z0K@IM*vUaoRv{QHa0X}Y!QJT;Auz+|%QyDw5V>nZSNfggy*DM%k&oTOq z($6j%3aJ8s40uK!LI_m(SI^!&hCJKMZ%DYA`0>)_I^$-o0=C?Avx|5$RB<_SvoUe= zE9=|M%+315%{>2E)Xgzb!r3-#|CIM826ixWlfZwbHFq>=tW$SoM{<>ko1?h5@5z-; z_bBaac~o4)S)2@mt3yZN2X}KpwMbTBVyX}5fe!3xxVp9B@+K97ACuFe@4@cs665Z# z!_Ae81NCCBjba6vI}+c}zqT{e5^2c_t@a;Y^cs>d&8Ll$7NW6p7{)*WJtej;GjEEF z#;E#DNqYNJoO@4RJR~*p16zA+tJ<4vrCAyx(Z&eh(6+*R+5J`ap!^IrT#p#4%W}~;3PZ+#1nm4+V6z(Vjneev>@Tq<6;-cJj*i#!Z~kwDo*<{XQ+M`-&lhCZk}w;zjvPhjSXbLF?nJr!Y6@^QP~v zR75Bz(j<70x`^0%+q9xJyo`)lka_3b-dk4kx*7!|l^z$zIf;bBYNO_Qcx>CK{RB68 z{O8(HFkQFxf)*I;e3GB++k_KRZTv}&v}8#euBMgqXQ<^Q^2kb3ss1PF?ozz&;I`nD zkJyu5L!}DhY15jLv66*fCX)PyNW~SIgk0}WeQcE~=itIYZW15O?H{j>qBO-y<+PP+ zX;$SfAg5Q)6gT0DmN0$!_1A0TI@{}72+z0<@GfjLA@6NcoS#U3;2Bdiq}jbtr_0l@ zo73&S>+T=A=OZlFn{#L9WAMG7FptA^U6}1!Cx4CIS}zU%S;yRI$Q;lS@p5l34CW4l z0ZM!plc$coy6eBXLT19A<{#%p%0_O^)c&QPgDl(d+%#iaa{xKeXyV~kD^?k>^#kR> zV3H6^4+s7jqoivD0-kNOR+l!j@Z;DwuuR-aN`~G-QfD^0ts})r3E|>2T)iOy+I}KG zaGjTYBClmq!_LiU#@y-R&ed5R%N)PEKP>fhuHN?a0sL$VexwyJcWQTj(o^u_tgE8_ zGKAl4%b0(^8{>K&L$ipwSk%X{yYXOuxSCH{lAiLNIl&Y%JsT=3WqQ|jB=!iaM@2Id zecpxH3i@H$QT_i!9vnlybX5cydg)xU`YF0N9WfMVFTN z<@Mzn(6NQswRh@M^@w?*?A#w9?YDCI`52hXjkzxGr7z6k)W479<#neT$z{zHeE)RU z*wG1oO_OkX4!_PSfSu7Ck_aL6Gq_(QzN0`y^O8*xkUZFTjm29D`nA8G+aDL7HN*D9spW)i>YPtbsO;HsUQ&^~)kTkH+K3=|~o5Ha4N>ngNtPI;c4M z9h+R%FZ(RjLAPQIK>}V74&Ng2+&P)8I>-vR*_czJ-PHd2$y~x|mA!iBdmOsSmF~Y1S{&IS1#U{1>B1rO}%8 zPFDxIBZuyQYRbO7jZ|I?ZsiNKFvZszjp2xMf0K>i{%PDvIczT-`O%PpeW&e(YWg=t zM0c{7&<@4=SV(bPPy0JzgxMO0tr&iz4@J}WPA_9F$>qqaF=3~ZUF(QQ6~Pa5s)<<^ zC+-`<)+0ESGz4!?y`G6@`8DhL#IPoR<=|G&kOA0xPU3SMe43Z4nZUic;8l|Gf_g82O3>^$_vSD1kt^V1S>120@UKs(k?u zP>5>cf;dy8lOxzg_%rl~;0x0Kk(K|Se1LbEi0%Z-$E~`n9hW}0Wg<#|&aS?%bDmFN zAtQ|fZw?zXJ<|0szn!}P?tD*ra^xKCc=PB)gD3Q$;tP{{Nrn!Bl zbjxuwQHX>(dm`-b+g%9uEr>1}RH3{^#OHy6? zGI;6mU6DK{2kyyWq~qYH?%;qy&(BipwWR?#!HxnXx2*AU?AAub1B+woWoZfsh#Cce zjq6W@%heWdJ2HEBE_>mZUGQN%Wzy#>(Jx7DawvAbm0!$8hN@N9wv9q(@3Ay?0N#0R zWwKO$I!4x%23>-A+aRlQ!hThIJy$Ww;=v*4@BHL-PoZc?lRK!Gu*)B?CveWwr~>yD zbKMI9ORgJpU#p@A=7@jB8X9M||B|22a=H%OLMN&B!ytXAF7|IxsAK>&blzGF(AJll zUud|%f`Sv}b~Vu-TGiDn|Hu!l7xDku;dL^chIo|5f8X!98SVU>^l6Zs`=S=$@8*un zD+Zzm=`Ebu7WCn*T9-%-q5P0an>4+Uf6W3o2~$^0r0XW=N%$xCw#`5^joxPKD}VoQ zu+F)s3hB`(R4bDABow!A(7pAJ{&L6heQ>T4t-Rb1|LIZ30=&F?NlHev1(^>yAOFYm zeolE0zV7jZADhFED{hYGt~X&<1w+w;lh#E;ij#r3MSl4sZ4QUin5u!^N!b;JcjT0gE#aL@0PE>1@E^YsAqJ= zqqr=T*IBe0i8Oe72WfESA2;4h<9Hlw=j~qPL|vSG8$kUduE1FW^F4lghW*X}Df@X> z4W#T*flokmt^8l2YfRK!lFKqN!FP5Fi2o-z6MMv>MX7wWuI^7kmR)m zoZ7C@AWV)kE^^u--V|*NzfLcm=6Q-PD^*Ns@V1B#g`=lRM>A6@t=?Hx+=SB#FQr?{ z>NoqnGE7&VaE8y=H|vazBBYW+@!`X2^nMTO@4+`>9oGwVYepxz1F_( zo^^edlhvYARB|CjS}`SWg|VqwGo`7`ht-^QT1$q;EtHTNr*%aWqZ`VlJxqPLNYG(# zm0doZ=ZOuwaIV$~UTCK0Fen#T{lE2s>QXS)DA=E0o)zL9V7XDXH|uNR1ar@G458+s znoZEmBqLL~xc?xKv!8A(q^Yo^}eL1YOF)PZn zBj&8FTQ=dN3Q3cl;-#rU>eDpJf>;b&I#jqL)RL?v$PM&#@4?6SeOBsxLAg|(RUtV3 zgs-0A>@t6uDX-F78^RX+GF_7>N;@RZ(bxz^A=Im#_j^T=>os~o^efICz8E7*NjT2be zA7e9XTZ&;;cXr$Ke}%jCfE4nWRKN`zna<)6gy<_HA&{yBKojDZm@hmygad^nmnWVD zper+VdJd41nTvMncWr|Q$9_5__bazbs(cB36)zZgKW#mjCr(MdQRRb)f}R73G1G>}L$7G4s<7zjSz{#gBVB3rvH*)-xQDZY z>h)$GPX*NA!#Gd&2-OQ6@lNHu;QKqXqe<%uP{K^m>((&g-x(%|!N*TQZ1 z0{VYC`|hx&zHQrp1R;o00!Wn>483<$3`G)(p_9-%1f+w2qDT`$5khZDgwT5x1f)m@ ze@GP&M4AF(K~MqFw}a=Lch0%@-21-AANkl}v&&j*&N=27bFGC1>@VhAqB-zuhoeC= z71_}L*Bq66jsKd^>N~=Heh&kiNCFt+(-GPF_N)|8 zc(q&$IV}+N55mL4ba&b7 z&2q1NQBE`Hg#XA*UPHXpoC?5WuxN_cEFf?>v%rq4zkXb5JW~^Gyf8J$2gtj}re?fB zU5630bf7E%7=mKxg~UL1)O6&21D2*aOKwL{xZz2=fzHeS{~Q|AgO|V{B_U6ynOaW} z2<{sk?DoRJ5JCj8gF%(&b3zqpJ?zXVK{-ITbor2dBRPQpow=`!xEHxoH572As6{+b z^IJ)(TchpZE-)=>M{admg;n^f)}sB|Ef&^NXL&8WlIk50R~&XBL#9zJY`?z;$~j(V zIiz%@#?)=Rne(!(zn7#ytP&vv|!4WqUVmvwnD06 zdItKujJgq#vJO|h`HDtZQ6H1n_!l4HAFT&41U6ckeBET%;xhC11To6HP8%VOCrY8; z58G4Qn(AV8zt%ayoJxwaeV8P8CIl58JDVE?F`FcQN=JxO2oF|?V0{wV@Zz8NO;puz zdM;G*WgR)lDNEBPu8A}`la=Y zZ1h^P_d~v#zKQ-NZnkL#5lXGA9656 zor%Ap?26#a;55?K878VkJYR-em{n=coJwN?)|tQTn+-1S`YmEJfg0tNFf?rTUw|rq*#&0S`n>z2zxodc4;&wK*ncvm8IOKxxq`-D)QhLvuac zWl2&isS})2teNJAZNkhx&l8h(-!QzEvK(mCX7qGUlyp0UBvhtYXwzQJoW3O=zHgU= zF6at95CW+nPR%;d)WR#yfGMY&E;4C0iD5%=!?089^26Em*>#nQgbACRgp5E=g1lT! zv7wUOT?XMD-Qvbff&?ircU2tHrw%HVghYze}BPFWO_7ZBgdCMX=Za6 z76V+lIcFW#YS7$2J)3pz4hp81#uhd69fC9oxn!qq$4KrmkO-1jBZ$efzq{+2^b&T5@1lc(@rZe&(@B z_w2b992UAkWZ@727BFD($X~LkLTgv%GnrVi+(xhn8eR$O_M2HKYb#fFMNe7eG)5+^ z$kC_Q-kFdSKad@GTGi5=li>3bn@Zr#z!yJeCs3J~!KY=9qbc(N`f(U*i4BQ1TT!uQ zJlIz%R`&fSwi$=&j$Iixsz*nPqFIdYsrQMzf&**xlP6bRIr`AhEIBSgD?IY;+7Akf z1GaDG->$_x5Ac?NtJ-jHk=+s4H_V2-wIl(6(Kz}N2-fH2$gcY5sk)D z8YNqrHZF5WLM@lHN`rFV^lnd15Q;3kvW#`oDh~n{)9yFwJhpsEl4+x#%kiw`a<+ND zCDnVi;j@s(%=KdKPHh-!w0xd9T~FB*Hy~C!SRv0@CKq?pG?limy)2eFLw8@#o7iQ1 z{gU&o8$@+=R%;uZ#jTO#SXg@WtoS?Oov1*8IDAggR}me7Mu2kZ>yBYQ6%oo%kRSo2 zk$7=Hd>`I^YuEiP_;mMidxIKWD0X zKxZmDyLPEvE0UURW!FYfq_P$9i8RUO{^W9q7+ci#jpc z7On_Z?i^)^Hsza?F>|!)%Nkv=5Ri-8nMx`x7YnwpGx=+e6%x=UT6;@ctil&l+|*qE zs=qSUl9bwJTePjsZy?U@5+LwEzr?!^1wnHqTIy?ZKBk-cJ#`_&=wc9*f}oC8|nE+dk9Q zANxr!Jp!jw^^c5?{Tw7sslLXus~O1#_?*8Krf$4bC2!9H7(;GE;(X%zdBi;#kN2PO z`txZ))r#$}`=bf-Z|dD7d;%(jjh-)HV#eehHp!;yJjx77)`gh&ZVtyqcN_Z7=Y^W^ zVm^Q6L*6yUj5+NK>U~3?e2S?`vL`$z2_XXUJva}oQeoH0)o599DxH}rKh=Jd%jhzl z$)zW3DwxtiSai=F5tuN6%COsD%KJunj$dCcuP9ciMr1gz&&1Lg`=w8mHabXjOavEd z4^Mt%o7(m>e2pVrjNhX88O9}9SH>+1GMhKwtPNPYozf^fL^JdGS(H^evvxMaV!le) zVhk5j#ZYK;(Fy!QQF3#EdD7^!{6KSbYIkb|r>vYp| z1`EMD_H6N%iaNWw#vLzcRV+23FI+^q>BW^v%A1W*DR*xbR^;JR=nibb{(v z{XLpRipvjJMkplK*A2xd6&+s^2#11G`49JN=HsHzvrfhTz&iNewYs|E-_W>HfyXp$ z5i<54RRAgv$+p^x4gkJVTpRS@nQ_=Ul(Usl{1YwKMBBe|`8I0Ad<7mUVz zX0t&qBIs5|jtA2ACSKH7Ywg%j&mYk_a7{$SX;u6F?1z|o5;axaQD?d$<0R(soZVX* zut<6W2Y3-*S_ivv&FM*fn%LAb#3b5;7hT7p!%@sT9e7*b=kfeuwTnP>ZwmjMWq7Ko zArrW1%B0=QQRXdYe|C`jHWIvoUP1)5h zlMZ?6a3J{5u+XqJs{%Y?gOxRrFq##`bKqSOvyca7j?fDIO|f+%qEqvxsx-SU*XgfO zloVg&KLisvnRK2LmI-IxH5;|Xqjya1Scd!H`ltnug+^H3ibXEX&N70%JX$Mxw2C@l zuz&T_@#s!N4^zF=b*DlXshZjM4hj>*b(p=*UlJe5NRO%EHlnKOY)|Pxld6#h9D3w^O^I2%IFY(gSc7@!8StIw->^Vt zrI6rR^{CHR?3Xf-gNWX5&uQHU$MG;bakV;{kNQ3w(BH0@1_DDkP*tQ+BbQc)4JsN`ssGb4j&Y>oMkaWhD;yH5$muTu=(sgW=PQk zg-eT)8#AlB`B=k_vnDBT{WNW!`da-C$k-qLp4qXU&UNd6i#ug~|F2;T>Ni)SyeHwr zYY-oyd9QX}QjvUAJ!$PP4_!#6o0H$}>D%3!9n#6TbN&%u;QY&~IHo1Px-I@i`Sg(e zcd(W>uD`|l+xGuT{^NrLpmye7ckaY9oa6Wz98k8@Vx(e4YsA>!^kQxA;+*u=@$0%)C}n~Rj*`wX#GplCg0ut5hZUB-aheOf zt%jQP;GZ{nWd$GFbqe>>W7yLtkhqH25Ba^F(CYy*5225RGi?HY*J{`5ZlRy8`| zq=*S>6wl~uLDglfgs`S(=8qcivK2=d8u0%vUWAuu0yx;kRIwpt|5T-JJr)sKye=lb z)iiTjM&DI=7#XnlD=sMCXTxv}qGwH*W}1){cXcI_0>-%&)2>^tDro>7`1sR2L&3$vkL4czdqa=lx$k*}g5}N7>zEtjd)oOzZ_|g& z8ohSg#H*z|G>iicEZhV=q;Tav;ThLUyEauns87I$~HEm#|vb-79G*2CWdvt)(IaVA}U zH}*%67bH{Y?U@ZV#VXk*Vf z0dKJTc_FsdCbpL|M}i3O?Z6D@d}i2wR3UM_$;AybV{qEA>Eh9i{8T*0bfv?znEa@E z9sg`jXyR3)PZ~m-1C;9-O1MC|^R$I8OLWCYHH)~GZ(ou#i=F@FqZl!LpOW#J$bBu9 z^#L07Zw7gnwh zdDlvqhK~H_H=8UQ#Q2mAMs^{S4FtWnjJD)mH|)hz=>ngvS0N4z$7F(GWwGCUOSC!W{Lxy zDD{YQq&;d)9DCP{3j#_eKTQ$`M3eof6G+Q*T2;Pe2$eMcPI)YBZRxIk+QYYm#?l2W z;r&pF#jnr!PT@G-wa23M`sv3B@owc7QA{o=EFM8R79aCQ5imw%ziZQL+E!F~u>;=D zLujnh)PsJi!Ae}3+u76DxY~|52Y6JZ|Ape$geDXgsZTrV9F_icMJtk2Uu5y|XCS~M zDj6_9_D0l*UB#xl+MXKi5? zvgefPhXSKC^u+zy2NFTnceY{ZW8KDx_k-;>Z&V@5B4AF6X?L)Fa zrnhrhfA_9MD!Dx|m2jw=#gKa+EnUs*cyw${Xe3-@W?JwsRtZ!alfAS*QUF`#67tpR zSr-ANt;e}kp!zuU=oFYUO0vgUZY)}r+pbRA))+P5c|Bv%B`-S1MRmIQfTJ5nW{oYv zS)u_YCaMo+XyMBr5?9+kHRWfBV$+*^Q>&?LC?+~J@6K}nFyAev`!zvQa&1m~DG%MR zYdnt>$5g+Z&6^0>EMOo7uG(lew$O92k=aZ-pj*|Kn})~xF50TONfyi@fA<(*$IEf_ z6)EL)+R%Oin?%-Nrv8(lVvl!lHUGB}mgw~QZoeb$rnA06y?sGmvZQ=DSiHPKJ z6+-y%zuK?RScUv+a(Vp30lMOC%`Fx#Qd*ajC3voE_ z^`^ZE$ANDw33qBigAUhxtmgFn>Ih@4tKor7O%VobA4rAM4@o5nIKtIhlp z`BPbT1x4AP3FuCA{?02xn)!1l{7#c*o|K{vd;Mf-*AxsR&Ub0jFN4*EEe^`j4HZw8 zVyBtmI736+sNBj5>S;@Hu$JA4^24~J9r}n}ALoYR;%_>H$|ygrP|g3s%CBXgpMt;L85ohSOv~G*n1=r_G{J!m#VRqY8 zy28wQ0-|d`F5x5Hgw1Zl{OpPA-9_^?vlbp1lQ;X{eN4^P^1I#p7`5qxIMSK=)#Dc3 zxN6UmW8ZH=@+v}`pH^+ll|Kbl>PLqIlvWh=DZ>{`T9H)4QetilW7d<9=DfM`dx8MH z#gDj`{sov(4D8Hw2&~W56m~BNse@^LfG+R`0t)DrT(J8CiY`5P(fevOhono;@kQQD zXI0B;W3glpNMouNlkiyvxa3TilXEvDmg4Fq8Z_W*=>RX*Maks|SKka?x3Mm|0e;|M zvnt<5(o2uV@ou$RMZ(GjeGw07%_y}%`@HI8u=B^@R)E0{)c+p;A^QLU2cSXz1{Mlh z(98K`?uZ7g?)s0L?45_?)pcOuAayzg^q*=4v91XX;Ql8{{2#gC-wDR>B?QIcn{Uej zfb`IIpYq#k<=F%M=DqDI+F!J<)_>Y9?25G*s`S_U7=)_kjc4_p;VEMe+tWyQewCN% zoFJ!CDRqPLmrm>OuREWEH^XAd20DHTN@HR*N>EEud>T-q5btm*W40VDR#U8#;=I@E z+jN6{fJvA`k?$JCrDywgWdl7YZhMar5=F;t(Eq(FHue`Qx0NZ+9*iB;kHx#Aezd$W zG4_jQ(G`A?bnC&5DmTHc_#C0hzQ=z}Q(aWnionDAhBPKPea#%|rK^6dq(>p1il1hY z?~sBHCN*|sZsjx6W^8(!Nesf+<@88zU$b1l*I?uo(zrTd=Gf7y1>|+IYP6t7Def+SS-sO6eI776jUw|InZjjY|TW-hmSy`l9~jY++I}l zeQ3Kw9q)0iinY+%wRMV698fNe6`3PCRd!az>Ryx=IuCajY8OnCG;vi;bX7C{U>47| zK`mTpeXr~v*mzWei579l86V)8b^R}RJ@kac$l!#G+X{R)4pcs>4m4Ub9XL8o}^1rkmIk}|h2o-TJR46o+sbqSI{_WNq=fDb)Yo^@{ z7Kc658)V_T*B+>N0NItDbQkae68jUP)rg=sMX=qY#@iP=zjplaY6)34zJ4T?sq|_o zX;Y!?{Kb5yC)zC=V=e}&orZoN>ZEp%ZJ9A40%6?lw$O#ix)gDouF9x$mbH;_Ce2CE zZzpzrqquS0Ln18qy}p_G6INPdRJss>DjG9EBs&PwmZBDQh!V{L zwypx)JEy%}b0I~nZk;>9gVio>5qk~-jt(BTuFUXwnpnbdb62(CqFrrTk^GG=I@&6J z&c%pXA<~S+!MAT|B4-F6+RfuwixA>ioP7}WHn)XZX{B~b)VEY4F+&*#v#b?ElL|}Y zKjhLm@N?54+j%x%)$A7`7%%kM`qItMJd%op_kF?e%(R9^=9xt3c8>e~Nn*cAdkhY2 zT{UcKAr0T`vCo)d(r=aKW^!mXvdAKhcOd_!0JZVaY`Y){WhMDsFXnfz@Qimvi#M_1 zJ~(J5A$f&AK_5IuFXjNw0DxFJ@PeVn^P0-KV>e-MGNV@32`+FOjf9IA+%7QeIpozl zbeA$sve@_0=%NCf78rMa=y9jM<8Y9XT|X))%fJ&KV~d0piz~FAyv>f2fV67YJ%+DF z&ZLPB_6#fgwNmTi-aSsj#Kv&wXAh z?MGbmc6{SQqU7pkfKO9*T^k;I|Kz<}O5&6LQ+Ah6n(HLGgZ`Y*#r0Y1*M`-~*ZVJY z+hA9VA9%Ga4my}VQB}0oy;&9;kn!zpuM54%>63x*192~8Hmh%@$kDZI>|Vr=H9 zCAg-PPJGr{gg>8k;j2PZT<3>Mnm?2zg2K=Am&c24Z(l4o>8ta{_3{Qhm1M5O1B)!V zNai49^t4`$h1mpbmG4bS=H3bxwU$_&GIvH^i|?Was?6258`ohohU8Q!-!HWm$3-=X zZpB$7@9S3Kq?tx=Dr>HNkqDCIpjBU13dB6AV2Lq$b!)d4=)B&c1eVm!%9-zm7sZIITL<1d!1Ho*#5kt_Da#A6;dK^UeW z4cEpW?Lq~?^o4R(8OD5QG&4_oj;iN~F1oPaZlKe`Da`t1Gqi$w`+3DFLhKhBgL!teod>I2g|5u+(5w`Xf4%#B4`D@%D++V#onXMe2p z#emB(B;YR7@+|Z6mCd22B2b&Bf6bp8AT1C`c5QSqutWk zjnmsw5Z2ru-h0g??2{{odhH*gm$P`^a4fpSd@li2sbZvoUd{3^>1({;x7G2d}qHhx5V&|8n<=uq|K|U3>adEpqmj@ zz?SlQ{^+)=x%pjiEnlmcu0E}}A-)fD-X_fQ3LbR|-`r6ec_%roGs)bW&to8Gf^Xg+ zTz<iwG5giRBx`Glv3*U=Lrc9=DL zuVB-ivYRFVYgvZ@-M!kq2|iwq5c!0mdPMY`GKUxg=C;c@9^+=v(&e+x*tmxLq0+WyQ_C(k zbh8d4=J;Xr>Qp5^S%eBW2c~4XYku?Y&Xfj)c^>y%yI1RbXY&hXlo5@ zwwaKO(ETkozB>&SUfB`rEv~l^|Jqzq^Nr12F6jg;UV|^!2z$`|Oi(;)UfGv^ad6W+ zWIqlp%*fG2Dy$_e7Zq99>eq*kil?UeuZqhb2Kf7?xBXOqnRMMhn|D268VVB;N-ULb zm}4*EG>v>)I;5bHEo6N8Z#XdB5e}$oU&e9ysmWG_1TCtOJ;jkTen@J16MDf&xNYf+AY89xvT*Y(lW)&!UgtrBLQ3OIr>3Yqy%7vH z%UbXc^CCh_R}j8?!&CjlPs(Dy1#f zj~#X}UySB`f>zG%u)g_Vg&N>5bH8`M>F9Iy5sQ2SznQ<|h{paw>(@AoSo^CTu{AJO z+vV}UCtdm3BIP{p?n=}Dea1D z-Uw(dG*B7xN$mVMbYZpQ_*?lq+4Eh%r5zI=bB<3EexT5$ z%U8XZa;&M)+5g%er&(FxB_0`oJIMOUYY4Hc>O50TK0K}{q<=tWKv5GPmT5-}(? zY0$D-&Sfy}>OAHEnUT>q_nn}PhQFP%3H6ywwka5HMthgB$ z+{}abZhtz15r{*k?dR&w(OBSm))-RJR>>+ttY%ym;Q(xGyH-IXs%>FZUa^?uHZagH zBjOy!{@879*(1Pl_OW?HP#SRz>XGvtaRhFS>=$W|4X` zVpq=hX>zq>m(O`kGW$g?zdL^xPz(;&#o9O~MZMd!^+x?un}dDlzTo{I(iwMpSv`5& znl`}tP8D@FcI zfye4%15={Yo;QJA*bD0=O;PXC3348Up{-*6svtk2x-v7~vV29Qfs<9fU8?Avk_2eu z#8Ccibn%G)q z^S#*GTSR8WK*j`CQya?k1sAk(PC6tEL3pdq84OrAH-T9 z49)sesCaUt+Dd>D^bva{SZO~80-+!O1`dIr!jqcz|2qGYe2IUWj``1rqb|E)wp?3R zRC_pPW8%5(=|_0@gQDokPZmD+zWgBAV)P7H&)cH0GG0K<>7*Kbl$zLOrw&J-2H-I0 zUk_Z$h~&BPLMfZ3sr5gA>GIM$4Ttuv#BkN}PR=`lp;W0O=fFP(SF>|d1-P-y>8t4;?+wQHM*NPZEGCxsba_{Twg!{23bX*55lsdGKyflsp6E3^np`G0;fSU|?V{6cuE&U|`^1!N9;Bp}@hwzy{e)l|egT-L>SU zV5-N-ccDKJY$a7CVPI+#(H|@jp}$dq3I^^lFqpl+|6m7QzF5J)JQpjxm}VYtacg^%s2f0ydVkK(?o>mDhpZap&HrTz)GZ)&_l|CyB)W?vjB9z?;`TPk>Kr4W>sH$mm%*EEgBV!{N{WDB^Y0^>p>KX0_{_nqpM;rtC4Xknr~iRWQ03c0=}K z@R)UXSZ@w+{TDq2xoP0-)&aIK>W@~NJ^gg*c_)U>2-o#$v#x|o$rH6koYij(hvh57 z0_#RYG1&yG-vF*6A|l7WKiZ0bfgUU36ggd9s%Y-(xlVMQ5f{w{ryQGoWA9xoasW7r z!f={aM~SC9mTadSad?7G!e=XQU_6>*L2l>Hp155Hw>2Wtq=07e<|GdyfZJ$GF$;XP3M$NkVr27RTaxTI$fUy z?h2w>z8GXuYk$KRDIbk@BjUoNjNJl2O$U)uXg$b|OygEe5)GoF?Pb3qtY{3DzMQt7 z%xUhC6nrG<+wj-B!lsrWn*-vh{j{0t#Z76XM6HRZOh9u)VMq8r_^pnmh{}#u*j?WINbAm0@+<7&kam4Xj?}18p@P9N zR7-Gc+wAkrVTEdhh-NGq@Bafl(WVR|QJxxZef{yDrq>^O1Ox z3sF-U_A*~((^;nz;FW<8Rd17AsHWI=)94Lxoy&++>nc9!z#o;ngG!K*Z&JNOh&Hif zqzi(GwOo?a&%bE7fP{_qq}m4%s$VeSTIoE=m_1__t#BZ$YN;lFjHM_~K3NyquVPVF=?kYVe=DsUKdr3ef&c@WC(^9J46&`jzF}Q8o-JoG z)p!xRiwON5;^0`88u;!v)cm>4PPVfFy3rpxmWLtgmmECRVV1IO*m@C)9Z_&%&T8`> z>znZdO-BH0`Uo*qm&Zpea)q=KR^&aD4;;}7Xp@7;EZ2p-V&reF<|NEXK;@L-^#U`f z$P8sKV>sKD`UeDjj2B{c;k@RAAbn%QS!y}qdDt2c2smnJF(=(!)_M`5J21~lRtg+h zLuS#|xa9|TxD{!k4`rdUwUdNQWl{(5QGVsPH6K3@j*Ydd=iG&Mo$ui=??fH0!L@Wn zYv>k47FU+1<7CMf@Vz8!eBr#8k=IRvSk~L`i?QSCPP<_|7?a{fJPs4}?Uua#cu(6i z5_y~;pvTxUoK0a;H;Eu7o;JC-^1ZVMrOz_|kC!o#lgk&GG8nIB2q_8Op~_DKq{GL( zTAwz_j18mRMVK6gT|@7(T4OqYo-tJn9n2UjRCkF87^oaQYKKz>dtDyTrE)mg^QAt2 zrcVR0S|@)A_03M#nH!-^|4^L;3WlRM4`6b}^xxCgz;Z@+O=M(Pwn9 zEpY2YWp=E6RWq?i0f~vUSS7b_rt&AL}5oEs5g*h}dHS?b_BwNhJ7~^F~V9Pn|y1pA(V%wNnh>e`( z9T*$l$zFXZAsS|nTk$_1tMT7rd%~BWhR>`PT=BMSQM@87#Jirt%6;y7xYR2GUe}6O zpDmJMB~Y$j${R**o32}=%gbY}pR+go>cKD&WmDaJULMqH=$UB!o@a$>RoMPIj8c$k z(1&U&J`x(Vgk4WHGt#n$R@ycr2sM4W2Tgqgg)pYtXW$o%afMxjp5l-FuZ{A1?oMe_ z&c44@QG?5WSFYanFuP6l3EL+J)!bdN@<;U^-b>V6iK)KX_Q2=yT;#-Ka1ccWZryoI z_!vX2Dc*KhV_u})-3&VuT()v3a@6mW7o!Fq^AZssIS6r67x_Cw_gx$eB~ zNT+e8afP?uC0l*;F3UW23j#4Zzk;&SEtK)-zVrCr)6=tvn#b8nz31yz&V*Ab)R!_j ztEo-)^?S%r5m|~H&|<|28BhwY&2aV~&C_KIeXmB-LwxgN^%IA6K}^c>?R4?XDKoOz(uh3fHp=X8EoCIl!`Z~7F|fyY&jH+|gOQTHK9Pgdz>RNaLJ>ISMSV{XXS%ct%#3#zl=_E-n2Ci%laksJ|&2qPv?1;#mR|yFBRJjIqFX-&0N^3@q6!;m0InZTn;d*typvs z6sIco< z;t`$XALvGk#{jWmd=@`W8OFa^H}(WCC|pFfHTFDJzP~XtlYCG}$Zovc(*^*(NnV&E z25?lszyIZ3+4aO|=6rSMO%|?ToR={Ol^dna!nQ1UaEe zgv=Bs8}Rrkj5acVh%@(J)=pG-4G>`7mu1_P)eW?RbFF|{pSkD<{EQvnGm$s zvY~{$M#~sgpDa|~WXj2_7xi*{n2tj0QvO;w&`wm+=RJ9fWzqSewiB=E7e3xLB!CBe z0=Ljt7Mm$=*Au|ie%@H(<`c4Nut;A5kA;S>7H-X5-R!(CMD&%*oS$_;$$I@tUW8~1 zabmvn9ZxYG_!Xak1Ql7$6UmtXbkF}DBNw{32g5nOBggir?BvyktJ0z6!q z_nOFzOT>xi5K1D8R@`h}S4U*1S?9gh=_eIbLS(M+4bm9k&R3j8c^$B)2W5W}-J`t1 zh2f*kIs2Yvb`U;@I+8zBo62fmA)qxGH!OhW+pde~3kFy2_hoiPZ&)ctdBc-) z5F&6OQy>5XuuFs@V#P|)G40;#~8{aKA zAEVHRsMHQ#eST+n^;$W?5XcoaiR#RtNR03*o_e8-O%dLIMS-KLt@qpONYyM5EM-(K zgUr4xYMlg=fc;3TD!9i^^y+OdkMj?4)VND!5}{XFv}(z{3=dzJREwzH>Sgh`*62cf zGBd^mi$mkNv=5cD>ma!b7wsr9e>5s6rG(D9XkPrPs10zfg9-&)x9Me6HE4_Jjgh12 zV}HyE*DpC85|2WSR-%>k_#hCi8;ZZFKKlu^h(|Xp;H}pVvh|}VQ;@^Ud;Zc+(iVzr zz6eS|vfrw!g7qg7_uD8RzSXp(!sUrY>v&;HGeA;{3XsP%2*Cy4vnW$&z-jFm$OpY* zJl2n_fVFR-4Q^&~(%F309Ae{Ky>3ny9nmwbqEK`$!8(t$fXoQuH7nG_b1bY9bLHFP zyN>|C&pKr75gO> zP`?#McDQXMK(F^GnVCSGFfkdoW|1{VDR_IEX*9aY6cRenD=q2PoPX26)pfF46L=Cf zVXiajb=QL-szwkb)y9;u>TRx*=(0ekJ7-q25^%ML!Lp;RSEs8*hgSaZiUKQQ6PS41 zT2|?pR-cYtTHV2vR+k$P@G0TiR8=p3dSSjsGk&y8Xx^@ENs0Uo<{yY_YJcn3^I& zUc+o=ZiaQDO}91QvP1L%e;T`cEf*5p6Hg}ut}@Dh%FKVNtyx_q>v(=l!oGQb09VUR z8Q9J48Ah|FuITg2{oGm>0u7nmL0<%2|#z)lf#9{0YtxV3r%Btme z;&+*4AYd}d6y*f`=%n5Gv;IJ&EC9q`IRxR%ZH!GmG7+xn(XzB^9vC()+FQC+zFwJj z|4yo1Q>NCQ$MRERC=z6WgW210KX0U-Pb$X2HKL;st}RJlQ#jS)PDeoB(5Ai`aF_Zp z{9e~Mz%Wi9uYvm6(#JzBgPF|v4WIBkXFl8({rRqnsb=_%ZMki=_;LPnlm&$-x@>eP zQ}Bh!4Op_bfmSm;MlB?m@{LHp8%!|04li~tZZ(_d&z5d=%&0&DIh`I8hIr>s&Bgd|1krKZaG#v>@6JxS zCb4J`$sBgy9=A}6_y*wwi~4@45uC_r5&b~GVlpXmVit&UJGJ%FR)#%@Hn}S}oim?= zLadz~<27eQR0da^9FZK+_c+?On%JXuYz@N$!Xag+X*#ah`NDk6HjSebY!}y4c_OHc zFTbJa!D?IfldO~*WD+v^@qpxQn@Ct2V{*$ja==84FF%kUMU253fke6aJEs%-F=Ivx z-szj2bYomdp40^o$I(amUF=MWAGK-OK2KG}njZW*u-iVcqgQ50v@&oEHB8F5592VP z{79NAfAwWxxkH*|h>THranzb5A^7eU5&Fxk1@oYj)GzVZSJN9I#Vt)3SPDNh3en#OK1^!8k*R`aB8zKoarmBy4n2LlkMc{q{Q9qW06ceWo#KmQhMmX zh~FI`z-+iiD<5+Qf9oY0I=_((Pnc`U7hX+`y~!vg1Mf)%=z&9>lEqB1rho4fLHrof<5AXS?|MPQgu$nXxtJ4eW z2sYG3$cFNw5&!_6X+|I2c}@Ri|J!mrrXZ|Jd`(h6(5pfiTB5P#T-e3Ftzi;87{VCN z9K||Z;{fA_*u9?|_ZID2#Ljub&W#e}T9Z+n!~(Y`DJsz|^{MyJe^1~e$!%dr6zhG% zWblSa^Nko5YKffkRiE`(5k0m3_sM|eydH`$GCD8<)Gktly~}UkO7NMd4x*O~ z=ncJTZquPSTIXor6}r@B@VukToqE;FY_QpfEa%e>1tx+$@}H^9%GHsH@6WdL4-Sk; zwE#xc9W#mU8rm_NK36PS;(eLrL0Qrj!2+p7%tK~Bqdn*u6iFJ`siYgyuuVJC{GH-< zYm{YH5eMVj$lRMz|6Q5F8SW#g8BHwYNY}MFD#O~fM?H)fU}O=b-{E6XWIZ#x)jL}F zGNZ5+Xj7zGpTx;H^^!VcBB#fPklJ%IAD_2@A5J?AM7|6(b}T^V;_?iR+_K=CUTmx~ zYv4AhD%1v2Bb#v9=;Kl7cm}I^UZ7XEV9p#l#{u!WXK$2TO1xLK014u@earDwq>RC3 zwV%5RQ+i|Yy#|pRKGBZd--Pd3xq4`&7;?R{kT~nSd-0A{mF~z{C#tTF?EWm%?zvLj z#6dovrAKfsgt3|0;XD@mUc4z(vZl$xZWdEm&>B$#o z<4qw(oNKw~YexepP%2=I(4m?@r0Ccg@DC$nqdi?+Kjzk9$Fyf?;3e{?@{vT9*D72% zx;>_wtX{2k1|re()y{>{U9eTq3XXYj;H4IS_4=gda;W7sEnDbFjFVkx(t!d~F&*pE zXlhE0G+16SvVfNS$=v$wG;vz}w;Ng5!lmVkgODTV?+~csr)e}vO?}Giw2z#0qaX2) zzh~ajCP0b_){o?(vSCV)td~nKRp*`;?&Ir&Vma8u3XM!O~8leQx#44dMsGxNroh75gA=Gbj4!EaEDW)i9KKW zD^fu{b^$8F<5w0g+S9}Z3+@)2vJWpBb_`EOH6OKE4Pz1nK;_KCQ9FMH{IBh5KOc0o z!jDqMc0~f)vxAJv+nU=Cj*b#8`_j$w!dn-VSXH%aWIja0<%03UVc+7?2eyv;EsCUe zsl1dOWADBJ=zMznc*Z0-0#Kd?6?Q1Zr7lr>#H4>icK?WrarjEna#V%o|ED>Uwa}{} z3pi`Z1X_TatOi*kU5i`7@Z(3vinN(;HvW=UPW>lE>ReV~_#>|As`$@Nnx7rs(7#L( zbRyFPFYo+e<_OQ!P`Ch*m!R;UGm9H4DQc}zOtG-^0h848=d#Md!k0^(w`u6;5uPWp zxGb9uCR?2UnM?aRLFuQ;+#pXTj<7MJN<99Bad(Jm1AGg$Ust$rj(n1YSd)2!FJTYY z#uVsFOoCax0o@_{k^OFlKo4+RsS`mM{P+SPBz z+k+-4T-B-u9hSJko!5FgZ{YD{lxKDFj&_T}h;qM@)|icOHDn<$zLbip2rf&8QxmUB zr<5;iD42LK=cV&#M*B$0Hj+>i5swBz!C)Te`)6Vv#ne+q$-E8= zPoWf3l(KYL9#Wav*O&tUS$3Ja#`h`J!cqi2Louwk@|OIZj84>)nUma}8KasS_l$jn zh_81FGg1E8`IG=e{P8;qMKv7MAEsZ9IXnuTFu8KOT0n(q3kxaRy15qNrZHF=WNjrX3ZDAf3NVDM_oFC~EBhr80g980f3L zd9}>_p`P{Mtx^v=Jl65O#40{PFhU0IU4yRymeXX7DC>TgIMzQI$mVzsEV`}ac7O!j z{LCBiQ_a?0gafEvt^l8u&54O+Bb^Tm+gkB2pGxj(5@<4jbR)FM9}Div3we4~d#b{C zv6V>?v!#gj>MOD0u&oMghh`N@!oCevqmMa#v5pgM5@7!awckhTUzz?({d#(zE}N|x zcXAa+UMN&b-R698Mp#oeH8%H$Nv&d;ys%zHB!2r7ya@{}SOeE#~`KNxla6 zKcpmh^rcZeab17awJrW?0q^0AQltjbX?op0Asapixobf%yB&p zPt`mw#e(h*>LyG(?um6`kOi~84SIDXc>^yOD@-eC(mQ6?dg75yN4_jDk#%Rgbh3LV+%>b$y%Z2n%?>L8jlM>b*F zZdPaTM7)C2j%KKebZ19SyEk=LR5P7cK0XR^i8{u zKBZNX1w@SreTO*dtOWRM^uw=l5)RMOYrCKFG zOo=uyX^lWGbL3Z>f8pbGfU$?rfKkIio{(fM4b5-*DaI#Y@jzBPK&#?O$dFP&Z*tlP za%a(};hU&d*20;L>RhVZ_pTG^#V1)^<3qbsx5^pjHJ_$7M!X>rL=Q_@5jfgkeQW{d zz&ZuYYxSpLiQ6Nu=ZE zD5;{5BcjatMX}$VNb5|7F}?7Q*PK`W%Xd2Nh35q7#=IWQJ&KsuM9`Y__qNr`j;5{$ zmzA4$vsEM&*G)UXCaUGY0kq{WQd_u-3UiQZi7u{DWPMc8uIF_q4QL`VOu-plx&d%V zg0Y*xp!2S~?8KFuD>Ad2;fcUK=`VCs5V^Zqf_u&Ll!<5;MS~)Bard9B%S2VaRTUox#%sQQIfVx}vZfC78a> z2H}F0)8y}D9mXJp1M+eLXn$6{pQ3u4@>=ncPuD*jz6jgGz9CGC|F+s5_YE>nvI_TS zA!t^t+_&2P0-D6pKK-(Wk_PuwkgE^~nDSnaVfw_BuSJ6puZ}c&LoQ50Cb7ub2?3Iu{Ipn^eGr4o_DF-!KM3)Z< z6bTt<)2H5KhIJRy-#Ifh6aK4wih9{KCxNY8+?>CwVb5;`d^SkCIzDa!L821EiFGuP zjFTT1O&N<=TY8a+aZdP9QSmXG#!F>alm*D!6C-+YKu)^bKsWlUX?o$Vo)cnK0mAmg z3U|OTTz__`w4#zXG(D|fcH5;azu@&~>(>7u_q_L=Q-z64$pe&=CIl9{{X&y3*q40p zQ~&WKWP*0x_fE2}^D{+mQ@*&qfxQTLxpczduw|-D+s^IC!RhJ3BsssW+?SQlS`RO# zQtB{u$DV6@JXeGP(ICcJGsUo$##5%m_sv!6&}-Vm(1_Bx=1Y3f05p>%H~_dvy=;Gc z&fPotc~9}|$xO`4p(ug20#q+ZX-ci^iUUb)j;M_0ePI9OKnr-Mwd03tvK$djG1=pP~~o1aiO-PcH}+?=s}r+==p+OSfG; zTSd?Ir^1RergN4&8cIgQvZw?FkG!!%QjEcsjN9T4iX~A%&V#))#GD;{ckX97sCn(i zyt0Fwl43wtx5`FV+mp=R*>hlt^R@$1fAcF$GMXxlwk{V@ny0iqL-AK5fnW4exJRQYSO!53r|ZltO)wrIOM9ZWNDw#_f3aD7j>-gWe`hGu-jf4M08mb7TZL5 z=%*EKET@w@p!TAUV)tO;H6V@pocS}nM2BK%bfthD)Aa}m z89>G&S79xLttVfN)Ov6edC~L|^_stM3z$fG7#%-_;>@IG8F;S1u*m8FG1X;AXy~eQ z=Ml~+UvBjlaG$6vOsKwbOtk(ajnzlHMujLesS;RC-3|wnDhP~pxMhE;5$YUbVvxlwZBKh?>?Dx*a4OUTb5yq?PC^ zKJNA!;2XJ7i1lg^=Ix7VzC?O^Y1k@_G_2k&MXkYru}{5o!xU;ZcroqGXul}V*<9!x zw$xWp0`e<$SL_4oydM1tW<6rAohn^yvG0{BpI0NP%wOQ^$q;rr; zCyQPLyg&-XzK;m?vM{y7J*O$-r~CX#jVzKr>kWNlD5Ec`6vr!G*lYeUOg$zq0Eqg? z5n3o6-w`ZL`C6lj&ROcRi^s^`$vQ^X81I1-ujglgixHLGj+`>wTtlK7h5jS#qeyhk z(CQfaFY+U5TnTG_@7Q(+O=C%D;WSRhup?9ko|jy0_Vn;2TWvW@OMz6I3# zzHb$JAqQ~S##p=~HDtTL%1ZO3dgOimH!*EXPZ33`T(-d*G2S`3JwkWhPZUx)t=cUC zl6<7`UXO9@`3*m6(hfw$JEf9BSu^A+N2=w~O3hy<)YPe1h?4%amb$ant0YYB2 zs*JzSn(}OJ=>D@dQFXVb{8XLW9!K-Kf|8}dnvrsf48Ms^jL3VX6O)vTOGnzSp}|g; z88nyA%{ca-xlo_4w6oUl`QJ6qD(N<`DgmcvYd8MDu!-3uslYcz&esfag|^^hZeNBA zfj>d*=Fu$d(G2VQhx~t0W{E z0dHMqkMOL~_cQ&}e2wA9O5J1p3{%e+M%f2Twm(%0M%7jmyP>q3fuQUF0nZruoQIJL zKtPbo#fxZ%_h2;NLuc=w-vXk@Me1;uM)GyD5Nv-<`sd|(5 z@X8_@9|+_Q$T7$no<3{po)X>ZsPbu65>bh&oi4cj2)uAnE%}R0D&`Nec7}?6G0XVB zF#PfWX!Qn+F_R}S1=6+jMr`N^J0n7~th@l4f@@b-#cnLy8M__xhPPvOi85c%{F1$v zZNDTZK=|YT;`uJBj;=(-=A%YckDf{>y^vp99+m-~!A`~O2A1$to|PVRv;jC$!Eux` zY0ap>qJ`VBiqE8uplq(o%8a{iTJ%0k?K=J=q)c{3QD8ZN)i$JdS(gzIZ`P-K2W zpjDOFtN43656}8K_tW`)BTtE_i_3@3RIZgJs@&z(TBBDV+ua(X8+|=SJDc;LwjLkv zudQQ_kD)}DKLWlTxi!XpvcZbG?E}SmK^>t7fV`Se6Km#Y(Aqa_meDNyK14_a&ME(` zqfpN6R)TNQY?c+;iO_Gpt9Sx<@%{)g4@b3onkfRB zuy0WWUnsR$iT(^(6*a}}1;yc>!3&%b3lujV&WNw1oSta5JP04tbZSE^`ND#Gu^C+`8LjXH`;IT+H0=jZG}6Sf=WtpHT#HD8?D>+ zb~T=CMUWhdV~9~#^KJapti8(-qI$cF1dn+V^i8WQbc^{k~K*aa-1G(?!m-<*`-vjTW3co1s zV%+=3H2&nm3D{1tFqV69=?Fl*BHO+~f`;#c6iGl#XTRDZVwRz^i7>&tzR#)LPK#)} zg`=44b_Dn`I|4eAtzVU>y4YzZ2Gjp_drU4!E6NXPdaw~x6PZD;TDl!Cb4Lx!3O<$n zfHR=U4ApqCjzs}MqxGqIT-N>BL5W2qoCD!;H{iOD*#4X)AduspjQI3=%4tbKh2!b=>oRjz zmQ1i3?`Nik@13)SX~cx1Hz0Ij;ul%O&j0M76eYs>fbrAgufZ;X%^W>{l->mbBn*SS z5oYtzCeY);dy`UX1n}RKnrx!Yp=6SA-M_7nkHJ4%s&=FJm(iJ1NfL|qmc#F@WY6ZM zz}~{h<)0C58yq6r=vzt_W1jG}`O3mW6)!%NcAVV!>(76nv3`ho8r)&K4_^ z6BiZOQH3ctqe{Zj8TxXaEln0R_VblDdt9S}?g!T&n?rsdKn8fEOT%i@n2)c1(k)bXFaxJh$O?a};@OH*h z1K@#5OB91rpH!_qt;4MU!#A8DhL132@ke3y$5@BZ`U$-P^IWO1;})x`0YBtsuTot| zYZl!ZGz|yZ~)8$(=R4KeiAl7Sm)C2zj}1+m%dt zg{sA;(bJ91ueKiDDMphjlWmnlJ9_pIvF~X*cYO0H{7*Bc zd^}Q`0cHV;%H=dFrXb?Jox}OVlN$Qb%l@j*aF2tDnZHZWe6-|GF9L>jFGXk-ir9}s z@`5JmurT!j8lfIwNu!iDjghmG5m+Tm&FSxZ4K2i}UEUfq?HZ#=gTI!jFhRr-uSXr7 zm=XCx!A^?{PMetl4VLM1DZDM|#g0{k6hCSADK2Z%oP*2jyH$P{nMpC3>c|+)M)lJe zR)mHRxi7utG5q8Y*P@#=o}6^>-0R08&N$z5KV@2XsHTwC-}4Ta)7Gl?Wo|iBn<$0I6d6_y zjn%ldbPdxg;hlWhIRjE7aee zp*JOjKh}WWQBnTP(-6+di~Cx)CtrACjjyH^r|YLodl8Yao+)7rDAEJPVHL?c5~^fw zYU~|^C(NfJP1U4bW-)Lq$g<5Fb~C6bf%yt75W-H~F#gc2;1DRs-dFdgqMbpromEi; zSG{LW{tKK1y_`2KS!)Gps?L-o-Iw>)wQu1h@i!FwXB^}_xMhDZd>n>;%7EU+DwsO6 zf5QAD7`Q+NjqRelQ_pS&1?ILK;e~-5sxA{YL3!4pvOp`QCvN66w{WBw%HPRHKyU3$ zYTOk{p`7sj&~Fhn07?ikeZ>dj7;)WGQycjeb5`P7=?`SgiFWz~0|v*#6O-Jj?}(Wd zj(Ma;hUz;W3y5yR80Nrp7o+SOoH@#{e{f=^1w-=Md3>_s7#&1l(?s+irbY6BW1vqN+o#)37FP%SF8EN-~N zlVkapb-uww!u?&FJc0eM@m@g_g+KU(Kwb17b)fb1SO1$eTY86)m2UZ%sg4*^a!E8x z_OL>(=I*7fwVV@G=_S8V>1o2Xob|;!2*mxheoOD+(R!0ss404aM80p@J$vG`_R6gM zh96zIW;K)4cl@|7#Np@FZxBj!W}?OJT4~>X5ygjuzyGB~ ze=|z9PKZrA`)jc(Uu7)0ocp!Q$M~LqX`LOHk3@!fc?`ksI-NfKOXCYK058G6o<~gE zrRn8|P|CB5*>N@k_QowJU@>nKCL-UStdzfxx5jJvVBvS;c(Qk@atEXiau#Uzxzxnqo#F&n|c z)4hl+|7F&{-VxH?yn-5ZmCp7Cje{oKnt62LEF{z5dEh(!dynw_=t%@+X@XGK`!m7K z)M*5>F9kN8^dllHDQ`7copQRIL9mFz!W;V&WkD8_%F81Vkj^7UKR zLaL{4g^Q9uiA=qFe%MMH7PQn%pe#*81PFdV19}(L_87;W*TPYwE;R}BmJCynGQQ*W zbdr~laYYT=lVNBh^wEzbziEdZSIOMiOEe{00 zWs0}Z?0Te?LM!&GuDe%#aqnB!?+}zs%zulUdq9`=(*df79;)`MCC3_E5MN)9_;t%f zz-g=*dC&2K1FjUxBH=^y2#h?+qBvi7z-5KmTjb`6prfNGiT3AniE9Xv*~6Au*VPnR zm(R)RKGnG}bOyp6>`~7kSHNCr;EBZj#Pj^lY5*im;&FcBX{4*=A~xu1v@2&{wE2EP z8PCUm1J?9-oqv0;PSDDyH$55pCFoKsWt_4toBq>`nYQ=Uo(aD1^dNwSDaSTHU|u=) zwB!`LHQKo%Db~Gw(<{iCckA^uHQ4pAs26m7#MTvXon}-6zAd8nFs<@#9)?4vztv)f zGcI`{gC-j=>^L(`y3)Z~p}1}E(&6;fb&5M&vrJt|p%Qq#SC=WtVoIReX8*4kUaD?}HtLwcncL}cywu>hEl>9t zP~mpiP9(EE-EmG=1@e5)JaRU@JEMi4IhQwoFP2Maz~`sVur%=Q$b>g{%BTH(R%cEp zz0Q)1-s^>(QQs*ZE2IYVnv9}P?*-iK&_JP5S||}Cy7%1Ug@d!FSG=nxz;xC2QOxGL z^qaMzvoeHciM!m1huvkaeL-xqhr>dN=b7V<^P7pT^INLhWUA9Wm@CLR9R@P48FuhU z@f#gnGtr$s24Ww+)3suTSl_A2@Rvpe7PGD!0>O?T6xDHMm}wM7$?ZI&*Z`m4x*O&Q z;`Y8F`+emk!?f@@;&R>y4T4A_q(bEv(u2Syk!5G%wO<3s^6Baf-H&@Ul>VoQiIg3u zhh}~r7t1bz>uqLFinkl`vw;e_-n5^yHISNrdWPwkBwS8yt1D^pF0my#ZzNPfKW33N zIR$9pEhiJ^&EEGcoi!?ai#MqW7io}k_wUccx{Kp*k(f4W$qM+Pw|kR0DYZ+rRxR zezUk7e91UlUG`}popQ}%t}@d})GOG}b!}ds-=fp2i|jaJ$ZWhTLv3ZyZ~CM%~N;l0IpzuAXAYWh`#`aCsjqjCSZdaxVv$r z8VQjAP!5CM!Hx$y0gb!pypR1>9k1hY)IrVBDbQ?e-9}&uhngYik{Ta@72<@(&}?wk`ZSLd$g5d_7vN7gWlxfL2sS> zX(TANI;804kSP@LWHoI-@CrXTS3BuGDB=YSthKdSDGOI!7CJ2-bA_ z`IYlPaW1_U!E{#qH=IA-RKbB8dtl^;98OHC5#hnO|8|7JI>$g^1Cjb?I8F(6zg@Sc z9mIsXgNh!n7QzlVa!$NOR0W|f6@-ZM-MqC$lm4392I@sw`j=*VwJrad$kq+vOqFxw}ZQz0|#n9 z-LPXf4&t?Rlz$}&fG6j|%Y^^k1%Cy2m==HT2&jP(ymh8!&bf*jzCVW?a#99{M4RBh z(TgAQ9dzGl!u@w0U&Q7zFT7;)cU;CSvqM0YJ1-4$h`##*i$m%iM%(# z`_StSjA1ACVK<_@-K1q*%rir3Zd2cH`c8;`pu?as4xi4KDp4lc{*`rMYO73}w8~sn zIySYY{G_~ZR$EaViPfdk?Yt5O`6z3bZm&U+!a7e_{?R zth2}62lkp=uD}QOS!ZS$HO}2%m;ENi>4Ea_Qg<_Gz(tO^gQtzwy@_hQ37zY=%Z>^e zrK4?2vUWG2|V`30R;`<7g>?rLYe8w-pr@;qwvox|utM zy>HmKC(f!f-@C}_7Avrk<-Hi^f6G3d+;Knb=FS!hdyFI8s3JWUCtpY0h=V+ZL4IZo zQ<0ni<8>ZNge&OcTd?*EFxHl6ami2aGpS1Ve$F~zZp`6wNOVMM`RP$uN-3&c7+3^ZPtvTwvi)Vc5J zD-VaiNxgavh>HM-lIe&)6)u~k!OLJTBGuw~*15(vYApwIBz#2Wcn1}$u} zxq7)HYUPLJ%xbaa9K|S)VjclfKSaS~$K}Zj+|IHB6KMEnJgF6vvs0f7r=beE$z+XL zxqsoN9E-HLv18hxTPe7ci55(p}>8sx6-WrKTJMA3O^t=!o!YrD1 zIAA)FkHl*N@24_HO=*=sv2_m*M$39tB*l)sFAkiUvXV@iXzUQ44sZ$G8qQS`pFVci zX|(*geMrgiE1%ig;pbB?^KRF0N~Xwki@fJoG1vt5v;-JEf16}paaU$fkV^2zfI740 z8)g3lZ942X@~0ie*02MG3Bw!mYGg5ds8zH#R<`kz$)v*rYoi(pVadEmAJ7X5=Rt>Q z6yRA89h54S7Du*rbV+s1Vdd8!eLjN>_c@=xd}Lp6n9?Lkw;_{jG;vMIp81gL&m7Eh zxNOMBNPp#6WHG4dyhgbQ3s1h=-v`4~&EB`%9ZeFF>(UsYIAQU#LbqqMs)bXh5he4zbhbooap2DkMmAuwq4YW5s z@1=MqI@y_I=HFeuqNA{()X9_z@v}ls`(LEJbyOTp6EBRry98Mrg1ZwWxVr{-C%6YE zxH|+7?h*(DcXtgI2n2VBJ0y9Y_x;Y5bMN{7+ufP%sqU^W{Z$Rvbr&KNKba_b-N$QV z(LFeapjT{1aYW1=6=4Zj>kr&QN&K_}yUYC4LQhQ@ZbT2kR<4TJV;@YY-km8e{$#!V zWUe2Bkmom*#(^sfZ~e-R@q2AoK9Ll@gn6OE zq_narM+-k6#^jS6;O zCw&^PAM?(MhkkxXSNyX!yy_(pYT_0SgCYO<7O0|U)mhnp`5O&lxP>x8>s^Ir^(SZb zIT6{Kg&&&!tuB*RYVG+-miiehEi{PiN>}3_H=}#W*&@SA9WG8A$2MMPtv#3EseTtUtkzWEvwHU@Z;ytJ+ zHeYD2Cs>EGoJLYlr1FLQ$ z@)N$ie$X{aGx2p4y2y9#jY5-SB^Q|ZPDL84>&?p$xlwWblB70MIS_kYr&!jPKhp!0 z2&)WCQ|vbs2?7|`>aCvZA9B!!&L|WQ3|`#=1xd{rtQ~RLBN%}4BqE-YUXi1Q;=Y&j z{K_#fIt&yH@Z_&S361!k`YuwG+VD<^%uD2FNT6PBca3J?UR;8X#LiA?2Md4>CCaQb zIKE0G$bA8Azp6G5FKaIu3WO!+^C#0R_%Bik@+Ryl6z9}@I>*nZ4`I$i7TsknSV1Ty zf_PrD>UfRxx$ie3T}u=E8FYkNAXe=C)WBk*JbrqHWN)RWzQj4MjB$q7VDM zOH%kNqlo4<8qu9H!*@<9uELAhrb6{Tk45x((bzT;v$ZW8=>waQK_KiQjJXx6fBjgh#Cd+K!sz`{tbXsxIcWeuJA+f2ih)_SOvuF397kEFA5Du!Zzpy|eiIT>!oSYH; zXO7qfOC>uWKxx78yyO38iJ3d%E_+0^!&_+qIR_8<;fO%O4?V5^aH;*6@&X;b%Plx5KF;rUmmfzhbF2g9sP&G7K3K>h z-o1t>$9BG4FsBH=Sgp~6&1VWtvNl>KJc?O`zqpl8TjSIC&3sEtfz!=_g*|bT(Q9H* zll|6*oMLe1cLWfb=C;|bB}H?g%b1iLtsZefw6vf~t@4W{aTs$h4w0nj39?V+-$l+% z{XO_MoJ}2CefL2JzF{a8+rsBhlBF@j+lhIGKVza4JL;eVI`LFSqMtB^omDU~`>oZr z`^>+M$4uQdB*aU6mjyj0(p?49ab%B#Y~c6mWvBCQR}{jHcQPOWOE!%Sc<^E0?raoy zhN+2uuly{Sgd`yhcWt)2XX6TL&Kod!2czZZv zYMm!U|LqevrKy8OL`OjtE<07Jp3;R*e2{M)lKj4aJFT*R5tFFDH4;5uXwfGgkzK+{o%&p0z%I~~V>Z%yW@f7SwsRb$S0}%{c&}hnihvFk)dWc4!!b=Y=5#tsp z$+Rsl!uFX_YLCQz;O5`7WuWvKmmxkHr4a`8sH)~M-Bp{H7rh&?A&7SbDsR-Z5nyzh zK3du6SsAf0NB4=wlz?O}3E{O%(&@Y9bXEIXkuihiZTGBl`DCL>q4~c*D7L7F`}F(H8{@{)jRuCR}^sJl|R15iHZ1lCog0^;zlUOsX)D zt%K3l`6$$df3-Bbsj!k^x1dlfzB}xz!om19x8I+;Pvw#;7Nq zqI0{VBfGLot%k!0BIWT_TyauCimr_#dv4=_pt&@oD<9$-oTVaf$O!dsN?6;{Kv0QQ=FhsytTgoR(g#lqJV1Tl_V>AW(1)Zyg8b+`VfL z!6CUNqO}{>Wzl`kvpr`YBS-%LGRy$?6*tYk#QZ^}#7#YhQ0<_M*@PSR=N}d6ycVf~ z2GSC){h)h(!i$VRuCl>^xju9=k#0oZkuI~E3lT?kT8<$3x(J(n5iyIQ(Kn_P+fhlR z3d2rD^AC+03BOrg8`&YKK8+)gkCRs!a(OygqDrr(Zw1*4y=$KHw{4dQ9(`eA4DpJ` z@L%~_0?XYx=Z8ZFFY|CS_en-xGWs83n*fgwn-X7kr5A90sewdeB*iY(uuU zeNV7^Lycr}mdY~fQ@IqS5=tciGgt6@5dLUE%=N1BGWq-5o2_eCl~i8he~Dhj&-AK3 zP&%`6OJ$b2@i6X~Jzx~o9=q1ig$~GgFR9i-Q*fWnGnGX@dQXVl_9fjd*J`OFQMR9B z)cH~TjRzAa*cyT`Q#3mCtQv@2rw{wWh&Q%JfFC}0TEL7FMJ8#hN}}Qmk--F%UbC(_ zm5qTJ|J7$?$F*Xbn(czP0oDvO%4d0g4K#B1EhGJ+fVJhfb=AhhXNMsueVA6Jxm~aR zB^0nMcxzf~4`b=%NCT&}*=y7s7x9nORSmxBup3%^#y4$FishIW5o8AEy$X4cr{yh*|{f=oyQX@AKlZixQlj+>hp|P~vQ+<~st` z;*!o5Oi@$;2Pk?^2POrpmW%O{lHFIa+^RMRx;#%!M*@a=80Pn>#9xT|5ecm z!H~L+9rhKx@uKd7lHuJSEn-Rq$L!2zHO^Eim9fP)(?;P}O>JLW=_Lmb>cPg3jtRru z&Lk91-=zor%X!gY=I^3WNeMF6FDw^5&PjA^*T$*eUpUPk<0f&Q$WM6!QLevM<;(f_KU`V`XY^ha0`NB0 z6E3}#k|);C5T~!}0^0=IqJ?GdN`uQQN){>6@8pWGH|O)Owu@eCcKQ+-;;!{qs*PT% zu{FpAJEI5EJDvu?A4ov>x&%Bry@n<41VgDW=cTe*h*P627$)y(G&%c9er(789h-=a ztouE5nOd#PuCgnHqdsle z^2dS7SY;k{Xe<-+&R-kZ?=*r%c z!edFzkbuQ-7-)Qd)m|2vVlvuvJVT81zCf$5aX!E5y(s=8-;TiCrYw#Oez^a~RTJot zS~5-&Yp;6Z*;Vv?&n6Go-0p$A zx8cr*i@txn3n>Zz^BA+uMN8Nd5{3`DxesE=b~pJsf*14=dtE5WXCEl-O>^|?8LS+Q z`fx-%Wm60gzR2NCMmx8$7);U&UH76&=S9Y7)1g9gG9#_pZ-urlZ~~^m>{oT|4P9jy z$+RLjZC?|+6+6jJI&q^wCW-8*p*IxLk0RV_ed5qszu41fttuF&Gmc!(D8)4!v;H&V zN~AG)gffXPCL%tTNF+wOu=g^9s~W-W-#{I2nKT%dXH`WJO4MW|t{ikAW>qpaLPXL8 zc}H93MA-9s9l8r=s&Y$D=L9%0O2XWDF$^af+UbndzoJ>yq%&oR(s69RP5vH?UC{mY zi;v9aj#giGsOsLATKeJrYIq4BZErHIbWxGE4;Gw>&G z+eHAPIZVH!IdSjk**b2~+r>+}HUtzz5xOK8#%b=rt)paf>kx~1mjb)OfG!E223j zt6LX2wgCTUl0)l8)eCUdfuq9Yv2nSYD}Mi6`0v>}Lvedgq{@;IQ5I=5@RwD^4US}W za-`0pTzEC6`^4@|uXQ1@jq5ohJH>Uj{+TKZOGhCkzgkLz3iIr_5fu`31uJ=|SL+!y zH2I#yaMZbvCc^28R{bkVOpXl5Zj7O;y3(R*L(bZ!)`()Xg|vo(93~)23)y#>qV{F! zC|iGxT4h7c(WqjgdE9*lmsE;e;W$jEOb#(5*QBe(m%E)lq0T941OrscuN>hA3sw4|38%BF~))8lvYoEYdPH|D?7rMwFdMsqC_YiX~6?*>37b=S(>bS426eJ}MU&QTtYEdaTT7t3+8s~jJnyAgySn;wV ztt8QW(?K8Fm=iU8Sj5A6J#$2WRrYmURWspWhvIKc^R0yc>mz$|@Q$HbojVG-a0=zu zh%;s^WcZWT&9yp@Z|V$jkgeyi7HXz>_c#Tg=$sy=>gfAV&5b)sv8LcYpok}P_K?a3 za}(Fv{6p{1It*-hHdGk2p*IicZ>pfC7O-<<|9%0|ZgZH|11NawfBnxt;Z^9Du){xt zpg26u8qQ1k=uYSOJugsM>nLTMxPX@y`Q*gfxT3HQbX)MH&1rm~RaiQCbuXe`RozLq zdsI1XlY=fo{lsbrF-d@MbJQ%X5#u8sZ>S$O9{qO<1RygRw~*f>Y@&n*FdTMq(tfHq zT&C+Uw5{#tvLmA?gWb~8;`Gf)bc^y4b4@Czb6uSo^z*`Eq?9uG_R0w{c+pc|yhd*! z&tS+mJ8ta&jsXjMeV(vE4pAn9fD17^YT{k(;Ed@toKi;}?#g=Znr4ah*=&nnt8LvR zYc_#d-LK)JxO!?2_5aM1`UB6kKrO`IAGjC6qs#v}=K!bQ*9gO&8cPAazbI@G4C_!fCv;V{_WD5VVPb}fj4PP0WCI%#Nnw9AW3w}Vu3zvz66 zPQcAVd*OPTCLXtFQci?MlZ-P1+#tbKWU(l;yZz?-aKTOni9Db zZ-~p=J*v0$X$zU~Zhy%!1#*gMe`yN4lKqZ53Dg34%qhf|=*8b5m5?2Lk=y*t ze+qGyVrKITr5T*i_*SLFsXM|yZH{&V6j+i(iDTN1_a}mL z{e4Q_>%i#x=9&va`T5k_26L@4 zDPp^&t6#W~MNjS@`$Fa#0v`2)rr1%K8ZRY@TH($nq*JCeEWTH-pc%b(#zz5jY}H+a zkYMpYC`Dm-BTOw#rF~&jSKBy&ByO`<{i?sbbZ)qEw9fXeRTyKJVJWTZD6h9LSFw&!9Sd-2QJT)S_^UYZjnu*b&qOm5hFS~2m`|Pdgj|~M$~S< z5gn(al;Rje4~@URa7#P;s2!Y*S_yn|fK_lYuK|7}jrxp$dOqR1%{nR*wo~KfT95h_ zob=kUaGa6yuLH_x(AbL(=irhWj7{w}#NIz+hRZ7iw7MXYwJc_|6PV4kaM5sTA_M7L z6$wOUkyH$u&G0;o@mhL9@+0Q(g4n@G^NjFJ6X^c#n=>@GNHp%>Gi-+B;A^7~etRm! z>~^emq!@oWRl*i`dtq)nD`lIUsI`rpr>*dqJz_HYXQv}P{ky|iE+ub&xR6rbt{7rB zns1)J-4c~pveXf|zabB{kdqR+ItwvlUHuNrC;CN3wS@-8OoqL)zw87=GkeF1OuJaToIVQUWmDP?A+XOkg;EUs5mbUUI|DpL0vnlxR^Ae0ZB_3rw)t6k=x(6u6hoop_`;C}5 z{&Ujd974T9VPB%`*NzA0jWa%i*#Uz;J`Og3Qz(sccU)?LtSI=dPD{)9D4TGEB7{HV zCMM?W85O7b{z4xXUv|&AFsrCY))7_@{Y$D3Ycm6Rhe{s+ddeN<~xtQZ-`L$a6t487P>7MUx#0?QLjylz})WBs1KtFGzuPop0GuSkDghI^i^5do!|5FX!xCv^My^vJoQxJ?Rp4ePTT4FuR0B-><;8f5AW+EV|`oJ zTxpL9jz}ETJR)nyZVjp_^M{~Vm`B$^gmJz0$gT{SA+>iN+ev2r_hW?mcT1x=cORb5 zs-F1#Zo8kao=>lHzFl20J>FgWJ|7i-U7B#14s6x%fvjvK@7-!ez1aT1Ku+7vzI#+t zCk5ktXFaqZwbuge6NxE;@gA02*l1;Dmr504CFgO^&G+ux{rK9o{iWG$(7(efe~Nj@oGIKko#)(28(t#@sNbg_A7I}sb`lw=QGs^= zcp1no{|hkt16bkjSR7@72bq)sPRl=dlK%;d_UG1gaJ!4A>*2LwCZVBcvCUavJRacr z?hgrvLRHbae8<7zE3M9V+1TPgs}`-rs~zqxD6!t?pl6b}TrJE}Y<(~E;>FX?2(sFo zEtlsa+GB~V5Lq!pKJCQkvj6_I&UfImx3|eHfcjj!sUhiD<70ZHyxm7~2!m-%1Y;-2 zYBc?5R^xp5Ac-^o!?a*L4Mx2riosp4)fs@VO)Cqvq@=Z(V5o5tS?2ENPc}3i?G1aR zzFMuLvovC*<+xMUfpeHNpkFAni*9>Y+a7FPEJ{n~4kCQFVuiHzV9Bw-6mQ25N3$P- zItHx7DA@J<^PT?M^B2FT;Hro3-Oqa)+cM8L2{{ixs0B~M0|OzeqGup7vCa$8ATtlo zaRR+d!U&8$?6vCZn3!>}ORqPp?~-0vhzTF4l&I&nYU`UJN@+3EOiEj$rBR4^iif`= zDzT=8!q(YYCJdb%kZQt)N_6RlH3#e~X@9SCL_de)-R*q8%bnw=vEx^dw>eL}%lc1W z0BCL*d3%$7LYppx^m~n_LekF8u3iB|fv8XUv&9T_sqMq)RC!wLiEn2 zZ4`jvBGc7kUyBUkbmden!B{b+1>m+cF4<%Y#*8;Eqe2X|Yy`3a#ytS~>~;J86n0vo z;PZ>==@Pg7el&yRZX)z+x~!<6xtHa#@Eh=P{@VijoL5mbyj;~MBWz7Ibh`LuenyM1 zB$oPp6#IwF_Umt;|u7n zUwTbBO1IdrOH`$s7(y16ouRZa`*OkLlxA9}8|a5?LcYD$pjZ+fMcC!t3}mB%Z3cRd z-fJ8ad-}Kf=xt{8l=&cQGwFTvkx;*`ddD@IB6znquC+0CPUoX!l;g0P+;sev0{Pv_ zJa!LXQoFkzy>lm6lQbRp(edNsx99bk=TTrkhQ8gMNvu6||McCY_T4NgeoEHB#CY=t z98Q^_3vGb@0+v{_FM;7u5FjaGvv==*uk!eneT(;`4Y5 zD7Ui)CXW$oSniUE?Zf>TdfqN~Y~YcAMA(4>-(INsoO05Mj|sVwHNSR+=WOzG-NCO1 zHipAV3#SMp)79(IwqmL_JCe`y{__#s`tH7kTvgrEN0tcPeDX?}UmMl&bqEqD8$F=|6#RK_)b?$l#x1F!T-AtE z?lfwH-S}K>fLlcwC!H3%x}i{?a8;76A&kU8%jUgKb51}N681U;4XFr7_6GBz{&NA? zymY>I$z_QLUx(CWUII*ZK^^>!H@ZkNyepR&7noG}M?hd-`#oQGqs6LKohV++?M>hD zuzR6cA~?ijqzws31<2x4chLbkNg9R?D?v-FNn^g)<|S<1rL(x{k!Bk$gaG0WyBO87pa5jvDenL>&v3qI&4W&eMAP7PaiAZ zwtfV+lVrXRiY)}D5aEgqxf1)I0q9_wLI1V*NDiU_{}~5wJp`&w0ZxnV_iD0qAj6yG zpw+5+`&my`mclk8w`B~}1peptU*ITin74!>SZA%_>&4n?wQCd$_Iom%+t&pVpWXxG zu>P|v7)!25wCsL1Rl2Qa*Bh}@l&$7rSQH(WQhwG};CA2n0&E!nL%!7qFx(WJZxrRA zz`Bfx&$@wG)s}8hT2Lc`Ad`}tr@1^mHB^T+d*IRE2$g|F29WIqHaP3C{T}|y6MO;m z0b>Fnlfi#(Ec==|7iH;tD{m-bS--u~HuiYSnzna4+&^dWEo5d7lg_nQXb;j6(8h~koqhrS zx)PLO3?l)jh4q_FfC8EOLpw5bt;>&Sxj=WILWTVKv1NvM2d+44j3pCVL}Uj*DY_oV z)9Le#0}hrJ+TXuLyJ4oqTw{ntW3ORD{&$55AZh?3X&HO{#5vnx zyssZ5o?&}-E8y~LW!kO5!OnRIs!L6hSF$1hy@sjBP{8qOvGF-fLIowz4tem*l4CKW zRbjYG+*fT$YvX7)6Ilj{lefL}%H>+gHUa0T3cw`(I&g5C(~1Lt;r;~xm}LvY)Toh zJwdLvMPf3hMxPUP>RAh{QLEq#aU2WEMQ7zAcKe1>SyUG$S%fM+eohI9k&~vX|L!C5 z;~U+AI}(R7Ky@&WUqs8>0-IsuMb_~1h%8K*gN2Zz@r7;yswnZ;9&L#$tK}NXOf9i< zFlr1vD}E(P>oO~XRoR>RA^OI?PcTP<3`BjEfdCwOsuTo^L1wCj?4Tah6W4e~J+w$= z{N5%O2bskQiiK#Tq_`@Zk5VRTXKJJ#a6nCX!|cG~G4a;br8C!J*H@ARcp?bGRERxe zc@4icX5piQONs|d=7y_Tz=d0V)arrK6irRA$VK?cPv-6)t5|5pq1adHBZ+Y-U*e>~ z*i&r;q8$MAkOA5gS*=x@WD7!IUd*UehK)`Ed8izIHWIu{3D8Q@oCsSFbBdym1Ev{! zGJA~yhU6o>770*hFdPm9+{+1(9EM+tF^q%2?OsY7oFaj0gco#rG&)T4HlVTxSh~QP zUO?nL;=rF?0tx+akSk6ASO35RG%@3gV~z9_Z#erBN?@g^d`tSzukrjX@c+lrH&N%Q zf?i>^zlQmLQoiZnM?mZH>vCpZ5)$|-UB2;9gZNCZlo6#KLz`J1A>Lz3kvV@e{|LuX zGN2&qY%_+EBuZXC;68f}8+)h}tGrhL3+O~n@%jf8P>kf2(gWUuJ|Y^wJV7#WI)%SJ z;#g(44G4#U^%4BO_BnOOv^(LIX%Cwkw z32zY`t{KzTN|~X#Mbl5he2i!yR`%lj6yN$s*opd)_7DGH!hcYd9iX4E9cTe?^)R7! zqI1E6FU1#}c>h%k@PD}w%23VMXj9<)P|abnTYUnx8Dt$q=r7;HjK3ttZUurzBf;=P z0Tz!7ARS&l_JDB_kPMs|@ORPS#kjW3{4hA4kU?$%D*5X82#j5TP-g zB@v;!fwADqa)TB9^2L$B)f7+8Ijess^iFl>MJF(5r+=tFfDv}(sMktWal`s~rE?!m zxm%KN3@gstvhM7pCSiI5BLY~#U9 zd`!H%z#J*Czahyxhr2fF9IiBsAfDsd6b+@uHxaFx=vj|#+s-$q4ofEX&C6>EhsRJpRrp7Z+vAqVP-oC0;3KJ<}q4T>8Qu)5x*;4``MV_I1#ro~(J zh9TGpVHq8ZD@P0=bj2XKdz1Q2i9DG!OxhE;Hr|r)Pn^_K$JNZG;BH#5xMwYJcTEH@ zyt2lf(^&Y}$4^+4qlW)oZ>Hzf5}&5_SR)zIn^WR$1Cz9nbo}vA@zKE^FkDd`zP?$= zmCx8bEfBh@U%hu^HF0W0H`R2na#t@+tdjB9Ltu#^l>O^8jjIM7YkD^Hx?_nqdVSvF zxj6SvXfINtTn~l7w&*VkChJ5%HzXj@)&A_4MTSN!`gjNm{SrV;bbC^}I(Q$SO2g7y zgSBU1!>gQsr&S)F!<7(cFvJHjMN}F)Zy-ZBgeSY=y(bfCOxqx`s6i7n*%cNX4wN<| zt|%e(soA_W&PJvwpzAKjK9)TAT%BqE_7z(-@w6;w=&!zn3GI6e>R59JJ!c;=AGm&j z_dB)pl)D!GqASg`aYts6q)}j8%8z(_^}@vKW09&q0~qbIl`y$_&$@@T6QLA!XbvkI z)Djn_GGrvGZ46oZ8Wh7I=UA5E>f~Z!m?iJPP{9GaNV=r#Qsa^HW-qx@1ZjeHb!F0!8(kI|x*89invf=Sj6H2`arsVG`Y4lR{(g05DW9frUt%xnq8 zZOhr>pGtNp;G4z~p+PGG+HDr8u*MQo5lNLE0xNEy^RVC{ns}uct4!a6#3EVGz}EcK zA=)u#?qEW$$sV{&VfQXRsbp;)7lSd}Y3dtcX65<6|S;VX})qz7w;KyR!Td3*!EWYkpEZK0Y{= zvCRFmuk|jMM<{A23DV;}tN+lwA}AYipHlL8P{$%i51ya{i7bdoa7MC+R9}b?ME>#; zPk;xCIjY;1vV8U}NV87W747VU;ZW+z1WhnyDd|S|m9%W{Ja?JN0dW;HNyhcA*d z6f-}U+wEvAIJhXfGS3>jsM@H4^~&|qij~%ch$CfAmuXjqcj39htqr51B-5TLx#rWn zs92zgF|jO828}0nF9c@r5<7N7lw8?h`&CA0RCf13G4D*DT%#qt?b|S_IBtg6{aO~# zHW&fh+FuFG4v~42chHT@gawas(ELLU!D&KVSii5Cn9kiJOq%62x@txBdY|arj&GH8 z?d$c;DMwkF+DA|(cU`nDqqL?Gh0*(Z!q5U9D+%&AO9`C)3^>_7N!hcxj zq{FLi?u_HR6;`o+ z$K!+fIeV=H;U}rjd8ks<dC16EZ66y6A~ZKV8I9yf z?4;(WR!V4i4miUu@5-t$a5_Ks(wGG#|_HI^s#p@%%-L z#oUyE_@ez&Dv?fB1@-Vh4bN>uXfBn@bV6ogiH#n$8BG{L{}& zY*||DoT`KD)n;7zp0a4NIusF;?#znZFveIOy3||&f{gK+crH;eOJY`^W5|auuaYy! zdz|Fawv3!H|Cv|lIQP!nEl_SoGAs|;M>gC(lJcC-+C7oW03WDOWKp{!Cgfx!ONuT( z)Vvn8&{k`=DgVXlYFn`Uv@5+2BYk_5&mE}+w1pD7aFWy$NI*siiOJ=Ns$8@%8eYmI zWF62%Q4{FT54MSbAw)%ZU#I9_w|bv!qJ|Nqn`fy?Cs~AT3?9z}a9I!{JOz%NK~I1r z!mIdFsfzLv8R@Q7i{#NP&y-22wNaK%60i~!~ z97qnP-(~QIvchth$R@cfPnyB14Z;$sJb=#8`&I`x#>TzGF z#L@tOk$uF#Cj&b!Tz5D;iolGWx#4BY_jebp!V+av_L9IqA9-H>iT@rtqfR^9oZ`J) z7^}HIc>(fomhwY3*Pq(6a$OB!tiV}gOJ`mwlt?tSRn^s8x7s?HEq+(xz?>ZKqqV3y zToG(daOOKJcve1X=iL$&&Fpjf>ki$XhLTW|AY9E#|Atsy3@?1IOl%;^_{Y<1E=Qz( z!4Jqf&=0m)1!Kl>E|9%u^o063LzK9-et0SR2v~Bb!8W5*s*VnvRPLOH6?TweeOh%x zVGA!1{4-$&Ofy7>of1Q)Uw-+-;I=N7XU@j2TB#6C+b&ddGPu--85&m74RCoilNb!w zTy5Znb?!{kJ4(A;3=Iv`@m)+F*H0v$$~tC%_jk{7TbY`pICfIpk<7&7|g& z8kp$?TjByRGd7FOEYXdZIV9^gD9JCxV7oNcXdG)qwBX(a2C0pQSdFRxaC~(0Us>Mt zr>BLq1zGBr1PTo-KA2);R-DyF04aIl4AWHoa&K&HXoj7F=we08pmwVe>!+7UgDn)- zx(s;c?i`{%EAGFpTiipklzE@U10*Q|!BN3kI@HpZ^+PEMLyimk2WDCcD>$;L#{zw8 z-x2&F*ud$ffc}r64^)QNqKuHNKWGh~DxHdZJ6j_17uJioB?Jj!kO;_A2zp`%vt1d? z!RQHG;Y-PT5B&n(h{IfaWei^@(aDP}l_PIXwBQIlH43bWDo1Ki%J>N^v~A2)1Nj|b zW{Z=1k)Gqn_4W@hpC=tIj!kq1ro9c)P?}C*OF5men33u%FZAD;l!laM{|xQbMh~r) z2p%QQ;{C~gL$AGDF5l57uBJC67wq;&+#4-}L}4 zf31wlOZ-*UM2QK}q49lb9TkyMm-3G=tlA>A*bF&~7GETX#$Pa$%GwaYYT@W%tP}MC z9~r1D=D#>zSd1!*=8j8#qR$#;tsjQaonwybZ&ZEb`x9I~qNNn_CS2t zX}w9?IhXI?n>kdN=1YhiGf}J5bLQ+`9i4R$VAGVpL^Obt_J8;BJq))NWgJ7Z#x`k( zD1a`|g2h{h@drowUwy$raJZ8-^PBR@xEN97|4?7>B&Ou04Ah?8&}Bzhtq#R1gOGCf zg$wo03=RAtPtabhj}Oq0x_nM=m1Tk68Aw1mhc`AjqiSIn9pp;C;1vrKG~PPcAAi`u zA4xs{k@%KzP&Za5Ta7>QyU0kpAZEKeW1BSb;eiDdmJ-glavoxhD)%6#;g9LHB5Z+( z<2ksa4|^A<8&?rd&rgp(v%TaI6a+4@D3Bb$UUsoNtNi@l5pmT`;n%~XWey=@uvhX; z)ipI*MXq97iOnB?8tOanP%oPPPy&;BE?s-6*vX$MUmh;)5)4_nv79~j^MDpw1l4Hq z?B!x#oDf0%kjWLtYn~L(YW_E-YPZTKW_&pF0nFHEVCK9Sgc2pw68B-bq97JVajp+9 z%lHP#;fA3tm}m8of_J@|0z(V|m4zytH?-Mw>ZappfC=Zq5xfRo_EQBG!MGI*-=x9$ zJ6W1HDsMWI?_?pB;QHG7XC~w>3Bs@QP<0%kbHlz03&$p(-eQokrx{%9!kgt2?JFJj zs28y%Q##kSD#d|Vn`1pd{Hqv)T8Iwj<42M_1C&QJ%CXyHZ$}Tn###;GE+C~FY5|?DW@(W^}`SgKcN?%CQ?B`vsvsZ47*$5b*a37m=zo4nCrxe*W*R5X37>)5JdbF z;u(D06$f=VT&7k(4;X<*1F{Qv3~h&2dCh#^cf5E$TAdbj63CA}*j`^uXlvQHT#ci^ zaCDulYd*Qg3q#|h4bf;a_m<*LxQsS)jo9r&{jRo3V))ou4&urCyd*KBD;yNoUBi@* zvp&U8e5Q^})JB+Oo#p-yFTWvPAEn20`q3a4EG2vMo#7eV(M9;@xCdH~>cy>F_q4~8`deOYFOZ;g14-|Rq{82` zc@EngZSE${3mgzvF%|buPC|J;{G?wn{j8kq@s@UAh#`RbKwf4)f4&5W1vv)t^%bNT z;DrXl$?h<%6dIDB#2c;9Da0vlld}o!IVp$|AeQ=yo3}ok?9wdZo|JpV3b;NMnK^SY zrRKR-=+y%lt~$$g!y89;HET!y7faz~dIlfBQdqeo)G?MK(Hz;GddH*S4BL^=Df(Km z){Q`@4z%)?Wh;X3+E613YT2Qo6!rSRQn*GSGp%-VC+19*8pNr7yXc7DCPsXdc%lxj zlOke0GY3_hoPJVW)U5d-MQHA?MHmVdb4)Nl%()=c;L--+z@Fl^^CX>)xGsMVP8I5a zcWt3Rde&@^m1|z#i^rnW-UgSaK&=QD=zSC+UWZC52@uDjC54gN5P@^3guI7gH+EwY zF~o<=q&Mzf;bw2>V=wdv${j(h@pLC>KtCv0Pqs)>crI3D0xpg&hVZ^de&%hURzZ(L zuXR#!#kPwfM2rmjz*d?0eH3xbfh*D0*ZqSXkrwODu-eR4o_7sxu zShrR)Cnk^^IlsDa6)*HO7Mk*NASppQ>AA*Gtd`RPZHgLvpOd(i-en|5E#geX&Gbt} zXBF8>!6fl_6vjD!=d=RJ>-v)q1KO(ymYW=rJt~8sM5J+KximVMuyBf^^)`N~Ne@Mw zVAaDA*GriIFIlEJBY|K>&oiWzCz#3*M!TUvm!CVHix}se-x>ot5OTk>UZ4Qv8h`a={mH(B=%cv0L?H2TP;$e{a!Z}54Y(}rV)!7 zSbc7eUE~o4uPmE3MKKFm#H5M@0_b4B?@t6mFyGFas^-@tH2dsP>zI~i>XahNpkf=q zb>~Q>^Nbr{?~?S*IN5fUIGl_3{NZPPeIGy2S+L^O=nYSGbMMfEW}WTN^r?%9ZA=hQ z2QGBb!W+Sz=e}{4`~U(c1mPqWF8(FM|`bp;EaL2)+^=+jM=jeG6)D zJ?kMu3d10Di!N@@fge%VV_4c|gnH(3&J75VD`3CHk_8k{2L_pEIM_R(}#T9Whs4hdOAw%nPsMOG5fBc!Jz8jAUw9x?q&6Qx(e5pmu z&1WhIEzuFHI=mPmHfgO@dWFGls`|zW7HC6&S~C?djoQC%ydo7; znoBO#c1~~XVsv2pnp@t8%$aWN4uNnxwWMu(K!&f%o9^tI0zX^OjyI)lHC<$?XFaZr z&ZX`o>J`ktU;io`nR}%4afpnsEY@D+u+2IeT&-q*XvB?K);}S@xz1Qgj8E`2xcT#D zyP!XQLv1}Q@Y3v`g=i!X<>NUq2eE>|AE>4p-~uL?Z6G>_3baopC4yr=NgI z%vQhWcC6q0(gXDL3aX&;wY;ZdS>~eaN1h^K28r9S2SPVD&xFMXgW%cenm&sD%5Yi#|FT6lY1t>?Vihf zGKmmH(r)34G775!dIzFZlPE^!wwsW;TV3Ctf#fEv+1wjW@$xZ-GDBb>gaUAN|= zy^V5IMG1DcCeIYPI-ef3U-@*vYp5`hhcKItwRz~HeT^ku(G}&7lDp+b)4llS+pErY zmTK*iX#q~x(9Te~eV0%&t%i`6Qi9T|&)dx#A6*Odt)Zmm92)tkW*fD`Va`V*=gu6p zB?M~})$0uD>Xr9>x@&?cep!%ErMXm^Si0tQ(q1S10=k3!ImiV_W4eS#jMgn9c9F)P zVw2nVQ~e@p+wc}$Aa6}E6`Kg+H2o2aCM?-g_0%S2ghfe|T0$|}om?Jw)~z#eBvON7 zHHEbYSevvM+ejh%KE`seXASjYitk5DHB_iO1v;|j^D_*GHz4=-?K7tj8Co&`22l0j z`w?tk@{JeQVoi^5wl@=8-qkWb(2{54w~^kU4zuLiaN};}U=)j*s*bv>qE{yuLdz|7lSg7Hq4)F`)dfue!Imt@YW5 zEP{HS(0LHv5wKMZfQ1-ZKR}@J5dN`r*t{0)W0=yO-OWL^Q7#0L#t`9kVB%!2<4hsr z)b;mSTK+0$W%VzHhE}X{u2`pgR?vLNaFODGo%^EA@+BoL&xb$WE|Au`KzdcF*A<+f zp0xKrXnV`3x|(iXFhXz=Jh;2N6N06#loCFhr!k;(iuiZbrx^PGhp&&bRaF$Z?NSZ{_Jei$ALY>9 zihWql<08M=R_;ReI(eh0xYbHOA+TlJdEsGhi5PX}Qa|C%lE0S8P)TW6`=w!(++Hyl z*dbi?04jUf3oK$dgL0nI9GJyc9sSHQk4hH#<*#8~$J9DnEqXaT`73Hi)5yJJ@nyLs zJg284mELFb=vKmeIlqqu$5y*oXZWX5n(SHPN$DRhQ0CBa^YPK^%xpgsw>gbSWlKH} zrt}&I8OPp949kTD)}oQwjB^pQZ&X`SfyZ3#!vqO$aBf2QA7<%!gdA2%{zASzb|>QP zbx_uOPm6HWSFZG2K9y*p;Rvp2FcY*{{dw=dz7}8XWF~av>ap5Z!%3$4(uAhwfLmp; zX3r^K?qUs-nuyJwK6}JaEq($+Jf^@#C~-XSON&2Z7W@5;!qNIyGj!)lnw5h-mpK5d z?TNQsAPWX|a3i#6-3Md$yndDDmo`BMICD32h~2?_B1A!jiwJUcfcq$JwqDXGbm|e} zOIfB<3E|!(fTKAvl7}<_-$Jr?Awe~WHUA-#weA4yi~Nf3T0kO$y<78Uo0ou#o>~Pc{BV zNwsdPwI>NU2~)A`@6bc*n(~N=e=OiUOQow1w{s|Ogw>m=LuwM}Acoy%>8XLWTmJ#% zCm{jv@G+=(EOY~3H=*q!-o@f(Qcuh{iEy1)Va?}&&QA}uGLt6y^23W66m&ck$!p4r zoYc|DT=tFFxS=rD{k2vUegCOllk0rIim(sDxJfO?Uk#|cw&G~AD(K52ny5bH%`<^t zK^Ny)&{m(i>vZ-Pc@LktEDG0{oe!$oK*It4ih} z|Krb>AFq)OF*Ik1P`?)Gp>;;~&wp@gu}thV$v;jNki_8b4_*@Iw_yA|ufR=5CX`tF z^S(vsmMeSa^NIDC3K-tD@YkUv>J~d;<=2(+)i|pJs604l4QFU>-1PXQPLE0MnHPmk`HLRP>?SZ|{;irM=PL9r*!IxMdf>bT?m=wt|PpXE+>pLRBr zFmA`JDgd+gsPuzh+VJmv6a*M#jmwtH(OCR8eUe(;ciU}X|>gY_jxbqr*w z-gWbK`XlV`47(Xe!}>0OSJUG~%@t^d5GcP-*7BGJ4SAm9&Py9yo4uSrZ>>O-8eIZN ztBKxmnU%ES87`=eDDsWFN^+wbv~%6rib!ul47iFbJ`Lt-GT)ZdCWl(pO8-V&3V)|Z zeJB~P|H?WK(VO`&-%3$g5bkHb^08-+RdT+MAFX{=ky*1VN||2qj2PhbJ=HtY+qaSN z%;_?rEp*z(&vJcgUoXz~90}wT;{;;Nu*XI-0V;jl=ksM#FWASSYPtXT(Q%8S zQV!!_9_Omj{}Ru9nUWT7Zv8pfQ+z%V6nK$1EV1OrYmoikfh6_RrgVI6$#+tz97!G6 zYV}B6IXF9WsNjN7%W9W-5uaU@_t#re#@Bdojh5t^$%fGpWKM8lQ1vhi+$-GzOqMQ7 zp65Vs)!+V`_pQ9BveMiy%8_3*bZ~f(!j44h($Bv)DrU3rfOGv?qE0>at@fKr+-r4M zVjAuvMlu=t;FMT*c*-Mc82~#e8UA6lh?Yr`5M+v3@ZAbV&aOh zTP(ZkXJNEVrR&7kX z?Y43S8h#gX=1rpB zox;dBl%)@ltGJL$pHD`hCK-q>Fm@2j%ZKRy+z0*9XCOS6>_e=_`j8jejQAaugH7p6 ze{=Pc^godL=GyVre^WA+uBdC3i65n` zjXI|4J{UA2RX7AW!I-PSOkzJBh^Fy!IJMBPBrk@&3`T>Jt;#FGm0iV$zjvV~`Ug92 zEB}XZux|UpypwYr5}#w#UJ$Uo_SIuoj3x{iPRWz^fu_0U^M}vBwj7FM{*tbgqYX*n zd2s;&_@~bb9((l`M>?Xk*mb(-Wh(+tWoFTZNZGc!hwhtnZJ!;po+fwqrtL|LVbGLV zx21D6TQUgEa)CEaa8>g?yFL;mCe>f%2n_%^(|N6bpRQ%@1y9c+-0FxRi=GYIA6aRl zUv@KYbVs--BxD3nZ{o5WQ?w6bIPCh~<esr!fO&@?$W zXw6z(#Qo&wkZmL2(I)DXxIn<}-A5q+I!Zlq$hk##PvB?_32Eb+zDRZv$ooOKgZ6NW zijB#4%#49jMVJz~L_h8zsAr(xiv9GDLbz^%;%N1uYo`pfWrQWoD;qu?RYHFj&enJu zNFO>W9W6mcJzuIiV&KGg+;A7;q81@I``NG44B?9u-_L&Nfic5uOQ)n>H znLs1lyjuP(+##rc%!$n6d^sVa>=Z6c5=T+zg0@firjBm_^b89$Sha12nCy6osl;MF zgzJSp)k>HnM(urvyN)^!1R# zdu{(Thok2(25A*++!!Hyi%eV5b?NwP=ubI0ssHC@wr zbPNb?nt@ji@|vHy@6^oux%IzjXST)gA}Z z5&lr}CWR0mc%x1rZbW&7!=s#-Fz_{$x(rso*^Y)e`{v_fOl<1`o5h@g?hajTXbZ`J zJd?a41>~kA#g_$$jgI`e-k-}^ye#wOHUr`7lD0P3WM+oEUf;`Tnsc5)_&lj zGo+x%K|N=8{4|$NrU~1#j3Dx0Q29=)b|HW6l9|>Km6-&~pbfn87WNP}j{dR`e-gTJ z=F7ElVUZCZGQg&rx8-%)d{_(aWe&>S z-ECe67F@jxxd=ThVmOs(BRaXaUhTK4Pz6cla*m{!UGjTV&>`Nxo#mbbvNI=nlC^az zLRn=P4%ol*pSD$1kBunX9vX$&63Bc+#8{KlSAH}iZNW7Zf$cKpDoM(gLGMW})Mo{Z zl>EWPXv;ha6Mw20F*JH1a{>g4k-@KCFH${w0E}&2VKUY$Z)dzsT%ceXiDoAK-jGeQ zb%-_+p-L+VS%QQ+Ls>f^4U<&(MT1}V(xE#HmEu(BN|W@NrSWxb{198nZtxRA!e8TE)@^KKraIR!qYC$X?2+n3f=EO7glU)a(@H` z`DL$rMYk`InYL(BTkS&#}3;@S%b>o74e zH3?%+aS@&+ythG9&d^ zM?r&ud+aO0>*!*JjDFsn7n@bqJca00p&J1)MscMkrq9*_=xHWl=xG%N@adnV`Co#~ zVg3ls@yx*Q?Edr*jufK)IHig4e@%bZF-&o8{3$lC=BJdRIF`|nfIEsw9uthG^)ytP z@9A|FFCO*^8cVIx7nTXD3ZS|FuM}|bux0u8w`xNIbrLt>0<3|2sCurx`;RZn|A8(^ z{gT3es0h`7`5Y@?tU6bn5qc<+=@WUr{8EVYU8RbCKxv4Mqt}_Og^b!Zk87H3y1&Dp z(#m9s5=<4kZTaK#QmM=DliOctv$o#!a{w$v1+-#WEf+?~Xe;C(q#;*IKI*9X7U%hF zbWf0ew8q;tTZBHkwPSDZyfPbX6BV?9|V6h^0 zxPG7!=1KJ+q~h45PqwPwi|TPa%TF}c(JI}}`c^7yu-~HDXdQPJ6s(-2E)7mMlgETH zoEiV~;NX`sZN@FNDBF~Td#DOWVXO8Ty)G3ZKAkpu=#`-=*6BQ{(O|5>Mie1+l`&bC z!orJQscjo8RiME)M2c# z6=M*@X;XxzTi)*~v7VLHp~0;FoXtSUM^^B0CNjN`B~e$&%d{Qr~~3 zh*c?A7A>Ujx#!N!gD1Ed`aYiAO*Utw!b&cE&Fe)k7k*%?Mim;(lG=o zpGM$f?KA{Phh|UGU8!{-=ESfHVofs{Jb!aRmV@VmD#KZm%PwtV=L4m3J z4p6<>ZQky%AIWE}$cY8c72hXndSlwiO1?y=JHC-xdP0-gs}IDE$;yoy+wUF&Z>UDuqyac^OB=EZfRo{DYL9tG;BFHJvU_uf zM&$()mHDfub~OAMP)3g`7mhn^9brtEaagJlv~dRXo7uOe)YMxoT1oV+fJWKaDBZ%P z=l?ThqxW2uX_l&Bj$`4b6&Yvj?COA=9ss;i1ZmMq#cm|BCgl?taiZn3Xnr9*nVi{j zS8vj{=)^H-!~rmI4;@66`SnIwbic8oauNnwA_I00=H!`V_(v9D45oTL{^ohspIZ`2!?a?$;G3P2l^B?7jmY-wW@0%tDkA!T z_TXuCm)RPEF{&y`dhlMedF(i{i6+$>#)671vCv~3k*gPumnyl4hdu#i1BpdtOXmuQ zRS*La8Z3<5(=k5HBUOC3M$@C`HQAI((#&fUyCD7b2>n^f`*PMEf(?!rqdVWM#{Z)v zZIBRgW|HP?O{)bIv^c&!Q#A`X3h4hK&6E$x!N*+%OO-jfdBDqeqZsS9J)QEyJuk-{`zO2AY_FBX6A6DFU-5Be|=grZ5Kbr&(b>X=+i=S$z$6ZVj`cdW7@)edq zb${v0StU=;Ddw4CpK>Qtj!~Vjum)O{WDFVM5N~)9=na{fIV=x46E%=F1;HQ2gf&Gk zyBRP@ZEXw^azx|wN$ycG#wL;&ni&kYx*E^p4gjaC(W0@~P@oGot0BgPDv+U9B&s-( zk6n;Tm@j-WC^Yh|<8HNY3$ck-0X6GP5NrU24+pJ$B;AkvQa90``<>{0;A%3@pXpS! zNdMunA8+=jGRTPChqL&m-VVdoy=^i((Nkwr`Nm>R31KPH4BL*aQ5_>=Ff&be?*6aor#Q_-^Sj-bSAOXUXEL+a9eYXG$7c?%MR zJ&*dq{Q1j|IE);YrmJS9JL4!2+Cyco*N7~vFJV;cG-hT69Ra8&ID2JCNK5rW3Dp$X zhE}?X=&z+LP6B9~{B0_ljz&>KPD9C2Dv6`tq~*R62OyX`f>`O@ zlvp7mN+(!OC`6Ot4#m>SCvi#&Beb!H1`-Ac_01v6if_u=i;-`hTjBs`tS$1?pRu$C z&A+AYUE{)txyXwI2H(u2b8;jz6PW7=hu#Wk(5qN`N=(JSTOkd2I%&RHhzwPfrA)KFp8&f|9Yc#Ou*h07Xu$|mjkUFMBuer ze7-!@*4AIry%Gm{Kpt~8kJ(@VUqdd!27pT1e)G5g2v`wqfP6a7?S>|A?Z$ngfi|91 zB7sQk%U+vMU?(r(0>mQqg{{(8%yMu9e^j_uacMBGMDdOR{-B|IF&J(=QTNo~I zQ(2IRkHfaa5gh^y7oGOwIbAq_vnBbs#c~bk5Gi`xVwpCGwYn#=)%fLuo8wK&LL*K@ z#q5rw37lPBW=y2pLMxN{SQ85XAZnWNgKZi!s#^yHAQlkz^hv!u=&Lm3J6(^1w!0&a zW{~trMXuC<$5}P1BD2B-E=g^-dO7@w?dJtE)~W#2Ow#?!;l1Bx47i#uIpmo!cAKyH zkzIv5hQ7X(L2yGAEU0ZZ7`qMa{!qk(3wIU=SkQG2br%2K^Z{sQBVaBeF9(P~c}jTp z-ITZL@r*(6cAq;^^o;jA+|KAo`ftR@Ok9BwC3?*${{{IEUcOw}IwYTK20@>yWFlNb z`#1&=6o+~-4H`=e7E{|B&0ypCIEiu|L%~?&ZiXu!+^5F@Xi~HtQZH@Pnk5Y_dflAMFMEvAlT_%k0*IV0B2YQ1CU9P z08CTGA1uNEE2N6n>z%Fh8Qn`(0Mdy_$9=zMY^L>s^)DdPa*KNo`-;aYF@Q(obo&$k z{^!>5TF(jPd6@3)FJJ=&Y0k}_DIYby7JzcI7JWp@FNMq=VuHMc$Lq#&eNp%QuFTeR zfEbT308s#1-FDgIRQfL9x*OZJw;$>GHxkpE@ub$=l`JpdWJcpx0DA$Cx)&SHp9%K3 z+tq#OS8eTp0Cs;u6B^ycqz!rJpXbqg7RkQ4j9~wMaW%4p;9ar!{j&eJ&dnh2)y-ak z?#UMcip?g!v z4$wpZn)7W&dN6ev#P-1u`^s4YJkl^Pa^KvUPOBnHJ>Sjn8ej9hqHeR-c9Qok)I;3E zpOA;sgOyv!hvliU?+--}citD>HJU3oWg|GAw-ch7w|6-u><_n>hxZp@-%kdXOZ)tR z(q0S?veUO9qR0xYHKWgUftN#@aKeV29YT< z$2r)3mwYP?#AYx5P@?V!b10FR&l0thfFmr_CuZ8&oJWzbVE6*F7zOQJKpKp^TRIjsZ|S^LJBn&-C}~WKdU$Tgdazhe zjh@Xp>7D|RJ0%E5ym`_L-B1bvyfTT5)^nZTR~)-$}<7 zy{8?E8^DDr4^!TMb|1!co6f&4cwRjm&3w2^dRR-+X*li6ylHsno=SGyi*PcfRt}48 zEXW+-=)o?;GAGuCmeYzj)j01QpSQ&V`hDG~uudeS$s9jW1~+603X#el5>)>oQ=L{* zJr&>>HzJXjAs8p?ic;-uaSq_ z5zjxJ_{$G1D>vG<(8V<_d9{j!h)q|* z0TVLTz5xa3A%zj;Au+O$?i?DY-@ycCEbv7Tcjh@J8%vd-%P~0%CzIICy}b5~4Xt4L z<@y-oc!0ab@TbXrOH8cb^6de}!N1BIxt);pxMKfsN6vRQzMEv@vC*&sa0uT8)WeGI zRnFl<`@>AcO7ndOoGOVeHxG}awLp*{awE+HDKJ_ujc!)!`TpTz%Ow<_{gtlA>iE6; z!`MjcgCM~19~^!+t=yHXqA)QyUsu=@MLh~FGbsS9^(gwdde53cpTYM@?&cVh0kkbZ zSy*8VK^)LNenSK=|F8d)0uFTphG2sy`#TagBnoiY8z3DB{xE=I1ZEY)$m@&U@^H6y zEZe`bybKrj@O5(t1b}V1DSf&g=dI8T=s38tq)YFuIYkiuM(B@ZFZ((!Wb-$3eJ{gF zABKSx0pftM8!Sh(=hd5xU1Tpi$jO?RtN<-tFhS*KM9SC$GsS z1}&F{B`?!N=2IhR)>!2TFb4Noo8TYvXmX5}8l{dqkmXM>v8-~>wx75Y^n{R*B3p~$ zlabrGi18)2#grMjy}Fz!V8n`8cHO4;+&z7;+k~JSK~PX<`4xgo+ti9WAe0Tt29T+O zLZRg~&#8w#GniK?F)J-L@gbVwdrr)M6 z{fJzYS`cst4xy*|J>6m~N@*+0hD~O7r~ir_T57ddWt`gA{eb*_`|#nX=?C|-z8ioS zJv}-XRyeP7l60?H7DT=83+^wMyw6+sZm!?!G@TOjoe%>r>?oFDCl`gKZ7c|4A?fS? z5fmgY{Jl(Ns~};=ERPG?-(*N;xptgH6`@Ot1mbl=^`sn@V70}Vg%i0MD^q1+$|&+W zo95SjR5%eEvV_ybqBKci)qb_ueIFPt@8mXwS126dgfofN*89AfhqHsEjl+W$Z%VFA z_x-Aso8daIn>z0s_m#Vgk^8f$OwWt{kqNg6(?L5Z{%}}zzt_!nn-iYcSf7+leyA=a~)$s2{e$0oazf! z5pe0V$|Gix3>wz8AhlDc-XyF61$P zGUmaGsQA;LUC79=`#A`+8yUHNVJ35B#rv34S5e39n^q>&x1T)TceMl8S+wsDykMUf z;AVbixf-efujPcEkDRNb<@)CP#n#s9^*P^zYUW*v_XWMzX6D_mk=se&Xxr-%&n-cG z&^;OzAv0kg&P3h5fx)Zyr@74@QetnXiQf#=T-PM~ZjjjFyIzG=c%J1{cy7NWi50;0 zxZnC#A)S*=n;q41?HtSd`R@EiXRsH0czUA)kTXs33W$Tl+w|`apa1-+%H+My;k&OA zwe`4hiS*i-@%n9At_xTd{F|DR@3#ZrkKn!^F(=V`|5Cjd1tc-L2v{l-w3Fi zJ61l7HGPRS544i7$oTGcbH8gl@a0@IbN*rSH~wOS=USj{f{-kWjt78{Mr`i%o0f%BRFo?ndHP;S{u!}!wC>J!$L|X7gKrk0b`Ni` z8=M&7p2==`dU?OR;y&WO%#0W1y$a>Ex;IzlePjEu?|t;{zJ2AciEkM2RG3n{Ojn6& zaw%SeLluhl@=x*lmstuxM|q|tsbX{k{omAzW?HjL86#tj$?Q~GsVFB*d3*(ll5#Y9 zOYpiTj0u-IHQ>bI_|CT&r8b-It_RdR2gPVMgIaDm`&P0`F|Mp0so!_@=oCR3-9yMk z*L;+la-^_K+&1kWgFt5e2_TfYOIoOlN=yz7$J9W*5Vw&SQ1Gi!qv-ED`;)RJxoUOS z4R>?H{ymsxdn0PsoMr85w~jPo-urlCX2t8~oI7^g^K2p$s6H&Md($5HJO`-nTI9!tPw0Rs=aYJbM$=Pm^K}KY`@-PNNj&Ou6P&Fprj^C(61dhOCp^j{f`YNg&+&<+}qHzT+P#;CQfD zb0oa5YPXR&F7$am6vnb;+nmYh)n)5t z%VCfAZO?b$Q=bJX#^cBzKVD--Qq36=8KLv!HT{S{KeLJLp>*zwxC4yk z8zDpSQeRbC%uXtc*9}J@hJ(_F<3f&4oiC_Ea`85-Zm7CKY6AJADUCOjus&0BKaw7Z z?v4yK`-W24TP6iS@QH2vdwY6_+RdlK+_F5!0hZjyX7n&0Q>-T)Vrb-{CsBgj94L)+ zZvw9eO(-^pYGM*jGl26Ol3**9Y6OFP9+xhl@{IOB6SyLB8V*G>Sf&e=zHx zZ$oAz))C4Ck7EVA^H_b2f4d6RRPGxG(2>OfYv}Wd2SqfP09rF7niV3ee4J;bQh_rr z-+<}!y#kIAYQ_ie*4Q=}F#1Q&skiDlPtHLtBwy{h2narzw-gj|0|2Ih_p^W=VL`r|LS5laJ% z9r482Pt*Z;4A3+pPti{A^lDG-vKR^=3&j7mAhx-EM=&@CuP+Z=zTbq9XGCx0uRsAs zihn;9lgZcpF|=9ZyI<3mHHZf2Vf0R}7r%}n{p1QtMtN3*Ya`v29q->00~Yvh^xfTP zd%Le%v;A7POdo*52@@l^|HCwE7y_j}?(M&44N#m!zLOy1^DmfnYowUq+jN)Z7(Ywy zD@+a&f6SuIRQ6Oe~{$S;Qi@3A#Cse-n&J?Ul>VjzB-<5(TFyoVts*BUzjCIvzFvF=O(kme)sPe36ffU z;T3pY?$WaRNK8`iK#9bc|Lp=4{sg;l*`E(#maU`L&+I)MX6@}QGfLdfeYwKiaXdm z@~0s?A64cPN4vlOkzDy78>U!c{hM6C z%}sVcJI;4!7$d0^xX2}(=!{IVG@!Ahhq7JeiwcWsx#m9p=fRI^QtcJ_ zqfq}@h2ooaLP(oz)OppQPLQXf4!QZ2t~`@3bHgmjFF}t$axwPJ$elvcd?d_b{$J4% zH|d3VyQ*6Fc>en1gw;<}3!kEh5~Ga2#v=fS_-U4Z;{qdTS9%~4_yj&CHb5Y=+m$$W zpSMg>InfN?t0Rn4?;3IMvX3%(n0xyeV%QAYb7=NQVf0FjX3n6iD`c?dfl0NG3+gkx zl>@KdIp#>Q?u)h-$o6ol$@Hg`!&&eh?la(h`Ptz?P4;(s&TS9}M%kFrCVZ|tas7!T zDN@kCK$X!`tP`Q}pM+{mm>8En7mfMDz${KVrj!LAuKU(p=4ZYaI@Jtns#+dw+iE` z10f1fIg;8@yTzlcOP-KWDxle5oI}vz(w?rFocrJgs#`P1Kr7E3&lX~ZYuJ#s2Go87 z(4P9RXxSv0&g_1X!ANUh#lMA^I4z4%MjN!?5+x}%vv6LtK{R$2u+R1iD@^~6FqQ}e zLWu^QY+3DYG8NIqO;1m)erI|CeG?$boZM#3OHSoGv1TvMfvO7jBbX$1arKdo{q?cb zpiYf-Ye)6eLC`Iq!lGNn_0$TZ&&bn?s0OW&$am~RIl6V3{Gg;py|{N@pXi1sN$14b z>!LsuNZNQObzv2neuUCHELmFyIrM?)07Qi>dk)J-L(~Rnf2w^5I-Eolx6+!mLM6&B zd3MDfM$AGPH9n^UoVTsZI(8_m{-L#lkXaVua^21hoOB2Ac9^QsqH$5wm2rX$i`j>K$jViiX$u z8;T{M2|3G7ktQCsQ^GtZ2N*X#1rZ31xdD3u%c6wNEV33oX%)*rCa_sRUi+r;zO2^(QW)qE#T1d(EwTya0iu= z6Wh!WrlG&0tkDwF5gH*szNFEMd=k5LLSMS?3%>e7OakV3@{{G?E&+-)vU z8*u<3)B7qA#xQVn3-0|)e0}cr?P3z@S0)c zG>65qy5YMk;-AKn@BDduEp_^9ay#^jHOBWnvvix#ze>y%Nb9QLQ@iDYxYgaDSkaTY z>vc~~IgLaHi(KiQ0U6+I=AuQoLpnB{AdCcZUZ`a!QoCPxA~aigXX{u4DMg6det z#4Hh+jAu1%E)o<|y3%x{!T`yjkvjecnX$#UMWud6hRVc*kDVGAiRfcrjj4#$A|`&* zXI0Fq43WB*DX=YwCvPekWp$P7xhWI{s!a*)S5uVbWmAeanUheMF;>H8H^zKbh8Ndt z_{xA+ChGTwzD`rPdfM12wPuqD?lqjStF*Oz(T;fXUSMoY3KP?il1i!$4U{?>o2aEg zJX0#%n9M4VebwZU*sC#j}LeBznFxgZ3dfaZ@f<>+Q|(1sPr$rqmg6 zP8Pgi9nBU*;ArO5#K5f?Y(fV{#aE^;Ke-$d@ChUP8{&}`B(M&5`>dE{Y)djiUW-eE zKPf2s`GQP{k^(Lg4m^Y-3GxKK%2{2;9_1^;A&7gfD+Yc@G!T-hDa%fGu?EGUB5O|z zG<3!ruA$g|LQtPVvA6ceP0T6H;f|SyRf-WZ!-o>qv}7@F`WXAw$%I%{#n6JP*#wo1 z9IG!#X&#AGlQRBwO64+DEPGV(L~58COC>z3%AinS<(PHI^iB2ewU7-h4C|=?W6|s} zYX`z&n6#u<{$zG;d$xI^pp_T7Z`8d;OD!ZOaVWw!QzU3atNI`y8e#^%Y0aQb4jZF| zsaI|9=Y23^uajd1fdK>}8!@Ar7Nq^kbgfr;I&F&-kqMN?9%FzCEPSC#4#m*gKf-Ft$^PdMhh!Oh~Y#o2i%8%qXD|%wQT2?RW5E>KhJPX1&?o&D8(Xr_`M{&gH(4zG0t3Wt;tudIEnmr^i$CCo5qLy9l zrP4DHX2WX@hu37q~bbzJJsoZe!fOaUZuoH%}hz2T+u^ zPtq|Cce;%`m`jc#Z}4*_I;OrWm4A02C)3e$=Fv(7&P3n$lXc`oc&}?d!anmJ?O3iAGp1jBJiVbk@L2C^=sW2-*m;1GV?b z7{hW+yJ=bp8=Z(*h#(`dQYUE#i(rULCbL%%oy%A%eWOW?i%4t->lQ@KnLm0HrSBcc z?9h>TrSgLT#Mz+25(G(7>y^a%?4GJ64y-4POIXE+eUcq#|W`jpL2LL-&I6+RAuiz`j5^~anUONfz0U*%3yyHS(m ztiD=sLf}Rr{y-m?iVY#ZTSm7^@vi|h5np9{0n_a@NMHnweo@$Z)h=$h<~%h;YDeFE z$&!+_Tj;Mqxt26h4hd7m`siJehuPyEV)bIA?L zn|_$K_EPC*B(>XTG1*?%9v-`sBeq$fBn7=D#8teStKtrbxtR1=PM3F)dQJonOhWm0SHl_CDC=|Y1w;u3o zhFmIz7Gkg$8%hb($T`Sjf%0|Z$h@NAy6kp^Ni(dex zbOgYJ7`xKCB`@-9sr=>}LoBXkb!=!R;iiMW*0(rO5E+*el+(AW*a-0->~Hl=AuT9g zG3HGDQ=d>iBU}wLsbyAlV)W5M3-L@_A)ZO7YNzpAOJdw{E~2#YhGA-E!Y3)1G=tx< z<9#_a?`HWd^DeH^EJTO`ON}SQgr;5{2PD9HlAceK((I%C(AXs<(<_U$cIcGp1Q#cR z2R29%y5I1xkP1^0n-|Lip5rx1RWD*FmiH4=-@ZDhZaBz0@g~B*M(tNm<>aE)N@wyMIa|7#O%g0 z{NVlgX4;ReZ-W%@@Ja3p)9QAp{LMl8KS{Z0Es1fo$yw-2a$Cw!onPfKu!es^+CRWm z`klpZ$S~2E%GG-TSxYKRpT#rvNuKR|dh2zdi3w-FaP^;Cp{5kO9hG=k2~CAFY>I^TbJPvCkwt$F@+>hhB>-N|d$#_*6O=7@`ns zCDKr{5+#zY1&c6V8R4ueKqlo$sW7%UuE1|D8LA`TTD+0%0Z$NNSzzM>vv|xT_==nW zL?v8}`-L3p2M6_dWk%py$yQtQqjR9u4KZ|?W>wa7`4zG(TmIkVpe zPA$IXnA?036s8DNtYe|9UU~iA=sM*%bfbBK^S%&3#I zb;;R~vmDSd=YarKz;=&`;DyJG8R+ryNB6#03HUo6@c3UKKjEi)X*E$NENDI8;cQSM z95hz2FPF-h@Thxq=Lp`D;Qt2q&|IiGw9hk2-R~d+b=U1qKpY{Zn~vrL92=22h4u*g z%10~kctSf!{3EyVh1UAg)^?mM?HLqs_dxu~NUU)e)zes-IYd=y{VHaW->C-o(Q+bY zQn@!MggWgTFq8J#=DQd8vZ5hfU350$P)PR$M0$EPJ3nep$zYFFo9@Puk+V91l&8v- zcj|pDMCZ)rc_GE!-zMbZV^504j_u@hiXC+~YhmjXB5(Li8%`(@TKrDM-r~;v)TE%R z&pL}RR3$#(9$`!?HD4W?KJ^$GfprE!ZLCCK;+HBUl-cM=oMHU@L)j6PTt-aL6i8_65n6k?yh%Wh)E(kZJ0X8?LP}AfKEj zBd4l^^Tia&ct85XmN+qn9o}tTSY)S6BSEvbU%~Mgh6b*%{(@B+a-LbqAOnmqID{!K zW(OJ@a@X2lpE90U!%B=bi$zvjYH~1eO1flL9rw}s+3iY$NlU~=QX+*uMR%7^>AIgJ znoqG}7?-R16mR~Hg0-v$((sGV9$tgtRb^Bt-t;dCw3<@b`PSMNfNu{`-A)BCxJL$j zDJIA$lvBmpX^Ra8BB6KV6xGa7iTeIj$CwK2D>RxXBTs@P;ed{g*Zak#NotWyH6aSq zl}vl3)AHh%IQjFS8WGIgEC>^(?0)0Z;&u&9`BK??BEcPGH*D+u4x`?klA(!E`I;)O zM+Tb?10t3Cb>CzqQ-8(WUYbAhX{Bj~$+tAt3s1S@X*e>wfiEyx*xX+P$T{&;c&@hI zTG=%|*4@B5G~|F^5M5?41+zE=mjlP%V#Nc%cn@xTA+qWHO$^E$StaU>MmYBHN|u&q z;A}NmZ(%7;{2^y69b_vsU{Py-=Vmn`oBDyvp(>z{@RZ!HD(&OA>?+R;&=;krlHO*_ znaFgtrBQfcaDjeWQxt98ug594AV-&ym8xE6|CO^yk@12v6qYx z#xa;$nq7;2F4ejZP7;apq3|eFytE5O7K#$PNc44S#LDaucd? z?`u+|m%xpjT6|ukD?!;@-+~Hgy*Mj5BtVZKDG^J;Fj$3FqwD~pOoR@odu#YDl9@>c z3`&?YSdbsbemNxBHBSLjYLed2=qtKpor)}yz?5WyVkWVR z^~_tRCeZ=KvZByYnCvX|*KGQQvS0g|3iLYL^T4Fx9-ed>^W1Lq@SEku(P$*rz`ef} z+nMSJgj+5(C%3>DFI^%zBxR%5Fv*sq=_hzAcXVw0U*&f?t+(QWLR8quSvXQA4B~`B z6Dm~*ul6y)Eb~+b+I`AfrNBOg2~R1Nrz{s(=h1tOe#(fIzW*Dflt`}X5Ev01P^|xW z%GKwC$01}aV2Xf*vCuziH>L*2;5~YLfA6&fvU12zl_5nyW!pULnf?AntD6#N(U~#5 zxyxe9Iwz3BR$i;AOlo@B0zc0cm!j<50=S<E`l~?|f2mg!eM70vqrpicXx!>_~FFU(I;rCzM9L+v8XB=h>l32Bc4*Q%v>{dHi)7 zdiEVeWpfh0i4~TA3oGVqaOl*YubJnKm8?AW80Hp&c~$ro;lcoj)Q+yNKQRJ>ky{+W zIImY5EF>Dk6@$8CE(}w1V@gXq@yQA?;Z#N2cr;px)~7f(#^DX_QlZj@Ti&SLU3z-{ z5-VZ8{r)5ZK(&~AfU}N%jX9pg)Qo&BsZt1is|;D+I?ma%;@##VzVp9A z`u0zvshhC5I0a77-!W7;kZx$_waP9_ae$t>PFO!dox!Lb+CFCl0?8ct4q$u9L zk?|p8)wyoqNMkwQXHGMXV}aa{yS3%Ejx9)=ln z9#vQ%k`@RT9+_w`zU}JgH36T=Or)RUfSXW6&$P&?ly2xTB3F^Pij0K>gWQDFdhBTH zczVTWB6;Ur)X+Hh5TlOquRw5E;5VL#+7fW0G$1^eyiB5i8K6)@&|yTNw#%RwkP%jH z$ca)Lp>zYXAg`v@Kmj-Q%%~gUt!V%4s0tr!e<=l)xU z#Icz4Ul|fYc`;npI!71VifKtfqWF&fUVrgf+sj!jmHbT1OjntFHp)IIbY+WFly35D zt5B+iH$vPtD#jQ#0CE#?LaW0FabEe|qmUpk`}sCV)OsTO>v_tDBOBp#o|{ zVtVO<`svqSSyI=2bb34=<1|9W$Dh>c{}DjII044zZw>(nnxE3@&xy|e+vO(@wug%; zR@|Yy-mNIh_I8KlZ9sSaJp{&@{(vPuycWE=P_?Ai8Wyw94`K*LhtFoYh{2*1uU@;8 zF_)akD>vx4SF|)W-aNnwq*GI$W~y5rDpKF@v%g5?>3nh76?MP1)O7ezs&n@}^KMI2 zSIOaB{2l%mWUq@mIjb0&P>->zs>8$4Ig;&%M(hr2ye4ANS(nQf94G(=>x;_1C8&B2 zBE7??&yg|mLS$I{g06{FZ$roJ^WLGDN3f^{#*z3eWfY-ViDTje%!DYV9kds`|RU4PE!`qW zcOJTt2I(#pL|VF$?ru1g(jeX4-Fax<4g8;HJnwtQy&v9j&nL!a@3r?@YvymxHD@C` zF3cn7x#x6PolQ|3M~4!s!G-o_NC(q0^Lv`{+qTO7 zQj?SVmks6|TM0l2+4neFu|ad0xDmz%<{CIuyYc?ycn56LF?SUT%d&N=uHJtv8vGT#24nMio$K!%F~|P& z2g5E8w9X-Lxi-WyNg?XqY+f7ri@le5t{<--R;+PMQ2p-X^Uv(xNP7ba?di1P>Z9la z3w4kuF;IHT=d0!}SHH7W6&VboI34E4tG+HUhj$(5cfyS6n_VCl(Rc-dObN8m%yGMC z7;^T!zwS=quz?ga$~VbL_Au@DlO|7r8Z;|@QNQ=(?j z_6U6bLx6hVUCWniEHOHe4#)(>=1PJiacy&);3_U&4`}z|iLk{2U#=9f-aAjyl$VYlgvYyYh65w`GBySGg zWNJ04d9)|Cc&emV;AZ-rfs9YtR7U5Otu6I=+vTY}E2EM_MBFK}^hg7}?k|iu`S8h^ zbj1sM3Zq!@#``h7Wq~@4p!MZySQ5{|O6udy4JA!XUDPcr6{n0Ui?`YW-$7X=5rL*Z zy&(ayn?eoawq1KhRS02@uSe&outrz^RLJx-k3~BZph_7`GH18Z#*jkOQ);It;m%Pw zP2Q>oVS2t8*=KX#8>Y2lmDr$F$La|Ds7e0*2U!z!B8})uW{}%hO}#SXqy>%NX4& z`bz!=4~Z{dr6%BH2Y3#SJF?1(Ehaed>d)*98_QtM3Y#`2fECIHj_bZ-BwO4@GTL)^me6lm`Q5Tsw!i8c?3$NF_?9r$*{ zquf0aIf&38Je_pRwpgfhts;M3t(frn>z}bq!`iRcg85aRxjS>Rjf=(j9HEl5me0x@ zl`V0I`~V1ZtXibL=8F*RC;rT^5W;RnaE+?wUNx#-2kmMZg-kmv-vkJ{61M$5F3d}- zkvFyN;AXLT+b@Dg%;`Jg{n@tz62{S@={JO-meoh%7_Rj*gLzhVY+j526|Vs8wP)rC zyHg_Qb1V{Ac-|xkjF7fcthIzP`zCKmsqmz+{Z-Rohsc?c68=r`;hrAw;O{%?@F+ z&6)lrVmMweRAU}%2;O$Bf}NG~z8W!y_TZ5FD11|~r8 z6X}KFTAfXQ1o26klW0wN^scDBkm9@MO*7dz84$P!j&49($?i(EA_QYs>0{wgY+7n3 zK-9mWV5d-|H*o0OheGP!u!cVF`g|*(iBPf-F{@vq4u$4_EM0?D>B9(vV%Au8!f%Jd z_~*YGjz?&l2KpIybd8SmX%nsRNQYP?KPzg;ps940`$)LbF;w)xJ5VBkg%{yYf?<;= z?F0Mi9IGbza>U!j$bchDjBOSbl3imc+4L59z;+{~`TjX#o_MBJfmEvTc63to?LpA= zmsk7Dv3x5ZvYCsCDzv~X3_9t&ms`I<2*JeYHaoh;wYxzWOF^#g6;Pb?xI|CFPH{Y^6|_VhJj*%og1DNg7rcPzgPrc;OeCGM%h=4PTc zfX_4qSR@#NZZl+ms=U_uM+D(2MF^)N-LrD+P5&_YcorBex2um{Hk&MkABs0eCLpS# zw4-NzQu4)az!N%8{pQW~tk8)Npp$4G1`2}b;zjKq90;GepMCsrAG(HwM@n1kYr>(T_>a2VLpy#@ck8%_*HX_ztOMjfT}{&G>q>{@ zl26e&5}?@VAw4ix3#cA;#K`DPQd5M-$xa_IvUB6wUwkcoXs6b0a;Lz3>p@tf| zp6Gya1C-#JMmUT*Hj}CfYlYR_GF9;Pui=>LsEj#hq8J0d`0-v1Nnjj>FZ9C!q7gUQ*Scv8=aiqj7vZ59ut@2hOAYK$kX0jZY51EB7*Q2# zRP%nUs|*pb4P=~fRaGhU4W^JNddag^Zr1vfs44SJWFi@oier5>M@QS_$F4J(JnCW& zr!V}kHS8)!=GO3@Pbp#l*dMoPkuMvQa7qLEQNl{6m(*aEEKSWMCKB=(anb0|rQvPl zYm`QQhixEoFKx@kE0~1Ses3B)eyCbBQTF=#OGC**gRL^}v$nAg#x})jwy2Z0jWjyB z3ubN@FX3QGKzfX!z?u_#8SQ#24pMGRclNNdym$NDcT1Pj*6Wo9^9=?K^bY?)_31qr zrT@}-fRY0JZ3k)@dbhQC&#snfP?w(&8{KG2?ir#ponKpne9Rt{V_Xm{Y?8F>?b}rW zE=yLGjlh%0Da)<_Hzje~a+kFw=HS3N(7OH@C)*jgZQmk%!Y1x-@9f?n3?ot?_!*zf!AKx@Pk`elzZ@sIl zwITvl_$vdUe)h>>kzinI!yz%!Gi~d?h(Yt>!3!h7x-V>TL5HIMer_&p2vPSLFr$a! z`Yl@0+$~2F-B(P$Frbzbpb-JE07__pLH@K3_77J;9FGqJRb2o(9jKE5JoT_7J~EH? z4RA;k1hV}4KP(;GqxlV-%>*{!;gJ@qe;FM+cO08T0=OD?T(|z6(DT?0hU8u3J1>vv zmi}V;!kz7BPT<*9`s8GJZphjYxC>uvPo)zsc>xdvo4x`+-Cr7h-e00{Cl;vhtk{=8 z3NUdNyVD4~7T|loU;oWrBP%XCcBQb7bo^=VKvi+-%Nf<965Z}g#zFxiUUv7Ggl7D7 zKS^9!;uqzH)Z4E27n9(DLx)~6IyWV(DDdZzyz;>q-ErH*5Pt;4tRKqev!%nFD{ER= zp9Adk(flA|?AVJ0$UlBts<6Cd5&HHqNCmu=PXZYb?s~(zs+@098~?49Z)%1{*)|c? z6Rxwr(N9CaaI&`kLcUCu%E<93rI3B(xqTe_NCb|fiG2`Xd1QKeJFC;q?dVU1*Lm$c zeFE|53LD{A4d2Rjn1~*idpQZFSSSA_nr(+%XSi$#OYbL2TuPU$VNoOp^05R5|M9|S zBdb7WfqgaSve3G+J1_sVUzSQm&9e?(aBU`G+I-oSU};y@DO}=T$ym~r%XG6!7SVjq zHP3a2s%~xOwVyPxXwd=AZ%Pc*{I$2n`bPrEMSeJrJz2dX5^flZaCY@R`L;%>m?J$h zW)kUceSxv$T{AJ!crnnvo#AmFAD{>oajK6Jl_367yCoD$RM` zeYwDR?qWmNq{uuiwPl!z$)7?gnH`@ERg9X|3TpdpOiMC9OB19eIlxonsIxnqp>Psc z6=fP}>tONQaC!a24%g09n7S=RF)XsaJ(CeLIi+dVm71Atq7&ae%#N-i8Ea7um1?_2 zJ{Bjxy=hP=4Wt9miNy@`HOB@*Hf{rCPu^D`VlJh)XC@6wb>bH#kyFk#yiZ?;h=+G z_p7I3$CTihr;rrQHBhL>+s`1G@si62AL)&Us9GB=CpAxoslrTx~H&Vpuo z$gFKlp_3u2t)dy8DFUh7ez2M}y)j9rLI3vclNhk^8Np`d4s10yuc29u4r)xO6bE0H z&=cZeXC|GErK^%A8VT^J!?2jM%E&lD<$Q82&3uICel7- zC)HadU~TzV=rhZdF3ZZ6l*1I~st;9zcWXY5d89`!Vx3RCa453MUWl#NqG@xtkuTjw zM`tfT$jR#p(oPhTDG&Z?#zBF6UW-50eTO4hpPWUDl+$J>VN=wNYME;#7RuX`CkZDZ z3#ZcWT|&TA)cCOjzH;=KA*2p(F+oLdqS$I|=X;HC6ic;(R_>~LgK%d{xbV*re_{e+ z%>(Mf`j^R&CzV7AJ6j>Naa?wCZcXBaHJjvmfD6KZ*Dk>PsNYv^fzIMdY<}U)f z*FX5?tTsnE2v;EPUN0|ET?0rO%VdA4>r{^H2lwbcKrG7B+$(!R!BB26_gbixZHLs8 z^1epk%Hj>}9C1yy^?~f_$zVI@YlGR0i|8B*oVbm%QVIvpQ9a|G41H)SjrqQgWjO{e%0e1B<1u}nt&R2x10*ZT<=j~a zHt!WLg4GWBbnjL>@pyD9wodH(lwc|*qq@GK;<4^?BvIE)3fAx?SbCUxs?J%0NCp^GK>^ z8+GU96K{2ZIFlkgSl0a)KjerOB1foz4dWP?IQ3lrs#Vg*ior~w%aMNm&1})l$kr~z zYG|~*Wu4qni>9=qk@JD>z!Yh3jxsMb+K`@tXKY?Jtoo;OVyC^OXG}Kp@Axhj!QX1M zIn`3(>^SB>eR3`oHCMsWrX?yUM@G}K90?@RK*SixCCM%VglTmvn3Vnr{%jsGkVNkMPO9~qwr1<>E29;qVY^Oe1c6f_ zr`gs~b?$?ON*+_5m6jy7C37TnD_h}hZK$2@NR?b*G(<*+X61MB%IhLU`Dp?dAOs!G zAoO>jd6xf)owWE{jt1gK$pizs&=YF!TUS;HB1<=}opB;@l>4vH7Woz=qa5+l80zL zZjEnG+4<_SC1gi7B3J{XcP9hb1;wu-_dZE~PLKBs2`c-H?8z-PuuZjwB0EZ)f(O-D zEq7Esii%jd1&1hCT#wPF-QsDyP+zeyI<>+`VzDl&Lsb8qqR20K^v3U*1nyQ+NTymA zlEiA7YRndov`DqR#VW=+rixaXM%C9TOZw)FexRl_U^}3p*m%%ieGwPS)@nOZHls{d z{*uI)YVP$MIV28jEt&W->Cp}Hw<_A)5`ttP`Kg}o1kL4#t1=p74sltm_Q+^1)V}6m zH+?XOsan?=QKtdWvPB0-f$)DuQ46N#?Jk+zWnM%jxPh&2M#rvzkebsS-b4X_HxLEc2b~* z7S2<#AmVDpw>D~F%Sw4z?HeN#C9vUv>2?Ww2xHWCnK_F?IdX803gZo!ERLyGqzJK* zS0&gxOZPYeIcJ|cRSRXXgzxwYbtp!QMsmtbtgp)ljmqQK)Rsc9b}Q9J2b?2mxw)Z)cg{*r-j?CQ*mt^8%mxSGW6YKyE>c}|)4I&YNy zFcgL-NQ#D=^ZqD?F~-}WGd!Qm^kqa)vb1vWi0{g&8qEw#F2{_S3|%X115j2|a{b`b z2}ML^>qtzNIYN)y(ETTk0+7!sb2fT~9m};~evUbpJu#%T()`?jN3~!evV-g>u9}m) zPlGncDc#WFs}tc3g0+G}sLD!yIeD>YHQe!##^q;66`?dO?|`4;F4ik1&iBvM@tKEX z#hm% z8cnctmgVg%VXa|3(kO11F0I>~1hNz@G0~h4F~>c=Q~%sx-r%wrD3aV?q`(0wVD^lZo3w_O1t{bE;C( z`D1jiAw|l#$c&=-pSv8#jn2L3SZ*E16`*q8_yTK$+N}T1XEmQ*!M|jV@IDUgO^`1r zgz39S{RAOAe%l_4!}G*Yll(21PUcKg@sa4``@(Z*ln+Q!dm&C3(5JNw=#t!yb$zB0L{c#qXZK zccEo2tbnqQ%)rTh*1}unhh!C6WFO(Pb*qo}+)U7@|q?s!RsH(HysYSm)x#1Jb1{##YV#7xwNWESa#iP-1}qwQ9fF>)A@@%R00 zc;#~3pYp2H9kkO<|sITj#a zZ7iI)9~YJ!0M+gvP$Ubo#Z~O<*qaN!#8`f5l-=3>q6PS!tCHQ6W`(Drs?Y(L#RjN? z^$?et13_nXHBztEkjZXveZnwN?-jm^;81|Sd}^rtb6e2AN^Bl(A}7t%2dul#SmX1~Am3{M{0 z*~uoc(p|T7UJqYaSvF58FX8+MmePw%Up{lPRdWoVGBrJnXs-CChlmdSUFw3SY4x6} zS{+x8qfI157S#v;$yovfoC}7UOG}v4K6!7-l`Rp*I2K{@GlSx(_>p{(4dW}(8gsJE zz8|E0pB;VQhkx|II?kFEK#J&$1lI>j8LDMq zjIz<*zTJMS+L+qO2~A5+uy&}%bnsNjg0l^)TQ$2zSbX#3IUpd^#y*!L91!5v^MF}o zf3m7dTpol+#iK9vzwH$Lhrbnc3rljZ|1HL^IjvImQgerlbfL!kKqA+h!W{o!4pP); zyC0e@fFB&}?>Vj#HxulfuWC;84zcguRj&UVY$q&v%RGOhwid-(-QImbmu9)#v1j;5 zd3P|fTPZLrl=_dJ(d@rGBkftIrG)hm=DRDH{T|OEy&jX;#V;-AQpbE(w%Ck>k8Y?{4?QCqHK0V#Xc8Um{vRPB70YfDK1i0EbwN>dIht~>f zwW|6Mq;bSgZh?~>(2mI_(l=)ak&qe+m8C2W<*}xDlXA=M60ZC+`CIiF#@^cLGU^Vj zf)N|M`f;A|z0l=Fu>-MSJJ^`cV3A%s*Snv$hpR_;Bo!T=9>Zzs6$Ex`-skht;R|1YBMra3Jnja{qL z{-PiJ6K~ak*@uu{2DgecnpksEwvPPi^CDqF7c;>Nm{01WE?DQgWQcU}6Y{)YPzif5vIGOPW{C6t8!oRAqmreKh@*VS8E;23Z^W zLS$bQ@e}maiNJNpQ#)da?lbXZ8UHt!a3?(1B}~+n5@VZxr&z_razQ1i_pK$u{yj@>!athBG&UK zqu0B zD3)|O_U!hX}4p7>hF=Lf0 z-7tL^TbKT3&-Yp)&tJaXVVtNW{}!9Re7ZL@3eA2!^V_F6KX|7$&=U_Y%wM1rqccP7 zohWv@&5L%#9WM6Jzc4z_CjTyAubjJnOItfFRDc2%dGaa-vu8^+^ateoOWO>>>TDe= zxwGa&GoSpDSnDSEx?M?+7eq*QSh|{XgCAD3>ZIE9tmq}pd}|^(*1=k;>Dl3dnwf+R zT=&Gfc`dm(<({+29(!(~r*grq`EKXn;Jo)J42u}z7^yVpTN!VroBii5Wnfx- zRDEKWtnT@zmsgayu_|@ncc8WZb|gJy>EM$i*2FnKhF*TJ9jol&x9)RIV_l`|XhHK6hw>8;qqJfZ ziKP~{2{3+Q&W~(^+RK~#ihAB*Kz{NIMjAtTT& zui~h2!ztjJ4~eGb{TI%dL=x<98hzj6D(-K1`B@zuA&+dNb?W8b&ad0=n^}>(t)Pr4|ZicIcUVFMKfFSt0wRCNxf*+VEa*8RIKIE&1fl_PtM@j zEz~7BlYJ&hr#2z#E>+qh@i+QDdAS4iEd&FyP>b?1i@<(H1k+47pRn;(_4M@>P-=+jqCzgoc=D_ zDfH9fv937lDJds?)^fR}?GWMEG0_LJF>*Ik$i?rGbW&9k1!DhX+MYB?OZtatGK&9@g4(0t*Yzt z!R+WQl$1_qWEGAF-(K!kbE4iSgJF)xD_OznkEVIj0`b2P##;1pWI5UmlD8=;&ddJImCw05Z>4iSmfoo1#baRf%bYuPuKq!sne;0X z$A{_!u1$2fQO7ISiF1rizFZkLSdMYAq3R=+x-zHM4ASq2kxj%+;56_7Tk+<+s3TyT zDHSrSxv8mtmZU%=Zf8iHm&~0g$(%aq(ojECEjVNsj*HZP-8-ruKR8Ae z*oopzVh;?y0Z1`#c<+EaV{OpPR~4z8lpP_Du^N$smj^jTG)=;W^}jS zu}K?7^p86c?QP;T3I+@b$*|tas+-qt2nv`5Yz3ilzAGsnZO5vU7g8XntA#R(B!;XO zeVV>25%u)^+>YJGz`2?AL}p)LtbId8cnwVq*XMP(m$qDx2B3<^t+(&9O6FEXpf_u` z#N5|Kj!&>rt@(pBUh`kfjpa<3{mmK<>(ip2CYNZvcj*I{sHrbA_x7Bh9VR^4tAK&c zUwM|}(Ry;-nsF2Ed_?kXPzD5gUMwLjsLVI^3unCQA})tZy+D9Ase`vtEAI`rj+cvi zF)wo`ZJ-bPx!PL8Pda79KqUrjGiT1gcZ#|4#|Udao52vBSv2OtH&-F_+zi4}tB#G1 zc-tHlG$e8B)7x$*pnse)gL_bCn7OO@Nr_@QHP6g;pxo*HlpMUk3M9v!i0qYaRy2i& z0S1vin)|{{M_!@)47%&(^5K5)qC|8uRZVfRWsZuW-R;{%fC$tLR60t}v>c1s&|7x? zkq#&}#|_4-uCnK?A1{mI+O8^o{W__p&peWhm}qxK6h%cI(l#hlPeUWt`qM`VVXYq% zR$m$;+AjD#)hf8Bn7_dOZaU5P(^NYCRB~c5IQ<2v1mOvAV{7>mi};-uRQwb!eb>?m z1Bg!>hJVD$Lv8?&fOU_v-EI^AU>4dCJ^V*6(${&S+^MNS_Ui1KRf=ZB3Y)ar!Y$zYT3)BGQa5e&g_mBr_ z1s(F#0S@^BnKyLKS>W!#?abTz_;7!&Rjw^Fy8c5yh8P?Idpu1 zo<0Pw>6_Nptd}}fRc{_t56C5B7O0e*GQm^a4T2t78FMayVYS}-cFC*e7GR0p2fY6S zJ2v5d{EWBm2-LYk3>`n6+*Q8qm7Oa6#EJiCV}e?U*HU1ULP4iT5VCvUl=+&3#eLqE z0NwC2f}Ha>;&Or}LPMZ$G*8PXP4m91`eC~IedUk%#ZQyw>?wlha+UW-3?ZF3Zzu3} zsDN(gTyzz|*V-zfv-}wMJW7w_D17cdYhHdC=MqPZX5*>rpv^Kkg{V=Q1sRZ=(6` z4B~xv^2-}2-pu^44^Q_uU-o^T_q^T%%5css{O35{cbB~7cSm8~9w&XAx?Y!S{^(?0 zK-o)17d3!d&)^U3|;C%-q3x2S;7rR(^9B8pAiaB_l`73;dz{9Jr mMt(J2EC)SQ!Ul%zy+_FRLqoJ;+EjbESwcisxL8Q<>;D0pCkJ={ literal 48308 zcma%hWmH^C*Jjf=jRX%aK@vQ;yA#~q9fG^NyN2NIPH=Zf2p%N3OXIH7$-VFU&8%6o z*8Di#Rdwp@dbZXsiBOP}KtaMs0ssIgQj(%d006KG@^~Qt0RX6vdT1Ju7f?=062gG$ z3Bm(N1;$)RRtNy7ivv9w!b0kZ_L7=T003(Lp9gB#uG9no=#Y{U6;g5613&xK5-)nJ z!FQ!BO~0hcx+ZliRX-*CFdKit)Mj$ZqAvt$_o;nTDstp(hbr#sY2h{$LtGa0$~=Qb=TcY@~3c z{b!BSgj1XR?egj4&0|A%PVW`pbLJlJ-qrni=FEznTU;zWntE?e_x1ei-sv+JY_`vh zCVDEDH;rF5@fbEvtw%h%k0~(G+=Y~ir>vV{gN~mNyAIQ zJ8#$5RJeWrAp4wek57B?*o8O?eOhV~MJkOlO}U21!CO;bgWy$3RcmjZ1Rl%eeIjo^ zXZv0Drd$?WVtL!|T>WUF?3@Y*Hd0bz*YC=vD0IM3&?B1fN^wYD`of?5ZY?ld-k`Z# zJ$>w|d3teb>(<&oW5~hR^}5(zO|owEag4hWze+p2T}t0UvOE;(x*O8=8n|rs*t>}d z`W36sdG*AK7&hK%VZ4#6^>S=5mqk1+(U}uqwOP6##G!_{kn2RKgoxb0T zz1S|rvI)&?nt}cIQ-)Gp8ypsOsO#h@YGSpIz zpIOOATYX~ul!L>tINdG?Pfwkq#r3$$#Fj{6#=uyt_Nk0u_J?SPDRH8qVII z4DY=pDB`5f5AhN;j#VsT!4gd{+hZW%GJCI>_5;nCWy_ z2Q1cBS`E;=jS=T2e9weWGSbpCRoC91&zbn4r=92FYx+B>kyU~mRfGggR1NA)^SG=)B+)yig@cW_3PC3W^X8}~ zY1_PP_B`c|rKm9}elT|QY}({Ru{3hr6*Yk=$~A#Jte}fo$;;naAl~ySS7)L8*q=H+ zbS$PB&?_dE+%RQ|G>EHH8)Isjfks@!2hI~eWT1!}e`|D9SRSAq450P~6zGCMji%>Q z)!&>fwxFdyS>^X1xa zerf|p&X!9v?6rlCc}!K|E3AyNY0O@ZU-mb%7HBP4+7cbuOM_6JTvfpskso3we!Oy* z0$}OKFRy9-cd+vavCkG9Bc|~rQ`c!ZQIn4B$w1==rStGJdUlZSl!m*2cH)XETH5ke94%xH!uw0OU ziyaI7XW({??kj2K;#M0e%?P^-(%?jf1~K+FT?GUcgmNDZ=em=L6^muwWIFjQyD~{N zpUBjVVGO0}ijr`GQ%Pz1W>t?-9>2KFK8iSJezfkY#!U$64TaB}a2Q*KJ9olCGirZNa(6P*` zNK!|!3adgtw8EK;6o{cXeF~~#p6%_KA!A# z5?EK(=eOejV1`&W6&d<6Ftg1c-*3JSQh+T5238oX=OVEeB8dx}!M3aE2N~7qcYo$# zdmo8qQvySwA?jUBxerHiC$Z_CSV+S`F7zGZzS4^2b1z`0j@1BqLyQxaBB!Do4B zJ|j0J+axbB-9~wUFBywV80)Hs@pUwJe$T&NPZ<}ZPLX}sR^R!$>jt4B8hFD-_$Fu2ZR=a z_{ye&5Oy$)`%^bRKPRU_Kv%88s#~euw`n&WzIcEB2`+9w<$U6O5W%qzNn6UcQ^!f| z%&D#$A+4)vzqU%sCJopc zfsW4R*DuQ)Hz#X;EzQktXZRjR61S&oGa5~c6H6#CTtkTQTCbf3Be_Us`3Uw zf1^L?6oFlb&`b7j4_@L+@aDF}4DUpZMp6h!{%1MELW`eqSnp#}M&p;KeE1-%{W#H8PSKj{dIrNyfsQVBjQGx1J zH7JoA-^@DorZ)Y3#9)&5eQy`ippW}ST}CLg!+ zjD3L$3e|rtv}+_qd7!Nc%s{OIE^B_!#D>guWk8>VFxB2`*xbcg%^4cbkKESHbdMqp zWd*9aaoLmI(7x_p-Q1awSU+3JBoeJI%}`Km@8NDA$Vk)vtXL2MwM%T|`Fg-5k^Cx3 z&r0aJlV;u=*4(ypFI9&GQ|T4j4B4!mD`0hCBIwFQwf0jZQfZdE1hM#(o*)z|vEs%S zwCIJ7pF5=p)}b*SR;2v%c=a``*LN{2gr+ysW|b{SHs(bps)7ycAycp!8y4Tsju63F zAvX*n#IDSoHQ9IxRNapXu2S?}<4j#I3i<9Q$+zzuNheCBD}htn5|vF6Cfk_P>C6^v zxJyO;cH&DhWsOZm9Pz(uOQuH~Zj&aLDu1^KdcL5@U+$s|=?>itZyQvg2K$+OmP^UaQf*5huBJ_$fPYt667}~K z2dUg(#sdU8zpCIMsoE~;oVCa1-A^JR-H(Y^Lo6s?Dv>Odw(CY2IlYDbAf;bK_2H(t zrx#IZl#VOZVp%%%+%{AdK%Q8xg#i~KHP~?&)i)LE{%y3f!7nDMa>-n8CURZ+W+Reb z6a|NPb2!J5@mFBrMbrAN`c|*rs3|bRJ87+`s_DU2m=CJvqKt#(#x<;Hk&Z`Ps_pv- z)MS5uUaEBfQ#gjszOTfP{;VX|H#Tj({d|_ksG{NUM_!r^*b42I&{iT}a1ESWijPQU z!@V0sSAQ2Mb|99_RiD4BZWuXGlhiOBR5jqCh5Xhw^xK`};S`7)S+=aB%cZqamYtj4 zEvFgw9oYBj3{8Y9Ddc{ZPHNHXLG25qtpOfv(3%aZlG69PalWrDKm2D@A?(U7BJq++@-9ErV?dWW;xiQL!#v%D6FxhtOaUjuTr9NJKr2`+e318zuwS9Nz5gyd(kZdM zK0*nH$~y|ol;94`gog>JUuj*KikY-WN1gAEU?tie9I71ug7sl`Y1Z_?w)i^cDZc9L zAt>jM8uT;71xvx7;v2V-6tC<_*qnOrm=Ja@k~g-6MJ*)ommnQ$`9yFTbJQT6=<>T9 zUhplW8&!_h#8|QrpQoN#)+|P0)QCZ2Md<AatF)J#dGDH+fK+I!mK^bG+XR_ecc6}`kZ>H)~o4o>7H_cB$iJv%9Km`T*9a%H|lkKTiA)G z1h7444T><2!Qho{zh&3=12r|BeveZ#zep}lVwRuc<_9{IjmfeAvvqLC&}1Bxdiu~kvY=^E+@9rWF-|xf7Yt8s3j1ZN9RAvr4YXM7dC~~su9rKD zb?exQ;aJ^2rySukk^t-u(ahF;oCzR;N++mLfamUAuSIe($yx_PmKYJ3)E45owcl4* zW!Ahe%`&U(E`I8(U%8s|0GT+{@=)CadkwJ<1*zW>s^!I2VwNUmlTSMfR_pHo!MxQMWjHiuwrF z2v4ikpp7wzm=j|8+V3>F0#ytAnohqHLUMX3<yuV0bpA4$+K@y41J)5<*HQ5#H&PzBM7y@jCPkA^kEoKa6fIInq}II-C=k)6O#T zQP$Xr{Hv&AebKmkYXzwR`!Ikk0Be98;6l#+@@c>LDN^SYW9o}MZ`$%eP2haQFS7lS zeZpjUFtJU)!w;!B%!OxRCJH7ZfHUw74^$SH&Bur0!YYC9ClTtBN)(kA&rpGc zbbi#Y_0b3l1p}0?@6@dG*Ygs=Yo~K<~#U#7g z!P}wp5~*Vpr;CpbXZ*JJ)J?+}4>>R8_>_4uG$Z^4Yt5r{NfQA$g8HAO>`xNy=~7!L zu7*nz(|#|O#7Ta#NRgL{Yh zwHmLiAih}ZjjS~7`BMP4t?x@|`UswC`bN@M7J$5hkN{MHLX!daTk`oApsLIv%+2~X zRj$M|k#iu@-ui{1Ms8J$=YPRz_v~2Z9PuK=l@QIb56% zZ+|967e^QF4qoyKNDFCt4qp0Q1!i;Z^8{;S7cQVgTbYCRSBuozUd3BM^ zqp1?)$Ju@LzlCSN(6?dkrvdAzrIeaLMi}KZrU>Uk=!TU7&N0N z)!J$yj=5OOsW*!Zxw_qB#Ri)M?0QQdp;&1xE~Ra#BpDAPfXjpPix1)c*bIob7p9oV zL~K8LMK~&tL%w$KPL4FnhPa-0dq+7l56;pefu~lejC^Ve>*-t-+baZRa7jPc%JK;2 zrJ8gNYg+J9GiU#&JAbRfH(yyM`adMc6M2Om7hm&*s7rI3(D8md0}!fWM%Hmc+j$Hr zNnXGsWB&c{7a^a&oc9;jaCgw+T8Yx6fj*d&Ij1nyiv?NK39leLlT_bO@FWvZs@M7Q z@fX&YzW<;nmyS{uBRP*a{b6%;5%V3tM6|i5b9MR}`}U>Ce3Eu7!#stzuT)8tM}{jg zzqh2e4z&hQiy&bZvGnE_4828ME~d)lQaJKw**6pS-wA$2thV4?9wa<;8oO*oSm~*P zgcbMS$1J>HMatJ9l+8ok$&by^^;(O$45fsh3JzB%x>` z+b0cg7Z7#j5mFj`XP`P1_`&^_@Tf`bN40OsSKwAXdSqfn*b<`aU2}0`#j9}LI3yau z{X%p#F)U4apKL8ns}9^D*<)2`DwZ|k`B5rIrz$zU5b2Z;ky|cxI_~S&s;(0-171}O z0(Y;dH_z?#F07qlp12VPh*REdmXaPqZW58Xk*cJ8axR}kASFvmz&9Gw7`lL18ez#+ zLN7c1v1}MxSNCX1TK&eAF&)?cU1#1WD^D497Yp=~BgQ$h{;i-lsLerA0ZC{0*#+Ot zG8Ehu@o=4u1}J2Ul#Cd#=*vnat-gFyL007E=ZwdG51y`96pNe}hsid;DV3s|g#vTX z7W%%^wtmOlA}81{C4t3O7`g%=K++;WcMl|kup&hLmK;)X{#(H_psp=qp|7GR1;Ij) zSX)LE|3Ih5=lpJ!O0mlLZKqj-w8=Y5(%~U4LdtoE%p9-dCGJ&Jegfg{ciw#!oMYT$ z_{(itIYnw>e1g4r50_S{0G*&R$0-%RZ)a+otc?G#$NB?m zQozsU4}Lry>h(RIod>BxC7C8^r*cHb?b?n`s^PW??murgoqOK>%*Y_QyLPjSP@=B& zYQd-F8==@_KV~LJXFxdod_8gc0P%$041@5$`U*u*725!ts>m+K5LbbbiK}A5U4Tp` zlZX!{SJ3+D8#%>IIa=~Rc}LmkxrK5Rq7GTGu=l-tg(+F-*&@L3k!3>#bs@nE@!xV< z%>81lZ#X1o@-eSQ2jmni@x*3QxqClINrK(LqfH;5^HwIZ{FR~^^!ddC3<~30i^Zt- zllC`C9!e~avT{N6kS7Bt3m{2dnl#u@TkySedJs z9eK8>9Y?qA;b{T2aaIPKoUb|OakHph4{w&IQHR|H*#p)XG2~k}e+lb8CwWb&Si6kN z>2Mb4v<$@`YF>NkVh0y&N&HrM#F5A%eNpx~!fDPnO)=9(QyGto)K z%R416&!?;TmoBZdG79gf;}?1mLh9lCJL!0kkb2`Z!tyEdJd_ALpTYimV$Y-y+FS1Z zf2#IqZ#y4Xw$34mt8^4^ixCNS+@~iEZa;6{y)kHzyT-^GwSLX1!?JENze3RMqX^0k z@YetIY2x&$ulp&hLj7ftn*SUzh2}Q{j>)$11&l41z3;%?ng=l zo)7Gv&WTcheOfhWv$;*#4skDj;JdPux3_wn{JusTYO@B68fflUj4$BsmkSBMO=@4^ zBLB&ucg=+Y^SS;{$Gb}w-r&_8<=c9FeI4Ulm&1DS=qZmR_~OG$9b6t<)pfMjtsRL1 z+QRa3yWi>jjKu8$$+_jy+VW$@$?t9-rYH*3{6~u)Aeq zHjApg$*-hw*~H2O%7PTbwpkk$+pgW`HH@-M00@pOm`72djF)+NOQzz!+uZ0atBas>2{e5DkU>9Szjp% zZ(?!J?(@?nO={#D4GersnYTtwn&AIz#rXV5xgpy!`=2HHe&h`r4Z=GaW7DX3^>7>i zQ-mNwuTX&EGYE%}hZxHMjY{bafSbVkae0k6`S(w!K1arEd^)41wb)eR?{TW73ScN_ zcK6Kz#6y^R^Iy>WBsrTg69O%cTKypIHS6I>G)Q6(A>qF`0hbnpP4YcPwbb9G=S>|F zHpJ<|Ar)dK(Mn<1D}OShKR^VZS97Vek!S|@d~w2XkpCTF&MWBYRo1sMj8**IA(Xc| zliz^3<$q;RJ7FHAqE?I0=vf8t-&-F|oa;3FJskwyS+7DO$hUrVKzn6}$=10HGRal}9Hy1ZGB4ZY>$ASIp?|s6uva+N!h6MZyP@$BzDpiP6 zK@t`lw}(`JzVIRS+HZm3o6+e}86okydcO#PU-?5^b6q$G3JnPNHppKaQN#I3S*e@C zupSi%q>846Dhur6Gh$~;!!mh2n0>9ojLJ$B{IypSWi;}L`wf{JYWPCq8C+t$dJLK6 zGE8#3klonEm!zA?Y)sGqe1XJF&Jf9>dj22&Zli>jTOTNvJJ$}y2cW~c^3MzUx8JS5 zz0=LEB&Ps3i66<$?pL(FtYzEvs}y)g3yy=gw70qNpk~&&uqXET(=n?R9glcl+bwq`h?dRBLDG=K;UB;r6UiRj;PTHp!o*gP}8L0fTX zh0Q|8y58%jKtFzM@G=QFw+MS#jD;MB5JrR6tYf9Zr7;32cna#kFo#w%J(O-ZWAI90 zR_|WiGZ6UJCqgRX?oT26ST9>|WA-gh7f?^tuo0%p9LXrT)wYOnTQ#mY**aM86?tON zT6*&MN;gp@<-j!U!|+>KD_KNJ1%7m?#DcHeZ^ia3)Q$N}7^RJ9rcu?J;KR`mLa=f_ zNsc&3wATSLCKt^OSD2R(`A8R#xnzZDDKLEe+0d^6hz`)LRND%xkrb_$cZXjp%v-=^ zZy@JHL{dPcv+jyG5i7YNOA`GeUn(Ff#WF}dZpQT@q3vY=b@rVW8Tt{_Z2YV^(6dICbq<~|6n1bX_5Ht-{gV5|-iH+O>H=$&8{dZUas zH=KDq-44@61NxN!!Yw2{sgm3@GDcnLW?HMtRo>54ulB8A zks5y_%M+GYsNF8?nYU2wrDgltU|9hsic#3rBbRDDO%#0{4LDY~7aJbSjhbQ5ctop* z2MjHBPeb43zZ!S#>i6n*{?Z0ySC~)iuaKf4(qo+=9*JXh`Urlzi+cl}MUe|3rVg`U zuaYZ`jG1C+EWeO!GI)o1kw~UTU2OGf;$@Wb*9v51%|>EByz+x(1Xc_&?7kX(?f1+) z`5kfmsvsmy;XmplvSq>|wz#oYn zTaA}bk>5lSm%zlu-jU?-`SS$a_%96M7ndb(xev+iod+ZQ03J+|*!n8vmU5me(||${ zvtRC08J4CR+GAZ+l($s`Q-_7+2A2Hd`3!vWs2V3{gI}ictY4-0dQQ*|1 z7G&sYDDH>j)ahSw+QK*90y-(*SIK^D$LaD?^y(RG_wsUMOjPg^v@nib8utVo32-@( z-(-*SdfzEPYYq59tdO)_$1wwIv!Ub(l`c-Wbw|33?anYMDQxcOb0e*}kN302DN&OD zHwsMZ@2Hxc4xd^oCbFMypu8OCaIMRj+A3NrfFX;;E7@j-?*Z6fWf(%X+k3oCoyOX+ z=U;*{VM{~NN@I|ei+{f>E}!dUDs!wDfxZ9O6n2fYY4H6P`S)SKuGyDtW38b@SfM zzoZb?4njhd+(bfU-4T{nr;roGFG)<$nB4G*Y93adUDOmJ!11v^>Y2BY+OQUMDxbp+ zpj&KboX7e6@zce5N1Nak1SxS+s~S6M>b0e*}U=AaS}!+AKiauO91Vh5f*K4t^OlB3s2!XKgE{6}%X0yHwn%!86Y2PE%Buymw*6$WxpJ*F% z_{2mdXC`+^SFv!oq++k|>9gSL<@TjAXnNEGcj7)fzQfq@0@zm47Fx?@MmoRGLkuij zTYF;>B3e&u@9MlcFxc*#DW82jmFl)rR)>juZx$yk9NE?~j4`KTy43kLo7p(z!zs$4 zh~ZzmY0N^QyiO#BpjPn$JSTly_9AbFy60a{f^3Q1i?2bpQYSDV>6BZ}ab3KyRA76* zbu9CkgY;QLwBG{^%@E8kP?}4+y>=@_bjO>gxqz~@~=vSf>%j*XZT*M zEqC-AhZIWkbY=U5Tc1J3}h zmc&j`H7WSpi*MbK65}NPEP!_WvP0|iw-jB3T0;}Zb*Aq9AcvIX#{QiJ-OnUT48^4R zX^F&p4ojQhZ=#>XS``E)DYTd(YVglZcVl?t=-Q(XIUuBaxee?gQihv@HbE$!!Xzp~ zF549Y#Ela&=JiU9#<^w@WQVW@rsOwyN`>dw!dAtP)OrGbq;~8eW_C2TI>%00l*^)w z8ng(_5kRY(~t1pJ5oNtco%JJD~0|uLJ}QF%u`m z3ZM_6j&(=t#=fMxTeeS%?=u`oR%U&R$V^c!9m9Gf+okfUoeuHm(}O*$Fw{d11tioc zNR13@pKKs2P_p7F`tKAeSz>)D6eWz`Q>J8lWcrao@nrX@m1vUCv<~%;7`*{=3GQ+y zP%06>1vkj_mzs*#+jhs)ew@Xntkg7#T3EJvAdpbahIbh))g$-_I|wnG{d{Mwhfw!d!chYwMY`8pmQuG%B#5KYkl60Xg+@owW^R~py_x!&rOCkwh|IX zq<<~XAVnT=aef6ozdlsNGI847%I{LZ1tJP1( zcihx1)sw+p^hYDln%IsSsaS-A)!DKMTRU_ERBP#K`kh{d#Tw)SSg91-T30bCX40Rp z>f&X{%Nk1`q_|M5^$HnJvYZrUQPl-(GygbXE?R9^L+QOU#x8OEvsqL@zUXPSk_N5% zYXYilwbWZ*eNo%oF}%FJow5amN#6WI49Q}ZQa)1ls@3dbwGxXE3i8G-;a9rA2rWE_ zb$PNC5fZjVG8)k{M7w6i3$nd89(guJ{6vZ;a&7C(NuNOw za!%s?48}fGr=jXsC&;&81feY7da`$^G5KKQK-u^$9feLqH(o}nAlg1k z#S+HgF7=WR;F{o&Zz+8?j zUWXvA^?aY?RF6PioL%vg%#Uin4|DFU#h*oRGN%6lz=NUzZ-YIX$?`PQI8Ud{><6Lp zcZrrYB|&wL8H?t#FXH!T_i7uZf%AG+LO%(UGG?qaiSp7(05GUc?(BgVXpwmJJxKH2 zC?M%PKaX4U-f_C60|IJYR62Wdy3UIPIxdyhp4Xn{{7xBt&eop0{Z9Hh)*g!VALsW_ z1#GAKs?2ZcXU8^P8t@nVZc^be(PpBk#ca()`(+Ndv`}&m^fZ6k^^}da`dqg5 zlqB<0;32@R^XU2X6_1;(mXitb+8SVk)549=GZ}yjFxaoft@RoL_zM9U0spp`=ows{ zxXpCq>U(d#CJf|50hS?DqlZtu9^-tPUmhR8b_ISEb^9YfE<1eecZ3$QNwOd}9midr zU#KK7K006WnmSxkJ>wO1P$Xh1(?oVU?pz(rUVx?T7RC}hb-XletNKR zd6Ft7i<)4SZx4PW*5Q)PvtWYTW+aJy>LmBTqnyg-RiXW@*q@He^G_`1@{iJ-#1a?y>UxS*zNvQ(|xhreXTw0cW%DseKam`8(>b) zov-H~S{=yZt7VhT&*%#0kJA1JQV+PHVcSp@>xjB)@h8F1jusd zOBR)ON-b_*cAgxgywWtK^Smw+p%)WTg}eqhyA;G&uYHgTlnIN$?yP1!PxZ)(N&aR; zb$y6cdh4rEb{*FhVSlbj`GW5bp1m0V9HDpl`JKYqe(ttEw!A^=R6q zHR0UWJHO*LfKglNp)M`uhSoDMG^La`H-KV{o2=v`RmMYuACY5n$HTaH6J0=Q1C)jjR4u#4ugZ^$ zAUb$W9Gf|`)2dA<4T4JRc@12~S|5!;=)dow7;E2G{`{k45zb$LuhE?#g&VOj6AH!bBZTQhDxT61nkVFfuxpiWyFK_sM(Dw?=8VvACe7~~ zRt4ifTC~>%0OBE*)HAtA%$RHUCL`eMlhh6k%hPtNDHL4K1>OlB)IHGWYpxA=Q_Q>M zt$trE8UuBnXTZKF>zhvhld&eWCLD(F*|QYii|tmKFhWia?himCeM*$Vg{fAbrR?OW z%CIz}3ncJ72DQYVg;#{E>+TtbZQ=G~vK%n1z)6XYS!2{a2kayyrWb?K;%Px`hSdPa z5_klZ#;@aE$Ca*hCTeS|a)-iSM!vp$cDhoh{5YTMKq(R>o{UTrtHjg6ry|xgWMv{1 zlBO|~XTW0b9>E-~39p>&nxmw;Jyw)70e`@mW@u@c^fo#5C83_jgpcsU_UO7Y>JMB8 zLpi-A0k_0&X>#?vw?vtW*=*?{3uNZ4$_Qo!gV&!)jy-!kgPMAf-X`M$j?g-Kko<80 z*0BGNf3f5E7KvKkb=V%Q0LVB0bOiu%Y0rQFWFmJcKqxB2M@6VFfoRp4^UYAI+0*p= zUZD9ecb^J7o7Gw8kenz9QKP5J*+`qDyNo>|8m;SQcbvBxMYuxUx-H zvY#FRFwvXCq;q^rqU1F}VF&5_nZ5qU?f*NV+y(Fy=4&*2z7aVfIO1n3C8J=ufktB zHgh44vCKTGhKsjg@%scbnzG?SUgA?pSDW~6nMLX3rfP=ta*~Q|s#3FD(~i+-k`bh> zC*}1SlZ{vi!vvqCS~Y{9T|3I)C~`AkzWfqYvR4)5sh{i5tGE2dm|IuFDW{jQkSFp)U z3XOY!f6u14OA%9RQ2rA)i>6v^HFKAdde$coSlf;Dwf-btgc^TEfQ9xDtyX z!ZTZH;ZrkM{2DBF{e%-o2Sw-Y$Xkj)Hq~A2IHE7l_~vb*`oebaPe!hv+&#L*fBiOQ z;M3bs-~DK@#XsC8lZ4C3gKxPGxxG^`Wg#z&#n~>QNNpkU&CC2}c5W%Acg`hUMfwxs z(HEWLaC9jGiskYCFti-66D|~i%kM1slWn?$vep4vSu47&ag;=oj}Er99Gf53oxeLs zI+-H6ZHKZKoe2v89jO`dXC1_Z>sa#r_lGEuk2pitMH3ys4_!}%EZ-h48PrazB81Gm z4O&4H;U6keMH5HsJU`WwieGr^*3E20*{7KjmhWK$>l(G(s~0r-;$atgb0vS!5{eaN z)i#V5l5G8R zJY#Kqu1h;7oQpUU7@$F)*J#O914D4jHLq(g{#U;6f0SeMdr!ly%q!r?0Lo&8Ay%(L zP-kpH)&+eT9`scP%sSwk_txTj^?i6-vVu#S^-bts{kbp#*c0FwbNLR!C&Z3Ql3xhj zCFB}3OI$tV<+7F6RCyjMwkEn|( zd2l)>zO!yzrMT&?;agwfr{$npf6}bDDM5)5BL+!c! z*q@^Q(+>4tCO&vV`G`{Ule!x^8?thXM5RvQB@Rk>5;uruPborfDT$do3%w@dzj8UL z=19zPB84~Ig~#)SI){<~BH_45{c4o_vC9Mt6uk|kptU+G)VVBKC;UonJ{lsFc63sd ze`-%8pnb!@O?kD0p2t^MDAx9_u5tWh7t@CnoUcc+&I}e*$!Th*$gEYco12;^a_7t` zIG3X7qaHFdJYrL+r>8OEH>6p-58@Vd^vWM1(<(6}D>e-RFh?*4$O_KhGO~z$R1%LK z2o2#VNk)(wv%Hrd3ChK88JSDw8g zlxn(~4f+VSOhe*J-*R=;s1DZnV2&^nhd_hFYKwms98y9XYD%#Hh}TFRZ*{)5+(d|L zn=TmMAm&BC_>rTJsvRLYq#UbQ^8WiJw#Q4$NAp7)I3rsuSyQ~hVEp)p9Mu0bHf& zgu$t&C#ckgwXuSMZC!9GLQEi|oDlD(PvVH67G7_$_?PnE;*tvUx~qb!i^dmD0jfiAVE;2xWrJK>=&wumoC(NAGPvE{XG}jI_?DiH{301)}tA;Eg2{0PYc%q<+;4(E`l%ZlZaHoQ$N@Ih2>>tyiE23;mQle0HS zKU*3pBSVLn4M`rasMJ7tYNfPao&)xN1rCi3_uQf9j&42FD}a>?w{Fp_*Lk!^jCvyG z$E-0mp*y;IsPKi@Y|4^O@DBH1`80Y3FnPL|j3o{7mfr^$A;EK@D24(X`5Y2DgYqxC zKdUOwPW%6&j#bT(&E%8W;2T>Gbyt;;DY}TF7AM!H)82qJp{0R$6A-`{qebF}goz-^Te?JbmJ zUrSXvBDCRRnS3Q-CJ7ud?z2MN$$VcPVoRf~j6xA)L^fvnm5-ql;cvX{bqR2_7oU`V z3&<0x!67;zh-^uLHToOlS3v%wX4YDR zi)iw9$r}rx^QoZECWFiPo?P$Z*TDYZfxpvnK5jhqQ!)?XyrKs+Z=};6(Du3&7eAL9 z;eLb53qgV;g^W|vQ%%BVGQQZ~iz#6$%$~KtBFCPDsKMNETao16{fl>W=|glpZMw~1 zaV{F^;3js};Drr&3j<*3Kaq%Zh8+!qXu6)ZAgjedBsP%s`%{t!g$JF~_9&jO!F&y@ z#t;&3$A?_#6d>zYbG$MiAvR;ziSaXb52&0hA8z0^B-8 zW{}*&|9^_5o&iUs5*4ODK6nP)iD2D#X6P>42{GP{^95qiD@J$Rm&~MSb)xh_NquZJ zP^C&95K@h2@VGdNi&PifiirzNnE{_JZVtqLVv}hF=`vk8+|FB`NQ6jUxPtFuJeTeUQ}GlyRN-psWB5 z$VAzMr7cpRh4t3FLCPsGgm}@JG1n){KIltL;-Oj&?&?b3OJ*l$bio~-mxo(!N47sO zwc~-XZm|$hl92EQB{Fz89*yv&h6>VvYz_pcOEG-Ew4_$A|7*T8#WTrM1hG0Vf z2HPTDS#r)uFW57{BDKlFqyp9fF=y1_T(w=JgNQSQmCF7rC8-b%$Ol=|JVxe zspi4d_UBIFTNdrdS;jBG?%cHy-*gJ4T#a@s-cNl8iU@o<1?rDsUr-1-bh7 zRx+}j!ab^BBp#7TE)`a0^cwv97p=t&@VCH<-AdDzbPbBYfx02Zjm%u0zq2Wh(kW%$ zjX}|cj5c_9Dpy{0imc&bd7D#Gk|HBhdZn;}Ru$=!V|eAF`m$IYx`FA?5I!SF_;3%f%>}pluZ^j`$A`{q zFRA+EXqjdYox3aZjW!w2`R?F*eT8$z^7wi`4{Usx zBkH5X%F@DVQz=%|x<|B491lpAPDEuHn^99gsH5;+_dL^yE_YmzMna+>aw44hm7;gU z60|`hHY4;=;>kF&cqzV0t)5ZfVBnN3tuA{C(9y$Q+sG1F*)7-q9kJa&#JOh#qXgw& zp8kgXe>zP%i<8O>bIUr`HvLD#m%xnyRp=B62bYTRYldHSJ)!^V0$>i4OY|>^GvNP! zQH+ta+sWAVj;!w@&UJ{Vy`AT2oMp~L@!nzG*{RM%`ZH^K8REX(foB+!JnSsJA=(X5 zGy!S}Fs-}D0BkyMm3`MvM6Q-ab)Zm7vtk{0>~;C?e3J1C$nIITJf(kFL4_zk4)=+^ zi+RD#>Y)8)!)O&n97+BZBbmsyXj~0L%aQ$*ST!~9quem-p!0o#Nlp}2Pi$Z=`IMTo zW@!f7R`f18H%-JTtfcUqB?Aj))Zkd2CtIt#p=`cpdZslMVJ-`?({}JQd2~{9O7OR8 zVT^wvaJxhOYA*a$&zjK1St(_b_Mqm8-+W>3z$&bLd-b`8?}h;LVu^ycnRb+G9VA{F z`&5UEQ=ZVW2BsdTzcL2_1y3C`@PTS z7k`~IbI#fMU9s0*Yi$}WRIj&ww_-A8h;I z6CtMuqr+IKdeED;F$@!AWdQ{||hsot`yAaav6 zgTUsmf2JL3XEJDz5mAwWkTW zx3hG<4>+w|F6u^0Nk-4&vv<&E+i|evV!05lFKqD{Zg`{>hMM8L+wPy5HK$2LM@muL5N95`$6>6Pdbl!=N&h$9!_tEh7E9Eg zSjXeFxc5*=^^E4YUfD0dv!+0*B(7N9vb@^ShQRXSa2W6piDyBy8=6r&KEf~4XCI8s`r zzAxKW*amM_76eO_t1N0~`*vwYBRC@zeeGQVC+R$LqQC)ORQaH)|7c+aD_Dx`Q!SZ~ z)w>i8He0y`W}0^E#^h=@h0+Hd9by;`A3jGLgY-c8)GE%Nm*2V}Cp~4B2oiB;d0)k6 zM_w`afNDXS5{qEM0AmuMZ~rtI?tt~6x2J3#hk-a0LT;yH8u~74Q8C{)Vn|c6iSF|w zh;xfVv^8GKBEf`G4CTENFK#x3;nS9dLkIgOYDl2Qazr9fV~QsPWH6|z+i00Ae6xsp zE_7l~QTt&f2D-a0VRPHw)S>S@zYGGskyu9*x?-AWxK7-^VQaYU5Qlg5gy;+3EjRGp zCHgMhOm@6C+ev>jz!)jEGzAVsrd(qy;;gJgon&^txOloixVf$j3W|?@BAoKFO4aaUte$txqP>q9(UNSD$Z3x>gHQdR-r|jXr@E&{kz`olS8GNMS>g&G8?uPIQRiKHL zNOkI|q{*p-z?cxm$nMAst0|(vd}*q}z?{)1X+PHLbN9HdDT+N4Go@p;x-wyMB>i{bv zENiFu^nz!vZlALzU7p``_cXX)4BL>`JDg`;Ctm^6!5qg>2@1Pl3HyPVP$CAH z$AyJ>tZA2)gm&r3$V^K73@B8T*4b;~jp$LFG3mYVXX)j1gC1OS?sm{%tVQ96zw~b( zIm`{U%C$sFkudp)FoY_1f*1?A@DFjnJjm;q5I%0WUG&v+9r(nW=l}Rojcc{jS4)24ArI-;$=HQ z!PQD&Z69I#lyQ)><4(NKp;jAndWZ#N-(1&kILvV9RWT>Ij>szHv`sI3$hL6aB`g3R zcwY;@6+Ujl@o0R~_-eQc2NeHm9msR^5{VVq)kXRjKo@@?fG|lbK_CPmbI$jE&F)notyZk9_O*VoH0)R|u5~h9}gEDJ6J2X=--Kpz=gDk*vaQ>ckM# zBf}+#MEFT1F{l(@STMD_^l=#1)-{5Ag9zUDq0Qa)J%=9ALyuM}pu3M2E&>Pc+K-*~ z=Wkc(g)a|7pf?)OQwb9xrJ)UPeK>Y6W6mSJ5i0dyMTxDQB587aiF% zChF*33%suwQ#mypsRpbfANwdT@nV-8V-ozxl^hV7<-*nQ{g#!!zg^vqvj(#onB?19 zirXPT58fo-mbS1RhkR+ci2rM^`s!+=;bLUMWWm>S z9jaG8%RbEq>VZwhFRWwVKet7A_RiW!B9Y6(%%9AQ2+zJdn8WCWAKG({t7kG&h?y6Wvb&E&YSBbTt7e1 zg(czckkyKtB0ni=O0I!@r^(utINK{aN+Pyt1S)C-!?rqg8!-$U9&GI)0$EtH(@%g< zp+mp#Iq-{%9}^VhBSjt;d=g=+KPI$R?q1gOu^M6@cn=^bhwV~J-$m-etfelt>Oxw; zFcwoRoknh6jlmIwccer`4^D!X+a?w)&Oo*Z227gqY9j63x*|lt(4**pzF}9wV(*y* z@Qlx_=m)*J&{DtlTL7wyh#+Dv+y5i;DsKaKZr?UT>ZAK==1*BY{E%UCjjq-P{5r5Y z6)X820)r8N8IEHC+xWkLXka+C@DVjz?LqTI!=2-_@?^$#a6OUY(D_Z5%-#FpT#*F= z#zOX9r&DhIn|Y;Z71+ly@Fu_5cSKfD{v%-Ld^DYt=wLaJ&Eg78iYwqtFl*^bJTHN; z{jZ+V_j(LCsj=&m@7Y#A+0qsumPIb(8<|tG5k==8&m9aKMqCql%H!yOG@k?8^w|=| ziFbwY(}sdA>V>=Ag#slF`Q&ljG*-&`ie&g^Su9GF@H2%4B7?r;vK9-x^@+Qy3A>*7 z%Q3sG5isd-Mt^sBqH*6N9$MPMoq*eeFU!O-9iP=elZg42U+A-}Oy!A0-aKkCEE@?O zTWWnlq?j0BoEOK+J8&=$o}|R@d_SrMT|{iGP8C$?Xh;huCg{=uv0OJ?_Sxj3e{SA; z1=EG~mQQ`Uj(||U;Y=z#IQP)hQs{)RicIW2A5b~^6@S^siJI1b_1DPm#(r3Jaztpw zV?)h#0*q%sxrVx>;)1!q5Tl#rw06Ef^p!*X*Z8R~BbH-Tf{NY)jsi*{pCOwF|KI({ zt%k|DDci0ASaxiwHVJlBT}M2TYEp1perWS)X2wir=@*W7PsYOKmWl{({2@Qw1qK0a ze{t+1JpnEk)xuJj7g>$v`+yh@a1SuEtZP&b^5B#q_n0!F^&_gXC zXw!p(UE=mE`79pwU!BNJLUTKgU${Bd2WIz51I}m-QNZ9Mq8va}f$4&TH`#Eo?RHFr zcAw(_h@S&IA=1gCsz8V_NT#5Fm7mKB>IMA^DNW#${~vyonHF5iv{wApaI=AoFbXB9 zpa3IQk!1W6RS(J=k@`!uSI`&C_(Bf`uTqxU|IknqWU~Ji5&NOn+t#fS4WqK-cb_+G z!V{9wp75gcX5e5C*So1JCgY|64F>hJ-cP}3J}YGbs*(3dX%~#4Aq~#L=_X1)- z4>5lG7ff8A4Bp9!lJ0Zut;8jNsgS>3Ms#2S1gbETsN(_T6rk!L{7cob@`nu0;FLdOQ)$=K#ZS?8PRgi-RxNVU(^>p6u6fG)I=}Wwl^Ktyua-wH>Qz4Bka2m&RZE7qt=NZE&W?$u1m)1zDkm^URL1}d_jtl|4Jj9 znRgaF#5*p;a2F=cQo@%*KJ8D^mM^+*l?Mq8i5tY1>v#zrNY)?{F(f$xw5FwGj?%Xm zEbkl;%4E9BXdNb?*RNWc6<7_185i+_;V<{=wPX}2pvATy7fj3N>T{oKVs zUwJ>BhnlNZXWS$}f;l#~JL=`5x{|RE#5y2fN6W#I*Xpbp%vV+tI1&&B^~}|`o*fNn zY{fw@bp%j#L>e|PG*me$iHc;yA)z@@DP3|k^=Z^vpUQtFM1BwpRqO~7Lw_9@jUqtI zl`3r}Q_Ai$=^jczO1X??HX4CDr_7AY`4*Z=i>{r`LeDq(G$Wj&r%M4)(N zoklU@I0z^n0^9(+CLZzs*>xM;gRGJU;H<7<)WT_al`tO=Akzqi@6dnW@__%Fs|Y}1 za!sz*0AKm%g5WQe|GyEgbXA~R%89;XweOV43y6=r-H(~wo(!2?Q9dDlVc1x+Z@;a< zb@@_d!>0TBg*eVhybh3TGf3dcgaZsIl6x_MkAoVC85vH8f;z$50|GM}S0j&{?iBSns%-jK%JV*%tvmXAn z_Gw{VOf-lX`l2d}eD4(WY#s4yQ+pa#P6~r3DyzW*vzLr!(uO3i zsMQng&RivmsO{-w5L)byAS?+iGZBJAzY8L$ua9re3SgWiwKA7wwO zSw`YEWnq7$ZG7jC7#SDI&5u{i{Q>#yF9U(-QFRo&FQyTmC3XJ3)Z{p%AHL2n59;)N`mTO}wFCwG9lVdQJKNUw- z$#K2|WrB1R=eZpQ&m!eToWTdwIRMss1*2aE{ja!q=qRb}fj!uAJsFBY%03TZHG@HdNy;hgePgTCl&|U2hg@93Zx1bJjJJ>{Fo;C z8AC*=xHrPy6b6jLZWV_z0Hl6MVF^n##hVc`bJ(P&SZd*kp*H^P&rhAe4-nbw7Si(-w z5*_Ss_0q22FRJZBYZwJmapO=Lzc<9h_RZiIRW}vJV$09-Vdic>V%xy%Tm{1ky{sZA zcn^_&s)1V4W!ya5bKgJCZjA+oP@-F)#`H?toFI}dgb zrnBQZSjE@CT*pZt$OTk|5|T#i?2Jr%He>i`J&TM$>IgB8$Mzh-HYWh05Ket#NQ=l- z^uSj5O%Jh%tR(>*${A$|5eSg@oP|tY2@_5EZz&HW4$nEu9$}*C?O?m+B2kg6`WoU6N%aj;eqRH=)y-?y7z(1?uR;|g@?}}wy5yT` z>leZAuKYa^+yi(8SRQzc>1W#Sam09dEbV_AT9jp7+-nn@vUBD;W1Yw9l1U&-EE){e zjDieGXtm+m?x)K43MbGsBe~r>`lS}9;JIW3Gasb4a`@kS`uQQX%leNPVqtrCn5=p7 zehr0L;2k!7%Xko;{nhF+b{UB^p3sZJjpoAek+=ld=I3ZxdZt2^j5u=MSduZ}MQjrg z@$Et`m2?x~HZsytFu8TWTfEv|NPK{UW*NpsIY1<3&cK_=&DO&6f{l+WJYera5^o*A zvCsD(ElL^LUwc;(lXempQ+pE@clwnV)4Z)hd!pN)NzBzr9*62d`e84VtvNx&#Z0&GEOpnknbFA6EtsUe4FEm-Zjn z@0#UyVj(G^*!%27v}b#-r;{FZ6g%-`(nfjaBX&Ys4;Auz!JTH24bx=r;Mfpkj18P6 zX=W$suW}(j+r4jKKhDH#SWqVAIXed@{YvXlTIbkjQ|C&1nTHsLh}eQ6G%>pqzmTJT zJ0WJD4ZSJ%X6b&x(TTzsi z0&>7-4y-1rL>Aix-Z^9d$z9`P^mx{AGn2Q>T#2;Jo54d zz4|6%IUX5D{O9QL;8o*i5fD%vBGDj)!+2duF_&OYnJvP-4KDvdC2Xv;pOrGHtiyiD zgCtn|SR1SGHjdEA%z85RvZ?ZoxQ+}<^vpA|9>-EvdQQOt(yWgN2DoPLn6a%TjTwm+ zH~YY&1ppl^6ArsRYMxglHtR1q{M)sz*?|>g_4HnXNyph|*L2rrXr%7Go7KQvP>{8Y1-hm@7uxZ2Lp;mqG?`n@gMn>nb>#DZ|t*~4t= zjWVy4BtaO{frZL5Y2U>Ps!)uVhAe(Wx!7;)JMx~B(nO=@ysFxI${a`z`%88P*dxpa z8<};1Y%3yj7T!$Ilb!SJb`M-j(g)Gb1&~z{#02q|%B$q8Z>RM-_ZIhrAigb*3h)WQ z-fxdL-D8c*vQtc0UE$1qPsS{R6UWP)( zpcE&?Tw>m7OyoqvOT{RME{ELDKLLi>nl;KKyTvz2Ls(XxTuzM3qEIWZPMsK4_H5&W zqkIx8t+PpY-K}@twkOj_4QM-NHr3c!1ukqaUO#ZC$zNr48c3GU%oq9j{PH375pO8O zX|AH!tLfZ+@Fg~e#%J;=SwNX8X6QKFTvd(;68)5~ z#vg4(FA&UB?CKuq`$YdH9O66wd9OsQ(~m9OXZAaTc=yxJ6(6TBnQvbWqe#KdwW@9s z3JorQwFykeydA;yp&|$>#r;&`d{jEjJnWW9zDkHm5lTvno|BtJgG0_TDn6y^Trjm3 zKL&L&u|r6Q@G&!_w8XcZ&<6{VldC?(b0xbq!--LsW#pL!9r^0MJ=uUOagqnO8e=&@b2{+7vkk@6TKFCYx5Od%%tLPpJaEaBD+ueYA& z@+p7mjoF6zXz4fvM`QX2}>sTXi9t6g`wwgO5oRA?%ZJX-W-ix}vXi z$J^E*9cKLkr-~^qmS9Pl<o#XF(3y>B;+>C;tRiNsa&i{xrDRG;Zg!_Pi?Afh6=gYW96H<^em z>;WEzjAc|&mvQ0!(Jsms#=$y`&EIZ`&3_cDpCS>lqXCn^MSJj@5Hn{Z?SAELcA5I5 z+45a9N6$%w(uS~px%}ydCrMv?$)^?dePE7kh$f41AYWD~3B7X-HvgMxNz17GdQlj3 zmS&5R0Dkj&o4e?6ay7kJmnJ=Iqrfc3?!(et8ENvzC?Pc$?ae#^8NjN4zhEe4aH-}e zR@sOSJf4+nG27U1I~6M3QTHBBJ@(afc>@6d?8d8@naE1Alfb!4!{J153NIyFHdb0v ztWJ`gH8tY%bQsGg|1hKiqkO6^_EG z*nY51#~UxZGQ0^2Knbq~{Tg2deKc>`KAx;7u{MsWSlX*terKMdY#Lp~^&nEJfba8} z$=E7;RBKcdTGcnsRKn4E=6+hnXnF$Kh=cOn$N6FIckjO0#vNs#rd_jyRCFQmI^r1) zE7ULqPI*GUL4LHJN&t9Zh4F=cOrNaCwj2)1s8g(Xtn~0#p*oFn`Wos-yhZYy237QD z@lQ=r7_fS*G(Me$nc2VSP5AI$72MA3=T4vuD=!w{)A5=`LHBvBwR@mmW>p3miSq5o zmy8#4kMTX^;qB0@d;4lY&PXF-!+_Xft?if7j`iwn-M3_F@0&BZPM3|{Kks`%Rn3fJKMJWQswqz=U zw@VC10Df~!Iw-9Jy;poei?KuC&L=Qob5vt$dbp<0K%1xr#WqbFd%Im5F(;udbAEd z0&b?h>C-qF9Zn%z_JVb`P@5G57w5OstGbN+c$RLmvTvZiQn#w0E4uqOB ze>iMKw*wKGx7dx3W|#eNw^S?#yx-(|{SrEt>*b{N8le!`-@U7aOp>T2ivf>Kqah+kXD>}BKDukc-ug`DMT)fJf7%~!C~X21w#nK!{Q>VulmGX&B-e(C6@ z0z$a5#b-AI%1HwRE~ihCKjBp=Be}J)70UkTvSkRvW_O2ugP-&Tv5Ewkdg)Z$7%x3M zV-O7p=XhFtwWTz@5K+wF6+3hct-)xFdkl@{>B8-#mwLUBnF*5l#iyLR$hJ4EEaDyb z`tSDoy(ws8Ps3VK?*0j0gv|0Pv#YMpB=@xy#S77q_<-8)#2=} zfl22tXe?^euU-vR<_=M6w;xw6u_oq#sb5tOXyhZ9DzaQm-XQEI#rA%wfk74m-D;(fq7$zUD<m)48bq;2Og2J)y#|UjI`AsOF*7$4}p~&%ON4ITJ$< zXR!XIL9t3DQM{(+G!by-wRs!!esTMKua5xY zZ8~f^2z@2`oP76m&4RL!s9cvl28X!gF`oh zJ6v$L`MRXo2c~86)PS&+^R*?jCh4;((D_;d->yyVI2#)BEPrVm9rVT&Z{FjkSphd- zZQxAy_-?M&dBzK1@A1#S6l8HTn!JF7=@a6^#Kk?b=8;vr?!H|tj)0@>1ey&&h2Np~H;OQ|A!j2z7M)n96 z5#<7zmeVI|k8jaJjPQ3MS1z3G?!P3sPpO5M5nlvaG#PEvxy>uIF=@-JO-cTt`f2c> zfnP-4*9~Xs6a?~_t#_aJI$h%1HIL8?2_9ILu-T?_eKkr}(g7!+&(oMl$cu7Y_xwtD zExj2O-xun`Mh^B1_!$hyNMJFVw51EfRE;YzC!U&28ERSRceAo1NyDdXri@|9NvvX& zy6E90s)eBOIEoxCKz8URSs74>7I&E*+dLC^i6Cs24#~!6Cf1PqTx#3Kq}9R*vSJve z0DOW}Y93d{W_R2cxdP}ezUZhqYJBJ zMMcy0-wxr)2-krLG*TC4$#TJ8H3;Dau{Qj|82~$s1$n*=r{mY%;UC6r^QDuKbwCK_ zUfE15C0#^Z7yC_>X^^6gvr2w@)J&}yr@6*JYH7sW^zaub;fjtYsp)3HbRJ48x=+47 zR>xLAwY1X?_oj*S>AFlzTWT^g6or3?7cb}GA#fe@ zljWY;2u@$i!ohJ+$e2;+=cyP!$H(g7Xv*DjhmpXZarAL{6;19=Qjp0FBPBy5xeMVa z_*JRap<8Y)HpxOTo3tho0MM;ZIgr4%j3utJ1R_@ z7G8somW&t1mU!CzcaYk4OdHy7+#Irkn9)do_1DqdkaWbcS3nkFR&79{BMG|Q939`M zSe@OdZDvmUJLuDT0!`FBbh0y3!cWE3y_5^HiTqZQ|1Dj&`oIUMwL1?}1n7HUqn>2+ z*4W-5&@fgU)j5>DS#ap1)I%08pjnLO@5YVEq5_e$(eAuHd;gw6z)U@0#R?++4MD)+ z3IP7!8i6fBBLI1#e?L;G0WA*wTdMzWj2BpX{hLO9Yl*ZxnRjM^2S8%pUtQz8T zS;>1m#X+XAHRO^`eRS0tq};*e6(-YHFW$YK#%un)&U|jX$vRcIHZw$HAL4DU154Mc zI($$)xv%%dCEs!2b!V<5#r95fWED^clC@;!CgMe`j!S(s?HzT4kAy4lV)@;>)~nE< z=@Ti{JvphbTV48FdyyI}mM#Tf-i`V7Oq5fl@G-`&X_<5j_YdUjyg29{YNLTbqhr1E z2fPC?Vyn9=cDM$~elvS~UD!!Em%#~#UgnWxA!DVr^c$DyiY=1)i%pIxx*ny1i~O9I zmJ%W0y!ZBAj1x;ws@QI{Oi1SKn7LON3||V`R?d|6K4w}Gpu;RSf76x8|C_bM?jU9( zwNHF%wRP5x1{*SU>FVRJje=j|MRoEBx&mjcwEPs67yQ;$QjQ?*{n;Fwi%?nIU9hK@ zgRk?2$o-nwHils(+zgB6J~ZIPd1)`H41*LUdb*eGOl^71?|F!N{hYS&0JX7<+S>ZJ zvHjlUw}^=1`A^GWYgR_4)r*;oh_U99@}hCU>8R3$6=${Xuzp>n!|qyTjqH(>^ofm- z)yxD3q1mnK3Vww>PowXVj?q0_8)$QZ6BC}Qze^8rLbyUXoFl`qEyRk6+nEl3I6b!R zJQb@%MzWT%vQSJUUSIbvgoe|MBwXB!BWg1!Qy@qeEI?c%G%#_NnGiYHD{ZHaj)L>i zX$nS%Hbu5WZX5PW%$Hi@I^Rto`y$s+5)VSrBg^?UTE?|1v03TWE7A88#weE{^9pSf z8MCvlo}p-PL|z5O?=CLu!h!(*hwix?>F13Z1GsoE-NX3n!r$u~+e{ObZK&&)GRz5* zT74QRpy_2}3YWW*p!U8SdM_O=ZDv09zP{&;+BojhqEHO0Pdv<32L%Fvs53Bmr|U1k zAArVC`9Y8S8?6F5cW60T?%y?rSAn*csjM0_!anqf?Owg_EeiN3tgKA7m6M=|8iRpE zOB9NErAk0{BOiYZCBZSo=XoW#`W7wG;lCK!_wJO7iM9L`^>0 zTmY!;V3370pB4vwJ2O$U?iTc0cR97_K6w*^NhTKW!`Bgv^n00PITGonU7+IX!@lHY z{QJd!FWQXV<4UgIm8yu!1nya)2@2cLCKWJ6>4xN6N(+C@-%!4c+eYRSWEG_TjZrNV z6&|c2Y$O{K?Js7Y03o8p?Hp4p$N@4)m(fTx3gvGd>Rl|0`FvVYLWImlG^&ydBR}ym zw^^0Ug93RKqDYykEe<{L-IL2nD`&;$X>k@h_O^DnnTj6x+@(?Zx_I+gw%RrUL6v#8 zCR$7qxoxr^GUlpPexbIlnFg!cl@C;$C*&wk4J%pZ&*MhQ{cQ)Tf{pGv^KXf&k{mOx zz9*IVq8-XXSG;!)Ce7?}Pf0RY9cRH3*j`HuO=9ccr^Ltn$og_?$b`J3OZ7CV0cDsc z4sVvRacvK3xFl1+N*R|+$Qkt`_a*mBxMmLhZ}<#vB342;>u09aJ-U~@e_>-v%M^2h znALZRM3q<2ZfP+s9X?q_r?1#7mUMXfD@syn%9~pn4`zRJWDHuxdpqT`)za3F-`BEa z>Vmk7a$O?VLAzNHH2pop=Qu(-TqEXzfF1YJ0ugjSm z>;4yd3op5PH2SWQ(mHR={^S|Qkmc|fCb&mqmgWMlF009WoFls0JZc??u(Db*toZ^$ z6HSaV6^%b2YZF|3emOL{)H>tp=#L?Dp>STErrE_rI{GqQWJI(LBM5^^iZMx@()uT{ z-S;oYMUmXUhZ`?mnN3<|U}-+BPNF8P!H|xuYn6~GF$B*g)c}D^vfrfqC#+^^?_sVy zH-tnI8Qg69qq|Kcm1c{bB5$%# z7Zc55*ovv@v)V>#f@FA$md3pv3~G?b?#vTj@kcRdI>#r_H<-5&$1O>r%OKX9B1FSy zRU^_^DRXQ?D1L~AXE)HWl!EO{+>@_Y7_3^W=vhp>I&spq&H0DIj8xk11X-TZ?|91( zdA%N|4E`-QjSW~ACDqqkeAKaa9U*^_*}tinmYbI4L3|;er{^C=Fd6AOmn|Rh*oyXd zsX3LPxvaqcDO%&XU#F(Lx;Vl~2ygyiiIG*rM#op=uFT37LEvJ9#jHr}k3nY{(ah?& zP_`ZQhX2_)gWlyzvIZ?hQ>$(f+3y$rk81J%>(}0@bnm;zt}on>KPICfJ5cZ^agWTt z;5E4Z!J)#Q*}$o;@(^u*;1`KIGoQd?IjEWdDFr^x?{JWZ-OOx?efkRHBKdrBoIrG7 z^@LtF2I6m?SkGW=i}z3$md!29fWPzLSq&_U)46&Re{eZdY})hS6E|6K``nP)rrvta z*8*Cph(y-2hj)IzVX5qZz$eu{M4m*(^O>|EJ-lU#x@Gp#ELH@4IsREXuDgqgwOEf( z?e;@)OMK;2p(6Zti{ZmKs+ewie|J_Lm@PhLl-va369hSTKN%SM&6&@P4MJ@{k#dQJ3zU(xO3pT=s-s07 zLQ)0&BNXA`12(N2fl|bHYvQj)oL;<6;x|c^d79o#8?&R+ggmsgYo_C3_)(p`Z3C}D z{Dn1P>J+{8TQ5;iZnXQ$PWKgLNsIfcJ7Wy#dx~T z85!jtfA`jMEOM#{IS=%E?*8Q`@Nd;6JnqO$L!o(vn^uC)6Vsv2XMHnmL~`wM>QW?? z?mppq_Xm_;nQ>>MCRr*}g1y~Mggy~}yBbK>Iaqaa(~!x#4N0@f`LknkT=He=)Q!}* zBTKDeMCeWptEP=y7{3V)jy8`u$2oB&&hrzkFKL55Z8jg5YkQ0Tv1*o+eAROHaZ_4X z^0O>vHBU|&Ua(l0CW}=cw$HJ$R&gR7H0c6%6p&2t^(Q03n301<;BLJr^TZj;Hd*mw z>=Ad0SOSaYZ%RzRX_cWG=0M*ymoi*HAs$o(!Z05gAIfADQd6Ucm;7iK?~&Ik|M^Ix z%49CmL}_wvDJ1JSQTSH5NHg|=_nqf)+Vo-wZfUJL4M8qhUzrE&y=Byc3XYg=vXSU` zmy;M29=LkrTvB%Kn77L@_a7t3Xe5`g)Om`KygeE?gD5LGC!1Z-4k6QKaonMVZRU$+ z=}sgII+2vPu2QK-vjyJ(6DI z{*kskPNrlc=kya@2k(mjiFL<{YDR!uDx<9L$R863;bf#?b3Wy>H^L`oj6u=ln?F^1 z{y1&~noA2k&wBlRm)A^a$1>y8OnS2ee4?9c{GU>fmS^o7Thw9fciF|Y%>1M&3?JT+ zHojTvJYyd`xi}?qX?{=VW*ojh9j%6#X?653BO(V|C_M=8qw9N`yopG+2JZgD@Wvw# z&BvP~s#e}BAXtipQ|$gWJ~}!Q8OH_eiIdf(6&w+N^$y%f@Lt|F(bd!L@9Obw`d8s- zD~d?9QEyZZS3?i!;9$e6yKg!h?FU;gxs~KW^TZ%3FN*GKrg8qRB_#7 zq7j*Mwk30#iG`MP=Be8TYun$+)1*eeD@(5_8B0e}`%Sndx^n)Wf^5Hm^1(hPGdW;z6ZQ@I%;5k(obv=9sw2#z?mRv6VVUYeqBW5A^&YBnFn(r z5EUH)It4(evCUvuA7G2)zy%>}lk^oqKp;%Q|J$I5duOZr)QQZ;$!m-{`cI-W4bqGa ztM1)fT}4}tx=OMuLHE&5$|;8C!)^EOk-)0V2Uw^6>zZh;3xcW{aD^|{^_)BNlj=vz zbpiI7J>9GzzM1;*0y8ZPU7f}?71to+`(s1s07u60#2lT*oWWDJWWG$+lxt$ztPcne zzc>UZ>4M1Ad%~K)uw6sIm-JZZ!#-yXtmyHkv=b5Knc&X*_VBsQQDf2r^#{6sI_U^g zc@P6Ho_=nXDZPhKr{FrI*ZyBCn|bbCbD!-qrX0IT$`)f(I`LwglN@uh%zS%Hk4m+o zxH$qokeEhBwBAX%F3w`Oo>c6yM*5xvBUF34Id z8d2c&`4-}57P8%hhcX4a(NB~ldj>t~L;&m9c7GYG0eO}k!tGlv3_#3DNYp5va_YKK z0Q)~qi- zLI+REqm%ELplddow%FMP0h(N(K*N)Z!t7=X$Z2InZ!5g?h3dHBfuiy2ZXG ztMQ8Zi%qEeSryJr;yy3jec{|aedu(k;d*&<0q)gs{jQ@z745LF zKi3ngJ-2)=Y|(XJHOumpx~w^a;z#|1Bu~rZgw`1Wrv`dF-;M-MXn|;)GxjPjuF)_o@7Nl1QHZJ6+7Ivc!Q7=E36lLI{%qPX7oSZ#n?0xi4r zf*vOy=t+)~8*sULrU1R5Z#YZJgI_Pe_2*x>ZK*U|K!k0&a#eL|7lIA3 zXRCk0nH6}R2xN36<;Y|E5=*i&Xd=ooJ+_NtD~99`|;&Pi|)viw|$;&r=ni_p^L7kfDV3H^d;2 zIx;UkWX#N8`zhb;Koz1Q-Hp)V64NEs?F`cDTV z%X0jBsPu!u`sKIJ;J7`jK&Qts#CtSUBEwLF-rYVSO%(&9 zSyd)rsceR{g*)NqCQ4MKVFJxX<>mdWxsMM?MKCp6Wy^jbc^sebK^H3;K3qp6S6^>8 z9F4GfSi_t2-406O>-%-r?$2#J9H8*&pE&Sgw!2}rn;SN_&6mRGKoptnzLUpB1&bEJ z{xbS=T}9cMSw(cz7itMM;r?CdEvsu!(zI2kmCfG?NT`Qj!{YI0!Y|mtVkMFGO3#*Q zhMXfacQEmgg9E6d%{&saNnMCPx|0)RYMVUC8P{V>!1OS&!T9AJEHLdJ1^y26P{O&ICR9x_{|g;j!YgJyAGx z0(EdOng*Sq{(#JKVt_!6Y2R%17yAltx0bvXuKn{GF48s5=1&!b5BARQcJ|%Q?w;2l zVg;h4n6AEkwN?W7io$$249V^(6UKtFeSbBmH2CW`CQ&|sX%K9wc^hGBK$))Rwx?`UkZbSuziNQi^;rtvQI|*#Pm;b#uK*6syIRVHo+CDLiv`G39Me zvS=fd?uh#)+ou@9GTFFn56bgiFQ-p=w7U(vPI;t>>hQf5`=VcJP-|(z20D{mdlvFt z5A}k9&PR$m$;58*gyGwOL|ZH?+6*2i&FCca!Z*rHzu_;#;%S{T#Tn9$4UtY5%0}t| zX0>aTFXSi(0??O6+~-};Hf+y;Y!Grk zEFZ`YB=lWx2e2Dt;n);6tPJjVV;c3R-=RnG4VUo?SM3u*2hXl4oX@6FlWq^5C)Ho1 z3s+yyQ@FH;bB7I(2pFP$A4s-Iew53AG=#Xcp4Wx`dXG9yyI?@uq&l^%`x5ZqwV<~^ zi_A}I-N1`5Wk`IATw0`@A7n;r6w^z{Ic(H5c**qB5!RELBo#SkXP#X*ykw?5vg8nj z2Mf+}A+y~-V%U1p3*=;$<)fWwPanF7+wFxsQpsXb5N^|Kq~z4L$nO2D&iwYd zEgwnfXqia=c2h$Cc9=S9P}c2W`cP#i{*`F_tAU0a^>9Jg+f!dchYRl!W8UX~M%oED zkV=rx6_Cpv&;z!+o32Ot*T7lfmyL4R&vG5MS5iI^<@3i`ul3Omz_aqnHWBky75WM3pahG#Vp!Pe z^Lz~v&ttYAJ7|9c95wD&QDfthd^=hQp7Zr|`tP9HWs zw+o*EVPiSGJ>8ga8Nv}50DIC21jqXGPYvh5iQXH|0(X1+cYCF#19yoH$4+-c!oZPk zixf9608Rt@SgniW7rCzP+l?VzRT6u~yIOTPI%`MU5G~i*qw@jnDkJT&c%`A1nmQXT#%q{QRr;g6i}@QO-c>;ZW^B zPv!*K5VpeiWR%wx1^c^mmud3lY#s>;zrcLS->01S+XI0!dB?ZU&6^H}2Hf=UiX3cg z7T}n$iHG;#gICW!>69yuR`}M;vqm(5fFBLW7d>Y~czd3H3!g#pJ@?go(YFnwQr2oy z1u$%&67~i;`6`?RKMUzE(!75TKn4|HUgs2Dg-DTFgb2t0l<&E6kuAVgu*VVV?nk-^ z00;A9fW-jZh7IT|*&mMn+3}ujv+LYH2Z6po{-<2Mkrdbp1A!oo30CO&NaKO18uB6H z8#dGP@j&#Ai$N2C?Qtzrw{l9q#XdeD85EmmjZL3Q32(!I4BCgyK9Ge&vW3I)in`!( zd^-O&&w8^sXJf|{Z)c^<;I7Z@=DN?zI$XUh2Da(LL~|sCvvg_h<%M}DO1k(E=-HBWi zsRBwqg75yM5soF9vG^6?c3fM6xrX zIlr=!Dd=UNW^TG{q!{-Z))gRSOm5{T1|`SXAJU{bW7VuMA-{R|%qu{}ZVCU_<9OJ@j->JgGOI4>6qB5~yBHP= zjD4L=pCP;3$WH!s?81Z^??DNaMv_7R>&U>qFAvs#s_(o6?yEs-i!MZ+ z9PPBvnsteeeQ~3frpHRimAH%C-BrislQ{ahswsd&p6UAM0io8{v^ zcP(Br6^AN0U)@|b1FCHutet2VcKLU2r%0qZ_xVJIHo*0_GYz-aHlH3@KfiTBNb2Np zFQoX#^j&G8f{Kv;Zp+6n;Q-8eQ10=VLS`S6mL*>$Pj;Vt3o(m z7rncUBD#GQ&WQeVe^ZtE2l@EaBzh>LV@-7bQ9sAXIm((gEVOS;783~GgwD&IYKSd| zHf9Dh9LzPa{H2opL3r&p$hfEeIokNce~iX0aIcB@kM;nA`v~ct6AXT>>giX+%SUQ# zhyAN76*a z#Q(cXyln(9F)3jF63`YNS*0y~^176@`ph2oTz->-%Dhzu^>Kf=%P}K0x{yF6!9V&D zYe^=uadlPKL|5%*6Pjf*h4Zkg(Y`|dfGQ4+RIQKMg|MqArF`uvoihR}qT!Q%DPk3aHa7Lhu8ChY`3%;fn<<%#hdD`iq6xxJ}eQPVp; zc#v>*Jsv*{+Ekec%d9QlU88QXr^qXPOcBAp?B?rI@n+hngAO7|8WnVm*S9WoUdq}r zwBP~VwExxFcZW5xb?XNZ5Ku%2O+^Jm353v*CMDE_-a`+)igYO!1cEdvp@rUi3st&+ z^eVlG9zlvUMFd3@&z;~o-~I0QyT9+b_x{6^XPBA2XV2Pez3W}?p8cn<-r&eoWWcad z{=Fc!^QxLAPlsyfcs%EptMhDqMML-l0h(?16p_Lgm3| zO~=Z@a%5lZ;zbTe?sH~Gu1a_RxG_kUgtj_+f+C1@UTliFjP2g9N_Ns=y z*Vkme);HjIwC;(G7M^}S)-$<2v=2FzM_Gp<7y>e*J-T7$3R5+nM-*fMg4!3m4odw8 zhnKAu4FS{3PO9ya(jRIX|N3n)_N5o1LUxK zbhD=yu7tB-fg?$CB<<%)B@&Es$ZE*CdWcOD=%{ys^B+?oWZzu6&Xsi{UBeKPgaMDm z>%4@wq+)wDDuT!`rTY=(7_z=gtXDNXby_ZSThrP^kbtgDTV5LE+QW&S6X`46Dl*g` zvLXSM_f9$#o<69g(lubSPon~XJ{%R(H_FQ2}1_g7?$l>epjKsKehxkezK!DXWg>B7|P}-ix?mLOf3QlTV z+xr*;d<7IzDegQ$6BN9w<$5<9q9Vq*r+@LtPpO;84)9XgXW?sRZxsb*yRw->+rr(a3NlKpWRdNqJYGWj{nMak#Bf+;$uGJMbqA%MUEZZ1X-5R6QylQ#nWI` zmYQG89DdFusKu6_CB`5>0+aU3AwdD&oomgT>CJ1V)C-Mk#Tu*zPb00zd5Sa;+};6e zPr)-Tm!FJk>D;a9KnLqoR&MZ-(4u%2T}rEG^{pruehTn`Xf#bPYM4^WbOt*3ti#n2mpkC-Ov#I_{D|mo6KB>dXUw1by7vLpmCHr7>j7vB$8` zb&Vlfa@&?AT(gIsZO9XxLytP*1mV|Ydojte*DmVFoIa(&DUSo1`XK++FfMtpwA}EA z*?=&l5g%zBJ?VQYuQ6a(WO^fN2Sh`@VM)0U*2}ODNH_5D^PJWYE9bTLMmfxA`wLwg z<6_|5SE=szFiFKo8=Gi2^c5GC9OqixLClp7d}6lT09h99qln0XR9nqT?@ z>De?)d1~C}{K#{sOO<5Pm1KiA$VXjkpI(Vuml+Sz`0Dzk(An;~;1^H0d94m|&ssC5 z+^(vxt{3Yu0I}rf<^x?8tA{i&X!Nlyu~BBl-!Q(**+Oo^5l(&tkxj)f-%yV~UVv2| zSK1ixw-pwt8rC!v*4MYaPEi-sA?QqSQS0p`@LbWh*1ymnaN8m2{7JFqOj3Cf%B0z& z>Jg+|T+e(-Yj*vM>766rt_wad1iBKLwYi+>8T>7&rZw*H_WGmhL_Ld4=J=#Wcn?(c zByO`gbkw;k5=i^hz<>IJFO5yqL3fYz7LbYrLFBwr;m(R$syTnthhSg(bYJ3Ab3z})KYI8Bw z_i6|twV+ykAqHt~C;1JgI<=urfuzfgh)i=ipkdB$&SmhbSR`}pc>v7XE_vNQ_oqbh zj-K!ChwOkhHqX#8hJrx5Kzh9P<_$Fo84-YXT>$)YR|*kD68{Ins1p&rAb{I|DN1zN zcp^SupeMSX(Jq^LlKC2|$E00c@(*VN_xg#xSx;$97)0UAKP$HLB}7lNBOGKG60v zxs-5w@5$k#UEff?vbSYuKdRJb+Fay!U@=5f{j~=vB6crA=tGtFe}0)T8`Ql_>&o^{ zMzkf9KppY+De2^;fYceV(Srk&eBPVkkb=@JEIWySIqp>$l&yPAtZVca zt`zr3meeULWge88sd3UuWPvwg^oAim!l|l{)U^1+D^OahG)DFGrD&SI)m*O9G_P|N zwI{pUgM7vI-b0rBYcA4M`W84?VdK*qyRKhe+Vvee7dcKEE=vtl1Fc$k|K%ec3E?1o}?T=$R6lpH6_1@XAlm zU9)HT`hv!F*$2m?A``?lv#shROPqNhc@@nl@qhM~_=;fVi_sID*2rikUYyquH+2=v zBr?XvG+gAKlqfqCl3t1R2!$#Rt9A^DI;9HG%v=;l$JT}Ks_{yfm)8qzuE=VQdE_^} z*TX64OJB82dsbVvKcBGZCbk-t^qQS>aVUvQ3#~OPqHamaA~QQx>H7GZFH)R!fWW|n zQ+lwJo4S*zQXr^KD}LSL;*2q9cz=#$+ot_e)LZT^nhh^Yf7G%q^_BQyKP2xkZ7(V* z$mPuOv&P`?xq5_FM3+6P8&QTDz`q;Bt5tDkITdybyNa0HE!oYq$a!{&64>-Ok=jZ*1*a{M42(4EDu8FsiC%;a|9L6f1YkvvkSRfW6YWn-v ziS0#!YNqJk+t$+-ZyGUVHR}2a7MvSFj1Cg5XN9PJwiC-hl$HHXS|2glP`6F@4L&X) z`*EtfuK`QCfs7ncf1!o?F~pp%SaFOhUMaC;ylon}|4S&GQ-{}16D`2so&Nc@m5LuI zoYlGh9gUTAVULjComPxFw&CJ_+@3}CTaZZYg~{V_t)L1`aYOym9%?4#aQ#v*Jnh_P zdo^onR!(WKS`oVvw>Iu;c}sJWgPCpFbLv`AlGKzC_%myq>FEp~Obzuy(t_s91KU_>`6AO?mgqTo}~P$R*CG%#e;@xJwK zPUOidRU+Zd9y#~cfm)>b0r(G|hP5<7hmS84q7ZFZ-a<~#OhMz-L*GbN?d{~{9mH6u zi}dXcC%EEdEMs@yT(s$J`{s7)&u%>GEVJ#Mm%O7~vU-mVs$1Epd&!)&S6_mi?pfV1 z%7k2rt4qpK2+7qI>ZKoxV=&~HCp+_p#paZi1#-hsCa+tlw^w}{+^5Je?0>n^E++Pp zSVhy%!Hh)zXx1YN*bGQ8rIxnY+ZuoXSS+x~b7sp4zL)X4o6?th*31$XpPL7^bj5Ls z)(u{6s{1Vl`AkYyn(qmrr6#_V^ZWyWr!!mmA|f=Unb~-EAQ_%jdCZ*cdRsHK_vd$b zzW9>b_sgyx>yPhN*Bwq{S66%_tBcrzgbHF?1e)SU(3H((>CX43(pcTI}Yi8UUk9F7f?A%*gt%jw^p~8I1 zqSwcN<-@w2Ndt^D2FLCD3-!Wya>N|bL;aj;_8x(<0oB%vbKX8K357R8?MJ{))rpZ< zs$&Fa)KEvf$R$J#-XzYm(n7#RujVRrV;v#u3kAahM@DR-d_e{GbKeh@dW(L2U~)P$ zDqX-*9IT!ernPY}IPoyrS(1l6*6<MsE=Hs8GkYWT-xPL`zY9CO zzEmrfYZL{3^xA`yJZPBN*QxX^FI?-}H3VI{j4>=ZA0_k}49CWJSu*TJ@M3-2cmb

{;qrLJES)1#-JMKQhimhTzftPI=5Eh1FXVXUnlVxxC1M^&mtv+f9zuh~KaS{`LO&_QeaA2h)$sR~f?TIrhw*EtmwuQOq0L~Hi4zj@-O$TqvvvNHXPcC zOz51anrfqL2bOW`iMDUTmCP2UGoFD_<1R^-MYSjx_uKn^S8($^{N!Iw+7q9L^hh0X zv@E-pmFvo;vcOZzQxeq8CK5QX$}b{3h*3d2@_|jxxhkp@+0Vv!2R4HFVE5QgZ+iv# z1LBC9mSCS3ps`Zs@v_ zrGxH1Wsh<4`)6;dhlKxF;V%d8uW$7a)QiI{v7IDM=r<3}z` z7k0L)*2A6spLoM_SM06=Lg$2%S#lnN6LTzpha7 zZjCe7cayKzr0!(VHJH3_Ut!7xX>vUkO%`z?kNg468M%Y4m(S=nBrN!L`GQPqV@XeP ze@F#)#7S^I(n-4}`ZTokU5jbYFl20PH*EC1*tV*(nO7|8N0Oyq` zSH?%Q;~gOVExTMyIL2#Wi^2Y_fqkWsGzVPDe%X0cZrgas&#Fy&LosuHfA^N`c3iPS zx56aW?E#!!X40!Tt&q0F9HxR|5L5peT?;@&o0XklZjdNYet7{Tp>)jPny-5P8jd_0 znM-d>I4d<~3gyK#gCFKecBLD6)bkHX4&%7hg{0`$cgnN7cajO!d&-e z4pE124>|HeDqFp@fH^v-sei3FFfI3w(E`rYZ!oCL$(?#|oEXb7p>+74CsoY4RqyTA z2SjT~wty$K+PY@}0FGuwQyz{O09KWP&H3JhzbLB#5Gli5Qn^+@Sat>I_MLIzd6FPU zRc`p(#w=$Zu3e|QO&Sl&)1s?J^^XTL?a}%`W$6s3h!B>1gVo^K$$zL7O5mKXLM^kd-8Kcq$@ z!6MuEA5+wl+?|;jdK=<%_t@y{W!PLIloSNU5_Bi}uE2CTjcSyl;x9w76WK+KPh9*n zgbal;>pYZE?2$DYQ5sE&B|@k9Rbo$z|2(0V?*;}MaInocgr8d7rp$MJ-~4V3XL;f* zI@F_0IGv_skDRjOCl@(&n)XPCjuyl4S!StN2LWc6!9^IoZJ)oyLLkp9GK?eCsLHE- z5p@$6V;onj6N8zhKhEW#npJV&w=;FdB9hRh4s4Mp`NiD`6`?K#Do!)3luvCUFFWp# z^qESCDQ9K~J@1v65W3nx6Ld0_QCzK(lo&(UaBuKY6XkMw~F$0?hMeyCRpNMeb8HntOwqdAGT1> z4og=Y=3Zf-m=0iK#g^*LA^A5 zvGPL@2J9;}V4h@kpXJe;G*o-~u5yzNJh(=F75L(PG?_fDvNC@ZLJ2pS!Rm`^nDP#2qOPls11)3?LG?NwvHekLr1% z;Jxr}2V?K%wl44h7%`eTUHKaqoPiAX!?WMOn+%v)f2F&GO5d)jk58JcHU}&KQ5f)O z0LulPC)t|U5ie`YQN=o2ZY=H6RJEVi>2b%$C?3FXV3PkxKyo$eCGAQ?)uvs3O9ku; z*a>NbRfMFIg3K=d#;TQM2Q9d=vFy6{B@--gDrf+(9y-uE-Gh9%&W&3qrt0bn&mE>9 zkc_d`(;@H(rs5ii;xCk2NoH3)QX-WOeR&~`OI?m(z$5Y1RI{@vEAH6lpy3vHPbsR_ z_ZIyaGaJl16gKNSmz@DT=R{*JfPCO`DBy_W9u zJ_2@K^n0S0lg8VfMFX!_L776n^hh&HEu^XC{rqBhp4q$gN?N#kBjsFday8l7&*d%- z;4^$S(4F9e-kzxn8MfgVE`|a+g8-Bfi8I!urktxd)B((zsRl-8>V;pkG05c-{3(;& zV;{N|VI%qAdvZz)Of!ag7K6f05_YA{gg7?Pa7k{e^-71dnEE=Aw^eQ?v6vQM>rjBz zG%#wXRbz;H%7ud=@n+jDXVb1AhsuOBq`VI0cEZ_f$ac;!iN@Mv0d zU+jhjs9C@Riid+plC^|o^V~3oXJo~bB48j>UM1SCe4eEN`-xC$!rjKP=&Exds2#84XZ(d4Ke+Y#FbnA+u45HK6 zI{f*L0Kj`VmOP)oIzN&EIhtS;71|>fxHzYP3kPE{84s3Me)vn1`y&UjrbYpU!%G2VuzAU_?fs$;+^TmACoO9rj-|3E*V_c zFS`m|>+?fkqsMODb4;Z#q<3oH3+DYtcj{^B28OdIf1RH+39MOU*H9?HE$@8M+DLuY z>Tte(XF_jK3n{V!$&?90x+#soi*~tqu3GV}n{(8LC0ClMTaHe0UVhL?jOt8GT-;RP z;hSLoctO_lbLi;=RvJl16M$`)dj|fJ?)3B}@Y$bhVDyF*=2N8@%-e6GkS#atEO5%} zqDuA#Zd3%)vfu;D+y3WK*;&#&#$g= zyIj#I*_9O^O#ld@B)8hY7(*W6HUE%!2|XGr!*^~`jgV^Q=Q@xZUwb0rs$L`Wg176J zljgIZ0=i*fqtA&u-!eby1^XdO+o*v+LoDR$t?>p=dYaBdn(1Ff0$t=4$xjXQNZ;it zthMAEV$+{6DDWMUU#Sm5%JKd%DDudLBI`NQD&2XfT)3I3!6Ny}>W1xKKe*&} zlIr{?FadgwC{~bD?HAMz&G$^vT2SuMZMZch!PwfsPF^s{UctaD&` z5KGmSoMy>5V9UB=Cd`;-$IUwBqifaBu?keYGWZuzI-7hLdq7Jg@b~;X zi(7x;q6H#l>HM$E=D(S*J%>BNKkavC-*oOfFefSBk0M8#mpKsHGa<@Mx|b?=UvtEA zBKmheiD^iF&H9Fj!va)jFn?Z-Z`YHK9x)}QtV8$tWwN=ov|t=%zb!M@tdj}p(ZmLY z^rGY4TeEH>DtcdyBy?S6`db&5CWT-cZ7EV$R=Ox2H@28cChta=X3g+H)lhehN3qz9 z)7cHD5}SNe1EUeyRP%|}q(aMTV&&|tz2LomkMj}tc>N2amL)aAPtlW=mr}#*xQB(w z^Mc@DQ3G6BKAUHQ0{XU@WUG=IiX=KV-*k-ABMn=6<_(-9wC8(dMa&8Bw_I$n~5fkhG3WSFGxr{JEeGXtZEkZa$puZ=PsBZdv%gvhbsZ zngW`g)m{IlH0SD%Hkr|{-P)qDa1H0Du@a^F9_{LXy0Y3T36OtLIgy&`6#Q<_c+TYO%y^D8r2h&G(%0^8<7%u zjrFDcST4Kdc+W)xdPbC)20bJkVvt6IYIbptecNUU%$=?j!Ix6tL|XQn9)BdO%uDHeF2@~0*+jY6n+ zcs;~TR?DIvf{j&1xq!Q3yX* zz(D~Oj0sPh%-PU_I5&$r|DGXxOhz5QGk*1^c7&i+_wQ-kAsHcwhDEC zFQK5Vj71h1;_bb<0fC$ITZftk-)(XZ58k?5cCJSW=m0fp3(lZA^y2`JnJLSx?mef;a~t@t><`_gQWQe)Igir^&zE@_>+ zFu*zi%LE{9L=N>Ik2qhjJf28uH$I6>JQ*v)DOrt_tr^=c-s^CEBrI~>#>NzBET&aU z(rCu-p$vp-PA4AmKi{gC?(|(qvRmSi2q;@i_BkpI>>O%hEXZqswgo;qB0Y!vTF@l_ z*~6uA(gwmxM}uo$YA(`)!X`Kql6sxN(UW$WGzGX51;Z!{VZFiVy|7{C4Ar;ea85PO zSN^X}ZvCEOfovGsGO!DceNg@W>R~U^|s6kdREb8Z`3KygFmqjS$?(5Zx!B z8#Xe9e5u1UJ1S8DK&@aU-WJvQ+YDcAN(GZ4d3{he@Y^kJHD#6=<5^xWFO-NmO9D-g zhja(F6z12gz*9s-9?(6K>o2*$H}vH&GSGn2dePL?Ia<{s-U&5Vty-S@*(0B@s3sYC z$@>76eoi&~C1ke~q^>?-DWDSV85KnpU3AbBbvY&Jz~%X^rFHig@W1T(XYMh<$ zLlZQY*+93Yr1;#5`D|d&pL~Ne6~wf@0{G`h^#@_f)AZh_uRFipXyh~Y&M!Q{t}ht8}j52R#7DS8vBy~M;9?!$)^tR1w0qlwt<4(nNs}C2hGgL5lSjgFTL-~-Lb9R%0Lp>|axvRTB z8m<{Am*@mlKl6&%hCj9AC>r&GhBM~0)9X0hmJ6vnE4fEEzvuhcl6z4K$A4F6JB{c1 z&8dTTg5RzBy8aj{F}$XE9(MW`5;{)WgmxT-R{d-Tq{qFb~ieu2?EcY!DDg@ z)An)ko$* zQuM8CmVts_{Nogb^8Jl9n|eYIeSrQ|2Go*d8$~Fr_MB2T&Aiv>9ypd`Vfq}BJ-u|} zwt`&g{M%_&4{H}rJBfrpE;YAH+$C)EU`eGV=2F?Y4(A@gJ)imwC~&VOm{z%PbJ?JE zv{$_&haP?p?HzEi?sH@;a9QN6(t$z?wiCn~3~tW3yg}T_;8AN-&3BT)Y6`JzzQIo> z{kGe6Da`5TkM|^Das%19R1P9Ev?tb`v}XxQ&s-Idtc;vVKmI9i0m>M`&iA<7cgej$ zU63;a|IkkRPC3}dJLu%Q-sb^zXMx>*F$E%z_=1bcg@Od+`kVL6nkNa%7&*O%r^;%c zp2;cxzO?-5W#R==&>T_8u|V%&PU#`BCn$t-JX{hL(92lXpE3$Hfq^g`XIYYUIsn-~ zEN3GPbpF3or2h?W`+xGRvj_h>UHkWi?%%ha24HW^Y0g(Z5T&h=+|rxKKe(cXzB7ZX+lJ&;q2d;5XrDnzI_|*U!d0t>-s{YE;YY-;EEXHl%)!$tr!9 zENPdttJB3uFj5k^TDm4|afboUPi}GLC8TkA+z|?%lQua2jPOi2Dx4}6VfIM#8hv> zWa59A;|={b0rnjbt*AsCZ}J*Yu9sAljrvxAf0z<(ZaI{oe23YUpp=a6pf}-!ZuXmb z9j+9w`Hn@T7K++Hmtb5q>G{2jop^kmAVr0v7^7GQE){kCy<{D3nGyyp?CyOE72L~{ z{GVoZ5F(2ND5B;`awkPd1+V=T@G*hFkFyyAi0S^$^nuI))N--h=MLXTFH%h@Ki9g) z+xHFTV`&Z7;zDNlj$V)q@Eq!l`!-*%eC{jvyhn$mK)4*b8R>GJTE!ElWb8ps^D`oWy zlIJJAOvw%vN?PSiS~b5NUATZ+pMg=T(dWB7LwHUiM%5}gU$!(3rE7J^I>FC|3~$4B z^JCR&5Z+v4Jp6u$9F6dzv*1m1>!?}L-zhwI;fUVVs>NjfHjnJE!n)~Mho^dy`jKDJ zjU^v*dftcPNysY&O|oHd4Rc*~F7F;Y-aM78t=t^G#0D3BnjZ&{fHD8VA*~DA0CE|y zTRes!s)xz5Eo(f%H^KsLf#0$*k8fWsiapRwhY9TVPS!EcrL zqpFHMqQJ8$jNc64oKlD)aW^W!EdEyTInR-Nq||Jces8#H(-S-AFfvn;-m)+(gN>Ux z;`5az^S;gunkGs%iPh?0>Y||-NMlVpZiXPKH4}KEC&)>IY9UW44{LhD81JE(PHR)RHbDkIPdYr5r0_f0_#1IV%~6lrfM}P4S!jRvAXt7m8 zvcBjbLLE<4P|MUlupdi1}J5dS&CzXPR? z6=f!aTS=1{Q6^$Uw5(v((i*b!SwC)Z-6gKw{OcG`HCYn;Oc(q25kTb)tQPvm2_GH< zfeui%DxAq^{}1bc0Fr~W;Kp%J)35qlm7YX;@%4GOR5t5pB-iVR2nwVjU!vh%@fvt` zMxyHi=}_zhSCQ-lOA()`3s?rSaD_lydZr52zF1)3WGv4AKTRLM`|#Mx_^{ z9RI59uzz)qF^|vk_IOJXP(8$^w zJyQz{3XGUjhNXr5%5Ht|jO&Rq|GAVlTDk!F)eg(^^V6*cz;{3`oT-^wX?fW6t~dA< zG2LYjmyf_x68$m85&*|^k3Vq*9-Mrh5gY@-vVw$5>w!+3=JwZR*S=p>qw1HO!0tRX zmGIB;aA9huElr93+PDUe7!cHD(RlSFPT+OAhb(cVf&)yJr7&2SI~!pf=E3$VBI6B% zavnGTxlQ6r2jKypsVQ6&O}Q@??{DGs==UYvQW#fspA@E#2w*^8LVUaCfb!$nVlND- zl)d}9oOI6>(Ev9-zc4Xa;MLk&Zp2^$bo^ge`kuYJf3k-fvd+UI0X8gK9`=u#H-j#{2NvBW;1j;*6 z Date: Mon, 8 Aug 2016 12:43:33 -0700 Subject: [PATCH 027/421] Added information about the Company Settings Center being removed in Windows 10, 1607 --- windows/manage/uev-release-notes-1607.md | 17 +++++++++++++++ .../uev-whats-new-in-uev-for-windows.md | 21 ++++++++++++++++++- 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/windows/manage/uev-release-notes-1607.md b/windows/manage/uev-release-notes-1607.md index d28d61f312..4a416cacc4 100644 --- a/windows/manage/uev-release-notes-1607.md +++ b/windows/manage/uev-release-notes-1607.md @@ -14,6 +14,23 @@ Applies to: Windows 10, version 1607 This topic includes information required to successfully install and use UE-V that is not included in the User Experience Virtualization (UE-V) documentation. If there are differences between the information in this topic and other UE-V topics, the latest change should be considered authoritative. +### Company Settings Center removed in UE-V for Windows 10, version 1607 + +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. + +Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. + +With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. + +Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. + +>**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: + +- Contact IT Link Text +- Contact IT URL +- Tray Icon + + ### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked Version 1.0 of UE-V used Offline Files (Client Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607. diff --git a/windows/manage/uev-whats-new-in-uev-for-windows.md b/windows/manage/uev-whats-new-in-uev-for-windows.md index f4192c7109..361d8d472d 100644 --- a/windows/manage/uev-whats-new-in-uev-for-windows.md +++ b/windows/manage/uev-whats-new-in-uev-for-windows.md @@ -24,6 +24,8 @@ The changes in UE-V for Windows 10, version 1607 impact already existing impleme - The UE-V template generator is available from the Windows 10 ADK. In previous releases of UE-V, the template generator was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new template generator to create new settings location templates, existing settings location templates will continue to work. +- The Company Settings Center was removed and is no longer available on user devices. Users can no longer manage their synchronized settings. + For more information about how to configure an existing UE-V installation after upgrading user devices to Windows 10, see [Upgrade to UE-V for Windows 10](uev-upgrade-uev-from-previous-releases.md). > **Important**  You can upgrade your existing UE-V installation to Windows 10 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10. @@ -32,11 +34,27 @@ For more information about how to configure an existing UE-V installation after UE-V for Windows 10 includes a new template generator, available from a new location. If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create settings location templates. The UE-V for Windows 10 template generator is now available in the [Windows 10 Assessment and Deployment Kit](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) (Windows ADK). +### Company Settings Center removed in UE-V for Windows 10, version 1607 + +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. + +Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. + +With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. + +Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. + +>**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: + +- Contact IT Link Text +- Contact IT URL +- Tray Icon + ## Compatibility with Microsoft Enterprise State Roaming With Windows 10, version 1607, users can synchronize Windows application settings and Windows operating system settings to Azure instead of to OneDrive. You can use the Windows 10 enterprise sync functionality together with UE-V on on-premises domain-joined devices only. -In hybrid cloud environments, UE-V can roam win32 applications on-premise while [Enterprise State Roaming](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) (ESR) can roam the rest, e.g., Windows and desktop settings, themes, colors, etc., to an Azure cloud installation. +In hybrid cloud environments, UE-V can roam win32 applications on-premises while [Enterprise State Roaming](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) (ESR) can roam the rest, e.g., Windows and desktop settings, themes, colors, etc., to an Azure cloud installation. To configure UE-V to roam Windows desktop and application data only, change the following group policies: @@ -52,6 +70,7 @@ Additionally, to enable Windows 10 and UE-V to work together, configure these po - Disable “Sync Windows Settings” + ## Settings Synchronization Behavior Changed in UE-V for Windows 10 While earlier versions of UE-V roamed taskbar settings between Windows 10 devices, UE-V for Windows 10, version 1607 does not synchronize taskbar settings between devices running Windows 10 and devices running previous versions of Windows. From e2f2a7b6ded78c9036ff0d8cf065d0edaff0e6d1 Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Mon, 8 Aug 2016 12:59:49 -0700 Subject: [PATCH 028/421] Fixed formatting --- windows/manage/uev-release-notes-1607.md | 6 ++---- windows/manage/uev-whats-new-in-uev-for-windows.md | 8 +++----- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/windows/manage/uev-release-notes-1607.md b/windows/manage/uev-release-notes-1607.md index 4a416cacc4..9e43ca4bef 100644 --- a/windows/manage/uev-release-notes-1607.md +++ b/windows/manage/uev-release-notes-1607.md @@ -16,15 +16,13 @@ This topic includes information required to successfully install and use UE-V th ### Company Settings Center removed in UE-V for Windows 10, version 1607 -In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. - -Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. ->**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: +**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: - Contact IT Link Text - Contact IT URL diff --git a/windows/manage/uev-whats-new-in-uev-for-windows.md b/windows/manage/uev-whats-new-in-uev-for-windows.md index 361d8d472d..06f90bb53f 100644 --- a/windows/manage/uev-whats-new-in-uev-for-windows.md +++ b/windows/manage/uev-whats-new-in-uev-for-windows.md @@ -34,17 +34,15 @@ For more information about how to configure an existing UE-V installation after UE-V for Windows 10 includes a new template generator, available from a new location. If you are upgrading from an existing UE-V installation, you’ll need to use the new generator to create settings location templates. The UE-V for Windows 10 template generator is now available in the [Windows 10 Assessment and Deployment Kit](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) (Windows ADK). -### Company Settings Center removed in UE-V for Windows 10, version 1607 +## Company Settings Center removed in UE-V for Windows 10, version 1607 -In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. - -Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. +In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues. With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings. Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell. ->**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: +**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable: - Contact IT Link Text - Contact IT URL From ba254945bca9d89ba086bb0335af869db81c289c Mon Sep 17 00:00:00 2001 From: Iaan Date: Mon, 8 Aug 2016 13:00:31 -0700 Subject: [PATCH 029/421] BAFS - edit for review of GP and regkey; EN - edit for review of GP enable vs disable --- .../windows-defender-block-at-first-sight.md | 18 ++++++---- ...windows-defender-enhanced-notifications.md | 34 +++++++++++++++++-- 2 files changed, 43 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index de89c2fde6..179ad0de5a 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -20,9 +20,9 @@ author: iaanw Block at First Sight is a feature of Windows Defender cloud protection that provides a way to detect and block new malware within seconds. -You can enable Block at First Sight with Group Policy or individually on endpoints. +It is enabled by default when certain pre-requisite settings are also enabled. -## Backend processing and near-instant determinations +## How it works When a Windows Defender client encounters a suspicious but previously undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. @@ -79,6 +79,10 @@ Block at First Sight requires a number of Group Policy settings to be configured **Enable Block at First Sight with Group Policy** +The Block at First Sight feature is automatically enabled when the pre-requisite settings have been applied. + +You can manually disable the feature. You might want to do this so you can turn off the feature but still retain the pre-requisite settings. + 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration**. @@ -87,16 +91,16 @@ Block at First Sight requires a number of Group Policy settings to be configured 5. Expand the tree through **Windows components > Windows Defender > MAPS**. -1. Double-click the **Configure the ‘Block at First Sight’ feature** setting and set the option to **Enabled**. +1. Double-click the **Configure the ‘Block at First Sight’ feature** setting and set the option to **Disabled**. > [!NOTE] - > The Block at First Sight feature will not function if the pre-requisite group policies have not been correctly set. + > Disabling the Block at First Sight feature will not disable or alter the pre-requisite group policies. ### Manually enable Block at First Sight on individual clients -To configure un-managed clients that are running Windows 10, Block at First Sight is automatically enabled as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. +Block at First Sight is automatically enabled on un-managed clients that are running Windows 10, as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. You can manually disable the feature on individual endpoints. -**Enable Block at First Sight on individual clients** +**Disable Block at First Sight on individual clients** 1. Open Windows Defender settings: @@ -104,7 +108,7 @@ To configure un-managed clients that are running Windows 10, Block at First Sigh b. On the main Windows Settings page, click **Update & Security** and then **Windows Defender**. -2. Switch **Cloud-based Protection** and **Automatic sample submission** to **On**. +2. Switch **Cloud-based Protection** and **Automatic sample submission** to **Off**. > [!NOTE] > These settings will be overridden if the network administrator has configured their associated Group Policies. The settings will appear grayed out and you will not be able to modify them if they are being managed by Group Policy. diff --git a/windows/keep-secure/windows-defender-enhanced-notifications.md b/windows/keep-secure/windows-defender-enhanced-notifications.md index c3f51393f2..d6effcc2f2 100644 --- a/windows/keep-secure/windows-defender-enhanced-notifications.md +++ b/windows/keep-secure/windows-defender-enhanced-notifications.md @@ -22,9 +22,9 @@ In Windows 10, application notifications about malware detection and remediation Notifications will appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications will also be seen in the **Notification Center**, and a summary of scans and threat detections will also appear at regular time intervals. -You can enable and disable enhanced notifications with the registry or in Windows Settings. +You can enable and disable enhanced notifications with the registry or in Windows Settings. -## Configure enhanced notifications +## Disable notifications You can disable enhanced notifications on individual endpoints in Windows Settings. @@ -39,6 +39,36 @@ You can disable enhanced notifications on individual endpoints in Windows Settin ![Windows Defender enhanced notifications](images/defender/enhanced-notifications.png) + +**Use Group Policy to disable Windows Defender notifications:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender > Client Interface** and configure the following settings: + + 1. Double-click the **Suppress all notifications** setting and set the option to **Enabled**. Click **OK**. This will disable all notifications shown by the Windows Defender client. + + 1. Double-click the **Suppresses reboot notifications** setting and set the option to **Enabled**. Click **Ok**. This will disable notifications that ask the endpoint user to reboot the machine to perform additional cleaning. +>[!NOTE] +>Usually, users are asked to reboot the endpoint to perform a scan with Windows Defender Offline. For details on performing offline scans, see the [Windows Defender Offline](windows-defender-offline.md#manage-notifications) topic. + +**Use the registry to disable Windows Defender enhanced notifications:** + +1. Click **Start**, type `Run`, and press **Enter**. +2. From the **Run** dialog box, type `regedit` and press **Enter**. +3. In the Registry Editor navigate to the following key: + ``` + HKLM\Software\Policies\Microsoft\Windows Defender + ``` +4. Right-click the Windows Defender key and add a new key. Name it `Features`. +5. Right-click the **Features** key you created and select **New** then **DWORD (32-bit) Value**. Name the value `DisableEnhancedNotifications`. +6. Double-click the **DisableEnhancedNotifications** value and set it to `1`. + + ## Related topics - [Windows Defender in Windows 10](windows-defender-in-windows-10.md) \ No newline at end of file From 9f7eda83271861e12694a1bb28acf665f8438bea Mon Sep 17 00:00:00 2001 From: Justinha Date: Mon, 8 Aug 2016 14:47:05 -0700 Subject: [PATCH 030/421] removed self-signed cert option --- .../bitlocker-how-to-enable-network-unlock.md | 81 ++++++------------- 1 file changed, 24 insertions(+), 57 deletions(-) diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index 16e0aa12b2..2b1a237877 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -80,11 +80,11 @@ The server side configuration to enable Network Unlock also requires provisionin ## Configure Network Unlock -The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012. +The following steps allow an administrator to configure Network Unlock in a domain where the domain functional level is at least Windows Server 2012. ### Step One: Install the WDS Server role -The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager. +The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock, you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role. To install the role using Windows PowerShell, use the following command: @@ -114,72 +114,39 @@ Install-WindowsFeature BitLocker-NetworkUnlock ``` ### Step Four: Create the Network Unlock certificate -Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate. +Network Unlock can use imported certificates from an existing PKI infrastructure. To enroll a certificate from an existing certification authority (CA), do the following: -1. Open Certificate Manager on the WDS server using **certmgr.msc** -2. Under the Certificates - Current User item, right-click Personal -3. Select All Tasks, then **Request New Certificate** -4. Select **Next** when the Certificate Enrollment wizard opens -5. Select Active Directory Enrollment Policy -6. Choose the certificate template created for Network Unlock on the Domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: +1. Open Certificate Manager on the WDS server using **certmgr.msc**. +2. Under the Certificates - Current User item, right-click **Personal**. +3. Select All Tasks, then **Request New Certificate**. +4. Select **Next** when the Certificate Enrollment wizard opens. +5. Select **Active Directory Enrollment Policy**. +6. Choose the certificate template created for Network Unlock on the domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: - Select the **Subject Name** pane and provide a friendly name value. It is suggested that this friendly name include information for the domain or organizational unit for the certificate. For example "BitLocker Network Unlock Certificate for Contoso domain" 7. Create the certificate. Ensure the certificate appears in the Personal folder. -8. Export the public key certificate for Network Unlock +8. Export the public key certificate for Network Unlock: 1. Create a .cer file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. 2. Select **No, do not export the private key**. 3. Select **DER encoded binary X.509** and complete exporting the certificate to a file. 4. Give the file a name such as BitLocker-NetworkUnlock.cer. -9. Export the public key with a private key for Network Unlock +9. Export the public key with a private key for Network Unlock: 1. Create a .pfx file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. 2. Select **Yes, export the private key**. 3. Complete the wizard to create the .pfx file. -To create a self-signed certificate, do the following: - -1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf -2. Add the following contents to the previously created file: - - ``` syntax - [NewRequest] - Subject="CN=BitLocker Network Unlock certificate" - Exportable=true - RequestType=Cert - KeyUsage="CERT_KEY_ENCIPHERMENT_KEY_USAGE" - KeyUsageProperty="NCRYPT_ALLOW_DECRYPT_FLAG" - KeyLength=2048 - Keyspec="AT_KEYEXCHANGE" - SMIME=FALSE - HashAlgorithm=sha512 - [Extensions] - 1.3.6.1.4.1.311.21.10 = "{text}" - _continue_ = "OID=1.3.6.1.4.1.311.67.1.1" - 2.5.29.37 = "{text}" - _continue_ = "1.3.6.1.4.1.311.67.1.1" - ``` - -3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name: - - ``` syntax - certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer - ``` - -4. Verify the previous command properly created the certificate by confirming the .cer file exists -5. Launch the Certificate Manager by running **certmgr.msc** -6. Create a .pfx file by opening the **Certificates – Current User\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file. - ### Step Five: Deploy the private key and certificate to the WDS server With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following: 1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options. -2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import** +2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import**. 3. In the **File to Import** dialog, choose the .pfx file created previously. 4. Enter the password used to create the .pfx and complete the wizard. @@ -189,18 +156,18 @@ With certificate and key deployed to the WDS server for Network Unlock, the fina The following steps describe how to enable the Group Policy setting that is a requirement for configuring Network Unlock. -1. Open Group Policy Management Console (gpmc.msc) -2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option -3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers +1. Open Group Policy Management Console (gpmc.msc). +2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option. +3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers. The following steps describe how to deploy the required Group Policy setting: >**Note:**  The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012.   -1. Copy the .cer file created for Network Unlock to the domain controller -2. On the domain controller, launch Group Policy Management Console (gpmc.msc) +1. Copy the .cer file created for Network Unlock to the domain controller. +2. On the domain controller, launch Group Policy Management Console (gpmc.msc). 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. -4. Deploy the public certificate to clients +4. Deploy the public certificate to clients: 1. Within Group Policy Management Console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** 2. Right-click the folder and choose **Add Network Unlock Certificate** @@ -212,16 +179,16 @@ The following steps describe how to deploy the required Group Policy setting: An additional step is for enterprises to use TPM+PIN protectors for an extra level of security. To require TPM+PIN protectors in an environment, do the following: -1. Open Group Policy Management Console (gpmc.msc) -2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option -3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers +1. Open Group Policy Management Console (gpmc.msc). +2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option. +3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers. ### Create the certificate template for Network Unlock The following steps detail how to create a certificate template for use with BitLocker Network Unlock. A properly configured Active Directory Services Certification Authority can use this certificate to create and issue Network Unlock certificates. 1. Open the Certificates Template snap-in (certtmpl.msc). -2. Locate the User template. Right-click the template name and select **Duplicate Template** +2. Locate the User template. Right-click the template name and select **Duplicate Template**. 3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8respectively. Ensure the **Show resulting changes** dialog box is selected. 4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the checkbox for the **Publish certificate in Active Directory** option. 5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop down menu. Ensure the **Allow private key to be exported** option is selected. @@ -237,9 +204,9 @@ The following steps detail how to create a certificate template for use with Bit - **Name:** **BitLocker Network Unlock** - **Object Identifier:** **1.3.6.1.4.1.311.67.1.1** -14. Select the newly created **BitLocker Network Unlock** application policy and select **OK** +14. Select the newly created **BitLocker Network Unlock** application policy and select **OK**. 15. With the **Extensions** tab still open, select the **Edit Key Usage Extension** dialog, select the **Allow key exchange only with key encryption (key encipherment)** option. Select the **Make this extension critical** option. -16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission +16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission. 17. Select **OK** to complete configuration of the template. To add the Network Unlock template to the Certification Authority, open the Certification Authority snap-in (certsrv.msc). Right-click the **Certificate Templates** item and choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. From cd9fbc5cd12db8617bd3d70f0c4094e8a0ba52bb Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Mon, 8 Aug 2016 15:16:45 -0700 Subject: [PATCH 031/421] Fixed bugs --- windows/deploy/upgrade-analytics-get-started.md | 2 +- windows/deploy/upgrade-analytics-release-notes.md | 2 +- windows/deploy/upgrade-analytics-requirements.md | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index 61df9139e8..3e691ab5e1 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -37,7 +37,7 @@ If you are already using OMS, you’ll find Upgrade Analytics in the Solutions G If you are not using OMS: -1. Go to the [Upgrade Analytics website](http://go.microsoft.com/fwlink/?LinkID=799190&clcid=0x409) and click **Sign up** to kick off the onboarding process. +1. Go to the [Upgrade Analytics page on Microsoft.com](http://go.microsoft.com/fwlink/?LinkID=799190&clcid=0x409) and click **Sign up** to kick off the onboarding process. 2. Sign in to Operations Management Suite (OMS). You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. diff --git a/windows/deploy/upgrade-analytics-release-notes.md b/windows/deploy/upgrade-analytics-release-notes.md index dd1959b0e1..dbf92527d7 100644 --- a/windows/deploy/upgrade-analytics-release-notes.md +++ b/windows/deploy/upgrade-analytics-release-notes.md @@ -1,5 +1,5 @@ --- title: Upgrade Analytics release notes (Windows 10) description: Provides tips and limitations about Upgrade Analytics. -redirect_url: https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements +redirect_url: https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements#important-information-about-this-release --- \ No newline at end of file diff --git a/windows/deploy/upgrade-analytics-requirements.md b/windows/deploy/upgrade-analytics-requirements.md index 5dc5a972e7..1d48d9a363 100644 --- a/windows/deploy/upgrade-analytics-requirements.md +++ b/windows/deploy/upgrade-analytics-requirements.md @@ -29,7 +29,7 @@ Upgrade Analytics is offered as a solution in the Microsoft Operations Managemen If you’re already using OMS, you’ll find Upgrade Analytics in the Solutions Gallery. Click the Upgrade Analytics tile in the gallery and then click Add on the solution’s details page. Upgrade Analytics is now visible in your workspace. -If you are not using OMS, go to \[link to new Upgrade Analytics Web page on Microsoft.com\] and select **Upgrade Analytics Service** to kick off the OMS onboarding process. During the onboarding process, you’ll create an OMS workspace and add the Upgrade Analytics solution to it. +If you are not using OMS, go to [the Upgrade Analytics page on Microsoft.com](https://www.microsoft.com/en-us/WindowsForBusiness/upgrade-analytics) and select **Sign up** to kick off the OMS onboarding process. During the onboarding process, you’ll create an OMS workspace and add the Upgrade Analytics solution to it. Important: You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. @@ -37,7 +37,7 @@ Important: You can use either a Microsoft Account or a Work or School account to After you’ve signed in to Operations Management Suite and added the Upgrade Analytics solution to your workspace, you’ll need to complete the following tasks to allow user computer data to be shared with and assessed by Upgrade Analytics. -See \[link to Steve May’s PDF doc when it’s published\] for more information about what user computer data Upgrade Analytics collects and assesses. See [Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization) for more information about how Microsoft uses Windows telemetry data. +See [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](http://go.microsoft.com/fwlink/?LinkID=822965) for more information about what user computer data Upgrade Analytics collects and assesses. See [Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization) for more information about how Microsoft uses Windows telemetry data. **Whitelist telemetry endpoints.** To enable telemetry data to be sent to Microsoft, you’ll need to whitelist the following Microsoft telemetry endpoints on your proxy server or firewall. You may need to get approval from your security group to do this. From 038a5e9e71ebc46c96814bc4631ff3b04c7745f5 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Mon, 8 Aug 2016 17:59:36 -0700 Subject: [PATCH 032/421] Folded in some changes from Maggie's email --- ...pv-client-for-shared-content-store-mode.md | 2 +- ...ing-for-sequencer-and-client-deployment.md | 5 +- windows/manage/appv-prerequisites.md | 44 ------ ...appv-release-notes-for-appv-for-windows.md | 147 +++--------------- 4 files changed, 20 insertions(+), 178 deletions(-) diff --git a/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md b/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md index fb6da496d4..f02ef3fd54 100644 --- a/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md +++ b/windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md @@ -12,7 +12,7 @@ ms.prod: w10 # How to Install the App-V Client for Shared Content Store Mode -Use the following procedure to install the Microsoft Application Virtualization (App-V) client so that it uses the App-V Shared Content Store (SCS) mode. You should ensure that all required prerequisites are installed on the computer you plan to install to. Use the following link to see [App-V Prerequisites](appv-prerequisites.md). +Use the following procedure to install the Microsoft Application Virtualization (App-V) client so that it uses the App-V Shared Content Store (SCS) mode. **Enable the App-V client for SCS mode** diff --git a/windows/manage/appv-planning-for-sequencer-and-client-deployment.md b/windows/manage/appv-planning-for-sequencer-and-client-deployment.md index 7da2d52c61..c2d5c87f95 100644 --- a/windows/manage/appv-planning-for-sequencer-and-client-deployment.md +++ b/windows/manage/appv-planning-for-sequencer-and-client-deployment.md @@ -38,10 +38,7 @@ Ideally, you should install the sequencer on a computer running as a virtual mac ## Planning for App-V client deployment -In Windows 10, version 1607, the App-V client is included with the operating system. For more info, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). - -For a list of the client minimum requirements see [App-V Prerequisites](appv-prerequisites.md). - +In Windows 10, version 1607, the App-V client is included with the operating system. For more information, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). ## Planning for the App-V Shared Content Store (SCS) diff --git a/windows/manage/appv-prerequisites.md b/windows/manage/appv-prerequisites.md index b8b112eea4..55c44b029c 100644 --- a/windows/manage/appv-prerequisites.md +++ b/windows/manage/appv-prerequisites.md @@ -517,50 +517,6 @@ The Reporting database is required only if you are using the App-V Reporting ser -  - -## App-V client prerequisite software - - -Install the following prerequisite software for the App-V client. - -> [!NOTE] -> This is not required on Windows 10, version 1607. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
PrerequisiteDetails

[Microsoft .NET Framework 4.5.1 (Web Installer)](http://www.microsoft.com//download/details.aspx?id=40773)

[Windows PowerShell 3.0](http://www.microsoft.com/download/details.aspx?id=34595)

-

Installing PowerShell 3.0 requires a restart.

[KB2533623](http://support.microsoft.com/kb/2533623)

Applies to Windows 7 only: Download and install the KB.

[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784)

- -  - ## Remote Desktop Services client prerequisite software diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index 618d92d9da..1d63f22499 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -13,150 +13,39 @@ ms.prod: w10 Applies to: Windows 10, version 1607 -Review these known issues in Microsoft Application Virtualization (App-V) for Windows. +The following is a known issue in Microsoft Application Virtualization (App-V) Windows 10 Anniversary Update: + +**MSI packages generated by App-V 5.1 and older sequencer fail to install on computers with built-in App-V client** + +When MSI packages are generated by an older sequencer (5.1 and below), they include a check to ensure the App-V client is installed before allowing the MSI package to install. Since App-V client is now part of the operating system, the pre-requisite check fails and it leads to MSI installation failure. -## Error occurs during publishing refresh between App-V 5.0 SP3 Management Server and App-V Client on Windows 10 +**Workaround**: +1. Install the latest App-V sequencer, which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer). -An error is generated during publishing refresh when synchronizing packages from the App-V 5.0 SP3 management server to an App-V client on Windows 10 . This error occurs because the App-V 5.0 SP3 server does not understand the Windows 10 operating system that is specified in the publishing URL. The issue is fixed for App-V publishing server, but is not backported to versions of App-V 5.0 SP3 or earlier. +2. Ensure that you have installed the **MSI Tools** included in the Windows 10 SDK, available as follows: -**Workaround**: Upgrade the App-V 5.0 management server to the App-V management server for Windows 10 clients. + - For the **Visual Studio Community 2015 with Update 3** client, which includes the latest Windows 10 SDK and developer tools, see [Downloads and tools for Windows 10](https://developer.microsoft.com/en-us/windows/downloads). + + - For the standalone Windows 10 SDK without other tools, see [Standalone Windows 10 SDK](https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk). -## Custom configurations do not get applied for packages that will be published globally if they are set using the App-V Server +3. From an elevated Windows PowerShell prompt, navigate to the following folder: + + <Windows Kits 10 installation folder>**\Microsoft Application Virtualization\Sequencer\** -If you assign a package to an AD group that contains machine accounts and apply a custom configuration to that group using the App-V Server, the custom configuration will not be applied to those machines. The App-V Client will publish packages assigned to a machine account globally. However, it stores custom configuration files per user in each user’s profile. Globally published packages will not have access to this custom configuration. + By default, this path will be:
**C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\Sequencer** -**Workaround**: Do one of the following: +4. Run the following command: -- Assign the package to groups containing only user accounts. This will ensure that the package’s custom configuration is stored in each user’s profile and will be applied correctly. + `Update-AppvPackageMsi -MsiPackage "" -MsSdkPath ""` -- Create a custom deployment configuration file and apply it to the package on the client using the Add-AppvClientPackage cmdlet with the –DynamicDeploymentConfiguration parameter. See [About App-V Dynamic Configuration](appv-dynamic-configuration.md) for more information. + By default, the path to the Windows SDK installation will be:
**C:\Program Files (x86)\Windows Kits\10** -- Create a new package with the custom configuration using the App-V sequencer. - -## Server files not deleted after new App-V for Windows server installation - - -If you uninstall the App-V 5.0 SP1 Server and then install the App-V Server, the installation fails, the wrong version of the Management server is installed, and an error message is returned. The issue occurs because the Server files are not being deleted when you uninstall App-V 5.0 SP1, so the installation process does an upgrade instead of a new installation. - -**Workaround**: Delete this registry key before you start installing App-V: - -Under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall, locate and delete the installation GUID key that contains the DWORD value "DisplayName" with value data "Microsoft Application Virtualization (App-V) Server". This is the only key that should be deleted. - -## File type associations added manually are not saved correctly - - -File type associations added to an application package manually using the Shortcuts and FTAs tab at the end of the application upgrade wizard are not saved correctly. They will not be available to the App-V Client or to the Sequencer when updating the saved package again. - -**Workaround**: To add a file type association, open the package for modification and run the update wizard. During the Installation step, add the new file type association through the operating system. The sequencer will detect the new association in the system registry and add it to the package’s virtual registry, where it will be available to the client. - -## When streaming packages in Shared Content Store (SCS) mode to a client that is also managed with AppLocker, additional data is written to the local disk. - - -To decrease the amount of data written to a client’s local disk, you can enable SCS mode on the App-V Client to stream the contents of a package on demand. However, if AppLocker manages an application within the package, some data might be written to the client’s local disk that would not otherwise be written. - -**Workaround**: None - -## In the Management Console Add Package dialog box, the Browse button is not available when using Chrome or Firefox - - -On the Packages page of the Management Console, if you click **Add or Upgrade** in the lower-right corner, the **Add Package** dialog box appears. If you are accessing the Management Console using Chrome or Firefox as your browser, you will not be able to browse to the location of the package. - -**Workaround**: Type or copy and paste the path to the package into the **Add Package** input field. If the Management Console has access to this path, you will be able to add the package. If the package is on a network share, you can browse to the location using File Explorer by doing these steps: - -1. While pressing **Shift**, right-click on the package file - -2. Select **Copy as path** - -3. Paste the path into the **Add Package** dialog box input field - -## Upgrading App-V Management Server to 5.1 sometimes fails with the message “A database error occurred” - - -If you install the App-V 5.0 SP1 Management Server, and then try to upgrade to App-V Server when multiple connection groups are configured and enabled, the following error is displayed: “A database error occurred. Reason: 'Invalid column name 'PackageOptional'. Invalid column name 'VersionOptional'.” - -**Workaround**: Run this command on your SQL database: - -`ALTER TABLE AppVManagement.dbo.PackageGroupMembers ADD PackageOptional bit NOT NULL DEFAULT 0, VersionOptional bit NOT NULL DEFAULT 0` - -where “AppVManagement” is the name of the database. - -## Users cannot open a package in a user-published connection group if you add or remove an optional package - - -In environments that are running the RDS Client or that have multiple concurrent users per computer, logged-in users cannot open applications in packages that are in a user-published connection group if an optional package is added to or removed from the connection group. - -**Workaround**: Have users log out and then log back in. - -## Error message is erroneously displayed when the connection group is published only to the user - - -When you run Repair-AppvClientConnectionGroup, the following error is displayed, even when the connection group is published only to the user: “Internal App-V Integration error: Package not integrated for the user. Please ensure that the package is added to the machine and published to the user.” - -**Workaround**: Do one of the following: - -- Publish all packages in a connection group. - - The problem arises when the connection group being repaired has packages that are missing or not available to the user (that is, not published globally or to the user). However, the repair will work if all of the connection group’s packages are available, so ensure that all packages are published. - -- Repair packages individually using the Repair-AppvClientPackage command rather than the Repair-AppvClientConnectionGroup command. - - Determine which packages are available to users and then run the Repair-AppvClientPackage command once for each package. Use PowerShell cmdlets to do the following: - - 1. Get all the packages in a connection group. - - 2. Check to see if each package is currently published. - - 3. If the package is currently published, run Repair-AppvClientPackage on that package. - -## Icons not displayed properly in Sequencer - - -Icons in the Shortcuts and File Type Associations tab are not displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons are not 16x16 or 32x32. - -**Workaround**: Only use icons that are 16x16 or 32x32. - -## InsertVersionInfo.sql script no longer required for the Management Database - - -The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. - -The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). - -**Important**   -**Step 1** is not required for versions of App-V later than App-V 5.0 SP3. - -  - -## Microsoft Visual Studio 2012 not supported - - -App-V does not support Visual Studio 2012. - -**Workaround**: None - -## Application filename restrictions for App-V Sequencer - - -The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -**Workaround**: Use a different filename ## Have a suggestion for App-V? - Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [About App-V](appv-about-appv.md) - -  - -  - - - - - From 009b03f63efa81e5ad1c1fcfa8736f6a0716cffc Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 9 Aug 2016 07:26:59 -0700 Subject: [PATCH 033/421] fixed typos --- windows/manage/settings-that-can-be-locked-down.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/manage/settings-that-can-be-locked-down.md b/windows/manage/settings-that-can-be-locked-down.md index fe4253fb64..c0348677ba 100644 --- a/windows/manage/settings-that-can-be-locked-down.md +++ b/windows/manage/settings-that-can-be-locked-down.md @@ -266,27 +266,27 @@ The following table lists the settings pages and page groups. Use the page name Narrator -SettingsPageEaseoOfAccessNarrator +SettingsPageEaseOfAccessNarrator Magnifier -SettingsPageEaseoOfAccessMagnifier +SettingsPageEaseOfAccessMagnifier High contrast -SettingsPageEaseoOfAccessHighContrast +SettingsPageEaseOfAccessHighContrast Closed captions -SettingsPageEaseoOfAccessClosedCaptioning +SettingsPageEaseOfAccessClosedCaptioning More options -SettingsPageEaseoOfAccessMoreOptions +SettingsPageEaseOfAccessMoreOptions Privacy From 5a5095b29ae896ea56b28234d92e9e4c37068cf2 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 9 Aug 2016 09:25:22 -0700 Subject: [PATCH 034/421] removing placeholder content --- devices/hololens/TOC.md | 1 - devices/hololens/index.md | 1 - 2 files changed, 2 deletions(-) delete mode 100644 devices/hololens/TOC.md delete mode 100644 devices/hololens/index.md diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md deleted file mode 100644 index 06913f7aef..0000000000 --- a/devices/hololens/TOC.md +++ /dev/null @@ -1 +0,0 @@ -# [Index](index.md) \ No newline at end of file diff --git a/devices/hololens/index.md b/devices/hololens/index.md deleted file mode 100644 index beccdc8994..0000000000 --- a/devices/hololens/index.md +++ /dev/null @@ -1 +0,0 @@ -# Index test file for Open Publishing \ No newline at end of file From c17f869ceb0c4196feae4f905c9d177b3f188dfc Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 9 Aug 2016 09:32:45 -0700 Subject: [PATCH 035/421] update link --- windows/manage/lockdown-features-windows-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/lockdown-features-windows-10.md b/windows/manage/lockdown-features-windows-10.md index 555ec7ab73..ed9d772f83 100644 --- a/windows/manage/lockdown-features-windows-10.md +++ b/windows/manage/lockdown-features-windows-10.md @@ -40,7 +40,7 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be

[Unified Write Filter](http://go.microsoft.com/fwlink/p/?LinkId=626757): protect a device's physical storage media

-[Unified Write Filter](http://go.microsoft.com/fwlink/p/?LinkId=626607) +[Unified Write Filter](https://msdn.microsoft.com/en-us/library/windows/hardware/mt572001.aspx)

The Unified Write Filter is continued in Windows 10, with the exception of HORM which has been deprecated.

From 8e28557db123bab78112a0c2e62dc681a52a65eb Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 9 Aug 2016 09:37:07 -0700 Subject: [PATCH 036/421] Revert "removing placeholder content" This reverts commit 5a5095b29ae896ea56b28234d92e9e4c37068cf2. --- devices/hololens/TOC.md | 1 + devices/hololens/index.md | 1 + 2 files changed, 2 insertions(+) create mode 100644 devices/hololens/TOC.md create mode 100644 devices/hololens/index.md diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md new file mode 100644 index 0000000000..06913f7aef --- /dev/null +++ b/devices/hololens/TOC.md @@ -0,0 +1 @@ +# [Index](index.md) \ No newline at end of file diff --git a/devices/hololens/index.md b/devices/hololens/index.md new file mode 100644 index 0000000000..beccdc8994 --- /dev/null +++ b/devices/hololens/index.md @@ -0,0 +1 @@ +# Index test file for Open Publishing \ No newline at end of file From 0cbe3dbd6fd5b661db37678835c5ba2611b652f5 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 9 Aug 2016 09:38:24 -0700 Subject: [PATCH 037/421] changing tex --- devices/hololens/TOC.md | 2 +- devices/hololens/index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index 06913f7aef..8b4c888244 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -1 +1 @@ -# [Index](index.md) \ No newline at end of file +# [Placeholder](index.md) \ No newline at end of file diff --git a/devices/hololens/index.md b/devices/hololens/index.md index beccdc8994..867e2c8492 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -1 +1 @@ -# Index test file for Open Publishing \ No newline at end of file +# Placeholder \ No newline at end of file From 87a89759ef8d9a80938ac22b73302f70441e08d8 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 9 Aug 2016 09:39:15 -0700 Subject: [PATCH 038/421] Revert "removed self-signed cert option" --- .../bitlocker-how-to-enable-network-unlock.md | 81 +++++++++++++------ 1 file changed, 57 insertions(+), 24 deletions(-) diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index 2b1a237877..16e0aa12b2 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -80,11 +80,11 @@ The server side configuration to enable Network Unlock also requires provisionin ## Configure Network Unlock -The following steps allow an administrator to configure Network Unlock in a domain where the domain functional level is at least Windows Server 2012. +The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012. ### Step One: Install the WDS Server role -The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock, you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role. +The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager. To install the role using Windows PowerShell, use the following command: @@ -114,39 +114,72 @@ Install-WindowsFeature BitLocker-NetworkUnlock ``` ### Step Four: Create the Network Unlock certificate -Network Unlock can use imported certificates from an existing PKI infrastructure. +Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate. To enroll a certificate from an existing certification authority (CA), do the following: -1. Open Certificate Manager on the WDS server using **certmgr.msc**. -2. Under the Certificates - Current User item, right-click **Personal**. -3. Select All Tasks, then **Request New Certificate**. -4. Select **Next** when the Certificate Enrollment wizard opens. -5. Select **Active Directory Enrollment Policy**. -6. Choose the certificate template created for Network Unlock on the domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: +1. Open Certificate Manager on the WDS server using **certmgr.msc** +2. Under the Certificates - Current User item, right-click Personal +3. Select All Tasks, then **Request New Certificate** +4. Select **Next** when the Certificate Enrollment wizard opens +5. Select Active Directory Enrollment Policy +6. Choose the certificate template created for Network Unlock on the Domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: - Select the **Subject Name** pane and provide a friendly name value. It is suggested that this friendly name include information for the domain or organizational unit for the certificate. For example "BitLocker Network Unlock Certificate for Contoso domain" 7. Create the certificate. Ensure the certificate appears in the Personal folder. -8. Export the public key certificate for Network Unlock: +8. Export the public key certificate for Network Unlock 1. Create a .cer file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. 2. Select **No, do not export the private key**. 3. Select **DER encoded binary X.509** and complete exporting the certificate to a file. 4. Give the file a name such as BitLocker-NetworkUnlock.cer. -9. Export the public key with a private key for Network Unlock: +9. Export the public key with a private key for Network Unlock 1. Create a .pfx file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. 2. Select **Yes, export the private key**. 3. Complete the wizard to create the .pfx file. +To create a self-signed certificate, do the following: + +1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf +2. Add the following contents to the previously created file: + + ``` syntax + [NewRequest] + Subject="CN=BitLocker Network Unlock certificate" + Exportable=true + RequestType=Cert + KeyUsage="CERT_KEY_ENCIPHERMENT_KEY_USAGE" + KeyUsageProperty="NCRYPT_ALLOW_DECRYPT_FLAG" + KeyLength=2048 + Keyspec="AT_KEYEXCHANGE" + SMIME=FALSE + HashAlgorithm=sha512 + [Extensions] + 1.3.6.1.4.1.311.21.10 = "{text}" + _continue_ = "OID=1.3.6.1.4.1.311.67.1.1" + 2.5.29.37 = "{text}" + _continue_ = "1.3.6.1.4.1.311.67.1.1" + ``` + +3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name: + + ``` syntax + certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer + ``` + +4. Verify the previous command properly created the certificate by confirming the .cer file exists +5. Launch the Certificate Manager by running **certmgr.msc** +6. Create a .pfx file by opening the **Certificates – Current User\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file. + ### Step Five: Deploy the private key and certificate to the WDS server With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following: 1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options. -2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import**. +2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import** 3. In the **File to Import** dialog, choose the .pfx file created previously. 4. Enter the password used to create the .pfx and complete the wizard. @@ -156,18 +189,18 @@ With certificate and key deployed to the WDS server for Network Unlock, the fina The following steps describe how to enable the Group Policy setting that is a requirement for configuring Network Unlock. -1. Open Group Policy Management Console (gpmc.msc). -2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option. -3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers. +1. Open Group Policy Management Console (gpmc.msc) +2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option +3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers The following steps describe how to deploy the required Group Policy setting: >**Note:**  The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012.   -1. Copy the .cer file created for Network Unlock to the domain controller. -2. On the domain controller, launch Group Policy Management Console (gpmc.msc). +1. Copy the .cer file created for Network Unlock to the domain controller +2. On the domain controller, launch Group Policy Management Console (gpmc.msc) 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. -4. Deploy the public certificate to clients: +4. Deploy the public certificate to clients 1. Within Group Policy Management Console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** 2. Right-click the folder and choose **Add Network Unlock Certificate** @@ -179,16 +212,16 @@ The following steps describe how to deploy the required Group Policy setting: An additional step is for enterprises to use TPM+PIN protectors for an extra level of security. To require TPM+PIN protectors in an environment, do the following: -1. Open Group Policy Management Console (gpmc.msc). -2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option. -3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers. +1. Open Group Policy Management Console (gpmc.msc) +2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** option +3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers ### Create the certificate template for Network Unlock The following steps detail how to create a certificate template for use with BitLocker Network Unlock. A properly configured Active Directory Services Certification Authority can use this certificate to create and issue Network Unlock certificates. 1. Open the Certificates Template snap-in (certtmpl.msc). -2. Locate the User template. Right-click the template name and select **Duplicate Template**. +2. Locate the User template. Right-click the template name and select **Duplicate Template** 3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8respectively. Ensure the **Show resulting changes** dialog box is selected. 4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the checkbox for the **Publish certificate in Active Directory** option. 5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop down menu. Ensure the **Allow private key to be exported** option is selected. @@ -204,9 +237,9 @@ The following steps detail how to create a certificate template for use with Bit - **Name:** **BitLocker Network Unlock** - **Object Identifier:** **1.3.6.1.4.1.311.67.1.1** -14. Select the newly created **BitLocker Network Unlock** application policy and select **OK**. +14. Select the newly created **BitLocker Network Unlock** application policy and select **OK** 15. With the **Extensions** tab still open, select the **Edit Key Usage Extension** dialog, select the **Allow key exchange only with key encryption (key encipherment)** option. Select the **Make this extension critical** option. -16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission. +16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission 17. Select **OK** to complete configuration of the template. To add the Network Unlock template to the Certification Authority, open the Certification Authority snap-in (certsrv.msc). Right-click the **Certificate Templates** item and choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. From 4516f77eed4e7e9eb33c14198ffb00da4a02f877 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 9 Aug 2016 11:12:12 -0700 Subject: [PATCH 039/421] Updated with loc tags --- browsers/edge/Index.md | 1 + windows/keep-secure/block-untrusted-fonts-in-enterprise.md | 1 + 2 files changed, 2 insertions(+) diff --git a/browsers/edge/Index.md b/browsers/edge/Index.md index c15b35774b..60c93b0051 100644 --- a/browsers/edge/Index.md +++ b/browsers/edge/Index.md @@ -6,6 +6,7 @@ ms.prod: edge ms.mktglfcycl: general ms.sitesec: library title: Microsoft Edge - Deployment Guide for IT Pros (Microsoft Edge for IT Pros) +localizationpriority: high --- # Microsoft Edge - Deployment Guide for IT Pros diff --git a/windows/keep-secure/block-untrusted-fonts-in-enterprise.md b/windows/keep-secure/block-untrusted-fonts-in-enterprise.md index 83a3f113a9..975a2a8c12 100644 --- a/windows/keep-secure/block-untrusted-fonts-in-enterprise.md +++ b/windows/keep-secure/block-untrusted-fonts-in-enterprise.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.pagetype: security ms.sitesec: library author: eross-msft +localizationpriority: high --- # Block untrusted fonts in an enterprise From 723825a12662dd0a3015ee6bda0aed070bd7d479 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 11:26:42 -0700 Subject: [PATCH 040/421] Correcting version in selected strings about App-V Server --- windows/manage/appv-deploy-the-appv-server-with-a-script.md | 4 ++-- windows/manage/appv-getting-started.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/manage/appv-deploy-the-appv-server-with-a-script.md b/windows/manage/appv-deploy-the-appv-server-with-a-script.md index 919248523e..818bf8ae34 100644 --- a/windows/manage/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/manage/appv-deploy-the-appv-server-with-a-script.md @@ -1,5 +1,5 @@ --- -title: How to Deploy the App-V Server Using a Script (Windows 10) +title: How to Deploy the App-V 5.1 Server Using a Script description: How to Deploy the App-V Server Using a Script author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization @@ -9,7 +9,7 @@ ms.prod: w10 --- -# How to Deploy the App-V Server Using a Script +# How to Deploy the App-V 5.1 Server Using a Script In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md index 2e33f78295..34d3229eb4 100644 --- a/windows/manage/appv-getting-started.md +++ b/windows/manage/appv-getting-started.md @@ -30,7 +30,7 @@ To start using App-V to deliver virtual applications to users, you’ll need to | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](#_Deploying_the_App-V). | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215).
You must have a MSDN subscription to download the MDOP ISO package.
See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. | +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md). | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215).
You must have a MSDN subscription to download the MDOP ISO package.
See [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. | | App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10.
For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | | App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit). | From 601afcdd6582051ed89f3c756ab450793fa09e0b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 9 Aug 2016 11:30:04 -0700 Subject: [PATCH 041/421] clarify exit assigned access --- .../manage/change-history-for-manage-and-update-windows-10.md | 1 + .../set-up-a-kiosk-for-windows-10-for-desktop-editions.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index f45e2f1553..3785c0b427 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -18,6 +18,7 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | New or changed topic | Description | | --- | --- | | [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Updated sample XML for combined Start and taskbar layout; added note to explain the difference between applying taskbar configuration by Group Policy and by provisioning package | +| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated instructions for exiting assigned access mode. | ## RELEASE: Windows 10, version 1607 diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index 940a457a76..9dc93e1be7 100644 --- a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -247,7 +247,7 @@ Edit the registry to have an account automatically logged on. ### Sign out of assigned access -To sign out of an assigned access account, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. +To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain connected until an admin account opens **Task Manager** > **Users** and disconnects the user account. If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: From 507ee8a987fc81206868e1f4a13cd1d583674fff Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 9 Aug 2016 11:36:31 -0700 Subject: [PATCH 042/421] tweak --- .../set-up-a-kiosk-for-windows-10-for-desktop-editions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index 9dc93e1be7..b2cb477ef2 100644 --- a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -247,7 +247,7 @@ Edit the registry to have an account automatically logged on. ### Sign out of assigned access -To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain connected until an admin account opens **Task Manager** > **Users** and disconnects the user account. +To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain connected until an admin account opens **Task Manager** > **Users** and signs out the user account. If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: From f3a0e168ab9a5b80aacf14c18b70366b5c772fb6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 9 Aug 2016 11:58:02 -0700 Subject: [PATCH 043/421] connected > sign in --- .../set-up-a-kiosk-for-windows-10-for-desktop-editions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index b2cb477ef2..7aa85347e3 100644 --- a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -247,7 +247,7 @@ Edit the registry to have an account automatically logged on. ### Sign out of assigned access -To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain connected until an admin account opens **Task Manager** > **Users** and signs out the user account. +To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain signed in until an admin account opens **Task Manager** > **Users** and signs out the user account. If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: From 2fee048d554c19460e5e35d7f178dde169677d78 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 12:06:24 -0700 Subject: [PATCH 044/421] Fixed the strings that mention the server version --- windows/manage/appv-about-appv.md | 2 +- windows/manage/appv-capacity-planning.md | 2 +- ...-deploy-appv-databases-with-sql-scripts.md | 4 +-- ...pv-deploy-the-appv-server-with-a-script.md | 8 ++--- windows/manage/appv-deploy-the-appv-server.md | 18 +++++------ windows/manage/appv-deploying-appv.md | 2 +- .../manage/appv-deploying-the-appv-server.md | 32 +++++++++---------- windows/manage/appv-deployment-checklist.md | 2 +- windows/manage/appv-evaluating-appv.md | 2 +- windows/manage/appv-for-windows.md | 2 +- ...porting-databases-on-separate-computers.md | 6 ++-- ...agement-server-on-a-standalone-computer.md | 2 +- ...-publishing-server-on-a-remote-computer.md | 2 +- ...porting-server-on-a-standalone-computer.md | 2 +- ...-powershell-cmdlets-and-get-cmdlet-help.md | 2 +- windows/manage/appv-maintaining-appv.md | 6 ++-- ...grating-to-appv-from-a-previous-version.md | 13 ++++---- ...ove-the-appv-server-to-another-computer.md | 2 +- windows/manage/appv-planning-checklist.md | 2 +- ...ppv-planning-for-appv-server-deployment.md | 4 +-- ...lanning-for-high-availability-with-appv.md | 2 +- .../manage/appv-planning-to-deploy-appv.md | 4 +-- windows/manage/appv-prerequisites.md | 2 +- windows/manage/appv-reporting.md | 2 +- .../manage/appv-supported-configurations.md | 6 ++-- 25 files changed, 65 insertions(+), 66 deletions(-) diff --git a/windows/manage/appv-about-appv.md b/windows/manage/appv-about-appv.md index 28dd41b085..03b077981a 100644 --- a/windows/manage/appv-about-appv.md +++ b/windows/manage/appv-about-appv.md @@ -173,7 +173,7 @@ Complete the following steps to upgrade each component of the App-V infrastructu

  • If you are upgrading to App-V for Windows server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 server](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/check-reg-key-svr).

    • -

  • Follow the steps in [How to Deploy the App-V server components](appv-deploy-the-appv-server.md)

    • +

  • Follow the steps in [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md)

    •  

    diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md index b41c87dd1b..3c07350030 100644 --- a/windows/manage/appv-capacity-planning.md +++ b/windows/manage/appv-capacity-planning.md @@ -67,7 +67,7 @@ You can also manage your App-V environment using an Electronic Software Distribu - When network bandwidth limitations inhibit electronic software distribution. -- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: +- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: **Important**   The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V Supported Configurations](appv-supported-configurations.md). diff --git a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md index a01fb30d6a..7f75c3060d 100644 --- a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md @@ -179,5 +179,5 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros ## Related topics -- [Deploying the App-V Server](appv-deploying-the-appv-server.md) -- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) +- [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) +- [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) diff --git a/windows/manage/appv-deploy-the-appv-server-with-a-script.md b/windows/manage/appv-deploy-the-appv-server-with-a-script.md index 818bf8ae34..b5c3122c5b 100644 --- a/windows/manage/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/manage/appv-deploy-the-appv-server-with-a-script.md @@ -1,6 +1,6 @@ --- title: How to Deploy the App-V 5.1 Server Using a Script -description: How to Deploy the App-V Server Using a Script +description: How to Deploy the App-V 5.1 Server Using a Script author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -14,9 +14,9 @@ ms.prod: w10 In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. -**To Install the App-V server using a script** +**To Install the App-V 5.1 server using a script** -- Use the following tables for more information about installing the App-V server using the command line. +- Use the following tables for more information about installing the App-V 5.1 server using the command line. **Note**   The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. @@ -777,7 +777,7 @@ In order to complete the **appv\_server\_setup.exe** Server setup successfully u ## Related topics -[Deploying the App-V Server](appv-deploying-the-appv-server.md) +[Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md)   diff --git a/windows/manage/appv-deploy-the-appv-server.md b/windows/manage/appv-deploy-the-appv-server.md index 3838c1812c..1cbab6ab2a 100644 --- a/windows/manage/appv-deploy-the-appv-server.md +++ b/windows/manage/appv-deploy-the-appv-server.md @@ -1,6 +1,6 @@ --- -title: How to Deploy the App-V Server (Windows 10) -description: How to Deploy the App-V Server +title: How to Deploy the App-V 5.1 Server +description: How to Deploy the App-V 5.1 Server author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,9 +8,9 @@ ms.sitesec: library ms.prod: w10 --- -# How to Deploy the App-V server +# How to Deploy the App-V 5.1 Server -Use the following procedure to install the App-V server.. +Use the following procedure to install the App-V 5.1 server. **Before you start:** @@ -24,11 +24,11 @@ Use the following procedure to install the App-V server.. - If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md). -**To install the App-V server** +**To install the App-V 5.1 server** -1. Copy the App-V server installation files to the computer on which you want to install it. +1. Copy the App-V 5.1 server installation files to the computer on which you want to install it. -2. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. +2. Start the App-V 5.1 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. 3. Review and accept the license terms, and choose whether to enable Microsoft updates. @@ -74,7 +74,7 @@ Use the following procedure to install the App-V server.. | Item to configure | Description and examples | | - | - | - Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser
    After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.| + | Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser
    After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.| | **Website name**: Specify the custom name that will be used to run the publishing service.
    If you do not have a custom name, do not make any changes.| |**Port binding**: Specify a unique port number that will be used by App-V. | Example: **12345**
    Ensure that the port specified is not being used by another website. | @@ -113,4 +113,4 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros - [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) -- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +- [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) diff --git a/windows/manage/appv-deploying-appv.md b/windows/manage/appv-deploying-appv.md index 4afd68b171..bf4e076bd8 100644 --- a/windows/manage/appv-deploying-appv.md +++ b/windows/manage/appv-deploying-appv.md @@ -19,7 +19,7 @@ App-V supports a number of different deployment options. This section of the App This section describes how to install the App-V sequencer which is used to virtualize applications, and the App-V client which runs on target computers to facilitate virtualized packages. -- [Deploying the App-V Server](appv-deploying-the-appv-server.md) +- [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) This section provides information about installing the App-V management, publishing, database and reporting severs. diff --git a/windows/manage/appv-deploying-the-appv-server.md b/windows/manage/appv-deploying-the-appv-server.md index 309a23843c..90a078e3d5 100644 --- a/windows/manage/appv-deploying-the-appv-server.md +++ b/windows/manage/appv-deploying-the-appv-server.md @@ -1,6 +1,6 @@ --- -title: Deploying the App-V Server (Windows 10) -description: Deploying the App-V Server +title: Deploying the App-V 5.1 Server +description: Deploying the App-V 5.1 Server author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,15 +8,15 @@ ms.sitesec: library ms.prod: w10 --- -# Deploying the App-V Server +# Deploying the App-V 5.1 Server -You can install the App-V server features by using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). +You can install the Application Virtualization (App-V) 5.1 server features by using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). For information about deploying the App-V Server, see [About App-V](appv-about-appv.md). ->**Important**
    Before you install and configure the App-V servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. +>**Important**
    Before you install and configure the App-V 5.1 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. -## Download and install App-V server components +## Download and install App-V 5.1 server components App-V offers the following five server components, each of which serves a specific purpose in an App-V environment. @@ -24,15 +24,15 @@ App-V offers the following five server components, each of which serves a specif >**Note**
    If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you can still take advantage of the reporting and streaming capabilities in App-V. -- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to deploy the App-V server components](appv-deploy-the-appv-server.md) for more information about the management database. +- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) for more information about the management database. - **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. See [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md) for more information about configuring the publishing server. - **Reporting server.** Use the App-V reporting server to generate reports that help you manage your App-V infrastructure. The reporting server requires a connection to the reporting database. See [About App-V reporting](appv-reporting.md) for more information about the reporting capabilities in App-V. -- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to deploy the App-V server](appv-deploy-the-appv-server.md) for more information about the reporting database. +- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) for more information about the reporting database. -All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: +All five App-V 5.1 server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site. @@ -51,18 +51,18 @@ In large organizations, you might want to install more than one instance of the ## App-V standalone deployment The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this topology for larger deployments. -- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) +- [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) -- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +- [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) -## App-V Server distributed deployment -The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V Server components are deployed across multiple computers, based on the structure and requirements of the organization. +## App-V 5.1 Server distributed deployment +The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V 5.1 Server components are deployed across multiple computers, based on the structure and requirements of the organization. - [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md) -- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +- [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) - [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) @@ -75,8 +75,8 @@ You can also deploy the App-V clients and packages by using an ESD without havin [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) -## App-V Server logs -You can use App-V server log information to help troubleshoot the server installation and operational events while using App-V. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: +## App-V 5.1 Server logs +You can use App-V 5.1 server log information to help troubleshoot the server installation and operational events while using App-V. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: **Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** diff --git a/windows/manage/appv-deployment-checklist.md b/windows/manage/appv-deployment-checklist.md index 2def234fd2..9d692acc2c 100644 --- a/windows/manage/appv-deployment-checklist.md +++ b/windows/manage/appv-deployment-checklist.md @@ -59,7 +59,7 @@ This checklist can be used to help you during an App-V deployment.

    • [How to Install the Sequencer](appv-install-the-sequencer.md)

    • [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)

      • -

    • [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)

      • +

    • [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md)

    diff --git a/windows/manage/appv-evaluating-appv.md b/windows/manage/appv-evaluating-appv.md index 20d2eba290..71b0fe0730 100644 --- a/windows/manage/appv-evaluating-appv.md +++ b/windows/manage/appv-evaluating-appv.md @@ -30,7 +30,7 @@ Use the following links for information about setting up the App-V sequencer and Use the following links for information about setting up the App-V server in your lab environment. -- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) +- [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) - [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) diff --git a/windows/manage/appv-for-windows.md b/windows/manage/appv-for-windows.md index d127094cb6..f7f6ea9af9 100644 --- a/windows/manage/appv-for-windows.md +++ b/windows/manage/appv-for-windows.md @@ -32,7 +32,7 @@ The topics in this section provides information and step-by-step procedures to h [Deploying App-V](appv-deploying-appv.md) - [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) -- [Deploying the App-V Server](appv-deploying-the-appv-server.md) +- [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) - [App-V Deployment Checklist](appv-deployment-checklist.md) - [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md) - [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) diff --git a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md index f9978a7b46..fd30510d36 100644 --- a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -21,7 +21,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance **To install the management database and the management server on separate computers** -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. @@ -50,7 +50,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance **To install the reporting database and the reporting server on separate computers** -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. @@ -79,7 +79,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance **To install the management and reporting databases using App-V database scripts** -1. Copy the App-V server installation files to the computer on which you want to install it on. +1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. 2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: diff --git a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md index de8e7c0416..8dc3be4c50 100644 --- a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md @@ -16,7 +16,7 @@ Use the following procedure to install the management server on a standalone com **To install the management server on a standalone computer and connect it to the database** -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. diff --git a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md index f9f66a2120..4671ecc76a 100644 --- a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md @@ -16,7 +16,7 @@ Use the following procedure to install the publishing server on a separate compu **To install the publishing server on a separate computer** -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. diff --git a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md index 5fbc775cc8..177e3e119f 100644 --- a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -21,7 +21,7 @@ Before performing the following procedure you should read and understand [About **To install the reporting server on a standalone computer and connect it to the database** -1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. diff --git a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index 110f5d08a1..49310ed483 100644 --- a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -43,7 +43,7 @@ Review the following requirements for using the App-V PowerShell cmdlets:

    Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:

    • When you are deploying and configuring the App-V Server:

      -

      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md).

      • +

      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md).

    • After you’ve deployed the App-V Server:

      Use the App-V Management console to add an additional Active Directory group or user. See [How to Add or Remove an Administrator by Using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md).

    diff --git a/windows/manage/appv-maintaining-appv.md b/windows/manage/appv-maintaining-appv.md index 6cf35b1731..ddfa4d502c 100644 --- a/windows/manage/appv-maintaining-appv.md +++ b/windows/manage/appv-maintaining-appv.md @@ -14,17 +14,17 @@ ms.prod: w10 After you have completed all the necessary planning, and then deployment of App-V, you can use the following information to maintain the App-V infrastructure. -## Move the App-V Server +## Move the App-V 5.1 Server -The App-V server connects to the App-V database. Therefore you can install the management component to any computer on the network and then connect it to the App-V database. +The App-V 5.1 server connects to the App-V database. Therefore you can install the management component to any computer on the network and then connect it to the App-V database. [How to Move the App-V Server to Another Computer](appv-move-the-appv-server-to-another-computer.md) ## Determine if an App-V Application is Running Virtualized -Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V or above, should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. +Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index 87958fb0dd..e153ca44c2 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -13,14 +13,13 @@ ms.prod: w10 With Microsoft Application Virtualization (App-V), you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V infrastructure. -However, you cannot migrate directly from App-V 4.x to App-V, you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) +However, you cannot migrate directly from App-V 4.x to App-V for Windows 10—you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating to App-V 5.1 from a Previous Version](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version) **Note**   -App-V packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V packages. +Packages for App-V for Windows 10 are exactly the same as packages for App-V 5.0. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V for Window 10 packages. -For more information about the differences between App-V 4.6 and App-V, see the **Differences between App-4.6 and App-V 5.0 section** of [About App-V 5.0](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/about-app-v-50). +For information about the differences between earlier versions of App-V, see the **Differences between App-4.6 and App-V 5.0 section** of [About App-V 5.0](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/about-app-v-50). -  ## Improvements to the App-V Package Converter @@ -252,7 +251,7 @@ You must be running the latest version of App-V 4.6 to use coexistence mode. Ad   -## Migrating the App-V Server Full Infrastructure +## Migrating the App-V 5.1 Server Full Infrastructure There is no direct method to upgrade to a full App-V infrastructure. Use the information in the following section for information about upgrading the App-V server. @@ -278,8 +277,8 @@ There is no direct method to upgrade to a full App-V infrastructure. Use the inf

    [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).

    -

    Install App-V server.

    -

    [How to Deploy the App-V Server](appv-deploy-the-appv-server.md).

    +

    Install App-V 5.1 server.

    +

    [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md).

    Migrate existing packages.

    diff --git a/windows/manage/appv-move-the-appv-server-to-another-computer.md b/windows/manage/appv-move-the-appv-server-to-another-computer.md index dbbb6a80a6..99d137095c 100644 --- a/windows/manage/appv-move-the-appv-server-to-another-computer.md +++ b/windows/manage/appv-move-the-appv-server-to-another-computer.md @@ -19,7 +19,7 @@ Use the following information to create a new management server console in your The following list displays the steps necessary to create a new management server console: -1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V Server](appv-deploying-the-appv-server.md). +1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md). 2. After you have completed the installation, use the following link to connect it to the App-V database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md). diff --git a/windows/manage/appv-planning-checklist.md b/windows/manage/appv-planning-checklist.md index 91d7f0fe4e..af28d24d8f 100644 --- a/windows/manage/appv-planning-checklist.md +++ b/windows/manage/appv-planning-checklist.md @@ -48,7 +48,7 @@ This checklist can be used to help you plan for preparing your organization for Checklist box

    If you plan to use the App-V management server, plan for the required roles.

    -

    [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md)

    +

    [Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md)

    diff --git a/windows/manage/appv-planning-for-appv-server-deployment.md b/windows/manage/appv-planning-for-appv-server-deployment.md index 982d10f933..efe4f77276 100644 --- a/windows/manage/appv-planning-for-appv-server-deployment.md +++ b/windows/manage/appv-planning-for-appv-server-deployment.md @@ -31,7 +31,7 @@ The App-V server consists of the following features: The following list displays the recommended methods for installing the App-V server infrastructure: -- Install the App-V server. For more information, see [How to Deploy the App-V Server](appv-deploy-the-appv-server.md). +- Install the App-V server. For more information, see [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md). - Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md). @@ -104,7 +104,7 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) -[Deploying the App-V Server](appv-deploying-the-appv-server.md) +[Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md)   diff --git a/windows/manage/appv-planning-for-high-availability-with-appv.md b/windows/manage/appv-planning-for-high-availability-with-appv.md index 9b84aeeb88..73f8c5234a 100644 --- a/windows/manage/appv-planning-for-high-availability-with-appv.md +++ b/windows/manage/appv-planning-for-high-availability-with-appv.md @@ -1,5 +1,5 @@ --- -title: Planning for High Availability with App-V Server (Windows 10) +title: Planning for High Availability with App-V Server description: Planning for High Availability with App-V Server author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization diff --git a/windows/manage/appv-planning-to-deploy-appv.md b/windows/manage/appv-planning-to-deploy-appv.md index a18db4a671..2e60b9cd72 100644 --- a/windows/manage/appv-planning-to-deploy-appv.md +++ b/windows/manage/appv-planning-to-deploy-appv.md @@ -37,11 +37,11 @@ Describes the options and requirements for deploying App-V with an electronic so [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) -## Planning for the App-V Server deployment +## Planning for the App-V 5.1 Server deployment Describes the planning considerations for the App-V Server components and their functions. -[Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) +[Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md) ## Planning for the App-V Sequencer and Client deployment diff --git a/windows/manage/appv-prerequisites.md b/windows/manage/appv-prerequisites.md index 55c44b029c..699986c520 100644 --- a/windows/manage/appv-prerequisites.md +++ b/windows/manage/appv-prerequisites.md @@ -75,7 +75,7 @@ The following table indicates the software that is already installed for differe ## App-V Server prerequisite software -Install the required prerequisite software for the App-V Server components. +Install the required prerequisite software for the App-V 5.1 Server components. ### What to know before you start diff --git a/windows/manage/appv-reporting.md b/windows/manage/appv-reporting.md index a23ad9f73a..75613f4f57 100644 --- a/windows/manage/appv-reporting.md +++ b/windows/manage/appv-reporting.md @@ -308,7 +308,7 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros ## Related topics -[Deploying the App-V Server](appv-deploying-the-appv-server.md) +[Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](appv-install-the-reporting-server-on-a-standalone-computer.md) diff --git a/windows/manage/appv-supported-configurations.md b/windows/manage/appv-supported-configurations.md index 67662f89bd..b2521e81f4 100644 --- a/windows/manage/appv-supported-configurations.md +++ b/windows/manage/appv-supported-configurations.md @@ -18,13 +18,13 @@ This topic specifies the requirements to install and run App-V in your environme This section lists the operating system and hardware requirements for all of the App-V Server components. -### Unsupported App-V Server scenarios +### Unsupported App-V 5.1 Server scenarios -The App-V Server does not support the following scenarios: +The App-V 5.1 Server does not support the following scenarios: - Deployment to a computer that runs the Server Core installation option. -- Deployment to a computer that runs a previous version of App-V Server components. You can install App-V side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. +- Deployment to a computer that runs a previous version of App-V 5.1 Server components. You can install App-V side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. - Deployment to a computer that runs Microsoft SQL Server Express edition. From edb24168679e51b2af5f64043838b55a59bf6d13 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 13:35:18 -0700 Subject: [PATCH 045/421] Fixed strings that mentioned server version --- windows/manage/appv-capacity-planning.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md index 3c07350030..b0af8a88d6 100644 --- a/windows/manage/appv-capacity-planning.md +++ b/windows/manage/appv-capacity-planning.md @@ -925,7 +925,7 @@ For example, an average user can stream a 100 MB package in less than 2 minutes, The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. -## Combining App-V Server Roles +## Combining App-V 5.1 Server Roles Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another. From a535fc26cbf542252cdde8e9d5c609e5d7179b38 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 13:37:38 -0700 Subject: [PATCH 046/421] Took out tables re client, RDP client, Config Manager, replaced w sentences --- .../manage/appv-supported-configurations.md | 311 +----------------- 1 file changed, 4 insertions(+), 307 deletions(-) diff --git a/windows/manage/appv-supported-configurations.md b/windows/manage/appv-supported-configurations.md index b2521e81f4..632faf1ec3 100644 --- a/windows/manage/appv-supported-configurations.md +++ b/windows/manage/appv-supported-configurations.md @@ -271,129 +271,11 @@ The following table lists the SQL Server versions that are supported for the App   -## App-V client system requirements +## App-V client requirements and Remote Desktop Services client requirements +With Windows 10, version 1607 and later releases, the App-V client is included with Windows 10 Enterprise and Windows 10 Education. The App-V client is no longer part of the Microsoft Desktop Optimization Pack. Before you can use the App-V client, it must be enabled, as described in [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). -The following table lists the operating systems that are supported for the App-V client installation. - -> [!NOTE] -> App-V is included with Windows 10, version 1607 and later. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService packSystem architecture

    Windows 10, version 1511

    32-bit or 64-bit

    Windows 10, version 1507

    32-bit or 64-bit

    Windows 8.1

    32-bit or 64-bit

    Windows 8

    32-bit or 64-bit

    Windows /p>

    SP1

    32-bit or 64-bit

    - -  - -The following App-V client installation scenarios are not supported, except as noted: - -- Computers that run Windows Server - -- Computers that run App-V 4.6 SP1 or earlier versions - -- The App-V Remote Desktop services client is supported only for RDS-enabled servers - -### App-V client hardware requirements - -The following list displays the supported hardware configuration for the App-V client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## Remote Desktop Services client system requirements - - -The following table lists the operating systems that are supported for App-V Remote Desktop Services (RDS) client installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2016

    64-bit

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - -  - -### Remote Desktop Services client hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space +Similarly, the App-V Remote Desktop Services (RDS) client is included with Windows Server 2016 Standard and Windows Server 2016 Datacenter. ## Sequencer system requirements @@ -452,7 +334,6 @@ The following table lists the operating systems that are supported for the App-V -  ### Sequencer hardware requirements @@ -460,191 +341,7 @@ See the Windows or Windows Server documentation for the hardware requirements. A ## Supported versions of System Center Configuration Manager - -The App-V client supports the following versions of System Center Configuration Manager: - -- Microsoft System Center 2012 Configuration Manager - -- System Center 2012 R2 Configuration Manager - -- System Center 2012 R2 Configuration Manager SP1 - -The following App-V and System Center Configuration Manager version matrix shows all officially supported combinations of App-V and Configuration Manager. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    App-V VersionSystem Center Configuration Manager 2007System Center 2012 Configuration ManagerSystem Center 2012 Configuration Manager SP1System Center 2012 R2 Configuration ManagerSystem Center 2012 R2 Configuration Manager SP1System Center 2012 Configuration Manager SP2System Center Configuration Manager Version 1511

    App-V 4.5

    R2

    No

    No

    No

    No

    No

    No

    App-V 4.5 CU1

    R2

    No

    No

    No

    No

    No

    No

    App-V 4.5 SP1

    R2

    No

    No

    No

    No

    No

    No

    App-V 4.5 SP2

    R2

    No

    No

    No

    No

    No

    No

    App-V 4.6

    R2, SP1

    No

    No

    No

    No

    No

    No

    App-V 4.6 SP1

    R2, R3, SP2

    Yes

    Yes

    Yes

    No

    No

    No

    App-V 4.6 SP2

    R2, R3, SP2

    Yes

    Yes

    Yes

    No

    No

    No

    App-V 4.6 SP3

    R2, R3, SP2

    No

    Yes

    Yes

    No

    Yes

    Yes

    App-V 5.0

    MSI-Wrapper-Only

    No

    Yes

    Yes

    Yes

    Yes

    Yes

    App-V 5.0 SP1

    MSI-Wrapper Only

    No

    Yes

    Yes

    Yes

    Yes

    Yes

    App-V 5.0 SP2

    MSI-Wrapper Only

    No

    2012 SP1 CU4

    -

    App-V 5.0 HF5 or later

    2012 R2 CU1

    -

    App-V 5.0 HF5 or later

    Yes

    With App-V 5.0 SP2 HF5 or later

    With App-V 5.0 SP2 HF5 or later

    App-V 5.0 SP2 HF4

    MSI-Wrapper Only

    No

    2012 SP1 CU4

    -

    App-V 5.0 HF5 or later

    2012 R2 CU1

    -

    App-V 5.0 HF5 or later

    Yes

    Requires HF5 or later

    Requires HF5 or later

    App-V 5.0 SP3

    MSI-Wrapper Only

    No

    2012 SP1 CU4

    2012 R2 CU1

    Yes

    Yes

    Yes

    App-V

    MSI-Wrapper Only

    No

    2012 SP1 CU4

    2012 R2 CU1

    Yes

    Yes

    Yes

    - -  - -For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](http://technet.microsoft.com/library/jj822982.aspx). +The App-V client works with System Center Configuration Manager versions starting with Technical Preview for System Center Configuration Manager, version 1606. ## Have a suggestion for App-V? From bc8fb3e1fd7ff3bf96b9bccba8d090d86fafe998 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 13:46:02 -0700 Subject: [PATCH 047/421] Fixed a link --- windows/manage/appv-release-notes-for-appv-for-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index 1d63f22499..94f9c9116f 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -21,7 +21,7 @@ When MSI packages are generated by an older sequencer (5.1 and below), they incl **Workaround**: -1. Install the latest App-V sequencer, which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer). +1. Install the latest App-V sequencer, which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). 2. Ensure that you have installed the **MSI Tools** included in the Windows 10 SDK, available as follows: From 0a46338f375db711ae1d834987f7d26b23fe22de Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 13:55:28 -0700 Subject: [PATCH 048/421] Fixed vsn name for Windows 10, version 1607 --- windows/manage/appv-release-notes-for-appv-for-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index 94f9c9116f..99c9a92e07 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -13,7 +13,7 @@ ms.prod: w10 Applies to: Windows 10, version 1607 -The following is a known issue in Microsoft Application Virtualization (App-V) Windows 10 Anniversary Update: +The following is a known issue in Microsoft Application Virtualization (App-V) in Windows 10, version 1607: **MSI packages generated by App-V 5.1 and older sequencer fail to install on computers with built-in App-V client** From d821edab99622b71872ee1282c58bdc448f3a650 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 9 Aug 2016 13:57:18 -0700 Subject: [PATCH 049/421] enhanced the readme and contributing files --- CONTRIBUTING.md | 53 ++++++++++++++++++++++++++++++++++++++++++++++ README.md | 22 +++++++++++++++---- education/index.md | 4 +++- 3 files changed, 74 insertions(+), 5 deletions(-) create mode 100644 CONTRIBUTING.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000000..b909c0a74e --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,53 @@ +# Contributing to Windows IT professional documentation + +Thank you for your interest in the Windows IT professional documentation! We appreciate your feedback, edits, and additions to our docs. +This page covers the basic steps for contributing to our technical documentation. + +## Sign a CLA + +All contributors who are ***not*** a Microsoft employee must [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before contributing to any Microsoft repositories. +If you've already contributed to Microsoft repositories in the past, congratulations! +You've already completed this step. + +## Editing topics + +We've tried to make editing an existing file as simple as possible. + +- If you're already in the repo, just navigate to the file you want to make the edits to and click the **Edit** button. +- Alternatively, if you're viewing a TechNet page in your browser, click the **Contribute** button on the top right of the page. You will be redirected to the relevant source file in the repo, where you can click the **Edit** button. + +When you're done, submit a pull request back to the master branch of the official repository. + +After you create the pull request, a member of the writing team will review your changes. + +If your request is accepted, updates are published to one of the following places: + +- [Windows 10](https://technet.microsoft.com/itpro/windows) +- [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) +- [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) +- [Surface](https://technet.microsoft.com/itpro/surface) +- [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) +- [Windows 10 for Education](https://technet.microsoft.com/edu/windows) +- [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) + +## Making more substantial changes + +To make substantial changes to an existing article, add or change images, or contribute a new article, you will need to create a local clone of the content. +For info about creating a fork or clone, see the GitHub help topic, [Fork a Repo](https://help.github.com/articles/fork-a-repo/). + +Fork the official repo into your personal GitHub account, and then clone the fork down to your local device. Work locally, then push your changes back into your fork. Then open a pull request back to the master branch of the official repo. + +## Using issues to provide feedback on documentation + +If you just want to provide feedback rather than directly modifying actual documentation pages, you can create an issue in the repository. + +At the top of a topic page you'll see an **Issues** tab. Click the tab and then click the **New issue** button. + +Be sure to include the topic title and the URL for the page you're submitting the issue for, if that page is different from the page you launched the **New issue** dialog from. + +## Resources + +You can use your favorite text editor to edit Markdown. We recommend [Visual Studio Code](https://code.visualstudio.com/), a free lightweight open source editor from Microsoft. + +You can learn the basics of Markdown in just a few minutes. To get started, check out [Mastering Markdown](https://guides.github.com/features/mastering-markdown/). + diff --git a/README.md b/README.md index f5b28b423b..503b25df69 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,20 @@ -# win-cpub-itpro-docs -This repo hosts the WDG ITPro content that is published to TechNet. +# Windows IT professional documentation + +Welcome! This repository houses the docs that are written for IT professionals for the following products: + +- [Windows 10](https://technet.microsoft.com/itpro/windows) +- [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer) +- [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge) +- [Surface](https://technet.microsoft.com/itpro/surface) +- [Surface Hub](https://technet.microsoft.com/itpro/surface-hub) +- [Windows 10 for Education](https://technet.microsoft.com/edu/windows) +- [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop) + +## Contributing + +We actively merge contributions into this repository via [pull request](https://help.github.com/articles/using-pull-requests/) into the *master* branch. +If not are not a Microsoft employee, before you submit a pull request you must [sign a Contribution License Agreement](https://cla.microsoft.com/) to ensure that the community is free to use your submissions. +For more information on contributing, read our [contributions guide](CONTRIBUTING.md). + This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. - -English Handoff Folder Structure Demo! diff --git a/education/index.md b/education/index.md index beccdc8994..f468605351 100644 --- a/education/index.md +++ b/education/index.md @@ -1 +1,3 @@ -# Index test file for Open Publishing \ No newline at end of file +--- +redirect_url: https://technet.microsoft.com/edu/windows/ +--- From 30a5fea6cc2d513d6a4b887cb320b981247cbf2c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 9 Aug 2016 14:01:18 -0700 Subject: [PATCH 050/421] first version --- license.md | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 license.md diff --git a/license.md b/license.md new file mode 100644 index 0000000000..8e1a232216 --- /dev/null +++ b/license.md @@ -0,0 +1,7 @@ +Copyright (c) Microsoft Corporation. Distributed under the following terms: + +1. Microsoft and any contributors to this project each grants you a license, under its respective copyrights, to the documentation under the [Creative Commons Attribution 3.0 United States License](http://creativecommons.org/licenses/by/3.0/us/legalcode). In addition, with respect to any sample code contained in the documentation, Microsoft and any such contributors grants you an additional license, under its respective intellectual property rights, to use the code to develop or design your software for Microsoft Windows. + +2. Microsoft, Windows, and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. This license does not grant you rights to use any names, logos, or trademarks. For Microsoft’s general trademark guidelines, go to [http://go.microsoft.com/fwlink/?LinkID=254653](http://go.microsoft.com/fwlink/?LinkID=254653). + +3. Microsoft and any contributors reserves all others rights, whether under copyrights, patents, or trademarks, or by implication, estoppel or otherwise. From 57f95dd508ba20f4d425bc9f2559e57386963a05 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 14:17:44 -0700 Subject: [PATCH 051/421] Deleted mention of AppvClientEnabled --- windows/manage/appv-enable-the-app-v-desktop-client.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/appv-enable-the-app-v-desktop-client.md b/windows/manage/appv-enable-the-app-v-desktop-client.md index fe8bc4ffdc..f85c10f998 100644 --- a/windows/manage/appv-enable-the-app-v-desktop-client.md +++ b/windows/manage/appv-enable-the-app-v-desktop-client.md @@ -32,7 +32,7 @@ With Windows 10, the App-V client is installed automatically. You need to enable 3. Restart the device. -4. To verify that the App-V client is enabled on the device, enter **AppvClientEnabled** or **Get-AppvStatus** in Windows PowerShell. +4. To verify that the App-V client is enabled on the device, enter **Get-AppvStatus** in Windows PowerShell. See [Using the client management console](appv-using-the-client-management-console.md) for information about configuring the App-V client. From 7a1804de444b524668eacd03de1b8b7ef8c2bd9b Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 14:33:25 -0700 Subject: [PATCH 052/421] Fixed server version strings --- ...ppv-planning-for-appv-server-deployment.md | 27 ++++++------------- 1 file changed, 8 insertions(+), 19 deletions(-) diff --git a/windows/manage/appv-planning-for-appv-server-deployment.md b/windows/manage/appv-planning-for-appv-server-deployment.md index efe4f77276..f8bef54407 100644 --- a/windows/manage/appv-planning-for-appv-server-deployment.md +++ b/windows/manage/appv-planning-for-appv-server-deployment.md @@ -1,6 +1,6 @@ --- -title: Planning for the App-V Server Deployment (Windows 10) -description: Planning for the App-V Server Deployment +title: Planning for the App-V 5.1 Server Deployment (Windows 10) +description: Planning for the App-V 5.1 Server Deployment author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,15 +9,15 @@ ms.prod: w10 --- -# Planning for the App-V Server Deployment +# Planning for the App-V 5.1 Server Deployment The Microsoft Application Virtualization (App-V) server infrastructure consists of a set of specialized features that can be installed on one or more server computers, based on the requirements of the enterprise. -## Planning for App-V Server Deployment +## Planning for App-V 5.1 Server Deployment -The App-V server consists of the following features: +The App-V 5.1 server consists of the following features: - Management Server – provides overall management functionality for the App-V infrastructure. @@ -29,9 +29,9 @@ The App-V server consists of the following features: - Reporting Database – facilitates database predeployments for App-V reporting. -The following list displays the recommended methods for installing the App-V server infrastructure: +The following list displays the recommended methods for installing the App-V 5.1 server infrastructure: -- Install the App-V server. For more information, see [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md). +- Install the App-V 5.1 server. For more information, see [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md). - Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md). @@ -54,7 +54,7 @@ The Management Server does not perform any load balancing. The associated metada ## Server-Related Protocols and External Features -The following displays information about server-related protocols used by the App-V servers. The table also includes the reporting mechanism for each server type. +The following displays information about server-related protocols used by the App-V 5.1 servers. The table also includes the reporting mechanism for each server type. @@ -96,21 +96,10 @@ The following displays information about server-related protocols used by the Ap ## Have a suggestion for App-V? - Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics - [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) - -  - -  - - - - - From 2bd2420778e3f596401214c8055c8f5e79e19dba Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 9 Aug 2016 14:37:06 -0700 Subject: [PATCH 053/421] changing wording around Device Guard --- windows/keep-secure/windows-10-security-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 6a822ec11e..87cd7086c5 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -538,7 +538,7 @@ Historically, most malware has been unsigned. Simply by deploying code integrity The core functionality and protection of Device Guard starts at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel VT x and AMD V, will be able to take advantage of a VBS environment that dramatically enhances Windows security by isolating critical Windows services from the operating system itself. This isolation is necessary, because you must assume that the operating system kernel will be compromised, and you need assurance that some processes will remain secure. -Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to protect all kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can’t happen in the first place. +Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can’t happen in the first place. Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dgwithcg) section. **Device Guard with AppLocker** From bdf64935ff36fb33a9675127dab272a2ff69e2c5 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 14:50:54 -0700 Subject: [PATCH 054/421] Fixed server version strings --- windows/manage/appv-security-considerations.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/manage/appv-security-considerations.md b/windows/manage/appv-security-considerations.md index 79d71d971a..0a114d5036 100644 --- a/windows/manage/appv-security-considerations.md +++ b/windows/manage/appv-security-considerations.md @@ -29,7 +29,7 @@ Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that wa **Understand the security risks.** The most serious risk to App-V is that its functionality could be hijacked by an unauthorized user who could then reconfigure key data on App-V clients. The loss of App-V functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. +**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V 5.1 server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V 5.1 servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. **Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V, subscribe to the Security Notification service (). @@ -38,7 +38,7 @@ Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that wa ## Accounts and groups in App-V -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V local groups on the App-V servers. +A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V local groups on the App-V 5.1 servers. **Note**   App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. @@ -47,7 +47,7 @@ App-V client computer accounts that need to connect to the publishing server mus ### App-V server security -No groups are created automatically during App-V Setup. You should create the following Active Directory Domain Services global groups to manage App-V server operations. +No groups are created automatically during App-V Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.1 server operations.
    From a09d5a04a249229d00b48ec6dfa609e8d5e1a81f Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 9 Aug 2016 15:02:40 -0700 Subject: [PATCH 055/421] Updated four topic titles --- windows/manage/TOC.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index b46f78d870..a976bf9afc 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -52,7 +52,7 @@ ##### [App-V Capacity Planning](appv-capacity-planning.md) ##### [Planning for High Availability with App-V](appv-planning-for-high-availability-with-appv.md) ##### [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) -##### [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) +##### [Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md) ##### [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md) ##### [Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md) ##### [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md) @@ -65,9 +65,9 @@ ##### [How to Install the App-V Client for Shared Content Store Mode](appv-install-the-appv-client-for-shared-content-store-mode.md) ##### [How to Install the Sequencer](appv-install-the-sequencer.md) ##### [How to Modify App-V Client Configuration Using the ADMX Template and Group Policy](appv-modify-client-configuration-with-the-admx-template-and-group-policy.md) -#### [Deploying the App-V Server](appv-deploying-the-appv-server.md) -##### [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) -##### [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +#### [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) +##### [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) +##### [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) ##### [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md) ##### [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) ##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) From 11c8f5863c6979cbb64cdb324351ae3a59b46566 Mon Sep 17 00:00:00 2001 From: Justinha Date: Tue, 9 Aug 2016 16:03:59 -0700 Subject: [PATCH 056/421] added ProviderType to inf file --- windows/keep-secure/bitlocker-how-to-enable-network-unlock.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md index 16e0aa12b2..1884657372 100644 --- a/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md +++ b/windows/keep-secure/bitlocker-how-to-enable-network-unlock.md @@ -149,6 +149,7 @@ To create a self-signed certificate, do the following: ``` syntax [NewRequest] Subject="CN=BitLocker Network Unlock certificate" + ProviderType=0 Exportable=true RequestType=Cert KeyUsage="CERT_KEY_ENCIPHERMENT_KEY_USAGE" From b2156a02d8b81be64da7223f2dfe2ee222c0d512 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 10 Aug 2016 15:32:29 +1000 Subject: [PATCH 057/421] Add localization tag = high --- ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 9 ++++---- ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 3 ++- ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 21 ++++++++++--------- ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 3 ++- ...ows-defender-advanced-threat-protection.md | 3 ++- ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 4 ++-- ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 15 ++++++------- ...ows-defender-advanced-threat-protection.md | 3 ++- ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + ...ows-defender-advanced-threat-protection.md | 1 + 30 files changed, 56 insertions(+), 27 deletions(-) diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index 74189887bb..02d66f7c0d 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # View and organize the Windows Defender Advanced Threat Protection Alerts queue diff --git a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md index 6cc5b28e2f..30b45491f9 100644 --- a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- title: Assign user access to the Windows Defender Advanced Threat Protection portal -description: Assign read and write or read only access to the Windows Defender Advanced Threat Protection portal. +description: Assign read and write or read only access to the Windows Defender Advanced Threat Protection portal. keywords: assign user roles, assign read and write access, assign read only access, user, user roles, roles search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Assign user access to the Windows Defender ATP portal @@ -30,14 +31,14 @@ Users with full access can log in, view all system information and resolve alert Assigning full access rights requires adding the users to the “Security Administrator” or “Global Administrator” AAD built-in roles. **Read only access**
    -Users with read only access can log in, view all alerts, and related information. +Users with read only access can log in, view all alerts, and related information. They will not be able to change alert states, submit files for deep analysis or perform any state changing operations. Assigning read only access rights requires adding the users to the “Security Reader” AAD built-in role. Use the following steps to assign security roles: - Preparations: - - Install Azure PowerShell. For more information see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/en-us/documentation/articles/powershell-install-configure/).
    - + - Install Azure PowerShell. For more information see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/en-us/documentation/articles/powershell-install-configure/).
    + > [!NOTE] > You need to run the PowerShell cmdlets in an elevated command-line. diff --git a/windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md index 5ee2fbe06a..51c6a67f78 100644 --- a/windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure an Azure Active Directory application for SIEM integration diff --git a/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md index bd262bbc8a..cb5fb08c28 100644 --- a/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure HP ArcSight to consume Windows Defender ATP alerts @@ -56,7 +57,7 @@ The following steps assume that you have completed all the required steps in [Be 5. In the form fill in the following required fields with these values: >[!NOTE] >All other values in the form are optional and can be left blank. - +
    diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index 535be7d761..0dc00ad4ef 100644 --- a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure endpoints using Group Policy diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 14be889faa..04ba717eb7 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure endpoints using Mobile Device Management tools @@ -20,7 +21,7 @@ author: mjcaparas - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints. +You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints. For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). @@ -28,10 +29,10 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). -### Onboard and monitor endpoints +### Onboard and monitor endpoints 1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - + a. Click **Endpoint Management** on the **Navigation pane**. b. Select **Mobile Device Management/Microsoft Intune**, click **Download package** and save the .zip file. @@ -51,8 +52,8 @@ Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | S Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | TRUE | Windows Defender ATP service is running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 1 | Onboarded to Windows Defender ATP | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Use OrgID from onboarding file | Onboarded to Organization ID - Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
    Default value: 1 | Windows Defender ATP Sample sharing is enabled - + Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
    Default value: 1 | Windows Defender ATP Sample sharing is enabled + > [!NOTE] > The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated. @@ -67,12 +68,12 @@ For security reasons, the package used to offboard endpoints will expire 30 days 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. - + b. Under **Endpoint offboarding** section, select **Mobile Device Management /Microsoft Intune**, click **Download package** and save the .zip file. - + 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding*. -3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). +3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). Offboarding - Use the offboarding policies to remove configuration settings on endpoints. These policies can be sub-categorized to: - Offboarding @@ -81,7 +82,7 @@ Offboarding - Use the offboarding policies to remove configuration settings on e Policy | OMA-URI | Type | Value | Description :---|:---|:---|:---|:--- -Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Copy content from offboarding MDM file | Offboarding +Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Copy content from offboarding MDM file | Offboarding Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP @@ -92,5 +93,5 @@ Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) - [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 1d009b3943..c7493e5656 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure endpoints using System Center Configuration Manager diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md index 1e740f14b3..bc8fe33b4f 100644 --- a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure endpoints using a local script diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index bd69be41b4..fd3f14562f 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure Windows Defender ATP endpoints @@ -20,7 +21,7 @@ author: mjcaparas - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -Endpoints in your organization must be configured so that the Windows Defender ATP service can get telemetry from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization. +Endpoints in your organization must be configured so that the Windows Defender ATP service can get telemetry from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization. Windows Defender ATP supports the following deployment tools and methods: diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index bc045d449a..526c3cf5d9 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- @@ -79,7 +80,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover ``` HardDrivePath\WDATPConnectivityAnalyzer.cmd ``` - Replace *HardDrivePath* with the path where the WDATPConnectivityAnalyzer tool was downloaded to, for example + Replace *HardDrivePath* with the path where the WDATPConnectivityAnalyzer tool was downloaded to, for example ```text C:\Work\tools\WDATPConnectivityAnalyzer\WDATPConnectivityAnalyzer.cmd ``` diff --git a/windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md index 9811157abe..75a1c0f0a0 100644 --- a/windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure security information and events management (SIEM) tools to consume alerts diff --git a/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md index fc3fe7916f..8033431e7e 100644 --- a/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Configure Splunk to consume Windows Defender ATP alerts diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index e68df885fb..bebd3a0cdb 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # View the Windows Defender Advanced Threat Protection Dashboard diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 4a509cf46a..715979e936 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Windows Defender ATP data storage and privacy @@ -44,7 +45,7 @@ Microsoft does not mine your data for advertising or for any other purpose other When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in Europe or United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation. ## Is my data isolated from other customer data? -Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides. +Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides. ## How does Microsoft prevent malicious insider activities and abuse of high privilege roles? @@ -70,4 +71,3 @@ Your data will be kept for a period of at least 90 days, during which it will be ## Can Microsoft help us maintain regulatory compliance? Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Windows Defender ATP services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001. The service is designed, implemented, and maintained according to the compliance and privacy principles of ISO 27001, as well as Microsoft’s compliance standards. By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service. - diff --git a/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md b/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md index 2ad4b75d16..84d052ec72 100644 --- a/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Windows Defender compatibility diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md index 3dd165c68a..4c51d1c44f 100644 --- a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: iaanw +localizationpriority: high --- diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index 8bd01c944f..893a914547 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate Windows Defender Advanced Threat Protection alerts @@ -56,25 +57,25 @@ Some actor profiles include a link to download a more comprehensive threat intel ![A detailed view of an alert when clicked](images/alert-details.png) ## Incident graph -The incident graph provides a visual representation of where an alert was seen, events that triggered the alert, and which other machines are affected by the event. It provides an illustrated alert footprint on the original machine and expands to show the footprint of each alert event on other machines. +The incident graph provides a visual representation of where an alert was seen, events that triggered the alert, and which other machines are affected by the event. It provides an illustrated alert footprint on the original machine and expands to show the footprint of each alert event on other machines. -You can click the circles on the incident graph to expand the nodes and view the associated events or files related to the alert. +You can click the circles on the incident graph to expand the nodes and view the associated events or files related to the alert. ## Alert spotlight The alert spotlight feature helps ease investigations by highlighting alerts related to a specific machine and events. You can highlight an alert and its related events in the machine timeline to increase your focus during an investigation. -You can click on the machine link from the alert view to see the alerts related to the machine. +You can click on the machine link from the alert view to see the alerts related to the machine. > [!NOTE] > This shortcut is not available from the Incident graph machine links. -Alerts related to the machine are displayed under the **Alerts related to this machine** section. -Clicking on an alert row takes you the to the date in which the alert was flagged on **Machine timeline**. This eliminates the need to manually filter and drag the machine timeline marker to when the alert was seen on that machine. +Alerts related to the machine are displayed under the **Alerts related to this machine** section. +Clicking on an alert row takes you the to the date in which the alert was flagged on **Machine timeline**. This eliminates the need to manually filter and drag the machine timeline marker to when the alert was seen on that machine. -You can also choose to highlight an alert from the **Alerts related to this machine** or from the **Machine timeline** section to see the correlation between the alert and other events that occurred on the machine. Right-click on any alert from either section and select **Mark related events**. This highlights alerts and events that are related and helps differentiate between the other alerts listed in the timeline. Highlighted events are displayed in all filtering modes whether you choose to view the timeline by **Detections**, **Behaviours**, or **Verbose**. +You can also choose to highlight an alert from the **Alerts related to this machine** or from the **Machine timeline** section to see the correlation between the alert and other events that occurred on the machine. Right-click on any alert from either section and select **Mark related events**. This highlights alerts and events that are related and helps differentiate between the other alerts listed in the timeline. Highlighted events are displayed in all filtering modes whether you choose to view the timeline by **Detections**, **Behaviours**, or **Verbose**. -You can also remove the highlight by right-clicking a highlighted alert and selecting **Unmark related events**. +You can also remove the highlight by right-clicking a highlighted alert and selecting **Unmark related events**. ### Related topics diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index d138e36e1f..cab6e62c2d 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -1,13 +1,14 @@ --- title: Investigate Windows Defender Advanced Threat Protection domains description: Use the investigation options to see if machines and servers have been communicating with malicious domains. -keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL +keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate a domain associated with a Windows Defender ATP alert diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index 6c1309102d..935b8f7511 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate a file associated with a Windows Defender ATP alert diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index dd72b28bc9..dc852cb406 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate an IP address associated with a Windows Defender ATP alert diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 7eae125102..561daeebdd 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Investigate machines in the Windows Defender ATP Machines view diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index ef1ab6abe0..9e115b6e6f 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Manage Windows Defender Advanced Threat Protection alerts diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 85249ee5d8..32e4420124 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: iaanw +localizationpriority: high --- # Minimum requirements for Windows Defender ATP diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 1c962bc1ec..b584f2eb7b 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: iaanw +localizationpriority: high --- # Onboard and set up Windows Defender Advanced Threat Protection diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index 177d0998d6..9d6334217d 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: DulceMV +localizationpriority: high --- # Windows Defender Advanced Threat Protection portal overview diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index e45619b0a3..4b5dd38660 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: DulceMV +localizationpriority: high --- # Windows Defender Advanced Threat Protection settings diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 2025b51e99..a88d28abcf 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 5ed6bf4bc5..770c693912 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Troubleshoot Windows Defender Advanced Threat Protection diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index cadbd4c872..6be25ce91e 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Use the Windows Defender Advanced Threat Protection portal diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index 108dd74507..01fccfad1a 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -8,6 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +localizationpriority: high --- # Windows Defender Advanced Threat Protection From ff2966768d43466d11a05e3295fa3f8f04fbf6ee Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 10 Aug 2016 07:31:27 -0700 Subject: [PATCH 058/421] add updates and redirect change history --- .../change-history-for-what-s-new-in-windows-10.md | 1 + windows/whats-new/whats-new-windows-10-version-1607.md | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md index 750a878d7d..a38cbf4702 100644 --- a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md +++ b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: TrudyHa +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/whats-new/index --- # Change history for What's new in Windows 10 diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index 5d509f5ee2..fa89197f86 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -50,6 +50,14 @@ The Upgrade Analytics workflow steps you through the discovery and rationalizati [Learn more about planning and managing Windows upgrades with Windows Upgrade Analytics.](../deploy/manage-windows-upgrades-with-upgrade-analytics.md) +## Windows updates + +Windows 10, version 1607, provides administrators with increased control over updates by changing the update deferral increment from weeks to days. Other changes: + +- Quality Updates can be deferred up to 30 days and paused for 35 days +- Feature Updates can be deferred up to 180 days and paused for 60 days +- Update deferrals can be applied to both Current Branch (CB) and Current Branch for Business (CBB) + ## Security ### Credential Guard and Device Guard From 4a100e89809d688be6f98f6e410d40f9138cf7e8 Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Tue, 9 Aug 2016 19:46:16 -0700 Subject: [PATCH 059/421] First batch of App-V updates --- windows/manage/appv-about-appv.md | 131 ++++-------------- windows/manage/appv-capacity-planning.md | 8 +- ...-deploy-appv-databases-with-sql-scripts.md | 6 +- ...pv-deploy-the-appv-server-with-a-script.md | 12 +- windows/manage/appv-deploy-the-appv-server.md | 57 ++++---- windows/manage/appv-deploying-appv.md | 6 +- .../manage/appv-deploying-the-appv-server.md | 40 +++--- windows/manage/appv-deployment-checklist.md | 2 +- .../appv-enable-the-app-v-desktop-client.md | 8 +- windows/manage/appv-evaluating-appv.md | 2 +- windows/manage/appv-for-windows.md | 2 +- windows/manage/appv-getting-started.md | 8 +- ...porting-databases-on-separate-computers.md | 6 +- ...agement-server-on-a-standalone-computer.md | 2 +- ...-publishing-server-on-a-remote-computer.md | 2 +- ...porting-server-on-a-standalone-computer.md | 2 +- ...-powershell-cmdlets-and-get-cmdlet-help.md | 2 +- windows/manage/appv-maintaining-appv.md | 9 +- ...grating-to-appv-from-a-previous-version.md | 8 +- ...ove-the-appv-server-to-another-computer.md | 2 +- .../manage/appv-planning-to-deploy-appv.md | 4 +- windows/manage/appv-prerequisites.md | 2 +- ...appv-release-notes-for-appv-for-windows.md | 4 +- windows/manage/appv-reporting.md | 2 +- .../manage/appv-supported-configurations.md | 6 +- ...indows-10-from-an-existing-installation.md | 6 +- 26 files changed, 133 insertions(+), 206 deletions(-) diff --git a/windows/manage/appv-about-appv.md b/windows/manage/appv-about-appv.md index 03b077981a..f7d8e7187d 100644 --- a/windows/manage/appv-about-appv.md +++ b/windows/manage/appv-about-appv.md @@ -1,6 +1,6 @@ --- -title: About App-V (Windows 10) -description: About App-V +title: What's new in App-V for Windows 10 (Windows 10) +description: Discusses what's new in App-V for Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,118 +9,40 @@ ms.prod: w10 --- -# About App-V for Windows +# What's new in App-V Applies to: Windows 10, version 1607 -Review the following sections for information about significant changes that apply to Application Virtualization (App-V) for Windows: +Microsoft Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. -[App-V software prerequisites and supported configurations](#bkmk-51-prereq-configs) - -[Migrating to App-V](#bkmk-migrate-to-51) - -[What’s New in App-V](#bkmk-whatsnew) - -[App-V support for Windows 10](#bkmk-win10support) - -[App-V Management Console Changes](#bkmk-mgmtconsole) - -[Sequencer Improvements](#bkmk-seqimprove) - -[Improvements to Package Converter](#bkmk-pkgconvimprove) - -[Support for multiple scripts on a single event trigger](#bkmk-supmultscripts) - -[Hardcoded path to installation folder is redirected to virtual file system root](#bkmk-hardcodepath) - -## App-V for Windows software prerequisites and supported configurations +Application Virtualization (App-V) for Windows 10, version 1607, includes these new features and capabilities compared to App-V 5.1. See [App-V release notes](appv-release-notes-for-appv-for-windows.md) for more information about the App-V for Windows 10, version 1607 release. -Review the following topics for information about App-V for Windows software prerequisites and supported configurations. +## App-V is now a feature in Windows 10 -
    ---- - - - - - - - - - - - - - - - - -
    Links to prerequisites and supported configurations topicsDescription

    [App-V Prerequisites](appv-prerequisites.md)

    Prerequisite software that you must install before you can get started with App-V for Windows

    [App-V Supported Configurations](appv-supported-configurations.md)

    Supported operating systems and hardware requirements for the App-V server, sequencer, and client components

    +With Windows 10, version 1607 and later releases, Application Virtualization (App-V) is included with [Windows 10 for Enterprise and Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. + +For information about earlier versions of App-V, see [MDOP Information Experience](https://technet.microsoft.com/itpro/mdop/index). + +The changes in App-V for Windows 10, version 1607 impact already existing implementations of App-V in the following ways: + +- The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client. + +- The App-V application sequencer is available from the Windows 10 Assessment and Deployment Kit (ADK). In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. + +>**Note**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. + +For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) and [Migrating to App-V for Windows 10 from a previous version](appv-migrating-to-appv-from-a-previous-version.md). + +>**Important** +You can upgrade your existing App-V installation to Windows 10, version 1607 from App-V versions 5.0 SP2 and higher only. If you are using a previous version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you upgrade to Windows 10, version 1607.   -**Support for using Configuration Manager with App-V:** App-V supports System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. +## Support for using System Center Configuration Manager 2016 with App-V -## Upgrade to App-V for Windows +App-V supports System Center 2016 and 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. - -Use the following information to upgrade to App-V for Windows from earlier versions. See [Migrating to App-V for Windows from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) for more information. - -### Before you begin - -Review the following information before you start the upgrade: - - ---- - - - - - - - - - - - - - - - - - - - - -
    Items to review before upgradingDescription

    Components to upgrade, in any order

      -

    1. App-V Server

      2. -

    2. Sequencer

      3. -

    3. App-V Client or App-V Remote Desktop Services (RDS) Client

      4. -
    -
    -Note   -

    Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from [Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186).

    -
    -
    -  -

    Upgrading from App-V 4.x

    You cannot upgrade directly from App-V 4.x to App-V for Windows. You must first upgrade to App-V 5.0. For more information, see [Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md)

    - -

    Upgrading from App-V 5.0 or later

    You can upgrade to App-V for Windows directly from any of the following versions:

    -
      -

    • App-V 5.0

      • -

    • App-V 5.0 SP1

      • -

    • App-V 5.0 SP2

      • -

    • App-V 5.0 SP3

      • -
    -

    To upgrade to App-V for Windows, follow the steps in the remaining sections of this topic.

    -

    Packages and connection groups will continue to work with App-V for Windows as they currently do.

    -  + ### Steps to upgrade the App-V infrastructure @@ -173,7 +95,7 @@ Complete the following steps to upgrade each component of the App-V infrastructu

  • If you are upgrading to App-V for Windows server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 server](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/check-reg-key-svr).

    • -

  • Follow the steps in [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md)

    • +

  • Follow the steps in [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)

    •  

    @@ -450,6 +372,7 @@ App-V supports the use of multiple scripts on a single event trigger for App-V p For more information, including a list of event triggers and the context under which scripts can be run, see the Scripts section in [About App-V Dynamic Configuration](appv-dynamic-configuration.md). + ## Have a suggestion for App-V? diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md index b0af8a88d6..f88561dc30 100644 --- a/windows/manage/appv-capacity-planning.md +++ b/windows/manage/appv-capacity-planning.md @@ -14,7 +14,7 @@ ms.prod: w10 The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. -**Important**   +>**Important**   Use the information in this section only as a general guide for planning your App-V deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary.   @@ -52,7 +52,7 @@ Before you design the App-V infrastructure, you must determine the project’s s ## Determine Which App-V Infrastructure is Required -**Important**   +>**Important**   Both of the following models require the App-V client to be installed on the computer where you plan to run virtual applications. You can also manage your App-V environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md). @@ -67,9 +67,9 @@ You can also manage your App-V environment using an Electronic Software Distribu - When network bandwidth limitations inhibit electronic software distribution. -- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: +- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V Full Infrastructure Model consists of one or more App-V management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for App-V Server Deployment](appv-planning-for-appv-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - **Important**   + >**Important**   The App-V full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V Supported Configurations](appv-supported-configurations.md).   diff --git a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md index 7f75c3060d..f0a57d3634 100644 --- a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md @@ -17,7 +17,7 @@ Use the following instructions to use SQL scripts, rather than the Windows Insta - Upgrade the App-V databases to a later version -> [!NOTE] +>**Note** > If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V. ## How to install the App-V databases by using SQL scripts @@ -179,5 +179,5 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros ## Related topics -- [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) -- [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) +- [Deploying the App-V Server](appv-deploying-the-appv-server.md) +- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) diff --git a/windows/manage/appv-deploy-the-appv-server-with-a-script.md b/windows/manage/appv-deploy-the-appv-server-with-a-script.md index b5c3122c5b..1cccb12111 100644 --- a/windows/manage/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/manage/appv-deploy-the-appv-server-with-a-script.md @@ -1,6 +1,6 @@ --- -title: How to Deploy the App-V 5.1 Server Using a Script -description: How to Deploy the App-V 5.1 Server Using a Script +title: How to Deploy the App-V Server Using a Script +description: How to Deploy the App-V Server Using a Script author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,14 +9,14 @@ ms.prod: w10 --- -# How to Deploy the App-V 5.1 Server Using a Script +# How to Deploy the App-V Server Using a Script In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. -**To Install the App-V 5.1 server using a script** +**To Install the App-V server using a script** -- Use the following tables for more information about installing the App-V 5.1 server using the command line. +- Use the following tables for more information about installing the App-V server using the command line. **Note**   The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. @@ -777,7 +777,7 @@ In order to complete the **appv\_server\_setup.exe** Server setup successfully u ## Related topics -[Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) +[Deploying the App-V Server](appv-deploying-the-appv-server.md)   diff --git a/windows/manage/appv-deploy-the-appv-server.md b/windows/manage/appv-deploy-the-appv-server.md index 1cbab6ab2a..d6462823b4 100644 --- a/windows/manage/appv-deploy-the-appv-server.md +++ b/windows/manage/appv-deploy-the-appv-server.md @@ -1,6 +1,6 @@ --- -title: How to Deploy the App-V 5.1 Server -description: How to Deploy the App-V 5.1 Server +title: How to Deploy the App-V Server +description: How to Deploy the App-V Server in App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,13 +8,13 @@ ms.sitesec: library ms.prod: w10 --- -# How to Deploy the App-V 5.1 Server +# How to Deploy the App-V Server (new installataion) -Use the following procedure to install the App-V 5.1 server. +>**Important**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. **Before you start:** -- Ensure that you’ve installed prerequisite software. See [App-V Prerequisites](appv-prerequisites.md). +- Ensure that you’ve installed required software. See [App-V Prerequisites](appv-prerequisites.md). - Review the server section of [App-V security considerations](appv-security-considerations.md). @@ -24,15 +24,21 @@ Use the following procedure to install the App-V 5.1 server. - If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md). -**To install the App-V 5.1 server** +**To install the App-V server** -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it. +1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: -2. Start the App-V 5.1 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. + - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site. -3. Review and accept the license terms, and choose whether to enable Microsoft updates. + - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). -4. On the **Feature Selection** page, select all of the following components. +2. Copy the App-V server installation files to the computer on which you want to install it. + +3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. + +4. Review and accept the license terms, and choose whether to enable Microsoft updates. + +5. On the **Feature Selection** page, select all of the following components. | Component | Description | | - | - | @@ -42,21 +48,20 @@ Use the following procedure to install the App-V 5.1 server. | Reporting server | Provides App-V reporting services. | | Reporting database | Facilitates database predeployments for App-V reporting. | -5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. +6. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. -6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. +7. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. | Method | What you need to do | | - | - | | You are using a custom Microsoft SQL Server instance. | Select **Use the custom instance**, and type the name of the instance.
    Use the format **INSTANCENAME**. The assumed installation location is the local computer.
    Not supported: A server name using the format **ServerName**\\**INSTANCE**.| | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.| -7. On the **Configure** page, accept the default value **Use this local computer**. +8. On the **Configure** page, accept the default value **Use this local computer**. - > [!NOTE] - > If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. + >**Note** If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. -8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. +9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. | Method | What you need to do | | - | - | @@ -64,21 +69,21 @@ Use the following procedure to install the App-V 5.1 server. | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.| -9. On the **Configure** page, accept the default value: **Use this local computer**. +10. On the **Configure** page, accept the default value: **Use this local computer**. - > [!NOTE] + >**Note** > If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. -10. On the **Configure** (Management Server Configuration) page, specify the following: +11. On the **Configure** (Management Server Configuration) page, specify the following: | Item to configure | Description and examples | | - | - | - | Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser
    After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.| - | **Website name**: Specify the custom name that will be used to run the publishing service.
    If you do not have a custom name, do not make any changes.| + | Type the AD group with sufficient permissions to manage the App-V environment. | Example: MyDomain\MyUser

    After installation, you can add users or groups on the management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups to perform this action.| + | **Website name**: Specify the custom name that will be used to run the publishing service.
    | If you do not have a custom name, do not make any changes.| |**Port binding**: Specify a unique port number that will be used by App-V. | Example: **12345**
    Ensure that the port specified is not being used by another website. | -11. On the **Configure Publishing Server Configuration** page, specify the following: +12. On the **Configure Publishing Server Configuration** page, specify the following: | Item to configure | Description and examples | | - | - | @@ -86,16 +91,16 @@ Use the following procedure to install the App-V 5.1 server. | **Website name**: Specify the custom name that will be used to run the publishing service.| If you do not have a custom name, do not make any changes. | | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 54321
    Ensure that the port specified is not being used by another website. | -12. On the **Reporting Server** page, specify the following: +13. On the **Reporting Server** page, specify the following: | Item to configure | Description and examples | | - | - | | **Website name**: Specify the custom name that will be used to run the Reporting Service. | If you do not have a custom name, do not make any changes. | | **Port binding**: Specify a unique port number that will be used by App-V. | Example: 55555
    Ensure that the port specified is not being used by another website. | -13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. +14. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. -14. To verify that the setup completed successfully, open a web browser, and type the following URL: +15. To verify that the setup completed successfully, open a web browser, and type the following URL: **http://\<_Management server machine name_\>:\<_Management service port number_\>/console.html**. @@ -113,4 +118,4 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros - [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) -- [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) diff --git a/windows/manage/appv-deploying-appv.md b/windows/manage/appv-deploying-appv.md index bf4e076bd8..eb82edefc5 100644 --- a/windows/manage/appv-deploying-appv.md +++ b/windows/manage/appv-deploying-appv.md @@ -10,16 +10,16 @@ ms.prod: w10 # Deploying App-V -App-V supports a number of different deployment options. This section of the App-V Administrator’s Guide includes information you should consider about the deployment of App-V and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. +App-V supports a number of different deployment options. This section of the App-V Administrator’s Guide includes information you should consider about the deployment of App-V and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages in your deployment. ## App-V Deployment Information - [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) - This section describes how to install the App-V sequencer which is used to virtualize applications, and the App-V client which runs on target computers to facilitate virtualized packages. + This section describes how to install the App-V sequencer, which is used to virtualize applications, and how to enable the App-V client, which runs on target computers to facilitate virtualized packages. -- [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) +- [Deploying the App-V Server](appv-deploying-the-appv-server.md) This section provides information about installing the App-V management, publishing, database and reporting severs. diff --git a/windows/manage/appv-deploying-the-appv-server.md b/windows/manage/appv-deploying-the-appv-server.md index 90a078e3d5..6c21e160b4 100644 --- a/windows/manage/appv-deploying-the-appv-server.md +++ b/windows/manage/appv-deploying-the-appv-server.md @@ -1,6 +1,6 @@ --- -title: Deploying the App-V 5.1 Server -description: Deploying the App-V 5.1 Server +title: Deploying the App-V Server +description: Deploying the App-V Server in App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -8,15 +8,17 @@ ms.sitesec: library ms.prod: w10 --- -# Deploying the App-V 5.1 Server +# Deploying the App-V Server -You can install the Application Virtualization (App-V) 5.1 server features by using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). +You can install the Application Virtualization (App-V) server features by using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). -For information about deploying the App-V Server, see [About App-V](appv-about-appv.md). +For information about deploying App-V for Windows 10, see [About App-V](appv-about-appv.md). ->**Important**
    Before you install and configure the App-V 5.1 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. +>**Important**
    Before you install and configure the App-V servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. -## Download and install App-V 5.1 server components +## Download and install App-V server components + +>**Important**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. App-V offers the following five server components, each of which serves a specific purpose in an App-V environment. @@ -24,22 +26,20 @@ App-V offers the following five server components, each of which serves a specif >**Note**
    If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you can still take advantage of the reporting and streaming capabilities in App-V. -- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) for more information about the management database. +- **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the management database. - **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. See [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md) for more information about configuring the publishing server. - **Reporting server.** Use the App-V reporting server to generate reports that help you manage your App-V infrastructure. The reporting server requires a connection to the reporting database. See [About App-V reporting](appv-reporting.md) for more information about the reporting capabilities in App-V. -- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) for more information about the reporting database. +- **Reporting database.** Use the App-V reporting database to facilitate database pre-deployments for App-V reporting. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the reporting database. -All five App-V 5.1 server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: +All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from: - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215) You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site. - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). - >**Note**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. - In large organizations, you might want to install more than one instance of the server components to get: - Fault tolerance for situations when one of the servers is unavailable. @@ -51,18 +51,18 @@ In large organizations, you might want to install more than one instance of the ## App-V standalone deployment The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this topology for larger deployments. -- [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) +- [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) -- [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) -## App-V 5.1 Server distributed deployment -The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V 5.1 Server components are deployed across multiple computers, based on the structure and requirements of the organization. +## App-V Server distributed deployment +The distributed deployment topology can support a large App-V client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V server components are deployed across multiple computers, based on the structure and requirements of the organization. - [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md) -- [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +- [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) - [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) @@ -75,8 +75,8 @@ You can also deploy the App-V clients and packages by using an ESD without havin [Deploying App-V Packages by Using Electronic Software Distribution (ESD)](appv-deploying-packages-with-electronic-software-distribution-solutions.md) -## App-V 5.1 Server logs -You can use App-V 5.1 server log information to help troubleshoot the server installation and operational events while using App-V. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: +## App-V Server logs +You can use App-V server log information to help troubleshoot the server installation and operational events while using App-V. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: **Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** @@ -97,7 +97,7 @@ The reporting information will be maintained until it is successfully sent to th If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V reporting server and it must be deployed separately to generate the associated reports. -For more information, see [About App-V Reporting](appv-reporting.md) and [How to Enable Reporting on the App-V Client by Using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md). +For more information, see [About App-V Reporting](appv-reporting.md) and [How to Enable Reporting on the App-V Client by Using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md). ## Other resources for the App-V server - [Deploying App-V](appv-deploying-appv.md) diff --git a/windows/manage/appv-deployment-checklist.md b/windows/manage/appv-deployment-checklist.md index 9d692acc2c..2def234fd2 100644 --- a/windows/manage/appv-deployment-checklist.md +++ b/windows/manage/appv-deployment-checklist.md @@ -59,7 +59,7 @@ This checklist can be used to help you during an App-V deployment.

    • [How to Install the Sequencer](appv-install-the-sequencer.md)

    • [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)

      • -

    • [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md)

      • +

    • [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)

    diff --git a/windows/manage/appv-enable-the-app-v-desktop-client.md b/windows/manage/appv-enable-the-app-v-desktop-client.md index f85c10f998..2a92c9d953 100644 --- a/windows/manage/appv-enable-the-app-v-desktop-client.md +++ b/windows/manage/appv-enable-the-app-v-desktop-client.md @@ -8,15 +8,15 @@ ms.sitesec: library ms.prod: w10 --- -# Enable the App-V desktop client +# Enable the App-V in-box client The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. The client can also get virtual application content from the management server. -With Windows 10, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. +With Windows 10, version 1607, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. **To enable the App-V client with Group Policy:** -1. Open the device’s **Local Group Policy Editor**. +1. Open the device’s **Group Policy Editor**. 2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **App-V**. @@ -28,7 +28,7 @@ With Windows 10, the App-V client is installed automatically. You need to enable 1. Open Windows PowerShell. -2. Type `Enable-Appv` and press Enter. +2. Type `Enable-Appv` and press ENTER. 3. Restart the device. diff --git a/windows/manage/appv-evaluating-appv.md b/windows/manage/appv-evaluating-appv.md index 71b0fe0730..cdb5351de3 100644 --- a/windows/manage/appv-evaluating-appv.md +++ b/windows/manage/appv-evaluating-appv.md @@ -30,7 +30,7 @@ Use the following links for information about setting up the App-V sequencer and Use the following links for information about setting up the App-V server in your lab environment. -- [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) +- [How to Deploy the App-V server](appv-deploy-the-appv-server.md) - [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) diff --git a/windows/manage/appv-for-windows.md b/windows/manage/appv-for-windows.md index f7f6ea9af9..d127094cb6 100644 --- a/windows/manage/appv-for-windows.md +++ b/windows/manage/appv-for-windows.md @@ -32,7 +32,7 @@ The topics in this section provides information and step-by-step procedures to h [Deploying App-V](appv-deploying-appv.md) - [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) -- [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) +- [Deploying the App-V Server](appv-deploying-the-appv-server.md) - [App-V Deployment Checklist](appv-deployment-checklist.md) - [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md) - [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md) diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md index 34d3229eb4..1923a4353a 100644 --- a/windows/manage/appv-getting-started.md +++ b/windows/manage/appv-getting-started.md @@ -9,9 +9,9 @@ ms.prod: w10 --- -# Getting Started with App-V +# Getting Started with App-V for Windows 10 -Microsoft Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. +Microsoft Application Virtualization (App-V) for Windows 10 enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you are new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. For information about what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). @@ -30,11 +30,11 @@ To start using App-V to deliver virtual applications to users, you’ll need to | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md). | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215).
    You must have a MSDN subscription to download the MDOP ISO package.
    See [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. | +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

    **Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:
    - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.
    - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).

    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. | App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10.
    For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | | App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit). | -For more information about these elements, see [High Level Architecture for App-V](appv-high-level-architecture.md). +For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For information about Microsoft training opportunities, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx). diff --git a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md index fd30510d36..f9978a7b46 100644 --- a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -21,7 +21,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance **To install the management database and the management server on separate computers** -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. @@ -50,7 +50,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance **To install the reporting database and the reporting server on separate computers** -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. @@ -79,7 +79,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance **To install the management and reporting databases using App-V database scripts** -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. +1. Copy the App-V server installation files to the computer on which you want to install it on. 2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: diff --git a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md index 8dc3be4c50..de8e7c0416 100644 --- a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md @@ -16,7 +16,7 @@ Use the following procedure to install the management server on a standalone com **To install the management server on a standalone computer and connect it to the database** -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. diff --git a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md index 4671ecc76a..f9f66a2120 100644 --- a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md @@ -16,7 +16,7 @@ Use the following procedure to install the publishing server on a separate compu **To install the publishing server on a separate computer** -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. diff --git a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md index 177e3e119f..5fbc775cc8 100644 --- a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -21,7 +21,7 @@ Before performing the following procedure you should read and understand [About **To install the reporting server on a standalone computer and connect it to the database** -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. +1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. 2. On the **Getting Started** page, review and accept the license terms, and click **Next**. diff --git a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index 49310ed483..110f5d08a1 100644 --- a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -43,7 +43,7 @@ Review the following requirements for using the App-V PowerShell cmdlets:

    Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:

    • When you are deploying and configuring the App-V Server:

      -

      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md).

      • +

      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md).

    • After you’ve deployed the App-V Server:

      Use the App-V Management console to add an additional Active Directory group or user. See [How to Add or Remove an Administrator by Using the Management Console](appv-add-or-remove-an-administrator-with-the-management-console.md).

    diff --git a/windows/manage/appv-maintaining-appv.md b/windows/manage/appv-maintaining-appv.md index ddfa4d502c..487547914c 100644 --- a/windows/manage/appv-maintaining-appv.md +++ b/windows/manage/appv-maintaining-appv.md @@ -12,16 +12,15 @@ ms.prod: w10 # Maintaining App-V -After you have completed all the necessary planning, and then deployment of App-V, you can use the following information to maintain the App-V infrastructure. +After you have deployed App-V for Windows 10, you can use the following information to maintain the App-V infrastructure. -## Move the App-V 5.1 Server +## Moving the App-V server - -The App-V 5.1 server connects to the App-V database. Therefore you can install the management component to any computer on the network and then connect it to the App-V database. +The App-V server connects to the App-V database. Therefore you can install the management component on any computer on the network and then connect it to the App-V database. [How to Move the App-V Server to Another Computer](appv-move-the-appv-server-to-another-computer.md) -## Determine if an App-V Application is Running Virtualized +## Determine if an App-V Application is Running Virtualized Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index e153ca44c2..c6ff02b2cb 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -13,7 +13,7 @@ ms.prod: w10 With Microsoft Application Virtualization (App-V), you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V infrastructure. -However, you cannot migrate directly from App-V 4.x to App-V for Windows 10—you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating to App-V 5.1 from a Previous Version](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version) +However, you cannot migrate directly from App-V 4.x to App-V for Windows 10—you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating to App-V server from a Previous Version](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version) **Note**   Packages for App-V for Windows 10 are exactly the same as packages for App-V 5.0. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V for Window 10 packages. @@ -251,7 +251,7 @@ You must be running the latest version of App-V 4.6 to use coexistence mode. Ad   -## Migrating the App-V 5.1 Server Full Infrastructure +## Migrating the App-V server Server Full Infrastructure There is no direct method to upgrade to a full App-V infrastructure. Use the information in the following section for information about upgrading the App-V server. @@ -277,8 +277,8 @@ There is no direct method to upgrade to a full App-V infrastructure. Use the inf

    [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).

    -

    Install App-V 5.1 server.

    -

    [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md).

    +

    Install App-V server server.

    +

    [How to Deploy the App-V server Server](appv-deploy-the-appv-server.md).

    Migrate existing packages.

    diff --git a/windows/manage/appv-move-the-appv-server-to-another-computer.md b/windows/manage/appv-move-the-appv-server-to-another-computer.md index 99d137095c..243e056c65 100644 --- a/windows/manage/appv-move-the-appv-server-to-another-computer.md +++ b/windows/manage/appv-move-the-appv-server-to-another-computer.md @@ -19,7 +19,7 @@ Use the following information to create a new management server console in your The following list displays the steps necessary to create a new management server console: -1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md). +1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V server](appv-deploying-the-appv-server.md). 2. After you have completed the installation, use the following link to connect it to the App-V database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](appv-install-the-management-server-on-a-standalone-computer.md). diff --git a/windows/manage/appv-planning-to-deploy-appv.md b/windows/manage/appv-planning-to-deploy-appv.md index 2e60b9cd72..bc891dc8ee 100644 --- a/windows/manage/appv-planning-to-deploy-appv.md +++ b/windows/manage/appv-planning-to-deploy-appv.md @@ -37,11 +37,11 @@ Describes the options and requirements for deploying App-V with an electronic so [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) -## Planning for the App-V 5.1 Server deployment +## Planning for App-V server deployment Describes the planning considerations for the App-V Server components and their functions. -[Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md) +[Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) ## Planning for the App-V Sequencer and Client deployment diff --git a/windows/manage/appv-prerequisites.md b/windows/manage/appv-prerequisites.md index 699986c520..19ca1f59f3 100644 --- a/windows/manage/appv-prerequisites.md +++ b/windows/manage/appv-prerequisites.md @@ -75,7 +75,7 @@ The following table indicates the software that is already installed for differe ## App-V Server prerequisite software -Install the required prerequisite software for the App-V 5.1 Server components. +Install the required prerequisite software for the App-V server components. ### What to know before you start diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index 99c9a92e07..c60f1dd5b5 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -15,9 +15,9 @@ Applies to: Windows 10, version 1607 The following is a known issue in Microsoft Application Virtualization (App-V) in Windows 10, version 1607: -**MSI packages generated by App-V 5.1 and older sequencer fail to install on computers with built-in App-V client** +**MSI packages generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client** -When MSI packages are generated by an older sequencer (5.1 and below), they include a check to ensure the App-V client is installed before allowing the MSI package to install. Since App-V client is now part of the operating system, the pre-requisite check fails and it leads to MSI installation failure. +When MSI packages are generated by an older sequencer (App-V versions 5.1 and earlier), they include a check to ensure the App-V client is installed before allowing the MSI package to install. Now that the App-V client is installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. **Workaround**: diff --git a/windows/manage/appv-reporting.md b/windows/manage/appv-reporting.md index 75613f4f57..b76c62fad9 100644 --- a/windows/manage/appv-reporting.md +++ b/windows/manage/appv-reporting.md @@ -308,7 +308,7 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros ## Related topics -[Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) +[Deploying the App-V server](appv-deploying-the-appv-server.md) [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](appv-install-the-reporting-server-on-a-standalone-computer.md) diff --git a/windows/manage/appv-supported-configurations.md b/windows/manage/appv-supported-configurations.md index 632faf1ec3..b93d27a77c 100644 --- a/windows/manage/appv-supported-configurations.md +++ b/windows/manage/appv-supported-configurations.md @@ -18,13 +18,13 @@ This topic specifies the requirements to install and run App-V in your environme This section lists the operating system and hardware requirements for all of the App-V Server components. -### Unsupported App-V 5.1 Server scenarios +### Unsupported App-V server scenarios -The App-V 5.1 Server does not support the following scenarios: +The App-V server does not support the following scenarios: - Deployment to a computer that runs the Server Core installation option. -- Deployment to a computer that runs a previous version of App-V 5.1 Server components. You can install App-V side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. +- Deployment to a computer that runs a previous version of the App-V 5.1 server components. You can install App-V side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the Application Virtualization Management Service (HWS) 4.x is not supported. - Deployment to a computer that runs Microsoft SQL Server Express edition. diff --git a/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index f544dffb06..c93a7f9be1 100644 --- a/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -40,9 +40,9 @@ To verify that the user’s App-V settings were migrated correctly, type `Get-Ap With Windows 10, the App-V client is installed automatically. You need to enable the client to allow user devices to access and run virtual applications. You can enable the client with the Group Policy editor or with Windows PowerShell. -**To enable the App-V client with Group Policy**: +**To enable the App-V client with Group Policy** -1. Open the device’s **Local Group Policy Editor**. +1. Open the device’s **Group Policy Editor**. 2. Navigate to **Computer Configuration > Administrative Templates > System > App-V**. @@ -50,7 +50,7 @@ With Windows 10, the App-V client is installed automatically. You need to enable 4. Restart the device. -**To enable the App-V client with Windows PowerShell**: +**To enable the App-V client with Windows PowerShell** 1. Open Windows PowerShell. From abf4008f1e4a17df35a06d363514bd28889a11b8 Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Wed, 10 Aug 2016 09:24:47 -0700 Subject: [PATCH 060/421] Changed description of topic --- windows/manage/appv-about-appv.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/appv-about-appv.md b/windows/manage/appv-about-appv.md index f7d8e7187d..571fcda8b1 100644 --- a/windows/manage/appv-about-appv.md +++ b/windows/manage/appv-about-appv.md @@ -1,6 +1,6 @@ --- title: What's new in App-V for Windows 10 (Windows 10) -description: Discusses what's new in App-V for Windows 10. +description: Information about what's new in App-V for Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy From 300626bbb9dc5ddb16952f4e7225026bb1ba9c15 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Wed, 10 Aug 2016 09:45:12 -0700 Subject: [PATCH 061/421] These are the correct screenshots --- .../keep-secure/images/device-guard-gp.png | Bin 46125 -> 47736 bytes .../images/dg-fig7-enablevbsofkmci.png | Bin 66762 -> 48308 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/device-guard-gp.png b/windows/keep-secure/images/device-guard-gp.png index c6713c2bf3b709dd878b4a1edbc5619d269d822d..169d2f245be210e8306e752823def4470bd97d10 100644 GIT binary patch literal 47736 zcmb5VbyQqU(=R&65ZnnC+ya3i!F_NKZV4LP-Q6v?yA#~qArLgUySux?ojiHY``+)a zd)7MVkC|QF)4RI5`d8L_Pl%k17z!c*A^-qDkq{SF005xNAs;t*XaE3e!K79l@&lBe zf|wwneB|9eqycLr@L2!=sER~-`UZrw5v;|(*Z}~j-G4q%eO86~06;T}gs^~;v)1vm zS0&Ma!z#i`(%jh#J9kaX<*dKnOHz6=%5CPHH|Hp`Plyk#o*o;uFNVq~Twc~EOa~$| zq?<8cC;h>%auW*Z!l~!*5@huc(XI@VD!G}Y!KQmYIazSyrsCww{^GvIgRV?)q{mtz z3<95rQW7LWtwt+;^L&X{ZaDF9IBjV-cr>wZD~+X*H8e2D;8DJvDH}jy<$Ldbl}nO; zwYd6n;^Y|uMD+(uKK?={MEiEM#JvJz7&Btt^Xcln#xpwJ(C>r{xg4yyIM zmoTLggvY!Dw2C0K_p$HVYCCQ7d{)MyJXu^tl^$8GoJzG?;Q&`nJ!!N!9^1STznr!# zoOf(QdO1T|z3c6GPD6;m+4pU6%!)2il!6skj6B=9WaOE`zC6o6Y)L?djGZwfzhXty z?SPPLNMk^$1K(S7)TytB(4pvg=lBfm&re${uT3^Dh!uqFGMVi^TcA)lXWp5a9r-r2 z9a}W7BB>0x>RD(`2vR+D1WZiMtXfwWrn%D^p; zNsgm3GIKA2YRarn@3SbrN!S0d@1)!MGMp3Q2<3)i3;Sk+k1{cDLh9)A9@+qB z;rY{aTXP1I?ZKB{{1gwIoyA zw0W02do+Pqh$;PlR`b&V3dpa{7LT?S zH(9iW)gntHvwL&#-X2Q1$!-T(6I+2?Mb>O7U;r3h1I^&yip{q`mc3`l$JsL^4eT}RmtDRemDX@gV5&tTv{$SaJYz-(l;oc!!ZGR6R zGQW3@RfQxY$C$?3l^7VOW`O$+*Y&AqD_yp#M4d{hBtHU&*Hf3l-6z6Mwy$dmDplCw z>Mq2mvHQoSxjp^wwiwe|n7 z;6$7X3eX80#ilY&9IesVoiIV29ZCB&D`(3cJaN*hpulH2_!-01;4>yZ(3PlHWqZ_E zQ~(JgLzROMm#_6o1Qf3)bS?m5JERdcNI8VN%KRE_%cxXyk2TDywK)1uk>NrhW8gc=>g84?s?!8{VJ1JRI{3KW#JpW zl&2;vuMI({{F6)34dI0`umbgG1{w9i+)dT&sFR{Y$Q>LQ6Km909N(q6-MQ)k5ZQVg zg}_>_5dF<1f%b?X3ZBxmK6wX5@7CYuB%A=oo<8ahffXvb@2L!TETwVPVz+0t zKrPzt_~pzns17^5sKy!>@zx#$RW(A3Mz3avm@A zg3$K8o<)S7p9Lkrc~fmPK|!)70j1q-Zn7CozrYdVsclAA1?Un(o>(?z@ZdgUo|f2* zrleDH_bB?85_>-=O;Szk=Z6yQXVYe9$|sn(b@p=_oz{cp6KCgU}sX}tpexkSd(BV|bW>l?()fG{Ve~^(M<{Rw?QWM0TLqo8H zUeGy#4o5Ff+sXV$`KoRIe9;ovyFXwu-bD62z!J;UVz{avkr{$Nu&RE1Df^5{_G^gF zKLnJf+y$_}VC8WDjQe*O9&pe1L70Q)5O9lvPu5e%LQqZ1Jw2V)Ecg#!_EA!rWTBhr)X16!Iul%HTGf zC4Gn~8m+E|lh^~WCUVXt(4RnK77Iw4iKObl7otn+3O<8%psDHHC;fvyNlG=Q4%}>$?!1@%3N6 zx)~NLL-scV25;@>N`HwzQJ|ah#yI%6ROWsQS!l94zos8cy@0*!)%~CVi?hOAWqWDCI7f39 zxAeW?P{)RVz9v7?-1w(%qCF36deIpmwK|THnOfC7Y+zF{n(AfaT8*U9YWk#s+_CS# z*6;OWB%_|7{`j1yQnDc$%0%*~$-o$JwpkyM0&k7b{)Q}6L(O@vcgvb_sRXVZbKGV! zd;*us)g8hKv=-`#24#h391#<~J=^3qJ05(>>p?TE0JJTv%`|C8mdT*PX?eM@ z=W9AH#{322ehkcdj|wa7`if#Qr+0XAD-EJ8l+?KOsaE>RR+s zM+*+Z>D=BY&9!CP!Yp>}R%#7W5Vow5@D> z9GX1_nL~v%m$^@PRSQ`~ZX!Z82JLf)N-im}6H?u1M9En8*W&O}I$qC>yJmhqChA(v zIC!I&@n61}rKBCYg|@`Nr(>+ZYW<;~?Lpf^`BZ4-AhG2m(RCc|yvmm^_cDHBPMiw^RZ=6xuO60c!AbY+s(9{1 zqAwE80dXRdq>#Un&#}Lg{QaA14R!k#)gl{Kj|#Eq#+a)@vVEq_aa$ zZ9UoO=H%F*gRroNgdZCb*iw1>yUZ;=r^)7{-yj;dit}bT`;#m$oeBEWl~l#6m)HJn zrkkazQ(2nPl4w>FRVLireA^>okvx)I6JZA0-ix!Td@&ko88aU3`+&FwDuD*o~SGt54v z!>Ge)tZ$zI2*XE)jzaq9Eear|z(DR=T0?1$T2Fbl=Us?CSKHfr#;4o?2DPEi=<$~@uw|in zudR+4AR^4c7!|Iou@ZGy!q1yUCXFN8HC`LW$qcFnIcPPamgLIY!FWUxx|>4p-@yrf zHs6R+U}QgnYQcmRsM15fVC^ybGtYZQeN?VX#vDow*7_mRK-dEk21DVx?g#uqv_F-B zEm*d6TZZpNMhpa-+$#nyjpGl!No5t zly2rmr)ejM;Z~+5pV~*v!)WHX6CV;s1|?2T+;;Cyg=>C(aDwNOa8n{JJm23sC);l{ zSRaV1r^kogHAY`*=^+<;2TQ}KnWM45J8;tkm4Fdu^-c{H00-4c3V{9R+Xh{!{mxDL z)<5BM^M&-P8=NQl*fgg@xK`aHUQ`Lu!;to4Q7fyXUX=j9n6Q}ZHb;AJdxj1t01p=6 z2SDe6S9yI@{ve7LkNInrTc#ss*87d_Vl>9!04%K9AXM4o=~y9?Ya^mgY%#)v zF5*Vf&Jff8rpv-}cEI9*p1f^y3*>Oir5gRFn(>iE&9q#6xP3V!$=74e#(Knfay! zzEoge>dn_ZF z=Xy$!4c>9|D|=$2GmV@2*gQf9n^Ao0-NyG6jzLn6xt#_RrMEkGht<{4i;hz+LYN| zlo-J0ef!kyIBNrj?;e7#M6?EljL8>i$cPRSDL*b`6d!iiXX{}l-j7&`)VSvJK3pyr zp{PGGpQS8D{4;~k`d;NFqw#2-0Dodo4h61zby}Djrg#g5e-IsB{>IX^8O-rIAhvgM`wkQQ(cqb6;Vd;mLQLPBQpQQL zCAR?NvN&T6<(t=lyON^jA#3Y6gXD9S6Kqs(YV!EJvKkqEs**L5Ja* zE*Nf~V5IYBhtK`^wTau^&S5(k9c&$MH$WX?36rrkG}N)Vt#b859w_&dvf$6^W+oMT z*$U*~!=5A1AwLsl`O;1RLu38$ba4|}*GNYeFEdCst42G)@ua2f*g{Ld1%o$fFh$aZ za<@R_JOk{16-xiS6}4uWt=6|2q7O3Li4&PQ~T0Kl?|G0^Lly)TEPnl)gTSd|ez~ zv2nLyoil6b&f3e#o%SKoB(3P7RwzcyJ-JWtWw#veUU1yw;JvEfj~&o$f-iCLaTxJ2 z3K~z>-q^}n*oTjK-j+<;x5f%O`A*^R@na6SRB9)>ERvH6-RuJ!ck(bSF3JUQ)OU&` zAnJ>xa=dl&w@dgbGiypIx=#M$#1z6Y*2mQ?{RUzP$0(5`u#O?(xItIDM_WBxJt9r? zOCGIm3Hn1V!b(?y<6jp(xE9ved>S)`XNOI-dS&pw2{h8k0H8xma)3LN%P&bs$=J%d z7Y{GS%;1!cq;@ait)`~Oe&#k}D?#6wK(({%%5|wzz{XeN*MWy&%!kaE6xt#Y9Q{l( zLj4}q?EFIb@W&duWeQoQP_rpd zkvOXf#!BpF4%?=ur{GW>Aj7AO4@6MD7h`hKGR1hF3i4+%z^|hy%R=!=rc&u*N?Dqm zLnc#;Fucz(;35++7N@CY=Q)G@hclOK)~i0|qI+oOgr&uK?e~@~I&;YhrN!#~A(1U= zsOL$KWPj7av87PpD<{w(u&ITF*Z)OvPQBkFK#nJ6J+!CYEK+<*)?NT2rGji0&4A+k zwKeW2N@o2H-C&ivC#XbZNj$VLqN8XGvK}LIKX2|Z>KIh$eZ?2_WXx}gG;jCk`ufyc z_XdB*+H_{_U64%Zhq!A=o6wC8`u@1y)L|wMc>g_4h~Zp+kt0dEV13hs&2wywj^RTD z>9lb^hj$_T&>z*;zw1Xpf19!@#P8Pa*J*7J>H7#T8U#_HpU$5~F9&@6E$92(Jqaf& zjx{${%IuF(l$hVn^GShv^5I!5Me^cB(TV!|V!zXeAmu4|k1 zh50JW)n?Emw{4RpZ;D*V^^piNV+<4uVFPQ!MX!RdLdD&>A;FOZ2A-ylooAB(*4<0B z9OEvv>!e99HHWFe*s+Oz1?4h+-DJc$orURrG~(dzndibaODvo6yTGH9SoZwaxpV)5 z`1~6V#3qXbWaUXwmTsRpiz?**V%{44OeuT6>r!;aIb|>9#}}cN(of41Vvop8RYG65 z7ITEb%OS20HmJt~Pa~28FU?tP>pnDiL<@w($iCy*ZR=g6|1^kU6JYg#egGZxtG=zr zc4O_-%r|uTzbw3DBD4}ZN%z7N1gvi_iiT7f7iDBz&^6Kz99>zDCq#~x` z_qK@ElDu>twik58Y`RXCuJ@pwwcKWO^IobWxphcji-1V&-$WScB*DkCSpj8-UM>040axN9f*>o)aYRDqoC`e;TNwopV(f zXVVqLS{*NR&#A4qZFJ{W1MFLEd#XQMwnt@0RvFurmT+5a+PQv~r%@N5s?ucV&mcU$ zD?^)FD|ya_bL$!z+eHPt+&xyj^V}TuI(y?KN5ulYr!)@sWNgovb%#Z#j$Go9Em)E= zPJGGj*_R7r$jI1>i1<|eKEj*h$bDMarjUV<+sz{j?)d21hu{cE2xYH)_8}4t{FI#; z$){6hoonf^H_+mq`0AkV8vi;i@8@^}P4YOmTXA}_I8st^(%~q+7}R`uP$Elw(LoK# zTIb-M`?y!m(O%cVJZ?8ft`XjP07ks`&!{nh260yV*4IWg}DsDbLA zreh;oYu9foCg9hkE*iAJ?iX@mfGVjXA@V_{h>#y_2q^|(P%=p5<5h7pB%SNTB{&ZYy~`iB0^ z@d^tx2)@1smKv-0uvg#K)AnI7oN%`yZKv2IaU!j7nJz+3{XPf(9sZ#l*~tR@o!ILh zNl^@{?_@#6-tv-n$MmAi`VCR~@`v4P*wy}%cS9CC&W8;MVczYPs5l$t;Q+4lV(evp zN3gaG&ga=jRhd34>f3|UKEgYB@&Uds_&ub9--``aW)%k@n>=M5R+2d#*sB1CLUgA| zcs2Ep&<{Vkl!9CEpeX*wRV)-n1xA!#TP+CDW>yrSiIRaX>E})1;bhZzP+|7JI9R}r zg;azAxVEokM;r;Dq?%XE-cV#QmI?(lepl8J{&O>K^jh#AK|!LO|MR-xjUkXef7isn zT_Zrw*DA0Vz`qoU=3EN*KUXH^?MYYI?ahd^ttjvlyir5&za%ECMD)(DhKeRtqbtFK zqRle?1&%$)R_;{D0wb1m+BSIwy!>(|=aHn>+w66@N6Zcb+>ekJnH&|_<3qXa_WvZN zl97=q&I=jXO3SzH@%2oO4nf#lp^|F7-^q7NIIEm*tKPoW-=^R%)KIh+7V8{{O)NYV zIz9d3)FK0Ry1+cnNKH$FJZPxuJQ`2VU5-_vH_lj8q%ijxY0h7qQ%tvGc~8A7X!ACW z(tLN=4y*W;csjr3FiZ=bcobeOY!Bu{lWTwXeZfAx!q^(liA>q-23es{Od7@_Ke8d7R%#yO9D;0_08v0up+3c2KL)@R_J3ec zVIc$W3uJ2(pdc1MpN9cRK!gxo@Oa#KPtUGa|}T$em**03s`F}0yF=N5EupDj;oo*DA-tP397D zbv>Qdqo5K&nG49cOP2z8Wx&uZRTyJ(HA=EQ80cRf=;Sh=KZr&$M|ejIJ)hyfxkldb zw()_u3j#6kHe4&LF^c^NWIz}IhN3g)9J~dwuBP*Hc9Dz1mHSbD%O^dAV^x9=x-EcCr!HH}ceq4-XgLr@Zk?b{jl+GtI z!+aH5Lk0w8@l=z{9>eTjdJ^kha*HjcOIk2Dr;V;{!maZyYQBVUQBB_`JYpW_ECk+| zlYT%Y2B}^8DEc$wa+^q7F{b2L$kt?cn*?u0VDR2M=?39@om6aL!CapP!*8pYSCQdw zsBL99$&7tX*F*K$GxQir%5qYSS4-ptv6FtIqVbtU)_q4TeXdZ6G$`7u(} ziT27l*||JmhKdVqV3G0g0bkx_Wl!2O8H^5^gu=RnC^vP|c*`K%+er>oXZ2LO*Bj&4 z`;upS9W(&nx&mV=1sR@z6|gQ8D7vC`eBS=a2GY# z0MbYMi~m><0|lu^D=v79!qCI>Qk+kzw3CG3m}kRld0aMIV_2Bp3SsqQKB$NSCaVF1 z|71~t2tLCTH8i3iH9d5d&Mljbq|z=BJe&*4e=QoSn^nei+J6_lHa>!nDY6_Ht zd6UZ#rZEWdW`sX%7ZplbCpe&wEQf4z%Z_mI0c_BB(pGjIVvUQ_g+=}yI~c}zao+b#U#X87NbL(=c@=u7`;UIH>)2?W2)BZ<@2}`wzF$^`x_of0u2|7)>8PV#~9 zCVXQ(vGIpT5xCBWKBx~le@)^t0+6cAMHB=p%HOPQX2jkBRr;bL2G}m?@rZbb!-f;) zjhX5$x|{C;+uz5GOO1<4a=bJXJ+g?@AOgBwxwj*D!4?H?MvHYjjubB7PbSKm7>oI1 z-B<3i?VqM`=4LV!Q48RRu(H)j>jOwpKN{WvI6tim;c|Ymm%OfN5aTuijY-7Uc9NWo z)83K{572tWd4b$hxSoWyyEx- zjSb1DCLyrNSo#MxyfW<2cMFl^a&6FCaxCIoJL!C0-DGqKn{Dd8Tcv4yvAjx1>&#z3 z?=SrJJ-dSQn&LbJ#QA_fd>s+!aI@rtUIOVoH~hgEs0}5N;*0QE2PQ)#(0EV!WAhSE z96C5?h$avPMkmHQrH@ACG%5LyP-R*R zfIDzaMU|vRsOGb?`GG>=z!?d8#AsSP;`A$qD>J2d(xUfIO zpG>}&51Nu5P2hG(JU9dTQPh1&YnJh=v8q|I5{Pq%1*Z!>%QM?@a|qlfUBIA?^P_!B zV{npq>s?b?uJAjkwE9S_dm|pYSrhwsT&gOL_%PNpkR}owMO^SSf;) zwo}0N8B;EkCpI+Vgst)1RVp~A64|{I%Bh0Bw)w$ycOQQ2S3EW%1%GHG{YVHBAH(RP zdaKeKzuNVVxQbULnguB-X=j!syGy!_VdLzU9sdr#dIEJ;-Q5qvI;rk%~B-07= zfIYj8cUEoISXi08POV6viw>04kqB}$Aqcg6;7B4>rEmJ`pUJhs!a#JMy_{9br}4dz z8aFx;F;|08*abmn`)a&~!;$)}{HCJmC0pG`cjPh>o{Le*n4ZwzuzdXMo+B!gqzGe{ zPv)vJ78;SuZ@LIn4{CItI@DX+0`LqKK$=f>gY-eGsLBTIQW)Q{zNUSL-F%X+qQoB# z#U$`2&wvu;r+_>kZy_k`vZ0?ys_v-igoh6<$p2F4*1Q-&gUh#8mEe+Q};~*s~@6DU+l*l41P_C z^n4GoHenBJL$pkWm_zUaRgZm}(q0SBS%vo`ZN%OpNIf1{EHmxIHd$f*M;o021ek~;r$OUcUNbn z{=PniM03dmw0envi8nXpA!lE_vEi)+9&!<{DlCQ7S#K}^5XAROG$&*28cFN_zP7RU zKXPJhRKpq0gBjozhUO#v*&g>UxB2t=&47_)LfKg8$%H3*k~S;Sx1t%lD8$~(vigcb zGg@YmNAoT|NmQ>T_GOh@3ukDFmc5JxBYJPwvL3zzBB0gjL- zKTVS7NSoA2zuGD#m*p4Rt-V7Kp6x>B?XO_)krB+I4~AHh0yR8RHK_+BC@v_qiA>$@cG{P(cE3>41>B_@$~mJvKKnofA5Es9*|*3Q{ok zH9JBMmg*f~S$r|Z!11IVn_vd1T|KA>g@myUNKNzyr_x%^>%hl3c)&-=H6Q?wTbc3f z4chB$$K&!YO{`h$>)oyP!_RfF*Y;Va=IcYn%3YEH3?N~YnUgv_mVL#!TS0eBfvQ+* zZPx4J)ayvB=udpw&d zYYU?6aQdKpv$fKlJ#~NGkf~9z<9j;+I!o2OLKEm{&J~(cOUt3WY=-Y-C;2w<^q*Ez(gXv z(SSURyl@a^8`}rp*ZaW7p6ucLo&LD$;{i`x2sQKZKwImYQ2KQ3`HZgbF{K}JQwYZ* zD_P&qelnhO#D(Id!gqDk*IO%PyfpxRZTchN#uJV9+NLiTM7=wzuSb5|uTQ+MR}>wW z`>LN|xdghPH2`zs)=uc&RWOWz&be=lI@&}4Kp3Vo6rdNi6#&qqxrCnFmo>N2E_tHJ zHekM`={3P(v3ngfQQ`6Gz9ABDd>woy%zr{;7vFx$J3l;O_~Ku$>qu3Kk9q)?oTkxa zs8?mTB$AP}N(8pN#7)hC1vI_BhUzUU}3SLfz}(^LUV)Tj3aH-hmsk zN}FvG0`b2v#g$+=kc%V{?waHpY$6vF;riE8=^GZK;*zDksUlBvcny_aAgnE$Qa*<^ zmoufQeQSDSVq-c|S5=b>mS1=8w;is@r5;*9-hXR3y_S7%C`(n2g~NDu@KrZlotcU8 zOibJLdGypHnR4~12K>A;+wl->RPOma@PXtmyMTc^ON&3zH64wq?Y8EMJgQx$90slqHL zIp^|A zrPK2E;@UolW8+$sP2X7UO_r`098IwXy$TO54_zRAP&Fw*Y;8+inD^Q~`Fr z-tG$uvT6f0Ym+kadu4dN?5GC?wJ>(v?5no~1qEfsAAeVRnoblK|J8AIHofbVNwa=( z!dgA%&uTf`xh(LJ9mq&}M%JWH%6`jnI6b@SdL19BxZx6tC~kH7 z!*V{P^O=y3bPU`CQeUuU6RMW)o#-w_SwVq1-BvD%o50AO%{oFgqP!(* zK+mH-Pw6uBQ?J*@&vdJWlfqA5wR|2`skg=6z>e^Gt+cbwMO&^8plBmfZ>SP(;y&u@ ztqMrDTsZJ=v_HNjZ3W;Vv$2>>)j)h%PY9MN`9*z0+vl3A56>(#^GJ=S$9>5ZSfgWB zJ43Ullb68aZab6=BNw4&z8vp{vKr7My){Lbi9fX0?0jM*X20%et_u}BmMe~7NC^y9~rEjDoNIW zoz36=tPM#k>;I$yQNdR}+N~A`*EbcR%X1WxnG~q6xX%A!Q*r>jiWOX-i*wAxuEx!} zFD1F_8wFlr3EQAOQMf+{kd8ileylxx--+by&>d(P?y5re*7zkas;$%H1w%mV*dWyt z`zTcZ&Aq7Sf)n+LBM7zkK4ho7~x zzCgWeK#sOWJ6R%4u@2LH`=&|LZ!&{>!uIRE_M^f?fjIG5?)(Ds174&~SEi*8&`ruk z9jxMZahMxG`A|?+VgVi+#+C zgzf1B@BQOW>Mk`MZLIC74Fa9##Zty`oN+_K9QUk_4zgh@}+0Ov|ZYfo}S zEIFrBNW+wA^t8nDN361bRg?z^CoGO&vq##Y!pW^y3^SbEM3kK(_6x6za1E}FqaAR z1vFM9E?~2xT{#xStLPYTkst@ftg-fy2P;Tg5nNI)OlQ!~m|%)9ge4-4w-hbpb9R;h zbG$R?A?RCR=MMm5B|QWV|GVn~IU3gRB@2ccGGxbSJCW#-E}*BH0Oqi4rZ8vFfH0!} zgg6NPy{k4`z4>Gcik`ALT~Kk&(H-Ho$%g#hS`od4b8*Koa=XPddkez(5-ZToLaTX8 zb~6!R%=mYJSEU%XGRJZAqn`j#E(Oss%_lDxSyaiR`aZv#>7Ah#UY5ru6;gCuJ2CYVK~&giNq?noM>C4j+NlO%*{JA} z#q5&?g~E)V%d~c5Qc7YzKc*KF!8s2HoIwzGHT&*R822?60jq4EV}(Xluw~0>DvM50 zFkAB)_%)iP6S29BN`8NT#4B3YRQbyt_;USPM-g>Mcf zPBmzvY$nM8+v*7K3n+%axMYHdRV4X5FL-!L4{QE7U=KLLsf1bN=Cf$zNNjR|?6eJx zS^AMK#$CIKmF8k7hD{=Yu%e~&ESBc5eshfUq(P|;{ zMODYFBJloryRlA^z6bnT=;E`;bL*_YyMTZd(AJq8GF+aNB~gfwnhyQ>V|o;ekjn?= zs0PDhHVYTb1EsujY!u}WO2-TQ2!lDi+DnFa0Yt3)!i?yP62Cyf4WXDIZfHgTKwxv7 z8D%aQzZ0ix1V2QsH#|cMs0DBqT?YcPcNMydV2Pc5s&#|}{o1p&rZ1~_ zt~BV*pgSiAkRY!Oaqr9iLOMGh9Qg8iw7VQTZH^c{VhG86fZ_b^Q)XV(SrNVjP2zQK?x$6vDdNUdt%2aThE=LtJx01r)7q^w1KN36_V?y%% zy^^W|Jc5x18fjg)`2<)+R{AOt-la`nM3N=f6H#|tH`y;(B(Cf@mcX z_6%C0d_*9u(mJs;X(yP2kMW~0f$Cu$W$n!89p#!zT!05;VN|pwy$A56)g!uX$yHKK1yr6AxF*#oVMf-YvIi z2;|x@pP14s(G33(SL>Lgv1wsReVw8Yw)y^hGyB}>T7j_eK#s0co@>7*Sjh4dxj!S{ zfeMv;(1v?_Kl^jPugA4q{Iq{UzW+_k$%M+0uwR{Ll)vc>^j~Md!I+hs8Q896H;6lb z{qsV{t@&4tyr}wvXxrQKsHvS0bmADu-R;{cOV(D^>5ugT# zI^R757(c#+Xk`THiY*43iy@f`FB5?wwWPv+^Ggp>PXUbMNZPm&)I#*>U{{~Nf(X)%VH-bRI+wD@_%UAWH()rs#BHYMwjnX$Z$+R6oK@;5jelr zT76SC7V`b+`ryfDKI9q3mdHo5uV5Y|BHEVIs*k7jk$$|K%7`(Z zQC#)8K@lf0RX!sZTngyL)f<84kn`rHOyz@su>&Kyi!s@6L`Cu%d0^<-rc>tgzWg*W z_pL(Q5B8@Cr2IXyCFtJxaTq6Ee57$E2^aZ?VI5_BsFpXW7{6e8XIyZdnwv0QMxY8~ z=k$I;b#ZvKf&)>p|3sS`6oD3O!B$}GZ|U|BDlbmv@Q?G=VVA!#;8UdhlCohfj`?&g z1^VnugBvVOG15|&!;~ruv_UaSF*)g=8# zQ;L@3#L#}W64mXz&*}k`rKG%czl2ow!gGq$T6TJUYaL{ToN`ie@1n1k1uC;4Xt1X9 zDM-cbT<#hc8_l1vrCY9!eUFIioggh0Fs+v8_8d*_i*1jw7~{avIf%WTkicH2SRk>| zqj7AKU2#(y2l1AyQMu2JFA!EaxN{2&D+PBk9ea|S8DhnmXEqC}0R%;Xw8z`7yv5^1 zzZxH!C}^iT4hLt~Dc5Uj{gG``e#<3T2H4+cy}deYlLyz)Oc~hLX~?sEyAlgEbg+n| z>!Ubm;O+YHktz|pLpl9w($W+3Ha8acPVNMF^k~UH=BeQYF_dv6?|`xSMujO>`Vbkd zEKH>SwFa@kl#a^^MCpB~?6{VFV{kbbf-7gJHO?GdXZLg1VQZO8cr+v_XI(+xR#-PE zkE~$(lR{_3Hg7&uyi6cvEy*kiZ=&QCbd5^VG`*{)smb_y=?zTLE~vKl2U}byV{XON z4imi*z5ZrDTIGkgy`uL=}#>poT`@%yhkZmQ?JtuY4g9ZC$xPk_MYG3}>L2 zub4hrKIrClU%^9rD<^@DJhYe9X((gVKg$h|rtOhumF-5G|eg9t3o_E1R5#c{ZF&R;h26i~u(5zqwK; zQW%goF_b(0LX!oNe;bBIW-O;|Si2w>)?)jxq&34Tz$&ll{VX`_H<{&>{6sn4Y6WlE z@72-R$VT6QF}%vJYrtOL3@NIN!Mi$_XTC^{iXUd<=0Ah13d}H4*5sKr%vIaFG8`up z19rUfa7(>`ZQh=@FEz3WAFlJ?yuB#O%iRRnE-{$ zK)(zr1J9t5l3LK6jx+rha7j2^w)LZt1tzB?zoOmC$#Lv^m1$I>Q)YE6a>wn8exCw6qrUVbnbX50{YHZ5 z2vS-Q6QHp%rF41tko}GG|0Ci9+F6wZ9&Mf>_X;!WWTIRo&S4HW>=Aa{Pi~jDAM~7# z)}fb~=qfza%PNLze%*-5gi}C0y8XV1d;9Jhra}8H3d>Dc?)Q;%0Hd|ie}Kbsbw5Lz>&Anx0_t8tzkj5m?T zv-7Ek7iA?MOktJ;fY(@nz79Wkzbiy>(Y01^p1K!<>MJSEp!Ebs^A&EOdEh6-mV^ls zV}4ZqFj2Nv*G_OS7N1Obk8N{$WAJ!klR{9WWQ5>0>TH^1ISDh;)<&O%a={Md>Y(Sq zLEx2RwgfI?EmcjRGJL8D+Xexe`N0MKH!crx$2TKS_7lTg%GB2ZwRGtJ zNuR??-e4qh$l7EbDxsCc(UfWW46<7op{uTOVT&GWmy!2Q6N#4a*GY`lV9URT= z+Mr*{nB}zWxc_UWm(c25E%isLo%GWA<3CUZHT;m<&&V}j2{XtX>wMP}1Dv6I3YE#V zSmVieb;c5Pi7bTr^HGo}@_6DCX(5kW$$sgpAYWY9zVp|awjpH@tS3Pg)&YVrgTtLH z3~RsLQ;Dv>C(p}Lg~IWhE|1#C&Z>(=`C|5^sm|>Y>hCIAakGvcA8u-Q~(KiRTTk$)zum4)=E>&Xo=d zCDp^(F5iD`*#EXjx+Moj^47F;PKz+iH8i=BvMF6yr&l!*`4aFlp^B)OfS;(DY&Bv_ zw>Sq^!o@1OP|<`uU&#BOA$&|IBBVC_2M6<1f8&B8gUiq_Bud5XXu-vj(6X$$LbSi& z&QDaNwObh*M{uQaEk`_Xe1QI|HAoPB^OyQ6V_={>>cq;Do{HWFddJ8ztsW=#&8;X< zAus_VfhC>TcaympBphNrw|;2eQ5_+ z6^HHb_r7&S($sDjJ+I>i{ba|D7u`JBqqDcPdx+6S8YiH+`w-cjIIg6Zm_YedCrKV$C z{*pBk?^ZG~Ad)JmjQ7FxU;HLG(V4(5djB@@s&)XmvTW~+%J0`Hm%#mhac){L5fHZy zY^*Id^W7L_@Bn<7{;AiW5&oOLj^+R z;iVdzisp=blLnp9or+DkLY`XU|3lkbKt-jdTtv zp@5PCD&5`9(9+%A2uOE-2h{hz_ulW`_5ZK+eQUXJX3jq6?DO<~p5L<%w5{6f&%EC| z&_AmPL;byIn^y*7{J(sXI|Q%we#@aG-vtW`{Pti2kWyf&bq|Oj0V!n*fC7aay#Ji# z0*XANp&ch4dwbc5)w!yTsSJ(TIQiN&MuRKD4jOp~K&s3UNR^M-639%t_w0~zx{ zNh*&cdLl;?l(OI><^=sCBOp_E|7i>~QG;~oI=?%(CT3@!{pU9FYA_OY2J_JI{$X*i zz-0e41&VdYjY;0KfgI>lxr0;s#~ChiS?hjA7b8lqV^LcXWLPTHBmwV^uE)$`BeJ>= zzS37gCDQlylXWJuW5SyPpSO1jzGj{IK=(p~&hyM&r|aH1 zg&wGm^IQ!-C5%56=5jKX;OZ6*-)*XZAJCXyZ10@SLrAW7FO>HMabKQnW59QT%|j@P zp)U{X6H;Mu)U+~Y&(uOHnPNB~bIo);nhd1{vsc?r=01U@Lm<89%COT%pr`bAh0WU} z;J0F^^A_af=bZ0FLe`&G?dF?E4JXrbBA(^W3`S$7G^+3e2MYzOSLbM9iG z8S1&YYy8sXbi&Pvi4aui{=MVb`qxvRJ7Bw{a$SS&Z7v)1{^sPI(|UoHcE4+kfnZD4PN zn}&*^4~L59J2}Vd{+B$=&o>LQxL{(iFv zX_;)+s;JDRr7Xdyx(8Jt3J*k;I_+cX!4UmEjU5}=vl0F}i-Dk)rc6QT`W+tC@%Bta zc2K}Jtuz^qM9&AYydF{{X3Qr~KoAOwJd*ZDr8S^r8{PSf>mTrAxcg>Mhpx+w!T!R{ zhV}Fr%S~Ix%YzLI7R(j0id7_^;$kto(3R{RyBSp@CaSNY{urz~#Xg!uQM*EdSaJqH z(+IoAbFn861W^V;MDa&$QOP33+h+FSKG|DsIfRjdXq$!eG1yW20~7rLcJ<7;9i`2k zE(hqGZP+DTJ8@aL|Jpc!@7nR-46J>hDzhN#w$ti6IK#AiE@c#&pJTdDE7$&@Jv2eI zSjNcIf%=7{$TzJG4dPky*1B5K9&5=UmfcYyAs}6IkHf3DDX!0wN@9E|meJfzIdF`l zHKn}z`1p_<*^6S}15_TGxb7$>e+1?~g(O^;$z8=WR9qkNyX~FSAJoiwY)y{%BGxh% zGhhXQ3g6)5BX7^#)REK|U(8}$c8|fY9k9J0%K!2b09lYD0l7qc-2a@U4yg0G>IH%H zBJb*7{|NAZNtQ>rcz3wX@qW8*IX>pN38Rc=di}g-N0KUkno9zbZOR);xF+Mga=3m# z<&U~XvsTrQK9x5RE;=2f`pG|bI_v?JsO*$1gZ3mpUw$6dDEGo~wf>eC4XV!k`H|Wc zJQ%8HWgn|x{rw?!Sb8<}6E6G7@4X%pLk4&(^63uO46GGH_pHfi9e4%g0*ug5-R5TE z-h^PA)YnyeT6h7K<&c89Lp6drFWJWv8?KpC9qSBVH;qoO7?zQ&q)n2ixk)m}cQiGM z9fhM@n4gz`GnB<>;=(9Q7>2@1WV;4EzE?z5(-(mV4UnXYMI~)E+RoG&{Q0t;xz}LS~i}gfnXjG>y@81uUso`iQplN{EXKWyOp6Gg>H*&!)cJufzx_72uT(%{UcwWtU z?j00pI;PGe8BkX;ef|OF39zKbW{)lS8hTDGhb>pWAus;Lo?XqTvKleA_iGxq){BQ3 zirPk>_frIYp7;_4Muo$3A16*{3$eFN{mN{mw&Zx`Y%!Vlc$6DKC-D|Gv364LzH<#f zZCc|$iHD!Xlbo&Bh4CF+V%+SO8;Uhe&r7Wx@R60Ak!p$Jy(!a;jrG&+{!rf`5t}=} z`2{Fq52Nxh&TC#f&6I%BVDFo-3QdQp?bu&4xKl>IdvIj(p^hH8}!1ITgSugJKTl zAT`|wQfi%l}CKmUsYrx4|kiu2dR17qxP^5qYDr ztr9nvL7mH)mPg;tnQ-PrhnL8oF^*&G!UE*z%W`sI4w6VClOpAh%)dTuhPbcfUCo4L zL7lJ9;;o5@x9cw_^UUGh2RFNUa&wC$lfy1ISz!{>HYcky4+=0W$M)ECj)!@@^K#L6rR0p=W7yQ#f%o)7$kUpU=t^PfK8H<|$511Q0a zIzN#gp_}xaVd(1$&%%yQZ!IW^jbF%YfMdAM%Yf263e-YC(|rgo^*Ae&8)BbLGt_q8 z-H@tb;ZOgC1EFQv;y*id7)d(Y(MND32fENDV#;+Z&o0TJN=t^EfS&h1igy$mfwZ@b zR(YI7_Szggq#Q<(4N_9l85A9;eLt(KH%1!wL{;8r5j>$<3v$68d>#jNKHAPRhY29u zFp#WC-NfH=djC9!i~k787SWAMMac>>ox0u=G^33*aGY<+#v-6KTIqRkpz99>Q8c8_ z*iyuhp#V(XK#FdkiSL7D*%t@`d5z}A^gCq^ZH4@_mcRHAgt`mX;~p>7V#~E{vTX(5 zF6!g-IH3%b};1B+D48X?DU{GT%-04snJZKd-E>nAWx##l|( zOXrsIUA?*O?8(at8=h?bL^63CQ$CXs^;)yT(((j+zO?c+-x;9=tcN+?A8DM!NY#A| zHX_|EEAZ%HHF)gd`f&WT%vdcrWD#eKtWb38Sh>!Jy}Jh==>EkRL- zArx}{Y^Q`K{$zeO1(~jO8L~hI9^y^?cX;EFx|;G;()BWuKBGLOYeaHZQy@1`?o^gdx62M`7NJMe+bZ|Mq@ zjhlFgy~-NzSgi*njrbh@p8sVFY4STAjs?q)`r{wFYKROLohLV;KL3d&*LhkMvd9Ui zEi}c(s7oh)z>WS+1)!Py!tEYw8%VSZ33QS2UaJS_o}TmfVF$V^%S4B^0sw$uynhWG z=5x&Z50`u5xnNggFzvdAf~(1bk?(Yr_GN39?mFsk5nNj2m(RZ_h?C-h^o{@`05>S* zQ=%>M$~&%J$+)3j8-dsavr#&+B|!L4|4qWq?{rVF{!+po$eJPieZ>Du5}`YL8@?gJ zXqW_GF86C2ivMx|NLDwn`9t(>4<%CAeLi{A?Vc_V=fNZkM4v>QX??rsqHi3Vv| zLl^~n9FlpCE(`cw7hvt88uVKwa!+vfeT7OD9tc2@OIhsrP_}0L7F7Jn90eFb4U$E7 zD)@6(nvARnB&>9G|K<^kjp%pMREs)tOr+Tr{orKDfLzJ^Nx zgya_W(@$uh2S5q*QdIFnq1;R-6wpdUx&$j_jd_~Ehw;`O;6hi;`^$QDUf0O1N&GOz zDMGI0H4M{}+Dpb{&qit`ZKZD97g*daChHZhjOn!Spslpdb?p_ASbHwOT%AysB)C08C1acR6W z4eX*9h3Z(=CKD^&viwB;bA+Ox^d}+?^5axXA#O$UzUApzi5SA7=5?V=S`~CW{m3G( zZrQlfwIg)oMI@8#p=i$1z>(IwCUuwPTxdgEoKeEWnSB*>S=ov8zG^>df5?*Z` zaISpka|tS6W8OO+>`3nz8iDjn7Y~268Cmw7rDRF99FORzQp-Cg=JKOvokr5TE=_YELbnxEu`420}_ z$0Xy3723@Ux?>|0DGcw$cfQb6UYEeIPipZ$U(ttIqnPecdN-5D{+ka#9%7WTtv^9GKM~3a2DQ*>J zZaZZu%6jzA&gInk)^w+L?ylT};^>yCD;C~^ZokMo9=uKtSysfgXcS=V$C!n*&2EH-F><17Q~%;N)yH*=)ghG!rk6M*XM{T2jZsDL%V574cwE_$_a1*$!` z{a6c?w~x6s8n+kPMI5XF0og%~+p8oS3N!&W_V0~`*8xlopw(Ug&gKth^lrWV$MgP$ z(%m^|6_y5m`~-MEc{0lxm{8EYFS#~_Y49{$^r;amOJc!K3i_R`QLZy@bg&M{p5_Gn zrsXGt>xx6&C7#|9_%giUmr4TTa*R(~1t?~A0VUL*;oQ~H6Xn2z$Nb&kPxc}xGK zFHb&xk5+FOMJIUG0U6f0$kW;@57qZRN_r=X*&FAAAXzf@iV@_O4Yipkc=sjq;y&r%B49C60D}EDoZ$Z& zeMsmu%xZ!;KRMNHYP(|LMu0H^zz+xj`~a-j8gDlNQe(*ME(k8)oy~aBEo90~q+B07 zn3{S(Z*B~iu%u6q8z0oa7;2WqwPl(tCuh=VQ4VvTbJP;IoLv(ll6=Bh4mW>5pG7Ej zH9Fq$;SEI!g0nZ7{4w}qs29;R|CyTns4ZVJB#=LDRVS-T{B6Xfxk7cRSP)M{o~4X^ z>W4km&>xVmyiUD}4}tUgaUd2$-Af~u2?3S4$~^NX8tIG*3IJMY_7xI5{GBUIQi$GY z^!Pb1y}1vb5-Y_(0Dh|Bjm?}8NQX{TY?1=k7E!3N6g_AdUos$_GHIibgO|A+50NAU zX%V52m5VwxuSZiPhxB14@>LM33v^u-gN8%cO@i}Ymj`@gW8X6KD-Ltci&ytEt!B3{ zi10VS8=;BwNWId`{f@?KpSQ7~B8qEGmQugIJ{Q)abLMUTG6g-IcbM{b9odRxc}02q1B;>e&~BgNhbN^k#vdvPM&X8U z5Z`3s*&=1}6r>zTZt%3DzSpGXM^Pb1`QFw+N>x!z{Hc{6Pa!iuRi2yYh1W1=G2M&Y z@r71T2K9Cfc{#~QHupfk*bNBbV|1L_27eng_N1TACQX@8Zed<#LAFo*k27=x%J~`{ zMSLkQ*U$*b9LlIemyUaTW50=2SeFDra@~yr@*=ZCgV>TOrsSu8>B<|Yrq@CH9m72& z`6m_lTd^!t37*_X*U?MBh{@=`wyzeIh$gZSOS;ZO+s{0AJpI-r-Il!lSXP1ktsS94{b#VjlEh$xL)dpo;=!~^oJLp z=nYGeGt9J?*@ueE*-XSLz+F|jn_Lqmqn(^YdVF+ogsvZ%`WM2p#>-RQQlxmNGx$ug zXQZm|iB3R%re>JJ;)%TV516IhCL#<~Bk9z}%w{$iqb4$?icC9Sxz4p`KeXdL02fu_ zEw83kkthz{U;J$HePEQkHC_w~@whZDjJlGyeyWsq9ILtPz5|zJ@ z0jTB2zR1D_*2o%P?QJBq$Ib}-p*4!4vG=QctX_jkMQ5W} z*(u?t3?SJ|9t#=OJP*&{SHxSm`x#*(&-sifTBZ8B+a4tNHVL-pjDCqD!$AJ=RE*}n zwJ0%_0nKply|Q!PzK`ltGzchZ%GqjBZ%c+2q$ZebAD2~=r>7rpVmN8xDn@gjDfk6X zr%de8n($iB>)k!_0d6A^5Au1+!C6ZyFH~;VDze=%W|_0dsqg*kS3=&}p~%~>Q(t2Z zUZc>l-e=hbAY?-TmMp;oDE~^{(k23$7}fKFKR!Kru5+khFG&0Irh4v6M8YUbb+M$x zpwr#r7Y4$@OxYJKujRl3IzH1>sV7{p>^D;99@61~)r=S|1l93+4C$a0iq z`(YfOQ$^BmH2}Pk_TY1eHS!E+jX87x(Bp#Oh>4aVBuHbNk@!kk z9Oasg^_IjbP<(QN84J{;GE-I($ejk2{s1Sk0LOmZ1|*>WRX134NOk&&V{xtqqjJ+i zI|s=(oV8xoyct*5wqtQHP5P<4Efc+d=6olwS#Ai0LF~@nS6d$S5h8R1HSQOZR*VBS zYY8jMm+OM~F^n;LOcgyA`nw)4ne!>aD^i77Yu1TAij`O>Y7)HmZT}-RY)4xeeU}q9o36@46-s2t0`N$5wf7n zLO&q6^KvGNeA~IA;(36g&+_{)3>BT72a=U;nOAr6dTSv}4#BM9CfuFlX$yu+VVvwD z8SYEL4ucs%tnMhx)XfUl*+jG1L}i#EV=qUG8IyIayIGft+GI(v+l<&$ASy(&BiSgi zZ}~Wy1*v}S9(4)TCvW`CR_k*yj8Bt=_hVT3G`jK!S}_h{{IyuV)GUdcPy0~gW%=gq zKU(em7|a!>ryomV+;kUu*;ziqY8H%S&4-d^PtaKATGGhW_BLcs3sld;)N2+e(PLHq z34ruzoMKKUnq-*-IF9(_h*xA$T`K6G_hPI~LUSme4iucU`1BBwqZDDIV@0JTN=je_ zANt-2Ibb6bU*P?G^etNGrmcn)!uW;o56|B>ir0dee*IW#uD3kr&mp{4jpQ=1~zYucJ^hn^<<1mQV&eTzZt5>`Lw8Za~;iX$Zm%GUdpL#LdTDQH;)NnWZ&iH7&A3L z%@`zXhAhSX9RH~PIk9Tp^!2e!5+h2PxQPAfkYm(A`Tm64tXHS-kb+wkwclj24CY z=M=WTh~axRf+fij`-dd9<{hnph}vHFS^Aq(YB=W)d6^7?_koP1Bc45NK(Gi?=sP?I z^H$<*kp6mdBmR2{IOQDbPQYCr8A6MqNFM z%d$ZhS%}sD{9~3j9yK^zYvZP>&?Vt*Ga&X}RAhGb?^^`LlBn?1LE1K&>UucLA)Px} zM{S=&2lPL2G_87sqC=g%-}Dy%iPYx5-++bQWYO(4fNDOz{V{kQYghq?S)jTnZ-HIA z$&5!mebXJK1f%>Ypc_XeH0I=cdZGKQjYs}*X}_AAYS=%z`xEJqI^khI(^*uFjdk}6 z97eko`bam0H?L?&8c*^?1h3yu%_K`7@Q=S~%AF@%QeQbD%8OZQF5wNJfv7XuO)Ge+d45|S zujTeRVydB)_urLjjedQ{NJSVTdcoOg?zC(j_DSVzCL!Y>F(N;NP z03nZQzO+=tm{h`nDRf9^Cg4|~|Ktycq8EFJY*9HY!NsUc?+Q#**NzLH5-Id;J&QLJ z)=F+l-ElmyE8@Pht3YP`iu)lZ=M44nOtpz{c;i8l;RTH7$Nt|;{()Bt@5lG$UZo_`l4OT{qwaHn-V z+O7Fm0{!$|g$1*Ki2V%<^_2AG1rpZ`M7q5ED7|cZaQ@**NAs46%RTOTx0v#(xQKuN z|C#ZlzV39IH%HVit>P`H;o-FD(a7`}1V_!t&-77}%)as~#Js*@l;Lc_B3T`o8EkG{ zw>8Bxe37WdrhaN5c&_>~{x#km=jONdczpwroEZ|_{N=h#89Sjzlrl|++cVh&JJcqZ zgQv1@$AAsTZE0JVYEHeY$TgzYTo}SS_qkk7of%*WZMxy`E8|Jkk;5(~_OB>(OYdKE1{73`x*StH$A*@s?++2#I4ZMn#KoHdswDw<$j zt7(pdy?KE!;4r`;`u$%au&9Kpb9#dPB;LIiXDq4ec8|OGEjGYPgnipvtj4hCIW>Ti zy?^I>H*|p7?!Q(h?;C}5NM~lYWvTZ0uOSHi=zl%5U<7ntOLyH9m&RmPQHUReEm4h4 zt;934hb41jU_SV0Iv+owbH?GA>6&^WRQ=m4SGmy}SBt^u=8luHHJK!Y^X4t(fS&Qj$z}d?$i)v2u^?UucOu^<%|gm1N{uN)79U-!nnPK?`=gwvz`0q}q+%P%M5j8) z%u%0iG_c6)0Id1d2WKdfNkxb*zX|tHM<54HC3O`y&yxKgRsm3ZqZsLCG24|=(=!vG z^;UPjgPLWFJXl8{{jn~h2#bJ{tmP+YWg^REa%4TuQ&$9I-2tw%U#}C#g*ZxF;%mJa z@I!J!bI3UgOwfx!_)j@m3GfGJ1iuZwy?48i1(xn_oDn>S=(K&tXHWlRpY+6w8k~VT z+TTpn-OAX2{T4@bw=8BQ0ANkv+c^Rm4rRb9wgXo2LhaS!j=#|ys>LM%%v~|_RgCrZ z2U&N|tPqnB>`OQAe?V&#Xvd60f(tYr8xQge*h1J(q?14NKGVNTQgL!#R=oc;Kq}dR zU#7c6(PY1vcbQAvhxs?)##ma<#~FAK?2^A@ZEg23?Oq2uJS}JcvdXA8*{?o9P24gu zTZ0TAgCpI?EL%&e6enk3^t*lMjFLR^D+BP4YUDlefW?+dYgS~v*O$o@o~gm_`+ zP~bTlAf-j?aPIO}_*$1RU+-?y-!Pl6_`oLw-jIWGHPWy5X%%;^{VN$QS#?%m;Dp|n zfGS(Hr`-$6rf;Rp!W7tMA>96h2Ls`0I;3CFd$5ZGa&vezsvutyv(?85IDG(@>=mDypN>V`FlIs;cpm- z-%H6~BsSC%sv^irnPz;M>0+rWvQyE~yGb3&Y9**4#@Eei_jJ7dqt;S_lA-b|Uoua{ zayIp}JPlm7fb60`1oV@s`x-giKDULmuHgeqy-60x(*uV+sZpHB@!4iT$jAGdfP%;^ zY->!Y{4x|_KcSND*B;Fnf0HsNb2#7V3oN9gvG)A^0mjQ7_>MooBF&`$#OVtW#N@oU z6?^&7a+JZsia!7Z;}f*|Ugy;wD+7}wd+zfSj0|*IqgfcR_dDte2zz`V+z(gWM`qum zq3O+rlA@d;)sTNu!~Ib~V4V-m1Y(o--oRWsbwIR0o*Dlx8=8pz=L#T}{`)|C^nKvI znXbV4?|&6dAaw)ezWYOgtIZ?57bt-iT8~{=5BHIKa9z_@60EU~WKO#yYyWbxZdS;3 zDDV%$pf(Y7VaGCk90zaRc6ym-q z+qEd*lWPx>3<+2$daYK*H$d69(21tI@7s6rwKYqx@ZEe|JF)vi(bNagXY(aL)ytAn zN);#KG&5y+jb8#pxm7EkHn1)EfU|y+{iF%9=Ebb6lo_uo?sB>Q*mr8N;OG^*$SoQKE}WPNZF_wVozJS1hPR*U9j8CzrYbX2cpP zuEge;rg}SKOq(mgd9J8qa-(u~x-j~uyh-I!MMp(xdMxzpcZ|vDUq3}@4D|`9O2Tmn z2ogRXj9s_y1w!Y;bK_LvLWSy+NYw==^9XZs##SH2?P}36R22o+y1BKydIeOSgcBPf zxk#;qA?y-OA1CowYjCTL{^(b32^6&H^;Eh%83B+$A?CGXzFBc`b z(r7xg^p9!Qu=aVAK zS?^gUM$lT$WT*3fZ2>9Pxs4A0|GRB_MB4#i`fReS;d z!&{;{P!H$li_gYOVFCHll(>qMb#6{{edBFAkp4Jv-sISi59ood+Z*)>6-S;4J`gQy zd2z1gj-~M$5u5RcB|DXTx1ctu+P(T?b*Z$K{F?DdRZVLxnE-dCy$|2Tntt;^?=jHg z-vZ&}5$sFtrxON${r*Rke@;P^XX_v={k$Q4Cf3#yW7X%ae@_9z46HwM{8k4l*w}WN zY9i+!8>$SQR^AkD5fdy(_DB|2%GZwGIiPt&q^Z81Prv2CF|tyRf4G)9+8HwVkZN`N z&7Dt1^RBA(qL{KwQ0vM39K7<}B)ft(tm#-$rpnbCzOOw`y%Ozf#vE>99YnLS8!`xV z8@&EALs~Zk7Xgl0v+zgF&6?PI#ATQ(bZTnxHqe=L^ex4p%KNY4OIIE-uH3^rcj(6* zzF4jgR%a;~Iret>B;sO%vV+y3xA2rnEsm)N(zg-r(7WQePG(1^``JpE+yRnymGpe2 zynY|T%Mf5>vUe`{nT%ctmMoOTm5cb6tu#T~82Z;r1tXbM?goB#8`#U>b^d9P@NTGo z`HH=_sm`20T_O`pVziW~Wrb)+S|9Gmi52@{x<((t_;E zjBH@Tiy2&_$As4Y`L`Vp!~$l76UsZIK7T|Jz!Nc`6g=HOgA??T)0nbORvqk_YQkPQ^o)I~cy%W5da&Occ645)p4V)2yred)+7Zf%f>Y*imr*s+XIFgHCdNor6dX&;*yGZFZUm&nzOT7fXiR%w z_E@osu?W!B#k@SQVjCCvGhnh-z&)<)+{DtArO*{2_>sD0$H_rsk>2mps8@~eT`c>b z1BQRuqr0Nd@3D8elmAw%{nsP>_YnDiylf&+ETcdS3A-gk4+)Wqz=v`j*}#ou@2ykc=AVFaO)XwNc)RkI5C7u6LQynLn!$ zzj_ESB@C&YV?F-aB>uKs^J%GIo72+HarHl~DI={m&84=Cxv^z=Py9xbv5Kf+)8>&b zyg5DRDd|R^rh|s_hN4ytw;n`3enxAV|5y&m7cLvcS&=%s_2>^3p4SSjyr_Mjt?@eV z>~d*z`;7rJ)e;L=lW5ZyxqjM=JhV+9)NE3j9K=#}Bntnd z?CMK3z9YA7F~8^Wui&$R0LbLv{Sj$)H-!4;ZnY|o#a4sV{fB*zyU%*39}Xwq&(lxP zq~F?sw=r{u5qEW)HgaTnh6X0vQ2#Nf=sE(P8in4mI*DB-S{5Sr>4#GIwCGiyhlvcjert3A70r)D%IUt-M{ z$90K{5An%%;&vS~zr~Bws0$-9bBc@1{6Zc?czBl2?k1%ZNy|}8t0|w!+$o-5+ftos zaVe5Fo~lQa=82RjyJg`oPXwD z@)qGtFNjp){1*>0?h%;PU`XI&f?ADSZ4M8+<5GrGbUY)C;fyN(P%p=3dMRpBv6QS; zg5<9cCD5L@hDjUHC&y8HlB+6BIzcN2boHAoFB{VNu{ZdAop)~&ib4p9= zyhmz%Ib0@*-add0`;SPpU4YMzh+`Y}MR6X>vCo>)eJ=In_4ns1WMyg4WY-(DYpN%8YD(m_azx0o7?4JQ}P2F^oKR=?A=yv=f zZ@PNgHKHB2dzlqGgFBX6%H%nVmy^FyiGgeyt;MQ%A)lvTzFzX8-|x3SYM9p1yB2$Y zbn$$MPL6-XekiP>`upbEajj%c1sO!;oBE?GnGyVBBtlaaM#bDN$Xo5i;6G=2?L5@C zI{D+*{$-5y8gxL1|NZBGQR{!U(e`=(u7%m^1rU_pj!!}KU4&>4cz}n;NsEGKsS}G;Z3gO!ep6wm>SZEVHqm5Hj1htaLZf@_UD!j%mDlV zz%%6n9lcVm*|$I}hkH7DS?W=M$tVoH?XtRUfZDJZn(E4s9XK9dsrfnpL_!U~HjVja zLgj3+vgy%4I~cUmt!iXm#Zn8J+X)azU2Jt1tTxn=*deDQ@J&bzXoZR}{c7TLCTdmd zc0^y5fWk`}mlmlP^6BRoDq^at_uY4o&jm|Wb|2!Bp$wEdom!7~;C--KFF6~fd` zL$c2Nv%VMK1FFFXoU3Md&r>|>yy9Z=m@bx&N>Sf=(l5`{lpvDjuma>8{rtQZ)Wf53 z$&w(cc5kK`m@tT`fwgg4XGKFyiTMCLaM2=?phL=CLq`awkKt1@rLcTTRlpEE~#oIHM3(rQKQDFFqOn^8*wp%z^9=nToO~mL=3jN<>0YHWFpXUbP ze!(h_f%MfTvP^H(RS7*(Tx?E@8Lo6G*4>Cd{a*hCe>M*3zd0tR0A6Jc`iSNSy!IN@ zkSR!e_m$w!*L4Ea+GBsWz84iaH!sgi`mUN-E-#NZ;ipAm+BYMFBp0VYtf$Y9uKKRF zXTs*(2TBou(+kPEk&&(!^D15*OO1KXlia}Jw?KaQ4aQB_&9;`O{XXovtOIsEakF-E z*_twj0oxf^Ai0chW~sA1<;A$(FFDaUi_)#KY6W9hzfgL!GmG8DOWtcQ7OzY`lzOFw zfsrshwV9#Nc&UFsZ1`ht{Q8&k#7Qmb?2HV_z}a&W5GWe?`Aex0lMc<>cb>GB@bZ?H zc_h*P>isA`-&en%7C-{u52%1`tR$Ro@0^p|oWpL8cTU5uH|&5-HYZ`Hu&bGqo5T3N zIp<9Z_~8z0K@IM*vUaoRv{QHa0X}Y!QJT;Auz+|%QyDw5V>nZSNfggy*DM%k&oTOq z($6j%3aJ8s40uK!LI_m(SI^!&hCJKMZ%DYA`0>)_I^$-o0=C?Avx|5$RB<_SvoUe= zE9=|M%+315%{>2E)Xgzb!r3-#|CIM826ixWlfZwbHFq>=tW$SoM{<>ko1?h5@5z-; z_bBaac~o4)S)2@mt3yZN2X}KpwMbTBVyX}5fe!3xxVp9B@+K97ACuFe@4@cs665Z# z!_Ae81NCCBjba6vI}+c}zqT{e5^2c_t@a;Y^cs>d&8Ll$7NW6p7{)*WJtej;GjEEF z#;E#DNqYNJoO@4RJR~*p16zA+tJ<4vrCAyx(Z&eh(6+*R+5J`ap!^IrT#p#4%W}~;3PZ+#1nm4+V6z(Vjneev>@Tq<6;-cJj*i#!Z~kwDo*<{XQ+M`-&lhCZk}w;zjvPhjSXbLF?nJr!Y6@^QP~v zR75Bz(j<70x`^0%+q9xJyo`)lka_3b-dk4kx*7!|l^z$zIf;bBYNO_Qcx>CK{RB68 z{O8(HFkQFxf)*I;e3GB++k_KRZTv}&v}8#euBMgqXQ<^Q^2kb3ss1PF?ozz&;I`nD zkJyu5L!}DhY15jLv66*fCX)PyNW~SIgk0}WeQcE~=itIYZW15O?H{j>qBO-y<+PP+ zX;$SfAg5Q)6gT0DmN0$!_1A0TI@{}72+z0<@GfjLA@6NcoS#U3;2Bdiq}jbtr_0l@ zo73&S>+T=A=OZlFn{#L9WAMG7FptA^U6}1!Cx4CIS}zU%S;yRI$Q;lS@p5l34CW4l z0ZM!plc$coy6eBXLT19A<{#%p%0_O^)c&QPgDl(d+%#iaa{xKeXyV~kD^?k>^#kR> zV3H6^4+s7jqoivD0-kNOR+l!j@Z;DwuuR-aN`~G-QfD^0ts})r3E|>2T)iOy+I}KG zaGjTYBClmq!_LiU#@y-R&ed5R%N)PEKP>fhuHN?a0sL$VexwyJcWQTj(o^u_tgE8_ zGKAl4%b0(^8{>K&L$ipwSk%X{yYXOuxSCH{lAiLNIl&Y%JsT=3WqQ|jB=!iaM@2Id zecpxH3i@H$QT_i!9vnlybX5cydg)xU`YF0N9WfMVFTN z<@Mzn(6NQswRh@M^@w?*?A#w9?YDCI`52hXjkzxGr7z6k)W479<#neT$z{zHeE)RU z*wG1oO_OkX4!_PSfSu7Ck_aL6Gq_(QzN0`y^O8*xkUZFTjm29D`nA8G+aDL7HN*D9spW)i>YPtbsO;HsUQ&^~)kTkH+K3=|~o5Ha4N>ngNtPI;c4M z9h+R%FZ(RjLAPQIK>}V74&Ng2+&P)8I>-vR*_czJ-PHd2$y~x|mA!iBdmOsSmF~Y1S{&IS1#U{1>B1rO}%8 zPFDxIBZuyQYRbO7jZ|I?ZsiNKFvZszjp2xMf0K>i{%PDvIczT-`O%PpeW&e(YWg=t zM0c{7&<@4=SV(bPPy0JzgxMO0tr&iz4@J}WPA_9F$>qqaF=3~ZUF(QQ6~Pa5s)<<^ zC+-`<)+0ESGz4!?y`G6@`8DhL#IPoR<=|G&kOA0xPU3SMe43Z4nZUic;8l|Gf_g82O3>^$_vSD1kt^V1S>120@UKs(k?u zP>5>cf;dy8lOxzg_%rl~;0x0Kk(K|Se1LbEi0%Z-$E~`n9hW}0Wg<#|&aS?%bDmFN zAtQ|fZw?zXJ<|0szn!}P?tD*ra^xKCc=PB)gD3Q$;tP{{Nrn!Bl zbjxuwQHX>(dm`-b+g%9uEr>1}RH3{^#OHy6? zGI;6mU6DK{2kyyWq~qYH?%;qy&(BipwWR?#!HxnXx2*AU?AAub1B+woWoZfsh#Cce zjq6W@%heWdJ2HEBE_>mZUGQN%Wzy#>(Jx7DawvAbm0!$8hN@N9wv9q(@3Ay?0N#0R zWwKO$I!4x%23>-A+aRlQ!hThIJy$Ww;=v*4@BHL-PoZc?lRK!Gu*)B?CveWwr~>yD zbKMI9ORgJpU#p@A=7@jB8X9M||B|22a=H%OLMN&B!ytXAF7|IxsAK>&blzGF(AJll zUud|%f`Sv}b~Vu-TGiDn|Hu!l7xDku;dL^chIo|5f8X!98SVU>^l6Zs`=S=$@8*un zD+Zzm=`Ebu7WCn*T9-%-q5P0an>4+Uf6W3o2~$^0r0XW=N%$xCw#`5^joxPKD}VoQ zu+F)s3hB`(R4bDABow!A(7pAJ{&L6heQ>T4t-Rb1|LIZ30=&F?NlHev1(^>yAOFYm zeolE0zV7jZADhFED{hYGt~X&<1w+w;lh#E;ij#r3MSl4sZ4QUin5u!^N!b;JcjT0gE#aL@0PE>1@E^YsAqJ= zqqr=T*IBe0i8Oe72WfESA2;4h<9Hlw=j~qPL|vSG8$kUduE1FW^F4lghW*X}Df@X> z4W#T*flokmt^8l2YfRK!lFKqN!FP5Fi2o-z6MMv>MX7wWuI^7kmR)m zoZ7C@AWV)kE^^u--V|*NzfLcm=6Q-PD^*Ns@V1B#g`=lRM>A6@t=?Hx+=SB#FQr?{ z>NoqnGE7&VaE8y=H|vazBBYW+@!`X2^nMTO@4+`>9oGwVYepxz1F_( zo^^edlhvYARB|CjS}`SWg|VqwGo`7`ht-^QT1$q;EtHTNr*%aWqZ`VlJxqPLNYG(# zm0doZ=ZOuwaIV$~UTCK0Fen#T{lE2s>QXS)DA=E0o)zL9V7XDXH|uNR1ar@G458+s znoZEmBqLL~xc?xKv!8A(q^Yo^}eL1YOF)PZn zBj&8FTQ=dN3Q3cl;-#rU>eDpJf>;b&I#jqL)RL?v$PM&#@4?6SeOBsxLAg|(RUtV3 zgs-0A>@t6uDX-F78^RX+GF_7>N;@RZ(bxz^A=Im#_j^T=>os~o^efICz8E7*NjT2be zA7e9XTZ&;;cXr$Ke}%jCfE4nWRKN`zna<)6gy<_HA&{yBKojDZm@hmygad^nmnWVD zper+VdJd41nTvMncWr|Q$9_5__bazbs(cB36)zZgKW#mjCr(MdQRRb)f}R73G1G>}L$7G4s<7zjSz{#gBVB3rvH*)-xQDZY z>h)$GPX*NA!#Gd&2-OQ6@lNHu;QKqXqe<%uP{K^m>((&g-x(%|!N*TQZ1 z0{VYC`|hx&zHQrp1R;o00!Wn>483<$3`G)(p_9-%1f+w2qDT`$5khZDgwT5x1f)m@ ze@GP&M4AF(K~MqFw}a=Lch0%@-21-AANkl}v&&j*&N=27bFGC1>@VhAqB-zuhoeC= z71_}L*Bq66jsKd^>N~=Heh&kiNCFt+(-GPF_N)|8 zc(q&$IV}+N55mL4ba&b7 z&2q1NQBE`Hg#XA*UPHXpoC?5WuxN_cEFf?>v%rq4zkXb5JW~^Gyf8J$2gtj}re?fB zU5630bf7E%7=mKxg~UL1)O6&21D2*aOKwL{xZz2=fzHeS{~Q|AgO|V{B_U6ynOaW} z2<{sk?DoRJ5JCj8gF%(&b3zqpJ?zXVK{-ITbor2dBRPQpow=`!xEHxoH572As6{+b z^IJ)(TchpZE-)=>M{admg;n^f)}sB|Ef&^NXL&8WlIk50R~&XBL#9zJY`?z;$~j(V zIiz%@#?)=Rne(!(zn7#ytP&vv|!4WqUVmvwnD06 zdItKujJgq#vJO|h`HDtZQ6H1n_!l4HAFT&41U6ckeBET%;xhC11To6HP8%VOCrY8; z58G4Qn(AV8zt%ayoJxwaeV8P8CIl58JDVE?F`FcQN=JxO2oF|?V0{wV@Zz8NO;puz zdM;G*WgR)lDNEBPu8A}`la=Y zZ1h^P_d~v#zKQ-NZnkL#5lXGA9656 zor%Ap?26#a;55?K878VkJYR-em{n=coJwN?)|tQTn+-1S`YmEJfg0tNFf?rTUw|rq*#&0S`n>z2zxodc4;&wK*ncvm8IOKxxq`-D)QhLvuac zWl2&isS})2teNJAZNkhx&l8h(-!QzEvK(mCX7qGUlyp0UBvhtYXwzQJoW3O=zHgU= zF6at95CW+nPR%;d)WR#yfGMY&E;4C0iD5%=!?089^26Em*>#nQgbACRgp5E=g1lT! zv7wUOT?XMD-Qvbff&?ircU2tHrw%HVghYze}BPFWO_7ZBgdCMX=Za6 z76V+lIcFW#YS7$2J)3pz4hp81#uhd69fC9oxn!qq$4KrmkO-1jBZ$efzq{+2^b&T5@1lc(@rZe&(@B z_w2b992UAkWZ@727BFD($X~LkLTgv%GnrVi+(xhn8eR$O_M2HKYb#fFMNe7eG)5+^ z$kC_Q-kFdSKad@GTGi5=li>3bn@Zr#z!yJeCs3J~!KY=9qbc(N`f(U*i4BQ1TT!uQ zJlIz%R`&fSwi$=&j$Iixsz*nPqFIdYsrQMzf&**xlP6bRIr`AhEIBSgD?IY;+7Akf z1GaDG->$_x5Ac?NtJ-jHk=+s4H_V2-wIl(6(Kz}N2-fH2$gcY5sk)D z8YNqrHZF5WLM@lHN`rFV^lnd15Q;3kvW#`oDh~n{)9yFwJhpsEl4+x#%kiw`a<+ND zCDnVi;j@s(%=KdKPHh-!w0xd9T~FB*Hy~C!SRv0@CKq?pG?limy)2eFLw8@#o7iQ1 z{gU&o8$@+=R%;uZ#jTO#SXg@WtoS?Oov1*8IDAggR}me7Mu2kZ>yBYQ6%oo%kRSo2 zk$7=Hd>`I^YuEiP_;mMidxIKWD0X zKxZmDyLPEvE0UURW!FYfq_P$9i8RUO{^W9q7+ci#jpc z7On_Z?i^)^Hsza?F>|!)%Nkv=5Ri-8nMx`x7YnwpGx=+e6%x=UT6;@ctil&l+|*qE zs=qSUl9bwJTePjsZy?U@5+LwEzr?!^1wnHqTIy?ZKBk-cJ#`_&=wc9*f}oC8|nE+dk9Q zANxr!Jp!jw^^c5?{Tw7sslLXus~O1#_?*8Krf$4bC2!9H7(;GE;(X%zdBi;#kN2PO z`txZ))r#$}`=bf-Z|dD7d;%(jjh-)HV#eehHp!;yJjx77)`gh&ZVtyqcN_Z7=Y^W^ zVm^Q6L*6yUj5+NK>U~3?e2S?`vL`$z2_XXUJva}oQeoH0)o599DxH}rKh=Jd%jhzl z$)zW3DwxtiSai=F5tuN6%COsD%KJunj$dCcuP9ciMr1gz&&1Lg`=w8mHabXjOavEd z4^Mt%o7(m>e2pVrjNhX88O9}9SH>+1GMhKwtPNPYozf^fL^JdGS(H^evvxMaV!le) zVhk5j#ZYK;(Fy!QQF3#EdD7^!{6KSbYIkb|r>vYp| z1`EMD_H6N%iaNWw#vLzcRV+23FI+^q>BW^v%A1W*DR*xbR^;JR=nibb{(v z{XLpRipvjJMkplK*A2xd6&+s^2#11G`49JN=HsHzvrfhTz&iNewYs|E-_W>HfyXp$ z5i<54RRAgv$+p^x4gkJVTpRS@nQ_=Ul(Usl{1YwKMBBe|`8I0Ad<7mUVz zX0t&qBIs5|jtA2ACSKH7Ywg%j&mYk_a7{$SX;u6F?1z|o5;axaQD?d$<0R(soZVX* zut<6W2Y3-*S_ivv&FM*fn%LAb#3b5;7hT7p!%@sT9e7*b=kfeuwTnP>ZwmjMWq7Ko zArrW1%B0=QQRXdYe|C`jHWIvoUP1)5h zlMZ?6a3J{5u+XqJs{%Y?gOxRrFq##`bKqSOvyca7j?fDIO|f+%qEqvxsx-SU*XgfO zloVg&KLisvnRK2LmI-IxH5;|Xqjya1Scd!H`ltnug+^H3ibXEX&N70%JX$Mxw2C@l zuz&T_@#s!N4^zF=b*DlXshZjM4hj>*b(p=*UlJe5NRO%EHlnKOY)|Pxld6#h9D3w^O^I2%IFY(gSc7@!8StIw->^Vt zrI6rR^{CHR?3Xf-gNWX5&uQHU$MG;bakV;{kNQ3w(BH0@1_DDkP*tQ+BbQc)4JsN`ssGb4j&Y>oMkaWhD;yH5$muTu=(sgW=PQk zg-eT)8#AlB`B=k_vnDBT{WNW!`da-C$k-qLp4qXU&UNd6i#ug~|F2;T>Ni)SyeHwr zYY-oyd9QX}QjvUAJ!$PP4_!#6o0H$}>D%3!9n#6TbN&%u;QY&~IHo1Px-I@i`Sg(e zcd(W>uD`|l+xGuT{^NrLpmye7ckaY9oa6Wz98k8@Vx(e4YsA>!^kQxA;+*u=@$0%)C}n~Rj*`wX#GplCg0ut5hZUB-aheOf zt%jQP;GZ{nWd$GFbqe>>W7yLtkhqH25Ba^F(CYy*5225RGi?HY*J{`5ZlRy8`| zq=*S>6wl~uLDglfgs`S(=8qcivK2=d8u0%vUWAuu0yx;kRIwpt|5T-JJr)sKye=lb z)iiTjM&DI=7#XnlD=sMCXTxv}qGwH*W}1){cXcI_0>-%&)2>^tDro>7`1sR2L&3$vkL4czdqa=lx$k*}g5}N7>zEtjd)oOzZ_|g& z8ohSg#H*z|G>iicEZhV=q;Tav;ThLUyEauns87I$~HEm#|vb-79G*2CWdvt)(IaVA}U zH}*%67bH{Y?U@ZV#VXk*Vf z0dKJTc_FsdCbpL|M}i3O?Z6D@d}i2wR3UM_$;AybV{qEA>Eh9i{8T*0bfv?znEa@E z9sg`jXyR3)PZ~m-1C;9-O1MC|^R$I8OLWCYHH)~GZ(ou#i=F@FqZl!LpOW#J$bBu9 z^#L07Zw7gnwh zdDlvqhK~H_H=8UQ#Q2mAMs^{S4FtWnjJD)mH|)hz=>ngvS0N4z$7F(GWwGCUOSC!W{Lxy zDD{YQq&;d)9DCP{3j#_eKTQ$`M3eof6G+Q*T2;Pe2$eMcPI)YBZRxIk+QYYm#?l2W z;r&pF#jnr!PT@G-wa23M`sv3B@owc7QA{o=EFM8R79aCQ5imw%ziZQL+E!F~u>;=D zLujnh)PsJi!Ae}3+u76DxY~|52Y6JZ|Ape$geDXgsZTrV9F_icMJtk2Uu5y|XCS~M zDj6_9_D0l*UB#xl+MXKi5? zvgefPhXSKC^u+zy2NFTnceY{ZW8KDx_k-;>Z&V@5B4AF6X?L)Fa zrnhrhfA_9MD!Dx|m2jw=#gKa+EnUs*cyw${Xe3-@W?JwsRtZ!alfAS*QUF`#67tpR zSr-ANt;e}kp!zuU=oFYUO0vgUZY)}r+pbRA))+P5c|Bv%B`-S1MRmIQfTJ5nW{oYv zS)u_YCaMo+XyMBr5?9+kHRWfBV$+*^Q>&?LC?+~J@6K}nFyAev`!zvQa&1m~DG%MR zYdnt>$5g+Z&6^0>EMOo7uG(lew$O92k=aZ-pj*|Kn})~xF50TONfyi@fA<(*$IEf_ z6)EL)+R%Oin?%-Nrv8(lVvl!lHUGB}mgw~QZoeb$rnA06y?sGmvZQ=DSiHPKJ z6+-y%zuK?RScUv+a(Vp30lMOC%`Fx#Qd*ajC3voE_ z^`^ZE$ANDw33qBigAUhxtmgFn>Ih@4tKor7O%VobA4rAM4@o5nIKtIhlp z`BPbT1x4AP3FuCA{?02xn)!1l{7#c*o|K{vd;Mf-*AxsR&Ub0jFN4*EEe^`j4HZw8 zVyBtmI736+sNBj5>S;@Hu$JA4^24~J9r}n}ALoYR;%_>H$|ygrP|g3s%CBXgpMt;L85ohSOv~G*n1=r_G{J!m#VRqY8 zy28wQ0-|d`F5x5Hgw1Zl{OpPA-9_^?vlbp1lQ;X{eN4^P^1I#p7`5qxIMSK=)#Dc3 zxN6UmW8ZH=@+v}`pH^+ll|Kbl>PLqIlvWh=DZ>{`T9H)4QetilW7d<9=DfM`dx8MH z#gDj`{sov(4D8Hw2&~W56m~BNse@^LfG+R`0t)DrT(J8CiY`5P(fevOhono;@kQQD zXI0B;W3glpNMouNlkiyvxa3TilXEvDmg4Fq8Z_W*=>RX*Maks|SKka?x3Mm|0e;|M zvnt<5(o2uV@ou$RMZ(GjeGw07%_y}%`@HI8u=B^@R)E0{)c+p;A^QLU2cSXz1{Mlh z(98K`?uZ7g?)s0L?45_?)pcOuAayzg^q*=4v91XX;Ql8{{2#gC-wDR>B?QIcn{Uej zfb`IIpYq#k<=F%M=DqDI+F!J<)_>Y9?25G*s`S_U7=)_kjc4_p;VEMe+tWyQewCN% zoFJ!CDRqPLmrm>OuREWEH^XAd20DHTN@HR*N>EEud>T-q5btm*W40VDR#U8#;=I@E z+jN6{fJvA`k?$JCrDywgWdl7YZhMar5=F;t(Eq(FHue`Qx0NZ+9*iB;kHx#Aezd$W zG4_jQ(G`A?bnC&5DmTHc_#C0hzQ=z}Q(aWnionDAhBPKPea#%|rK^6dq(>p1il1hY z?~sBHCN*|sZsjx6W^8(!Nesf+<@88zU$b1l*I?uo(zrTd=Gf7y1>|+IYP6t7Def+SS-sO6eI776jUw|InZjjY|TW-hmSy`l9~jY++I}l zeQ3Kw9q)0iinY+%wRMV698fNe6`3PCRd!az>Ryx=IuCajY8OnCG;vi;bX7C{U>47| zK`mTpeXr~v*mzWei579l86V)8b^R}RJ@kac$l!#G+X{R)4pcs>4m4Ub9XL8o}^1rkmIk}|h2o-TJR46o+sbqSI{_WNq=fDb)Yo^@{ z7Kc658)V_T*B+>N0NItDbQkae68jUP)rg=sMX=qY#@iP=zjplaY6)34zJ4T?sq|_o zX;Y!?{Kb5yC)zC=V=e}&orZoN>ZEp%ZJ9A40%6?lw$O#ix)gDouF9x$mbH;_Ce2CE zZzpzrqquS0Ln18qy}p_G6INPdRJss>DjG9EBs&PwmZBDQh!V{L zwypx)JEy%}b0I~nZk;>9gVio>5qk~-jt(BTuFUXwnpnbdb62(CqFrrTk^GG=I@&6J z&c%pXA<~S+!MAT|B4-F6+RfuwixA>ioP7}WHn)XZX{B~b)VEY4F+&*#v#b?ElL|}Y zKjhLm@N?54+j%x%)$A7`7%%kM`qItMJd%op_kF?e%(R9^=9xt3c8>e~Nn*cAdkhY2 zT{UcKAr0T`vCo)d(r=aKW^!mXvdAKhcOd_!0JZVaY`Y){WhMDsFXnfz@Qimvi#M_1 zJ~(J5A$f&AK_5IuFXjNw0DxFJ@PeVn^P0-KV>e-MGNV@32`+FOjf9IA+%7QeIpozl zbeA$sve@_0=%NCf78rMa=y9jM<8Y9XT|X))%fJ&KV~d0piz~FAyv>f2fV67YJ%+DF z&ZLPB_6#fgwNmTi-aSsj#Kv&wXAh z?MGbmc6{SQqU7pkfKO9*T^k;I|Kz<}O5&6LQ+Ah6n(HLGgZ`Y*#r0Y1*M`-~*ZVJY z+hA9VA9%Ga4my}VQB}0oy;&9;kn!zpuM54%>63x*192~8Hmh%@$kDZI>|Vr=H9 zCAg-PPJGr{gg>8k;j2PZT<3>Mnm?2zg2K=Am&c24Z(l4o>8ta{_3{Qhm1M5O1B)!V zNai49^t4`$h1mpbmG4bS=H3bxwU$_&GIvH^i|?Was?6258`ohohU8Q!-!HWm$3-=X zZpB$7@9S3Kq?tx=Dr>HNkqDCIpjBU13dB6AV2Lq$b!)d4=)B&c1eVm!%9-zm7sZIITL<1d!1Ho*#5kt_Da#A6;dK^UeW z4cEpW?Lq~?^o4R(8OD5QG&4_oj;iN~F1oPaZlKe`Da`t1Gqi$w`+3DFLhKhBgL!teod>I2g|5u+(5w`Xf4%#B4`D@%D++V#onXMe2p z#emB(B;YR7@+|Z6mCd22B2b&Bf6bp8AT1C`c5QSqutWk zjnmsw5Z2ru-h0g??2{{odhH*gm$P`^a4fpSd@li2sbZvoUd{3^>1({;x7G2d}qHhx5V&|8n<=uq|K|U3>adEpqmj@ zz?SlQ{^+)=x%pjiEnlmcu0E}}A-)fD-X_fQ3LbR|-`r6ec_%roGs)bW&to8Gf^Xg+ zTz<iwG5giRBx`Glv3*U=Lrc9=DL zuVB-ivYRFVYgvZ@-M!kq2|iwq5c!0mdPMY`GKUxg=C;c@9^+=v(&e+x*tmxLq0+WyQ_C(k zbh8d4=J;Xr>Qp5^S%eBW2c~4XYku?Y&Xfj)c^>y%yI1RbXY&hXlo5@ zwwaKO(ETkozB>&SUfB`rEv~l^|Jqzq^Nr12F6jg;UV|^!2z$`|Oi(;)UfGv^ad6W+ zWIqlp%*fG2Dy$_e7Zq99>eq*kil?UeuZqhb2Kf7?xBXOqnRMMhn|D268VVB;N-ULb zm}4*EG>v>)I;5bHEo6N8Z#XdB5e}$oU&e9ysmWG_1TCtOJ;jkTen@J16MDf&xNYf+AY89xvT*Y(lW)&!UgtrBLQ3OIr>3Yqy%7vH z%UbXc^CCh_R}j8?!&CjlPs(Dy1#f zj~#X}UySB`f>zG%u)g_Vg&N>5bH8`M>F9Iy5sQ2SznQ<|h{paw>(@AoSo^CTu{AJO z+vV}UCtdm3BIP{p?n=}Dea1D z-Uw(dG*B7xN$mVMbYZpQ_*?lq+4Eh%r5zI=bB<3EexT5$ z%U8XZa;&M)+5g%er&(FxB_0`oJIMOUYY4Hc>O50TK0K}{q<=tWKv5GPmT5-}(? zY0$D-&Sfy}>OAHEnUT>q_nn}PhQFP%3H6ywwka5HMthgB$ z+{}abZhtz15r{*k?dR&w(OBSm))-RJR>>+ttY%ym;Q(xGyH-IXs%>FZUa^?uHZagH zBjOy!{@879*(1Pl_OW?HP#SRz>XGvtaRhFS>=$W|4X` zVpq=hX>zq>m(O`kGW$g?zdL^xPz(;&#o9O~MZMd!^+x?un}dDlzTo{I(iwMpSv`5& znl`}tP8D@FcI zfye4%15={Yo;QJA*bD0=O;PXC3348Up{-*6svtk2x-v7~vV29Qfs<9fU8?Avk_2eu z#8Ccibn%G)q z^S#*GTSR8WK*j`CQya?k1sAk(PC6tEL3pdq84OrAH-T9 z49)sesCaUt+Dd>D^bva{SZO~80-+!O1`dIr!jqcz|2qGYe2IUWj``1rqb|E)wp?3R zRC_pPW8%5(=|_0@gQDokPZmD+zWgBAV)P7H&)cH0GG0K<>7*Kbl$zLOrw&J-2H-I0 zUk_Z$h~&BPLMfZ3sr5gA>GIM$4Ttuv#BkN}PR=`lp;W0O=fFP(SF>|d1-P-y>8t4;?+wQHM*NPZEGCxsba_{Twg!{23bX*55lsdGKyflsp6E3^nXc9?m73KA7_uj(CnL&DeGlh13nN~%c;rX;8ezvU%Vs)K9f2t8M@)%P_R^a_XVJ+E&8SJoa^d>M962peomR3;BxI(NA}O9Rfg zYI^R_0GFmu91_0%>m%2`-DpW?F?loe;yiXYjuYD-72yMKl>g~ec#~Oo!8au%+$-Ik ztXH;PQ%LzwKO}39cQ&i~vew%e&CRA(ea^eLS$hVr`jS75!#RRsPhr`|LGeqbzDrEBW>})o z#yv`D>;?Ji=7ov7V__?H0%QH~zTa*2Qq)^BY=D&d@P$NxyB6!^;h}~y;k_B($Z5K( zsR&jwXIRp98@i zE;;0$E+aL!BI(iXxijtf>`RwA!eElmH{*8f_5$BiZONDiyRPhLLHO&4_=}V4Gy|^O z!iLCvHf6U2Wk z%Rs810|`K-od?y+E843}g?&=t4mPnCu117ARM)dfe@+?));Y4Jfl08_B&6TSXzEJu zXZX{lsV8*{r)yB&8m}X1&Q2tVD{ZQk9sLwb#3tau^TN__aX}3*AcfH~lgKB;)UOFE zJ$Lx_Unjr%wBd93B;3<�h#RIb(Qe+34A4)K$ll5edIv|7-<7^6<(Xk^MYZ7c^rZ_CV;WouwFp}x#eQlNbmr!ky)1!OB z>ju_%*%1%918#GASZ9(dvzcr@5)_T@G{9f)DIiFkmR10a=;;FGD^=!(iK3vpAg1k} zQ@)0SL5e(6e;P1&mqiaVBej!?3Lwe9+@35bJG&i#f${FVvZX4&+|hq{86v*39y`<2 zy=lj%62J-=iqkW`)1A>55*?*;Wo1@F-1f_qmMQNcb~@JW_aCfXe?1D%F4Cj+w7n9mCNZ#pJnBnQf`QOtbA>e*qf2O)ZJp zWBOd?BrCnNz)}-h)!V^*I%e4WL~{C>A>ZJwe(Bc=fZ_ASfx-nmcKC|&8|ykLLZwb2 zq9;q`E4zaqZ7wHqLsN>Lv_#UpY<06zg_bzPWG0L>HNZ?YweKM#r;4AFDpkktU8A2Q=W?O zG^8mpUEikN(>)OxU(eS+(sOG7P4eaIhzF;;Jy(oNT!1Hw0Fpk1n%;Zl_>0X{Nq#Ce zz1jHZ*Muc*=eS4DQ+C-Wcc;rEa1TVHQ`hz@7!n(zzO-(?zfW~wOkThDFp7r$&e=x@ zye{H(uqMstGJ^6$rZpv>y^oQ{{&X|0+X`N0Y!L@$GJK4#GY1~2!nbbm5!Ex?9}DBt z7wyHe0_HG{_TgL?bDv*Iga*PI&d37x&!DqTPFNf(ZE!~_b{Fk^o)2!@@58blZGl7c zFW2b(tx*(taoD`kl9tK++||d|o+zePwdRr0`l_wofIG_djKmE&AHRUN^?!)5&(75y z8^w)^D*Rwgq!`zG_@lw6=gAoncVTCwRhFt^Wbz|El!#SKk&NfC&X`BG&^E;mR|5Q= zHF0<$(SelReav1?z2&z$J9iJ$v>@k}b-#N<79kZ?nq$-Xdo(#z)5N!_X~R=*h}}0S zPG}TD_cqbQR({s6+vp@vh)agtxRo{kAq8=VlaJ#xq^Zou!;|+;{Ca!)8;CjTWQ+A= zKp7h41*^nGq@3TB-T4Uah}Ae{x;*x?-7Uwu-n?A$v#WqE(p|u$itc~i7r1~uLA0#) z+CCyIr)~O7=v0MJBNkA5$d5{TI@n6m&NF;wThPxW`eB18hmOd?%9n|rsrr?)ww-|z zOYWDh8G>dxpFwf3vV(0t6(0zmyW6d1uot0sJ4G!QTq2fGh%2B~=VK#>HrEZLg3 z8Xw4Ou>&@$-%AvxTVN^`_MdthYEL)t&o{fYPcHjrV#zOIsXGxH=+;8UgD*!2z=g3k z{GPEK?Zw~|>V|_o>W?ZI93c(}J$C<>%QKC>TM`(^uhhmp{a7NYS(?GHK?;VlUfULr zX-X&2rxq1s0|%_}?p!#&Mk8m0#J6squQlK*6Oa4alE8&B^3E=Xo*z)^$2>A4Ov8}> zkW+J-9M)R-73cm=sqm4uSKob~%9LaF*JrP(iJo!XW;&1o^MtaQa9Z8Z6Jv;bMv!NR z`4}hqBYY)W*9{yPL?hwA)JRLCxwJ=AUadu3x%XvMDGz~VxZKajh8|;PIOn{^0$BFZ z-n>Q7Q|*f*MsRDP^(FJ=%0Qy?CQ|rfJ=$ze8`eOAMe}3vpt}gi_T`@Rlar1a#{dK=ROokKk z+pzAnNFmqA=kJBl;o)~6GGr&8v)%e+#QDA9<8meUwC#1ZwYB#Lqi^Vguqgk1*sfUs z`bmKloTUm;(8B73h>k0s`Dusn$48twh?<`E>hEID4xT>Tov`!99Gcx^uv0K$FYlEP zSiDP-y`|}NjSGM}H-j!RpM+(NH3bxHo1AoR(nw?HDFQIdlin-!s7SK~?h7JxORQOP z3wkUqY8=hkF*QXBKbTBPlYUdGB=0zQJ4DetN-y4Q8)rQDot;>8Y9 zELCqyq584ChXF#5mCn4S@%-GmvAmRVaqN zBSUS)d_xwLQjIHR>P?cWpFD6&s?qv-uZyF5mudHOV{eqa+iU`hwC66{RB`8JK_Fzu zH>Y=;Wb?3BC;`7VcUky_w3pQA+T1JqVuLkgLx*RiiqW1ipXc~_nm92Kk=xU)a=xu3 zwv%@n8SGslhAp#?Ae53)H$pL`o8BQqzb;b@Xn`ml>^^CA9p zI@r9yl{o({OsqBLB{$P_xO9jC;(`N(&ma0bXR8Bz(h~*>6qst+r)g(@zV51FV%D<2 zdadcVumtbBjUh`99KWOCS8g_328n|SAkBxQ=6y29FF*>aTjSQSXu77$ZS-Xsb9U|@ zkV|3S70%wIu#TU4k_{chQc+w$`v+Z3dt>kMZXW&)CA0Fa7BesBZF=E#PL33YP#>|0 zU(Yh|60Y9#fA;PPbH_0l??s)gh_^|hUMYf(HP1}%l=V%5YuidHakSj3Z8UghU7}Sf7X^@2)^YEDiWfEwv4C&D zv-ln)_6hX<8cd+?M(WK)g+jbvBXT%|1>%3V8GFuG9yBae%jbj({=fFJAatZ$futZ74^FMHau<3@=!7FJU`PeJ^j=A!eSd1D`NbQmk35#2cGoybh z*bKr_Tc>6OkUp_o$onw}>1fJBxK(#)^~`uqoRmQ2_AAl881q=P{^@r*$$*|uof}W6 zd*p6M2>9tvNYt??ng1{pDBl-OtWWSBSq|&|dL))JJ_U~Us0mwq5?tjrJkwxaUc-pI z6O^3HS?M1LLHfqflVnuEamVuQWbuzS9^o0Y9;K}1b(-wmlELp5Nv9`0d41Myvstn4 z?eaTc2yPHIIU*(qS!7G6)_=a4SVoXt28o?eYxR>gnp*OgazxCy^cHBv)dnc0LC675 z+oLHYI=T)!ArQnIz_RVS;3t#m;;&vWPS&n;9na-)09j(n@+E^BbW7AV&oU;(ut_B;gcJ_?$49U1mg4M zlPnKcGJBf3hODe)N9Q~Xg{$ozMJ71PF2)Agm{9F0YP24Hx19r=?H9imj$bqE@~*ny zIo&V>{j9;{FhO*;#;E|lvYT2{T;gJRxn;JnC9W~Mg}NlZJRNVfvJKKp4+@3EHkBR3 zMPhHguc54~!>jQm%E#h|+0o@X*^1zMTnCWVtvSRk-#QHn@aKX`O_#g2ORc zNc>o7--~Qas*Ye07Mg_*vG#h0uVfEDKW0#}Wj%IiZY%oWx}@y&t^&WOq`}}o?PV`m zA?G{@MVb}7>t7+{U(FXPR-lwvWItTS0gDFC0fco95rwtAbC5 zedQeq+#!yY=Yr6h)gF9&HssPH;k`J>NCs_)b9{^n3zfb_!+wzGltDJrr<+4 z)c=`L;S=^+OD<0p?C?ROL(Ao1vrX;(+zru8Kh{B?qJcgUfyME{WZ4SQISPWOP&g3wR`Ql*A%2$pXru^Cxrqp@LhD2O+A%2FSSTs=~ z;=<*!)Yt`r?fT=5+Orh9-Q+%hBJ6<%_N@ohS8^HU%kG3d0teMVgKAJ`w=bdC4jTV8 z_}B@LVAegY4fKAuQ5Nkl44VO|IhO2XQs!jS=E0eoy<-5WS<(;Y6+`mRH6<6a(M|#T zBK~^lC`3NGpskUzs&;(yi&w*EhGU5e+NQjn1@S-r47NLo!V~&YqF&-9KEJ?d8igvXvbBd^ zEO1&})_~iWqj@X7Z>^l6ifRl{8lQWlSM-j5&Gs1Ukmg8WsQmX+Q$cF`S_{dJWr!yN zFFoX(#l9no5>O?K)uS4HuB96Wig`|#c`BXG(e?EYUyE+RYH)Xd(p&j)82Z3%jmwpA zBKU_z;L%RL?PeZJ;}lYLcWSHAn|01%Dt2zd^=5PfcMl67D{kJ7+d3zqpS0Xk9FJ=1 z7%tB8K`~{-S{8O5#2;7&(J-8Vz3%&$LiAtid`Z$=`P4D7(B_4{i+;`GbI`@}A~Q(! zoZ3ddp-q?PRvDEQa^Pw62)t?BW3E=k&MI@7v0&^ip`{@IoX2QpEcPX`@%Pu5^s#2D8_s_ zp)0YKWQ3kL_0{2b2Rf9PE~#&PQWb1bd|?B{K{wU!hS~K6>fZFjLqR)O(x8{HVv*ja z2&{jiZt=Y}D0b{5#BIb~8LKf9$%)uizi@N zGDC7_Xi;Ne>VP#({}}SZySHz*F!r*3TWg0HyY%{y(QfeGQ+fHNt-Di5dt2IaoW>=x z#rc!qX>OsOLyhThtNKyRBEeX;*5Wz_cbKl-={jyy`DyS7Y*bnNP%0l5)>|LAi!X5t zIn?`;P)@YOCV#HVkNd;tJ0k>@az1dqUr*RjU$d>o`|?d6;FefJdpCZXFec4?btjWO z=|KP72m97Y6~tL##RH;-!QdDtN@@#lY*$k(_Bz6=J?!~@82ZUNC!#pG9o!B*4?iGJ z8iW{{VKvrdNiHtpTOUdvKB=v*X$(T0mP6l1mKnsN&I4%OoQjo$CQlye8G+rRu@p{5 z5iFcPJ1#k~S?{;DVR)(oY`gmtB& z!-~_c{x*xA*~*+%;cd8G2xQ-gt(-&ZRVd%DyZQ6f0sc53T{P%=6m>v%(f4oQL?}gm znm?_2fES#eJI$9zy@TK9;0cC4;NhWm!%8eTTpx7;NxPX!j%=?lq2JqaqmM;0pHc?6 z3@RsK56gp4K8)&Tr?C&jBYyzAX}cgnmr*ay5i9CMVRoe)Ks1$*bI&Qr@iY??Q7{#{X2Pjz^>hBoyL>4Iz9c6 zAw7#8?S%?{3p1JfR8DpmHn3?6(YgG3J|+#+9GUG7@8W{POVE)=Zw}2I`s?Kv+zenEx=)`yh8nZ4248M@~bo!8epfE zS08kilX|qYMyN>paImfykpQwYnbvO>X*QlF-SmMT4zlDJFQkjBbn?xpSFCufZkZ@Lzf-RFL?v6!yle9IqP*OJIL#BNSKES7 znDc^SDds-Rg4d9^To15w^D(H+b)aP_v0EClZ&Qvha04#7$-OtY)A7_L4u=C%Yh}aZ zE?cLRa%Bsz=VvL`aWtS~AvKx$yE*hpo=k9R?BO@qODxuM5bQ#GIr{_snladN^9LH@ zw7t@F#rgaOHg7&EpI6PY_P+)QEnHyu{OawTq8Ydi_J?Nh^b5u4Hz)n&JMS@UNb0m8 z_}O@Af_Q*PG-vwomwGC;1fKIaEJ-vax}z^&P4Z~Z>4IdaETH1+44zp;%t^@AG*6{Z*)Uvu@^HkT=k2avMz05yH>bDwmYwIj7>Lj5==<0atmPDKXRbuQ*DAxcVy6sWXXeijX*8d{#8JH>9_ZiU z-n%MI>C(w6M25d%j_Y`%=@YTXB)})+AEkE+yv$!r%8tZeJjKWV_V<4i8Jhq54RQfG z#%8Knt`vKSNm@gRnX0!aM(*)^B*M-2>7iy zpG$%s`vBFh7^&_17QoBCu0LH)-6u02e;4S_j;bORUCD9&an`DES^KfCO$goW0z#y* z*X9z{u-)eZn(Juss;3$B=U<~R@9edA3QwDubon zWpn&>!u0F0Sp^ey7YEgZ>obQSpAQpb(NaO_tZI^98$mKxT$Q&EafQ>5Lk7=HWRR2p z0xPoOCH~RocnCV+xc4xM>}1Flw>?>~$y_Br^K zOuWw7h6}dKrH-%JMFA#|kllcfY;KlIb01Vj{_v|Q^TEs#gTuWV_tXCjf*0ohAT%_z zo5eIQPoOw1t56qYK~8J%#Ndm&?J}=dW%=k-3%YQAC@nJt@Mm<8((3-#Jo; zKF&%0^umeVtO3CZ{d&?(KT!>Kl?6vx$pa&U19@#_Y_3kJI>O#o8?<3D-G=-sM2KQ5 z2hvBTUw{t?@cR%}49Wn5Il=Yy^V8JTwalyQJaCw-UR!!xe|>Yx!1)@JXPo+7M_I`a zNU}|Dx!l{3$76Gz@ylNuSrOG7te&!ZX=7>Tq9A=UAv!(`_wh2X3uJWRy|Gc-ZO$COXa^6RDTE@JGvN8NXOCm{I4wkHJ{I zT2nR~WE6yO5BUp0bQadBacw@KCId@XkVE2lew?oEckg7CIE6Vd=|lckSV@GuV*2bg&#egY5Fl;BLL4jog~hR8bGL;p7OX;)l9z z&klEMFS0e$xdKeW5}PHDrA;(o?6I}ghaY<1T0;;AuYDxINMc}rdNbe?GWv?R5?D+$ z6nnl~1;ca$6OS|hSzBG$LQZG)rl@_g@sNOo6WyLZFqp?qWUhO8-vwjXS-YLpjh%n| zc-7ydLaqV>!or(fiI9=lfP-vcy5;PFl~k17qmkb423g&knrjW)ouh^#quzb^Vqdqz zTK9tCbeXGgSAYeU8vnfe;40cNd}MEs3_-r?g+q%uZSu|1jz$aIIfMgdDAH86Dm< z5%uUsR<9|SFlKaw)(SZM9;}qA2-1Fb zoUWsXo+d&gAm>MOLYMPG&X=bv8&Jy^d0iLrj19k^;BPngQXZ0cQ{i20GW2qX!>Xr* z6=G`~{bOTcA3xGapRHyC@gsK1!Q8OIl;2ML9L6Q2Im?v_EJL^oU%70>;_W_84{3=& z6XHL&V*cK)KCicf#x3Hm?(r#lOuqY@rFYfwdJu3`4#*;Fk^O7O`d`?P$f(TYI=Roz z&t2N+^=E-pWdQrT_Sw~<-r|b~;$qE=FS(TGW|Mg1E~P!P0@v?ov)K!AZh|R~>T*xU z0`r$5dNtDU_q=EvPiN6x>pkLt@LK7uJ(;#Eaq(w`7NKxw=x}n=}F?#8}JO)ICerfFK~YR_)$<))N)-z zIw&TF>S7#*N&eGiwZr6rYx6Xzn0W`eTT*J3Y)v^R?#jx;U4QWhLKZ(NI-f2jZp>Y+ zU|y}=nptL6m;KD%&*F3T zw|2yyd(px3RUe&9*p;u%*`HS&vPmVmA4yC{M8}%gdk7%w38m2E*^l)r$x=DL*0VJP zvJV}fl!Iy*jXfQ^x3&43?Wpg+sk>LuR-wu8X^k}>G|eoi{&GXMit5Vf;&U7DkjDrt z=48AtATLb6)F>Bw_!W4b_wT#;t8@0fvK7=X-6RVIkak|-CRfb=6;JCn{5c~#xErFB zYyEJv8Q7rgn-01%W_`upLC&k^+3NE=7Ss#gIlstr`Yv0A@o*^^`Gb?9mgt)T7P&Z^ zL4DHMVGFypmtz~iYmHzzWc`^qFL%NYcY>97d^KcD?~4}r)g-N*BEOCibT9AsTg@)n zfc~=Qr$C7C^ONH6-;ry;98I1q@`57}m`Mb{yTX7%*aADSHi*@%$OC^v^#q~N1==@a zX}HB%2Y;B#sPtOiY1k|dt#Od*n4fK!-A3ih{HniZOR~DXl`Zetyx^JAgnkdy(+S_AfdBX#xXLs6> zGZxs&@ZvoO$cd|BZ2We!0i2n7%i-5dUW#n31q*A>x0H@`0AyWRO}DO^np%&znAp12 z;hjZFW3$uW`uC-ziaF!qo?Axj7oBH=4v%b2?d;mtDcnElIFW!SPQ^6msU#gq`S@B%hK+v&jUm&9tRJW8rRGV0kW&ZDs$|-&?Vjq z4BB{Q`*q#cJ1W4N%IALY!m*3n#)Uv2Ow7#9*|D-k*!bO9NBpZV<;nG(|H8uG=>GSy z>wm!Oe}l&Z{%AiG=!v7;5V@u^PULCM+wNEir)6@hy)}Pu%2AMChCA4{DY&TtfHdd&phJRCaWEW zx(K~^k%8<&-7g(`&l)NKd$8LycVTzbA96IyXXO49oEIp8Evw-@;F*dXJ_Lzo0pFR) zdAp)xVp1xdi^ae>!3O4bx6rowe?sgN&wiuLS=~kYCKb`04)CQ5h+%umtq%~8fSuZ1 zjp3JC_DKQE9VR`P?QJ5x8axd~0w=Q&{2GG3Dt1(e+R=mFGQu*CAvU+Yw{VHn zQf!6oKfeP?Ol!}^LL;@2b$umIuAX7Z1@w$ zkt!S%&0Q(D;l`;|WhGf{?o_wG`A>}Tu+~P_T)|#DBk}FGMkF1UX9*jXKJkW*CTzAI zedg)wRxBtwj95wM;LXV$teR_&<*EE< z$T5gqwp7j2(}!|QP&7z80QnREAtbu~YpC-czh>Bc;ed)FuNXYN$WtysU%2hRi4&vx zW!yQG)SY^^GTpZc8R0hwhZCE({mc;YC@lkG&C}!N>C>cauzm2Kls5eL^Zy?7_&~1$ z{?OZUS=LJZv0$rr<-MszVvoJ34dAD~(={V0mq`aK&d6X@H3x@i)49xNi8!gl>)Q^_ z4rX4O&xeQ)7aF<`{)sks!n8GHJmg@Hb^ZxDc?bVR(AoLdpo5DB>R#PO^6tmeUa2>M z8Q!a#3uWzoem_EjnqBfU6o?&(bidq8moyFczTtj}dM1y#xoaausK zz~~e4Q{i0Hnzdqq5SI8@Cu#v%RY=VAVgmBv-*Z_A)#i!6g#|yp!S9ES#Hqc?b7$Wt zE7dg~2Fm!^R(_|rW#F^5W5L)r=gDtD6R(fsH~*6q^bQ!r*Ur>$48A6DB72nP#lq(~ z$?~te^D3OW+IYO_H-6vpzQRznBhf#ElI3pwNxIy)#I__Hd6=|7^)}Rl+9nIc&Z<2E z4{w-I51T2Txpm>n@cL)mT0;(v@PfLGocc1cYMH#Tj7blnw5s$xw_>a)9hwnpTf zt)>HgXel!GNdzHsdB*!dR{NlG|0?$o#oUxW=w~}}#I4@c?UMP%T>RQ(jrq%%Hm9L3 zZ9ISmDqGd}=jp1qL7fs$k)D!$wyjd=m;FFI)1d-19%O)@>o&b1^w11J3LsOr)9R>p z*;(&nzOwHTb`MR{mw6qi#rrgIor5+^IENu}qti9?D@iO`kfHH|u7}%dZh%v|jo-4D zO1CbIpGj;fp(vjy3AUksw87kVC?7i!o59;{K&SB~fBBaGp(V)Z@h5SwQU7X;d~7^6 z5%E5f?DyFGRxHmcybqSb0YA*mj{VWu^|Tkyd2vA0WYuTreTZSn%f{ z&}!zs!ciTknwl?ik#Qt`TipAowNcSr|2YQ=OEM*}FXf_9hr#>>O(qXNx-vd-Llkyu=7v2>3e?I9d?oa+#BYnw-c)&U50~A>+!!A!ovCmJ8jYC&+^+GMamz zP@z(2f*2%b)hu-8U1XPJOQ-i5NyaIXrJ%n%3-4PW^f!f&*jRPn&y?8YX5MyZtgb_a z6@<)K*Ts0Ho%!Tq0eBDlA-4w^O~`}v6QkifZr|C5zPOU!Q@q6o|2tV{YSOCqa2ZBf zh|7)6rYQ=xk=Nawwta>2jS>C9JA&iYb;0n0tUlQhKtZR-qClTPHbl+MbgLs@#|^=m zPv0Z>?WS2a+Cf*fQW3Ef8`0R2bFZ7f+$MA5N$GlP4HPSQ3O=w5^vwoHhooN0FA3`( z<4t$lp*8YIN5-Yom0O4PlGkK37LlXOj0;02#0Fy!euSN1*^^d`g_V@h+%FJi!BAyP z70(z2RP+n!*vFN~Mo9}EmNHDIh*y1TWBR1lYj&BTdg$opHx2k)k+oyX%0XGI=Uu4S<4P1wh~9qwECE(#|28Op?ovfR(@9tN`?Rc~Do z7&>-{JepZjl7IS=xICBS6?4-k>UwPP>BBR>vWbi5zGqKrP#GhP2NWIt=qe-pmC||{ znQ0jfN1iI!Q#)kW#N=Vg`G*ME^wYF@NYw-^ut{XEntdU675{wCf-mYs#QkX^f58bI z(Mn@<@s9A+Y1;1va|8O!x>an1%F~26%&FLY^IL%$loRI#gLNo(P48F4j1qiAGrI(Gv_AtI2!Yg z&I4pjYFBz>ym<4#7K8xn>I9!&i?y^Jc2}z=;5R(ax0d>KDI2DNZH0LUXU@8Q#w3~U zi;7}gq-Qo91E8-q173`r`{=4@j&f4m;f+`Cv%U{m8Erb1m4`1&%C{p*~&E7zrmYHu{*V&%FIulx-&@Rk8>&7G-%IyXWS+&^U6ovphE=su9_-x+oNUiihkI6^FES$j!`Sn1PB>@=z0C^HP*b6_%j z?nXbcd1EQ6FZ-D9y1hh7BaA7vJ>PH3$WAfND+dEo>y`ZQK+fJkq6niTp5GOaW5-vT z=l6qCbFA;xh@c8~q=RvA;Gk&69jq&1`rVc#5e1AqcbP&Dd^Ql9k~vRQ3FO!bQ`eC$ zLm=;Eo?@Qove2w{U7eS~+5Ru$zu#4s)p~lnr+kgoAfq+i6RQHzjv4*{QFj7qxs{MU z$ao&qqsv1!V8Rh2ok044;YnSB5nhMJ!n{W32~ERdQD?6OcKEBAHep<$=HcCrdxMFt zMq_1-7bCdO^07EHnxkHyW)Iz(#+F|+7uOU@Nq@Q5?<$i=6{!^?|GACIG+oZV@_u0M ztzDaK4f0gQy5$WEuXzdUrfmG4^SL*fy<1U|BC`RCZt%GVL*-yxdRD3Q-P4ZUG_sjI zk3&N$$zQdkuTDXs z m$3rU4b)0w|zM7|8eTaL8v={%QqhDzR{{FWAD^TEICV>m-M>o*3ea7!H3Z$ER; ziyhL8Z#G^zj*+Oq+k+zmURM^i@hp_9f{iKeNKp>7@SLWuL+6Ng7%1gIMs_BgK>>4_Oby;4_pa zyL6HH6qWpI|Fg@rXXf+uP%2naD@}beVp+o-rBZwZ`oe};oka&sp=PI!rANhc6rR&R zw(>a~=vmZSIB}Q-`KIV(ulPpA+n)nb>WA5=?AmX$6-q0^gaKj7PhJwV1CI#^i`yt( z75^=A^eCmKiSGqy{Aj7|T6}Xj9&Jy}0OWM)GKa&2W@FsZsZNc|;#1Bc z$+XWd17+M-ui0IdRBCwdCphNu0xZ>4!X{t`Ycc<2Q4cUdH2US;u;4=d1Zwi~^6}ZewiiSor9Y3k zEYh5`A^JmG{Wi;yt>`$me+)qUWdL`Ac+H5NBaINV00Xn<$>t~K(2}uWHT(euSDT42 zTom76ID`T`9q&jIyI9EOqT=PBeca702?YCrWReJ%agGF;n*hqdGk_VpBLC&(eTp3I z*+C()F=)BIQKC)A8<1YI@~i1BA@hy{8ADN)KaFzrWJE<@5kdZf&A-a-o4f-xI2 z7mo{wnM4r$XDfI1^{Ya#PV9dkjN>`NOo>cP5w#cx^odUf0Z1IfJ$AFv0zc2JSCcW* z&a1p**Y47w-UB<>X_NgCP{E}KvSl7ch=f$z@?BKvOm z9=r>MbIR+`89xw^I%^I59A04mj<|x)pdp}3-QN9h>yvE3in(1#)sZ{zw(?jw$D>#L z&TD6EV2tEL&lwU17a0pcLt0Ws7+Xk^fawc=bMtFJY%sya=&m?WAkbX$rz$zHfXodl zK2Wn0U77u;YSxriyuZfq!q!&a&Q=VloTw1jYzXSfS)K6+5*I2@PtL9;E}IH{*e4=0 ze3xz>@g@`K&=xO)hV{Z&QC>bW|L-EDrg$>F!ge==g0XLUd;c3AAW{!Tc*x7Es_|W; z0ijw6-M#oKPUg>m&#dIpo0`wX*x|j z!gkjGACK_9&UkfCm+s$~rT?hx=K9uV5B&4P_1=$n|M?~I4>R}wP{aS@u2v%DuCGH?#aLqb~{i!?nL}Nv-`8e6lLYasLeJb5UVop%3Y+mF4AbZgYSY0-{ra zv;(Sfn&NZ;%|tUWIR3*={Hn&#{vHS*L}66y0LgCI3W#x5>o&?F>6-SuqJTn9r;~dj zzQNHykNNko2OyF+mdUG+b#>!U-Cwpm6HH0IDWWfG@uod$auPUk5#?pt`Rt2b^Wwa%g7$E~xz0O7X14Y^S1fj3q_L-Sa6n`L7-{!HVT=Co$eW z2+%19`s<~s=7)?74v-ELu%h2wbMl0l?H>JLjwd&(c@IRr{R zb>d21Y#>{gJoZb>z~kQOFAH?Ori2j1GzQma3CvFYMsKbeW5!UT0Qc5qO77W{-!H6H zF2uCG@uBX`5q@jlDT7RUa-;)>L~=84+U1K`-v@F_83jqLQTM~~rJ}-54$)kWDetJQ z;7&w2Qo?~5dAorkrFkcB*$Ino@G|2ow3kFKcOyw2jQohfFvnVawZ7q&**oF*gTH)# zEqXaF6f&0~|MjJT8p<+Q+n9Yq@|98wUz__eu9+vxr$)2JVEE<(pHGLhm>3*BW0PaK z4zYPA@ipuGIoX8q(+_*Aa&hkT9}nI45g>2vrH9jwJ#O*YiKJ89Up`v-cX;|AcOAbV zl@!~Srm~PHd>;_p$R)S7e8xerE2Yt}G!?xq+i_a9x}R5WoUVrJ>JJS*enP;RKfC{X zm)!;9_)y>==^kgVxrg)f_(V-5V4mhzq`J-JHI9tT1Ti+vKdP+i%6SKjM~W}a?5k>P z+ImC8ISC!zj!eI;epC5q#_1DpA*}RWC$nZYJ??>!rL3w)*)^Y$%=0fEmCDtULjCJm z683^o9@DFl8jrok(mYh* zon2P1vBVYL=f!=0`Z0p|U(WIE#BZF(Elg2Ls|T&TU6A_ZF%_M~7Ps_QGSOIssI~b` zp>RWP#@8Hi$uBP}j)%HyvUvE~$)L%Dv@xK2aRIsH?d%cI94o%Xi`_OVAkg*2ukC-v zpZru%vFjbv^GTNbQjDh6^8A5yNDAuq7jP+NTJvN%fsF5kPh|&+l5XuN>o0A5Vc}57 zZ$$bS^LuDZE8G|3V%(?t2LE*;qD8Azkom^NO!z22P-L?~V=-<_TFK4+3^)fkJlCT} z$WzMHH#|)LN#X9QAmb6ICaw>ewElbdMk|P-%ApL&Q1DE1PFZCd^Sa{K>>e_Pkj1mh zH$K~ni*7CF^>g3oEcG)Q;oX?WuC9Y%-Ox56fGh z>$E1+wwVX%sH5B`7~PmPUb&ka6`8dPZQttfNoDl@RRUd%!1Y0jHdUcl@= z9heiFnZfc3Pj9K1E9sXMW!q;($zE+-4eVp5=R=cX@L`F)MM-_UK7CQhS7LmgSXzp+ zQ9)veBHj??8OK|;d}%|`V|*rO`2Dx!7ngLd+o1{2CUmH_T!(ymYA?%)<*hpg0^H%H zm-S&{$;~8!_N~=h8w2xWF=>v$i5ia_-t<3^9m)-L#(0{a`-+w>nbI+&`qr@|@hLh@ z97}d=*(&R2q`~9$w2yxrR~M`e<~XJ_4w>L_V`H|?mVSJ2JxCQCN?WUM$KSi__Tn5B zX&SF@?XX!=5~p!!uQyYIInGO-L4ARI^Er+zFfi(E`8FM;51i)vZF!d0-Y?=XGNH2; zVB;C*O76MV=%5FCgc%r-9PF07I^>6)$hd*KmY2#`{2Vp3I4M#rw7P!F)~wr7I$24f zp_X_{gM4BkFB!BFLy-G1by1W7ermA4tQuc`5NR(u$sS)P@C1`VnMHi~;D;NFnuM)J z?#83Xm@!*)$P^o0l7hjh!P3p1ElKui)W9V1Lo!8Bm3pf*3*Q}$#ub&F-D%N`yEW?W zuYdR4-H`$c{{6={79YObySq~7cp&=Mp+kY^y=V>G6~|Q{`UAkUnk*h)US$*d*zUfb zo?P&lso$1=g~h%Zg1|T3;e1Qk42D?zR9-C6e(A8^4?6C1Y85+#-gZw`T}EVNe5{0~ zTCfU!BJPmZH z+8sM*G9$X3*!S#v?UDEo_PM*0-vZaWss!*0%^QO(P$<18oXVawvQr3zkux6{z zT|FVz3}?QI!jx=tH!Wm=r|b)BIk)$Z4SP1wr1rSLlkZ)XI}hHg;2m&tlUJd9uBnMH zGfSUwoRbe!JJhRdJASaUbz{rCvqAB2^+O=Bzu-38Se&r=_$ovp`tglP3Y zFdPDjAHG0VJIINHgpa3WPb!$tuyvT`e`oLP0w))~q%_U|0PdaOD_DEl-mcKy z)03>s*E?BFS?`4wv-tMlR~)`9v43fJkfdhB3$JMpWTQ-j@;ihD0Q{c>WG@{be_zP} zY43S0CtIi7tVu~>VUu)!a}#22W9YMoc6N~ca~hULfQG1oKf}k$0U5`31*m_M;3Mh# z0@B8AH9SrPJ{OSuQ=u-r+(4&X)v5rc%X3V>7gO_}Lf%q=W7L78?w|X6&!@#`%w0Fr2Y}!J;x1TE!LbVMe=$OV-keW< zl$ah+S*?2@t;$jSeCb4K;B!p&vxddmoc)2^gnN~rII&u!cUwsorRHSYW!D5wq`p>2 zFY~@Jj!Y)zr1uMmFJDJE+KYq$Fwgiu5w_ZmnHjv{ztMOyv*6RllXs5%QM{al`PX?u zn}?;BS4Mb6!(VUQB8WA0t#l%6zfCR4N%_!d{aNjA*NBkx=WRWy{=5LHZb_GT&&?zJ zAYr_zdw}~D<>75flwSC!coPX&ajq^UpbpqZkiy~cWw+}`shz5JU`Lge&a){U4rcP3 zK8+N|?4WF$@pIQ?yPF`eIdSZ?SF#bW)HFt%u-szTaZJcbbruP!EqSr`IKH?MxAJEJ z*NxPsH@B!F%sLgP4c}TrkY=QSC@6w-H;nFPq$sh` z-Ka1+WFw@XGkw25&*%Gle&2s!J7?$Yocq4+>w4W{oofcA;?-k9zZX2_%=osmBIgDf z^nNNXd8F~q>Bxl5wYk%wmo7pRQmrp0^p=0jymvXY<5SfRYZi3>N-D4STqS~@#Q8n> zBVl{q(m$Y%w+kO`GL2|eyz}raX_)L1=NhQqSan_!{N0b{dwC={kF+j$vbECt-U-%U znmALd@5D03kvS3nC5kJv&Alx8Dqz60P?%4gZzh>ij>(@A1JQg|5}KUd1-9J2#@>IA{U;H?3FeGo2Sv%R%fqS$49H zJ(n)rl~s4ZkNhX`D^E8$8_~avrH#@Eew|~6QnMY*FopL#Y_`Il*cRU(Te#(?LO=7& zLBMP%ior>!Y!3k@pRPvo`y+kA1LV|W%gWEPEFQT;q#o3a*>si<`xSoF_a{#29`I>C zSt7aCE92C>kRn9eV>$F@S!&&q>z(UD|qBMKt? z66&Xt>3Qy zZZPrPA|`hpCo1!J{+HoWTv7T)hedMkHnM-KqCK+x>a4wIIZDC_X4%W1%#2juAFuQ1 z)zJtQ<9l9Q{@GRKfRepsh9Bs1{73p7{}4<*YPH#}w|$JwCtYW zfa4{7%x?QFkR<`O&-)F8PLVc;ekMkN__JhV>Dg8mel@GuV)e7 z5&12n0x@I{R3JxBV*C)j&NFG_JdXq=V=&Wrj$I5i&lM|Y-4j&htX|%V+PJJ}!x=29 zTrS1jf1M%H%%_a)-V#sBVQ?O4HoCu;%=#@YaK%J06b1>A7#2hmsW<3tU?4+!iSU>{ zh`^7a(`R1z?7rY`>tj*xMpJIV*@4C58=@Y+9$!b`PQ&+E$EZOcMHwchX}hCOxl2%c z+J<)(=a4tWNn7NF-XFZPyqK$84XA0`HU54(!GEnUU@?k)hsh&TxuSinlmRLJ-62Kq zL>_F3_F*I{2vI(+Z;NPUQ#TAdY+P5AQ}^Ab)A{fy`=_?hnmhj6iC1w36BfriUvJo_ zZ$P6I#$E4-1O%+fmb(&*CeRmdBZmNX0chT5tIYdnIJ1#t>0RWX3q~@d0wZHvAE{G; z_*BVbz}PPAzi2F}+E^M3+-REe*Bh~-J1dd`jt|mLzho3~ega0WF;Rg!`c7;YW_4A{ zWxCO$14?&%ZpAitJ3(;CiSR&4Cv zCH-Br2l*JG#=sbuHN7;E6Q?%5%o@0oBFTwpqI|NGL$@4X)NxI>w0nYht}_JRJgPOA zq5K;9I<;!6Ij-9KimwSRqR+}F1l}2_&+1cO$YvJzsKO^zD*_q0sx7i7^em9^@3UiX zrzR?$LIjI=+%-?udGQrL)h)zJ*4G{BPS?1TwF*2KF&Hm6b9y!DRb){)wpq{|m`Jc) zZ&Vf;nL6SBoeXkn2ZXyE;lW>;m4!`S&r!`^Rq~1N@r1u}lI*GY?8dO>c>~d=3=MgO zSCP-OaQjWhByAJ#8f94CL~bY1_S^-M!sPRtXVK7N*kY%PO|m3{!5gO;{1YBSA^X3 z`t{Q6;P>21%@o9WCD$tY=jRzSZFI^=P|5X9u2B!dD5O%V#)N9badqzI=ZCZkJYRUU zH6u`bhGHsHew}8vFz)fn31_Uc{wC~wHj%-LfxP9YYv3^hj(jm8wp6|_t6v5_u0i24 zjxl3-YFW0R@d-v49k|3+l{&r|U|dj!ustYD+(;j@L1_50fp3v+w(IH}gIv4h{s(L3 z(r56}6=2OM0IZo2iGNu$QU0Cv{{uCn6{^w(zKv~9)87~SESUTX)bCNCO1$+}Jbi-3)ryTtjq`5*=UOyntZ<&}L><+1~c zbzN+tGxK!0_tFXB%^ThCr{|WSCLPqn_YP)T0;yFzW~{?d)Nzns+zQI0QTKeZ_VRMc zWbZ`XMkKz#j*M!J?#unvew=RHc4-xh4$6-%l3wqYCog@!A_Mw#+T>I`%D>b2Sn|GChjlnNUTF`K)bK`(Cpj zLoFv=ePGC}E?#9ll zr@&q`_0CI9-RIE2o-hi<-55H@D4&oA@$l_s;h^&30RHK~T8+*XA%lRxOy6B$KE^=n z3@GfOYe`X2Cji?~zYx-5fN0WAW=6&>+&A*Q?qulJjt?poMg1t;sB!9u-o;zxQHL~7 zIP0n`xiZo=A~?<($47ASfv4$+ayk)tru6?7V-Xjo_+5Yy^le6tGSEGe2HYXH~na(VP`t<9Ox#jc%m>r*|ihHE0<@2!D55tA^#@R{(Hbdj*Mst z5nHeOG}`V2Z5!no2oU=maO@j;TO6Wf8I6AG^~1V#L@_d3EV5_?`r41~LtRCYN=}fAVuQs&^cU4dmN+40_<2mX7YLaGR?-d1ZP! zc>ck!o}{vr+kWPNxB8+#jDdL2&w6x{uC+y|eRqGq(F-ar!0!K0mC&c&EMZ9X<>Y?q zYOh=*#`(4SPDS$CDJTy*>J}dr0T~@s9$I_F8o8n0PD0*)c_Hri`*kN>`;y0rynfL& z&$j0MiuRIs;bFQT6b=pm)n4JAczPsk7|X@usj$yt8qPOi+;9NJttw&=!w1N2GXeM! zG<9HMi`e33vez(aAnKO=i|7O zcA6em^0X3h$=0n$0(Q+Av!JC5A~x==GlaN4WMj~*#&)PM?k+Y$g_|C+TTakPs!@+efc5 z9G^__0cyTh^g2+48+1iMRZ0$m9A!i#zIe5xMd;?C?pLzvTob9Zr=mcYUQ1edXR#8W zbhCMcGE*A%$dm&!c$l0kUyQUk_1QJ5&j*7mWe0GbadHEk526n(k~cgS{MiIv7VNY< zW2!!-&jDIWY5OA;!EE4^y^N;=>>_#lAcu94pJ-^G`&5m0&Ei~%C<1NZvKXAFF zkr>=~$l4Ba%>;hVB#TG87zj?M8sTTBn=jPtqqa@22Zn`zMysk=@J?nWs2@NJ3f`$h z5BVnm@TleojKN>xomMSIPlfpOQ&w7W53K(l$;gL$FM&QrR5Sl96MAY21DJ8ULe?o4 z?sS4Z)y=DHLDE{jzfPB3p7x)n+ifUgvf>4OHp^;J%VlgzLTb9%Z9POz%2$S>YPp&f z%lGS@B{8ns1xi?*n3dmp!Wgt6@_QG!E&A*wdq!50oUGXOgmL$0+Oe8$pUW;Vi4vM~jRD;)(PPu(3uR9Be#(61mGBMjC#C?$1@lJty>e^ zf{}QFD7-JNT=*}x`1{Flg3)nPCt0vtm%xp#lS=hyjV>jHz(0ZlaGbNA^B8E7)dA15 zSWbtf1WZ6;hS;ybTJcRnbLrX#Q6t5dsnH~SSjUG^-p0({DjU6lrXP0Xtw90x(}|yO zaFA#X3Pa!lmKg&{gGzf6T0pi<>UWWJ2>WDVqGo;(BXc*|ub&Q1 zOk$EbQ43Mkce&Zh&&m5VF<^+FJCQj}Ci+*dE21ZMEE zeiN2uHx2;*9idp1zpyzHCB{h%B&~y_@!Cm1g}D^kY7Znec9>mG7!_KyxkhH_?L@}* z`u#`)y&TDod~xRPR5ZO?+jm{_^Nm!eoOA-w7X4<+Pdj`R6TBFtCXM140##DxIL>)m zvYA<%eXDStITqYM{%KrCjmbzjLYJ{E$G)UXD!o>?$Aq-saJ4p32Bw{k9eh%xB*dxN2J%euDU2fGA35G%RI1(1Q_H?qZBK?a(fzq0ya@bwsOmDh4++K7Jm8g#-{^XB3<;-i*& z8}(S%P&_KTxvFa9uI%!r?B`vO>8EB#JxtrX6X+pEoG0pH?v3Nw8jnPDNkR$5R3WMi zvS9Js2MySkLh7cJldN_e<;zk6sVIrwuDs-$ESXrG9@xbILzKbG4|7!kr2{Diq`(ki zIP}ldL?lSpWbW;wimC?EN)xq9nsUckXILteaUXK+O+~V;2)pNtDp2wU)$kF0xxY3u zt!n)b5!GZ1H^Sg!(UO*6G-GEBJ7Ec=W(7qP^Ui)Q19Yc`o6)6jrXZCks?sksKG1aL z?fz0vFN!vSZonmtCUj3V@Y)R_5jdWHU|hh($Dkknp|L#*`NKTst)n9zKgKJ<`K^SB zFpI8D_a-g!7_3zEGHskKQm_+#&OJYmdO@jIztIAil!*0O3_sVne2THThw0lLRHqU!`HYvQmU z$xbs?lZhUHJ)pw~Wed16L?in$uGh)@SakZuL&(*B-mr0Bmq{vrg!pbMbbTX2orz@h zZm-_2Ht%G;IoWe3tGy8AM88#$%r6P7mJ-3}pZ9B3yqYL3FDj@fv`iK(@fcj)8E)@^ zDhEhfP^{pRS_ANBx^EvVk~Yl7MZD7eImX&~m-vmbGhq0LOLqG`lXH<@-@UdgZ66)Y zg)0FQBKq@K_akxfM_wnB3BqXi)0sxgGoM;ZdLef1DC3V4KKh5zo4gwzz7H&intYw& z=IPSs4RW6V=H~2g+^JL3&UWs_af5R=lo^7}rg;C@8QBMUl?9wY{psY_nX%73VsbGP43ZJvO z+usds#PWb`8#uMtOC;DncPJ_F@e#;9-f<(->ZC}k;LW4iTUdny($p_uAq6e(Fk>=E>UHbU6W_GfZx<0T#ZO7xJF9`ji!E z6nqt+IZZ1sbwc7?tt%&}p(L21E)Am$FDIm_x-F^4Bad-9?XJJC9UZrr`2~$EPz94Gima-8V!)~S?Lcws*`&+3}rzG!+#K}~mK)2yJfEjBe z;Z+lhP`WKwmYTT(oc8vUfhq2vvT~K51F1d`*`+OzugKED1D%8N1h+;UZL~t;*wvcZ z-+r+3&~nl><~W5tv;NKqzLDep(!24BpU!OwY4$8JIl%R6b4t!hYb-0)It+mxo z?CHQTnwTXu=Qii@&otr~UDs{n3%R1Sij;G+#`)6@RlvEh0(mCL8~*BLD}m(-BtzPh zESu=HA1s%aaIiz}R5PX1Z=%lQ8pDkT4SJ!_Yo;|1z_ z`uy?^1?Pzc;Kdl(aylxI$Rj_weK_V)Pr!dl27^6wFxDP?G6IR3hNp~GVHo_0W} z!x-yYfSS2wzr)x#&KgIo6ten_fB4Y?!St=zpcUU(92ROL%Cx=i`vr_SOe_ zQu|#r^R8-FI`OR{{Dq}BThE5s1sat;K=s-6Fu|I*|AX*TLFhw^s+%7aZkWW%xy>M> z(rHFRALme??XXpR_5*OC%_?!VEtH?%9o!K2JPApLoD>gTH_;Bf8Jb_TiklEP=>u~h zxL-GaN1U!Y@?$N<(~55)iGfw#b%&@z6o>MhinGpPGu@ix!uD)1xOpgf!dffPy)K78 zBr3O$XQ9}U-+$X+pgLERnN$W_lAa8e*T=!Wz;2SNM5cyI;i7a@=!RB`$Y>(P$TLiq z9P?9OV66{v3+}B?QPgquiMb~_$BeafdzNL~3pBi#ZBYLYj8Ts^qI(aLonU+yusT!+ ztnsJNPrNJM!K2kGc!OpK-i2mooaQzu^>#l>+^>*tcwPG9A#bFP7)QO>z3E&t)ie_J zZ!bh;wLHgl)KZCZFXx~G1PqgOXNPmKKMEANq2t`U1-KW$J1@SA&I{tHB_Fqv&Up94 z>jODjZtf?1w|T45-`9Igk?|t358Q_(B^!OP!vX7D*vQ|qsePd6#(~tZN;6?!^NyoD z`INA_a=0KIId$4dZnu+n~iy^bF=Ee zca2j;rME?=m&tkbL&=N2h*?PYijG3-dORgFbP7Lf=@29w9QKjhLP_gVTImy@M3p@l zRZb}?M31k?^JQe%swD;*MprJ)uay2!REW(q!IZI>iZ8siQK=~2bj78oP%{QEuSQEk zE)G^*VMUDzRZ|{o624b{NqWgJ6XIh2gQM&s>y9dL{Ltl7Jm0y2MipZL`_|1dpTo6R zopr@v@Ti#6k-(R>{3sPueJFC$*?+A{-LHYY-}Pm3Ly{Fj@cRSVIu?{OS|WO;UHP&M ziflM{+sR}Yirg4@`7*Kvir%0aqK&LABQO8Q2F&Tqx#RM5yX5>UOH7sWr`YmPR~=!5 zMQ}GsL#q8)1zLl0D8TepigV9$k~=Ow{SuJCP-<7zN(r%|Mf*0Keti?5Q!Oi@_TtN)fzfWoZR0b2(n_0WM^_m*+s;ywpW3;qWdjA?lBVVdR6x z(wkT4!e;*Z#{wzRa+%FW$5Cc5_&{+eRYHk3!a(qIv-d2qoU^SS zQ*ofW09TS8>a33-SzU@4k;z#yN30_sR^MqeO{ax_h8Z(Og3io2_dZ1(n`(PX{Ddt4 zEQ;C#q8yXcqI!1*fh?|Ve+-+gXioL3fvGM?tjA}?j?*A~_cK`%wrdJ|TGY#!!OJEd z@W(<_jkBaxJ}gSPn4f4>8;~I`u)fj=cw~jy#AZ7oxN6IW$+`9zatOe)#BX z<;>gNReF-ZMS2JJlE-=(e~Sxj1|Ic3(+ZPK&Iaz{4;rz&HEUq$M^%(HTO`BKnN(yJ z9TiCaS;8Y4RA}!j;z4EsJ8`>iyQ+k6uEw{9B8Ry4!n5>z41~y45GwMp@LFRhUi86Q zzxwqsFj>BR!3Qf6Btq>wPlU|~V#yZRv;cYC$yRkv$v32A1hOiodcFjh%Q?Mt3CHBE zC1PkC?UcJ?AJ8NvsJ>CsD$wwvNcr45!tpBV-SksfK9fT4z;np3?v($%qRs~~n)&w` zRce%B;rh73xUD@)PJ)MbShj{2rrrW`p(}L!MHnGHs^$4m!LtW$$7}tDpfd_>UDER+ zzm*9icn7Zs%}Z82z0AJHAN4O|lT%yVhpCNW@!-oRIG9qH+L398gNc`06<+-Ol9`F* z9Q`5?C}IEDreUR7zBY+6>W&S!g!K)|oRSy}OqQosxgxAvDf}s$44#AUB(z4}q<490 zFmSF>6w9-{R#&X%uSRz2PG%FwUuG5KnbMpI9yd^_aTeJL;Lnpfb*w)qe#7E~MhWty zyx?H3jFDh7Pi{lt;?D`~RpGO-Lurbj((%boxcv zaf~KL)TDqiPBJ`m7%<}T7xtuWxWwg#vi z!QekmBY*fq%-RJFLr&;tDl`0qla|qSU8m$e=i2j2(DA$*MDcP^45Q4qqN}A9^71`V z)jt8DJAczg#VojZm1izmj+}NhnaEvH$SP~kZkJVEVy7@Gm4c8>Yb8{YK>s};#LOF1 zeyk83AVZeMQK;X5Q#61CKF;W$%tr|{fZxof9vRl?ntXb1P1ik9Ql|08f@IFBNf~_D zh$%9xItuDBlX{gSbNH{>0c&SM->)Fv-c&PPp1t*}G14?$<+$hdl2vj!o+snZWhyoJ z-gbDsUf!KxfuRY3P6aQm%CSaPvge{O6VD}f2tB8DMf;`5<>lTLZIr}iV{*)sG0O~& zmzE3U)To)16Be12`wrJp;tYFn4O1R4t!;}WXCIV1Q79_^vtPnk8|S&_dFN)T{-1+~lPiZ_kY+lglMYomiHWX8N9JEv$;abm9gZgGjjm#xl{-h~xeK8` z0!#~x@LwZ`CA4-;&8)e@fMd{ghHe0|Z) zc%+bLZr;(X{eilpT;^f}GVJLiJ_&lQ#C;uuHkhVR6U=NxzX4(b|mkT?5EDi(v;%Onj}TO>I`02o0Is>J*Hc2(fl z#V-5T&BxuG{x1{9-vub#N^Ndy5e z3kj>u+#uTXgYHqrhQ`YDUWb_dX&CX_yMZ(DVMs^QhXm^$yj#x9p;PbT^M%ofE!&+!@7?vF>$KBvxMVZpjAPK+$7lv|^+- zfu>vjG<}tGXTP8QIkRkZ#FLBN-^o=ZS=q+Ka!Zjd1Y;bck=w`FYIm~=Z0GaH(IOg@ zJ(pX0+MdnzdlEyfL%iHGn|E*S_#yr3)WXcv(L1r(mHvClP7SL~kxH+jqB5Lk=PQfO zS7LMhTQ6xUtm3B{y3d-$E1b#AtTLCyZiAVgM`icW|DvwKb>y4fM{^|x&Jf^}Zt;vp zS0`xEZN(weJy(5KX#oAJ-LcQ2I(YEdFH)S`9GG3_;4q5~#GVVzQc;oW#TXHmOCdjW=p*C=^_@acmNPtGpWKkN;>U z)D$h5KCRw;RI9Ku@#a;*OWwM&S zdPo??7_~{25I*u$ejn5{`>%#}X)Hd`STDK4Y4f=y(xY1>i7R^hF`gMjC93Lqt-cT})l zZD)>A5^tTJhfVB zRU&-srkKW5wmi!;n_+A=8GTC40@}C|7x-&FBr*$L1;fB!TK(vRZ8TtNBZAQMaV^vH zmhG2AA!38^wZj%9o{)2!Mlje299%u8FS?fd`E1fgBeKUR| z!J)Vc3_5nu%6C#i6@U7)0Q-uinqyl~8{WOe61=JpRhYHi1O*QsrWp*=3aL~sp35$J z75qYbBJ_`-NbB~O@?@S`IN`9i&vM?OiT>-*d$tdw{v7ypaQ(wWZ}MD+iKc+pfE7aQ z6}RxTtt~`BOH**|BH(fyq?pI-9 zynjaK%D5qA_+L@!TesjE1xpci5p*x>=8vPo*xmtXIC~(U%M!@LzdrR4fV!9i6MvGj zXRG^ycm5X0ulUHrbz4B(n_*atF9J{^#D&%&p zTmrC0Gz5mPcPcj^O=pI*%6E*9+RB$2Rgr3zZ$z`^#O0?iy|D@p1H8{upE8B8mf-Z8 z8d$TUSwMhsU}?j0VTW=%?^udpg~`i}yW`rQMSxN4BW!rtAay11 zG3xHHE72eRSi@!MWbBlQq6nHzIkv$i>9|TxMZ!V2z1FPtgWv@{v~Ju6XCJgz!_kEp zWo{?Cv2IIs%%LQ$owV7Wd|LeQDZRle>W+v|`fS&( zSdb6qO#V9J{`%32(Fm)>4y~yL%HKp+4pseUXC90F@X7q6YJnhyzE|T1T?uy-4Uc$u zilsDof;8HN@Iw>w)l#qzO#>Ab0g{m~*tDg_%twp)aidK&jS}vQQKvtvzS91#`bt1{~L?iTic|4TIj&x`vR6f@vvdP-!5#LX`Qtc!nSGFwEs6}d2Clv_pPpQ65*!1v2o zK|&Y{6>vM%29IZ-eSe+;j3rlh+*M40U`s#+Y{u~TN8Dw>o$OKSC@h-^AA*K;?hh&4I0e{7e`{eYp*`+e;@3jurS?9|NhjeB9%~lo4EC(pF*2 zQ{+MM)vaIKCOSGin6-F|tB(egiX!4OS1eXKY)VazIp2hMhC_g5hrfGY(dUFBMc<^i zHsI=%n0);dNp$MSy-@O{G9P1E!FR9u-VHXj8Sv6&~$V|uofbDU{x`ou6* zv{9)h1+^D%@Dkp)Fmb+PQ=Mp_>g%)T)i2%UMKiXt_iCuTFV>*-a4u+PYvO>SD4id< z*)%HVT#yfHnk_lJTnMud{wdm*y7=w~74d9>TGQK|cFx*Tay?;TdqIYT_>6T9_HXeO zzI@%&!TxU+)Wl zxA)xX3NUSzrX_V>H&Eqk-H|amE7S+Co|NS}_MBD;^7%iiU$VmGq9p2n`N@1PK*0Zt zp{V{xdnRQAOwX^w6>z7&3i;mU29qBdf8E=%!ca$~7MJAN-aUg!P1O>*uP9Hd=B%^} z8-}>}21ViR#+8-nc7rR|+v2LYyTpK}s7x6krPWyr{umh^%mSh}VE+@uNAH6X`>NTS zZ*(*-68!LMco+1M&>xihhf4jghedo=1-BbQ%J0lo?u<~96dBqzuR7Hc^wJXUAU7A< zXYHBXhut~SJE?IRP^^hr7hbnH?VYI_|1&cwe^dP-i90azf(#nhq`Q7OZX6O`Dq#Th zIyOzniaVVf*2^(F7Rit$qxu~o0lU@QV8WI-e!d&OOSN9Vp${6z&IlBg?5@2;!2?xE z8W;siqB)*&B=SzVyXna^lVAW@xl&c?_sGrhZm0c(&z;TL( z#(U@r_Ys>T~fw$vNmDeZoUC8e|9x)Ew-Ube0SVS1e;taUBsmtyN2$|0v9Ws^i z*oF@(G!r%+R}hrYwNRUk?ab+p)u*=)wNAfPo@8)hceoPAL5h^5P2M=mzbewNx|e-I zu;^S->3Um4wR$IK4|`oX4FM|v?q~Q_&+sZVf>J}cuvf?hxZL-SQX8?Ma@hT$FF@Ci zT-CNV|dzsXo)1+$_ z``?Duo$c5xjXgpGsv^t zKW;K%^@)eJZPOoyfc(GN@bHnFKZ7(np2iS%0sLpZOqZ`763PP9i&HP`XBfAVfT(!# zn;yCUii!gjOZJI6rN>xa>68*7{mka=`W17De=C~DWG@<%vR>d2*min4^mw&1;SB>* zXV{!Ta17-}iA@6Ct<#;3?&uz~h{DHD8}PXN4Aj#d{#UN(aaWK6;+1URh8~m z#=|_f*)r8hhD!b!G}9vL#}-1Eo~88XDIm$PN3Ngu=sJ+W&JLy!(6))7l23Vg*eXPN z6ZY%@-&j{+Mc}s7lSVw(7_unf=+Dg{V|JdyTE%MxIMNd}_j; zbX+B^cLx_>_KHZ?wkQbUWEIriV);#v-LP6oHmWy%mtNqL0vxJ0wY^dF zgvnH=O@wO|T9Cc|sGM5z6T$N{N}rIF#rmTB!D!|Uf@n>RvfT_bbj-v##~8EkGgEXS z9Pd>~DA4lUz*ynFZAwMbe9&0LEzqzQNN#`}JJQ7L|L4atzpW_BApxy6(8GK7jNZiY zT?KLh$If)>=VSqdN0dGDPpnMccPzkuautQS;uUN$-T{R5_>f&qPw(-2=O% z?6_zKT0{sjNjX_!`Ec@ADi^wZE%B7`>OL9qCIbFqT2ATfy>W(}UykMsjU`VsdoVz` zNj+BflhXsr{rFP?80K7}uLnwhk!md5q8uD0seW>w-freSiaBDaD!QChWpi#ku4(^s zLIn=6EJPqxRO2d+K|bDK>W=0#uP^gts=^6IL5S1A__Nexw&DRGTP}CeT~T!zS)bDr7C>xG+vMC|ifT(7|?4hvEx=Qa*soptEU2o#+; z^VSvUL4*5&+#yo$Wy9}^HY&q%v52?^`on4V=k!6lxG=n<;#;p@0cdV}XPHF&7(J6# zTs?!3+WtRj5CHV_;*?G_Ls?yY>bfXlo31A#tMN4;wo`Tdiz;n*$G+HkJ!W>8d&5-g znBp_!vgFN~2jR9>qeoetO}<D(qpuYrg)H-*z$BpepS@La6-p(gk-qzZ+AVC3M|d zY?|U|1kd;Q`$QFG@5@Ukf+~!^K96X~*_ysg+f82X=D8Fk11s+DcI6ztOZN{Tpc$vzXfxMbh& z(3z~|He-O_D}6!Q$cu%n8nhL|x}B4p9a=?)dTdB^1VOST)%!dKK#y+kLYu2IXUhcC zJ6QD3s06T}1uL3|XK-egw6HN_Vfg@eRP3J*3@*HO^dGFy|Mvs`fAK=>-O_sG#l_VU126e_DZx4e!y(34 z+hdBJqEg+0ycB}neGwW0OaG8m)SPBQ!>p%0&c4f`p=;$Mv(&Wp;vRW90u0=s|GvRLAU52O zfVufDUeZH5S@v$Xt19Ja;2Y^(6%{bKHTFTTCx0bDUeqXi+M9OxEtJ}-?P;|0TD$y)+ci&sMo>~!>Ej(Ssf_K40B65sC$b|FSm)>4=T zYMa9a;mXa;DJmjnDCYU)?6Z8Ugv4u4TT3ne*-Hbv@8(*N@ zgzB|073K`YUfI#{&_cQg2~K!_q-#r)dw=VJX8L}H5`kf_w&vRtQCVH?`bj`t@P4xj zITLR-#WmDu!k3F!a)&E)B}*u@-%=TkC|V`7kOpgC{6=-PJ;2M~+3<-5#P7F}XhlLC zz?u)Of8+Qr!Gfmw?5BJLL^05uKgc`Nglq>})g+&XCS)4^3a~2K0kWaS)_d-Tr{Xx{_7u^}DY#OeuExDsbD%Uy{f<+{i zb=GkPV5}pH-A1SaLFPe7mt*kSAb?j3WG!p#!XZUp=`!AopVSOPhks zl%TLMqNMzh|Gt9dj_$A^0ODDB!jsab9>v6WwnhQ$q&N9~Px5;JZtA)nZud@yRG$zb zm=-XR;akQV_PV^rXZ39tL%A8tif7hVx^=iXxb8N*G;RBf!T}BZ0#3ybogtGiu}hc| zpXEQ^vgZDR_T|{$^FX}>w-5~~m1!5W*;uA9eCjxHiBRGUzvwGwHQ<1*zD!|Zgp479 zi74M#&0lSJe+E+Ss{OP2?a$*0tf*gRd!>BHThhN1|z(=P! zDl6AkoYOS5385k1k;63{4)e@(zwky59pnq3GzHiWb!68AtYXV=urb>RKqrObZ~=ci zbs1WI7CP$x-~z#!_@_Rf|!O7QQ7t9bg?ue2&SFTIC66SA9;}$_LJfR96?aiaox76X&W4_vYpvNQKg7 zO1%YQffwB7`Y7hoQUcZ)NVs&88JtW?pJ zUkp9Tvo({Fn77zU(9SphkZe`x`kCKqU7i#!=R(UF8x^!65N*@k z?E`VRsS*;>+u~`DXBV@Uj+U-90_G1n5PQL**q=6~HE_uNjVeAaJ5+<^#AfgqNq{_<&rW z|1o=^LmCc3;kOfVG4P?M7oE!vJYlF>@%q{0g=gCv`U`f!2n6fs$#-E1w-_-|G+DKY z{+iBk6#=l{I(AYTLeuwQqLoE&Hvcpuh7M5XQY7hf;-!qmH~bo!2v~HUuauW+QSx5c zDUY>Om@wMjy1xtUvfJs0|Fp_zu^TNFBD(U5f8S=4^>xluqjSm~t`CY-pqWN4M|YFR z-3^IJC}$$V_5|iwM~}eJi4C{&>B1zt2@M#B3G0In6-U++SqrG75a^MYZZ0$T2;f5p z+I4bw{cy`>0e{hST_$~L|2d+&uOdx)xSsm&t0}(>RG#8pk%pwGC+39rqpOMWtsAK1 zE)Po-MQJb&p&7(xPt~1qEfiKjW|4jU)gH6Pr3nglvdin50$_37o}=^Zw_v5?R160h)e zQwK+TD%v_XX=4_ybavJ%g}VnY?sC?IS;aD%8mf-s(vMIX!8hXUXQYlL?V7Bh;E&rY zz3rHJH@4q?w*^P_qoO0VnO+Q4ne1ZNOeJ29-To;a5b0=@|My&EcakBW!)$P?QnQ%f z4bwe&g;1kj)~qoPY|(*K?L>U&cKC#zE;BB81_h52A=NV6e+l!xxvuw1*z8c@V2<%ZPM&z> z9*o_PQ342Hd!M!Av05d|r~{J(R&sGB2JIa@F2i0BfIzhMvKaBNKGg2o=YOAdIV&SU zXTJUb6z1~WF6E<(gCf*VW!CCY94v{YVU`&I?PbKbk+rkZ9E$Bx|5;_e%-tHuaf22{ zdFgrbRMD40Wxk?1T3{w|xU#HgHCc^3NajQK7LeJDJ!09fXNbPcgC%Pfki>bu3i#qZ zrk96b&k97XOuqKWO=Oobz|85audEdGE|xd1s36%^t2J~Qd8vC?bL#!qL{!3woThXu z^Lm|utsHa0pP2Lr9qy`(={h>c@AhmQ+x^5Dd~YPQ%E}4XTz{ZpyNROkaggR2y=|V~ zTDvp`yb(4_Qdb{IT;2PhfoBGKHtzqM9NzbG2$vsozu-SL5^|Jb_UewRUu!H1XCsZ; zK|E<6L7)9u@R0BQkDF9``MjM6yHtom)+tO$NM%ha#q{GMT{5EUrtJSI>?)w5>bI{V zsDvUSf|7zFlEQ#PqomR)UD7Q%vrSw@?`T?!zk?ix0#?d>;nr=Va-kV-`wr0CARxt!4i(OLBLK{t_ZU&zrG zXT_2*%DBCb25LT|-BP5ArvYQxPw>R@K4S)ByXE^R^0_V|p6mqf!Q#>@wXN;8o9`0n z$Rl22hf5#x>*|*2!QvByile`KSt;#Q!X_QE%rL8UHkw6b_^vZF=(^(f(+iV4^Hq%< zF-g%>2ZG#DZsn?szh*XKJ1%1AJUzS@yCrIN1X5SV5OJx8HM@LCOH>CdD3!jSc<5oy z2I%P#%T^$J*s0kOSLyLg*Dg?+Z}hvuU{#l&-lMfE8p+Zc$&NOYw;(d!GVoG==7nH7=>YwMZhTi60LM(zyO-pbfpn1`2ECflOhu`otYQIdKs)2)&k zsn=s8u+uG&JTp3UXwVgx#b$k^GpV*$Wyar$D*rWKR<$%^*W_hSpv8Fe*^F~nnc+d) zxa~)W?S&8W0z4EddrxgALt$)IM{`F35tX;?T;hwc!lQ^!4^VA-qcH;d-sqK-rSp>` zoz=S{`lA`g~~T-db0%Fsb3NT(H z{Pq;}7e`$ScT%a&bn425nuI*lMWjq9`-E|Qn-29H==m(PmF}rd#h5)08@~KF+0ZSd z)+WX?#QsKGoBcX~$Qgi3i2}%^s{l1TVCpl4f=H^qm-PPS-K*Od8T*TIsv!tgV1j;% ziQ6yz5vE;SeaxH@81!8Zf@ume9tdI=ZptS8TO*N)o_# zzG2rB9|Z@;3HpC$=`x!HSHm}?9!1ydwUf6d91s=sF=B?fbcmbL=tAGF;>yv8O1T7| ztrD{1Rx#!RQ(Lox`Z0PqfSha9t+NzoBhAjSSYl9i8+lvD5h8BoGCOkP8Zk?6iJ;WP zpOT*jE(0;7G1O-pi@uHvF~MSc#%hF%Pcp+*$!!`M>(@lcFnMYg_iUu;`iICd5A#lh zk?uA50!$4hHdPRQDEVC&ZzI3{v-7bH1&Qk@0_B)uvy%0dd1#m01YT9O{p6BRPK*hE zcK;QPNeXnegeGH*=MJoz>InNbD^$BBS$0kQoM*xwLrkE`$9KaHEnwb$;#Rr-zP`N6 zsqy(eU2{Y9HRMvjWXR3cU3yj#Lr)a<03!KN^(0V{;eQomwbiZIDK+7VO}8P%_^FPm z(3e9F&lZ`L@ZzqCI)XC2$Z+@;`~!FQKYR8UtMV?u*_fGlz#2u#7r>1AcwZrlMXK>f z5(fpK>q*%7u)&HJ_bRq9jA>kG?<_kj`jBt+vpua_hoVsF({dP)Qr>jv8RkjFt3w{K zXa}N_j=U;F{GF%+_LH*d{##$q6m~@8$isxVo;{1$L~F3;^=%`iKOQl4*2hRI#$9>Z zCC0`oR1+z*#%78!=W^3g=?INs*gA1a?%LLlR%lU}47$1C%1?7mU2Pb$Z8O>T0&xZ6 zSNy$IhD7)C-Pp}R)HnqJQ9SbI7TzL{&D%9{ZF}tC08OvE|LR9`9D6s?`^(>$9cr$4 z+PY$tA{<#?wnVK|<)!e|oo`8x!Hrz0%6=pa?W4v$jW((AA|_~qe4ld$hT(Kb@8ZVT zW^)?5``Y%~+LaMs8^0DVB-$yEGFPuJax$NXQ2ZMOZ6nq37c%b@13_W<11W5p9Z)|l zio!cJJCFGtwsDJ&+QNs;dsma^wihBhd?919_1Iz6f;co|;vR~XoJ~OzCGv*IY-T$2 ziUXq&erF6%aelt09K6D?5q&94eYC7+f*Z8_IwA{WrX9@rU$I@6!)QrVcb*?u#*PkW z>3`zq3=*%Oo}#u3c`o0hxft;{1Umpr?%g#uZJ&ARv6s2$?YfNVs6RqIYr^T-@K1!Z zZ3HOnqz-a~K5rZ2piRcuzX3kTThT%aKb?_S#TSkho@&IzzbYV&NzZBlqBOhs>uQx& zyv9L++1<)@E;)A~X}P^mO@3BnRWw!qi)A4!n8aDBy z`EBPGNL%=(jdL89I`TCgxpwZQ-1X%Z*=!Oag%EDhDihh?N=54JdvE7FJL-);lxV5b zNL*39=53{QJsxpKkB1@VR zIEKXNE=DBl3;Uw6Lb-pzLAQ>)AI>p8Pv!n1Q2C`!zj0|tw3l*x^a{UZ!RTNu&bRiZ z@(M}brCrn_+tTLwCCk0M#seUJ0n?0$yrsxMcL6DdbK~jTUPk^yiVJrguXJdbPSoUWCI)i7E0uDxQWK(M^myfcr~zQcl53)u2A1Y3TVD8sjF0(`qHbAsAo=iQ=h zaVc8HUJ$qsDZb^jOcm{6Afu>!BB)}e!9Ghojed{Y@&MQcSG{(c$=QB2+{(q1`bm&B zo%vHuEiaVD`}j&e((=?92Dvz`3rlavYFot=E-=Dp^*z2VN1a zgLOIXminTg*nCA&Woo@?_;0TS>vzrfGybv!?)oJd@1wT2%IhPufAqBPj|FfQx%-SP z5nruvmw~JeD`VVwS@^Q&MLu~q=GB^7$k(MGm1dQD`62f>yqf7mQn*qC8Q)s@1D627 z5b^xssnJ|zSvdLGtYHW-qVLMfQeBB#6rc9YIe1ToaYsQvKP^Q@Zym&OHucO5hsgeYN<%0+6pVBQDVMIP0<~h_?mV*y#dW-o|`JTmpn-* zX!n=@QriyjUwW|Q*ltgNR_WpE9mc3SfA}$UI9>SW-<5{J0Xg-*O-G?sfGUi48)Ki^ zaOl~CG@W}W9{tSQh)PIQxbo6`<;sCh^sM>bk&yl87jephf8sv`th%oNbqVuDi$&lX z`@|eCzt1uHIJ_^YRj?ccL~YzAxD=g<5>^M^@+548Y-1J6#fUd)I#@O4MUqD>mMOVh zYCAP3s89pl>EGoM<|d`IZ&Yq<9Wc_TS%XKCIbQg={M%r)E1H&dAq&s#W)zls9SDh_ z@XdY#(wz`jkRSr>sG0kRO{loR!oFXPH?6zwYFKpzDR+}@2(xCs;I?7%wGz0zia>uH9S`(-*rVk_d|CPI0=JdjRGC7nw^Umh z#FJM^NYGHOXW>)(;I;V2*zkBYi&Z=Sxa9W+U97bR!jnLzQ?F*^G6wcz3hzS3BZ2E# zhbO(2JLJWptngh4T8tSW%Oy>3si*+!rCuiE2|fW#{AA6I#z081=ZB>!SI0(E+vQ= zwrK^DmQLqU-B%lvRSBHW4yhUFwXS0**_xV;qj&x!FhmHKR2=6)0%_OF~@@wr%iWXun%5R_WIT9z-rDtQ(=- z+I1!#{4hETn;5CBM{cy{hVeMNGp@AWIK8nCg6Ad?a8sIL$b5Tt*f`wjLQDw-Pp2LVwcglThcem zsmE$GT!o zo~W`-&P1da1l7;t(Z(p#>d*gR&paD$%{EV~@s?{(as0l5*^LKNfbIekjj%baE9Y?= z$PHNYBG=N7%a?UsEq+UBc($sQX6N`gfVv?-?6W%Ncpd9w{}a4Tyu7tdF;53vBbmg| zPvlQ&IOxH*MO^-lMNoPCx$=aA4O6kEcv`Z=)rkOpC)%mZR-B=Vw+zVU9QkI=*Yt8b zF8gtdO6pbT>=G;#^^$xs8?iHjPD8R+NOnF%XO-U>UGIGX*XL>=!62GaVgI>}HP&wlBJ z^**5X6#h4YOxnxS#*z}IOvZ~(4>V-*V({7k{w$4B{#B-sS*?mlm6xUKkgK| zY_FAO`Z0PFo9gqBN;@-`7Hv3~ou8?D^e}-D6_;+=?)FXA_`7;nr~)>@R@An;sK3Mx z*;hd$A5uT!oX#N}Sip*h)&_|Q{Z>UDwby`6w_Ns$`9#lz%L`98iARGy1=woVheXtI zIb!%@l7052=q?W@XB+C~_E-W<)2H0mM#R^;J!o)xvkgdf`L()+T9*lndvu+E7Yc@4z<9{jgP7N`N?5!b*E#?fCZS9XyNYx0&^xWQ(IhLm1 zv=8p|AN*-N>@J?c@lcMp(?dv^Jiw26+R$m0FxIvxl2I@abf+p5!J4m4BYoP4Oz$W+ z5(1i;U>>0(Em2EifNMm$N~I*`-6 z(vbUFqwlVEDtoK5K*MU9&h`a{Kzb+2k_5Cbhx>qag0i~7bX4Lo@l{JNf3DG;#ON}^ zP7*^Fl2KRt2_dRVHf6oVrzUmHRMF}#JQCz-WD(Hp>%u7|+GEsvxCxbjZl{@Kz-)l% z>U(FM#GrV@isUH(q@JR-3DIise6fyL-dm7LDz3#0m%@OKC+hQ$RhtB@RVp_JYJtd@ zH1FHK3+1!V_saGqm%dM`1VfC{Er`lt%D#HEeX5KNIEtmDmCpvdUjzNL!{)N1aptlwid760yL_vO-!mQA?aPx{R=d?57b(dnfBTc87 zr|o)cHc~wy)eee2f88PTnm_!A-)Yxmr_@q)wTfU4p`#NNzDu+sc}eA$#1?&6oA;|^ zh4GBvc>+87B3RhnH@~aa3U`-Lx-VwIW4)k0=fwc_>d&O}mn&yyAZm9?)`F(V3}VOj zw^ZyyG*|wF_5R1MBUo5)n06jDJlNSV?V^3whJ24(>lD_g(VKoV&Ee)h!OjtI?}Mj= z$sez$NCn5gEwaDEshMRfq9rz76u*s_6439Bea*V%*|bL= zAC8D$iX4>=U*i0V^gD{Zwe?NE5^WM?{R?v>&suS-$8Oo4iQ6vPh3I%XeSFocKL?Ol zU*5n!G>=7yBfX`co*uBfS$2^1_&r{cxZ5^T%nD4tqjhU)snVaK)suA&s-lpFHUamP)l=&@7B%@Bb zdPgaKxV%=?bx_3pWFYDQ*$pdTO`LSvyS-0j%-vp>PR>ib0hHes(?UON8A13|gfcvwTpk=ns9 zFw;4TPY!R%>a~c?Tp+-Rj z(E92$QkQWy;&Iw6f69r>@?5>%m?mK9_w9Y28C~BBW>b&DwShCN))?Y56Ye7JcnItjk*l&tLmYe|Yvka=xE9u9VWgka z1)JjuHWo={tY>|x!Bh{xkXi$MYq_sq4*5Rpmb4PJVSLK+vUYhau;N|*y9nM@1RFlY z&H-z*uD^Ff{am_snCBL)M@l@;&h&ckn!uRWTEq(oG~N2lxgqDCy?& za)M=f{a505EIrR&PS4n#Y}Aw;MP4hjO&hM-VgI0n)I^icyNch5^bGM+DLRZGnGIk)y@nSpU&d9|M%bwkT?`xus#%g9GPha4^6o@%aR2N_T`r8kk)Iza)@ z#ih%#C?9rgQG3uD7CZ_OSU5U74I+k?PfiG|8m4Tk!7le(79oVkvd28D$ceY7iNp)9 zF}MDV=l1NJVEMd*nF+}MOp?hZXZGjSXZT7XoG zQAvUqepS2OO*!y*kR1U0lm)EY9J7KuvHd9*uPzbm^o+BvDJdRqi`T?eOiJC(Euyvd zHd{E-bd$N_6q|Wyf~jzlq~e6(9{v|O{cy$s$W+CPgtkyM_^4vwJoB2l$z1rZxA?q@ z-bMb0Di3m@cL8j9ajk#P7q@zWlW>`p!QeDOp5iR&B^`Rmr}t&K^lrzy&Nh||Pbaz5 zs7D^lwLjZ#V9%u_!vZOqe>ptszy5s zGSU8Xet7~m&iWnha`r`9=@O|eM`Lz-HNK=Q@!)navwQ2z0y_X z882ASS8Qn&J?u0QK@!psGYdhjFj?-!>2uTwQt~0^X8H88gxr{3Z{7+6^-r6<4uUkQ zwor@ppTkHY9qIDGmQjqb`;JF5+ICA;UwQA!PvdKkSeAJb4Y9sg%0g}^++woSyZYqq zB%zkRTrYp}txHA1tsUaL7F|Dpfzq(66x zv@yH4lFJtL{kyD3E%2Yi^_&?YjZ#pb5v?RMq4dTXBwr+vZN$E??wpZ)@g>empRwL# zu8L#FdzH*F``XiDFf4`8)i#&s{Yk|=Bo`0`iC zi`-?!Zd*}8)ID=we{nXqMev9E6rHS27O}#W4-`tzRV$G@yq9-gPyAk%?m2{(rCav+ z&$v-VqSB}3=%+>AhbxRW)?f`9Tt=_G+sB`HnNqTS%e4?_`cU!N!kZb!-Yj%$lB-MM zR{Dn_YDHdwVW!P|V&b1vj&x!7L3$qFK{LMm$B{nYE1TxjQD>GGKCmf#6l?nFpK+)^Mm5hX{ z-ZzVko2OL8!at7&!E%K;S^78vON=DM(Jvub1{3|eA$_YidVMvw)wq^#wn#~KbYy(B zN0jt()})W$aaU^Ln0#$@cSAJws(6BGt;-I>cz;&wvA4NJu6Kpy6+#n?>8@g!0Vso8 zVnWxSgiN#s_WK4#UkL&}!NuGxI=te_CeZ$vibDdkF4N=!?J zY!ip1cPO#XWN5hnx4yK+wWX%T%av>-P6h9GZmGuu*U&#Hw*OOA^+P~%K11>yq@7wlHHli9lIpPn$zxY@E;UK=um5kX(2r^v(M>LZ9 z-PP;$1Sd^z$Aya*<8L6ot|rouL7xjC^{;@`;jq6#ge8p575bn36C%u(=a2j6|NlDa zyjNx*2?!iYcscRlu(P)Q2=asDaIGgRyCG3{HiRGD_>CX&gW#jqK+@Y?8s9)^p96&L zPe>*JUR+apW^8qSd@KG>fN6Yj#Bofh^!x1p56H;_K;+3O7=UUHj(?rr|9jE@{6g;E zPab^f-U$vJ?$XBHAmG|<@@gmA1M0ezYiV?p_pI-V{nU6_gJu@fK2gy@mmA4(wxmV^ z|0MiKuUGiMI^z`5go0K2+643``peADm6WGE3;h|xW!bbZbHs6G%-`@--BW+C_Vgb? z$^Ssf{%tr>!mr=&?#?MJ?DpJro#-Md{+y5i|B_G~uOzgoYkJM&d&1Z{Q^Kdojcj|V z4eHfjoq^7q);)=`gsRs}K0>FO(|*&{hQ{tw%eZD&d~elL2?L+~ZR&0cJE4H_gkG2m zl7o5--t>Zl7iIdP)GqICFac)ubZ~K?QTLke-mr5dPj^uS6g|0j3oDd=7v2= zL|`9GIWMq;XsN%(byCmy>e6eLB*USuV5EUE-7)1A`;HY}V`mB496s|!qkP`fI^cGR z9iBwVG2a-pG92?&)zgpVetF`{VXNf#KTb>GddywS&vL;Vs<%|w5_?}|{bEHjd>H+n z+d{Iht^K}6rS30jScLf`K~-u>RmOH%L2T1;cKHR4RGE^4%W;L{vUHe;*e zKK_u&`t#dD=6qpCYorPSSRB~R7GaT}rGv{q3W$ zLh2?HTrA0d!K<6^hONF1$+QUZj}}y( zsV00nTDAE;oFx(N$YxiAI=gbc#dPY&kV-r2^|q>YEld2NWcLmN1LrrJ<|-&4>lf@OA4@f*u!^;kMxubc7+1cL?>zIEtws>W^wTlxqN)CY-w%J3cF z_()p)q#WDhzM?P|OgZ{v=xQCs9Z)fBt4P@(1R zsdKw}PP+{zH&!tp+QGk3{_J(#Q-*l;`)nF^1iy{wL@4-o5f?3^6u#pvZ$qU zkc($rbMWrvhpke{)DzA- z$)D$h!_A<*3N~V%Uq@2=v*W!@Qom%bRp=jO{zPm(I|%y;Z*TNEczSH!fN=+IOQnV% z&cYV$EKrKc+$F@6f}yPCFS@Z2BWG$D*y)L+@8A6A(y4N^EaOr_eEbgzHc;1H z*4xaL?g~p<8KQPMwW1kj+sx(U<+(s_mWFor#sY2h{$LtGa0$~=Qb=TcY@~3c z{b!BSgj1XR?egj4&0|A%PVW`pbLJlJ-qrni=FEznTU;zWntE?e_x1ei-sv+JY_`vh zCVDEDH;rF5@fbEvtw%h%k0~(G+=Y~ir>vV{gN~mNyAIQ zJ8#$5RJeWrAp4wek57B?*o8O?eOhV~MJkOlO}U21!CO;bgWy$3RcmjZ1Rl%eeIjo^ zXZv0Drd$?WVtL!|T>WUF?3@Y*Hd0bz*YC=vD0IM3&?B1fN^wYD`of?5ZY?ld-k`Z# zJ$>w|d3teb>(<&oW5~hR^}5(zO|owEag4hWze+p2T}t0UvOE;(x*O8=8n|rs*t>}d z`W36sdG*AK7&hK%VZ4#6^>S=5mqk1+(U}uqwOP6##G!_{kn2RKgoxb0T zz1S|rvI)&?nt}cIQ-)Gp8ypsOsO#h@YGSpIz zpIOOATYX~ul!L>tINdG?Pfwkq#r3$$#Fj{6#=uyt_Nk0u_J?SPDRH8qVII z4DY=pDB`5f5AhN;j#VsT!4gd{+hZW%GJCI>_5;nCWy_ z2Q1cBS`E;=jS=T2e9weWGSbpCRoC91&zbn4r=92FYx+B>kyU~mRfGggR1NA)^SG=)B+)yig@cW_3PC3W^X8}~ zY1_PP_B`c|rKm9}elT|QY}({Ru{3hr6*Yk=$~A#Jte}fo$;;naAl~ySS7)L8*q=H+ zbS$PB&?_dE+%RQ|G>EHH8)Isjfks@!2hI~eWT1!}e`|D9SRSAq450P~6zGCMji%>Q z)!&>fwxFdyS>^X1xa zerf|p&X!9v?6rlCc}!K|E3AyNY0O@ZU-mb%7HBP4+7cbuOM_6JTvfpskso3we!Oy* z0$}OKFRy9-cd+vavCkG9Bc|~rQ`c!ZQIn4B$w1==rStGJdUlZSl!m*2cH)XETH5ke94%xH!uw0OU ziyaI7XW({??kj2K;#M0e%?P^-(%?jf1~K+FT?GUcgmNDZ=em=L6^muwWIFjQyD~{N zpUBjVVGO0}ijr`GQ%Pz1W>t?-9>2KFK8iSJezfkY#!U$64TaB}a2Q*KJ9olCGirZNa(6P*` zNK!|!3adgtw8EK;6o{cXeF~~#p6%_KA!A# z5?EK(=eOejV1`&W6&d<6Ftg1c-*3JSQh+T5238oX=OVEeB8dx}!M3aE2N~7qcYo$# zdmo8qQvySwA?jUBxerHiC$Z_CSV+S`F7zGZzS4^2b1z`0j@1BqLyQxaBB!Do4B zJ|j0J+axbB-9~wUFBywV80)Hs@pUwJe$T&NPZ<}ZPLX}sR^R!$>jt4B8hFD-_$Fu2ZR=a z_{ye&5Oy$)`%^bRKPRU_Kv%88s#~euw`n&WzIcEB2`+9w<$U6O5W%qzNn6UcQ^!f| z%&D#$A+4)vzqU%sCJopc zfsW4R*DuQ)Hz#X;EzQktXZRjR61S&oGa5~c6H6#CTtkTQTCbf3Be_Us`3Uw zf1^L?6oFlb&`b7j4_@L+@aDF}4DUpZMp6h!{%1MELW`eqSnp#}M&p;KeE1-%{W#H8PSKj{dIrNyfsQVBjQGx1J zH7JoA-^@DorZ)Y3#9)&5eQy`ippW}ST}CLg!+ zjD3L$3e|rtv}+_qd7!Nc%s{OIE^B_!#D>guWk8>VFxB2`*xbcg%^4cbkKESHbdMqp zWd*9aaoLmI(7x_p-Q1awSU+3JBoeJI%}`Km@8NDA$Vk)vtXL2MwM%T|`Fg-5k^Cx3 z&r0aJlV;u=*4(ypFI9&GQ|T4j4B4!mD`0hCBIwFQwf0jZQfZdE1hM#(o*)z|vEs%S zwCIJ7pF5=p)}b*SR;2v%c=a``*LN{2gr+ysW|b{SHs(bps)7ycAycp!8y4Tsju63F zAvX*n#IDSoHQ9IxRNapXu2S?}<4j#I3i<9Q$+zzuNheCBD}htn5|vF6Cfk_P>C6^v zxJyO;cH&DhWsOZm9Pz(uOQuH~Zj&aLDu1^KdcL5@U+$s|=?>itZyQvg2K$+OmP^UaQf*5huBJ_$fPYt667}~K z2dUg(#sdU8zpCIMsoE~;oVCa1-A^JR-H(Y^Lo6s?Dv>Odw(CY2IlYDbAf;bK_2H(t zrx#IZl#VOZVp%%%+%{AdK%Q8xg#i~KHP~?&)i)LE{%y3f!7nDMa>-n8CURZ+W+Reb z6a|NPb2!J5@mFBrMbrAN`c|*rs3|bRJ87+`s_DU2m=CJvqKt#(#x<;Hk&Z`Ps_pv- z)MS5uUaEBfQ#gjszOTfP{;VX|H#Tj({d|_ksG{NUM_!r^*b42I&{iT}a1ESWijPQU z!@V0sSAQ2Mb|99_RiD4BZWuXGlhiOBR5jqCh5Xhw^xK`};S`7)S+=aB%cZqamYtj4 zEvFgw9oYBj3{8Y9Ddc{ZPHNHXLG25qtpOfv(3%aZlG69PalWrDKm2D@A?(U7BJq++@-9ErV?dWW;xiQL!#v%D6FxhtOaUjuTr9NJKr2`+e318zuwS9Nz5gyd(kZdM zK0*nH$~y|ol;94`gog>JUuj*KikY-WN1gAEU?tie9I71ug7sl`Y1Z_?w)i^cDZc9L zAt>jM8uT;71xvx7;v2V-6tC<_*qnOrm=Ja@k~g-6MJ*)ommnQ$`9yFTbJQT6=<>T9 zUhplW8&!_h#8|QrpQoN#)+|P0)QCZ2Md<AatF)J#dGDH+fK+I!mK^bG+XR_ecc6}`kZ>H)~o4o>7H_cB$iJv%9Km`T*9a%H|lkKTiA)G z1h7444T><2!Qho{zh&3=12r|BeveZ#zep}lVwRuc<_9{IjmfeAvvqLC&}1Bxdiu~kvY=^E+@9rWF-|xf7Yt8s3j1ZN9RAvr4YXM7dC~~su9rKD zb?exQ;aJ^2rySukk^t-u(ahF;oCzR;N++mLfamUAuSIe($yx_PmKYJ3)E45owcl4* zW!Ahe%`&U(E`I8(U%8s|0GT+{@=)CadkwJ<1*zW>s^!I2VwNUmlTSMfR_pHo!MxQMWjHiuwrF z2v4ikpp7wzm=j|8+V3>F0#ytAnohqHLUMX3<yuV0bpA4$+K@y41J)5<*HQ5#H&PzBM7y@jCPkA^kEoKa6fIInq}II-C=k)6O#T zQP$Xr{Hv&AebKmkYXzwR`!Ikk0Be98;6l#+@@c>LDN^SYW9o}MZ`$%eP2haQFS7lS zeZpjUFtJU)!w;!B%!OxRCJH7ZfHUw74^$SH&Bur0!YYC9ClTtBN)(kA&rpGc zbbi#Y_0b3l1p}0?@6@dG*Ygs=Yo~K<~#U#7g z!P}wp5~*Vpr;CpbXZ*JJ)J?+}4>>R8_>_4uG$Z^4Yt5r{NfQA$g8HAO>`xNy=~7!L zu7*nz(|#|O#7Ta#NRgL{Yh zwHmLiAih}ZjjS~7`BMP4t?x@|`UswC`bN@M7J$5hkN{MHLX!daTk`oApsLIv%+2~X zRj$M|k#iu@-ui{1Ms8J$=YPRz_v~2Z9PuK=l@QIb56% zZ+|967e^QF4qoyKNDFCt4qp0Q1!i;Z^8{;S7cQVgTbYCRSBuozUd3BM^ zqp1?)$Ju@LzlCSN(6?dkrvdAzrIeaLMi}KZrU>Uk=!TU7&N0N z)!J$yj=5OOsW*!Zxw_qB#Ri)M?0QQdp;&1xE~Ra#BpDAPfXjpPix1)c*bIob7p9oV zL~K8LMK~&tL%w$KPL4FnhPa-0dq+7l56;pefu~lejC^Ve>*-t-+baZRa7jPc%JK;2 zrJ8gNYg+J9GiU#&JAbRfH(yyM`adMc6M2Om7hm&*s7rI3(D8md0}!fWM%Hmc+j$Hr zNnXGsWB&c{7a^a&oc9;jaCgw+T8Yx6fj*d&Ij1nyiv?NK39leLlT_bO@FWvZs@M7Q z@fX&YzW<;nmyS{uBRP*a{b6%;5%V3tM6|i5b9MR}`}U>Ce3Eu7!#stzuT)8tM}{jg zzqh2e4z&hQiy&bZvGnE_4828ME~d)lQaJKw**6pS-wA$2thV4?9wa<;8oO*oSm~*P zgcbMS$1J>HMatJ9l+8ok$&by^^;(O$45fsh3JzB%x>` z+b0cg7Z7#j5mFj`XP`P1_`&^_@Tf`bN40OsSKwAXdSqfn*b<`aU2}0`#j9}LI3yau z{X%p#F)U4apKL8ns}9^D*<)2`DwZ|k`B5rIrz$zU5b2Z;ky|cxI_~S&s;(0-171}O z0(Y;dH_z?#F07qlp12VPh*REdmXaPqZW58Xk*cJ8axR}kASFvmz&9Gw7`lL18ez#+ zLN7c1v1}MxSNCX1TK&eAF&)?cU1#1WD^D497Yp=~BgQ$h{;i-lsLerA0ZC{0*#+Ot zG8Ehu@o=4u1}J2Ul#Cd#=*vnat-gFyL007E=ZwdG51y`96pNe}hsid;DV3s|g#vTX z7W%%^wtmOlA}81{C4t3O7`g%=K++;WcMl|kup&hLmK;)X{#(H_psp=qp|7GR1;Ij) zSX)LE|3Ih5=lpJ!O0mlLZKqj-w8=Y5(%~U4LdtoE%p9-dCGJ&Jegfg{ciw#!oMYT$ z_{(itIYnw>e1g4r50_S{0G*&R$0-%RZ)a+otc?G#$NB?m zQozsU4}Lry>h(RIod>BxC7C8^r*cHb?b?n`s^PW??murgoqOK>%*Y_QyLPjSP@=B& zYQd-F8==@_KV~LJXFxdod_8gc0P%$041@5$`U*u*725!ts>m+K5LbbbiK}A5U4Tp` zlZX!{SJ3+D8#%>IIa=~Rc}LmkxrK5Rq7GTGu=l-tg(+F-*&@L3k!3>#bs@nE@!xV< z%>81lZ#X1o@-eSQ2jmni@x*3QxqClINrK(LqfH;5^HwIZ{FR~^^!ddC3<~30i^Zt- zllC`C9!e~avT{N6kS7Bt3m{2dnl#u@TkySedJs z9eK8>9Y?qA;b{T2aaIPKoUb|OakHph4{w&IQHR|H*#p)XG2~k}e+lb8CwWb&Si6kN z>2Mb4v<$@`YF>NkVh0y&N&HrM#F5A%eNpx~!fDPnO)=9(QyGto)K z%R416&!?;TmoBZdG79gf;}?1mLh9lCJL!0kkb2`Z!tyEdJd_ALpTYimV$Y-y+FS1Z zf2#IqZ#y4Xw$34mt8^4^ixCNS+@~iEZa;6{y)kHzyT-^GwSLX1!?JENze3RMqX^0k z@YetIY2x&$ulp&hLj7ftn*SUzh2}Q{j>)$11&l41z3;%?ng=l zo)7Gv&WTcheOfhWv$;*#4skDj;JdPux3_wn{JusTYO@B68fflUj4$BsmkSBMO=@4^ zBLB&ucg=+Y^SS;{$Gb}w-r&_8<=c9FeI4Ulm&1DS=qZmR_~OG$9b6t<)pfMjtsRL1 z+QRa3yWi>jjKu8$$+_jy+VW$@$?t9-rYH*3{6~u)Aeq zHjApg$*-hw*~H2O%7PTbwpkk$+pgW`HH@-M00@pOm`72djF)+NOQzz!+uZ0atBas>2{e5DkU>9Szjp% zZ(?!J?(@?nO={#D4GersnYTtwn&AIz#rXV5xgpy!`=2HHe&h`r4Z=GaW7DX3^>7>i zQ-mNwuTX&EGYE%}hZxHMjY{bafSbVkae0k6`S(w!K1arEd^)41wb)eR?{TW73ScN_ zcK6Kz#6y^R^Iy>WBsrTg69O%cTKypIHS6I>G)Q6(A>qF`0hbnpP4YcPwbb9G=S>|F zHpJ<|Ar)dK(Mn<1D}OShKR^VZS97Vek!S|@d~w2XkpCTF&MWBYRo1sMj8**IA(Xc| zliz^3<$q;RJ7FHAqE?I0=vf8t-&-F|oa;3FJskwyS+7DO$hUrVKzn6}$=10HGRal}9Hy1ZGB4ZY>$ASIp?|s6uva+N!h6MZyP@$BzDpiP6 zK@t`lw}(`JzVIRS+HZm3o6+e}86okydcO#PU-?5^b6q$G3JnPNHppKaQN#I3S*e@C zupSi%q>846Dhur6Gh$~;!!mh2n0>9ojLJ$B{IypSWi;}L`wf{JYWPCq8C+t$dJLK6 zGE8#3klonEm!zA?Y)sGqe1XJF&Jf9>dj22&Zli>jTOTNvJJ$}y2cW~c^3MzUx8JS5 zz0=LEB&Ps3i66<$?pL(FtYzEvs}y)g3yy=gw70qNpk~&&uqXET(=n?R9glcl+bwq`h?dRBLDG=K;UB;r6UiRj;PTHp!o*gP}8L0fTX zh0Q|8y58%jKtFzM@G=QFw+MS#jD;MB5JrR6tYf9Zr7;32cna#kFo#w%J(O-ZWAI90 zR_|WiGZ6UJCqgRX?oT26ST9>|WA-gh7f?^tuo0%p9LXrT)wYOnTQ#mY**aM86?tON zT6*&MN;gp@<-j!U!|+>KD_KNJ1%7m?#DcHeZ^ia3)Q$N}7^RJ9rcu?J;KR`mLa=f_ zNsc&3wATSLCKt^OSD2R(`A8R#xnzZDDKLEe+0d^6hz`)LRND%xkrb_$cZXjp%v-=^ zZy@JHL{dPcv+jyG5i7YNOA`GeUn(Ff#WF}dZpQT@q3vY=b@rVW8Tt{_Z2YV^(6dICbq<~|6n1bX_5Ht-{gV5|-iH+O>H=$&8{dZUas zH=KDq-44@61NxN!!Yw2{sgm3@GDcnLW?HMtRo>54ulB8A zks5y_%M+GYsNF8?nYU2wrDgltU|9hsic#3rBbRDDO%#0{4LDY~7aJbSjhbQ5ctop* z2MjHBPeb43zZ!S#>i6n*{?Z0ySC~)iuaKf4(qo+=9*JXh`Urlzi+cl}MUe|3rVg`U zuaYZ`jG1C+EWeO!GI)o1kw~UTU2OGf;$@Wb*9v51%|>EByz+x(1Xc_&?7kX(?f1+) z`5kfmsvsmy;XmplvSq>|wz#oYn zTaA}bk>5lSm%zlu-jU?-`SS$a_%96M7ndb(xev+iod+ZQ03J+|*!n8vmU5me(||${ zvtRC08J4CR+GAZ+l($s`Q-_7+2A2Hd`3!vWs2V3{gI}ictY4-0dQQ*|1 z7G&sYDDH>j)ahSw+QK*90y-(*SIK^D$LaD?^y(RG_wsUMOjPg^v@nib8utVo32-@( z-(-*SdfzEPYYq59tdO)_$1wwIv!Ub(l`c-Wbw|33?anYMDQxcOb0e*}kN302DN&OD zHwsMZ@2Hxc4xd^oCbFMypu8OCaIMRj+A3NrfFX;;E7@j-?*Z6fWf(%X+k3oCoyOX+ z=U;*{VM{~NN@I|ei+{f>E}!dUDs!wDfxZ9O6n2fYY4H6P`S)SKuGyDtW38b@SfM zzoZb?4njhd+(bfU-4T{nr;roGFG)<$nB4G*Y93adUDOmJ!11v^>Y2BY+OQUMDxbp+ zpj&KboX7e6@zce5N1Nak1SxS+s~S6M>b0e*}U=AaS}!+AKiauO91Vh5f*K4t^OlB3s2!XKgE{6}%X0yHwn%!86Y2PE%Buymw*6$WxpJ*F% z_{2mdXC`+^SFv!oq++k|>9gSL<@TjAXnNEGcj7)fzQfq@0@zm47Fx?@MmoRGLkuij zTYF;>B3e&u@9MlcFxc*#DW82jmFl)rR)>juZx$yk9NE?~j4`KTy43kLo7p(z!zs$4 zh~ZzmY0N^QyiO#BpjPn$JSTly_9AbFy60a{f^3Q1i?2bpQYSDV>6BZ}ab3KyRA76* zbu9CkgY;QLwBG{^%@E8kP?}4+y>=@_bjO>gxqz~@~=vSf>%j*XZT*M zEqC-AhZIWkbY=U5Tc1J3}h zmc&j`H7WSpi*MbK65}NPEP!_WvP0|iw-jB3T0;}Zb*Aq9AcvIX#{QiJ-OnUT48^4R zX^F&p4ojQhZ=#>XS``E)DYTd(YVglZcVl?t=-Q(XIUuBaxee?gQihv@HbE$!!Xzp~ zF549Y#Ela&=JiU9#<^w@WQVW@rsOwyN`>dw!dAtP)OrGbq;~8eW_C2TI>%00l*^)w z8ng(_5kRY(~t1pJ5oNtco%JJD~0|uLJ}QF%u`m z3ZM_6j&(=t#=fMxTeeS%?=u`oR%U&R$V^c!9m9Gf+okfUoeuHm(}O*$Fw{d11tioc zNR13@pKKs2P_p7F`tKAeSz>)D6eWz`Q>J8lWcrao@nrX@m1vUCv<~%;7`*{=3GQ+y zP%06>1vkj_mzs*#+jhs)ew@Xntkg7#T3EJvAdpbahIbh))g$-_I|wnG{d{Mwhfw!d!chYwMY`8pmQuG%B#5KYkl60Xg+@owW^R~py_x!&rOCkwh|IX zq<<~XAVnT=aef6ozdlsNGI847%I{LZ1tJP1( zcihx1)sw+p^hYDln%IsSsaS-A)!DKMTRU_ERBP#K`kh{d#Tw)SSg91-T30bCX40Rp z>f&X{%Nk1`q_|M5^$HnJvYZrUQPl-(GygbXE?R9^L+QOU#x8OEvsqL@zUXPSk_N5% zYXYilwbWZ*eNo%oF}%FJow5amN#6WI49Q}ZQa)1ls@3dbwGxXE3i8G-;a9rA2rWE_ zb$PNC5fZjVG8)k{M7w6i3$nd89(guJ{6vZ;a&7C(NuNOw za!%s?48}fGr=jXsC&;&81feY7da`$^G5KKQK-u^$9feLqH(o}nAlg1k z#S+HgF7=WR;F{o&Zz+8?j zUWXvA^?aY?RF6PioL%vg%#Uin4|DFU#h*oRGN%6lz=NUzZ-YIX$?`PQI8Ud{><6Lp zcZrrYB|&wL8H?t#FXH!T_i7uZf%AG+LO%(UGG?qaiSp7(05GUc?(BgVXpwmJJxKH2 zC?M%PKaX4U-f_C60|IJYR62Wdy3UIPIxdyhp4Xn{{7xBt&eop0{Z9Hh)*g!VALsW_ z1#GAKs?2ZcXU8^P8t@nVZc^be(PpBk#ca()`(+Ndv`}&m^fZ6k^^}da`dqg5 zlqB<0;32@R^XU2X6_1;(mXitb+8SVk)549=GZ}yjFxaoft@RoL_zM9U0spp`=ows{ zxXpCq>U(d#CJf|50hS?DqlZtu9^-tPUmhR8b_ISEb^9YfE<1eecZ3$QNwOd}9midr zU#KK7K006WnmSxkJ>wO1P$Xh1(?oVU?pz(rUVx?T7RC}hb-XletNKR zd6Ft7i<)4SZx4PW*5Q)PvtWYTW+aJy>LmBTqnyg-RiXW@*q@He^G_`1@{iJ-#1a?y>UxS*zNvQ(|xhreXTw0cW%DseKam`8(>b) zov-H~S{=yZt7VhT&*%#0kJA1JQV+PHVcSp@>xjB)@h8F1jusd zOBR)ON-b_*cAgxgywWtK^Smw+p%)WTg}eqhyA;G&uYHgTlnIN$?yP1!PxZ)(N&aR; zb$y6cdh4rEb{*FhVSlbj`GW5bp1m0V9HDpl`JKYqe(ttEw!A^=R6q zHR0UWJHO*LfKglNp)M`uhSoDMG^La`H-KV{o2=v`RmMYuACY5n$HTaH6J0=Q1C)jjR4u#4ugZ^$ zAUb$W9Gf|`)2dA<4T4JRc@12~S|5!;=)dow7;E2G{`{k45zb$LuhE?#g&VOj6AH!bBZTQhDxT61nkVFfuxpiWyFK_sM(Dw?=8VvACe7~~ zRt4ifTC~>%0OBE*)HAtA%$RHUCL`eMlhh6k%hPtNDHL4K1>OlB)IHGWYpxA=Q_Q>M zt$trE8UuBnXTZKF>zhvhld&eWCLD(F*|QYii|tmKFhWia?himCeM*$Vg{fAbrR?OW z%CIz}3ncJ72DQYVg;#{E>+TtbZQ=G~vK%n1z)6XYS!2{a2kayyrWb?K;%Px`hSdPa z5_klZ#;@aE$Ca*hCTeS|a)-iSM!vp$cDhoh{5YTMKq(R>o{UTrtHjg6ry|xgWMv{1 zlBO|~XTW0b9>E-~39p>&nxmw;Jyw)70e`@mW@u@c^fo#5C83_jgpcsU_UO7Y>JMB8 zLpi-A0k_0&X>#?vw?vtW*=*?{3uNZ4$_Qo!gV&!)jy-!kgPMAf-X`M$j?g-Kko<80 z*0BGNf3f5E7KvKkb=V%Q0LVB0bOiu%Y0rQFWFmJcKqxB2M@6VFfoRp4^UYAI+0*p= zUZD9ecb^J7o7Gw8kenz9QKP5J*+`qDyNo>|8m;SQcbvBxMYuxUx-H zvY#FRFwvXCq;q^rqU1F}VF&5_nZ5qU?f*NV+y(Fy=4&*2z7aVfIO1n3C8J=ufktB zHgh44vCKTGhKsjg@%scbnzG?SUgA?pSDW~6nMLX3rfP=ta*~Q|s#3FD(~i+-k`bh> zC*}1SlZ{vi!vvqCS~Y{9T|3I)C~`AkzWfqYvR4)5sh{i5tGE2dm|IuFDW{jQkSFp)U z3XOY!f6u14OA%9RQ2rA)i>6v^HFKAdde$coSlf;Dwf-btgc^TEfQ9xDtyX z!ZTZH;ZrkM{2DBF{e%-o2Sw-Y$Xkj)Hq~A2IHE7l_~vb*`oebaPe!hv+&#L*fBiOQ z;M3bs-~DK@#XsC8lZ4C3gKxPGxxG^`Wg#z&#n~>QNNpkU&CC2}c5W%Acg`hUMfwxs z(HEWLaC9jGiskYCFti-66D|~i%kM1slWn?$vep4vSu47&ag;=oj}Er99Gf53oxeLs zI+-H6ZHKZKoe2v89jO`dXC1_Z>sa#r_lGEuk2pitMH3ys4_!}%EZ-h48PrazB81Gm z4O&4H;U6keMH5HsJU`WwieGr^*3E20*{7KjmhWK$>l(G(s~0r-;$atgb0vS!5{eaN z)i#V5l5G8R zJY#Kqu1h;7oQpUU7@$F)*J#O914D4jHLq(g{#U;6f0SeMdr!ly%q!r?0Lo&8Ay%(L zP-kpH)&+eT9`scP%sSwk_txTj^?i6-vVu#S^-bts{kbp#*c0FwbNLR!C&Z3Ql3xhj zCFB}3OI$tV<+7F6RCyjMwkEn|( zd2l)>zO!yzrMT&?;agwfr{$npf6}bDDM5)5BL+!c! z*q@^Q(+>4tCO&vV`G`{Ule!x^8?thXM5RvQB@Rk>5;uruPborfDT$do3%w@dzj8UL z=19zPB84~Ig~#)SI){<~BH_45{c4o_vC9Mt6uk|kptU+G)VVBKC;UonJ{lsFc63sd ze`-%8pnb!@O?kD0p2t^MDAx9_u5tWh7t@CnoUcc+&I}e*$!Th*$gEYco12;^a_7t` zIG3X7qaHFdJYrL+r>8OEH>6p-58@Vd^vWM1(<(6}D>e-RFh?*4$O_KhGO~z$R1%LK z2o2#VNk)(wv%Hrd3ChK88JSDw8g zlxn(~4f+VSOhe*J-*R=;s1DZnV2&^nhd_hFYKwms98y9XYD%#Hh}TFRZ*{)5+(d|L zn=TmMAm&BC_>rTJsvRLYq#UbQ^8WiJw#Q4$NAp7)I3rsuSyQ~hVEp)p9Mu0bHf& zgu$t&C#ckgwXuSMZC!9GLQEi|oDlD(PvVH67G7_$_?PnE;*tvUx~qb!i^dmD0jfiAVE;2xWrJK>=&wumoC(NAGPvE{XG}jI_?DiH{301)}tA;Eg2{0PYc%q<+;4(E`l%ZlZaHoQ$N@Ih2>>tyiE23;mQle0HS zKU*3pBSVLn4M`rasMJ7tYNfPao&)xN1rCi3_uQf9j&42FD}a>?w{Fp_*Lk!^jCvyG z$E-0mp*y;IsPKi@Y|4^O@DBH1`80Y3FnPL|j3o{7mfr^$A;EK@D24(X`5Y2DgYqxC zKdUOwPW%6&j#bT(&E%8W;2T>Gbyt;;DY}TF7AM!H)82qJp{0R$6A-`{qebF}goz-^Te?JbmJ zUrSXvBDCRRnS3Q-CJ7ud?z2MN$$VcPVoRf~j6xA)L^fvnm5-ql;cvX{bqR2_7oU`V z3&<0x!67;zh-^uLHToOlS3v%wX4YDR zi)iw9$r}rx^QoZECWFiPo?P$Z*TDYZfxpvnK5jhqQ!)?XyrKs+Z=};6(Du3&7eAL9 z;eLb53qgV;g^W|vQ%%BVGQQZ~iz#6$%$~KtBFCPDsKMNETao16{fl>W=|glpZMw~1 zaV{F^;3js};Drr&3j<*3Kaq%Zh8+!qXu6)ZAgjedBsP%s`%{t!g$JF~_9&jO!F&y@ z#t;&3$A?_#6d>zYbG$MiAvR;ziSaXb52&0hA8z0^B-8 zW{}*&|9^_5o&iUs5*4ODK6nP)iD2D#X6P>42{GP{^95qiD@J$Rm&~MSb)xh_NquZJ zP^C&95K@h2@VGdNi&PifiirzNnE{_JZVtqLVv}hF=`vk8+|FB`NQ6jUxPtFuJeTeUQ}GlyRN-psWB5 z$VAzMr7cpRh4t3FLCPsGgm}@JG1n){KIltL;-Oj&?&?b3OJ*l$bio~-mxo(!N47sO zwc~-XZm|$hl92EQB{Fz89*yv&h6>VvYz_pcOEG-Ew4_$A|7*T8#WTrM1hG0Vf z2HPTDS#r)uFW57{BDKlFqyp9fF=y1_T(w=JgNQSQmCF7rC8-b%$Ol=|JVxe zspi4d_UBIFTNdrdS;jBG?%cHy-*gJ4T#a@s-cNl8iU@o<1?rDsUr-1-bh7 zRx+}j!ab^BBp#7TE)`a0^cwv97p=t&@VCH<-AdDzbPbBYfx02Zjm%u0zq2Wh(kW%$ zjX}|cj5c_9Dpy{0imc&bd7D#Gk|HBhdZn;}Ru$=!V|eAF`m$IYx`FA?5I!SF_;3%f%>}pluZ^j`$A`{q zFRA+EXqjdYox3aZjW!w2`R?F*eT8$z^7wi`4{Usx zBkH5X%F@DVQz=%|x<|B491lpAPDEuHn^99gsH5;+_dL^yE_YmzMna+>aw44hm7;gU z60|`hHY4;=;>kF&cqzV0t)5ZfVBnN3tuA{C(9y$Q+sG1F*)7-q9kJa&#JOh#qXgw& zp8kgXe>zP%i<8O>bIUr`HvLD#m%xnyRp=B62bYTRYldHSJ)!^V0$>i4OY|>^GvNP! zQH+ta+sWAVj;!w@&UJ{Vy`AT2oMp~L@!nzG*{RM%`ZH^K8REX(foB+!JnSsJA=(X5 zGy!S}Fs-}D0BkyMm3`MvM6Q-ab)Zm7vtk{0>~;C?e3J1C$nIITJf(kFL4_zk4)=+^ zi+RD#>Y)8)!)O&n97+BZBbmsyXj~0L%aQ$*ST!~9quem-p!0o#Nlp}2Pi$Z=`IMTo zW@!f7R`f18H%-JTtfcUqB?Aj))Zkd2CtIt#p=`cpdZslMVJ-`?({}JQd2~{9O7OR8 zVT^wvaJxhOYA*a$&zjK1St(_b_Mqm8-+W>3z$&bLd-b`8?}h;LVu^ycnRb+G9VA{F z`&5UEQ=ZVW2BsdTzcL2_1y3C`@PTS z7k`~IbI#fMU9s0*Yi$}WRIj&ww_-A8h;I z6CtMuqr+IKdeED;F$@!AWdQ{||hsot`yAaav6 zgTUsmf2JL3XEJDz5mAwWkTW zx3hG<4>+w|F6u^0Nk-4&vv<&E+i|evV!05lFKqD{Zg`{>hMM8L+wPy5HK$2LM@muL5N95`$6>6Pdbl!=N&h$9!_tEh7E9Eg zSjXeFxc5*=^^E4YUfD0dv!+0*B(7N9vb@^ShQRXSa2W6piDyBy8=6r&KEf~4XCI8s`r zzAxKW*amM_76eO_t1N0~`*vwYBRC@zeeGQVC+R$LqQC)ORQaH)|7c+aD_Dx`Q!SZ~ z)w>i8He0y`W}0^E#^h=@h0+Hd9by;`A3jGLgY-c8)GE%Nm*2V}Cp~4B2oiB;d0)k6 zM_w`afNDXS5{qEM0AmuMZ~rtI?tt~6x2J3#hk-a0LT;yH8u~74Q8C{)Vn|c6iSF|w zh;xfVv^8GKBEf`G4CTENFK#x3;nS9dLkIgOYDl2Qazr9fV~QsPWH6|z+i00Ae6xsp zE_7l~QTt&f2D-a0VRPHw)S>S@zYGGskyu9*x?-AWxK7-^VQaYU5Qlg5gy;+3EjRGp zCHgMhOm@6C+ev>jz!)jEGzAVsrd(qy;;gJgon&^txOloixVf$j3W|?@BAoKFO4aaUte$txqP>q9(UNSD$Z3x>gHQdR-r|jXr@E&{kz`olS8GNMS>g&G8?uPIQRiKHL zNOkI|q{*p-z?cxm$nMAst0|(vd}*q}z?{)1X+PHLbN9HdDT+N4Go@p;x-wyMB>i{bv zENiFu^nz!vZlALzU7p``_cXX)4BL>`JDg`;Ctm^6!5qg>2@1Pl3HyPVP$CAH z$AyJ>tZA2)gm&r3$V^K73@B8T*4b;~jp$LFG3mYVXX)j1gC1OS?sm{%tVQ96zw~b( zIm`{U%C$sFkudp)FoY_1f*1?A@DFjnJjm;q5I%0WUG&v+9r(nW=l}Rojcc{jS4)24ArI-;$=HQ z!PQD&Z69I#lyQ)><4(NKp;jAndWZ#N-(1&kILvV9RWT>Ij>szHv`sI3$hL6aB`g3R zcwY;@6+Ujl@o0R~_-eQc2NeHm9msR^5{VVq)kXRjKo@@?fG|lbK_CPmbI$jE&F)notyZk9_O*VoH0)R|u5~h9}gEDJ6J2X=--Kpz=gDk*vaQ>ckM# zBf}+#MEFT1F{l(@STMD_^l=#1)-{5Ag9zUDq0Qa)J%=9ALyuM}pu3M2E&>Pc+K-*~ z=Wkc(g)a|7pf?)OQwb9xrJ)UPeK>Y6W6mSJ5i0dyMTxDQB587aiF% zChF*33%suwQ#mypsRpbfANwdT@nV-8V-ozxl^hV7<-*nQ{g#!!zg^vqvj(#onB?19 zirXPT58fo-mbS1RhkR+ci2rM^`s!+=;bLUMWWm>S z9jaG8%RbEq>VZwhFRWwVKet7A_RiW!B9Y6(%%9AQ2+zJdn8WCWAKG({t7kG&h?y6Wvb&E&YSBbTt7e1 zg(czckkyKtB0ni=O0I!@r^(utINK{aN+Pyt1S)C-!?rqg8!-$U9&GI)0$EtH(@%g< zp+mp#Iq-{%9}^VhBSjt;d=g=+KPI$R?q1gOu^M6@cn=^bhwV~J-$m-etfelt>Oxw; zFcwoRoknh6jlmIwccer`4^D!X+a?w)&Oo*Z227gqY9j63x*|lt(4**pzF}9wV(*y* z@Qlx_=m)*J&{DtlTL7wyh#+Dv+y5i;DsKaKZr?UT>ZAK==1*BY{E%UCjjq-P{5r5Y z6)X820)r8N8IEHC+xWkLXka+C@DVjz?LqTI!=2-_@?^$#a6OUY(D_Z5%-#FpT#*F= z#zOX9r&DhIn|Y;Z71+ly@Fu_5cSKfD{v%-Ld^DYt=wLaJ&Eg78iYwqtFl*^bJTHN; z{jZ+V_j(LCsj=&m@7Y#A+0qsumPIb(8<|tG5k==8&m9aKMqCql%H!yOG@k?8^w|=| ziFbwY(}sdA>V>=Ag#slF`Q&ljG*-&`ie&g^Su9GF@H2%4B7?r;vK9-x^@+Qy3A>*7 z%Q3sG5isd-Mt^sBqH*6N9$MPMoq*eeFU!O-9iP=elZg42U+A-}Oy!A0-aKkCEE@?O zTWWnlq?j0BoEOK+J8&=$o}|R@d_SrMT|{iGP8C$?Xh;huCg{=uv0OJ?_Sxj3e{SA; z1=EG~mQQ`Uj(||U;Y=z#IQP)hQs{)RicIW2A5b~^6@S^siJI1b_1DPm#(r3Jaztpw zV?)h#0*q%sxrVx>;)1!q5Tl#rw06Ef^p!*X*Z8R~BbH-Tf{NY)jsi*{pCOwF|KI({ zt%k|DDci0ASaxiwHVJlBT}M2TYEp1perWS)X2wir=@*W7PsYOKmWl{({2@Qw1qK0a ze{t+1JpnEk)xuJj7g>$v`+yh@a1SuEtZP&b^5B#q_n0!F^&_gXC zXw!p(UE=mE`79pwU!BNJLUTKgU${Bd2WIz51I}m-QNZ9Mq8va}f$4&TH`#Eo?RHFr zcAw(_h@S&IA=1gCsz8V_NT#5Fm7mKB>IMA^DNW#${~vyonHF5iv{wApaI=AoFbXB9 zpa3IQk!1W6RS(J=k@`!uSI`&C_(Bf`uTqxU|IknqWU~Ji5&NOn+t#fS4WqK-cb_+G z!V{9wp75gcX5e5C*So1JCgY|64F>hJ-cP}3J}YGbs*(3dX%~#4Aq~#L=_X1)- z4>5lG7ff8A4Bp9!lJ0Zut;8jNsgS>3Ms#2S1gbETsN(_T6rk!L{7cob@`nu0;FLdOQ)$=K#ZS?8PRgi-RxNVU(^>p6u6fG)I=}Wwl^Ktyua-wH>Qz4Bka2m&RZE7qt=NZE&W?$u1m)1zDkm^URL1}d_jtl|4Jj9 znRgaF#5*p;a2F=cQo@%*KJ8D^mM^+*l?Mq8i5tY1>v#zrNY)?{F(f$xw5FwGj?%Xm zEbkl;%4E9BXdNb?*RNWc6<7_185i+_;V<{=wPX}2pvATy7fj3N>T{oKVs zUwJ>BhnlNZXWS$}f;l#~JL=`5x{|RE#5y2fN6W#I*Xpbp%vV+tI1&&B^~}|`o*fNn zY{fw@bp%j#L>e|PG*me$iHc;yA)z@@DP3|k^=Z^vpUQtFM1BwpRqO~7Lw_9@jUqtI zl`3r}Q_Ai$=^jczO1X??HX4CDr_7AY`4*Z=i>{r`LeDq(G$Wj&r%M4)(N zoklU@I0z^n0^9(+CLZzs*>xM;gRGJU;H<7<)WT_al`tO=Akzqi@6dnW@__%Fs|Y}1 za!sz*0AKm%g5WQe|GyEgbXA~R%89;XweOV43y6=r-H(~wo(!2?Q9dDlVc1x+Z@;a< zb@@_d!>0TBg*eVhybh3TGf3dcgaZsIl6x_MkAoVC85vH8f;z$50|GM}S0j&{?iBSns%-jK%JV*%tvmXAn z_Gw{VOf-lX`l2d}eD4(WY#s4yQ+pa#P6~r3DyzW*vzLr!(uO3i zsMQng&RivmsO{-w5L)byAS?+iGZBJAzY8L$ua9re3SgWiwKA7wwO zSw`YEWnq7$ZG7jC7#SDI&5u{i{Q>#yF9U(-QFRo&FQyTmC3XJ3)Z{p%AHL2n59;)N`mTO}wFCwG9lVdQJKNUw- z$#K2|WrB1R=eZpQ&m!eToWTdwIRMss1*2aE{ja!q=qRb}fj!uAJsFBY%03TZHG@HdNy;hgePgTCl&|U2hg@93Zx1bJjJJ>{Fo;C z8AC*=xHrPy6b6jLZWV_z0Hl6MVF^n##hVc`bJ(P&SZd*kp*H^P&rhAe4-nbw7Si(-w z5*_Ss_0q22FRJZBYZwJmapO=Lzc<9h_RZiIRW}vJV$09-Vdic>V%xy%Tm{1ky{sZA zcn^_&s)1V4W!ya5bKgJCZjA+oP@-F)#`H?toFI}dgb zrnBQZSjE@CT*pZt$OTk|5|T#i?2Jr%He>i`J&TM$>IgB8$Mzh-HYWh05Ket#NQ=l- z^uSj5O%Jh%tR(>*${A$|5eSg@oP|tY2@_5EZz&HW4$nEu9$}*C?O?m+B2kg6`WoU6N%aj;eqRH=)y-?y7z(1?uR;|g@?}}wy5yT` z>leZAuKYa^+yi(8SRQzc>1W#Sam09dEbV_AT9jp7+-nn@vUBD;W1Yw9l1U&-EE){e zjDieGXtm+m?x)K43MbGsBe~r>`lS}9;JIW3Gasb4a`@kS`uQQX%leNPVqtrCn5=p7 zehr0L;2k!7%Xko;{nhF+b{UB^p3sZJjpoAek+=ld=I3ZxdZt2^j5u=MSduZ}MQjrg z@$Et`m2?x~HZsytFu8TWTfEv|NPK{UW*NpsIY1<3&cK_=&DO&6f{l+WJYera5^o*A zvCsD(ElL^LUwc;(lXempQ+pE@clwnV)4Z)hd!pN)NzBzr9*62d`e84VtvNx&#Z0&GEOpnknbFA6EtsUe4FEm-Zjn z@0#UyVj(G^*!%27v}b#-r;{FZ6g%-`(nfjaBX&Ys4;Auz!JTH24bx=r;Mfpkj18P6 zX=W$suW}(j+r4jKKhDH#SWqVAIXed@{YvXlTIbkjQ|C&1nTHsLh}eQ6G%>pqzmTJT zJ0WJD4ZSJ%X6b&x(TTzsi z0&>7-4y-1rL>Aix-Z^9d$z9`P^mx{AGn2Q>T#2;Jo54d zz4|6%IUX5D{O9QL;8o*i5fD%vBGDj)!+2duF_&OYnJvP-4KDvdC2Xv;pOrGHtiyiD zgCtn|SR1SGHjdEA%z85RvZ?ZoxQ+}<^vpA|9>-EvdQQOt(yWgN2DoPLn6a%TjTwm+ zH~YY&1ppl^6ArsRYMxglHtR1q{M)sz*?|>g_4HnXNyph|*L2rrXr%7Go7KQvP>{8Y1-hm@7uxZ2Lp;mqG?`n@gMn>nb>#DZ|t*~4t= zjWVy4BtaO{frZL5Y2U>Ps!)uVhAe(Wx!7;)JMx~B(nO=@ysFxI${a`z`%88P*dxpa z8<};1Y%3yj7T!$Ilb!SJb`M-j(g)Gb1&~z{#02q|%B$q8Z>RM-_ZIhrAigb*3h)WQ z-fxdL-D8c*vQtc0UE$1qPsS{R6UWP)( zpcE&?Tw>m7OyoqvOT{RME{ELDKLLi>nl;KKyTvz2Ls(XxTuzM3qEIWZPMsK4_H5&W zqkIx8t+PpY-K}@twkOj_4QM-NHr3c!1ukqaUO#ZC$zNr48c3GU%oq9j{PH375pO8O zX|AH!tLfZ+@Fg~e#%J;=SwNX8X6QKFTvd(;68)5~ z#vg4(FA&UB?CKuq`$YdH9O66wd9OsQ(~m9OXZAaTc=yxJ6(6TBnQvbWqe#KdwW@9s z3JorQwFykeydA;yp&|$>#r;&`d{jEjJnWW9zDkHm5lTvno|BtJgG0_TDn6y^Trjm3 zKL&L&u|r6Q@G&!_w8XcZ&<6{VldC?(b0xbq!--LsW#pL!9r^0MJ=uUOagqnO8e=&@b2{+7vkk@6TKFCYx5Od%%tLPpJaEaBD+ueYA& z@+p7mjoF6zXz4fvM`QX2}>sTXi9t6g`wwgO5oRA?%ZJX-W-ix}vXi z$J^E*9cKLkr-~^qmS9Pl<o#XF(3y>B;+>C;tRiNsa&i{xrDRG;Zg!_Pi?Afh6=gYW96H<^em z>;WEzjAc|&mvQ0!(Jsms#=$y`&EIZ`&3_cDpCS>lqXCn^MSJj@5Hn{Z?SAELcA5I5 z+45a9N6$%w(uS~px%}ydCrMv?$)^?dePE7kh$f41AYWD~3B7X-HvgMxNz17GdQlj3 zmS&5R0Dkj&o4e?6ay7kJmnJ=Iqrfc3?!(et8ENvzC?Pc$?ae#^8NjN4zhEe4aH-}e zR@sOSJf4+nG27U1I~6M3QTHBBJ@(afc>@6d?8d8@naE1Alfb!4!{J153NIyFHdb0v ztWJ`gH8tY%bQsGg|1hKiqkO6^_EG z*nY51#~UxZGQ0^2Knbq~{Tg2deKc>`KAx;7u{MsWSlX*terKMdY#Lp~^&nEJfba8} z$=E7;RBKcdTGcnsRKn4E=6+hnXnF$Kh=cOn$N6FIckjO0#vNs#rd_jyRCFQmI^r1) zE7ULqPI*GUL4LHJN&t9Zh4F=cOrNaCwj2)1s8g(Xtn~0#p*oFn`Wos-yhZYy237QD z@lQ=r7_fS*G(Me$nc2VSP5AI$72MA3=T4vuD=!w{)A5=`LHBvBwR@mmW>p3miSq5o zmy8#4kMTX^;qB0@d;4lY&PXF-!+_Xft?if7j`iwn-M3_F@0&BZPM3|{Kks`%Rn3fJKMJWQswqz=U zw@VC10Df~!Iw-9Jy;poei?KuC&L=Qob5vt$dbp<0K%1xr#WqbFd%Im5F(;udbAEd z0&b?h>C-qF9Zn%z_JVb`P@5G57w5OstGbN+c$RLmvTvZiQn#w0E4uqOB ze>iMKw*wKGx7dx3W|#eNw^S?#yx-(|{SrEt>*b{N8le!`-@U7aOp>T2ivf>Kqah+kXD>}BKDukc-ug`DMT)fJf7%~!C~X21w#nK!{Q>VulmGX&B-e(C6@ z0z$a5#b-AI%1HwRE~ihCKjBp=Be}J)70UkTvSkRvW_O2ugP-&Tv5Ewkdg)Z$7%x3M zV-O7p=XhFtwWTz@5K+wF6+3hct-)xFdkl@{>B8-#mwLUBnF*5l#iyLR$hJ4EEaDyb z`tSDoy(ws8Ps3VK?*0j0gv|0Pv#YMpB=@xy#S77q_<-8)#2=} zfl22tXe?^euU-vR<_=M6w;xw6u_oq#sb5tOXyhZ9DzaQm-XQEI#rA%wfk74m-D;(fq7$zUD<m)48bq;2Og2J)y#|UjI`AsOF*7$4}p~&%ON4ITJ$< zXR!XIL9t3DQM{(+G!by-wRs!!esTMKua5xY zZ8~f^2z@2`oP76m&4RL!s9cvl28X!gF`oh zJ6v$L`MRXo2c~86)PS&+^R*?jCh4;((D_;d->yyVI2#)BEPrVm9rVT&Z{FjkSphd- zZQxAy_-?M&dBzK1@A1#S6l8HTn!JF7=@a6^#Kk?b=8;vr?!H|tj)0@>1ey&&h2Np~H;OQ|A!j2z7M)n96 z5#<7zmeVI|k8jaJjPQ3MS1z3G?!P3sPpO5M5nlvaG#PEvxy>uIF=@-JO-cTt`f2c> zfnP-4*9~Xs6a?~_t#_aJI$h%1HIL8?2_9ILu-T?_eKkr}(g7!+&(oMl$cu7Y_xwtD zExj2O-xun`Mh^B1_!$hyNMJFVw51EfRE;YzC!U&28ERSRceAo1NyDdXri@|9NvvX& zy6E90s)eBOIEoxCKz8URSs74>7I&E*+dLC^i6Cs24#~!6Cf1PqTx#3Kq}9R*vSJve z0DOW}Y93d{W_R2cxdP}ezUZhqYJBJ zMMcy0-wxr)2-krLG*TC4$#TJ8H3;Dau{Qj|82~$s1$n*=r{mY%;UC6r^QDuKbwCK_ zUfE15C0#^Z7yC_>X^^6gvr2w@)J&}yr@6*JYH7sW^zaub;fjtYsp)3HbRJ48x=+47 zR>xLAwY1X?_oj*S>AFlzTWT^g6or3?7cb}GA#fe@ zljWY;2u@$i!ohJ+$e2;+=cyP!$H(g7Xv*DjhmpXZarAL{6;19=Qjp0FBPBy5xeMVa z_*JRap<8Y)HpxOTo3tho0MM;ZIgr4%j3utJ1R_@ z7G8somW&t1mU!CzcaYk4OdHy7+#Irkn9)do_1DqdkaWbcS3nkFR&79{BMG|Q939`M zSe@OdZDvmUJLuDT0!`FBbh0y3!cWE3y_5^HiTqZQ|1Dj&`oIUMwL1?}1n7HUqn>2+ z*4W-5&@fgU)j5>DS#ap1)I%08pjnLO@5YVEq5_e$(eAuHd;gw6z)U@0#R?++4MD)+ z3IP7!8i6fBBLI1#e?L;G0WA*wTdMzWj2BpX{hLO9Yl*ZxnRjM^2S8%pUtQz8T zS;>1m#X+XAHRO^`eRS0tq};*e6(-YHFW$YK#%un)&U|jX$vRcIHZw$HAL4DU154Mc zI($$)xv%%dCEs!2b!V<5#r95fWED^clC@;!CgMe`j!S(s?HzT4kAy4lV)@;>)~nE< z=@Ti{JvphbTV48FdyyI}mM#Tf-i`V7Oq5fl@G-`&X_<5j_YdUjyg29{YNLTbqhr1E z2fPC?Vyn9=cDM$~elvS~UD!!Em%#~#UgnWxA!DVr^c$DyiY=1)i%pIxx*ny1i~O9I zmJ%W0y!ZBAj1x;ws@QI{Oi1SKn7LON3||V`R?d|6K4w}Gpu;RSf76x8|C_bM?jU9( zwNHF%wRP5x1{*SU>FVRJje=j|MRoEBx&mjcwEPs67yQ;$QjQ?*{n;Fwi%?nIU9hK@ zgRk?2$o-nwHils(+zgB6J~ZIPd1)`H41*LUdb*eGOl^71?|F!N{hYS&0JX7<+S>ZJ zvHjlUw}^=1`A^GWYgR_4)r*;oh_U99@}hCU>8R3$6=${Xuzp>n!|qyTjqH(>^ofm- z)yxD3q1mnK3Vww>PowXVj?q0_8)$QZ6BC}Qze^8rLbyUXoFl`qEyRk6+nEl3I6b!R zJQb@%MzWT%vQSJUUSIbvgoe|MBwXB!BWg1!Qy@qeEI?c%G%#_NnGiYHD{ZHaj)L>i zX$nS%Hbu5WZX5PW%$Hi@I^Rto`y$s+5)VSrBg^?UTE?|1v03TWE7A88#weE{^9pSf z8MCvlo}p-PL|z5O?=CLu!h!(*hwix?>F13Z1GsoE-NX3n!r$u~+e{ObZK&&)GRz5* zT74QRpy_2}3YWW*p!U8SdM_O=ZDv09zP{&;+BojhqEHO0Pdv<32L%Fvs53Bmr|U1k zAArVC`9Y8S8?6F5cW60T?%y?rSAn*csjM0_!anqf?Owg_EeiN3tgKA7m6M=|8iRpE zOB9NErAk0{BOiYZCBZSo=XoW#`W7wG;lCK!_wJO7iM9L`^>0 zTmY!;V3370pB4vwJ2O$U?iTc0cR97_K6w*^NhTKW!`Bgv^n00PITGonU7+IX!@lHY z{QJd!FWQXV<4UgIm8yu!1nya)2@2cLCKWJ6>4xN6N(+C@-%!4c+eYRSWEG_TjZrNV z6&|c2Y$O{K?Js7Y03o8p?Hp4p$N@4)m(fTx3gvGd>Rl|0`FvVYLWImlG^&ydBR}ym zw^^0Ug93RKqDYykEe<{L-IL2nD`&;$X>k@h_O^DnnTj6x+@(?Zx_I+gw%RrUL6v#8 zCR$7qxoxr^GUlpPexbIlnFg!cl@C;$C*&wk4J%pZ&*MhQ{cQ)Tf{pGv^KXf&k{mOx zz9*IVq8-XXSG;!)Ce7?}Pf0RY9cRH3*j`HuO=9ccr^Ltn$og_?$b`J3OZ7CV0cDsc z4sVvRacvK3xFl1+N*R|+$Qkt`_a*mBxMmLhZ}<#vB342;>u09aJ-U~@e_>-v%M^2h znALZRM3q<2ZfP+s9X?q_r?1#7mUMXfD@syn%9~pn4`zRJWDHuxdpqT`)za3F-`BEa z>Vmk7a$O?VLAzNHH2pop=Qu(-TqEXzfF1YJ0ugjSm z>;4yd3op5PH2SWQ(mHR={^S|Qkmc|fCb&mqmgWMlF009WoFls0JZc??u(Db*toZ^$ z6HSaV6^%b2YZF|3emOL{)H>tp=#L?Dp>STErrE_rI{GqQWJI(LBM5^^iZMx@()uT{ z-S;oYMUmXUhZ`?mnN3<|U}-+BPNF8P!H|xuYn6~GF$B*g)c}D^vfrfqC#+^^?_sVy zH-tnI8Qg69qq|Kcm1c{bB5$%# z7Zc55*ovv@v)V>#f@FA$md3pv3~G?b?#vTj@kcRdI>#r_H<-5&$1O>r%OKX9B1FSy zRU^_^DRXQ?D1L~AXE)HWl!EO{+>@_Y7_3^W=vhp>I&spq&H0DIj8xk11X-TZ?|91( zdA%N|4E`-QjSW~ACDqqkeAKaa9U*^_*}tinmYbI4L3|;er{^C=Fd6AOmn|Rh*oyXd zsX3LPxvaqcDO%&XU#F(Lx;Vl~2ygyiiIG*rM#op=uFT37LEvJ9#jHr}k3nY{(ah?& zP_`ZQhX2_)gWlyzvIZ?hQ>$(f+3y$rk81J%>(}0@bnm;zt}on>KPICfJ5cZ^agWTt z;5E4Z!J)#Q*}$o;@(^u*;1`KIGoQd?IjEWdDFr^x?{JWZ-OOx?efkRHBKdrBoIrG7 z^@LtF2I6m?SkGW=i}z3$md!29fWPzLSq&_U)46&Re{eZdY})hS6E|6K``nP)rrvta z*8*Cph(y-2hj)IzVX5qZz$eu{M4m*(^O>|EJ-lU#x@Gp#ELH@4IsREXuDgqgwOEf( z?e;@)OMK;2p(6Zti{ZmKs+ewie|J_Lm@PhLl-va369hSTKN%SM&6&@P4MJ@{k#dQJ3zU(xO3pT=s-s07 zLQ)0&BNXA`12(N2fl|bHYvQj)oL;<6;x|c^d79o#8?&R+ggmsgYo_C3_)(p`Z3C}D z{Dn1P>J+{8TQ5;iZnXQ$PWKgLNsIfcJ7Wy#dx~T z85!jtfA`jMEOM#{IS=%E?*8Q`@Nd;6JnqO$L!o(vn^uC)6Vsv2XMHnmL~`wM>QW?? z?mppq_Xm_;nQ>>MCRr*}g1y~Mggy~}yBbK>Iaqaa(~!x#4N0@f`LknkT=He=)Q!}* zBTKDeMCeWptEP=y7{3V)jy8`u$2oB&&hrzkFKL55Z8jg5YkQ0Tv1*o+eAROHaZ_4X z^0O>vHBU|&Ua(l0CW}=cw$HJ$R&gR7H0c6%6p&2t^(Q03n301<;BLJr^TZj;Hd*mw z>=Ad0SOSaYZ%RzRX_cWG=0M*ymoi*HAs$o(!Z05gAIfADQd6Ucm;7iK?~&Ik|M^Ix z%49CmL}_wvDJ1JSQTSH5NHg|=_nqf)+Vo-wZfUJL4M8qhUzrE&y=Byc3XYg=vXSU` zmy;M29=LkrTvB%Kn77L@_a7t3Xe5`g)Om`KygeE?gD5LGC!1Z-4k6QKaonMVZRU$+ z=}sgII+2vPu2QK-vjyJ(6DI z{*kskPNrlc=kya@2k(mjiFL<{YDR!uDx<9L$R863;bf#?b3Wy>H^L`oj6u=ln?F^1 z{y1&~noA2k&wBlRm)A^a$1>y8OnS2ee4?9c{GU>fmS^o7Thw9fciF|Y%>1M&3?JT+ zHojTvJYyd`xi}?qX?{=VW*ojh9j%6#X?653BO(V|C_M=8qw9N`yopG+2JZgD@Wvw# z&BvP~s#e}BAXtipQ|$gWJ~}!Q8OH_eiIdf(6&w+N^$y%f@Lt|F(bd!L@9Obw`d8s- zD~d?9QEyZZS3?i!;9$e6yKg!h?FU;gxs~KW^TZ%3FN*GKrg8qRB_#7 zq7j*Mwk30#iG`MP=Be8TYun$+)1*eeD@(5_8B0e}`%Sndx^n)Wf^5Hm^1(hPGdW;z6ZQ@I%;5k(obv=9sw2#z?mRv6VVUYeqBW5A^&YBnFn(r z5EUH)It4(evCUvuA7G2)zy%>}lk^oqKp;%Q|J$I5duOZr)QQZ;$!m-{`cI-W4bqGa ztM1)fT}4}tx=OMuLHE&5$|;8C!)^EOk-)0V2Uw^6>zZh;3xcW{aD^|{^_)BNlj=vz zbpiI7J>9GzzM1;*0y8ZPU7f}?71to+`(s1s07u60#2lT*oWWDJWWG$+lxt$ztPcne zzc>UZ>4M1Ad%~K)uw6sIm-JZZ!#-yXtmyHkv=b5Knc&X*_VBsQQDf2r^#{6sI_U^g zc@P6Ho_=nXDZPhKr{FrI*ZyBCn|bbCbD!-qrX0IT$`)f(I`LwglN@uh%zS%Hk4m+o zxH$qokeEhBwBAX%F3w`Oo>c6yM*5xvBUF34Id z8d2c&`4-}57P8%hhcX4a(NB~ldj>t~L;&m9c7GYG0eO}k!tGlv3_#3DNYp5va_YKK z0Q)~qi- zLI+REqm%ELplddow%FMP0h(N(K*N)Z!t7=X$Z2InZ!5g?h3dHBfuiy2ZXG ztMQ8Zi%qEeSryJr;yy3jec{|aedu(k;d*&<0q)gs{jQ@z745LF zKi3ngJ-2)=Y|(XJHOumpx~w^a;z#|1Bu~rZgw`1Wrv`dF-;M-MXn|;)GxjPjuF)_o@7Nl1QHZJ6+7Ivc!Q7=E36lLI{%qPX7oSZ#n?0xi4r zf*vOy=t+)~8*sULrU1R5Z#YZJgI_Pe_2*x>ZK*U|K!k0&a#eL|7lIA3 zXRCk0nH6}R2xN36<;Y|E5=*i&Xd=ooJ+_NtD~99`|;&Pi|)viw|$;&r=ni_p^L7kfDV3H^d;2 zIx;UkWX#N8`zhb;Koz1Q-Hp)V64NEs?F`cDTV z%X0jBsPu!u`sKIJ;J7`jK&Qts#CtSUBEwLF-rYVSO%(&9 zSyd)rsceR{g*)NqCQ4MKVFJxX<>mdWxsMM?MKCp6Wy^jbc^sebK^H3;K3qp6S6^>8 z9F4GfSi_t2-406O>-%-r?$2#J9H8*&pE&Sgw!2}rn;SN_&6mRGKoptnzLUpB1&bEJ z{xbS=T}9cMSw(cz7itMM;r?CdEvsu!(zI2kmCfG?NT`Qj!{YI0!Y|mtVkMFGO3#*Q zhMXfacQEmgg9E6d%{&saNnMCPx|0)RYMVUC8P{V>!1OS&!T9AJEHLdJ1^y26P{O&ICR9x_{|g;j!YgJyAGx z0(EdOng*Sq{(#JKVt_!6Y2R%17yAltx0bvXuKn{GF48s5=1&!b5BARQcJ|%Q?w;2l zVg;h4n6AEkwN?W7io$$249V^(6UKtFeSbBmH2CW`CQ&|sX%K9wc^hGBK$))Rwx?`UkZbSuziNQi^;rtvQI|*#Pm;b#uK*6syIRVHo+CDLiv`G39Me zvS=fd?uh#)+ou@9GTFFn56bgiFQ-p=w7U(vPI;t>>hQf5`=VcJP-|(z20D{mdlvFt z5A}k9&PR$m$;58*gyGwOL|ZH?+6*2i&FCca!Z*rHzu_;#;%S{T#Tn9$4UtY5%0}t| zX0>aTFXSi(0??O6+~-};Hf+y;Y!Grk zEFZ`YB=lWx2e2Dt;n);6tPJjVV;c3R-=RnG4VUo?SM3u*2hXl4oX@6FlWq^5C)Ho1 z3s+yyQ@FH;bB7I(2pFP$A4s-Iew53AG=#Xcp4Wx`dXG9yyI?@uq&l^%`x5ZqwV<~^ zi_A}I-N1`5Wk`IATw0`@A7n;r6w^z{Ic(H5c**qB5!RELBo#SkXP#X*ykw?5vg8nj z2Mf+}A+y~-V%U1p3*=;$<)fWwPanF7+wFxsQpsXb5N^|Kq~z4L$nO2D&iwYd zEgwnfXqia=c2h$Cc9=S9P}c2W`cP#i{*`F_tAU0a^>9Jg+f!dchYRl!W8UX~M%oED zkV=rx6_Cpv&;z!+o32Ot*T7lfmyL4R&vG5MS5iI^<@3i`ul3Omz_aqnHWBky75WM3pahG#Vp!Pe z^Lz~v&ttYAJ7|9c95wD&QDfthd^=hQp7Zr|`tP9HWs zw+o*EVPiSGJ>8ga8Nv}50DIC21jqXGPYvh5iQXH|0(X1+cYCF#19yoH$4+-c!oZPk zixf9608Rt@SgniW7rCzP+l?VzRT6u~yIOTPI%`MU5G~i*qw@jnDkJT&c%`A1nmQXT#%q{QRr;g6i}@QO-c>;ZW^B zPv!*K5VpeiWR%wx1^c^mmud3lY#s>;zrcLS->01S+XI0!dB?ZU&6^H}2Hf=UiX3cg z7T}n$iHG;#gICW!>69yuR`}M;vqm(5fFBLW7d>Y~czd3H3!g#pJ@?go(YFnwQr2oy z1u$%&67~i;`6`?RKMUzE(!75TKn4|HUgs2Dg-DTFgb2t0l<&E6kuAVgu*VVV?nk-^ z00;A9fW-jZh7IT|*&mMn+3}ujv+LYH2Z6po{-<2Mkrdbp1A!oo30CO&NaKO18uB6H z8#dGP@j&#Ai$N2C?Qtzrw{l9q#XdeD85EmmjZL3Q32(!I4BCgyK9Ge&vW3I)in`!( zd^-O&&w8^sXJf|{Z)c^<;I7Z@=DN?zI$XUh2Da(LL~|sCvvg_h<%M}DO1k(E=-HBWi zsRBwqg75yM5soF9vG^6?c3fM6xrX zIlr=!Dd=UNW^TG{q!{-Z))gRSOm5{T1|`SXAJU{bW7VuMA-{R|%qu{}ZVCU_<9OJ@j->JgGOI4>6qB5~yBHP= zjD4L=pCP;3$WH!s?81Z^??DNaMv_7R>&U>qFAvs#s_(o6?yEs-i!MZ+ z9PPBvnsteeeQ~3frpHRimAH%C-BrislQ{ahswsd&p6UAM0io8{v^ zcP(Br6^AN0U)@|b1FCHutet2VcKLU2r%0qZ_xVJIHo*0_GYz-aHlH3@KfiTBNb2Np zFQoX#^j&G8f{Kv;Zp+6n;Q-8eQ10=VLS`S6mL*>$Pj;Vt3o(m z7rncUBD#GQ&WQeVe^ZtE2l@EaBzh>LV@-7bQ9sAXIm((gEVOS;783~GgwD&IYKSd| zHf9Dh9LzPa{H2opL3r&p$hfEeIokNce~iX0aIcB@kM;nA`v~ct6AXT>>giX+%SUQ# zhyAN76*a z#Q(cXyln(9F)3jF63`YNS*0y~^176@`ph2oTz->-%Dhzu^>Kf=%P}K0x{yF6!9V&D zYe^=uadlPKL|5%*6Pjf*h4Zkg(Y`|dfGQ4+RIQKMg|MqArF`uvoihR}qT!Q%DPk3aHa7Lhu8ChY`3%;fn<<%#hdD`iq6xxJ}eQPVp; zc#v>*Jsv*{+Ekec%d9QlU88QXr^qXPOcBAp?B?rI@n+hngAO7|8WnVm*S9WoUdq}r zwBP~VwExxFcZW5xb?XNZ5Ku%2O+^Jm353v*CMDE_-a`+)igYO!1cEdvp@rUi3st&+ z^eVlG9zlvUMFd3@&z;~o-~I0QyT9+b_x{6^XPBA2XV2Pez3W}?p8cn<-r&eoWWcad z{=Fc!^QxLAPlsyfcs%EptMhDqMML-l0h(?16p_Lgm3| zO~=Z@a%5lZ;zbTe?sH~Gu1a_RxG_kUgtj_+f+C1@UTliFjP2g9N_Ns=y z*Vkme);HjIwC;(G7M^}S)-$<2v=2FzM_Gp<7y>e*J-T7$3R5+nM-*fMg4!3m4odw8 zhnKAu4FS{3PO9ya(jRIX|N3n)_N5o1LUxK zbhD=yu7tB-fg?$CB<<%)B@&Es$ZE*CdWcOD=%{ys^B+?oWZzu6&Xsi{UBeKPgaMDm z>%4@wq+)wDDuT!`rTY=(7_z=gtXDNXby_ZSThrP^kbtgDTV5LE+QW&S6X`46Dl*g` zvLXSM_f9$#o<69g(lubSPon~XJ{%R(H_FQ2}1_g7?$l>epjKsKehxkezK!DXWg>B7|P}-ix?mLOf3QlTV z+xr*;d<7IzDegQ$6BN9w<$5<9q9Vq*r+@LtPpO;84)9XgXW?sRZxsb*yRw->+rr(a3NlKpWRdNqJYGWj{nMak#Bf+;$uGJMbqA%MUEZZ1X-5R6QylQ#nWI` zmYQG89DdFusKu6_CB`5>0+aU3AwdD&oomgT>CJ1V)C-Mk#Tu*zPb00zd5Sa;+};6e zPr)-Tm!FJk>D;a9KnLqoR&MZ-(4u%2T}rEG^{pruehTn`Xf#bPYM4^WbOt*3ti#n2mpkC-Ov#I_{D|mo6KB>dXUw1by7vLpmCHr7>j7vB$8` zb&Vlfa@&?AT(gIsZO9XxLytP*1mV|Ydojte*DmVFoIa(&DUSo1`XK++FfMtpwA}EA z*?=&l5g%zBJ?VQYuQ6a(WO^fN2Sh`@VM)0U*2}ODNH_5D^PJWYE9bTLMmfxA`wLwg z<6_|5SE=szFiFKo8=Gi2^c5GC9OqixLClp7d}6lT09h99qln0XR9nqT?@ z>De?)d1~C}{K#{sOO<5Pm1KiA$VXjkpI(Vuml+Sz`0Dzk(An;~;1^H0d94m|&ssC5 z+^(vxt{3Yu0I}rf<^x?8tA{i&X!Nlyu~BBl-!Q(**+Oo^5l(&tkxj)f-%yV~UVv2| zSK1ixw-pwt8rC!v*4MYaPEi-sA?QqSQS0p`@LbWh*1ymnaN8m2{7JFqOj3Cf%B0z& z>Jg+|T+e(-Yj*vM>766rt_wad1iBKLwYi+>8T>7&rZw*H_WGmhL_Ld4=J=#Wcn?(c zByO`gbkw;k5=i^hz<>IJFO5yqL3fYz7LbYrLFBwr;m(R$syTnthhSg(bYJ3Ab3z})KYI8Bw z_i6|twV+ykAqHt~C;1JgI<=urfuzfgh)i=ipkdB$&SmhbSR`}pc>v7XE_vNQ_oqbh zj-K!ChwOkhHqX#8hJrx5Kzh9P<_$Fo84-YXT>$)YR|*kD68{Ins1p&rAb{I|DN1zN zcp^SupeMSX(Jq^LlKC2|$E00c@(*VN_xg#xSx;$97)0UAKP$HLB}7lNBOGKG60v zxs-5w@5$k#UEff?vbSYuKdRJb+Fay!U@=5f{j~=vB6crA=tGtFe}0)T8`Ql_>&o^{ zMzkf9KppY+De2^;fYceV(Srk&eBPVkkb=@JEIWySIqp>$l&yPAtZVca zt`zr3meeULWge88sd3UuWPvwg^oAim!l|l{)U^1+D^OahG)DFGrD&SI)m*O9G_P|N zwI{pUgM7vI-b0rBYcA4M`W84?VdK*qyRKhe+Vvee7dcKEE=vtl1Fc$k|K%ec3E?1o}?T=$R6lpH6_1@XAlm zU9)HT`hv!F*$2m?A``?lv#shROPqNhc@@nl@qhM~_=;fVi_sID*2rikUYyquH+2=v zBr?XvG+gAKlqfqCl3t1R2!$#Rt9A^DI;9HG%v=;l$JT}Ks_{yfm)8qzuE=VQdE_^} z*TX64OJB82dsbVvKcBGZCbk-t^qQS>aVUvQ3#~OPqHamaA~QQx>H7GZFH)R!fWW|n zQ+lwJo4S*zQXr^KD}LSL;*2q9cz=#$+ot_e)LZT^nhh^Yf7G%q^_BQyKP2xkZ7(V* z$mPuOv&P`?xq5_FM3+6P8&QTDz`q;Bt5tDkITdybyNa0HE!oYq$a!{&64>-Ok=jZ*1*a{M42(4EDu8FsiC%;a|9L6f1YkvvkSRfW6YWn-v ziS0#!YNqJk+t$+-ZyGUVHR}2a7MvSFj1Cg5XN9PJwiC-hl$HHXS|2glP`6F@4L&X) z`*EtfuK`QCfs7ncf1!o?F~pp%SaFOhUMaC;ylon}|4S&GQ-{}16D`2so&Nc@m5LuI zoYlGh9gUTAVULjComPxFw&CJ_+@3}CTaZZYg~{V_t)L1`aYOym9%?4#aQ#v*Jnh_P zdo^onR!(WKS`oVvw>Iu;c}sJWgPCpFbLv`AlGKzC_%myq>FEp~Obzuy(t_s91KU_>`6AO?mgqTo}~P$R*CG%#e;@xJwK zPUOidRU+Zd9y#~cfm)>b0r(G|hP5<7hmS84q7ZFZ-a<~#OhMz-L*GbN?d{~{9mH6u zi}dXcC%EEdEMs@yT(s$J`{s7)&u%>GEVJ#Mm%O7~vU-mVs$1Epd&!)&S6_mi?pfV1 z%7k2rt4qpK2+7qI>ZKoxV=&~HCp+_p#paZi1#-hsCa+tlw^w}{+^5Je?0>n^E++Pp zSVhy%!Hh)zXx1YN*bGQ8rIxnY+ZuoXSS+x~b7sp4zL)X4o6?th*31$XpPL7^bj5Ls z)(u{6s{1Vl`AkYyn(qmrr6#_V^ZWyWr!!mmA|f=Unb~-EAQ_%jdCZ*cdRsHK_vd$b zzW9>b_sgyx>yPhN*Bwq{S66%_tBcrzgbHF?1e)SU(3H((>CX43(pcTI}Yi8UUk9F7f?A%*gt%jw^p~8I1 zqSwcN<-@w2Ndt^D2FLCD3-!Wya>N|bL;aj;_8x(<0oB%vbKX8K357R8?MJ{))rpZ< zs$&Fa)KEvf$R$J#-XzYm(n7#RujVRrV;v#u3kAahM@DR-d_e{GbKeh@dW(L2U~)P$ zDqX-*9IT!ernPY}IPoyrS(1l6*6<MsE=Hs8GkYWT-xPL`zY9CO zzEmrfYZL{3^xA`yJZPBN*QxX^FI?-}H3VI{j4>=ZA0_k}49CWJSu*TJ@M3-2cmb

    {;qrLJES)1#-JMKQhimhTzftPI=5Eh1FXVXUnlVxxC1M^&mtv+f9zuh~KaS{`LO&_QeaA2h)$sR~f?TIrhw*EtmwuQOq0L~Hi4zj@-O$TqvvvNHXPcC zOz51anrfqL2bOW`iMDUTmCP2UGoFD_<1R^-MYSjx_uKn^S8($^{N!Iw+7q9L^hh0X zv@E-pmFvo;vcOZzQxeq8CK5QX$}b{3h*3d2@_|jxxhkp@+0Vv!2R4HFVE5QgZ+iv# z1LBC9mSCS3ps`Zs@v_ zrGxH1Wsh<4`)6;dhlKxF;V%d8uW$7a)QiI{v7IDM=r<3}z` z7k0L)*2A6spLoM_SM06=Lg$2%S#lnN6LTzpha7 zZjCe7cayKzr0!(VHJH3_Ut!7xX>vUkO%`z?kNg468M%Y4m(S=nBrN!L`GQPqV@XeP ze@F#)#7S^I(n-4}`ZTokU5jbYFl20PH*EC1*tV*(nO7|8N0Oyq` zSH?%Q;~gOVExTMyIL2#Wi^2Y_fqkWsGzVPDe%X0cZrgas&#Fy&LosuHfA^N`c3iPS zx56aW?E#!!X40!Tt&q0F9HxR|5L5peT?;@&o0XklZjdNYet7{Tp>)jPny-5P8jd_0 znM-d>I4d<~3gyK#gCFKecBLD6)bkHX4&%7hg{0`$cgnN7cajO!d&-e z4pE124>|HeDqFp@fH^v-sei3FFfI3w(E`rYZ!oCL$(?#|oEXb7p>+74CsoY4RqyTA z2SjT~wty$K+PY@}0FGuwQyz{O09KWP&H3JhzbLB#5Gli5Qn^+@Sat>I_MLIzd6FPU zRc`p(#w=$Zu3e|QO&Sl&)1s?J^^XTL?a}%`W$6s3h!B>1gVo^K$$zL7O5mKXLM^kd-8Kcq$@ z!6MuEA5+wl+?|;jdK=<%_t@y{W!PLIloSNU5_Bi}uE2CTjcSyl;x9w76WK+KPh9*n zgbal;>pYZE?2$DYQ5sE&B|@k9Rbo$z|2(0V?*;}MaInocgr8d7rp$MJ-~4V3XL;f* zI@F_0IGv_skDRjOCl@(&n)XPCjuyl4S!StN2LWc6!9^IoZJ)oyLLkp9GK?eCsLHE- z5p@$6V;onj6N8zhKhEW#npJV&w=;FdB9hRh4s4Mp`NiD`6`?K#Do!)3luvCUFFWp# z^qESCDQ9K~J@1v65W3nx6Ld0_QCzK(lo&(UaBuKY6XkMw~F$0?hMeyCRpNMeb8HntOwqdAGT1> z4og=Y=3Zf-m=0iK#g^*LA^A5 zvGPL@2J9;}V4h@kpXJe;G*o-~u5yzNJh(=F75L(PG?_fDvNC@ZLJ2pS!Rm`^nDP#2qOPls11)3?LG?NwvHekLr1% z;Jxr}2V?K%wl44h7%`eTUHKaqoPiAX!?WMOn+%v)f2F&GO5d)jk58JcHU}&KQ5f)O z0LulPC)t|U5ie`YQN=o2ZY=H6RJEVi>2b%$C?3FXV3PkxKyo$eCGAQ?)uvs3O9ku; z*a>NbRfMFIg3K=d#;TQM2Q9d=vFy6{B@--gDrf+(9y-uE-Gh9%&W&3qrt0bn&mE>9 zkc_d`(;@H(rs5ii;xCk2NoH3)QX-WOeR&~`OI?m(z$5Y1RI{@vEAH6lpy3vHPbsR_ z_ZIyaGaJl16gKNSmz@DT=R{*JfPCO`DBy_W9u zJ_2@K^n0S0lg8VfMFX!_L776n^hh&HEu^XC{rqBhp4q$gN?N#kBjsFday8l7&*d%- z;4^$S(4F9e-kzxn8MfgVE`|a+g8-Bfi8I!urktxd)B((zsRl-8>V;pkG05c-{3(;& zV;{N|VI%qAdvZz)Of!ag7K6f05_YA{gg7?Pa7k{e^-71dnEE=Aw^eQ?v6vQM>rjBz zG%#wXRbz;H%7ud=@n+jDXVb1AhsuOBq`VI0cEZ_f$ac;!iN@Mv0d zU+jhjs9C@Riid+plC^|o^V~3oXJo~bB48j>UM1SCe4eEN`-xC$!rjKP=&Exds2#84XZ(d4Ke+Y#FbnA+u45HK6 zI{f*L0Kj`VmOP)oIzN&EIhtS;71|>fxHzYP3kPE{84s3Me)vn1`y&UjrbYpU!%G2VuzAU_?fs$;+^TmACoO9rj-|3E*V_c zFS`m|>+?fkqsMODb4;Z#q<3oH3+DYtcj{^B28OdIf1RH+39MOU*H9?HE$@8M+DLuY z>Tte(XF_jK3n{V!$&?90x+#soi*~tqu3GV}n{(8LC0ClMTaHe0UVhL?jOt8GT-;RP z;hSLoctO_lbLi;=RvJl16M$`)dj|fJ?)3B}@Y$bhVDyF*=2N8@%-e6GkS#atEO5%} zqDuA#Zd3%)vfu;D+y3WK*;&#&#$g= zyIj#I*_9O^O#ld@B)8hY7(*W6HUE%!2|XGr!*^~`jgV^Q=Q@xZUwb0rs$L`Wg176J zljgIZ0=i*fqtA&u-!eby1^XdO+o*v+LoDR$t?>p=dYaBdn(1Ff0$t=4$xjXQNZ;it zthMAEV$+{6DDWMUU#Sm5%JKd%DDudLBI`NQD&2XfT)3I3!6Ny}>W1xKKe*&} zlIr{?FadgwC{~bD?HAMz&G$^vT2SuMZMZch!PwfsPF^s{UctaD&` z5KGmSoMy>5V9UB=Cd`;-$IUwBqifaBu?keYGWZuzI-7hLdq7Jg@b~;X zi(7x;q6H#l>HM$E=D(S*J%>BNKkavC-*oOfFefSBk0M8#mpKsHGa<@Mx|b?=UvtEA zBKmheiD^iF&H9Fj!va)jFn?Z-Z`YHK9x)}QtV8$tWwN=ov|t=%zb!M@tdj}p(ZmLY z^rGY4TeEH>DtcdyBy?S6`db&5CWT-cZ7EV$R=Ox2H@28cChta=X3g+H)lhehN3qz9 z)7cHD5}SNe1EUeyRP%|}q(aMTV&&|tz2LomkMj}tc>N2amL)aAPtlW=mr}#*xQB(w z^Mc@DQ3G6BKAUHQ0{XU@WUG=IiX=KV-*k-ABMn=6<_(-9wC8(dMa&8Bw_I$n~5fkhG3WSFGxr{JEeGXtZEkZa$puZ=PsBZdv%gvhbsZ zngW`g)m{IlH0SD%Hkr|{-P)qDa1H0Du@a^F9_{LXy0Y3T36OtLIgy&`6#Q<_c+TYO%y^D8r2h&G(%0^8<7%u zjrFDcST4Kdc+W)xdPbC)20bJkVvt6IYIbptecNUU%$=?j!Ix6tL|XQn9)BdO%uDHeF2@~0*+jY6n+ zcs;~TR?DIvf{j&1xq!Q3yX* zz(D~Oj0sPh%-PU_I5&$r|DGXxOhz5QGk*1^c7&i+_wQ-kAsHcwhDEC zFQK5Vj71h1;_bb<0fC$ITZftk-)(XZ58k?5cCJSW=m0fp3(lZA^y2`JnJLSx?mef;a~t@t><`_gQWQe)Igir^&zE@_>+ zFu*zi%LE{9L=N>Ik2qhjJf28uH$I6>JQ*v)DOrt_tr^=c-s^CEBrI~>#>NzBET&aU z(rCu-p$vp-PA4AmKi{gC?(|(qvRmSi2q;@i_BkpI>>O%hEXZqswgo;qB0Y!vTF@l_ z*~6uA(gwmxM}uo$YA(`)!X`Kql6sxN(UW$WGzGX51;Z!{VZFiVy|7{C4Ar;ea85PO zSN^X}ZvCEOfovGsGO!DceNg@W>R~U^|s6kdREb8Z`3KygFmqjS$?(5Zx!B z8#Xe9e5u1UJ1S8DK&@aU-WJvQ+YDcAN(GZ4d3{he@Y^kJHD#6=<5^xWFO-NmO9D-g zhja(F6z12gz*9s-9?(6K>o2*$H}vH&GSGn2dePL?Ia<{s-U&5Vty-S@*(0B@s3sYC z$@>76eoi&~C1ke~q^>?-DWDSV85KnpU3AbBbvY&Jz~%X^rFHig@W1T(XYMh<$ zLlZQY*+93Yr1;#5`D|d&pL~Ne6~wf@0{G`h^#@_f)AZh_uRFipXyh~Y&M!Q{t}ht8}j52R#7DS8vBy~M;9?!$)^tR1w0qlwt<4(nNs}C2hGgL5lSjgFTL-~-Lb9R%0Lp>|axvRTB z8m<{Am*@mlKl6&%hCj9AC>r&GhBM~0)9X0hmJ6vnE4fEEzvuhcl6z4K$A4F6JB{c1 z&8dTTg5RzBy8aj{F}$XE9(MW`5;{)WgmxT-R{d-Tq{qFb~ieu2?EcY!DDg@ z)An)ko$* zQuM8CmVts_{Nogb^8Jl9n|eYIeSrQ|2Go*d8$~Fr_MB2T&Aiv>9ypd`Vfq}BJ-u|} zwt`&g{M%_&4{H}rJBfrpE;YAH+$C)EU`eGV=2F?Y4(A@gJ)imwC~&VOm{z%PbJ?JE zv{$_&haP?p?HzEi?sH@;a9QN6(t$z?wiCn~3~tW3yg}T_;8AN-&3BT)Y6`JzzQIo> z{kGe6Da`5TkM|^Das%19R1P9Ev?tb`v}XxQ&s-Idtc;vVKmI9i0m>M`&iA<7cgej$ zU63;a|IkkRPC3}dJLu%Q-sb^zXMx>*F$E%z_=1bcg@Od+`kVL6nkNa%7&*O%r^;%c zp2;cxzO?-5W#R==&>T_8u|V%&PU#`BCn$t-JX{hL(92lXpE3$Hfq^g`XIYYUIsn-~ zEN3GPbpF3or2h?W`+xGRvj_h>UHkWi?%%ha24HW^Y0g(Z5T&h=+|rxKKe(cXzB7ZX+lJ&;q2d;5XrDnzI_|*U!d0t>-s{YE;YY-;EEXHl%)!$tr!9 zENPdttJB3uFj5k^TDm4|afboUPi}GLC8TkA+z|?%lQua2jPOi2Dx4}6VfIM#8hv> zWa59A;|={b0rnjbt*AsCZ}J*Yu9sAljrvxAf0z<(ZaI{oe23YUpp=a6pf}-!ZuXmb z9j+9w`Hn@T7K++Hmtb5q>G{2jop^kmAVr0v7^7GQE){kCy<{D3nGyyp?CyOE72L~{ z{GVoZ5F(2ND5B;`awkPd1+V=T@G*hFkFyyAi0S^$^nuI))N--h=MLXTFH%h@Ki9g) z+xHFTV`&Z7;zDNlj$V)q@Eq!l`!-*%eC{jvyhn$mK)4*b8R>GJTE!ElWb8ps^D`oWy zlIJJAOvw%vN?PSiS~b5NUATZ+pMg=T(dWB7LwHUiM%5}gU$!(3rE7J^I>FC|3~$4B z^JCR&5Z+v4Jp6u$9F6dzv*1m1>!?}L-zhwI;fUVVs>NjfHjnJE!n)~Mho^dy`jKDJ zjU^v*dftcPNysY&O|oHd4Rc*~F7F;Y-aM78t=t^G#0D3BnjZ&{fHD8VA*~DA0CE|y zTRes!s)xz5Eo(f%H^KsLf#0$*k8fWsiapRwhY9TVPS!EcrL zqpFHMqQJ8$jNc64oKlD)aW^W!EdEyTInR-Nq||Jces8#H(-S-AFfvn;-m)+(gN>Ux z;`5az^S;gunkGs%iPh?0>Y||-NMlVpZiXPKH4}KEC&)>IY9UW44{LhD81JE(PHR)RHbDkIPdYr5r0_f0_#1IV%~6lrfM}P4S!jRvAXt7m8 zvcBjbLLE<4P|MUlupdi1}J5dS&CzXPR? z6=f!aTS=1{Q6^$Uw5(v((i*b!SwC)Z-6gKw{OcG`HCYn;Oc(q25kTb)tQPvm2_GH< zfeui%DxAq^{}1bc0Fr~W;Kp%J)35qlm7YX;@%4GOR5t5pB-iVR2nwVjU!vh%@fvt` zMxyHi=}_zhSCQ-lOA()`3s?rSaD_lydZr52zF1)3WGv4AKTRLM`|#Mx_^{ z9RI59uzz)qF^|vk_IOJXP(8$^w zJyQz{3XGUjhNXr5%5Ht|jO&Rq|GAVlTDk!F)eg(^^V6*cz;{3`oT-^wX?fW6t~dA< zG2LYjmyf_x68$m85&*|^k3Vq*9-Mrh5gY@-vVw$5>w!+3=JwZR*S=p>qw1HO!0tRX zmGIB;aA9huElr93+PDUe7!cHD(RlSFPT+OAhb(cVf&)yJr7&2SI~!pf=E3$VBI6B% zavnGTxlQ6r2jKypsVQ6&O}Q@??{DGs==UYvQW#fspA@E#2w*^8LVUaCfb!$nVlND- zl)d}9oOI6>(Ev9-zc4Xa;MLk&Zp2^$bo^ge`kuYJf3k-fvd+UI0X8gK9`=u#H-j#{2NvBW;1j;*6 zp`G0;fSU|?V{6cuE&U|`^1!N9;Bp}@hwzy{e)l|egT-L>SU zV5-N-ccDKJY$a7CVPI+#(H|@jp}$dq3I^^lFqpl+|6m7QzF5J)JQpjxm}VYtacg^%s2f0ydVkK(?o>mDhpZap&HrTz)GZ)&_l|CyB)W?vjB9z?;`TPk>Kr4W>sH$mm%*EEgBV!{N{WDB^Y0^>p>KX0_{_nqpM;rtC4Xknr~iRWQ03c0=}K z@R)UXSZ@w+{TDq2xoP0-)&aIK>W@~NJ^gg*c_)U>2-o#$v#x|o$rH6koYij(hvh57 z0_#RYG1&yG-vF*6A|l7WKiZ0bfgUU36ggd9s%Y-(xlVMQ5f{w{ryQGoWA9xoasW7r z!f={aM~SC9mTadSad?7G!e=XQU_6>*L2l>Hp155Hw>2Wtq=07e<|GdyfZJ$GF$;XP3M$NkVr27RTaxTI$fUy z?h2w>z8GXuYk$KRDIbk@BjUoNjNJl2O$U)uXg$b|OygEe5)GoF?Pb3qtY{3DzMQt7 z%xUhC6nrG<+wj-B!lsrWn*-vh{j{0t#Z76XM6HRZOh9u)VMq8r_^pnmh{}#u*j?WINbAm0@+<7&kam4Xj?}18p@P9N zR7-Gc+wAkrVTEdhh-NGq@Bafl(WVR|QJxxZef{yDrq>^O1Ox z3sF-U_A*~((^;nz;FW<8Rd17AsHWI=)94Lxoy&++>nc9!z#o;ngG!K*Z&JNOh&Hif zqzi(GwOo?a&%bE7fP{_qq}m4%s$VeSTIoE=m_1__t#BZ$YN;lFjHM_~K3NyquVPVF=?kYVe=DsUKdr3ef&c@WC(^9J46&`jzF}Q8o-JoG z)p!xRiwON5;^0`88u;!v)cm>4PPVfFy3rpxmWLtgmmECRVV1IO*m@C)9Z_&%&T8`> z>znZdO-BH0`Uo*qm&Zpea)q=KR^&aD4;;}7Xp@7;EZ2p-V&reF<|NEXK;@L-^#U`f z$P8sKV>sKD`UeDjj2B{c;k@RAAbn%QS!y}qdDt2c2smnJF(=(!)_M`5J21~lRtg+h zLuS#|xa9|TxD{!k4`rdUwUdNQWl{(5QGVsPH6K3@j*Ydd=iG&Mo$ui=??fH0!L@Wn zYv>k47FU+1<7CMf@Vz8!eBr#8k=IRvSk~L`i?QSCPP<_|7?a{fJPs4}?Uua#cu(6i z5_y~;pvTxUoK0a;H;Eu7o;JC-^1ZVMrOz_|kC!o#lgk&GG8nIB2q_8Op~_DKq{GL( zTAwz_j18mRMVK6gT|@7(T4OqYo-tJn9n2UjRCkF87^oaQYKKz>dtDyTrE)mg^QAt2 zrcVR0S|@)A_03M#nH!-^|4^L;3WlRM4`6b}^xxCgz;Z@+O=M(Pwn9 zEpY2YWp=E6RWq?i0f~vUSS7b_rt&AL}5oEs5g*h}dHS?b_BwNhJ7~^F~V9Pn|y1pA(V%wNnh>e`( z9T*$l$zFXZAsS|nTk$_1tMT7rd%~BWhR>`PT=BMSQM@87#Jirt%6;y7xYR2GUe}6O zpDmJMB~Y$j${R**o32}=%gbY}pR+go>cKD&WmDaJULMqH=$UB!o@a$>RoMPIj8c$k z(1&U&J`x(Vgk4WHGt#n$R@ycr2sM4W2Tgqgg)pYtXW$o%afMxjp5l-FuZ{A1?oMe_ z&c44@QG?5WSFYanFuP6l3EL+J)!bdN@<;U^-b>V6iK)KX_Q2=yT;#-Ka1ccWZryoI z_!vX2Dc*KhV_u})-3&VuT()v3a@6mW7o!Fq^AZssIS6r67x_Cw_gx$eB~ zNT+e8afP?uC0l*;F3UW23j#4Zzk;&SEtK)-zVrCr)6=tvn#b8nz31yz&V*Ab)R!_j ztEo-)^?S%r5m|~H&|<|28BhwY&2aV~&C_KIeXmB-LwxgN^%IA6K}^c>?R4?XDKoOz(uh3fHp=X8EoCIl!`Z~7F|fyY&jH+|gOQTHK9Pgdz>RNaLJ>ISMSV{XXS%ct%#3#zl=_E-n2Ci%laksJ|&2qPv?1;#mR|yFBRJjIqFX-&0N^3@q6!;m0InZTn;d*typvs z6sIco< z;t`$XALvGk#{jWmd=@`W8OFa^H}(WCC|pFfHTFDJzP~XtlYCG}$Zovc(*^*(NnV&E z25?lszyIZ3+4aO|=6rSMO%|?ToR={Ol^dna!nQ1UaEe zgv=Bs8}Rrkj5acVh%@(J)=pG-4G>`7mu1_P)eW?RbFF|{pSkD<{EQvnGm$s zvY~{$M#~sgpDa|~WXj2_7xi*{n2tj0QvO;w&`wm+=RJ9fWzqSewiB=E7e3xLB!CBe z0=Ljt7Mm$=*Au|ie%@H(<`c4Nut;A5kA;S>7H-X5-R!(CMD&%*oS$_;$$I@tUW8~1 zabmvn9ZxYG_!Xak1Ql7$6UmtXbkF}DBNw{32g5nOBggir?BvyktJ0z6!q z_nOFzOT>xi5K1D8R@`h}S4U*1S?9gh=_eIbLS(M+4bm9k&R3j8c^$B)2W5W}-J`t1 zh2f*kIs2Yvb`U;@I+8zBo62fmA)qxGH!OhW+pde~3kFy2_hoiPZ&)ctdBc-) z5F&6OQy>5XuuFs@V#P|)G40;#~8{aKA zAEVHRsMHQ#eST+n^;$W?5XcoaiR#RtNR03*o_e8-O%dLIMS-KLt@qpONYyM5EM-(K zgUr4xYMlg=fc;3TD!9i^^y+OdkMj?4)VND!5}{XFv}(z{3=dzJREwzH>Sgh`*62cf zGBd^mi$mkNv=5cD>ma!b7wsr9e>5s6rG(D9XkPrPs10zfg9-&)x9Me6HE4_Jjgh12 zV}HyE*DpC85|2WSR-%>k_#hCi8;ZZFKKlu^h(|Xp;H}pVvh|}VQ;@^Ud;Zc+(iVzr zz6eS|vfrw!g7qg7_uD8RzSXp(!sUrY>v&;HGeA;{3XsP%2*Cy4vnW$&z-jFm$OpY* zJl2n_fVFR-4Q^&~(%F309Ae{Ky>3ny9nmwbqEK`$!8(t$fXoQuH7nG_b1bY9bLHFP zyN>|C&pKr75gO> zP`?#McDQXMK(F^GnVCSGFfkdoW|1{VDR_IEX*9aY6cRenD=q2PoPX26)pfF46L=Cf zVXiajb=QL-szwkb)y9;u>TRx*=(0ekJ7-q25^%ML!Lp;RSEs8*hgSaZiUKQQ6PS41 zT2|?pR-cYtTHV2vR+k$P@G0TiR8=p3dSSjsGk&y8Xx^@ENs0Uo<{yY_YJcn3^I& zUc+o=ZiaQDO}91QvP1L%e;T`cEf*5p6Hg}ut}@Dh%FKVNtyx_q>v(=l!oGQb09VUR z8Q9J48Ah|FuITg2{oGm>0u7nmL0<%2|#z)lf#9{0YtxV3r%Btme z;&+*4AYd}d6y*f`=%n5Gv;IJ&EC9q`IRxR%ZH!GmG7+xn(XzB^9vC()+FQC+zFwJj z|4yo1Q>NCQ$MRERC=z6WgW210KX0U-Pb$X2HKL;st}RJlQ#jS)PDeoB(5Ai`aF_Zp z{9e~Mz%Wi9uYvm6(#JzBgPF|v4WIBkXFl8({rRqnsb=_%ZMki=_;LPnlm&$-x@>eP zQ}Bh!4Op_bfmSm;MlB?m@{LHp8%!|04li~tZZ(_d&z5d=%&0&DIh`I8hIr>s&Bgd|1krKZaG#v>@6JxS zCb4J`$sBgy9=A}6_y*wwi~4@45uC_r5&b~GVlpXmVit&UJGJ%FR)#%@Hn}S}oim?= zLadz~<27eQR0da^9FZK+_c+?On%JXuYz@N$!Xag+X*#ah`NDk6HjSebY!}y4c_OHc zFTbJa!D?IfldO~*WD+v^@qpxQn@Ct2V{*$ja==84FF%kUMU253fke6aJEs%-F=Ivx z-szj2bYomdp40^o$I(amUF=MWAGK-OK2KG}njZW*u-iVcqgQ50v@&oEHB8F5592VP z{79NAfAwWxxkH*|h>THranzb5A^7eU5&Fxk1@oYj)GzVZSJN9I#Vt)3SPDNh3en#OK1^!8k*R`aB8zKoarmBy4n2LlkMc{q{Q9qW06ceWo#KmQhMmX zh~FI`z-+iiD<5+Qf9oY0I=_((Pnc`U7hX+`y~!vg1Mf)%=z&9>lEqB1rho4fLHrof<5AXS?|MPQgu$nXxtJ4eW z2sYG3$cFNw5&!_6X+|I2c}@Ri|J!mrrXZ|Jd`(h6(5pfiTB5P#T-e3Ftzi;87{VCN z9K||Z;{fA_*u9?|_ZID2#Ljub&W#e}T9Z+n!~(Y`DJsz|^{MyJe^1~e$!%dr6zhG% zWblSa^Nko5YKffkRiE`(5k0m3_sM|eydH`$GCD8<)Gktly~}UkO7NMd4x*O~ z=ncJTZquPSTIXor6}r@B@VukToqE;FY_QpfEa%e>1tx+$@}H^9%GHsH@6WdL4-Sk; zwE#xc9W#mU8rm_NK36PS;(eLrL0Qrj!2+p7%tK~Bqdn*u6iFJ`siYgyuuVJC{GH-< zYm{YH5eMVj$lRMz|6Q5F8SW#g8BHwYNY}MFD#O~fM?H)fU}O=b-{E6XWIZ#x)jL}F zGNZ5+Xj7zGpTx;H^^!VcBB#fPklJ%IAD_2@A5J?AM7|6(b}T^V;_?iR+_K=CUTmx~ zYv4AhD%1v2Bb#v9=;Kl7cm}I^UZ7XEV9p#l#{u!WXK$2TO1xLK014u@earDwq>RC3 zwV%5RQ+i|Yy#|pRKGBZd--Pd3xq4`&7;?R{kT~nSd-0A{mF~z{C#tTF?EWm%?zvLj z#6dovrAKfsgt3|0;XD@mUc4z(vZl$xZWdEm&>B$#o z<4qw(oNKw~YexepP%2=I(4m?@r0Ccg@DC$nqdi?+Kjzk9$Fyf?;3e{?@{vT9*D72% zx;>_wtX{2k1|re()y{>{U9eTq3XXYj;H4IS_4=gda;W7sEnDbFjFVkx(t!d~F&*pE zXlhE0G+16SvVfNS$=v$wG;vz}w;Ng5!lmVkgODTV?+~csr)e}vO?}Giw2z#0qaX2) zzh~ajCP0b_){o?(vSCV)td~nKRp*`;?&Ir&Vma8u3XM!O~8leQx#44dMsGxNroh75gA=Gbj4!EaEDW)i9KKW zD^fu{b^$8F<5w0g+S9}Z3+@)2vJWpBb_`EOH6OKE4Pz1nK;_KCQ9FMH{IBh5KOc0o z!jDqMc0~f)vxAJv+nU=Cj*b#8`_j$w!dn-VSXH%aWIja0<%03UVc+7?2eyv;EsCUe zsl1dOWADBJ=zMznc*Z0-0#Kd?6?Q1Zr7lr>#H4>icK?WrarjEna#V%o|ED>Uwa}{} z3pi`Z1X_TatOi*kU5i`7@Z(3vinN(;HvW=UPW>lE>ReV~_#>|As`$@Nnx7rs(7#L( zbRyFPFYo+e<_OQ!P`Ch*m!R;UGm9H4DQc}zOtG-^0h848=d#Md!k0^(w`u6;5uPWp zxGb9uCR?2UnM?aRLFuQ;+#pXTj<7MJN<99Bad(Jm1AGg$Ust$rj(n1YSd)2!FJTYY z#uVsFOoCax0o@_{k^OFlKo4+RsS`mM{P+SPBz z+k+-4T-B-u9hSJko!5FgZ{YD{lxKDFj&_T}h;qM@)|icOHDn<$zLbip2rf&8QxmUB zr<5;iD42LK=cV&#M*B$0Hj+>i5swBz!C)Te`)6Vv#ne+q$-E8= zPoWf3l(KYL9#Wav*O&tUS$3Ja#`h`J!cqi2Louwk@|OIZj84>)nUma}8KasS_l$jn zh_81FGg1E8`IG=e{P8;qMKv7MAEsZ9IXnuTFu8KOT0n(q3kxaRy15qNrZHF=WNjrX3ZDAf3NVDM_oFC~EBhr80g980f3L zd9}>_p`P{Mtx^v=Jl65O#40{PFhU0IU4yRymeXX7DC>TgIMzQI$mVzsEV`}ac7O!j z{LCBiQ_a?0gafEvt^l8u&54O+Bb^Tm+gkB2pGxj(5@<4jbR)FM9}Div3we4~d#b{C zv6V>?v!#gj>MOD0u&oMghh`N@!oCevqmMa#v5pgM5@7!awckhTUzz?({d#(zE}N|x zcXAa+UMN&b-R698Mp#oeH8%H$Nv&d;ys%zHB!2r7ya@{}SOeE#~`KNxla6 zKcpmh^rcZeab17awJrW?0q^0AQltjbX?op0Asapixobf%yB&p zPt`mw#e(h*>LyG(?um6`kOi~84SIDXc>^yOD@-eC(mQ6?dg75yN4_jDk#%Rgbh3LV+%>b$y%Z2n%?>L8jlM>b*F zZdPaTM7)C2j%KKebZ19SyEk=LR5P7cK0XR^i8{u zKBZNX1w@SreTO*dtOWRM^uw=l5)RMOYrCKFG zOo=uyX^lWGbL3Z>f8pbGfU$?rfKkIio{(fM4b5-*DaI#Y@jzBPK&#?O$dFP&Z*tlP za%a(};hU&d*20;L>RhVZ_pTG^#V1)^<3qbsx5^pjHJ_$7M!X>rL=Q_@5jfgkeQW{d zz&ZuYYxSpLiQ6Nu=ZE zD5;{5BcjatMX}$VNb5|7F}?7Q*PK`W%Xd2Nh35q7#=IWQJ&KsuM9`Y__qNr`j;5{$ zmzA4$vsEM&*G)UXCaUGY0kq{WQd_u-3UiQZi7u{DWPMc8uIF_q4QL`VOu-plx&d%V zg0Y*xp!2S~?8KFuD>Ad2;fcUK=`VCs5V^Zqf_u&Ll!<5;MS~)Bard9B%S2VaRTUox#%sQQIfVx}vZfC78a> z2H}F0)8y}D9mXJp1M+eLXn$6{pQ3u4@>=ncPuD*jz6jgGz9CGC|F+s5_YE>nvI_TS zA!t^t+_&2P0-D6pKK-(Wk_PuwkgE^~nDSnaVfw_BuSJ6puZ}c&LoQ50Cb7ub2?3Iu{Ipn^eGr4o_DF-!KM3)Z< z6bTt<)2H5KhIJRy-#Ifh6aK4wih9{KCxNY8+?>CwVb5;`d^SkCIzDa!L821EiFGuP zjFTT1O&N<=TY8a+aZdP9QSmXG#!F>alm*D!6C-+YKu)^bKsWlUX?o$Vo)cnK0mAmg z3U|OTTz__`w4#zXG(D|fcH5;azu@&~>(>7u_q_L=Q-z64$pe&=CIl9{{X&y3*q40p zQ~&WKWP*0x_fE2}^D{+mQ@*&qfxQTLxpczduw|-D+s^IC!RhJ3BsssW+?SQlS`RO# zQtB{u$DV6@JXeGP(ICcJGsUo$##5%m_sv!6&}-Vm(1_Bx=1Y3f05p>%H~_dvy=;Gc z&fPotc~9}|$xO`4p(ug20#q+ZX-ci^iUUb)j;M_0ePI9OKnr-Mwd03tvK$djG1=pP~~o1aiO-PcH}+?=s}r+==p+OSfG; zTSd?Ir^1RergN4&8cIgQvZw?FkG!!%QjEcsjN9T4iX~A%&V#))#GD;{ckX97sCn(i zyt0Fwl43wtx5`FV+mp=R*>hlt^R@$1fAcF$GMXxlwk{V@ny0iqL-AK5fnW4exJRQYSO!53r|ZltO)wrIOM9ZWNDw#_f3aD7j>-gWe`hGu-jf4M08mb7TZL5 z=%*EKET@w@p!TAUV)tO;H6V@pocS}nM2BK%bfthD)Aa}m z89>G&S79xLttVfN)Ov6edC~L|^_stM3z$fG7#%-_;>@IG8F;S1u*m8FG1X;AXy~eQ z=Ml~+UvBjlaG$6vOsKwbOtk(ajnzlHMujLesS;RC-3|wnDhP~pxMhE;5$YUbVvxlwZBKh?>?Dx*a4OUTb5yq?PC^ zKJNA!;2XJ7i1lg^=Ix7VzC?O^Y1k@_G_2k&MXkYru}{5o!xU;ZcroqGXul}V*<9!x zw$xWp0`e<$SL_4oydM1tW<6rAohn^yvG0{BpI0NP%wOQ^$q;rr; zCyQPLyg&-XzK;m?vM{y7J*O$-r~CX#jVzKr>kWNlD5Ec`6vr!G*lYeUOg$zq0Eqg? z5n3o6-w`ZL`C6lj&ROcRi^s^`$vQ^X81I1-ujglgixHLGj+`>wTtlK7h5jS#qeyhk z(CQfaFY+U5TnTG_@7Q(+O=C%D;WSRhup?9ko|jy0_Vn;2TWvW@OMz6I3# zzHb$JAqQ~S##p=~HDtTL%1ZO3dgOimH!*EXPZ33`T(-d*G2S`3JwkWhPZUx)t=cUC zl6<7`UXO9@`3*m6(hfw$JEf9BSu^A+N2=w~O3hy<)YPe1h?4%amb$ant0YYB2 zs*JzSn(}OJ=>D@dQFXVb{8XLW9!K-Kf|8}dnvrsf48Ms^jL3VX6O)vTOGnzSp}|g; z88nyA%{ca-xlo_4w6oUl`QJ6qD(N<`DgmcvYd8MDu!-3uslYcz&esfag|^^hZeNBA zfj>d*=Fu$d(G2VQhx~t0W{E z0dHMqkMOL~_cQ&}e2wA9O5J1p3{%e+M%f2Twm(%0M%7jmyP>q3fuQUF0nZruoQIJL zKtPbo#fxZ%_h2;NLuc=w-vXk@Me1;uM)GyD5Nv-<`sd|(5 z@X8_@9|+_Q$T7$no<3{po)X>ZsPbu65>bh&oi4cj2)uAnE%}R0D&`Nec7}?6G0XVB zF#PfWX!Qn+F_R}S1=6+jMr`N^J0n7~th@l4f@@b-#cnLy8M__xhPPvOi85c%{F1$v zZNDTZK=|YT;`uJBj;=(-=A%YckDf{>y^vp99+m-~!A`~O2A1$to|PVRv;jC$!Eux` zY0ap>qJ`VBiqE8uplq(o%8a{iTJ%0k?K=J=q)c{3QD8ZN)i$JdS(gzIZ`P-K2W zpjDOFtN43656}8K_tW`)BTtE_i_3@3RIZgJs@&z(TBBDV+ua(X8+|=SJDc;LwjLkv zudQQ_kD)}DKLWlTxi!XpvcZbG?E}SmK^>t7fV`Se6Km#Y(Aqa_meDNyK14_a&ME(` zqfpN6R)TNQY?c+;iO_Gpt9Sx<@%{)g4@b3onkfRB zuy0WWUnsR$iT(^(6*a}}1;yc>!3&%b3lujV&WNw1oSta5JP04tbZSE^`ND#Gu^C+`8LjXH`;IT+H0=jZG}6Sf=WtpHT#HD8?D>+ zb~T=CMUWhdV~9~#^KJapti8(-qI$cF1dn+V^i8WQbc^{k~K*aa-1G(?!m-<*`-vjTW3co1s zV%+=3H2&nm3D{1tFqV69=?Fl*BHO+~f`;#c6iGl#XTRDZVwRz^i7>&tzR#)LPK#)} zg`=44b_Dn`I|4eAtzVU>y4YzZ2Gjp_drU4!E6NXPdaw~x6PZD;TDl!Cb4Lx!3O<$n zfHR=U4ApqCjzs}MqxGqIT-N>BL5W2qoCD!;H{iOD*#4X)AduspjQI3=%4tbKh2!b=>oRjz zmQ1i3?`Nik@13)SX~cx1Hz0Ij;ul%O&j0M76eYs>fbrAgufZ;X%^W>{l->mbBn*SS z5oYtzCeY);dy`UX1n}RKnrx!Yp=6SA-M_7nkHJ4%s&=FJm(iJ1NfL|qmc#F@WY6ZM zz}~{h<)0C58yq6r=vzt_W1jG}`O3mW6)!%NcAVV!>(76nv3`ho8r)&K4_^ z6BiZOQH3ctqe{Zj8TxXaEln0R_VblDdt9S}?g!T&n?rsdKn8fEOT%i@n2)c1(k)bXFaxJh$O?a};@OH*h z1K@#5OB91rpH!_qt;4MU!#A8DhL132@ke3y$5@BZ`U$-P^IWO1;})x`0YBtsuTot| zYZl!ZGz|yZ~)8$(=R4KeiAl7Sm)C2zj}1+m%dt zg{sA;(bJ91ueKiDDMphjlWmnlJ9_pIvF~X*cYO0H{7*Bc zd^}Q`0cHV;%H=dFrXb?Jox}OVlN$Qb%l@j*aF2tDnZHZWe6-|GF9L>jFGXk-ir9}s z@`5JmurT!j8lfIwNu!iDjghmG5m+Tm&FSxZ4K2i}UEUfq?HZ#=gTI!jFhRr-uSXr7 zm=XCx!A^?{PMetl4VLM1DZDM|#g0{k6hCSADK2Z%oP*2jyH$P{nMpC3>c|+)M)lJe zR)mHRxi7utG5q8Y*P@#=o}6^>-0R08&N$z5KV@2XsHTwC-}4Ta)7Gl?Wo|iBn<$0I6d6_y zjn%ldbPdxg;hlWhIRjE7aee zp*JOjKh}WWQBnTP(-6+di~Cx)CtrACjjyH^r|YLodl8Yao+)7rDAEJPVHL?c5~^fw zYU~|^C(NfJP1U4bW-)Lq$g<5Fb~C6bf%yt75W-H~F#gc2;1DRs-dFdgqMbpromEi; zSG{LW{tKK1y_`2KS!)Gps?L-o-Iw>)wQu1h@i!FwXB^}_xMhDZd>n>;%7EU+DwsO6 zf5QAD7`Q+NjqRelQ_pS&1?ILK;e~-5sxA{YL3!4pvOp`QCvN66w{WBw%HPRHKyU3$ zYTOk{p`7sj&~Fhn07?ikeZ>dj7;)WGQycjeb5`P7=?`SgiFWz~0|v*#6O-Jj?}(Wd zj(Ma;hUz;W3y5yR80Nrp7o+SOoH@#{e{f=^1w-=Md3>_s7#&1l(?s+irbY6BW1vqN+o#)37FP%SF8EN-~N zlVkapb-uww!u?&FJc0eM@m@g_g+KU(Kwb17b)fb1SO1$eTY86)m2UZ%sg4*^a!E8x z_OL>(=I*7fwVV@G=_S8V>1o2Xob|;!2*mxheoOD+(R!0ss404aM80p@J$vG`_R6gM zh96zIW;K)4cl@|7#Np@FZxBj!W}?OJT4~>X5ygjuzyGB~ ze=|z9PKZrA`)jc(Uu7)0ocp!Q$M~LqX`LOHk3@!fc?`ksI-NfKOXCYK058G6o<~gE zrRn8|P|CB5*>N@k_QowJU@>nKCL-UStdzfxx5jJvVBvS;c(Qk@atEXiau#Uzxzxnqo#F&n|c z)4hl+|7F&{-VxH?yn-5ZmCp7Cje{oKnt62LEF{z5dEh(!dynw_=t%@+X@XGK`!m7K z)M*5>F9kN8^dllHDQ`7copQRIL9mFz!W;V&WkD8_%F81Vkj^7UKR zLaL{4g^Q9uiA=qFe%MMH7PQn%pe#*81PFdV19}(L_87;W*TPYwE;R}BmJCynGQQ*W zbdr~laYYT=lVNBh^wEzbziEdZSIOMiOEe{00 zWs0}Z?0Te?LM!&GuDe%#aqnB!?+}zs%zulUdq9`=(*df79;)`MCC3_E5MN)9_;t%f zz-g=*dC&2K1FjUxBH=^y2#h?+qBvi7z-5KmTjb`6prfNGiT3AniE9Xv*~6Au*VPnR zm(R)RKGnG}bOyp6>`~7kSHNCr;EBZj#Pj^lY5*im;&FcBX{4*=A~xu1v@2&{wE2EP z8PCUm1J?9-oqv0;PSDDyH$55pCFoKsWt_4toBq>`nYQ=Uo(aD1^dNwSDaSTHU|u=) zwB!`LHQKo%Db~Gw(<{iCckA^uHQ4pAs26m7#MTvXon}-6zAd8nFs<@#9)?4vztv)f zGcI`{gC-j=>^L(`y3)Z~p}1}E(&6;fb&5M&vrJt|p%Qq#SC=WtVoIReX8*4kUaD?}HtLwcncL}cywu>hEl>9t zP~mpiP9(EE-EmG=1@e5)JaRU@JEMi4IhQwoFP2Maz~`sVur%=Q$b>g{%BTH(R%cEp zz0Q)1-s^>(QQs*ZE2IYVnv9}P?*-iK&_JP5S||}Cy7%1Ug@d!FSG=nxz;xC2QOxGL z^qaMzvoeHciM!m1huvkaeL-xqhr>dN=b7V<^P7pT^INLhWUA9Wm@CLR9R@P48FuhU z@f#gnGtr$s24Ww+)3suTSl_A2@Rvpe7PGD!0>O?T6xDHMm}wM7$?ZI&*Z`m4x*O&Q z;`Y8F`+emk!?f@@;&R>y4T4A_q(bEv(u2Syk!5G%wO<3s^6Baf-H&@Ul>VoQiIg3u zhh}~r7t1bz>uqLFinkl`vw;e_-n5^yHISNrdWPwkBwS8yt1D^pF0my#ZzNPfKW33N zIR$9pEhiJ^&EEGcoi!?ai#MqW7io}k_wUccx{Kp*k(f4W$qM+Pw|kR0DYZ+rRxR zezUk7e91UlUG`}popQ}%t}@d})GOG}b!}ds-=fp2i|jaJ$ZWhTLv3ZyZ~CM%~N;l0IpzuAXAYWh`#`aCsjqjCSZdaxVv$r z8VQjAP!5CM!Hx$y0gb!pypR1>9k1hY)IrVBDbQ?e-9}&uhngYik{Ta@72<@(&}?wk`ZSLd$g5d_7vN7gWlxfL2sS> zX(TANI;804kSP@LWHoI-@CrXTS3BuGDB=YSthKdSDGOI!7CJ2-bA_ z`IYlPaW1_U!E{#qH=IA-RKbB8dtl^;98OHC5#hnO|8|7JI>$g^1Cjb?I8F(6zg@Sc z9mIsXgNh!n7QzlVa!$NOR0W|f6@-ZM-MqC$lm4392I@sw`j=*VwJrad$kq+vOqFxw}ZQz0|#n9 z-LPXf4&t?Rlz$}&fG6j|%Y^^k1%Cy2m==HT2&jP(ymh8!&bf*jzCVW?a#99{M4RBh z(TgAQ9dzGl!u@w0U&Q7zFT7;)cU;CSvqM0YJ1-4$h`##*i$m%iM%(# z`_StSjA1ACVK<_@-K1q*%rir3Zd2cH`c8;`pu?as4xi4KDp4lc{*`rMYO73}w8~sn zIySYY{G_~ZR$EaViPfdk?Yt5O`6z3bZm&U+!a7e_{?R zth2}62lkp=uD}QOS!ZS$HO}2%m;ENi>4Ea_Qg<_Gz(tO^gQtzwy@_hQ37zY=%Z>^e zrK4?2vUWG2|V`30R;`<7g>?rLYe8w-pr@;qwvox|utM zy>HmKC(f!f-@C}_7Avrk<-Hi^f6G3d+;Knb=FS!hdyFI8s3JWUCtpY0h=V+ZL4IZo zQ<0ni<8>ZNge&OcTd?*EFxHl6ami2aGpS1Ve$F~zZp`6wNOVMM`RP$uN-3&c7+3^ZPtvTwvi)Vc5J zD-VaiNxgavh>HM-lIe&)6)u~k!OLJTBGuw~*15(vYApwIBz#2Wcn1}$u} zxq7)HYUPLJ%xbaa9K|S)VjclfKSaS~$K}Zj+|IHB6KMEnJgF6vvs0f7r=beE$z+XL zxqsoN9E-HLv18hxTPe7ci55(p}>8sx6-WrKTJMA3O^t=!o!YrD1 zIAA)FkHl*N@24_HO=*=sv2_m*M$39tB*l)sFAkiUvXV@iXzUQ44sZ$G8qQS`pFVci zX|(*geMrgiE1%ig;pbB?^KRF0N~Xwki@fJoG1vt5v;-JEf16}paaU$fkV^2zfI740 z8)g3lZ942X@~0ie*02MG3Bw!mYGg5ds8zH#R<`kz$)v*rYoi(pVadEmAJ7X5=Rt>Q z6yRA89h54S7Du*rbV+s1Vdd8!eLjN>_c@=xd}Lp6n9?Lkw;_{jG;vMIp81gL&m7Eh zxNOMBNPp#6WHG4dyhgbQ3s1h=-v`4~&EB`%9ZeFF>(UsYIAQU#LbqqMs)bXh5he4zbhbooap2DkMmAuwq4YW5s z@1=MqI@y_I=HFeuqNA{()X9_z@v}ls`(LEJbyOTp6EBRry98Mrg1ZwWxVr{-C%6YE zxH|+7?h*(DcXtgI2n2VBJ0y9Y_x;Y5bMN{7+ufP%sqU^W{Z$Rvbr&KNKba_b-N$QV z(LFeapjT{1aYW1=6=4Zj>kr&QN&K_}yUYC4LQhQ@ZbT2kR<4TJV;@YY-km8e{$#!V zWUe2Bkmom*#(^sfZ~e-R@q2AoK9Ll@gn6OE zq_narM+-k6#^jS6;O zCw&^PAM?(MhkkxXSNyX!yy_(pYT_0SgCYO<7O0|U)mhnp`5O&lxP>x8>s^Ir^(SZb zIT6{Kg&&&!tuB*RYVG+-miiehEi{PiN>}3_H=}#W*&@SA9WG8A$2MMPtv#3EseTtUtkzWEvwHU@Z;ytJ+ zHeYD2Cs>EGoJLYlr1FLQ$ z@)N$ie$X{aGx2p4y2y9#jY5-SB^Q|ZPDL84>&?p$xlwWblB70MIS_kYr&!jPKhp!0 z2&)WCQ|vbs2?7|`>aCvZA9B!!&L|WQ3|`#=1xd{rtQ~RLBN%}4BqE-YUXi1Q;=Y&j z{K_#fIt&yH@Z_&S361!k`YuwG+VD<^%uD2FNT6PBca3J?UR;8X#LiA?2Md4>CCaQb zIKE0G$bA8Azp6G5FKaIu3WO!+^C#0R_%Bik@+Ryl6z9}@I>*nZ4`I$i7TsknSV1Ty zf_PrD>UfRxx$ie3T}u=E8FYkNAXe=C)WBk*JbrqHWN)RWzQj4MjB$q7VDM zOH%kNqlo4<8qu9H!*@<9uELAhrb6{Tk45x((bzT;v$ZW8=>waQK_KiQjJXx6fBjgh#Cd+K!sz`{tbXsxIcWeuJA+f2ih)_SOvuF397kEFA5Du!Zzpy|eiIT>!oSYH; zXO7qfOC>uWKxx78yyO38iJ3d%E_+0^!&_+qIR_8<;fO%O4?V5^aH;*6@&X;b%Plx5KF;rUmmfzhbF2g9sP&G7K3K>h z-o1t>$9BG4FsBH=Sgp~6&1VWtvNl>KJc?O`zqpl8TjSIC&3sEtfz!=_g*|bT(Q9H* zll|6*oMLe1cLWfb=C;|bB}H?g%b1iLtsZefw6vf~t@4W{aTs$h4w0nj39?V+-$l+% z{XO_MoJ}2CefL2JzF{a8+rsBhlBF@j+lhIGKVza4JL;eVI`LFSqMtB^omDU~`>oZr z`^>+M$4uQdB*aU6mjyj0(p?49ab%B#Y~c6mWvBCQR}{jHcQPOWOE!%Sc<^E0?raoy zhN+2uuly{Sgd`yhcWt)2XX6TL&Kod!2czZZv zYMm!U|LqevrKy8OL`OjtE<07Jp3;R*e2{M)lKj4aJFT*R5tFFDH4;5uXwfGgkzK+{o%&p0z%I~~V>Z%yW@f7SwsRb$S0}%{c&}hnihvFk)dWc4!!b=Y=5#tsp z$+Rsl!uFX_YLCQz;O5`7WuWvKmmxkHr4a`8sH)~M-Bp{H7rh&?A&7SbDsR-Z5nyzh zK3du6SsAf0NB4=wlz?O}3E{O%(&@Y9bXEIXkuihiZTGBl`DCL>q4~c*D7L7F`}F(H8{@{)jRuCR}^sJl|R15iHZ1lCog0^;zlUOsX)D zt%K3l`6$$df3-Bbsj!k^x1dlfzB}xz!om19x8I+;Pvw#;7Nq zqI0{VBfGLot%k!0BIWT_TyauCimr_#dv4=_pt&@oD<9$-oTVaf$O!dsN?6;{Kv0QQ=FhsytTgoR(g#lqJV1Tl_V>AW(1)Zyg8b+`VfL z!6CUNqO}{>Wzl`kvpr`YBS-%LGRy$?6*tYk#QZ^}#7#YhQ0<_M*@PSR=N}d6ycVf~ z2GSC){h)h(!i$VRuCl>^xju9=k#0oZkuI~E3lT?kT8<$3x(J(n5iyIQ(Kn_P+fhlR z3d2rD^AC+03BOrg8`&YKK8+)gkCRs!a(OygqDrr(Zw1*4y=$KHw{4dQ9(`eA4DpJ` z@L%~_0?XYx=Z8ZFFY|CS_en-xGWs83n*fgwn-X7kr5A90sewdeB*iY(uuU zeNV7^Lycr}mdY~fQ@IqS5=tciGgt6@5dLUE%=N1BGWq-5o2_eCl~i8he~Dhj&-AK3 zP&%`6OJ$b2@i6X~Jzx~o9=q1ig$~GgFR9i-Q*fWnGnGX@dQXVl_9fjd*J`OFQMR9B z)cH~TjRzAa*cyT`Q#3mCtQv@2rw{wWh&Q%JfFC}0TEL7FMJ8#hN}}Qmk--F%UbC(_ zm5qTJ|J7$?$F*Xbn(czP0oDvO%4d0g4K#B1EhGJ+fVJhfb=AhhXNMsueVA6Jxm~aR zB^0nMcxzf~4`b=%NCT&}*=y7s7x9nORSmxBup3%^#y4$FishIW5o8AEy$X4cr{yh*|{f=oyQX@AKlZixQlj+>hp|P~vQ+<~st` z;*!o5Oi@$;2Pk?^2POrpmW%O{lHFIa+^RMRx;#%!M*@a=80Pn>#9xT|5ecm z!H~L+9rhKx@uKd7lHuJSEn-Rq$L!2zHO^Eim9fP)(?;P}O>JLW=_Lmb>cPg3jtRru z&Lk91-=zor%X!gY=I^3WNeMF6FDw^5&PjA^*T$*eUpUPk<0f&Q$WM6!QLevM<;(f_KU`V`XY^ha0`NB0 z6E3}#k|);C5T~!}0^0=IqJ?GdN`uQQN){>6@8pWGH|O)Owu@eCcKQ+-;;!{qs*PT% zu{FpAJEI5EJDvu?A4ov>x&%Bry@n<41VgDW=cTe*h*P627$)y(G&%c9er(789h-=a ztouE5nOd#PuCgnHqdsle z^2dS7SY;k{Xe<-+&R-kZ?=*r%c z!edFzkbuQ-7-)Qd)m|2vVlvuvJVT81zCf$5aX!E5y(s=8-;TiCrYw#Oez^a~RTJot zS~5-&Yp;6Z*;Vv?&n6Go-0p$A zx8cr*i@txn3n>Zz^BA+uMN8Nd5{3`DxesE=b~pJsf*14=dtE5WXCEl-O>^|?8LS+Q z`fx-%Wm60gzR2NCMmx8$7);U&UH76&=S9Y7)1g9gG9#_pZ-urlZ~~^m>{oT|4P9jy z$+RLjZC?|+6+6jJI&q^wCW-8*p*IxLk0RV_ed5qszu41fttuF&Gmc!(D8)4!v;H&V zN~AG)gffXPCL%tTNF+wOu=g^9s~W-W-#{I2nKT%dXH`WJO4MW|t{ikAW>qpaLPXL8 zc}H93MA-9s9l8r=s&Y$D=L9%0O2XWDF$^af+UbndzoJ>yq%&oR(s69RP5vH?UC{mY zi;v9aj#giGsOsLATKeJrYIq4BZErHIbWxGE4;Gw>&G z+eHAPIZVH!IdSjk**b2~+r>+}HUtzz5xOK8#%b=rt)paf>kx~1mjb)OfG!E223j zt6LX2wgCTUl0)l8)eCUdfuq9Yv2nSYD}Mi6`0v>}Lvedgq{@;IQ5I=5@RwD^4US}W za-`0pTzEC6`^4@|uXQ1@jq5ohJH>Uj{+TKZOGhCkzgkLz3iIr_5fu`31uJ=|SL+!y zH2I#yaMZbvCc^28R{bkVOpXl5Zj7O;y3(R*L(bZ!)`()Xg|vo(93~)23)y#>qV{F! zC|iGxT4h7c(WqjgdE9*lmsE;e;W$jEOb#(5*QBe(m%E)lq0T941OrscuN>hA3sw4|38%BF~))8lvYoEYdPH|D?7rMwFdMsqC_YiX~6?*>37b=S(>bS426eJ}MU&QTtYEdaTT7t3+8s~jJnyAgySn;wV ztt8QW(?K8Fm=iU8Sj5A6J#$2WRrYmURWspWhvIKc^R0yc>mz$|@Q$HbojVG-a0=zu zh%;s^WcZWT&9yp@Z|V$jkgeyi7HXz>_c#Tg=$sy=>gfAV&5b)sv8LcYpok}P_K?a3 za}(Fv{6p{1It*-hHdGk2p*IicZ>pfC7O-<<|9%0|ZgZH|11NawfBnxt;Z^9Du){xt zpg26u8qQ1k=uYSOJugsM>nLTMxPX@y`Q*gfxT3HQbX)MH&1rm~RaiQCbuXe`RozLq zdsI1XlY=fo{lsbrF-d@MbJQ%X5#u8sZ>S$O9{qO<1RygRw~*f>Y@&n*FdTMq(tfHq zT&C+Uw5{#tvLmA?gWb~8;`Gf)bc^y4b4@Czb6uSo^z*`Eq?9uG_R0w{c+pc|yhd*! z&tS+mJ8ta&jsXjMeV(vE4pAn9fD17^YT{k(;Ed@toKi;}?#g=Znr4ah*=&nnt8LvR zYc_#d-LK)JxO!?2_5aM1`UB6kKrO`IAGjC6qs#v}=K!bQ*9gO&8cPAazbI@G4C_!fCv;V{_WD5VVPb}fj4PP0WCI%#Nnw9AW3w}Vu3zvz66 zPQcAVd*OPTCLXtFQci?MlZ-P1+#tbKWU(l;yZz?-aKTOni9Db zZ-~p=J*v0$X$zU~Zhy%!1#*gMe`yN4lKqZ53Dg34%qhf|=*8b5m5?2Lk=y*t ze+qGyVrKITr5T*i_*SLFsXM|yZH{&V6j+i(iDTN1_a}mL z{e4Q_>%i#x=9&va`T5k_26L@4 zDPp^&t6#W~MNjS@`$Fa#0v`2)rr1%K8ZRY@TH($nq*JCeEWTH-pc%b(#zz5jY}H+a zkYMpYC`Dm-BTOw#rF~&jSKBy&ByO`<{i?sbbZ)qEw9fXeRTyKJVJWTZD6h9LSFw&!9Sd-2QJT)S_^UYZjnu*b&qOm5hFS~2m`|Pdgj|~M$~S< z5gn(al;Rje4~@URa7#P;s2!Y*S_yn|fK_lYuK|7}jrxp$dOqR1%{nR*wo~KfT95h_ zob=kUaGa6yuLH_x(AbL(=irhWj7{w}#NIz+hRZ7iw7MXYwJc_|6PV4kaM5sTA_M7L z6$wOUkyH$u&G0;o@mhL9@+0Q(g4n@G^NjFJ6X^c#n=>@GNHp%>Gi-+B;A^7~etRm! z>~^emq!@oWRl*i`dtq)nD`lIUsI`rpr>*dqJz_HYXQv}P{ky|iE+ub&xR6rbt{7rB zns1)J-4c~pveXf|zabB{kdqR+ItwvlUHuNrC;CN3wS@-8OoqL)zw87=GkeF1OuJaToIVQUWmDP?A+XOkg;EUs5mbUUI|DpL0vnlxR^Ae0ZB_3rw)t6k=x(6u6hoop_`;C}5 z{&Ujd974T9VPB%`*NzA0jWa%i*#Uz;J`Og3Qz(sccU)?LtSI=dPD{)9D4TGEB7{HV zCMM?W85O7b{z4xXUv|&AFsrCY))7_@{Y$D3Ycm6Rhe{s+ddeN<~xtQZ-`L$a6t487P>7MUx#0?QLjylz})WBs1KtFGzuPop0GuSkDghI^i^5do!|5FX!xCv^My^vJoQxJ?Rp4ePTT4FuR0B-><;8f5AW+EV|`oJ zTxpL9jz}ETJR)nyZVjp_^M{~Vm`B$^gmJz0$gT{SA+>iN+ev2r_hW?mcT1x=cORb5 zs-F1#Zo8kao=>lHzFl20J>FgWJ|7i-U7B#14s6x%fvjvK@7-!ez1aT1Ku+7vzI#+t zCk5ktXFaqZwbuge6NxE;@gA02*l1;Dmr504CFgO^&G+ux{rK9o{iWG$(7(efe~Nj@oGIKko#)(28(t#@sNbg_A7I}sb`lw=QGs^= zcp1no{|hkt16bkjSR7@72bq)sPRl=dlK%;d_UG1gaJ!4A>*2LwCZVBcvCUavJRacr z?hgrvLRHbae8<7zE3M9V+1TPgs}`-rs~zqxD6!t?pl6b}TrJE}Y<(~E;>FX?2(sFo zEtlsa+GB~V5Lq!pKJCQkvj6_I&UfImx3|eHfcjj!sUhiD<70ZHyxm7~2!m-%1Y;-2 zYBc?5R^xp5Ac-^o!?a*L4Mx2riosp4)fs@VO)Cqvq@=Z(V5o5tS?2ENPc}3i?G1aR zzFMuLvovC*<+xMUfpeHNpkFAni*9>Y+a7FPEJ{n~4kCQFVuiHzV9Bw-6mQ25N3$P- zItHx7DA@J<^PT?M^B2FT;Hro3-Oqa)+cM8L2{{ixs0B~M0|OzeqGup7vCa$8ATtlo zaRR+d!U&8$?6vCZn3!>}ORqPp?~-0vhzTF4l&I&nYU`UJN@+3EOiEj$rBR4^iif`= zDzT=8!q(YYCJdb%kZQt)N_6RlH3#e~X@9SCL_de)-R*q8%bnw=vEx^dw>eL}%lc1W z0BCL*d3%$7LYppx^m~n_LekF8u3iB|fv8XUv&9T_sqMq)RC!wLiEn2 zZ4`jvBGc7kUyBUkbmden!B{b+1>m+cF4<%Y#*8;Eqe2X|Yy`3a#ytS~>~;J86n0vo z;PZ>==@Pg7el&yRZX)z+x~!<6xtHa#@Eh=P{@VijoL5mbyj;~MBWz7Ibh`LuenyM1 zB$oPp6#IwF_Umt;|u7n zUwTbBO1IdrOH`$s7(y16ouRZa`*OkLlxA9}8|a5?LcYD$pjZ+fMcC!t3}mB%Z3cRd z-fJ8ad-}Kf=xt{8l=&cQGwFTvkx;*`ddD@IB6znquC+0CPUoX!l;g0P+;sev0{Pv_ zJa!LXQoFkzy>lm6lQbRp(edNsx99bk=TTrkhQ8gMNvu6||McCY_T4NgeoEHB#CY=t z98Q^_3vGb@0+v{_FM;7u5FjaGvv==*uk!eneT(;`4Y5 zD7Ui)CXW$oSniUE?Zf>TdfqN~Y~YcAMA(4>-(INsoO05Mj|sVwHNSR+=WOzG-NCO1 zHipAV3#SMp)79(IwqmL_JCe`y{__#s`tH7kTvgrEN0tcPeDX?}UmMl&bqEqD8$F=|6#RK_)b?$l#x1F!T-AtE z?lfwH-S}K>fLlcwC!H3%x}i{?a8;76A&kU8%jUgKb51}N681U;4XFr7_6GBz{&NA? zymY>I$z_QLUx(CWUII*ZK^^>!H@ZkNyepR&7noG}M?hd-`#oQGqs6LKohV++?M>hD zuzR6cA~?ijqzws31<2x4chLbkNg9R?D?v-FNn^g)<|S<1rL(x{k!Bk$gaG0WyBO87pa5jvDenL>&v3qI&4W&eMAP7PaiAZ zwtfV+lVrXRiY)}D5aEgqxf1)I0q9_wLI1V*NDiU_{}~5wJp`&w0ZxnV_iD0qAj6yG zpw+5+`&my`mclk8w`B~}1peptU*ITin74!>SZA%_>&4n?wQCd$_Iom%+t&pVpWXxG zu>P|v7)!25wCsL1Rl2Qa*Bh}@l&$7rSQH(WQhwG};CA2n0&E!nL%!7qFx(WJZxrRA zz`Bfx&$@wG)s}8hT2Lc`Ad`}tr@1^mHB^T+d*IRE2$g|F29WIqHaP3C{T}|y6MO;m z0b>Fnlfi#(Ec==|7iH;tD{m-bS--u~HuiYSnzna4+&^dWEo5d7lg_nQXb;j6(8h~koqhrS zx)PLO3?l)jh4q_FfC8EOLpw5bt;>&Sxj=WILWTVKv1NvM2d+44j3pCVL}Uj*DY_oV z)9Le#0}hrJ+TXuLyJ4oqTw{ntW3ORD{&$55AZh?3X&HO{#5vnx zyssZ5o?&}-E8y~LW!kO5!OnRIs!L6hSF$1hy@sjBP{8qOvGF-fLIowz4tem*l4CKW zRbjYG+*fT$YvX7)6Ilj{lefL}%H>+gHUa0T3cw`(I&g5C(~1Lt;r;~xm}LvY)Toh zJwdLvMPf3hMxPUP>RAh{QLEq#aU2WEMQ7zAcKe1>SyUG$S%fM+eohI9k&~vX|L!C5 z;~U+AI}(R7Ky@&WUqs8>0-IsuMb_~1h%8K*gN2Zz@r7;yswnZ;9&L#$tK}NXOf9i< zFlr1vD}E(P>oO~XRoR>RA^OI?PcTP<3`BjEfdCwOsuTo^L1wCj?4Tah6W4e~J+w$= z{N5%O2bskQiiK#Tq_`@Zk5VRTXKJJ#a6nCX!|cG~G4a;br8C!J*H@ARcp?bGRERxe zc@4icX5piQONs|d=7y_Tz=d0V)arrK6irRA$VK?cPv-6)t5|5pq1adHBZ+Y-U*e>~ z*i&r;q8$MAkOA5gS*=x@WD7!IUd*UehK)`Ed8izIHWIu{3D8Q@oCsSFbBdym1Ev{! zGJA~yhU6o>770*hFdPm9+{+1(9EM+tF^q%2?OsY7oFaj0gco#rG&)T4HlVTxSh~QP zUO?nL;=rF?0tx+akSk6ASO35RG%@3gV~z9_Z#erBN?@g^d`tSzukrjX@c+lrH&N%Q zf?i>^zlQmLQoiZnM?mZH>vCpZ5)$|-UB2;9gZNCZlo6#KLz`J1A>Lz3kvV@e{|LuX zGN2&qY%_+EBuZXC;68f}8+)h}tGrhL3+O~n@%jf8P>kf2(gWUuJ|Y^wJV7#WI)%SJ z;#g(44G4#U^%4BO_BnOOv^(LIX%Cwkw z32zY`t{KzTN|~X#Mbl5he2i!yR`%lj6yN$s*opd)_7DGH!hcYd9iX4E9cTe?^)R7! zqI1E6FU1#}c>h%k@PD}w%23VMXj9<)P|abnTYUnx8Dt$q=r7;HjK3ttZUurzBf;=P z0Tz!7ARS&l_JDB_kPMs|@ORPS#kjW3{4hA4kU?$%D*5X82#j5TP-g zB@v;!fwADqa)TB9^2L$B)f7+8Ijess^iFl>MJF(5r+=tFfDv}(sMktWal`s~rE?!m zxm%KN3@gstvhM7pCSiI5BLY~#U9 zd`!H%z#J*Czahyxhr2fF9IiBsAfDsd6b+@uHxaFx=vj|#+s-$q4ofEX&C6>EhsRJpRrp7Z+vAqVP-oC0;3KJ<}q4T>8Qu)5x*;4``MV_I1#ro~(J zh9TGpVHq8ZD@P0=bj2XKdz1Q2i9DG!OxhE;Hr|r)Pn^_K$JNZG;BH#5xMwYJcTEH@ zyt2lf(^&Y}$4^+4qlW)oZ>Hzf5}&5_SR)zIn^WR$1Cz9nbo}vA@zKE^FkDd`zP?$= zmCx8bEfBh@U%hu^HF0W0H`R2na#t@+tdjB9Ltu#^l>O^8jjIM7YkD^Hx?_nqdVSvF zxj6SvXfINtTn~l7w&*VkChJ5%HzXj@)&A_4MTSN!`gjNm{SrV;bbC^}I(Q$SO2g7y zgSBU1!>gQsr&S)F!<7(cFvJHjMN}F)Zy-ZBgeSY=y(bfCOxqx`s6i7n*%cNX4wN<| zt|%e(soA_W&PJvwpzAKjK9)TAT%BqE_7z(-@w6;w=&!zn3GI6e>R59JJ!c;=AGm&j z_dB)pl)D!GqASg`aYts6q)}j8%8z(_^}@vKW09&q0~qbIl`y$_&$@@T6QLA!XbvkI z)Djn_GGrvGZ46oZ8Wh7I=UA5E>f~Z!m?iJPP{9GaNV=r#Qsa^HW-qx@1ZjeHb!F0!8(kI|x*89invf=Sj6H2`arsVG`Y4lR{(g05DW9frUt%xnq8 zZOhr>pGtNp;G4z~p+PGG+HDr8u*MQo5lNLE0xNEy^RVC{ns}uct4!a6#3EVGz}EcK zA=)u#?qEW$$sV{&VfQXRsbp;)7lSd}Y3dtcX65<6|S;VX})qz7w;KyR!Td3*!EWYkpEZK0Y{= zvCRFmuk|jMM<{A23DV;}tN+lwA}AYipHlL8P{$%i51ya{i7bdoa7MC+R9}b?ME>#; zPk;xCIjY;1vV8U}NV87W747VU;ZW+z1WhnyDd|S|m9%W{Ja?JN0dW;HNyhcA*d z6f-}U+wEvAIJhXfGS3>jsM@H4^~&|qij~%ch$CfAmuXjqcj39htqr51B-5TLx#rWn zs92zgF|jO828}0nF9c@r5<7N7lw8?h`&CA0RCf13G4D*DT%#qt?b|S_IBtg6{aO~# zHW&fh+FuFG4v~42chHT@gawas(ELLU!D&KVSii5Cn9kiJOq%62x@txBdY|arj&GH8 z?d$c;DMwkF+DA|(cU`nDqqL?Gh0*(Z!q5U9D+%&AO9`C)3^>_7N!hcxj zq{FLi?u_HR6;`o+ z$K!+fIeV=H;U}rjd8ks<dC16EZ66y6A~ZKV8I9yf z?4;(WR!V4i4miUu@5-t$a5_Ks(wGG#|_HI^s#p@%%-L z#oUyE_@ez&Dv?fB1@-Vh4bN>uXfBn@bV6ogiH#n$8BG{L{}& zY*||DoT`KD)n;7zp0a4NIusF;?#znZFveIOy3||&f{gK+crH;eOJY`^W5|auuaYy! zdz|Fawv3!H|Cv|lIQP!nEl_SoGAs|;M>gC(lJcC-+C7oW03WDOWKp{!Cgfx!ONuT( z)Vvn8&{k`=DgVXlYFn`Uv@5+2BYk_5&mE}+w1pD7aFWy$NI*siiOJ=Ns$8@%8eYmI zWF62%Q4{FT54MSbAw)%ZU#I9_w|bv!qJ|Nqn`fy?Cs~AT3?9z}a9I!{JOz%NK~I1r z!mIdFsfzLv8R@Q7i{#NP&y-22wNaK%60i~!~ z97qnP-(~QIvchth$R@cfPnyB14Z;$sJb=#8`&I`x#>TzGF z#L@tOk$uF#Cj&b!Tz5D;iolGWx#4BY_jebp!V+av_L9IqA9-H>iT@rtqfR^9oZ`J) z7^}HIc>(fomhwY3*Pq(6a$OB!tiV}gOJ`mwlt?tSRn^s8x7s?HEq+(xz?>ZKqqV3y zToG(daOOKJcve1X=iL$&&Fpjf>ki$XhLTW|AY9E#|Atsy3@?1IOl%;^_{Y<1E=Qz( z!4Jqf&=0m)1!Kl>E|9%u^o063LzK9-et0SR2v~Bb!8W5*s*VnvRPLOH6?TweeOh%x zVGA!1{4-$&Ofy7>of1Q)Uw-+-;I=N7XU@j2TB#6C+b&ddGPu--85&m74RCoilNb!w zTy5Znb?!{kJ4(A;3=Iv`@m)+F*H0v$$~tC%_jk{7TbY`pICfIpk<7&7|g& z8kp$?TjByRGd7FOEYXdZIV9^gD9JCxV7oNcXdG)qwBX(a2C0pQSdFRxaC~(0Us>Mt zr>BLq1zGBr1PTo-KA2);R-DyF04aIl4AWHoa&K&HXoj7F=we08pmwVe>!+7UgDn)- zx(s;c?i`{%EAGFpTiipklzE@U10*Q|!BN3kI@HpZ^+PEMLyimk2WDCcD>$;L#{zw8 z-x2&F*ud$ffc}r64^)QNqKuHNKWGh~DxHdZJ6j_17uJioB?Jj!kO;_A2zp`%vt1d? z!RQHG;Y-PT5B&n(h{IfaWei^@(aDP}l_PIXwBQIlH43bWDo1Ki%J>N^v~A2)1Nj|b zW{Z=1k)Gqn_4W@hpC=tIj!kq1ro9c)P?}C*OF5men33u%FZAD;l!laM{|xQbMh~r) z2p%QQ;{C~gL$AGDF5l57uBJC67wq;&+#4-}L}4 zf31wlOZ-*UM2QK}q49lb9TkyMm-3G=tlA>A*bF&~7GETX#$Pa$%GwaYYT@W%tP}MC z9~r1D=D#>zSd1!*=8j8#qR$#;tsjQaonwybZ&ZEb`x9I~qNNn_CS2t zX}w9?IhXI?n>kdN=1YhiGf}J5bLQ+`9i4R$VAGVpL^Obt_J8;BJq))NWgJ7Z#x`k( zD1a`|g2h{h@drowUwy$raJZ8-^PBR@xEN97|4?7>B&Ou04Ah?8&}Bzhtq#R1gOGCf zg$wo03=RAtPtabhj}Oq0x_nM=m1Tk68Aw1mhc`AjqiSIn9pp;C;1vrKG~PPcAAi`u zA4xs{k@%KzP&Za5Ta7>QyU0kpAZEKeW1BSb;eiDdmJ-glavoxhD)%6#;g9LHB5Z+( z<2ksa4|^A<8&?rd&rgp(v%TaI6a+4@D3Bb$UUsoNtNi@l5pmT`;n%~XWey=@uvhX; z)ipI*MXq97iOnB?8tOanP%oPPPy&;BE?s-6*vX$MUmh;)5)4_nv79~j^MDpw1l4Hq z?B!x#oDf0%kjWLtYn~L(YW_E-YPZTKW_&pF0nFHEVCK9Sgc2pw68B-bq97JVajp+9 z%lHP#;fA3tm}m8of_J@|0z(V|m4zytH?-Mw>ZappfC=Zq5xfRo_EQBG!MGI*-=x9$ zJ6W1HDsMWI?_?pB;QHG7XC~w>3Bs@QP<0%kbHlz03&$p(-eQokrx{%9!kgt2?JFJj zs28y%Q##kSD#d|Vn`1pd{Hqv)T8Iwj<42M_1C&QJ%CXyHZ$}Tn###;GE+C~FY5|?DW@(W^}`SgKcN?%CQ?B`vsvsZ47*$5b*a37m=zo4nCrxe*W*R5X37>)5JdbF z;u(D06$f=VT&7k(4;X<*1F{Qv3~h&2dCh#^cf5E$TAdbj63CA}*j`^uXlvQHT#ci^ zaCDulYd*Qg3q#|h4bf;a_m<*LxQsS)jo9r&{jRo3V))ou4&urCyd*KBD;yNoUBi@* zvp&U8e5Q^})JB+Oo#p-yFTWvPAEn20`q3a4EG2vMo#7eV(M9;@xCdH~>cy>F_q4~8`deOYFOZ;g14-|Rq{82` zc@EngZSE${3mgzvF%|buPC|J;{G?wn{j8kq@s@UAh#`RbKwf4)f4&5W1vv)t^%bNT z;DrXl$?h<%6dIDB#2c;9Da0vlld}o!IVp$|AeQ=yo3}ok?9wdZo|JpV3b;NMnK^SY zrRKR-=+y%lt~$$g!y89;HET!y7faz~dIlfBQdqeo)G?MK(Hz;GddH*S4BL^=Df(Km z){Q`@4z%)?Wh;X3+E613YT2Qo6!rSRQn*GSGp%-VC+19*8pNr7yXc7DCPsXdc%lxj zlOke0GY3_hoPJVW)U5d-MQHA?MHmVdb4)Nl%()=c;L--+z@Fl^^CX>)xGsMVP8I5a zcWt3Rde&@^m1|z#i^rnW-UgSaK&=QD=zSC+UWZC52@uDjC54gN5P@^3guI7gH+EwY zF~o<=q&Mzf;bw2>V=wdv${j(h@pLC>KtCv0Pqs)>crI3D0xpg&hVZ^de&%hURzZ(L zuXR#!#kPwfM2rmjz*d?0eH3xbfh*D0*ZqSXkrwODu-eR4o_7sxu zShrR)Cnk^^IlsDa6)*HO7Mk*NASppQ>AA*Gtd`RPZHgLvpOd(i-en|5E#geX&Gbt} zXBF8>!6fl_6vjD!=d=RJ>-v)q1KO(ymYW=rJt~8sM5J+KximVMuyBf^^)`N~Ne@Mw zVAaDA*GriIFIlEJBY|K>&oiWzCz#3*M!TUvm!CVHix}se-x>ot5OTk>UZ4Qv8h`a={mH(B=%cv0L?H2TP;$e{a!Z}54Y(}rV)!7 zSbc7eUE~o4uPmE3MKKFm#H5M@0_b4B?@t6mFyGFas^-@tH2dsP>zI~i>XahNpkf=q zb>~Q>^Nbr{?~?S*IN5fUIGl_3{NZPPeIGy2S+L^O=nYSGbMMfEW}WTN^r?%9ZA=hQ z2QGBb!W+Sz=e}{4`~U(c1mPqWF8(FM|`bp;EaL2)+^=+jM=jeG6)D zJ?kMu3d10Di!N@@fge%VV_4c|gnH(3&J75VD`3CHk_8k{2L_pEIM_R(}#T9Whs4hdOAw%nPsMOG5fBc!Jz8jAUw9x?q&6Qx(e5pmu z&1WhIEzuFHI=mPmHfgO@dWFGls`|zW7HC6&S~C?djoQC%ydo7; znoBO#c1~~XVsv2pnp@t8%$aWN4uNnxwWMu(K!&f%o9^tI0zX^OjyI)lHC<$?XFaZr z&ZX`o>J`ktU;io`nR}%4afpnsEY@D+u+2IeT&-q*XvB?K);}S@xz1Qgj8E`2xcT#D zyP!XQLv1}Q@Y3v`g=i!X<>NUq2eE>|AE>4p-~uL?Z6G>_3baopC4yr=NgI z%vQhWcC6q0(gXDL3aX&;wY;ZdS>~eaN1h^K28r9S2SPVD&xFMXgW%cenm&sD%5Yi#|FT6lY1t>?Vihf zGKmmH(r)34G775!dIzFZlPE^!wwsW;TV3Ctf#fEv+1wjW@$xZ-GDBb>gaUAN|= zy^V5IMG1DcCeIYPI-ef3U-@*vYp5`hhcKItwRz~HeT^ku(G}&7lDp+b)4llS+pErY zmTK*iX#q~x(9Te~eV0%&t%i`6Qi9T|&)dx#A6*Odt)Zmm92)tkW*fD`Va`V*=gu6p zB?M~})$0uD>Xr9>x@&?cep!%ErMXm^Si0tQ(q1S10=k3!ImiV_W4eS#jMgn9c9F)P zVw2nVQ~e@p+wc}$Aa6}E6`Kg+H2o2aCM?-g_0%S2ghfe|T0$|}om?Jw)~z#eBvON7 zHHEbYSevvM+ejh%KE`seXASjYitk5DHB_iO1v;|j^D_*GHz4=-?K7tj8Co&`22l0j z`w?tk@{JeQVoi^5wl@=8-qkWb(2{54w~^kU4zuLiaN};}U=)j*s*bv>qE{yuLdz|7lSg7Hq4)F`)dfue!Imt@YW5 zEP{HS(0LHv5wKMZfQ1-ZKR}@J5dN`r*t{0)W0=yO-OWL^Q7#0L#t`9kVB%!2<4hsr z)b;mSTK+0$W%VzHhE}X{u2`pgR?vLNaFODGo%^EA@+BoL&xb$WE|Au`KzdcF*A<+f zp0xKrXnV`3x|(iXFhXz=Jh;2N6N06#loCFhr!k;(iuiZbrx^PGhp&&bRaF$Z?NSZ{_Jei$ALY>9 zihWql<08M=R_;ReI(eh0xYbHOA+TlJdEsGhi5PX}Qa|C%lE0S8P)TW6`=w!(++Hyl z*dbi?04jUf3oK$dgL0nI9GJyc9sSHQk4hH#<*#8~$J9DnEqXaT`73Hi)5yJJ@nyLs zJg284mELFb=vKmeIlqqu$5y*oXZWX5n(SHPN$DRhQ0CBa^YPK^%xpgsw>gbSWlKH} zrt}&I8OPp949kTD)}oQwjB^pQZ&X`SfyZ3#!vqO$aBf2QA7<%!gdA2%{zASzb|>QP zbx_uOPm6HWSFZG2K9y*p;Rvp2FcY*{{dw=dz7}8XWF~av>ap5Z!%3$4(uAhwfLmp; zX3r^K?qUs-nuyJwK6}JaEq($+Jf^@#C~-XSON&2Z7W@5;!qNIyGj!)lnw5h-mpK5d z?TNQsAPWX|a3i#6-3Md$yndDDmo`BMICD32h~2?_B1A!jiwJUcfcq$JwqDXGbm|e} zOIfB<3E|!(fTKAvl7}<_-$Jr?Awe~WHUA-#weA4yi~Nf3T0kO$y<78Uo0ou#o>~Pc{BV zNwsdPwI>NU2~)A`@6bc*n(~N=e=OiUOQow1w{s|Ogw>m=LuwM}Acoy%>8XLWTmJ#% zCm{jv@G+=(EOY~3H=*q!-o@f(Qcuh{iEy1)Va?}&&QA}uGLt6y^23W66m&ck$!p4r zoYc|DT=tFFxS=rD{k2vUegCOllk0rIim(sDxJfO?Uk#|cw&G~AD(K52ny5bH%`<^t zK^Ny)&{m(i>vZ-Pc@LktEDG0{oe!$oK*It4ih} z|Krb>AFq)OF*Ik1P`?)Gp>;;~&wp@gu}thV$v;jNki_8b4_*@Iw_yA|ufR=5CX`tF z^S(vsmMeSa^NIDC3K-tD@YkUv>J~d;<=2(+)i|pJs604l4QFU>-1PXQPLE0MnHPmk`HLRP>?SZ|{;irM=PL9r*!IxMdf>bT?m=wt|PpXE+>pLRBr zFmA`JDgd+gsPuzh+VJmv6a*M#jmwtH(OCR8eUe(;ciU}X|>gY_jxbqr*w z-gWbK`XlV`47(Xe!}>0OSJUG~%@t^d5GcP-*7BGJ4SAm9&Py9yo4uSrZ>>O-8eIZN ztBKxmnU%ES87`=eDDsWFN^+wbv~%6rib!ul47iFbJ`Lt-GT)ZdCWl(pO8-V&3V)|Z zeJB~P|H?WK(VO`&-%3$g5bkHb^08-+RdT+MAFX{=ky*1VN||2qj2PhbJ=HtY+qaSN z%;_?rEp*z(&vJcgUoXz~90}wT;{;;Nu*XI-0V;jl=ksM#FWASSYPtXT(Q%8S zQV!!_9_Omj{}Ru9nUWT7Zv8pfQ+z%V6nK$1EV1OrYmoikfh6_RrgVI6$#+tz97!G6 zYV}B6IXF9WsNjN7%W9W-5uaU@_t#re#@Bdojh5t^$%fGpWKM8lQ1vhi+$-GzOqMQ7 zp65Vs)!+V`_pQ9BveMiy%8_3*bZ~f(!j44h($Bv)DrU3rfOGv?qE0>at@fKr+-r4M zVjAuvMlu=t;FMT*c*-Mc82~#e8UA6lh?Yr`5M+v3@ZAbV&aOh zTP(ZkXJNEVrR&7kX z?Y43S8h#gX=1rpB zox;dBl%)@ltGJL$pHD`hCK-q>Fm@2j%ZKRy+z0*9XCOS6>_e=_`j8jejQAaugH7p6 ze{=Pc^godL=GyVre^WA+uBdC3i65n` zjXI|4J{UA2RX7AW!I-PSOkzJBh^Fy!IJMBPBrk@&3`T>Jt;#FGm0iV$zjvV~`Ug92 zEB}XZux|UpypwYr5}#w#UJ$Uo_SIuoj3x{iPRWz^fu_0U^M}vBwj7FM{*tbgqYX*n zd2s;&_@~bb9((l`M>?Xk*mb(-Wh(+tWoFTZNZGc!hwhtnZJ!;po+fwqrtL|LVbGLV zx21D6TQUgEa)CEaa8>g?yFL;mCe>f%2n_%^(|N6bpRQ%@1y9c+-0FxRi=GYIA6aRl zUv@KYbVs--BxD3nZ{o5WQ?w6bIPCh~<esr!fO&@?$W zXw6z(#Qo&wkZmL2(I)DXxIn<}-A5q+I!Zlq$hk##PvB?_32Eb+zDRZv$ooOKgZ6NW zijB#4%#49jMVJz~L_h8zsAr(xiv9GDLbz^%;%N1uYo`pfWrQWoD;qu?RYHFj&enJu zNFO>W9W6mcJzuIiV&KGg+;A7;q81@I``NG44B?9u-_L&Nfic5uOQ)n>H znLs1lyjuP(+##rc%!$n6d^sVa>=Z6c5=T+zg0@firjBm_^b89$Sha12nCy6osl;MF zgzJSp)k>HnM(urvyN)^!1R# zdu{(Thok2(25A*++!!Hyi%eV5b?NwP=ubI0ssHC@wr zbPNb?nt@ji@|vHy@6^oux%IzjXST)gA}Z z5&lr}CWR0mc%x1rZbW&7!=s#-Fz_{$x(rso*^Y)e`{v_fOl<1`o5h@g?hajTXbZ`J zJd?a41>~kA#g_$$jgI`e-k-}^ye#wOHUr`7lD0P3WM+oEUf;`Tnsc5)_&lj zGo+x%K|N=8{4|$NrU~1#j3Dx0Q29=)b|HW6l9|>Km6-&~pbfn87WNP}j{dR`e-gTJ z=F7ElVUZCZGQg&rx8-%)d{_(aWe&>S z-ECe67F@jxxd=ThVmOs(BRaXaUhTK4Pz6cla*m{!UGjTV&>`Nxo#mbbvNI=nlC^az zLRn=P4%ol*pSD$1kBunX9vX$&63Bc+#8{KlSAH}iZNW7Zf$cKpDoM(gLGMW})Mo{Z zl>EWPXv;ha6Mw20F*JH1a{>g4k-@KCFH${w0E}&2VKUY$Z)dzsT%ceXiDoAK-jGeQ zb%-_+p-L+VS%QQ+Ls>f^4U<&(MT1}V(xE#HmEu(BN|W@NrSWxb{198nZtxRA!e8TE)@^KKraIR!qYC$X?2+n3f=EO7glU)a(@H` z`DL$rMYk`InYL(BTkS&#}3;@S%b>o74e zH3?%+aS@&+ythG9&d^ zM?r&ud+aO0>*!*JjDFsn7n@bqJca00p&J1)MscMkrq9*_=xHWl=xG%N@adnV`Co#~ zVg3ls@yx*Q?Edr*jufK)IHig4e@%bZF-&o8{3$lC=BJdRIF`|nfIEsw9uthG^)ytP z@9A|FFCO*^8cVIx7nTXD3ZS|FuM}|bux0u8w`xNIbrLt>0<3|2sCurx`;RZn|A8(^ z{gT3es0h`7`5Y@?tU6bn5qc<+=@WUr{8EVYU8RbCKxv4Mqt}_Og^b!Zk87H3y1&Dp z(#m9s5=<4kZTaK#QmM=DliOctv$o#!a{w$v1+-#WEf+?~Xe;C(q#;*IKI*9X7U%hF zbWf0ew8q;tTZBHkwPSDZyfPbX6BV?9|V6h^0 zxPG7!=1KJ+q~h45PqwPwi|TPa%TF}c(JI}}`c^7yu-~HDXdQPJ6s(-2E)7mMlgETH zoEiV~;NX`sZN@FNDBF~Td#DOWVXO8Ty)G3ZKAkpu=#`-=*6BQ{(O|5>Mie1+l`&bC z!orJQscjo8RiME)M2c# z6=M*@X;XxzTi)*~v7VLHp~0;FoXtSUM^^B0CNjN`B~e$&%d{Qr~~3 zh*c?A7A>Ujx#!N!gD1Ed`aYiAO*Utw!b&cE&Fe)k7k*%?Mim;(lG=o zpGM$f?KA{Phh|UGU8!{-=ESfHVofs{Jb!aRmV@VmD#KZm%PwtV=L4m3J z4p6<>ZQky%AIWE}$cY8c72hXndSlwiO1?y=JHC-xdP0-gs}IDE$;yoy+wUF&Z>UDuqyac^OB=EZfRo{DYL9tG;BFHJvU_uf zM&$()mHDfub~OAMP)3g`7mhn^9brtEaagJlv~dRXo7uOe)YMxoT1oV+fJWKaDBZ%P z=l?ThqxW2uX_l&Bj$`4b6&Yvj?COA=9ss;i1ZmMq#cm|BCgl?taiZn3Xnr9*nVi{j zS8vj{=)^H-!~rmI4;@66`SnIwbic8oauNnwA_I00=H!`V_(v9D45oTL{^ohspIZ`2!?a?$;G3P2l^B?7jmY-wW@0%tDkA!T z_TXuCm)RPEF{&y`dhlMedF(i{i6+$>#)671vCv~3k*gPumnyl4hdu#i1BpdtOXmuQ zRS*La8Z3<5(=k5HBUOC3M$@C`HQAI((#&fUyCD7b2>n^f`*PMEf(?!rqdVWM#{Z)v zZIBRgW|HP?O{)bIv^c&!Q#A`X3h4hK&6E$x!N*+%OO-jfdBDqeqZsS9J)QEyJuk-{`zO2AY_FBX6A6DFU-5Be|=grZ5Kbr&(b>X=+i=S$z$6ZVj`cdW7@)edq zb${v0StU=;Ddw4CpK>Qtj!~Vjum)O{WDFVM5N~)9=na{fIV=x46E%=F1;HQ2gf&Gk zyBRP@ZEXw^azx|wN$ycG#wL;&ni&kYx*E^p4gjaC(W0@~P@oGot0BgPDv+U9B&s-( zk6n;Tm@j-WC^Yh|<8HNY3$ck-0X6GP5NrU24+pJ$B;AkvQa90``<>{0;A%3@pXpS! zNdMunA8+=jGRTPChqL&m-VVdoy=^i((Nkwr`Nm>R31KPH4BL*aQ5_>=Ff&be?*6aor#Q_-^Sj-bSAOXUXEL+a9eYXG$7c?%MR zJ&*dq{Q1j|IE);YrmJS9JL4!2+Cyco*N7~vFJV;cG-hT69Ra8&ID2JCNK5rW3Dp$X zhE}?X=&z+LP6B9~{B0_ljz&>KPD9C2Dv6`tq~*R62OyX`f>`O@ zlvp7mN+(!OC`6Ot4#m>SCvi#&Beb!H1`-Ac_01v6if_u=i;-`hTjBs`tS$1?pRu$C z&A+AYUE{)txyXwI2H(u2b8;jz6PW7=hu#Wk(5qN`N=(JSTOkd2I%&RHhzwPfrA)KFp8&f|9Yc#Ou*h07Xu$|mjkUFMBuer ze7-!@*4AIry%Gm{Kpt~8kJ(@VUqdd!27pT1e)G5g2v`wqfP6a7?S>|A?Z$ngfi|91 zB7sQk%U+vMU?(r(0>mQqg{{(8%yMu9e^j_uacMBGMDdOR{-B|IF&J(=QTNo~I zQ(2IRkHfaa5gh^y7oGOwIbAq_vnBbs#c~bk5Gi`xVwpCGwYn#=)%fLuo8wK&LL*K@ z#q5rw37lPBW=y2pLMxN{SQ85XAZnWNgKZi!s#^yHAQlkz^hv!u=&Lm3J6(^1w!0&a zW{~trMXuC<$5}P1BD2B-E=g^-dO7@w?dJtE)~W#2Ow#?!;l1Bx47i#uIpmo!cAKyH zkzIv5hQ7X(L2yGAEU0ZZ7`qMa{!qk(3wIU=SkQG2br%2K^Z{sQBVaBeF9(P~c}jTp z-ITZL@r*(6cAq;^^o;jA+|KAo`ftR@Ok9BwC3?*${{{IEUcOw}IwYTK20@>yWFlNb z`#1&=6o+~-4H`=e7E{|B&0ypCIEiu|L%~?&ZiXu!+^5F@Xi~HtQZH@Pnk5Y_dflAMFMEvAlT_%k0*IV0B2YQ1CU9P z08CTGA1uNEE2N6n>z%Fh8Qn`(0Mdy_$9=zMY^L>s^)DdPa*KNo`-;aYF@Q(obo&$k z{^!>5TF(jPd6@3)FJJ=&Y0k}_DIYby7JzcI7JWp@FNMq=VuHMc$Lq#&eNp%QuFTeR zfEbT308s#1-FDgIRQfL9x*OZJw;$>GHxkpE@ub$=l`JpdWJcpx0DA$Cx)&SHp9%K3 z+tq#OS8eTp0Cs;u6B^ycqz!rJpXbqg7RkQ4j9~wMaW%4p;9ar!{j&eJ&dnh2)y-ak z?#UMcip?g!v z4$wpZn)7W&dN6ev#P-1u`^s4YJkl^Pa^KvUPOBnHJ>Sjn8ej9hqHeR-c9Qok)I;3E zpOA;sgOyv!hvliU?+--}citD>HJU3oWg|GAw-ch7w|6-u><_n>hxZp@-%kdXOZ)tR z(q0S?veUO9qR0xYHKWgUftN#@aKeV29YT< z$2r)3mwYP?#AYx5P@?V!b10FR&l0thfFmr_CuZ8&oJWzbVE6*F7zOQJKpKp^TRIjsZ|S^LJBn&-C}~WKdU$Tgdazhe zjh@Xp>7D|RJ0%E5ym`_L-B1bvyfTT5)^nZTR~)-$}<7 zy{8?E8^DDr4^!TMb|1!co6f&4cwRjm&3w2^dRR-+X*li6ylHsno=SGyi*PcfRt}48 zEXW+-=)o?;GAGuCmeYzj)j01QpSQ&V`hDG~uudeS$s9jW1~+603X#el5>)>oQ=L{* zJr&>>HzJXjAs8p?ic;-uaSq_ z5zjxJ_{$G1D>vG<(8V<_d9{j!h)q|* z0TVLTz5xa3A%zj;Au+O$?i?DY-@ycCEbv7Tcjh@J8%vd-%P~0%CzIICy}b5~4Xt4L z<@y-oc!0ab@TbXrOH8cb^6de}!N1BIxt);pxMKfsN6vRQzMEv@vC*&sa0uT8)WeGI zRnFl<`@>AcO7ndOoGOVeHxG}awLp*{awE+HDKJ_ujc!)!`TpTz%Ow<_{gtlA>iE6; z!`MjcgCM~19~^!+t=yHXqA)QyUsu=@MLh~FGbsS9^(gwdde53cpTYM@?&cVh0kkbZ zSy*8VK^)LNenSK=|F8d)0uFTphG2sy`#TagBnoiY8z3DB{xE=I1ZEY)$m@&U@^H6y zEZe`bybKrj@O5(t1b}V1DSf&g=dI8T=s38tq)YFuIYkiuM(B@ZFZ((!Wb-$3eJ{gF zABKSx0pftM8!Sh(=hd5xU1Tpi$jO?RtN<-tFhS*KM9SC$GsS z1}&F{B`?!N=2IhR)>!2TFb4Noo8TYvXmX5}8l{dqkmXM>v8-~>wx75Y^n{R*B3p~$ zlabrGi18)2#grMjy}Fz!V8n`8cHO4;+&z7;+k~JSK~PX<`4xgo+ti9WAe0Tt29T+O zLZRg~&#8w#GniK?F)J-L@gbVwdrr)M6 z{fJzYS`cst4xy*|J>6m~N@*+0hD~O7r~ir_T57ddWt`gA{eb*_`|#nX=?C|-z8ioS zJv}-XRyeP7l60?H7DT=83+^wMyw6+sZm!?!G@TOjoe%>r>?oFDCl`gKZ7c|4A?fS? z5fmgY{Jl(Ns~};=ERPG?-(*N;xptgH6`@Ot1mbl=^`sn@V70}Vg%i0MD^q1+$|&+W zo95SjR5%eEvV_ybqBKci)qb_ueIFPt@8mXwS126dgfofN*89AfhqHsEjl+W$Z%VFA z_x-Aso8daIn>z0s_m#Vgk^8f$OwWt{kqNg6(?L5Z{%}}zzt_!nn-iYcSf7+leyA=a~)$s2{e$0oazf! z5pe0V$|Gix3>wz8AhlDc-XyF61$P zGUmaGsQA;LUC79=`#A`+8yUHNVJ35B#rv34S5e39n^q>&x1T)TceMl8S+wsDykMUf z;AVbixf-efujPcEkDRNb<@)CP#n#s9^*P^zYUW*v_XWMzX6D_mk=se&Xxr-%&n-cG z&^;OzAv0kg&P3h5fx)Zyr@74@QetnXiQf#=T-PM~ZjjjFyIzG=c%J1{cy7NWi50;0 zxZnC#A)S*=n;q41?HtSd`R@EiXRsH0czUA)kTXs33W$Tl+w|`apa1-+%H+My;k&OA zwe`4hiS*i-@%n9At_xTd{F|DR@3#ZrkKn!^F(=V`|5Cjd1tc-L2v{l-w3Fi zJ61l7HGPRS544i7$oTGcbH8gl@a0@IbN*rSH~wOS=USj{f{-kWjt78{Mr`i%o0f%BRFo?ndHP;S{u!}!wC>J!$L|X7gKrk0b`Ni` z8=M&7p2==`dU?OR;y&WO%#0W1y$a>Ex;IzlePjEu?|t;{zJ2AciEkM2RG3n{Ojn6& zaw%SeLluhl@=x*lmstuxM|q|tsbX{k{omAzW?HjL86#tj$?Q~GsVFB*d3*(ll5#Y9 zOYpiTj0u-IHQ>bI_|CT&r8b-It_RdR2gPVMgIaDm`&P0`F|Mp0so!_@=oCR3-9yMk z*L;+la-^_K+&1kWgFt5e2_TfYOIoOlN=yz7$J9W*5Vw&SQ1Gi!qv-ED`;)RJxoUOS z4R>?H{ymsxdn0PsoMr85w~jPo-urlCX2t8~oI7^g^K2p$s6H&Md($5HJO`-nTI9!tPw0Rs=aYJbM$=Pm^K}KY`@-PNNj&Ou6P&Fprj^C(61dhOCp^j{f`YNg&+&<+}qHzT+P#;CQfD zb0oa5YPXR&F7$am6vnb;+nmYh)n)5t z%VCfAZO?b$Q=bJX#^cBzKVD--Qq36=8KLv!HT{S{KeLJLp>*zwxC4yk z8zDpSQeRbC%uXtc*9}J@hJ(_F<3f&4oiC_Ea`85-Zm7CKY6AJADUCOjus&0BKaw7Z z?v4yK`-W24TP6iS@QH2vdwY6_+RdlK+_F5!0hZjyX7n&0Q>-T)Vrb-{CsBgj94L)+ zZvw9eO(-^pYGM*jGl26Ol3**9Y6OFP9+xhl@{IOB6SyLB8V*G>Sf&e=zHx zZ$oAz))C4Ck7EVA^H_b2f4d6RRPGxG(2>OfYv}Wd2SqfP09rF7niV3ee4J;bQh_rr z-+<}!y#kIAYQ_ie*4Q=}F#1Q&skiDlPtHLtBwy{h2narzw-gj|0|2Ih_p^W=VL`r|LS5laJ% z9r482Pt*Z;4A3+pPti{A^lDG-vKR^=3&j7mAhx-EM=&@CuP+Z=zTbq9XGCx0uRsAs zihn;9lgZcpF|=9ZyI<3mHHZf2Vf0R}7r%}n{p1QtMtN3*Ya`v29q->00~Yvh^xfTP zd%Le%v;A7POdo*52@@l^|HCwE7y_j}?(M&44N#m!zLOy1^DmfnYowUq+jN)Z7(Ywy zD@+a&f6SuIRQ6Oe~{$S;Qi@3A#Cse-n&J?Ul>VjzB-<5(TFyoVts*BUzjCIvzFvF=O(kme)sPe36ffU z;T3pY?$WaRNK8`iK#9bc|Lp=4{sg;l*`E(#maU`L&+I)MX6@}QGfLdfeYwKiaXdm z@~0s?A64cPN4vlOkzDy78>U!c{hM6C z%}sVcJI;4!7$d0^xX2}(=!{IVG@!Ahhq7JeiwcWsx#m9p=fRI^QtcJ_ zqfq}@h2ooaLP(oz)OppQPLQXf4!QZ2t~`@3bHgmjFF}t$axwPJ$elvcd?d_b{$J4% zH|d3VyQ*6Fc>en1gw;<}3!kEh5~Ga2#v=fS_-U4Z;{qdTS9%~4_yj&CHb5Y=+m$$W zpSMg>InfN?t0Rn4?;3IMvX3%(n0xyeV%QAYb7=NQVf0FjX3n6iD`c?dfl0NG3+gkx zl>@KdIp#>Q?u)h-$o6ol$@Hg`!&&eh?la(h`Ptz?P4;(s&TS9}M%kFrCVZ|tas7!T zDN@kCK$X!`tP`Q}pM+{mm>8En7mfMDz${KVrj!LAuKU(p=4ZYaI@Jtns#+dw+iE` z10f1fIg;8@yTzlcOP-KWDxle5oI}vz(w?rFocrJgs#`P1Kr7E3&lX~ZYuJ#s2Go87 z(4P9RXxSv0&g_1X!ANUh#lMA^I4z4%MjN!?5+x}%vv6LtK{R$2u+R1iD@^~6FqQ}e zLWu^QY+3DYG8NIqO;1m)erI|CeG?$boZM#3OHSoGv1TvMfvO7jBbX$1arKdo{q?cb zpiYf-Ye)6eLC`Iq!lGNn_0$TZ&&bn?s0OW&$am~RIl6V3{Gg;py|{N@pXi1sN$14b z>!LsuNZNQObzv2neuUCHELmFyIrM?)07Qi>dk)J-L(~Rnf2w^5I-Eolx6+!mLM6&B zd3MDfM$AGPH9n^UoVTsZI(8_m{-L#lkXaVua^21hoOB2Ac9^QsqH$5wm2rX$i`j>K$jViiX$u z8;T{M2|3G7ktQCsQ^GtZ2N*X#1rZ31xdD3u%c6wNEV33oX%)*rCa_sRUi+r;zO2^(QW)qE#T1d(EwTya0iu= z6Wh!WrlG&0tkDwF5gH*szNFEMd=k5LLSMS?3%>e7OakV3@{{G?E&+-)vU z8*u<3)B7qA#xQVn3-0|)e0}cr?P3z@S0)c zG>65qy5YMk;-AKn@BDduEp_^9ay#^jHOBWnvvix#ze>y%Nb9QLQ@iDYxYgaDSkaTY z>vc~~IgLaHi(KiQ0U6+I=AuQoLpnB{AdCcZUZ`a!QoCPxA~aigXX{u4DMg6det z#4Hh+jAu1%E)o<|y3%x{!T`yjkvjecnX$#UMWud6hRVc*kDVGAiRfcrjj4#$A|`&* zXI0Fq43WB*DX=YwCvPekWp$P7xhWI{s!a*)S5uVbWmAeanUheMF;>H8H^zKbh8Ndt z_{xA+ChGTwzD`rPdfM12wPuqD?lqjStF*Oz(T;fXUSMoY3KP?il1i!$4U{?>o2aEg zJX0#%n9M4VebwZU*sC#j}LeBznFxgZ3dfaZ@f<>+Q|(1sPr$rqmg6 zP8Pgi9nBU*;ArO5#K5f?Y(fV{#aE^;Ke-$d@ChUP8{&}`B(M&5`>dE{Y)djiUW-eE zKPf2s`GQP{k^(Lg4m^Y-3GxKK%2{2;9_1^;A&7gfD+Yc@G!T-hDa%fGu?EGUB5O|z zG<3!ruA$g|LQtPVvA6ceP0T6H;f|SyRf-WZ!-o>qv}7@F`WXAw$%I%{#n6JP*#wo1 z9IG!#X&#AGlQRBwO64+DEPGV(L~58COC>z3%AinS<(PHI^iB2ewU7-h4C|=?W6|s} zYX`z&n6#u<{$zG;d$xI^pp_T7Z`8d;OD!ZOaVWw!QzU3atNI`y8e#^%Y0aQb4jZF| zsaI|9=Y23^uajd1fdK>}8!@Ar7Nq^kbgfr;I&F&-kqMN?9%FzCEPSC#4#m*gKf-Ft$^PdMhh!Oh~Y#o2i%8%qXD|%wQT2?RW5E>KhJPX1&?o&D8(Xr_`M{&gH(4zG0t3Wt;tudIEnmr^i$CCo5qLy9l zrP4DHX2WX@hu37q~bbzJJsoZe!fOaUZuoH%}hz2T+u^ zPtq|Cce;%`m`jc#Z}4*_I;OrWm4A02C)3e$=Fv(7&P3n$lXc`oc&}?d!anmJ?O3iAGp1jBJiVbk@L2C^=sW2-*m;1GV?b z7{hW+yJ=bp8=Z(*h#(`dQYUE#i(rULCbL%%oy%A%eWOW?i%4t->lQ@KnLm0HrSBcc z?9h>TrSgLT#Mz+25(G(7>y^a%?4GJ64y-4POIXE+eUcq#|W`jpL2LL-&I6+RAuiz`j5^~anUONfz0U*%3yyHS(m ztiD=sLf}Rr{y-m?iVY#ZTSm7^@vi|h5np9{0n_a@NMHnweo@$Z)h=$h<~%h;YDeFE z$&!+_Tj;Mqxt26h4hd7m`siJehuPyEV)bIA?L zn|_$K_EPC*B(>XTG1*?%9v-`sBeq$fBn7=D#8teStKtrbxtR1=PM3F)dQJonOhWm0SHl_CDC=|Y1w;u3o zhFmIz7Gkg$8%hb($T`Sjf%0|Z$h@NAy6kp^Ni(dex zbOgYJ7`xKCB`@-9sr=>}LoBXkb!=!R;iiMW*0(rO5E+*el+(AW*a-0->~Hl=AuT9g zG3HGDQ=d>iBU}wLsbyAlV)W5M3-L@_A)ZO7YNzpAOJdw{E~2#YhGA-E!Y3)1G=tx< z<9#_a?`HWd^DeH^EJTO`ON}SQgr;5{2PD9HlAceK((I%C(AXs<(<_U$cIcGp1Q#cR z2R29%y5I1xkP1^0n-|Lip5rx1RWD*FmiH4=-@ZDhZaBz0@g~B*M(tNm<>aE)N@wyMIa|7#O%g0 z{NVlgX4;ReZ-W%@@Ja3p)9QAp{LMl8KS{Z0Es1fo$yw-2a$Cw!onPfKu!es^+CRWm z`klpZ$S~2E%GG-TSxYKRpT#rvNuKR|dh2zdi3w-FaP^;Cp{5kO9hG=k2~CAFY>I^TbJPvCkwt$F@+>hhB>-N|d$#_*6O=7@`ns zCDKr{5+#zY1&c6V8R4ueKqlo$sW7%UuE1|D8LA`TTD+0%0Z$NNSzzM>vv|xT_==nW zL?v8}`-L3p2M6_dWk%py$yQtQqjR9u4KZ|?W>wa7`4zG(TmIkVpe zPA$IXnA?036s8DNtYe|9UU~iA=sM*%bfbBK^S%&3#I zb;;R~vmDSd=YarKz;=&`;DyJG8R+ryNB6#03HUo6@c3UKKjEi)X*E$NENDI8;cQSM z95hz2FPF-h@Thxq=Lp`D;Qt2q&|IiGw9hk2-R~d+b=U1qKpY{Zn~vrL92=22h4u*g z%10~kctSf!{3EyVh1UAg)^?mM?HLqs_dxu~NUU)e)zes-IYd=y{VHaW->C-o(Q+bY zQn@!MggWgTFq8J#=DQd8vZ5hfU350$P)PR$M0$EPJ3nep$zYFFo9@Puk+V91l&8v- zcj|pDMCZ)rc_GE!-zMbZV^504j_u@hiXC+~YhmjXB5(Li8%`(@TKrDM-r~;v)TE%R z&pL}RR3$#(9$`!?HD4W?KJ^$GfprE!ZLCCK;+HBUl-cM=oMHU@L)j6PTt-aL6i8_65n6k?yh%Wh)E(kZJ0X8?LP}AfKEj zBd4l^^Tia&ct85XmN+qn9o}tTSY)S6BSEvbU%~Mgh6b*%{(@B+a-LbqAOnmqID{!K zW(OJ@a@X2lpE90U!%B=bi$zvjYH~1eO1flL9rw}s+3iY$NlU~=QX+*uMR%7^>AIgJ znoqG}7?-R16mR~Hg0-v$((sGV9$tgtRb^Bt-t;dCw3<@b`PSMNfNu{`-A)BCxJL$j zDJIA$lvBmpX^Ra8BB6KV6xGa7iTeIj$CwK2D>RxXBTs@P;ed{g*Zak#NotWyH6aSq zl}vl3)AHh%IQjFS8WGIgEC>^(?0)0Z;&u&9`BK??BEcPGH*D+u4x`?klA(!E`I;)O zM+Tb?10t3Cb>CzqQ-8(WUYbAhX{Bj~$+tAt3s1S@X*e>wfiEyx*xX+P$T{&;c&@hI zTG=%|*4@B5G~|F^5M5?41+zE=mjlP%V#Nc%cn@xTA+qWHO$^E$StaU>MmYBHN|u&q z;A}NmZ(%7;{2^y69b_vsU{Py-=Vmn`oBDyvp(>z{@RZ!HD(&OA>?+R;&=;krlHO*_ znaFgtrBQfcaDjeWQxt98ug594AV-&ym8xE6|CO^yk@12v6qYx z#xa;$nq7;2F4ejZP7;apq3|eFytE5O7K#$PNc44S#LDaucd? z?`u+|m%xpjT6|ukD?!;@-+~Hgy*Mj5BtVZKDG^J;Fj$3FqwD~pOoR@odu#YDl9@>c z3`&?YSdbsbemNxBHBSLjYLed2=qtKpor)}yz?5WyVkWVR z^~_tRCeZ=KvZByYnCvX|*KGQQvS0g|3iLYL^T4Fx9-ed>^W1Lq@SEku(P$*rz`ef} z+nMSJgj+5(C%3>DFI^%zBxR%5Fv*sq=_hzAcXVw0U*&f?t+(QWLR8quSvXQA4B~`B z6Dm~*ul6y)Eb~+b+I`AfrNBOg2~R1Nrz{s(=h1tOe#(fIzW*Dflt`}X5Ev01P^|xW z%GKwC$01}aV2Xf*vCuziH>L*2;5~YLfA6&fvU12zl_5nyW!pULnf?AntD6#N(U~#5 zxyxe9Iwz3BR$i;AOlo@B0zc0cm!j<50=S<E`l~?|f2mg!eM70vqrpicXx!>_~FFU(I;rCzM9L+v8XB=h>l32Bc4*Q%v>{dHi)7 zdiEVeWpfh0i4~TA3oGVqaOl*YubJnKm8?AW80Hp&c~$ro;lcoj)Q+yNKQRJ>ky{+W zIImY5EF>Dk6@$8CE(}w1V@gXq@yQA?;Z#N2cr;px)~7f(#^DX_QlZj@Ti&SLU3z-{ z5-VZ8{r)5ZK(&~AfU}N%jX9pg)Qo&BsZt1is|;D+I?ma%;@##VzVp9A z`u0zvshhC5I0a77-!W7;kZx$_waP9_ae$t>PFO!dox!Lb+CFCl0?8ct4q$u9L zk?|p8)wyoqNMkwQXHGMXV}aa{yS3%Ejx9)=ln z9#vQ%k`@RT9+_w`zU}JgH36T=Or)RUfSXW6&$P&?ly2xTB3F^Pij0K>gWQDFdhBTH zczVTWB6;Ur)X+Hh5TlOquRw5E;5VL#+7fW0G$1^eyiB5i8K6)@&|yTNw#%RwkP%jH z$ca)Lp>zYXAg`v@Kmj-Q%%~gUt!V%4s0tr!e<=l)xU z#Icz4Ul|fYc`;npI!71VifKtfqWF&fUVrgf+sj!jmHbT1OjntFHp)IIbY+WFly35D zt5B+iH$vPtD#jQ#0CE#?LaW0FabEe|qmUpk`}sCV)OsTO>v_tDBOBp#o|{ zVtVO<`svqSSyI=2bb34=<1|9W$Dh>c{}DjII044zZw>(nnxE3@&xy|e+vO(@wug%; zR@|Yy-mNIh_I8KlZ9sSaJp{&@{(vPuycWE=P_?Ai8Wyw94`K*LhtFoYh{2*1uU@;8 zF_)akD>vx4SF|)W-aNnwq*GI$W~y5rDpKF@v%g5?>3nh76?MP1)O7ezs&n@}^KMI2 zSIOaB{2l%mWUq@mIjb0&P>->zs>8$4Ig;&%M(hr2ye4ANS(nQf94G(=>x;_1C8&B2 zBE7??&yg|mLS$I{g06{FZ$roJ^WLGDN3f^{#*z3eWfY-ViDTje%!DYV9kds`|RU4PE!`qW zcOJTt2I(#pL|VF$?ru1g(jeX4-Fax<4g8;HJnwtQy&v9j&nL!a@3r?@YvymxHD@C` zF3cn7x#x6PolQ|3M~4!s!G-o_NC(q0^Lv`{+qTO7 zQj?SVmks6|TM0l2+4neFu|ad0xDmz%<{CIuyYc?ycn56LF?SUT%d&N=uHJtv8vGT#24nMio$K!%F~|P& z2g5E8w9X-Lxi-WyNg?XqY+f7ri@le5t{<--R;+PMQ2p-X^Uv(xNP7ba?di1P>Z9la z3w4kuF;IHT=d0!}SHH7W6&VboI34E4tG+HUhj$(5cfyS6n_VCl(Rc-dObN8m%yGMC z7;^T!zwS=quz?ga$~VbL_Au@DlO|7r8Z;|@QNQ=(?j z_6U6bLx6hVUCWniEHOHe4#)(>=1PJiacy&);3_U&4`}z|iLk{2U#=9f-aAjyl$VYlgvYyYh65w`GBySGg zWNJ04d9)|Cc&emV;AZ-rfs9YtR7U5Otu6I=+vTY}E2EM_MBFK}^hg7}?k|iu`S8h^ zbj1sM3Zq!@#``h7Wq~@4p!MZySQ5{|O6udy4JA!XUDPcr6{n0Ui?`YW-$7X=5rL*Z zy&(ayn?eoawq1KhRS02@uSe&outrz^RLJx-k3~BZph_7`GH18Z#*jkOQ);It;m%Pw zP2Q>oVS2t8*=KX#8>Y2lmDr$F$La|Ds7e0*2U!z!B8})uW{}%hO}#SXqy>%NX4& z`bz!=4~Z{dr6%BH2Y3#SJF?1(Ehaed>d)*98_QtM3Y#`2fECIHj_bZ-BwO4@GTL)^me6lm`Q5Tsw!i8c?3$NF_?9r$*{ zquf0aIf&38Je_pRwpgfhts;M3t(frn>z}bq!`iRcg85aRxjS>Rjf=(j9HEl5me0x@ zl`V0I`~V1ZtXibL=8F*RC;rT^5W;RnaE+?wUNx#-2kmMZg-kmv-vkJ{61M$5F3d}- zkvFyN;AXLT+b@Dg%;`Jg{n@tz62{S@={JO-meoh%7_Rj*gLzhVY+j526|Vs8wP)rC zyHg_Qb1V{Ac-|xkjF7fcthIzP`zCKmsqmz+{Z-Rohsc?c68=r`;hrAw;O{%?@F+ z&6)lrVmMweRAU}%2;O$Bf}NG~z8W!y_TZ5FD11|~r8 z6X}KFTAfXQ1o26klW0wN^scDBkm9@MO*7dz84$P!j&49($?i(EA_QYs>0{wgY+7n3 zK-9mWV5d-|H*o0OheGP!u!cVF`g|*(iBPf-F{@vq4u$4_EM0?D>B9(vV%Au8!f%Jd z_~*YGjz?&l2KpIybd8SmX%nsRNQYP?KPzg;ps940`$)LbF;w)xJ5VBkg%{yYf?<;= z?F0Mi9IGbza>U!j$bchDjBOSbl3imc+4L59z;+{~`TjX#o_MBJfmEvTc63to?LpA= zmsk7Dv3x5ZvYCsCDzv~X3_9t&ms`I<2*JeYHaoh;wYxzWOF^#g6;Pb?xI|CFPH{Y^6|_VhJj*%og1DNg7rcPzgPrc;OeCGM%h=4PTc zfX_4qSR@#NZZl+ms=U_uM+D(2MF^)N-LrD+P5&_YcorBex2um{Hk&MkABs0eCLpS# zw4-NzQu4)az!N%8{pQW~tk8)Npp$4G1`2}b;zjKq90;GepMCsrAG(HwM@n1kYr>(T_>a2VLpy#@ck8%_*HX_ztOMjfT}{&G>q>{@ zl26e&5}?@VAw4ix3#cA;#K`DPQd5M-$xa_IvUB6wUwkcoXs6b0a;Lz3>p@tf| zp6Gya1C-#JMmUT*Hj}CfYlYR_GF9;Pui=>LsEj#hq8J0d`0-v1Nnjj>FZ9C!q7gUQ*Scv8=aiqj7vZ59ut@2hOAYK$kX0jZY51EB7*Q2# zRP%nUs|*pb4P=~fRaGhU4W^JNddag^Zr1vfs44SJWFi@oier5>M@QS_$F4J(JnCW& zr!V}kHS8)!=GO3@Pbp#l*dMoPkuMvQa7qLEQNl{6m(*aEEKSWMCKB=(anb0|rQvPl zYm`QQhixEoFKx@kE0~1Ses3B)eyCbBQTF=#OGC**gRL^}v$nAg#x})jwy2Z0jWjyB z3ubN@FX3QGKzfX!z?u_#8SQ#24pMGRclNNdym$NDcT1Pj*6Wo9^9=?K^bY?)_31qr zrT@}-fRY0JZ3k)@dbhQC&#snfP?w(&8{KG2?ir#ponKpne9Rt{V_Xm{Y?8F>?b}rW zE=yLGjlh%0Da)<_Hzje~a+kFw=HS3N(7OH@C)*jgZQmk%!Y1x-@9f?n3?ot?_!*zf!AKx@Pk`elzZ@sIl zwITvl_$vdUe)h>>kzinI!yz%!Gi~d?h(Yt>!3!h7x-V>TL5HIMer_&p2vPSLFr$a! z`Yl@0+$~2F-B(P$Frbzbpb-JE07__pLH@K3_77J;9FGqJRb2o(9jKE5JoT_7J~EH? z4RA;k1hV}4KP(;GqxlV-%>*{!;gJ@qe;FM+cO08T0=OD?T(|z6(DT?0hU8u3J1>vv zmi}V;!kz7BPT<*9`s8GJZphjYxC>uvPo)zsc>xdvo4x`+-Cr7h-e00{Cl;vhtk{=8 z3NUdNyVD4~7T|loU;oWrBP%XCcBQb7bo^=VKvi+-%Nf<965Z}g#zFxiUUv7Ggl7D7 zKS^9!;uqzH)Z4E27n9(DLx)~6IyWV(DDdZzyz;>q-ErH*5Pt;4tRKqev!%nFD{ER= zp9Adk(flA|?AVJ0$UlBts<6Cd5&HHqNCmu=PXZYb?s~(zs+@098~?49Z)%1{*)|c? z6Rxwr(N9CaaI&`kLcUCu%E<93rI3B(xqTe_NCb|fiG2`Xd1QKeJFC;q?dVU1*Lm$c zeFE|53LD{A4d2Rjn1~*idpQZFSSSA_nr(+%XSi$#OYbL2TuPU$VNoOp^05R5|M9|S zBdb7WfqgaSve3G+J1_sVUzSQm&9e?(aBU`G+I-oSU};y@DO}=T$ym~r%XG6!7SVjq zHP3a2s%~xOwVyPxXwd=AZ%Pc*{I$2n`bPrEMSeJrJz2dX5^flZaCY@R`L;%>m?J$h zW)kUceSxv$T{AJ!crnnvo#AmFAD{>oajK6Jl_367yCoD$RM` zeYwDR?qWmNq{uuiwPl!z$)7?gnH`@ERg9X|3TpdpOiMC9OB19eIlxonsIxnqp>Psc z6=fP}>tONQaC!a24%g09n7S=RF)XsaJ(CeLIi+dVm71Atq7&ae%#N-i8Ea7um1?_2 zJ{Bjxy=hP=4Wt9miNy@`HOB@*Hf{rCPu^D`VlJh)XC@6wb>bH#kyFk#yiZ?;h=+G z_p7I3$CTihr;rrQHBhL>+s`1G@si62AL)&Us9GB=CpAxoslrTx~H&Vpuo z$gFKlp_3u2t)dy8DFUh7ez2M}y)j9rLI3vclNhk^8Np`d4s10yuc29u4r)xO6bE0H z&=cZeXC|GErK^%A8VT^J!?2jM%E&lD<$Q82&3uICel7- zC)HadU~TzV=rhZdF3ZZ6l*1I~st;9zcWXY5d89`!Vx3RCa453MUWl#NqG@xtkuTjw zM`tfT$jR#p(oPhTDG&Z?#zBF6UW-50eTO4hpPWUDl+$J>VN=wNYME;#7RuX`CkZDZ z3#ZcWT|&TA)cCOjzH;=KA*2p(F+oLdqS$I|=X;HC6ic;(R_>~LgK%d{xbV*re_{e+ z%>(Mf`j^R&CzV7AJ6j>Naa?wCZcXBaHJjvmfD6KZ*Dk>PsNYv^fzIMdY<}U)f z*FX5?tTsnE2v;EPUN0|ET?0rO%VdA4>r{^H2lwbcKrG7B+$(!R!BB26_gbixZHLs8 z^1epk%Hj>}9C1yy^?~f_$zVI@YlGR0i|8B*oVbm%QVIvpQ9a|G41H)SjrqQgWjO{e%0e1B<1u}nt&R2x10*ZT<=j~a zHt!WLg4GWBbnjL>@pyD9wodH(lwc|*qq@GK;<4^?BvIE)3fAx?SbCUxs?J%0NCp^GK>^ z8+GU96K{2ZIFlkgSl0a)KjerOB1foz4dWP?IQ3lrs#Vg*ior~w%aMNm&1})l$kr~z zYG|~*Wu4qni>9=qk@JD>z!Yh3jxsMb+K`@tXKY?Jtoo;OVyC^OXG}Kp@Axhj!QX1M zIn`3(>^SB>eR3`oHCMsWrX?yUM@G}K90?@RK*SixCCM%VglTmvn3Vnr{%jsGkVNkMPO9~qwr1<>E29;qVY^Oe1c6f_ zr`gs~b?$?ON*+_5m6jy7C37TnD_h}hZK$2@NR?b*G(<*+X61MB%IhLU`Dp?dAOs!G zAoO>jd6xf)owWE{jt1gK$pizs&=YF!TUS;HB1<=}opB;@l>4vH7Woz=qa5+l80zL zZjEnG+4<_SC1gi7B3J{XcP9hb1;wu-_dZE~PLKBs2`c-H?8z-PuuZjwB0EZ)f(O-D zEq7Esii%jd1&1hCT#wPF-QsDyP+zeyI<>+`VzDl&Lsb8qqR20K^v3U*1nyQ+NTymA zlEiA7YRndov`DqR#VW=+rixaXM%C9TOZw)FexRl_U^}3p*m%%ieGwPS)@nOZHls{d z{*uI)YVP$MIV28jEt&W->Cp}Hw<_A)5`ttP`Kg}o1kL4#t1=p74sltm_Q+^1)V}6m zH+?XOsan?=QKtdWvPB0-f$)DuQ46N#?Jk+zWnM%jxPh&2M#rvzkebsS-b4X_HxLEc2b~* z7S2<#AmVDpw>D~F%Sw4z?HeN#C9vUv>2?Ww2xHWCnK_F?IdX803gZo!ERLyGqzJK* zS0&gxOZPYeIcJ|cRSRXXgzxwYbtp!QMsmtbtgp)ljmqQK)Rsc9b}Q9J2b?2mxw)Z)cg{*r-j?CQ*mt^8%mxSGW6YKyE>c}|)4I&YNy zFcgL-NQ#D=^ZqD?F~-}WGd!Qm^kqa)vb1vWi0{g&8qEw#F2{_S3|%X115j2|a{b`b z2}ML^>qtzNIYN)y(ETTk0+7!sb2fT~9m};~evUbpJu#%T()`?jN3~!evV-g>u9}m) zPlGncDc#WFs}tc3g0+G}sLD!yIeD>YHQe!##^q;66`?dO?|`4;F4ik1&iBvM@tKEX z#hm% z8cnctmgVg%VXa|3(kO11F0I>~1hNz@G0~h4F~>c=Q~%sx-r%wrD3aV?q`(0wVD^lZo3w_O1t{bE;C( z`D1jiAw|l#$c&=-pSv8#jn2L3SZ*E16`*q8_yTK$+N}T1XEmQ*!M|jV@IDUgO^`1r zgz39S{RAOAe%l_4!}G*Yll(21PUcKg@sa4``@(Z*ln+Q!dm&C3(5JNw=#t!yb$zB0L{c#qXZK zccEo2tbnqQ%)rTh*1}unhh!C6WFO(Pb*qo}+)U7@|q?s!RsH(HysYSm)x#1Jb1{##YV#7xwNWESa#iP-1}qwQ9fF>)A@@%R00 zc;#~3pYp2H9kkO<|sITj#a zZ7iI)9~YJ!0M+gvP$Ubo#Z~O<*qaN!#8`f5l-=3>q6PS!tCHQ6W`(Drs?Y(L#RjN? z^$?et13_nXHBztEkjZXveZnwN?-jm^;81|Sd}^rtb6e2AN^Bl(A}7t%2dul#SmX1~Am3{M{0 z*~uoc(p|T7UJqYaSvF58FX8+MmePw%Up{lPRdWoVGBrJnXs-CChlmdSUFw3SY4x6} zS{+x8qfI157S#v;$yovfoC}7UOG}v4K6!7-l`Rp*I2K{@GlSx(_>p{(4dW}(8gsJE zz8|E0pB;VQhkx|II?kFEK#J&$1lI>j8LDMq zjIz<*zTJMS+L+qO2~A5+uy&}%bnsNjg0l^)TQ$2zSbX#3IUpd^#y*!L91!5v^MF}o zf3m7dTpol+#iK9vzwH$Lhrbnc3rljZ|1HL^IjvImQgerlbfL!kKqA+h!W{o!4pP); zyC0e@fFB&}?>Vj#HxulfuWC;84zcguRj&UVY$q&v%RGOhwid-(-QImbmu9)#v1j;5 zd3P|fTPZLrl=_dJ(d@rGBkftIrG)hm=DRDH{T|OEy&jX;#V;-AQpbE(w%Ck>k8Y?{4?QCqHK0V#Xc8Um{vRPB70YfDK1i0EbwN>dIht~>f zwW|6Mq;bSgZh?~>(2mI_(l=)ak&qe+m8C2W<*}xDlXA=M60ZC+`CIiF#@^cLGU^Vj zf)N|M`f;A|z0l=Fu>-MSJJ^`cV3A%s*Snv$hpR_;Bo!T=9>Zzs6$Ex`-skht;R|1YBMra3Jnja{qL z{-PiJ6K~ak*@uu{2DgecnpksEwvPPi^CDqF7c;>Nm{01WE?DQgWQcU}6Y{)YPzif5vIGOPW{C6t8!oRAqmreKh@*VS8E;23Z^W zLS$bQ@e}maiNJNpQ#)da?lbXZ8UHt!a3?(1B}~+n5@VZxr&z_razQ1i_pK$u{yj@>!athBG&UK zqu0B zD3)|O_U!hX}4p7>hF=Lf0 z-7tL^TbKT3&-Yp)&tJaXVVtNW{}!9Re7ZL@3eA2!^V_F6KX|7$&=U_Y%wM1rqccP7 zohWv@&5L%#9WM6Jzc4z_CjTyAubjJnOItfFRDc2%dGaa-vu8^+^ateoOWO>>>TDe= zxwGa&GoSpDSnDSEx?M?+7eq*QSh|{XgCAD3>ZIE9tmq}pd}|^(*1=k;>Dl3dnwf+R zT=&Gfc`dm(<({+29(!(~r*grq`EKXn;Jo)J42u}z7^yVpTN!VroBii5Wnfx- zRDEKWtnT@zmsgayu_|@ncc8WZb|gJy>EM$i*2FnKhF*TJ9jol&x9)RIV_l`|XhHK6hw>8;qqJfZ ziKP~{2{3+Q&W~(^+RK~#ihAB*Kz{NIMjAtTT& zui~h2!ztjJ4~eGb{TI%dL=x<98hzj6D(-K1`B@zuA&+dNb?W8b&ad0=n^}>(t)Pr4|ZicIcUVFMKfFSt0wRCNxf*+VEa*8RIKIE&1fl_PtM@j zEz~7BlYJ&hr#2z#E>+qh@i+QDdAS4iEd&FyP>b?1i@<(H1k+47pRn;(_4M@>P-=+jqCzgoc=D_ zDfH9fv937lDJds?)^fR}?GWMEG0_LJF>*Ik$i?rGbW&9k1!DhX+MYB?OZtatGK&9@g4(0t*Yzt z!R+WQl$1_qWEGAF-(K!kbE4iSgJF)xD_OznkEVIj0`b2P##;1pWI5UmlD8=;&ddJImCw05Z>4iSmfoo1#baRf%bYuPuKq!sne;0X z$A{_!u1$2fQO7ISiF1rizFZkLSdMYAq3R=+x-zHM4ASq2kxj%+;56_7Tk+<+s3TyT zDHSrSxv8mtmZU%=Zf8iHm&~0g$(%aq(ojECEjVNsj*HZP-8-ruKR8Ae z*oopzVh;?y0Z1`#c<+EaV{OpPR~4z8lpP_Du^N$smj^jTG)=;W^}jS zu}K?7^p86c?QP;T3I+@b$*|tas+-qt2nv`5Yz3ilzAGsnZO5vU7g8XntA#R(B!;XO zeVV>25%u)^+>YJGz`2?AL}p)LtbId8cnwVq*XMP(m$qDx2B3<^t+(&9O6FEXpf_u` z#N5|Kj!&>rt@(pBUh`kfjpa<3{mmK<>(ip2CYNZvcj*I{sHrbA_x7Bh9VR^4tAK&c zUwM|}(Ry;-nsF2Ed_?kXPzD5gUMwLjsLVI^3unCQA})tZy+D9Ase`vtEAI`rj+cvi zF)wo`ZJ-bPx!PL8Pda79KqUrjGiT1gcZ#|4#|Udao52vBSv2OtH&-F_+zi4}tB#G1 zc-tHlG$e8B)7x$*pnse)gL_bCn7OO@Nr_@QHP6g;pxo*HlpMUk3M9v!i0qYaRy2i& z0S1vin)|{{M_!@)47%&(^5K5)qC|8uRZVfRWsZuW-R;{%fC$tLR60t}v>c1s&|7x? zkq#&}#|_4-uCnK?A1{mI+O8^o{W__p&peWhm}qxK6h%cI(l#hlPeUWt`qM`VVXYq% zR$m$;+AjD#)hf8Bn7_dOZaU5P(^NYCRB~c5IQ<2v1mOvAV{7>mi};-uRQwb!eb>?m z1Bg!>hJVD$Lv8?&fOU_v-EI^AU>4dCJ^V*6(${&S+^MNS_Ui1KRf=ZB3Y)ar!Y$zYT3)BGQa5e&g_mBr_ z1s(F#0S@^BnKyLKS>W!#?abTz_;7!&Rjw^Fy8c5yh8P?Idpu1 zo<0Pw>6_Nptd}}fRc{_t56C5B7O0e*GQm^a4T2t78FMayVYS}-cFC*e7GR0p2fY6S zJ2v5d{EWBm2-LYk3>`n6+*Q8qm7Oa6#EJiCV}e?U*HU1ULP4iT5VCvUl=+&3#eLqE z0NwC2f}Ha>;&Or}LPMZ$G*8PXP4m91`eC~IedUk%#ZQyw>?wlha+UW-3?ZF3Zzu3} zsDN(gTyzz|*V-zfv-}wMJW7w_D17cdYhHdC=MqPZX5*>rpv^Kkg{V=Q1sRZ=(6` z4B~xv^2-}2-pu^44^Q_uU-o^T_q^T%%5css{O35{cbB~7cSm8~9w&XAx?Y!S{^(?0 zK-o)17d3!d&)^U3|;C%-q3x2S;7rR(^9B8pAiaB_l`73;dz{9Jr mMt(J2EC)SQ!Ul%zy+_FRLqoJ;+EjbESwcisxL8Q<>;D0pCkJ={ From 56f634377b9f5fff900a64b5571fd10d53e99835 Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Wed, 10 Aug 2016 10:02:33 -0700 Subject: [PATCH 062/421] App-V corrections --- windows/manage/appv-capacity-planning.md | 2 +- ...pv-deploy-appv-databases-with-sql-scripts.md | 2 +- ...appv-deploy-the-appv-server-with-a-script.md | 2 +- windows/manage/appv-deploy-the-appv-server.md | 2 +- windows/manage/appv-deploying-appv.md | 4 ++-- .../manage/appv-deploying-the-appv-server.md | 17 +++++++++++------ 6 files changed, 17 insertions(+), 12 deletions(-) diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md index f88561dc30..3388a0522a 100644 --- a/windows/manage/appv-capacity-planning.md +++ b/windows/manage/appv-capacity-planning.md @@ -22,7 +22,7 @@ Use the information in this section only as a general guide for planning your Ap ## Determine the Project Scope -Before you design the App-V infrastructure, you must determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. +Before you design the App-V infrastructure, determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. diff --git a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md index f0a57d3634..6501a694ec 100644 --- a/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/manage/appv-deploy-appv-databases-with-sql-scripts.md @@ -18,7 +18,7 @@ Use the following instructions to use SQL scripts, rather than the Windows Insta - Upgrade the App-V databases to a later version >**Note** -> If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V. +> If you have already deployed an App-V 5.0 SP3 database or later, the SQL scripts are not required to upgrade to App-V for Windows. ## How to install the App-V databases by using SQL scripts diff --git a/windows/manage/appv-deploy-the-appv-server-with-a-script.md b/windows/manage/appv-deploy-the-appv-server-with-a-script.md index 1cccb12111..1394472c33 100644 --- a/windows/manage/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/manage/appv-deploy-the-appv-server-with-a-script.md @@ -1,5 +1,5 @@ --- -title: How to Deploy the App-V Server Using a Script +title: How to Deploy the App-V Server Using a Script (Windows 10) description: How to Deploy the App-V Server Using a Script author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization diff --git a/windows/manage/appv-deploy-the-appv-server.md b/windows/manage/appv-deploy-the-appv-server.md index d6462823b4..c85f273c6c 100644 --- a/windows/manage/appv-deploy-the-appv-server.md +++ b/windows/manage/appv-deploy-the-appv-server.md @@ -1,5 +1,5 @@ --- -title: How to Deploy the App-V Server +title: How to Deploy the App-V Server (Windows 10) description: How to Deploy the App-V Server in App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization diff --git a/windows/manage/appv-deploying-appv.md b/windows/manage/appv-deploying-appv.md index eb82edefc5..14a78375a1 100644 --- a/windows/manage/appv-deploying-appv.md +++ b/windows/manage/appv-deploying-appv.md @@ -8,9 +8,9 @@ ms.sitesec: library ms.prod: w10 --- -# Deploying App-V +# Deploying App-V for Windows 10 -App-V supports a number of different deployment options. This section of the App-V Administrator’s Guide includes information you should consider about the deployment of App-V and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages in your deployment. +App-V supports a number of different deployment options. Review this topic for information about the tasks that you must complete at different stages in your deployment. ## App-V Deployment Information diff --git a/windows/manage/appv-deploying-the-appv-server.md b/windows/manage/appv-deploying-the-appv-server.md index 6c21e160b4..60f2618aad 100644 --- a/windows/manage/appv-deploying-the-appv-server.md +++ b/windows/manage/appv-deploying-the-appv-server.md @@ -1,5 +1,5 @@ --- -title: Deploying the App-V Server +title: Deploying the App-V Server (Windows 10) description: Deploying the App-V Server in App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization @@ -8,9 +8,13 @@ ms.sitesec: library ms.prod: w10 --- -# Deploying the App-V Server +# Deploying the App-V server -You can install the Application Virtualization (App-V) server features by using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). +Applies to: Windows 10, version 1607 + +>**Note** If you plan to use the App-V server components in your deployment, note that they reference App-V 5.x. This is because the App-V server components have not changed in App-V for Windows 10. + +You can install the Application Virtualization (App-V) server components using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). For information about deploying App-V for Windows 10, see [About App-V](appv-about-appv.md). @@ -18,13 +22,14 @@ For information about deploying App-V for Windows 10, see [About App-V](appv-abo ## Download and install App-V server components ->**Important**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. +>**Note**
    +If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. App-V offers the following five server components, each of which serves a specific purpose in an App-V environment. - **Management server.** Use the App-V management server and console to manage your App-V infrastructure. See [Administering App-V with the management console](appv-administering-virtual-applications-with-the-management-console.md) for more information about the management server. - >**Note**
    If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you can still take advantage of the reporting and streaming capabilities in App-V. + >**Note**
    If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you may want to take advantage of the reporting and streaming capabilities in App-V. - **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. See [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) for more information about the management database. @@ -49,7 +54,7 @@ In large organizations, you might want to install more than one instance of the - Scalability to support a high load. For example, you can install additional servers behind a network load balancer. ## App-V standalone deployment -The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this topology for larger deployments. +The App-V standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are installed on a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V components. Therefore, you should not use this strategy for larger deployments. - [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) From dbef5973b7dbeee8b5bb05ba7f16058850707ea3 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 10 Aug 2016 10:14:31 -0700 Subject: [PATCH 063/421] Fixed broken table --- .../change-history-for-internet-explorer-11.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md index b1243f0790..1a51930de6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md @@ -14,7 +14,7 @@ This topic lists new and updated topics in the Internet Explorer 11 documentatio ## August 2016 |New or changed topic | Description | |----------------------|-------------| -[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | ## July 2016 |New or changed topic | Description | From b7a3601447f37c8545164011234382eff735ddc9 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Wed, 10 Aug 2016 10:21:55 -0700 Subject: [PATCH 064/421] Improvements from Suhas --- ...rd-enable-virtualization-based-security.md | 34 ++++++++++--------- ...nt-planning-guidelines-for-device-guard.md | 4 ++- 2 files changed, 21 insertions(+), 17 deletions(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index c0fea04744..dadb481b1e 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -14,13 +14,15 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Hardware-based security features, also called virtualization-based security or VBS, make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard: +Hardware-based security features, also called virtualization-based security or VBS, make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are a few steps to configure hardware-based security features in Device Guard: -1. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). +1. **Decide whether to use the procedures in this topic, or to use the Device Guard readiness tool**. To enable VBS, you can download and use [the hardware readiness tool on the Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or follow the procedures in this topic. -2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details, see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). +2. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). -3. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. For more information, see the following sections in this topic: +3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool]((https://www.microsoft.com/en-us/download/details.aspx?id=53337)), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). + +4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following sections in this topic: - [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) - [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) @@ -51,7 +53,7 @@ After you enable the feature or features, you can configure any additional hardw Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10. -> **Note**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled. For more information about how IOMMUs help protect against DMA attacks, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). +> **Important**  Secure boot settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
    In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
    For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. @@ -75,7 +77,7 @@ Unfortunately, it would be time consuming to perform these steps manually on eve ![Group Policy Management, create a GPO](images/dg-fig2-createou.png) - Figure 5. Create a new OU-linked GPO + Figure 2. Create a new OU-linked GPO 2. Give the new GPO a name, for example, **Contoso Secure Boot GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. @@ -85,15 +87,15 @@ Unfortunately, it would be time consuming to perform these steps manually on eve ![Edit the group policy for Virtualization Based Security](images/dg-fig3-enablevbs.png) - Figure 6. Enable VBS + Figure 3. Enable VBS -5. Select the **Enabled** button, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. +5. Select the **Enabled** button, and then select a secure boot option, such as **Secure Boot**, from the **Select Platform Security Level** list. ![Group Policy, Turn On Virtualization Based Security](images/device-guard-gp.png) - Figure 7. Enable Secure Boot (in Windows 10, version 1607) + Figure 4. Enable Secure Boot (in Windows 10, version 1607) - > **Note**  Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMUs, there are several mitigations provided by leveraging Secure Boot without DMA Protection. + > **Important**  Secure boot settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
    In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
    For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart. @@ -129,7 +131,7 @@ It would be time consuming to perform these steps manually on every protected co ![Group Policy Management, create a GPO](images/dg-fig5-createnewou.png) - Figure 2. Create a new OU-linked GPO + Figure 5. Create a new OU-linked GPO 2. Give the new GPO a name, for example, **Contoso VBS CI Protection GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. @@ -139,17 +141,17 @@ It would be time consuming to perform these steps manually on every protected co ![Edit the group policy for Virtualization Based Security](images/dg-fig6-enablevbs.png) - Figure 3. Enable VBS + Figure 6. Enable VBS 5. Select the **Enabled** button, and then for **Virtualization Based Protection of Code Integrity**, select the appropriate option: - - With Windows 10, version 1607 or Windows Server 2016, choose an enabled option:
    For an initial deployment or test deployment, we recommend **Enabled without UEFI lock**.
    When your deployment is stable in your environment, we recommend changing to **Enabled with UEFI lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. + - With Windows 10, version 1607 or Windows Server 2016, choose an enabled option:
    For an initial deployment or test deployment, we recommend **Enabled without lock**.
    When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. - With earlier versions of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
    Select the **Enable Virtualization Based Protection of Code Integrity** check box. ![Group Policy, Turn On Virtualization Based Security](images/dg-fig7-enablevbsofkmci.png) - Figure 4. Enable VBS of KMCI (in Windows 10, version 1607) + Figure 7. Enable VBS of KMCI (in Windows 10, version 1607) 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. @@ -258,11 +260,11 @@ Table 1. Win32\_DeviceGuard properties
    -Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 11. +Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 8. ![Device Guard properties in the System Summary](images/dg-fig11-dgproperties.png) -Figure 11. Device Guard properties in the System Summary +Figure 8. Device Guard properties in the System Summary ## Related topics diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 7403b2750b..13b3f05f42 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -23,7 +23,9 @@ This article describes the following: - [Reviewing your applications: application signing and catalog files](#reviewing-your-applications-application-signing-and-catalog-files) - [Code integrity policy formats and signing](#code-integrity-policy-formats-and-signing) -The information in this article provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). +The information in this article is intended for IT professionals, and provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +>**Note**  If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx). ## Hardware, firmware, and software requirements for Device Guard From ffc60c5bf9da66fbd197948424c16af7d0335b10 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Wed, 10 Aug 2016 10:30:53 -0700 Subject: [PATCH 065/421] Made bold text into a heading for easier navigation --- .../deploy-device-guard-enable-virtualization-based-security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index dadb481b1e..fdd547a277 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -125,7 +125,7 @@ It would be time consuming to perform these steps manually on every protected co > **Note**  We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. -**To use Group Policy to configure VBS of KMCI:** +### Use Group Policy to configure VBS of KMCI 1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. From 0ffdbcee6ac3f502642c49f828d93fb451c914e5 Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Wed, 10 Aug 2016 10:38:27 -0700 Subject: [PATCH 066/421] App-V updates --- windows/manage/appv-deployment-checklist.md | 4 ++-- windows/manage/appv-enable-the-app-v-desktop-client.md | 6 +++--- windows/manage/appv-evaluating-appv.md | 7 +++---- windows/manage/appv-for-windows.md | 2 +- windows/manage/appv-getting-started.md | 2 +- ...gement-and-reporting-databases-on-separate-computers.md | 6 +++--- ...stall-the-management-server-on-a-standalone-computer.md | 4 ++-- ...v-install-the-publishing-server-on-a-remote-computer.md | 6 +++--- ...nstall-the-reporting-server-on-a-standalone-computer.md | 4 ++-- ...appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md | 2 +- windows/manage/appv-maintaining-appv.md | 2 +- 11 files changed, 22 insertions(+), 23 deletions(-) diff --git a/windows/manage/appv-deployment-checklist.md b/windows/manage/appv-deployment-checklist.md index 2def234fd2..2da5471851 100644 --- a/windows/manage/appv-deployment-checklist.md +++ b/windows/manage/appv-deployment-checklist.md @@ -14,8 +14,8 @@ ms.prod: w10 This checklist can be used to help you during an App-V deployment. -> [!NOTE] -> This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. +>**Note**
    +This checklist outlines the recommended steps and items to consider when deploying App-V features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. diff --git a/windows/manage/appv-enable-the-app-v-desktop-client.md b/windows/manage/appv-enable-the-app-v-desktop-client.md index 2a92c9d953..e10f3d842c 100644 --- a/windows/manage/appv-enable-the-app-v-desktop-client.md +++ b/windows/manage/appv-enable-the-app-v-desktop-client.md @@ -1,6 +1,6 @@ --- -title: Enable the App-V desktop client (Windows 10) -description: Enable the App-V desktop client +title: Enable the App-V in-box client (Windows 10) +description: How to enable the App-V in-box client installed with Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -32,7 +32,7 @@ With Windows 10, version 1607, the App-V client is installed automatically. You 3. Restart the device. -4. To verify that the App-V client is enabled on the device, enter **Get-AppvStatus** in Windows PowerShell. +4. To verify that the App-V client is enabled on the device, type `Get-AppvStatus` and press ENTER. See [Using the client management console](appv-using-the-client-management-console.md) for information about configuring the App-V client. diff --git a/windows/manage/appv-evaluating-appv.md b/windows/manage/appv-evaluating-appv.md index cdb5351de3..6ce476b57b 100644 --- a/windows/manage/appv-evaluating-appv.md +++ b/windows/manage/appv-evaluating-appv.md @@ -1,6 +1,6 @@ --- title: Evaluating App-V (Windows 10) -description: Evaluating App-V +description: Evaluating App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -11,8 +11,7 @@ ms.prod: w10 # Evaluating App-V - -Before you deploy pp-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only. +Before you deploy App-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only. ## Configure lab computers for App-V Evaluation @@ -34,7 +33,7 @@ Use the following links for information about setting up the App-V server in you - [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) -### Installing the App-V Client +### Enabling the App-V Client Use the following link for more information about creating and managing virtualized packages in your lab environment. diff --git a/windows/manage/appv-for-windows.md b/windows/manage/appv-for-windows.md index d127094cb6..aae7e37db8 100644 --- a/windows/manage/appv-for-windows.md +++ b/windows/manage/appv-for-windows.md @@ -12,7 +12,7 @@ ms.prod: w10 # Application Virtualization (App-V) for Windows 10 overview -The topics in this section provides information and step-by-step procedures to help you administer App-V and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. +The topics in this section provide information and step-by-step procedures to help you administer App-V and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. [Getting Started with App-V](appv-getting-started.md) diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md index 1923a4353a..a272035fa1 100644 --- a/windows/manage/appv-getting-started.md +++ b/windows/manage/appv-getting-started.md @@ -1,6 +1,6 @@ --- title: Getting Started with App-V (Windows 10) -description: Getting Started with App-V +description: Getting Started with App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md index f9978a7b46..9558f87d73 100644 --- a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -1,6 +1,6 @@ --- title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services (Windows 10) -description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services +description: How to install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -14,7 +14,7 @@ ms.prod: w10 Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. -**Note**   +>**Note**   After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases.   @@ -39,7 +39,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - **Note**   + >**Note**   If you plan to deploy the management server on the same computer you must select **Use this local computer**.   diff --git a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md index de8e7c0416..433492faf0 100644 --- a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md @@ -28,7 +28,7 @@ Use the following procedure to install the management server on a standalone com 6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - **Note**   + >**Note**   If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**.   @@ -45,7 +45,7 @@ Use the following procedure to install the management server on a standalone com 9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md index f9f66a2120..64a5da1508 100644 --- a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md @@ -1,6 +1,6 @@ --- title: How to Install the Publishing Server on a Remote Computer (Windows 10) -description: How to Install the Publishing Server on a Remote Computer +description: How to Install the App-V Publishing Server on a Remote Computer author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -44,7 +44,7 @@ Use the following procedure to install the publishing server on a separate compu 3. Type the name of this server and a description (if required) and click **Add**. -9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: +9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: `` @@ -62,7 +62,7 @@ Use the following procedure to install the publishing server on a separate compu `` - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md index 5fbc775cc8..92d0971f36 100644 --- a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -1,6 +1,6 @@ --- title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database (Windows 10) -description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database +description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -50,7 +50,7 @@ Before performing the following procedure you should read and understand [About 8. Click **Install**. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index 110f5d08a1..dca76e75eb 100644 --- a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -1,6 +1,6 @@ --- title: How to Load the PowerShell Cmdlets and Get Cmdlet Help (Windows 10) -description: How to Load the PowerShell Cmdlets and Get Cmdlet Help +description: How to Load the App-V PowerShell Cmdlets and Get Cmdlet Help author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/manage/appv-maintaining-appv.md b/windows/manage/appv-maintaining-appv.md index 487547914c..525a693300 100644 --- a/windows/manage/appv-maintaining-appv.md +++ b/windows/manage/appv-maintaining-appv.md @@ -25,7 +25,7 @@ The App-V server connects to the App-V database. Therefore you can install the m Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. -Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. +Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.1 and later, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. ## Have a suggestion for App-V? From a8fd85ea89bf18113135234c7ef7e776bf5f03e5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 10 Aug 2016 10:42:59 -0700 Subject: [PATCH 067/421] change Config Mgr link, ref --- windows/manage/manage-corporate-devices.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/manage/manage-corporate-devices.md b/windows/manage/manage-corporate-devices.md index f291375dbb..aca3fb1ea1 100644 --- a/windows/manage/manage-corporate-devices.md +++ b/windows/manage/manage-corporate-devices.md @@ -34,7 +34,7 @@ Your employees using devices that are owned by the organization can connect to A You can join a device running Windows 10 to an on-premises Active Directory domain after the first-run experience (sometimes called out-of-box experience or OOBE). You can add devices running Windows 10 to your existing Active Directory infrastructure and manage them just as you've always been used to managing PCs running Windows. -Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center 2012 R2 Configuration Manager. The following table shows the management support for Windows 10 in Configuration Manager. +Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center Configuration Manager (current branch). The following table shows the management support for Windows 10 in Configuration Manager.
    @@ -49,7 +49,7 @@ Desktop devices running Windows 10 that are joined to an Active Directory domai - + From 7cb073edf4bdd6f7fb29d889a6e38c873b269c2d Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 10 Aug 2016 10:44:46 -0700 Subject: [PATCH 068/421] Updated loc tag to remove extra "h" on the end --- devices/surface-hub/set-up-your-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md index 0ce8d6e7d7..95b7c2c92f 100644 --- a/devices/surface-hub/set-up-your-surface-hub.md +++ b/devices/surface-hub/set-up-your-surface-hub.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: surfacehub author: TrudyHa -localizationpriority: mediumh +localizationpriority: medium --- # Set up Microsoft Surface Hub From e84cd1c5f1b62d9e46227a3e91691d57360b67d1 Mon Sep 17 00:00:00 2001 From: iaanw Date: Wed, 10 Aug 2016 12:30:30 -0700 Subject: [PATCH 069/421] BAFS is enabled by default and can only be disabled manually --- .../windows-defender-block-at-first-sight.md | 85 +++++++++++-------- 1 file changed, 51 insertions(+), 34 deletions(-) diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index 179ad0de5a..e6c2092f3f 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -18,9 +18,13 @@ author: iaanw - Windows 10, version 1607 +**Audience** + +- Network administrators + Block at First Sight is a feature of Windows Defender cloud protection that provides a way to detect and block new malware within seconds. -It is enabled by default when certain pre-requisite settings are also enabled. +It is enabled by default when certain pre-requisite settings are also enabled. In most cases, these pre-requisite settings are also enabled by default, so the feature is running without any intervention. ## How it works @@ -36,17 +40,11 @@ The file-based determination typically takes 1 to 4 seconds. > Suspicious file downloads requiring additional backend processing to reach a determination will be locked by Windows Defender on the first machine where the file is encountered, until it is finished uploading to the backend. Users will see a longer "Running security scan" message in the browser while the file is being uploaded. This might result in what appear to be slower download times for some files. -## Enable Block at First Sight +## Confirm Block at First Sight is enabled -### Use Group Policy to configure Block at First Sight +Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender deployments in enterprise networks. -You can use Group Policy to control whether Windows Defender will continue to lock a suspicious file until it is uploaded to the backend. - -This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. - -Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. - -**Configure pre-requisite cloud protection Group Policy settings:** +**Confirm pre-requisite cloud protection Group Policy settings:** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -56,9 +54,9 @@ Block at First Sight requires a number of Group Policy settings to be configured 5. Expand the tree to **Windows components > Windows Defender > MAPS** and configure the following Group Policies: - 1. Double-click the **Join Microsoft MAPS** setting and set the option to **Enabled**. Click **OK**. + 1. Double-click the **Join Microsoft MAPS** setting and ensure the option is set to **Enabled**. Click **OK**. - 1. Double-click the **Send file samples when further analysis is required** setting and set the option as **Enabled** and the additional options as either of the following: + 1. Double-click the **Send file samples when further analysis is required** setting and ensure the option is set to **Enabled** and the additional options are either of the following: 1. Send safe samples (1) @@ -67,21 +65,54 @@ Block at First Sight requires a number of Group Policy settings to be configured > [!NOTE] > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. - 1. Click OK after both Group Policies have been set. + 1. Click **OK**. 1. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender > Real-time Protection**: - 1. Double-click the **Scan all downloaded files and attachments** setting and set the option to **Enabled**. Click **OK**. + 1. Double-click the **Scan all downloaded files and attachments** setting and ensure the option is set to **Enabled**. Click **OK**. - 1. Double-click the **Turn off real-time protection** setting and set the option to **Disabled**. Click **OK**. + 1. Double-click the **Turn off real-time protection** setting and ensure the option is set to **Disabled**. Click **OK**. + +If you had to change any of the settings, you should re-deploy the Group Policy Object across your network to ensure all endpoints are covered. + +> [!IMPORTANT] +> There is no specific UI change or individual setting in System Center Configuration Manager to enable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. +## Confirm Block at First Sight is enabled on individual clients -**Enable Block at First Sight with Group Policy** +You can confirm that Block at First Sight is enabled in Windows Settings. The feature is automatically enabled, as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. -The Block at First Sight feature is automatically enabled when the pre-requisite settings have been applied. +**Confirm Block at First Sight is enabled on individual clients** -You can manually disable the feature. You might want to do this so you can turn off the feature but still retain the pre-requisite settings. +> [!IMPORTANT] +> Changes to the pre-requisite settings will determine whether the feature is enabled or not. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. + +> [!NOTE] +> If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. + +1. Open Windows Defender settings: + + a. Open the Windows Defender app and click **Settings**. + + b. On the main Windows Settings page, click **Update & Security** and then **Windows Defender**. + +2. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. + +> [!IMPORTANT] +> These settings can be overridden by future deployments of a Group Policy Object. + +## Disable Block at First Sight + +> [!WARNING] +> Disabling the Block at First Sight feature will lower the protection state of the endpoint and your network. + +You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. + +> [!NOTE] +> You cannot disable Block at First Sight with System Center Configuration Manager + +**Disable Block at First Sight with Group Policy** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -96,23 +127,9 @@ You can manually disable the feature. You might want to do this so you can turn > [!NOTE] > Disabling the Block at First Sight feature will not disable or alter the pre-requisite group policies. -### Manually enable Block at First Sight on individual clients - -Block at First Sight is automatically enabled on un-managed clients that are running Windows 10, as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. You can manually disable the feature on individual endpoints. - -**Disable Block at First Sight on individual clients** - -1. Open Windows Defender settings: - - a. Open the Windows Defender app and click **Settings**. - - b. On the main Windows Settings page, click **Update & Security** and then **Windows Defender**. - -2. Switch **Cloud-based Protection** and **Automatic sample submission** to **Off**. - -> [!NOTE] -> These settings will be overridden if the network administrator has configured their associated Group Policies. The settings will appear grayed out and you will not be able to modify them if they are being managed by Group Policy. ## Related topics - [Windows Defender in Windows 10](windows-defender-in-windows-10.md) + + From 80969f68957d2cc014f62e7636ff1ba2eee2fc68 Mon Sep 17 00:00:00 2001 From: iaanw Date: Wed, 10 Aug 2016 12:41:50 -0700 Subject: [PATCH 070/421] Lower protection warning --- windows/keep-secure/windows-defender-block-at-first-sight.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index e6c2092f3f..ce529ce56a 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -62,7 +62,7 @@ Block at First Sight requires a number of Group Policy settings to be configured 1. Send all samples (3) - > [!NOTE] + > [!WARNING] > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. 1. Click **OK**. From d273e56443bdf6c1482e866bc9bd9eddb4c01b06 Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Wed, 10 Aug 2016 14:23:31 -0700 Subject: [PATCH 071/421] Latest batch of App-V updates --- ...-migrating-to-appv-from-a-previous-version.md | 15 ++++++--------- ...v-move-the-appv-server-to-another-computer.md | 4 ++-- windows/manage/appv-planning-to-deploy-appv.md | 8 +++++--- windows/manage/appv-prerequisites.md | 7 ++++--- .../appv-release-notes-for-appv-for-windows.md | 10 +++++----- windows/manage/appv-reporting.md | 16 ++++++++-------- windows/manage/appv-supported-configurations.md | 5 +++-- ...r-windows-10-from-an-existing-installation.md | 2 ++ 8 files changed, 35 insertions(+), 32 deletions(-) diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index c6ff02b2cb..a0df7a5306 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -1,6 +1,6 @@ --- title: Migrating to App-V from a Previous Version (Windows 10) -description: Migrating to App-V from a Previous Version +description: Migrating to App-V for Windows 10 from a previous version author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,17 +9,14 @@ ms.prod: w10 --- -# Migrating to App-V from a Previous Version +# Migrating to App-V from previous versions +Applies to: Windows 10, version 1607 -With Microsoft Application Virtualization (App-V), you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V infrastructure. -However, you cannot migrate directly from App-V 4.x to App-V for Windows 10—you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating to App-V server from a Previous Version](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version) - -**Note**   -Packages for App-V for Windows 10 are exactly the same as packages for App-V 5.0. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V for Window 10 packages. - -For information about the differences between earlier versions of App-V, see the **Differences between App-4.6 and App-V 5.0 section** of [About App-V 5.0](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/about-app-v-50). +When you upgrade your existing App-V environment to App-V for Windows 10, version 1607, you'll experience more flexibility, integratation, and ease of management. You can upgrade from any App-V 5.x release, however, you cannot upgrade directly from App-V 4.x to App-V for Windows 10; you must upgrade to App-V 5.x first. For more information about upgrading to App-V for Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) +>**Note**   +THe package format for App-V packages created with App-V 5.x has not changed in App-V for Windows 10. As a result, you don't need to convert packages. ## Improvements to the App-V Package Converter diff --git a/windows/manage/appv-move-the-appv-server-to-another-computer.md b/windows/manage/appv-move-the-appv-server-to-another-computer.md index 243e056c65..0a7e9d26c6 100644 --- a/windows/manage/appv-move-the-appv-server-to-another-computer.md +++ b/windows/manage/appv-move-the-appv-server-to-another-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 --- -# How to Move the App-V Server to Another Computer +# How to move the App-V server to another computer Use the following information to create a new management server console in your environment. @@ -17,7 +17,7 @@ Use the following information to create a new management server console in your ## To create a new management server console -The following list displays the steps necessary to create a new management server console: +Follow these steps to create a new management server console: 1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V server](appv-deploying-the-appv-server.md). diff --git a/windows/manage/appv-planning-to-deploy-appv.md b/windows/manage/appv-planning-to-deploy-appv.md index bc891dc8ee..997ba3e4e0 100644 --- a/windows/manage/appv-planning-to-deploy-appv.md +++ b/windows/manage/appv-planning-to-deploy-appv.md @@ -9,13 +9,15 @@ ms.prod: w10 --- -# Planning to Deploy App-V +# Planning to Deploy App-V for Windows 0 -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for App-V. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. +Applies to: Windows 10, version 1607 + +There are a number of different deployment configurations and requirements to consider before you deploy App-V for Windows 10. Review this topic for information about what you'll need to formulate a deployment plan that best meets your business requirements. ## App-V supported configurations -Describes the minimum hardware and operating system requirements for each App-V components. For information about software prerequisites that you must install before you install App-V, see [App-V Prerequisites](appv-prerequisites.md). +Describes the minimum hardware and operating system requirements for each App-V components. For information about software that you must install before you install App-V, see [App-V Prerequisites](appv-prerequisites.md). [App-V Supported Configurations](appv-supported-configurations.md) diff --git a/windows/manage/appv-prerequisites.md b/windows/manage/appv-prerequisites.md index 19ca1f59f3..5ba350c779 100644 --- a/windows/manage/appv-prerequisites.md +++ b/windows/manage/appv-prerequisites.md @@ -9,12 +9,13 @@ ms.prod: w10 --- -# App-V Prerequisites +# App-V for Windows 10 Prerequisites +Applies to: Windows 10, version 1607 -Before installing App-V, ensure that you have installed all of the following required prerequisite software. +Before installing App-V for Windows 10, ensure that you have installed all of the following required prerequisite software. -For a list of supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client, see [App-V Supported Configurations](appv-supported-configurations.md). +For a list of supported operating systems and hardware requirements for the App-V server, sequencer, and client, see [App-V Supported Configurations](appv-supported-configurations.md). ## Summary of software preinstalled on each operating system diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index c60f1dd5b5..ef3c356c57 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -13,15 +13,15 @@ ms.prod: w10 Applies to: Windows 10, version 1607 -The following is a known issue in Microsoft Application Virtualization (App-V) in Windows 10, version 1607: +The following is a known issue in Application Virtualization (App-V) for Windows 10, version 1607: -**MSI packages generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client** +**Windows Installer packages (.msi files) generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client** -When MSI packages are generated by an older sequencer (App-V versions 5.1 and earlier), they include a check to ensure the App-V client is installed before allowing the MSI package to install. Now that the App-V client is installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. +MSI packages that were generated using an App-V sequencer from previous versions of App-V (App-V versions 5.1 and earlier) include a check to validate that the App-V client is installed on client devices before allowing the MSI package to install. Now that the App-V client is installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. **Workaround**: -1. Install the latest App-V sequencer, which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). +1. Install the latest App-V sequencer, which you can get from the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). 2. Ensure that you have installed the **MSI Tools** included in the Windows 10 SDK, available as follows: @@ -48,4 +48,4 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros ## Related topics -[About App-V](appv-about-appv.md) +[What's new in App-V for Windows 10](appv-about-appv.md) diff --git a/windows/manage/appv-reporting.md b/windows/manage/appv-reporting.md index b76c62fad9..bd794779e4 100644 --- a/windows/manage/appv-reporting.md +++ b/windows/manage/appv-reporting.md @@ -12,9 +12,9 @@ ms.prod: w10 # About App-V Reporting -Microsoft Application Virtualization (App-V) includes a built-in reporting feature that helps you collect information about computers running the App-V client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. +Application Virtualization (App-V) includes a built-in reporting feature that helps you collect information about computers running the App-V client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. -## App-V Reporting Overview +## App-V Reporting Overview The following list displays the end–to-end high-level workflow for reporting in App-V. @@ -33,7 +33,7 @@ The following list displays the end–to-end high-level workflow for reporting i 3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at . - **Note**   + >**Note**   If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V.   @@ -52,14 +52,14 @@ The following list displays the end–to-end high-level workflow for reporting i 6. When the App-V client receives the success notification, it empties the data cache to conserve space. - **Note**   - By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. + >**Note**   + By default, the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache.   If the App-V client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. -### App-V reporting server frequently asked questions +### App-V reporting server frequently asked questions The following table displays answers to common questions about App-V reporting @@ -124,10 +124,10 @@ The following table displays answers to common questions about App-V reporting   -## App-V Client Reporting +## App-V Client Reporting -To use App-V reporting you must install and configure the App-V client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](appv-client-configuration-settings.md). The following section provides examples of App-V client reporting configuration using PowerShell. +To use App-V reporting you must enable and configure the App-V client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](appv-client-configuration-settings.md). The following section provides examples of App-V client reporting configuration using PowerShell. ### Configuring App-V Client reporting using PowerShell diff --git a/windows/manage/appv-supported-configurations.md b/windows/manage/appv-supported-configurations.md index b93d27a77c..3849c350d8 100644 --- a/windows/manage/appv-supported-configurations.md +++ b/windows/manage/appv-supported-configurations.md @@ -11,12 +11,13 @@ ms.prod: w10 # App-V Supported Configurations +Applies to: Windows 10, version 1607 -This topic specifies the requirements to install and run App-V in your environment. +This topic specifies the requirements to install and run App-V in your Windows 10 environment. ## App-V Server system requirements -This section lists the operating system and hardware requirements for all of the App-V Server components. +This section lists the operating system and hardware requirements for all of the App-V server components. ### Unsupported App-V server scenarios diff --git a/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index c93a7f9be1..3ae22a7bee 100644 --- a/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -10,6 +10,8 @@ ms.prod: w10 # Upgrading to App-V for Windows 10 from an existing installation +Applies to: Windows 10, version 1607 + If you’re already using App-V and you’re planning to upgrade user devices to Windows 10, you need to make only the following few adjustments to your existing environment to start using App-V for Windows 10. 1. [Upgrade user devices to Windows 10](#upgrade-user-devices-to-windows-10). Performing an in-place upgrade automatically installs the App-V client and migrates users’ App-V applications and settings. From 17abef26f5805e539ec88f3b402bd4f6b1e6d7c8 Mon Sep 17 00:00:00 2001 From: Maggie Evans Date: Wed, 10 Aug 2016 14:41:19 -0700 Subject: [PATCH 072/421] App-V corrections --- windows/manage/appv-getting-started.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md index a272035fa1..68cd9233fd 100644 --- a/windows/manage/appv-getting-started.md +++ b/windows/manage/appv-getting-started.md @@ -30,8 +30,8 @@ To start using App-V to deliver virtual applications to users, you’ll need to | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

    **Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:
    - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.
    - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).

    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. -| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10.
    For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

    **Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:

    - The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.

    - The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).

    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. +| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.

    For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | | App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit). | For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). From 9f248b940ad23a11ae39a83b1759aff20a406a6f Mon Sep 17 00:00:00 2001 From: SuhasManangi Date: Wed, 10 Aug 2016 14:51:50 -0700 Subject: [PATCH 073/421] Update device-guard-deployment-guide.md --- windows/keep-secure/device-guard-deployment-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 602bfdf4e3..cf8c3bd107 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -15,7 +15,7 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 Enterprise to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. +Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 (available in Enterprise and Education desktop SKUs and in all Server SKUs) to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. It includes: From 2f69336d899622b5d7dbb011f42a57867503a8ed Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 10 Aug 2016 14:53:41 -0700 Subject: [PATCH 074/421] fixing redirect link --- windows/whats-new/device-guard-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index 4009a8845d..926ad68867 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft -redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/whats-new-windows-10-version-1507-and-1511 +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # Device Guard overview From ceebe7f10bdf9fd40db2cbaeb66acdb0455cfc7f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 10 Aug 2016 15:28:30 -0700 Subject: [PATCH 075/421] fixing link --- .../deploy-device-guard-enable-virtualization-based-security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index fdd547a277..c64e07578a 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -20,7 +20,7 @@ Hardware-based security features, also called virtualization-based security or V 2. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). -3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool]((https://www.microsoft.com/en-us/download/details.aspx?id=53337)), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). +3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). 4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following sections in this topic: From 01417e64d110bb73f7ffdae60907cffbb6828b4b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 11 Aug 2016 14:07:16 +1000 Subject: [PATCH 076/421] Redirected page --- ...nal-configuration-windows-advanced-threat-protection.md | 7 +++++++ ...onitor-onboarding-windows-advanced-threat-protection.md | 7 +++++++ 2 files changed, 14 insertions(+) create mode 100644 windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md create mode 100644 windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md diff --git a/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..279966110f --- /dev/null +++ b/windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md @@ -0,0 +1,7 @@ + --- + redirect_url: https://technet.microsoft.com/en-au/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection + --- + +# Additional Windows Defender ATP configuration settings + +This page has been redirected to [Configure endpoints](https://technet.microsoft.com/en-au/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection) \ No newline at end of file diff --git a/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md new file mode 100644 index 0000000000..a462835906 --- /dev/null +++ b/windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md @@ -0,0 +1,7 @@ + --- + redirect_url: https://technet.microsoft.com/en-au/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection + --- + +# Monitor the Windows Defender Advanced Threat Protection onboarding + +This page has been redirected to [Configure endpoints](https://technet.microsoft.com/en-au/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection) \ No newline at end of file From a1eb06bd3361f5f2a19b147fd0b252662331070a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 11 Aug 2016 07:36:26 -0700 Subject: [PATCH 077/421] update references to Passport --- windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md | 2 +- .../implement-microsoft-passport-in-your-organization.md | 8 ++++---- ...nage-identity-verification-using-microsoft-passport.md | 3 ++- .../microsoft-passport-and-password-changes.md | 2 +- windows/keep-secure/passport-event-300.md | 2 +- .../prepare-people-to-use-microsoft-passport.md | 6 +----- .../keep-secure/why-a-pin-is-better-than-a-password.md | 2 +- windows/keep-secure/windows-hello-in-enterprise.md | 2 +- 8 files changed, 12 insertions(+), 15 deletions(-) diff --git a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md index 28f0292d02..e3c6cbddf6 100644 --- a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md +++ b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md @@ -17,7 +17,7 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -In Windows 10, Version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. +In Windows 10, version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. ![Sign in to a device](images/phone-signin-menu.png) diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index 2dc4c2628a..e449b17214 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -20,7 +20,7 @@ localizationpriority: high You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. > **Important:** The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. Use **Windows Hello for Business** policy settings to manage PINs.   -## Group Policy settings for Passport +## Group Policy settings for Windows Hello for Businness The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. @@ -139,7 +139,7 @@ The following table lists the Group Policy settings that you can configure for H

    [Microsoft System Center Configuration Manager 2016](http://go.microsoft.com/fwlink/p/?LinkId=613622)

    [System Center Configuration Manager (current branch) ](https://technet.microsoft.com/en-us/library/mt346023.aspx)

    Client deployment, upgrade, and management with new and existing features
    -## MDM policy settings for Passport +## MDM policy settings for Windows Hello for Business The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070). @@ -285,8 +285,8 @@ The following table lists the MDM policy settings that you can configure for Win
    -**Note**   -If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. +>[!NOTE]   +> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN.   ## Prerequisites diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index 5422f94366..30bcc08dfa 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -18,7 +18,8 @@ localizationpriority: high In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. -> **Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +>[!NOTE] +> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. Hello addresses the following problems with passwords: - Passwords can be difficult to remember, and users often reuse passwords on multiple sites. diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index dd002d75b8..128f1ffe29 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -9,7 +9,7 @@ ms.pagetype: security author: jdeckerMS localizationpriority: high --- -# Microsoft Passport and password changes +# Windows Hello and password changes **Applies to** - Windows 10 diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 3609eec53d..25c9b86986 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -35,7 +35,7 @@ This is a normal condition. No further action is required. ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index 81f36a3d4e..f6419c6ced 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -83,15 +83,11 @@ If your enterprise enables phone sign-in, users can pair a phone running Windows **Sign in to PC using the phone** -<<<<<<< HEAD + 1. Open the **Microsoft Authenticator** app, choose your account, and tap the name of the PC to sign in to. > **Note: **  The first time that you run the **Microsoft Authenticator** app, you must add an account. ![select a device](images/phone-signin-device-select.png) -======= -1. Open the **Microsoft Authenticator** app and tap the name of the PC to sign in to. - > **Note: **  The first time that you run the **Microsoft Authenticator** app, you must add an account. ->>>>>>> parent of 9891b67... from master   2. Enter the work PIN that you set up when you joined the phone to the cloud domain or added a work account. diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index b9bb671c49..f1321ab0de 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -70,7 +70,7 @@ If you only had a biometric sign-in configured and, for any reason, were unable ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md)   \ No newline at end of file diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 9907572763..28fed4cfd5 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -78,7 +78,7 @@ To allow facial recognition, you must have devices with integrated special infra - [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - [Microsoft Passport guide](microsoft-passport-guide.md) -- [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) +- [Prepare people to use Windows Hello for Work](prepare-people-to-use-microsoft-passport.md) - [PassportforWork CSP](http://go.microsoft.com/fwlink/p/?LinkId=708219)   From ff950d75f58f3c3652b197ad879fc6e3d911b150 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 11 Aug 2016 09:17:21 -0700 Subject: [PATCH 078/421] removing locale from links --- ...-windows-telemetry-in-your-organization.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/manage/configure-windows-telemetry-in-your-organization.md b/windows/manage/configure-windows-telemetry-in-your-organization.md index 9965ade8d5..09dc4ad2c3 100644 --- a/windows/manage/configure-windows-telemetry-in-your-organization.md +++ b/windows/manage/configure-windows-telemetry-in-your-organization.md @@ -66,7 +66,7 @@ Telemetry can sometimes be confused with functional data. Some Windows component There are subtle differences between telemetry and functional data. Windows collects and sends telemetry in the background automatically. You can control how much information is gathered by setting the telemetry level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data. -If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services). +If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services). The following are specific examples of functional data: @@ -150,7 +150,7 @@ The following table defines the endpoints for telemetry services: ### Data use and access -The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). Microsoft may share business reports with OEMs and third party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. +The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. ### Retention @@ -377,15 +377,15 @@ There are a few more settings that you can turn off that may send telemetry info FAQs -- [Cortana, Search, and privacy](http://windows.microsoft.com/en-us/windows-10/cortana-privacy-faq) -- [Windows 10 feedback, diagnostics, and privacy](http://windows.microsoft.com/en-us/windows-10/feedback-diagnostics-privacy-faq) -- [Windows 10 camera and privacy](http://windows.microsoft.com/en-us/windows-10/camera-privacy-faq) -- [Windows 10 location service and privacy](http://windows.microsoft.com/en-us/windows-10/location-service-privacy) -- [Microsoft Edge and privacy](http://windows.microsoft.com/en-us/windows-10/edge-privacy-faq) -- [Windows 10 speech, inking, typing, and privacy](http://windows.microsoft.com/en-us/windows-10/speech-inking-typing-privacy-faq) -- [Windows Hello and privacy](http://windows.microsoft.com/en-us/windows-10/windows-hello-privacy-faq) -- [Wi-Fi Sense](http://windows.microsoft.com/en-us/windows-10/wi-fi-sense-faq) -- [Windows Update Delivery Optimization](http://windows.microsoft.com/en-us/windows-10/windows-update-delivery-optimization-faq) +- [Cortana, Search, and privacy](http://windows.microsoft.com/windows-10/cortana-privacy-faq) +- [Windows 10 feedback, diagnostics, and privacy](http://windows.microsoft.com/windows-10/feedback-diagnostics-privacy-faq) +- [Windows 10 camera and privacy](http://windows.microsoft.com/windows-10/camera-privacy-faq) +- [Windows 10 location service and privacy](http://windows.microsoft.com/windows-10/location-service-privacy) +- [Microsoft Edge and privacy](http://windows.microsoft.com/windows-10/edge-privacy-faq) +- [Windows 10 speech, inking, typing, and privacy](http://windows.microsoft.com/windows-10/speech-inking-typing-privacy-faq) +- [Windows Hello and privacy](http://windows.microsoft.com/windows-10/windows-hello-privacy-faq) +- [Wi-Fi Sense](http://windows.microsoft.com/windows-10/wi-fi-sense-faq) +- [Windows Update Delivery Optimization](http://windows.microsoft.com/windows-10/windows-update-delivery-optimization-faq) Blogs @@ -393,11 +393,11 @@ Blogs Privacy Statement -- [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement) +- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) TechNet -- [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) Web Pages From 4ff194b21aab3ee96e761f8cd4be6cb5506959e6 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 11 Aug 2016 11:41:53 -0700 Subject: [PATCH 079/421] redirecting --- devices/hololens/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/devices/hololens/index.md b/devices/hololens/index.md index 867e2c8492..4b581a5c10 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -1 +1,3 @@ -# Placeholder \ No newline at end of file +--- +redirect_url: https://developer.microsoft.com/windows/holographic/commercial_features +--- From 83ed0961c349a7875c60cdc18c69dc98bbd1eb88 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 11 Aug 2016 12:12:20 -0700 Subject: [PATCH 080/421] opening Windows for public contributions --- .openpublishing.publish.config.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 2358d61c40..c81fb7b606 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -89,7 +89,7 @@ "build_output_subfolder": "windows", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -101,7 +101,7 @@ "branches_to_filter": [ "" ], - "git_repository_url_open_to_public_contributors": "", + "git_repository_url_open_to_public_contributors": "https://github.com/Microsoft/windows-itpro-docs", "skip_source_output_uploading": false, "dependent_repositories": [] } From 110cba96fb9cc43dc332ff29f853364300bfa687 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 11 Aug 2016 13:31:45 -0700 Subject: [PATCH 081/421] adding master branch config --- .openpublishing.publish.config.json | 1 + 1 file changed, 1 insertion(+) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index c81fb7b606..1883afb349 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -102,6 +102,7 @@ "" ], "git_repository_url_open_to_public_contributors": "https://github.com/Microsoft/windows-itpro-docs", + "git_repository_branch_open_to_public_contributors": "master", "skip_source_output_uploading": false, "dependent_repositories": [] } From 55104d4d769b6e5e84764606da6627479f24e270 Mon Sep 17 00:00:00 2001 From: iaanw Date: Thu, 11 Aug 2016 13:42:45 -0700 Subject: [PATCH 082/421] title updates --- .../keep-secure/windows-defender-block-at-first-sight.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index ce529ce56a..35ad409bbd 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -12,7 +12,7 @@ localizationpriority: medium author: iaanw --- -# Enable the Block at First Sight feature in Windows 10 +# Block at First Sight **Applies to** @@ -40,7 +40,7 @@ The file-based determination typically takes 1 to 4 seconds. > Suspicious file downloads requiring additional backend processing to reach a determination will be locked by Windows Defender on the first machine where the file is encountered, until it is finished uploading to the backend. Users will see a longer "Running security scan" message in the browser while the file is being uploaded. This might result in what appear to be slower download times for some files. -## Confirm Block at First Sight is enabled +## Confirm Block at First Sight is enabled at the Group Policy level Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender deployments in enterprise networks. @@ -79,7 +79,7 @@ If you had to change any of the settings, you should re-deploy the Group Policy > There is no specific UI change or individual setting in System Center Configuration Manager to enable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. -## Confirm Block at First Sight is enabled on individual clients +## Confirm Block at First Sight is enabled at the endpoint level You can confirm that Block at First Sight is enabled in Windows Settings. The feature is automatically enabled, as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. From 30cc9c45225ac354ecce143fdb41cc78d742c092 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 11 Aug 2016 13:46:38 -0700 Subject: [PATCH 083/421] remove en-us from links --- .../advanced-uefi-security-features-for-surface-pro-3.md | 2 +- .../surface/customize-the-oobe-for-surface-deployments.md | 4 ++-- devices/surface/manage-surface-dock-firmware-updates.md | 4 ++-- devices/surface/manage-surface-uefi-settings.md | 6 +++--- devices/surface/microsoft-surface-deployment-accelerator.md | 2 +- .../surface/step-by-step-surface-deployment-accelerator.md | 2 +- devices/surface/surface-diagnostic-toolkit.md | 2 +- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md index a590b85c20..7a4c04dabc 100644 --- a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md +++ b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md @@ -23,7 +23,7 @@ To address more granular control over the security of Surface devices, the v3.11 Before you can configure the advanced security features of your Surface device, you must first install the v3.11.760.0 UEFI update. This update is installed automatically if you receive your updates from Windows Update. For more information about how to configure Windows to update automatically by using Windows Update, see [How to configure and use Automatic Updates in Windows]( http://go.microsoft.com/fwlink/p/?LinkID=618030). -To update the UEFI on Surface Pro 3, you can download and install the Surface UEFI updates as part of the Surface Pro 3 Firmware and Driver Pack. These firmware and driver packs are available from the [Surface Pro 3 page](https://www.microsoft.com/en-us/download/details.aspx?id=38826) on the Microsoft Download Center. You can find out more about the firmware and driver packs at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/en-us/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). The firmware and driver packs are available as both self-contained Windows Installer (.msi) and archive (.zip) formats. You can find out more about these two formats and how you can use them to update your drivers at [Manage Surface driver and firmware updates](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-pro-3-firmware-updates). +To update the UEFI on Surface Pro 3, you can download and install the Surface UEFI updates as part of the Surface Pro 3 Firmware and Driver Pack. These firmware and driver packs are available from the [Surface Pro 3 page](https://www.microsoft.com/download/details.aspx?id=38826) on the Microsoft Download Center. You can find out more about the firmware and driver packs at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). The firmware and driver packs are available as both self-contained Windows Installer (.msi) and archive (.zip) formats. You can find out more about these two formats and how you can use them to update your drivers at [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). ## Manually configure additional security settings diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md index aa17e2e68f..9160b9b3f5 100644 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ b/devices/surface/customize-the-oobe-for-surface-deployments.md @@ -25,9 +25,9 @@ In some scenarios, you may want to provide complete automation to ensure that at This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](http://go.microsoft.com/fwlink/p/?LinkID=618042). >**Note:**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](http://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
    -- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) +- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit)
    -- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager) +- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)   diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md index 4d2733a4ad..21c8a0d24f 100644 --- a/devices/surface/manage-surface-dock-firmware-updates.md +++ b/devices/surface/manage-surface-dock-firmware-updates.md @@ -16,12 +16,12 @@ author: jobotto Read about the different methods you can use to manage the process of Surface Dock firmware updates. -The Surface Dock provides external connectivity to Surface devices through a single cable connection that includes Power, Ethernet, Audio, USB 3.0, and DisplayPort. The numerous connections provided by the Surface Dock are enabled by a smart chipset within the Surface Dock device. Like a Surface device’s chipset, the chipset that is built into the Surface Dock is controlled by firmware. For more information about the Surface Dock, see the [Surface Dock demonstration](https://technet.microsoft.com/en-us/mt697552) video. +The Surface Dock provides external connectivity to Surface devices through a single cable connection that includes Power, Ethernet, Audio, USB 3.0, and DisplayPort. The numerous connections provided by the Surface Dock are enabled by a smart chipset within the Surface Dock device. Like a Surface device’s chipset, the chipset that is built into the Surface Dock is controlled by firmware. For more information about the Surface Dock, see the [Surface Dock demonstration](https://technet.microsoft.com/mt697552) video. Like the firmware for Surface devices, firmware for Surface Dock is also contained within a downloaded driver that is visible in Device Manager. This driver stages the firmware update files on the Surface device. When a Surface Dock is connected and the driver is loaded, the newer version of the firmware staged by the driver is detected and firmware files are copied to the Surface Dock. The Surface Dock then begins a two-phase process to apply the firmware internally. Each phase requires the Surface Dock to be disconnected from the Surface device before the firmware is applied. The driver copies the firmware into the dock, but only applies it when the user disconnects the Surface device from the Surface Dock. This ensures that there are no disruptions because the firmware is only applied when the user leaves their desk with the device. >**Note:**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links:
    -- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/en-us/mt697551) from Microsoft Mechanics +- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/mt697551) from Microsoft Mechanics - [Windows Update Makes Surface Better](http://go.microsoft.com/fwlink/p/?LinkId=785354) on the Microsoft Devices Blog   diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md index 7071bb2da7..246334a4d4 100644 --- a/devices/surface/manage-surface-uefi-settings.md +++ b/devices/surface/manage-surface-uefi-settings.md @@ -26,7 +26,7 @@ On the **PC information** page, detailed information about your Surface device i - **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. - **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. -- **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://www.microsoft.com/en-us/download/details.aspx?id=44076). +- **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://www.microsoft.com/download/details.aspx?id=44076). You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC information** page (as shown in Figure 1): @@ -44,7 +44,7 @@ You will also find detailed information about the firmware of your Surface devic *Figure 1. System information and firmware version information* -You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/en-us/support/install-update-activate/surface-update-history) for your device. +You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) for your device. ##Security @@ -70,7 +70,7 @@ On the **Security** page you can also change the configuration of Secure Boot on *Figure 3. Configure Secure Boot* -You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. +You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. ![Configure Surface UEFI security settings](images/manage-surface-uefi-fig4.png "Configure Surface UEFI security settings") diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index c7b442925d..28bbfd35f7 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -83,7 +83,7 @@ You can find a full list of available driver downloads at [Download the latest f ## Changes and updates -SDA is periodically updated by Microsoft. For instructions on how these features are used, see [Step-by-Step: Microsoft Surface Deployment Accelerator](https://technet.microsoft.com/en-us/itpro/surface/step-by-step-surface-deployment-accelerator). +SDA is periodically updated by Microsoft. For instructions on how these features are used, see [Step-by-Step: Microsoft Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator). >**Note:**  To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share.   diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index c2113bd72b..3e6df89af7 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -300,7 +300,7 @@ The **2 – Create Windows Reference Image** task sequence is used to perform a Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations. ->**Note:**  Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt). +>**Note:**  Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).   diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index 78142a380b..283a22273c 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -339,7 +339,7 @@ The device orientation sensor determines what the angle of the Surface device is This test cycles the screen through brightness levels from 0 percent to 100 percent, and then a message is displayed to confirm if the brightness level changed accordingly. You are then prompted to test for brightness reaction. To test the reaction of brightness when running on battery, disconnect the power adapter. The screen should automatically dim when power is disconnected. #### Surface Dock test -The Microsoft Surface Diagnostic Toolkit uses this test only if a Surface Dock is connected to the device. If a Surface Dock is detected, this test verifies that the Surface Dock driver firmware is updated. For more detailed analysis of Surface Dock firmware status and how to manually initiate the firmware update process, see the [Microsoft Surface Dock Updater](https://technet.microsoft.com/en-us/itpro/surface/surface-dock-updater) article. +The Microsoft Surface Diagnostic Toolkit uses this test only if a Surface Dock is connected to the device. If a Surface Dock is detected, this test verifies that the Surface Dock driver firmware is updated. For more detailed analysis of Surface Dock firmware status and how to manually initiate the firmware update process, see the [Microsoft Surface Dock Updater](https://technet.microsoft.com/itpro/surface/surface-dock-updater) article. #### System assessment From 3c6cf6fb5fef0442dd2a309df118ac8f30cd149a Mon Sep 17 00:00:00 2001 From: Iaan Date: Thu, 11 Aug 2016 13:49:10 -0700 Subject: [PATCH 084/421] updates for structure --- .../windows-defender-block-at-first-sight.md | 26 +++++++------------ 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index 35ad409bbd..e4a487a15b 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -40,11 +40,14 @@ The file-based determination typically takes 1 to 4 seconds. > Suspicious file downloads requiring additional backend processing to reach a determination will be locked by Windows Defender on the first machine where the file is encountered, until it is finished uploading to the backend. Users will see a longer "Running security scan" message in the browser while the file is being uploaded. This might result in what appear to be slower download times for some files. -## Confirm Block at First Sight is enabled at the Group Policy level +## Confirm Block at First Sight is enabled Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender deployments in enterprise networks. -**Confirm pre-requisite cloud protection Group Policy settings:** +> [!IMPORTANT] +> There is no specific individual setting in System Center Configuration Manager to enable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. + +### Confirm Block at First Sight is enabled with Group Policy 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -75,22 +78,16 @@ Block at First Sight requires a number of Group Policy settings to be configured If you had to change any of the settings, you should re-deploy the Group Policy Object across your network to ensure all endpoints are covered. -> [!IMPORTANT] -> There is no specific UI change or individual setting in System Center Configuration Manager to enable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. +### Confirm Block at First Sight is enabled with Windows Settings -## Confirm Block at First Sight is enabled at the endpoint level +> [!NOTE] +> If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. You can confirm that Block at First Sight is enabled in Windows Settings. The feature is automatically enabled, as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. **Confirm Block at First Sight is enabled on individual clients** -> [!IMPORTANT] -> Changes to the pre-requisite settings will determine whether the feature is enabled or not. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. - -> [!NOTE] -> If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. - 1. Open Windows Defender settings: a. Open the Windows Defender app and click **Settings**. @@ -99,19 +96,16 @@ You can confirm that Block at First Sight is enabled in Windows Settings. The fe 2. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. -> [!IMPORTANT] -> These settings can be overridden by future deployments of a Group Policy Object. - ## Disable Block at First Sight > [!WARNING] > Disabling the Block at First Sight feature will lower the protection state of the endpoint and your network. -You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. - > [!NOTE] > You cannot disable Block at First Sight with System Center Configuration Manager +You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. + **Disable Block at First Sight with Group Policy** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. From 62a89d16d252acfc727e897d4b33b222a7bf7670 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 11 Aug 2016 13:56:25 -0700 Subject: [PATCH 085/421] opening the remaining docsets for public contributions --- .openpublishing.publish.config.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 1883afb349..576b2cc42a 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -9,7 +9,7 @@ "build_output_subfolder": "education", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -20,7 +20,7 @@ "build_output_subfolder": "browsers/internet-explorer", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -45,7 +45,7 @@ "build_output_subfolder": "mdop", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -56,7 +56,7 @@ "build_output_subfolder": "browsers/edge", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -67,7 +67,7 @@ "build_output_subfolder": "devices/surface", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } @@ -78,7 +78,7 @@ "build_output_subfolder": "devices/surface-hub", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content" } From 363f808a4b533a9bf0142baba4247afe9d9cf6ef Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 11 Aug 2016 14:58:27 -0700 Subject: [PATCH 086/421] added text for released vs. Insider Preview versions of Windows --- ...-operating-system-components-to-microsoft-services.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index d1bedc3492..a2f9376e50 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -273,7 +273,14 @@ To turn off font streaming, create a REG\_DWORD registry setting called **Disabl ### 6. Insider Preview builds -To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. +To turn off Insider Preview builds for a released version of Windows 10: + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. + +To turn off Insider Preview builds for an Insider Preview version of Windows 10: + +> [!NOTE] +> If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds. - Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Insider Program** > **Stop Insider Preview builds**. From 841ca505a29d07375f9759dcc8c41d34a888f708 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 11 Aug 2016 16:43:57 -0700 Subject: [PATCH 087/421] Per request from Suhas, combined two partly-redundant procedures into one --- ...rd-enable-virtualization-based-security.md | 108 ++++++------------ 1 file changed, 35 insertions(+), 73 deletions(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index c64e07578a..ad07a92a09 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -22,10 +22,7 @@ Hardware-based security features, also called virtualization-based security or V 3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). -4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following sections in this topic: - - - [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) - - [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) +4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security for Device Guard](#enable-virtualization-based-security-for-device-guard), later in this topic. For information about enabling Credential Guard, see [Protect derived domain credentials with Credential Guard](credential-guard.md). @@ -45,15 +42,19 @@ Hyper-V Hypervisor and Isolated User Mode (not shown). Figure 1. Enable operating system feature for VBS -After you enable the feature or features, you can configure any additional hardware-based security features you want. The following sections provide more information: -- [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) -- [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) +After you enable the feature or features, you can enable VBS for Device Guard, as described in the following sections. -## Enable Unified Extensible Firmware Interface Secure Boot +## Enable Virtualization Based Security (VBS) -Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10. +Before you begin this process, verify that the target device meets the hardware and firmware requirements for the features that you want, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). Also, confirm that you have enabled the Windows features discussed in the previous section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). -> **Important**  Secure boot settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
    In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
    For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). +There are multiple ways to configure VBS features for Device Guard. You can use the [readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) rather than the procedures in this topic, or you can use the following procedures, either to configure the appropriate registry keys manually or to use Group Policy. + +> **Important**   +> - The settings in the following procedure include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
    In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.
    For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
    +> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers. + +**To configure VBS manually** 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. @@ -65,13 +66,19 @@ Before you begin this process, verify that the target device meets the hardware | ---------------- | ---------------- | | **1** enables the **Secure Boot** option
    **3** enables the **Secure Boot and DMA protection** option | **1** enables the **Secure Boot** option
    **2** enables the **Secure Boot and DMA protection** option | -4. Restart the client computer. +4. With a supported operating system earlier than Windows 10, version 1607, or Windows Server 2016, skip this step, and remain in the same registry subkey. -Unfortunately, it would be time consuming to perform these steps manually on every protected computer in your enterprise. Group Policy offers a much simpler way to deploy UEFI Secure Boot to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you want, you can instead link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups. + With Windows 10, version 1607, or Windows Server 2016, navigate to **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios**. -> **Note**  We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers. +5. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. -### Use Group Policy to deploy Secure Boot +6. Restart the client computer. + +Unfortunately, it would be time consuming to perform these steps manually on every protected computer in your enterprise. Group Policy offers a much simpler way to deploy these features to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you want, you can instead link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups. + +> **Note**  We recommend that you test-enable these features on a group of test computers before you enable them on users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. + +### Use Group Policy to enable VBS 1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. @@ -79,7 +86,7 @@ Unfortunately, it would be time consuming to perform these steps manually on eve Figure 2. Create a new OU-linked GPO -2. Give the new GPO a name, for example, **Contoso Secure Boot GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. +2. Give the new GPO a name, for example, **Contoso VBS settings GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. 3. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. @@ -89,77 +96,32 @@ Unfortunately, it would be time consuming to perform these steps manually on eve Figure 3. Enable VBS -5. Select the **Enabled** button, and then select a secure boot option, such as **Secure Boot**, from the **Select Platform Security Level** list. +5. Select the **Enabled** button, and then choose a secure boot option, such as **Secure Boot**, from the **Select Platform Security Level** list. ![Group Policy, Turn On Virtualization Based Security](images/device-guard-gp.png) - Figure 4. Enable Secure Boot (in Windows 10, version 1607) + Figure 4. Configure VBS, Secure Boot setting (in Windows 10, version 1607) - > **Important**  Secure boot settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
    In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
    For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). + > **Important**  These settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
    In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
    For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). -6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart. +6. For **Virtualization Based Protection of Code Integrity**, select the appropriate option: -7. Check the test computer’s event log for Device Guard GPOs. - - Processed Device Guard policies are logged in event viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. - -## Enable virtualization-based security for kernel-mode code integrity - -Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), and enable the Windows features discussed in the [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security) section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment. - -> **Note**  All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable this feature on a group of test computers before you enable it on users' computers. - -**To configure virtualization-based protection of KMCI manually:** - -1. Navigate to the appropriate registry subkey: - - - With Windows 10, version 1607, or Windows Server 2016:
    **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios** - - - With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
    **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** - -2. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. - -3. Restart the client computer. - -It would be time consuming to perform these steps manually on every protected computer in your enterprise. Instead, use Group Policy to deploy virtualization-based protection of KMCI. This example creates a test OU called *DG Enabled PCs*, which you will use to link the GPO. If you prefer to link the policy to an existing OU rather than create a test OU and scope the policy by using appropriately named computer security groups, that is another option. - -> **Note**  We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. - -### Use Group Policy to configure VBS of KMCI - -1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. - - ![Group Policy Management, create a GPO](images/dg-fig5-createnewou.png) - - Figure 5. Create a new OU-linked GPO - -2. Give the new GPO a name, for example, **Contoso VBS CI Protection GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. - -3. Open the Group Policy Management Editor: Right-click the new GPO, and then click **Edit**. - -4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. - - ![Edit the group policy for Virtualization Based Security](images/dg-fig6-enablevbs.png) - - Figure 6. Enable VBS - -5. Select the **Enabled** button, and then for **Virtualization Based Protection of Code Integrity**, select the appropriate option: - - - With Windows 10, version 1607 or Windows Server 2016, choose an enabled option:
    For an initial deployment or test deployment, we recommend **Enabled without lock**.
    When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. + - With Windows 10, version 1607 or Windows Server 2016, choose an appropriate option:
    For an initial deployment or test deployment, we recommend **Enabled without lock**.
    When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. - With earlier versions of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
    Select the **Enable Virtualization Based Protection of Code Integrity** check box. ![Group Policy, Turn On Virtualization Based Security](images/dg-fig7-enablevbsofkmci.png) - Figure 7. Enable VBS of KMCI (in Windows 10, version 1607) + Figure 5. Configure VBS, Lock setting (in Windows 10, version 1607) -6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. +7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. The settings will take effect upon restart. -7. Check the test client event log for Device Guard GPOs. +8. Check the test computer’s event log for Device Guard GPOs. - Processed Device Guard policies are logged in event viewer under **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy has been successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. + Processed Device Guard policies are logged in event viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. -**Validate enabled Device Guard hardware-based security features** + +### Validate enabled Device Guard hardware-based security features Windows 10 and Windows Server 2016 and later have a WMI class for Device Guard–related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: @@ -260,11 +222,11 @@ Table 1. Win32\_DeviceGuard properties -Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 8. +Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 6. ![Device Guard properties in the System Summary](images/dg-fig11-dgproperties.png) -Figure 8. Device Guard properties in the System Summary +Figure 6. Device Guard properties in the System Summary ## Related topics From 3b5999ac47a0bff06386199348026acfd52102af Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 11 Aug 2016 16:50:46 -0700 Subject: [PATCH 088/421] Fixed a bookmark link --- .../deploy-device-guard-enable-virtualization-based-security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index ad07a92a09..ab38821fff 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -22,7 +22,7 @@ Hardware-based security features, also called virtualization-based security or V 3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). -4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security for Device Guard](#enable-virtualization-based-security-for-device-guard), later in this topic. +4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security for Device Guard](#enable-virtualization-based-security-vbs), later in this topic. For information about enabling Credential Guard, see [Protect derived domain credentials with Credential Guard](credential-guard.md). From e8e94d37ae31bdbae09511dc4155ed17d1226707 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 11 Aug 2016 16:54:15 -0700 Subject: [PATCH 089/421] Fixed a bookmark link --- .../deploy-device-guard-enable-virtualization-based-security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index ab38821fff..bf63f5df7f 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -22,7 +22,7 @@ Hardware-based security features, also called virtualization-based security or V 3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). -4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security for Device Guard](#enable-virtualization-based-security-vbs), later in this topic. +4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs), later in this topic. For information about enabling Credential Guard, see [Protect derived domain credentials with Credential Guard](credential-guard.md). From ea5d88237c69bfa6b7eadf0cc896d58c71856d88 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 11 Aug 2016 18:06:45 -0700 Subject: [PATCH 090/421] Fixed link text for App-V what's new topic --- windows/manage/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index a976bf9afc..e49b9df2ec 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -38,7 +38,7 @@ ## [Application development for Windows as a service](application-development-for-windows-as-a-service.md) ## [Application Virtualization (App-V) for Windows](appv-for-windows.md) ### [Getting Started with App-V](appv-getting-started.md) -#### [About App-V](appv-about-appv.md) +#### [What's new in App-V](appv-about-appv.md) ##### [Release Notes for App-V](appv-release-notes-for-appv-for-windows.md) #### [Evaluating App-V](appv-evaluating-appv.md) #### [High Level Architecture for App-V](appv-high-level-architecture.md) From 93a63ef88b1c1c7b75da0f1f5a285ec6e9a3a0a5 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 11 Aug 2016 19:32:55 -0700 Subject: [PATCH 091/421] Made improvements to http links --- windows/manage/appv-about-appv.md | 2 +- ...pplication-publishing-and-client-interaction.md | 10 +++++----- ...ppv-deploying-microsoft-office-2010-wth-appv.md | 14 +++++++------- ...pv-deploying-microsoft-office-2013-with-appv.md | 14 +++++++------- ...h-electronic-software-distribution-solutions.md | 4 ++-- ...appv-deploying-the-appv-sequencer-and-client.md | 4 ++-- windows/manage/appv-deploying-the-appv-server.md | 2 +- windows/manage/appv-for-windows.md | 2 +- windows/manage/appv-getting-started.md | 2 +- ...ng-on-a-stand-alone-computer-with-powershell.md | 2 +- windows/manage/appv-performance-guidance.md | 4 ++-- ...planning-for-sequencer-and-client-deployment.md | 2 +- ...h-electronic-software-distribution-solutions.md | 2 +- windows/manage/appv-reporting.md | 4 ++-- 14 files changed, 34 insertions(+), 34 deletions(-) diff --git a/windows/manage/appv-about-appv.md b/windows/manage/appv-about-appv.md index 571fcda8b1..5c6ea7dcf4 100644 --- a/windows/manage/appv-about-appv.md +++ b/windows/manage/appv-about-appv.md @@ -90,7 +90,7 @@ Complete the following steps to upgrade each component of the App-V infrastructu

    SQL scripts

    -

    Follow the steps in [How to Deploy the App-V Databases by Using SQL Scripts](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts).

    +

    Follow the steps in [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md).

    diff --git a/windows/manage/appv-application-publishing-and-client-interaction.md b/windows/manage/appv-application-publishing-and-client-interaction.md index 1d9ff36d03..f8eaf4ce98 100644 --- a/windows/manage/appv-application-publishing-and-client-interaction.md +++ b/windows/manage/appv-application-publishing-and-client-interaction.md @@ -67,7 +67,7 @@ The Sequencer creates App-V packages and produces a virtualized application. The   -For information about sequencing, see [Application Virtualization Sequencing Guide](http://go.microsoft.com/fwlink/?LinkID=269810). +For information about sequencing, see [How to Sequence a New Application with App-V](https://technet.microsoft.com/itpro/windows/manage/appv-sequence-a-new-application). ## What’s in the appv file? @@ -123,7 +123,7 @@ To change the default location of the package store during setup, see [Enable th ### Shared Content Store -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information on shared content store mode, see . +If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 ? Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). > [!NOTE] > The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. @@ -600,7 +600,7 @@ This process will re-create both the local and network locations for AppData and In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of PowerShell commands initiated on the computer running the App-V Client. -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012 visit: . +This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177). The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) or use Windows PowerShell: @@ -990,7 +990,7 @@ The App-V Client supports publishing applications with support for COM integrati App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). -Details on App-V integration are available at: . +For details on App-V integration, see [Microsoft Application Virtualization 5.0 Integration](https://blogs.technet.microsoft.com/appv/2013/01/03/microsoft-application-virtualization-5-0-integration). ### Software clients and application capabilities @@ -1059,7 +1059,7 @@ For situations where there is more than one application that could register the The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: . +The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: [App Paths ? A Virtual Application Extension in App-V 5.0](https://blogs.technet.microsoft.com/virtualworld/2012/12/12/app-paths-a-virtual-application-extension-in-app-v-5-0/). ### Virtual application diff --git a/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md index 694046b16c..87112ed665 100644 --- a/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md +++ b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md @@ -65,7 +65,7 @@ The following table shows the App-V versions, methods of Office package creation Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V, refer to the following link for detailed instructions: -[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330676) +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) ## Creating Office 2010 App-V packages using package accelerators @@ -170,7 +170,7 @@ The following table provides a full list of supported integration points for Off

    Active X Controls:

    -

    For more information on ActiveX controls, refer to [ActiveX Control API Reference](http://go.microsoft.com/fwlink/p/?LinkId=331361).

    +

    For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://msdn.microsoft.com/library/office/ms440037(v=office.14).aspx).

    @@ -268,19 +268,19 @@ The following table provides a full list of supported integration points for Off **Office 2013 App-V Packages Additional Resources** -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](http://go.microsoft.com/fwlink/p/?LinkId=330680) +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509) **Office 2010 App-V Packages** -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330681) +[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399) -[Known issues when you create or use an App-V 5.0 Office 2010 package](http://go.microsoft.com/fwlink/p/?LinkId=330682) +[Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619) -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330676) +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) **Connection Groups** -[Deploying Connection Groups in Microsoft App-V v5](http://go.microsoft.com/fwlink/p/?LinkId=330683) +[Deploying Connection Groups in Microsoft App-V v5](https://blogs.technet.microsoft.com/appv/2012/11/06/deploying-connection-groups-in-microsoft-app-v-v5/) [Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md index b092b860ba..1664333c9f 100644 --- a/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md @@ -46,7 +46,7 @@ Use the following table to get information about supported versions of Office an -

    [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md#bkmk-office-vers-supp-appv)

    +

    [Supported versions of Microsoft Office](appv-planning-for-using-appv-with-office.md#bkmk-office-vers-supp-appv)

    • Supported versions of Office

    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

      • @@ -54,7 +54,7 @@ Use the following table to get information about supported versions of Office an
    -

    [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md#bkmk-plan-coexisting)

    +

    [Planning for using App-V with coexisting versions of Office](appv-planning-for-using-appv-with-office.md#bkmk-plan-coexisting)

    Considerations for installing different versions of Office on the same computer

    @@ -860,19 +860,19 @@ The following table describes the requirements and options for deploying Visio 2 [Office Deployment Tool for Click-to-Run](http://go.microsoft.com/fwlink/p/?LinkID=330672) -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](http://go.microsoft.com/fwlink/p/?LinkId=330680) +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509) **Office 2010 App-V Packages** -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330681) +[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399) -[Known issues when you create or use an App-V 5.0 Office 2010 package](http://go.microsoft.com/fwlink/p/?LinkId=330682) +[Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619) -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://go.microsoft.com/fwlink/p/?LinkId=330676) +[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/en-us/kb/2830069) **Connection Groups** -[Deploying Connection Groups in Microsoft App-V v5](http://go.microsoft.com/fwlink/p/?LinkId=330683) +[Deploying Connection Groups in Microsoft App-V v5](https://blogs.technet.microsoft.com/appv/2012/11/06/deploying-connection-groups-in-microsoft-app-v-v5/) [Managing Connection Groups](appv-managing-connection-groups.md) diff --git a/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md index 40d840f195..67811c04b2 100644 --- a/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -14,7 +14,7 @@ ms.prod: w10 You can deploy App-V packages using an Electronic Software Distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md). -To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=281816) +To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682125.aspx#BKMK_Appv) ## How to deploy virtualized packages using an ESD @@ -38,7 +38,7 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros ## Other resources for using an ESD and App-V -Use the following link for more information about [App-V and Citrix Integration](http://go.microsoft.com/fwlink/?LinkId=330294 ) (http://go.microsoft.com/fwlink/?LinkId=330294). +Use the following link for more information about [App-V and Citrix Integration](https://www.microsoft.com/en-us/download/details.aspx?id=40885). [Operations for App-V](appv-operations.md) diff --git a/windows/manage/appv-deploying-the-appv-sequencer-and-client.md b/windows/manage/appv-deploying-the-appv-sequencer-and-client.md index 19cb04b5f4..809872cdec 100644 --- a/windows/manage/appv-deploying-the-appv-sequencer-and-client.md +++ b/windows/manage/appv-deploying-the-appv-sequencer-and-client.md @@ -76,9 +76,9 @@ There might be cases when the administrator pre-loads some virtual applications The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V client. The Sequencer helps provide a simple and predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. -For a list of changes in the App-V Sequencer, see [About App-V](appv-about-appv.md). +For a list of changes in the App-V Sequencer, see [What's new in App-V](appv-about-appv.md#bkmk-seqimprove). -[How to Install the Sequencer](appv-install-the-sequencer.md) +To deploy the sequencer, see [How to Install the Sequencer](appv-install-the-sequencer.md). ## App-V Client and Sequencer logs diff --git a/windows/manage/appv-deploying-the-appv-server.md b/windows/manage/appv-deploying-the-appv-server.md index 60f2618aad..c690b835bd 100644 --- a/windows/manage/appv-deploying-the-appv-server.md +++ b/windows/manage/appv-deploying-the-appv-server.md @@ -16,7 +16,7 @@ Applies to: Windows 10, version 1607 You can install the Application Virtualization (App-V) server components using different deployment configurations, which are described in this topic. Before you install the server features, review the server section of [App-V Security Considerations](appv-security-considerations.md). -For information about deploying App-V for Windows 10, see [About App-V](appv-about-appv.md). +For information about deploying App-V for Windows 10, see [What's new in App-V](appv-about-appv.md). >**Important**
    Before you install and configure the App-V servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. diff --git a/windows/manage/appv-for-windows.md b/windows/manage/appv-for-windows.md index aae7e37db8..17e12bb59e 100644 --- a/windows/manage/appv-for-windows.md +++ b/windows/manage/appv-for-windows.md @@ -16,7 +16,7 @@ The topics in this section provide information and step-by-step procedures to he [Getting Started with App-V](appv-getting-started.md) -- [About App-V](appv-about-appv.md) +- [What's new in App-V](appv-about-appv.md) - [Evaluating App-V](appv-evaluating-appv.md) - [High Level Architecture for App-V](appv-high-level-architecture.md) - [Accessibility for App-V](appv-accessibility.md) diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md index 68cd9233fd..de7fadffcd 100644 --- a/windows/manage/appv-getting-started.md +++ b/windows/manage/appv-getting-started.md @@ -41,7 +41,7 @@ If you are new to this product, we recommend that you read the documentation tho ## Getting started with App-V -- [About App-V](appv-about-appv.md) +- [What's new in App-V](appv-about-appv.md) Provides a high-level overview of App-V and how it can be used in your organization. diff --git a/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md index 9386a9d9b2..5447eb8b36 100644 --- a/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ b/windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -273,7 +273,7 @@ The pending task will run later, according to the following rules:   -For more information about pending tasks, see [About App-V 5.0 SP2](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks). +For more information about pending tasks, see [Upgrading an in-use App-V package](appv-application-publishing-and-client-interaction.md#upgrading-an-in-use-app-v-package). **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/manage/appv-performance-guidance.md b/windows/manage/appv-performance-guidance.md index d5e0a70918..0154fa543b 100644 --- a/windows/manage/appv-performance-guidance.md +++ b/windows/manage/appv-performance-guidance.md @@ -20,9 +20,9 @@ You should read and understand the following information before reading this doc - [Application Virtualization (App-V) overview](appv-for-windows.md) -- [App-V 5 SP2 Application Publishing and Client Interaction](http://go.microsoft.com/fwlink/?LinkId=395206) +- [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) -- [Microsoft Application Virtualization Sequencing Guide](http://go.microsoft.com/fwlink/?LinkId=269953) +- [Microsoft Application Virtualization Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760) **Note**   Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. diff --git a/windows/manage/appv-planning-for-sequencer-and-client-deployment.md b/windows/manage/appv-planning-for-sequencer-and-client-deployment.md index c2d5c87f95..9911146ef4 100644 --- a/windows/manage/appv-planning-for-sequencer-and-client-deployment.md +++ b/windows/manage/appv-planning-for-sequencer-and-client-deployment.md @@ -19,7 +19,7 @@ Before you can use App-V, you must install the App-V Sequencer, enable the App-V App-V uses a process called sequencing to create virtualized applications and application packages. Sequencing requires the use of a computer that runs the App-V Sequencer. > [!NOTE] -> For information about the new functionality of App-V sequencer, see the **Sequencer Improvements** section of [About App-V](appv-about-appv.md). +> For information about the new functionality of App-V sequencer, see [What's new in App-V](appv-about-appv.md#bkmk-seqimprove). The computer that runs the App-V sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V Supported Configurations](appv-supported-configurations.md). diff --git a/windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md b/windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md index f323d22bfb..e1cbb7a833 100644 --- a/windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md +++ b/windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md @@ -10,7 +10,7 @@ ms.prod: w10 # Planning to Deploy App-V with an electronic software distribution system -If you are using an electronic software distribution system to deploy App-V packages, review the following planning considerations. For information about using System Center Configuration Manager to deploy App-V, see [Introduction to Application Management in Configuration Manager](http://go.microsoft.com/fwlink/?LinkId=281816). +If you are using an electronic software distribution system to deploy App-V packages, review the following planning considerations. For information about using System Center Configuration Manager to deploy App-V, see [Introduction to Application Management in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682125.aspx#BKMK_Appv). Review the following component and architecture requirements options that apply when you use an ESD to deploy App-V packages: diff --git a/windows/manage/appv-reporting.md b/windows/manage/appv-reporting.md index bd794779e4..86af72e123 100644 --- a/windows/manage/appv-reporting.md +++ b/windows/manage/appv-reporting.md @@ -31,7 +31,7 @@ The following list displays the end–to-end high-level workflow for reporting i 2. Install the App-V reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](appv-install-the-reporting-server-on-a-standalone-computer.md). Configure the time when the computer running the App-V client should send data to the reporting server. -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at . +3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports ](https://www.microsoft.com/en-us/download/details.aspx?id=42630). >**Note**   If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V. @@ -286,7 +286,7 @@ To retrieve report information and create reports using App-V you must use one o - **Microsoft SQL Server Reporting Services (SSRS)** - Microsoft SQL Server Reporting Services is available with Microsoft SQL Server. SSRS is not installed when you install the App-V reporting server. It must be deployed separately to generate the associated reports. - Use the following link for more information about using [Microsoft SQL Server Reporting Services](http://go.microsoft.com/fwlink/?LinkId=285596). + Use the following link for more information about using [Microsoft SQL Server Reporting Services](https://technet.microsoft.com/en-us/library/ms159106(v=sql.130).aspx). - **Scripting** – You can generate reports by scripting directly against the App-V reporting database. For example: From dba564210a681fccc54f8575e1e9a72304e69bdc Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 11 Aug 2016 19:38:12 -0700 Subject: [PATCH 092/421] Fixed a character that might not display correctly --- .../appv-application-publishing-and-client-interaction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/appv-application-publishing-and-client-interaction.md b/windows/manage/appv-application-publishing-and-client-interaction.md index f8eaf4ce98..d9e5931749 100644 --- a/windows/manage/appv-application-publishing-and-client-interaction.md +++ b/windows/manage/appv-application-publishing-and-client-interaction.md @@ -123,7 +123,7 @@ To change the default location of the package store during setup, see [Enable th ### Shared Content Store -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 ? Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). +If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information, see [Shared Content Store in Microsoft App-V 5.0 - Behind the Scenes](https://blogs.technet.microsoft.com/appv/2013/07/22/shared-content-store-in-microsoft-app-v-5-0-behind-the-scenes/). > [!NOTE] > The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. From 39f8ae34cf6896c88e29811971de26acaa77449b Mon Sep 17 00:00:00 2001 From: Mattias Fors Date: Fri, 12 Aug 2016 14:56:33 +0200 Subject: [PATCH 093/421] clarifing Just to clarify that when using county code this will not merge/append with TaskPinList without country or region defined. --- windows/manage/configure-windows-10-taskbar.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/configure-windows-10-taskbar.md b/windows/manage/configure-windows-10-taskbar.md index aaa7856125..f731255619 100644 --- a/windows/manage/configure-windows-10-taskbar.md +++ b/windows/manage/configure-windows-10-taskbar.md @@ -175,7 +175,7 @@ If you only want to remove some of the default pinned apps, you would use this m ## Configure taskbar by country or region -The following example shows you how to configure taskbars by country or region. When you specify one or more country or region in ``, the pinned apps in that section are only pinned on computers that are configured for that country or region. When specifying taskbar configuration by country or region, the taskbar will concatenate pinlists together so long as the target computer meets the country or region requirements. If no country or region is specified for a `` node, it will apply to every country and region. +The following example shows you how to configure taskbars by country or region. When you specify one or more country or region in ``, the pinned apps in that section are only pinned on computers that are configured for that country or region. When specifying taskbar configuration by country or region, the taskbar will concatenate pinlists together so long as the target computer meets the country or region requirements. If no country or region is specified for a `` node, it will apply to every country and region, only if the country or region has not been defined prior. Unspecified country or region in `` will not merge with a `` that has country or region specified. ```xml From ce1c1053d1571ada6e2709b54d0ffb8d7ab47680 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 12 Aug 2016 07:39:53 -0700 Subject: [PATCH 094/421] exclude drivers --- windows/whats-new/whats-new-windows-10-version-1607.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index fa89197f86..7eb664abab 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -57,6 +57,7 @@ Windows 10, version 1607, provides administrators with increased control over up - Quality Updates can be deferred up to 30 days and paused for 35 days - Feature Updates can be deferred up to 180 days and paused for 60 days - Update deferrals can be applied to both Current Branch (CB) and Current Branch for Business (CBB) +- Drivers can be excluded from udpates ## Security From 336c2b0000dbd570affb0b1a9ae1da73bfb99570 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 12 Aug 2016 09:19:42 -0700 Subject: [PATCH 095/421] adding Windows breadcrumbs --- windows/breadcrumb/toc.yml | 19 +++++++++++++++++++ windows/docfx.json | 5 +++-- 2 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 windows/breadcrumb/toc.yml diff --git a/windows/breadcrumb/toc.yml b/windows/breadcrumb/toc.yml new file mode 100644 index 0000000000..fa80416cab --- /dev/null +++ b/windows/breadcrumb/toc.yml @@ -0,0 +1,19 @@ +- name: Windows + tocHref: /itpro/windows/ + topicHref: /itpro/windows/index + items: + - name: What's new + tocHref: /itpro/windows/whats-new/ + topicHref: /itpro/windows/whats-new/index + - name: Plan + tocHref: /itpro/windows/plan/ + topicHref: /itpro/windows/plan/index + - name: Deploy + tocHref: /itpro/windows/deploy/ + topicHref: /itpro/windows/deploy/index + - name: Keep secure + tocHref: /itpro/windows/keep-secure/ + topicHref: /itpro/windows/keep-secure/index + - name: Manage + tocHref: /itpro/windows/manage/ + topicHref: /itpro/windows/manage/index \ No newline at end of file diff --git a/windows/docfx.json b/windows/docfx.json index 4d4f037a4c..4b2035530d 100644 --- a/windows/docfx.json +++ b/windows/docfx.json @@ -3,7 +3,7 @@ "content": [ { - "files": ["**/**.md"], + "files": ["**/**.md", "**/**.yml"], "exclude": ["**/obj/**"] } ], @@ -14,7 +14,8 @@ } ], "globalMetadata": { - "ROBOTS": "INDEX, FOLLOW" + "ROBOTS": "INDEX, FOLLOW", + "breadcrumb_path": "/itpro/windows/breadcrumb/toc.json" }, "externalReference": [ ], From a0425c9942a2cf7bd75d875d0239a6bd5cfd37f1 Mon Sep 17 00:00:00 2001 From: iaanw Date: Fri, 12 Aug 2016 11:18:29 -0700 Subject: [PATCH 096/421] update how it works --- .../keep-secure/windows-defender-block-at-first-sight.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md index e4a487a15b..dae2dae33f 100644 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ b/windows/keep-secure/windows-defender-block-at-first-sight.md @@ -30,11 +30,9 @@ It is enabled by default when certain pre-requisite settings are also enabled. I When a Windows Defender client encounters a suspicious but previously undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. -If the cloud backend is unable to make a determination, a copy of the file is requested for additional processing and analysis in the cloud. +If the cloud backend is unable to make a determination, the file will be locked by Windows Defender while a copy is uploaded to the cloud. Only after the cloud has received the file will Windows Defender release the lock and let the file run. The cloud will perform additional analysis to reach a determination, blocking all future encounters of that file. -If the Block at First Sight feature is enabled on the client, the file will be locked by Windows Defender while a copy is uploaded to the cloud, processed, and a verdict returned to the client. Only after a determination is returned from the cloud will Windows Defender release the lock and let the file run. - -The file-based determination typically takes 1 to 4 seconds. +In many cases this process can reduce the response time to new malware from hours to seconds. > [!NOTE] > Suspicious file downloads requiring additional backend processing to reach a determination will be locked by Windows Defender on the first machine where the file is encountered, until it is finished uploading to the backend. Users will see a longer "Running security scan" message in the browser while the file is being uploaded. This might result in what appear to be slower download times for some files. From 0c5612063882c98682e7f303046654cf20c70aab Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 12 Aug 2016 12:33:46 -0700 Subject: [PATCH 097/421] Preparing to do a redirect from appv-planning-for-migrating topic --- windows/manage/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index e49b9df2ec..30561f90ce 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -54,7 +54,6 @@ ##### [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) ##### [Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md) ##### [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md) -##### [Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md) ##### [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md) ##### [Planning to Use Folder Redirection with App-V](appv-planning-folder-redirection-with-appv.md) #### [App-V Planning Checklist](appv-planning-checklist.md) From 5e37de6d9daee6cc3b2aaffd88701713d8d72798 Mon Sep 17 00:00:00 2001 From: Justinha Date: Fri, 12 Aug 2016 12:40:56 -0700 Subject: [PATCH 098/421] Revised all reference to 5.0 and 5.1 --- windows/manage/TOC.md | 8 ++++---- windows/manage/appv-capacity-planning.md | 2 +- windows/manage/appv-planning-checklist.md | 2 +- ...appv-planning-for-appv-server-deployment.md | 18 +++++++++--------- windows/manage/appv-security-considerations.md | 6 +++--- .../manage/appv-sequence-a-new-application.md | 6 +++--- .../manage/appv-supported-configurations.md | 2 +- 7 files changed, 22 insertions(+), 22 deletions(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index a976bf9afc..b46f78d870 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -52,7 +52,7 @@ ##### [App-V Capacity Planning](appv-capacity-planning.md) ##### [Planning for High Availability with App-V](appv-planning-for-high-availability-with-appv.md) ##### [Planning to Deploy App-V with an Electronic Software Distribution System](appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md) -##### [Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md) +##### [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md) ##### [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md) ##### [Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md) ##### [Planning for Using App-V with Office](appv-planning-for-using-appv-with-office.md) @@ -65,9 +65,9 @@ ##### [How to Install the App-V Client for Shared Content Store Mode](appv-install-the-appv-client-for-shared-content-store-mode.md) ##### [How to Install the Sequencer](appv-install-the-sequencer.md) ##### [How to Modify App-V Client Configuration Using the ADMX Template and Group Policy](appv-modify-client-configuration-with-the-admx-template-and-group-policy.md) -#### [Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) -##### [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md) -##### [How to Deploy the App-V 5.1 Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) +#### [Deploying the App-V Server](appv-deploying-the-appv-server.md) +##### [How to Deploy the App-V Server](appv-deploy-the-appv-server.md) +##### [How to Deploy the App-V Server Using a Script](appv-deploy-the-appv-server-with-a-script.md) ##### [How to Deploy the App-V Databases by Using SQL Scripts](appv-deploy-appv-databases-with-sql-scripts.md) ##### [How to Install the Publishing Server on a Remote Computer](appv-install-the-publishing-server-on-a-remote-computer.md) ##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md) diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md index 3388a0522a..eddcb1eb8c 100644 --- a/windows/manage/appv-capacity-planning.md +++ b/windows/manage/appv-capacity-planning.md @@ -925,7 +925,7 @@ For example, an average user can stream a 100 MB package in less than 2 minutes, The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. -## Combining App-V 5.1 Server Roles +## Combining App-V Server Roles Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another. diff --git a/windows/manage/appv-planning-checklist.md b/windows/manage/appv-planning-checklist.md index af28d24d8f..91d7f0fe4e 100644 --- a/windows/manage/appv-planning-checklist.md +++ b/windows/manage/appv-planning-checklist.md @@ -48,7 +48,7 @@ This checklist can be used to help you plan for preparing your organization for Checklist box

    If you plan to use the App-V management server, plan for the required roles.

    -

    [Planning for the App-V 5.1 Server Deployment](appv-planning-for-appv-server-deployment.md)

    +

    [Planning for the App-V Server Deployment](appv-planning-for-appv-server-deployment.md)

    diff --git a/windows/manage/appv-planning-for-appv-server-deployment.md b/windows/manage/appv-planning-for-appv-server-deployment.md index f8bef54407..26fb4f3269 100644 --- a/windows/manage/appv-planning-for-appv-server-deployment.md +++ b/windows/manage/appv-planning-for-appv-server-deployment.md @@ -1,5 +1,5 @@ --- -title: Planning for the App-V 5.1 Server Deployment (Windows 10) +title: Planning for the App-V Server Deployment (Windows 10) description: Planning for the App-V 5.1 Server Deployment author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization @@ -9,15 +9,15 @@ ms.prod: w10 --- -# Planning for the App-V 5.1 Server Deployment +# Planning for the App-V Server Deployment The Microsoft Application Virtualization (App-V) server infrastructure consists of a set of specialized features that can be installed on one or more server computers, based on the requirements of the enterprise. -## Planning for App-V 5.1 Server Deployment +## Planning for App-V Server Deployment -The App-V 5.1 server consists of the following features: +The App-V server consists of the following features: - Management Server – provides overall management functionality for the App-V infrastructure. @@ -29,9 +29,9 @@ The App-V 5.1 server consists of the following features: - Reporting Database – facilitates database predeployments for App-V reporting. -The following list displays the recommended methods for installing the App-V 5.1 server infrastructure: +The following list displays the recommended methods for installing the App-V server infrastructure: -- Install the App-V 5.1 server. For more information, see [How to Deploy the App-V 5.1 Server](appv-deploy-the-appv-server.md). +- Install the App-V server. For more information, see [How to Deploy the App-V Server](appv-deploy-the-appv-server.md). - Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](appv-install-the-management-and-reporting-databases-on-separate-computers.md). @@ -54,7 +54,7 @@ The Management Server does not perform any load balancing. The associated metada ## Server-Related Protocols and External Features -The following displays information about server-related protocols used by the App-V 5.1 servers. The table also includes the reporting mechanism for each server type. +The following displays information about server-related protocols used by the App-V servers. The table also includes the reporting mechanism for each server type. @@ -96,10 +96,10 @@ The following displays information about server-related protocols used by the Ap ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions at [Microsoft Application Virtualization](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics [Planning to Deploy App-V](appv-planning-to-deploy-appv.md) -[Deploying the App-V 5.1 Server](appv-deploying-the-appv-server.md) +[Deploying the App-V Server](appv-deploying-the-appv-server.md) diff --git a/windows/manage/appv-security-considerations.md b/windows/manage/appv-security-considerations.md index 0a114d5036..79d71d971a 100644 --- a/windows/manage/appv-security-considerations.md +++ b/windows/manage/appv-security-considerations.md @@ -29,7 +29,7 @@ Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that wa **Understand the security risks.** The most serious risk to App-V is that its functionality could be hijacked by an unauthorized user who could then reconfigure key data on App-V clients. The loss of App-V functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V 5.1 server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V 5.1 servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. +**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. **Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V, subscribe to the Security Notification service (). @@ -38,7 +38,7 @@ Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that wa ## Accounts and groups in App-V -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V local groups on the App-V 5.1 servers. +A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V local groups on the App-V servers. **Note**   App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. @@ -47,7 +47,7 @@ App-V client computer accounts that need to connect to the publishing server mus ### App-V server security -No groups are created automatically during App-V Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.1 server operations. +No groups are created automatically during App-V Setup. You should create the following Active Directory Domain Services global groups to manage App-V server operations.
    diff --git a/windows/manage/appv-sequence-a-new-application.md b/windows/manage/appv-sequence-a-new-application.md index dbae0de06b..a860b731e8 100644 --- a/windows/manage/appv-sequence-a-new-application.md +++ b/windows/manage/appv-sequence-a-new-application.md @@ -148,7 +148,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD Click **Next**. -7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console. +7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V Management Console. Click **Next**. @@ -193,14 +193,14 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD 3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. > [!IMPORTANT] - > If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package. + > If you are required to disable virus scanning software, you should first scan the computer that runs the App-V Sequencer in order to ensure that no unwanted or malicious files can be added to the package. 4. On the **Type of Application** page, select **Middleware**, and then click **Next**. 5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. +6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. Click **Next**. diff --git a/windows/manage/appv-supported-configurations.md b/windows/manage/appv-supported-configurations.md index 3849c350d8..ab0291c94a 100644 --- a/windows/manage/appv-supported-configurations.md +++ b/windows/manage/appv-supported-configurations.md @@ -25,7 +25,7 @@ The App-V server does not support the following scenarios: - Deployment to a computer that runs the Server Core installation option. -- Deployment to a computer that runs a previous version of the App-V 5.1 server components. You can install App-V side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the Application Virtualization Management Service (HWS) 4.x is not supported. +- Deployment to a computer that runs a previous version of the App-V server components. You can install App-V side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the Application Virtualization Management Service (HWS) 4.x is not supported. - Deployment to a computer that runs Microsoft SQL Server Express edition. From 2d511737f221c3d825023252b940f61fbdcb0cbd Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 12 Aug 2016 12:42:34 -0700 Subject: [PATCH 099/421] Redirecting the planning-for-migrating topic --- ...grating-from-a-previous-version-of-appv.md | 152 +----------------- 1 file changed, 1 insertion(+), 151 deletions(-) diff --git a/windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md b/windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md index 1b58aa37ae..5b98eac02b 100644 --- a/windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md +++ b/windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md @@ -1,154 +1,4 @@ --- title: Planning for Migrating from a Previous Version of App-V (Windows 10) -description: Planning for Migrating from a Previous Version of App-V -author: MaggiePucciEvans -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 +redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-migrating-to-appv-from-a-previous-version --- - - -# Planning for Migrating from a Previous Version of App-V - - -Use the following information to plan how to migrate to Microsoft Application Virtualization (App-V) from previous versions of App-V. - -## Migration requirements - - -Before you start any upgrades, review the following requirements: - -- If you are upgrading from a version earlier than 4.6 SP2, upgrade to version 4.6 SP2 or version 4.6 SP3 first before upgrading to App-V or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components. - -- App-V supports only packages that are created using App-V 5.0 or App-V, or packages that have been converted to the **.appv** format. - -- If you are upgrading the App-V Server from App-V 5.0 SP1, see [About App-V](appv-about-appv.md#bkmk-migrate-to-51) for instructions. - -## Running the App-V client concurrently with App-V 4.6 SP2 or later - - -You can run the App-V client concurrently on the same computer with the App-V 4.6 SP2 client or App-V 4.6 SP3 client. - -When you run coexisting App-V clients, you can: - -- Convert an App-V 4.6 SP2 or 4.6 SP3 package to the App-V format and publish both packages, when you have both clients running. - -- Define the migration policy for the converted package, which allows the converted App-V package to assume the file type associations and shortcuts from the App-V 4.6 SP2 package. - -### Supported coexistence scenarios - -The following table shows the supported App-V coexistence scenarios. We recommend that you install the latest available updates of a given release when you are running coexisting clients. - -
    ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    App-V 4.6.x client typeApp-V client type

    App-V 4.6 SP2

    App-V

    App-V 4.6 SP2 RDS

    App-V RDS

    App-V 4.6 SP3

    App-V

    App-V 4.6 SP3 RDS

    App-V RDS

    - -  - -### Requirements for running coexisting clients - -To run coexisting clients, you must: - -- Install the App-V 4.6 SP2 or App-V 4.6 SP3 client before you install the App-V client. - -- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](http://technet.microsoft.com/library/dn659707.aspx). - -**Note**   -App-V packages can run side by side with App-V 4.X packages if you have coexisting installations of App-V and 4.X. However, App-V packages cannot interact with App-V 4.X packages in the same virtual environment. - -  - -### Client downloads and documentation - -The following table provides links to the App-V 4.6.x client downloads and to the TechNet documentation about the releases. The downloads include the App-V “regular” and RDS clients. The TechNet documentation about the App-V client applies to both clients, unless stated otherwise. - - ----- - - - - - - - - - - - - - - - - - - - -
    App-V versionLink to download the clientLink to TechNet documentation

    App-V 4.6 SP2

    [Microsoft Application Virtualization 4.6 Service Pack 2](http://www.microsoft.com/download/details.aspx?id=35513)

    [About Microsoft Application Virtualization 4.6 SP2](http://technet.microsoft.com/library/jj680847.aspx)

    App-V 4.6 SP3

    [Microsoft Application Virtualization 4.6 Service Pack 3](http://www.microsoft.com/download/details.aspx?id=41187)

    [About Microsoft Application Virtualization 4.6 SP3](http://technet.microsoft.com/library/dn511019.aspx)

    - -  - -For more information about how to configure App-V client coexistence, see: - -- [App-V 5.0 Coexistence and Migration](http://technet.microsoft.com/windows/jj835811.aspx) - -## Converting “previous-version” packages using the package converter - - -Before migrating a package, created using App- 4.6 SP2 or earlier, to App-V, review the following requirements: - -- You must convert the package to the **.appv** file format. - -- The Package Converter supports only the direct conversion of packages that were created by using App-V 4.5 and later. To use the package converter on a package that was created using a previous version, you must use an App-V 4.5 or later version of the sequencer to upgrade the package, and then you can perform the package conversion. - -For more information about using the package converter to convert a package, see [How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md). After you convert the file, you can deploy it to target computers that run the App-V client. - -## Have a suggestion for App-V? - - -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -## Related topics - - -[Planning to Deploy App-V](appv-planning-to-deploy-appv.md) - -  - -  - - - - - From 9863026099a129ca2ddd4132b2215493e3a4e7c9 Mon Sep 17 00:00:00 2001 From: Justinha Date: Fri, 12 Aug 2016 13:40:22 -0700 Subject: [PATCH 100/421] removed prev version info from What's new --- windows/manage/appv-about-appv.md | 341 +----------------- ...grating-to-appv-from-a-previous-version.md | 10 +- 2 files changed, 9 insertions(+), 342 deletions(-) diff --git a/windows/manage/appv-about-appv.md b/windows/manage/appv-about-appv.md index 571fcda8b1..24e04a16d6 100644 --- a/windows/manage/appv-about-appv.md +++ b/windows/manage/appv-about-appv.md @@ -20,7 +20,7 @@ Application Virtualization (App-V) for Windows 10, version 1607, includes these ## App-V is now a feature in Windows 10 -With Windows 10, version 1607 and later releases, Application Virtualization (App-V) is included with [Windows 10 for Enterprise and Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. +With Windows 10, version 1607 and later releases, Application Virtualization (App-V) is included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. For information about earlier versions of App-V, see [MDOP Information Experience](https://technet.microsoft.com/itpro/mdop/index). @@ -28,7 +28,7 @@ The changes in App-V for Windows 10, version 1607 impact already existing implem - The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client. -- The App-V application sequencer is available from the Windows 10 Assessment and Deployment Kit (ADK). In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. +- The App-V application sequencer is available from the [Windows 10 Assessment and Deployment Kit (ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526740). In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. >**Note**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. @@ -38,346 +38,15 @@ For more information about how to configure an existing App-V installation after You can upgrade your existing App-V installation to Windows 10, version 1607 from App-V versions 5.0 SP2 and higher only. If you are using a previous version of App-V, you’ll need to upgrade from that version to App-V 5.0 SP2 before you upgrade to Windows 10, version 1607.   -## Support for using System Center Configuration Manager 2016 with App-V +## Support for System Center -App-V supports System Center 2016 and 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. +App-V supports System Center 2016 and System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager. - - -### Steps to upgrade the App-V infrastructure - -Complete the following steps to upgrade each component of the App-V infrastructure to App-V for Windows. The following order is only a suggestion; you can upgrade components in any order. - - ---- - - - - - - - - - - - - - - - - - - - - -
    StepFor more information

    Step 1: Upgrade the App-V server components.

    -
    -Note   -

    If you are not using the App-V server, skip this step and go to the next step.

    -
    -
    -  -

    Follow these steps:

    -
      -

    1. Do one of the following, depending on the method you are using to upgrade the management database and/or reporting database:

      - ---- - - - - - - - - - - - - - - - - -
      Database upgrade methodStep

      Windows Installer

      Skip this step and go to step 2, “If you are upgrading the App-V server...”

      SQL scripts

      Follow the steps in [How to Deploy the App-V Databases by Using SQL Scripts](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts).

      -

    2. If you are upgrading to App-V for Windows server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 server](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/check-reg-key-svr).

      3. -

    3. Follow the steps in [How to Deploy the App-V Server](appv-deploy-the-appv-server.md)

      4. -

       

      -

    Step 2: Install the new App-V for Windows sequencer.

    See [How to Install the Sequencer](appv-install-the-sequencer.md).

    Step 3: Enable the in-box App-V client.

    See [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).

    - -  - -### Converting packages created using a prior version of App-V - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V for Windows, version 1607. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - ->**Note**   -App-V for Windows packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and so there is no need to convert App-V 5.0 packages to App-V for Windows packages. - -  - -## What’s New in App-V - - -These sections are for users who are already familiar with App-V and want to know what has changed in App-V for Windows. If you are not already familiar with App-V, you should start by reading [Planning for App-V](appv-planning-for-appv.md). - - -### App-V Management Console Changes - -This section compares the App-V for Windows Management Console’s current and previous functionality. - -### Silverlight is no longer required - -The Management Console UI no longer requires Silverlight. The Management Console is built on HTML5 and Javascript. - -### Notifications and messages are displayed individually in a dialog box - - ---- - - - - - - - - - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V for Windows

    Number of messages indicator:

    -

    On the title bar of the App-V Management Console, a number is now displayed next to a flag icon to indicate the number of messages that are waiting to be read.

    You could see only one message or error at a time, and you were unable to determine how many messages there were.

    Message appearance:

    -
      -

    • Messages that require user input appear in a separate dialog box that displays on top of the current page that you were viewing, and require a response before you can dismiss them.

      • -

    • Messages and errors appear in a list, with one beneath the other.

      • -

    You could see only one message or error at a time.

    Dismissing messages:

    -

    Use the Dismiss All link to dismiss all messages and errors at one time, or dismiss them one at a time.

    You could dismiss messages and errors only one at a time.

    - -  - -### Console pages are now separate URLs - - ---- - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V for Windows

    Each page in the console has a different URL, which enables you to bookmark specific pages for quick access in the future.

    -

    The number that appears in some URLs indicates the specific package. These numbers are unique.

    All console pages are accessed through the same URL.

    - -  - -### New, separate CONNECTION GROUPS page and menu option - - ---- - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V for Windows

    The CONNECTION GROUPS page is now part of the main menu, at the same level as the PACKAGES page.

    To open the CONNECTION GROUPS page, you navigate through the PACKAGES page.

    - -  - -### Menu options for packages have changed - - ---- - - - - - - - - - - - - - - - - -
    New in App-V for WindowsPrior to App-V Windows

    The following options are now buttons that appear at the bottom of the PACKAGES page:

    -
      -

    • Add or Upgrade

      • -

    • Publish

      • -

    • Unpublish

      • -

    • Delete

      • -
    -

    The following options will still appear when you right-click a package to open the drop-down context menu:

    -
      -

    • Publish

      • -

    • Unpublish

      • -

    • Edit AD Access

      • -

    • Edit Deployment Config

      • -

    • Transfer deployment configuration from…

      • -

    • Transfer access and configuration from…

      • -

    • Delete

      • -
    -

    When you click Delete to remove a package, a dialog box opens and asks you to confirm that you want to delete the package.

    The Add or Upgrade option was a button at the top right of the PACKAGES page.

    -

    The Publish, Unpublish, and Delete options were available only if you right-clicked a package name in the packages list.

    The following package operations are now buttons on the package details page for each package:

    -
      -

    • Transfer (drop-down menu with the following options):

      -
        -

      • Transfer deployment configuration from…

        • -

      • Transfer access and configuration from…

        • -
      • -

    • Edit (connection groups and AD Access)

      • -

    • Unpublish

      • -

    • Delete

      • -

    • Edit Default Configuration

      • -

    These package options were available only if you right-clicked a package name in the packages list.

    - -  - -### Icons in left pane have new colors and text - -The colors of the icons in the left pane have been changed, and text added, to make the icons consistent with other Microsoft products. - -### Overview page has been removed - -In the left pane of the Management Console, the OVERVIEW menu option and its associated OVERVIEW page have been removed. - -### Sequencer Improvements - -The following improvements have been made to the package editor in the App-V Sequencer. - -#### Import and export the manifest file - -You can import and export the AppxManifest.xml file. To export the manifest file, select the **Advanced** tab and in the Manifest File box, click **Export...**. You can make changes to the manifest file, such as removing shell extensions or editing file type associations. - -After you make your changes, click **Import...** and select the file you edited. After you successfully import it back in, the manifest file is immediately updated within the package editor. - ->**Caution**   -When you import the file, your changes are validated against the XML schema. If the file is not valid, you will receive an error. Be aware that it is possible to import a file that is validated against the XML schema, but that might still fail to run for other reasons. - -  - -#### Addition of Windows 10 to operating systems list - -In the Deployment tab, Windows 10 32-bit and Windows 10-64 bit have been added to the list of operating systems for which you can sequence a package. If you select **Any Operating System**, Windows 10 is automatically included among the operating systems that the sequenced package will support. - -#### Current path displays at bottom of virtual registry editor - -In the Virtual Registry tab, the path now displays at the bottom of the virtual registry editor, which enables you to determine the currently selected key. Previously, you had to scroll through the registry tree to find the currently selected key. - -#### Combined “find and replace” dialog box and shortcut keys added in virtual registry editor - -In the virtual registry editor, shortcut keys have been added for the Find option (Ctrl+F), and a dialog box that combines the “find” and “replace” tasks has been added to enable you to find and replace values and data. To access this combined dialog box, select a key and do one of the following: - -- Press **Ctrl+H** - -- Right-click a key and select **Replace**. - -- Select **View** > **Virtual Registry** > **Replace**. - -Previously, the “Replace” dialog box did not exist, and you had to make changes manually. - -#### Rename registry keys and package files successfully - -You can rename virtual registry keys and files without experiencing Sequencer issues. Previously, the Sequencer stopped working if you tried to rename a key. - -#### Import and export virtual registry keys - -You can import and export virtual registry keys. To import a key, right-click the node under which to import the key, navigate to the key you want to import, and then click **Import**. To export a key, right-click the key and select **Export**. - -#### Import a directory into the virtual file system - -You can import a directory into the VFS. To import a directory, click the **Package Files** tab, and then click **View** > **Virtual File System** > **Import Directory**. If you try to import a directory that contains files that are already in the VFS, the import fails, and an explanatory message is displayed. Prior to App-V, you could not import directories. - -#### Import or export a VFS file without having to delete and then add it back to the package - -You can import files to or export files from the VFS without having to delete the file and then add it back to the package. For example, you might use this feature to export a change log to a local drive, edit the file using an external editor, and then re-import the file into the VFS. - -To export a file, select the **Package Files** tab, right-click the file in the VFS, click **Export**, and choose an export location from which you can make your edits. - -To import a file, select the **Package Files** tab and right-click the file that you had exported. Browse to the file that you edited, and then click **Import**. The imported file will overwrite the existing file. - -After you import a file, you must save the package by clicking **File** > **Save**. - -#### Menu for adding a package file has moved - -The menu option for adding a package file has been moved. To find the Add option, select the **Package Files** tab, then click **View** > **Virtual File System** > **Add File**. Previously, you right-clicked a folder under the VFS node, and chose **Add File**. - -#### Virtual registry node expands MACHINE and USER hives by default - -When you open the virtual registry, the MACHINE and USER hives are shown below the top-level REGISTRY node. Previously, you had to expand the REGISTRY node to show the hives beneath. - -#### Enable or disable Browser Helper Objects - -You can enable or disable Browser Helper Objects by selecting a new check box, Enable Browser Helper Objects, on the Advanced tab of the Sequencer user interface. If Browser Helper Objects: - -- Exist in the package and are enabled, the check box is selected by default. - -- Exist in the package and are disabled, the check box is clear by default. - -- Exist in the package, with one or more enabled and one or more disabled, the check box is set to indeterminate by default. - -- Do not exist in the package, the check box is disabled. - -### Improvements to Package Converter - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -For more information including examples, see [Migrating to App-V for Windows from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md). - -#### Support for multiple scripts on a single event trigger - -App-V supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you are converting from App-V 4.6 to App-V 5.0 or later. To enable the use of multiple scripts, App-V uses a script launcher application, named ScriptRunner.exe, which is installed as part of the App-V client installation. - -For more information, including a list of event triggers and the context under which scripts can be run, see the Scripts section in [About App-V Dynamic Configuration](appv-dynamic-configuration.md). - - ## Have a suggestion for App-V? -Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions at [Microsoft Application Virtualization](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index a0df7a5306..249d1366e3 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -13,10 +13,7 @@ ms.prod: w10 Applies to: Windows 10, version 1607 -When you upgrade your existing App-V environment to App-V for Windows 10, version 1607, you'll experience more flexibility, integratation, and ease of management. You can upgrade from any App-V 5.x release, however, you cannot upgrade directly from App-V 4.x to App-V for Windows 10; you must upgrade to App-V 5.x first. For more information about upgrading to App-V for Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) - ->**Note**   -THe package format for App-V packages created with App-V 5.x has not changed in App-V for Windows 10. As a result, you don't need to convert packages. +To migrate from App-V 4.x to App-V for Windows 10, you must upgrade to App-V 5.x first. ## Improvements to the App-V Package Converter @@ -164,7 +161,8 @@ ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\ ## Converting packages created using a prior version of App-V -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. +Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. App-V packages created with App-V 5.x don't need to be converted. + **Important**   After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. @@ -279,7 +277,7 @@ There is no direct method to upgrade to a full App-V infrastructure. Use the inf

    Migrate existing packages.

    -

    See the Converting packages created using a prior version of App-V section of this article.

    +

    See Converting packages created using a prior version of App-V earlier in this topic.

    From c7b5a886b0396fa6fe0a38ebd026f11bcb7cd108 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 12 Aug 2016 14:21:55 -0700 Subject: [PATCH 101/421] Link fixes, plus a few fixes to typos --- ...ation-publishing-and-client-interaction.md | 2 +- windows/manage/appv-deploy-the-appv-server.md | 2 +- ...eploying-microsoft-office-2010-wth-appv.md | 4 ++-- ...ploying-microsoft-office-2013-with-appv.md | 22 +++++-------------- ...ctronic-software-distribution-solutions.md | 2 +- windows/manage/appv-planning-checklist.md | 2 +- .../manage/appv-planning-to-deploy-appv.md | 4 ++-- .../manage/appv-security-considerations.md | 4 ++-- .../manage/appv-sequence-a-new-application.md | 18 +++++---------- 9 files changed, 21 insertions(+), 39 deletions(-) diff --git a/windows/manage/appv-application-publishing-and-client-interaction.md b/windows/manage/appv-application-publishing-and-client-interaction.md index d9e5931749..fdec3fdd21 100644 --- a/windows/manage/appv-application-publishing-and-client-interaction.md +++ b/windows/manage/appv-application-publishing-and-client-interaction.md @@ -1059,7 +1059,7 @@ For situations where there is more than one application that could register the The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: [App Paths ? A Virtual Application Extension in App-V 5.0](https://blogs.technet.microsoft.com/virtualworld/2012/12/12/app-paths-a-virtual-application-extension-in-app-v-5-0/). +The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: [App Paths - A Virtual Application Extension in App-V 5.0](https://blogs.technet.microsoft.com/virtualworld/2012/12/12/app-paths-a-virtual-application-extension-in-app-v-5-0/). ### Virtual application diff --git a/windows/manage/appv-deploy-the-appv-server.md b/windows/manage/appv-deploy-the-appv-server.md index c85f273c6c..16d49c34e8 100644 --- a/windows/manage/appv-deploy-the-appv-server.md +++ b/windows/manage/appv-deploy-the-appv-server.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.prod: w10 --- -# How to Deploy the App-V Server (new installataion) +# How to Deploy the App-V Server (new installation) >**Important**
    If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. diff --git a/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md index 87112ed665..fe452de031 100644 --- a/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md +++ b/windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md @@ -72,9 +72,9 @@ Sequencing Office 2010 is one of the main methods for creating an Office 2010 pa Office 2010 App-V packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 10, Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator: -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](http://go.microsoft.com/fwlink/p/?LinkId=330677) +- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://gallery.technet.microsoft.com/App-V-50-Package-a29410db) -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](http://go.microsoft.com/fwlink/p/?LinkId=330678) +- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://gallery.technet.microsoft.com/App-V-50-Package-e7ef536b) For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](appv-create-a-virtual-application-package-package-accelerator.md). diff --git a/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md index 1664333c9f..f441e4af00 100644 --- a/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/manage/appv-deploying-microsoft-office-2013-with-appv.md @@ -133,7 +133,7 @@ The following table describes the recommended methods for excluding specific Off

    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

      • -

    • For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).

      • +

    • For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#BKMK_ExcludeAppElement).

    @@ -205,7 +205,7 @@ Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: -1. Download the [Office Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778). +1. Download the [Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778). 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. @@ -810,7 +810,7 @@ The following table describes the requirements and options for deploying Visio 2

    How do I package and publish Visio 2013 and Project 2013 with Office?

    You must include Visio 2013 and Project 2013 in the same package with Office.

    -

    If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](https://technet.microsoft.com/en-us/itpro/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions#bkmk-pkg-pub-reqs).

    +

    If you aren’t deploying Office, you can create a package that contains Visio and/or Project.

    How can I deploy Visio 2013 and Project 2013 to specific users?

    @@ -841,7 +841,7 @@ The following table describes the requirements and options for deploying Visio 2

    1. Create a package that contains Office, Visio, and Project.

    2. Deploy the package to all users.

      3. -

    3. Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.

      4. +

    4. Use [AppLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/applocker-overview) to prevent specific users from using Visio and Project.

    @@ -858,13 +858,13 @@ The following table describes the requirements and options for deploying Visio 2 **Office 2013 App-V Packages Additional Resources** -[Office Deployment Tool for Click-to-Run](http://go.microsoft.com/fwlink/p/?LinkID=330672) +[Office 2013 Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778) [Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://support.microsoft.com/en-us/kb/2772509) **Office 2010 App-V Packages** -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399) +[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399) [Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/en-us/kb/2828619) @@ -882,14 +882,4 @@ The following table describes the requirements and options for deploying Visio 2 ## Have a suggestion for App-V? - Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). - -  - -  - - - - - diff --git a/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md index 67811c04b2..ca135a0bea 100644 --- a/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ b/windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -19,7 +19,7 @@ To deploy App-V packages with Microsoft System Center 2012 Configuration Manage ## How to deploy virtualized packages using an ESD -Describes the methods you can use to deploy App-V packages by using an ESD +Describes the methods you can use to deploy App-V packages by using an ESD. [How to deploy App-V Packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md) diff --git a/windows/manage/appv-planning-checklist.md b/windows/manage/appv-planning-checklist.md index 91d7f0fe4e..b059e11863 100644 --- a/windows/manage/appv-planning-checklist.md +++ b/windows/manage/appv-planning-checklist.md @@ -60,7 +60,7 @@ This checklist can be used to help you plan for preparing your organization for Checklist box

    If applicable, review the options and steps for migrating from a previous version of App-V.

    -

    [Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md)

    +

    [Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md)

    diff --git a/windows/manage/appv-planning-to-deploy-appv.md b/windows/manage/appv-planning-to-deploy-appv.md index 997ba3e4e0..292322be4f 100644 --- a/windows/manage/appv-planning-to-deploy-appv.md +++ b/windows/manage/appv-planning-to-deploy-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 --- -# Planning to Deploy App-V for Windows 0 +# Planning to Deploy App-V for Windows 10 Applies to: Windows 10, version 1607 @@ -55,7 +55,7 @@ Describes the planning considerations for the App-V Client and for the Sequencer Describes the recommended path for migrating from previous versions of App-V, while ensuring that existing server configurations, packages and clients continue to work in your new App-V environment. -[Planning for Migrating from a Previous Version of App-V](appv-planning-for-migrating-from-a-previous-version-of-appv.md) +[Migrating to App-V from a Previous Version](appv-migrating-to-appv-from-a-previous-version.md) ## Planning for using App-V with Office diff --git a/windows/manage/appv-security-considerations.md b/windows/manage/appv-security-considerations.md index 79d71d971a..944d707b04 100644 --- a/windows/manage/appv-security-considerations.md +++ b/windows/manage/appv-security-considerations.md @@ -31,9 +31,9 @@ Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that wa **Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. -**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V, subscribe to the Security Notification service (). +**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V, see the [Microsoft Security TechCenter](https://technet.microsoft.com/en-us/security/bb291012). -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V and App-V administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). +**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V and App-V administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](https://technet.microsoft.com/library/hh994572.aspx). ## Accounts and groups in App-V diff --git a/windows/manage/appv-sequence-a-new-application.md b/windows/manage/appv-sequence-a-new-application.md index a860b731e8..c9d6937c78 100644 --- a/windows/manage/appv-sequence-a-new-application.md +++ b/windows/manage/appv-sequence-a-new-application.md @@ -53,11 +53,9 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD > [!NOTE] > If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. - - + If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then click **Next**. - 6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V Management Console. Click **Next**. @@ -66,8 +64,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD > [!IMPORTANT] > You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring. - - + Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. 8. On the **Installation** page, wait while the sequencer configures the virtualized application package. @@ -76,8 +73,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD > [!NOTE] > To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. - - + Click **Next**. 10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. @@ -109,9 +105,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD > [!IMPORTANT] > The system does not support non-printable characters in **Comments** and **Descriptions**. - -   - +   The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. 15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created. @@ -179,9 +173,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD > [!IMPORTANT]    > The system does not support non-printable characters in Comments and Descriptions. - -   - + The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. **To sequence a middleware application** From c8b046634a3dfa914a06763775b89d0865a072b9 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 12 Aug 2016 14:52:01 -0700 Subject: [PATCH 102/421] Per Chintan's request, added old rel notes back in --- ...appv-release-notes-for-appv-for-windows.md | 123 +++++++++++++++++- 1 file changed, 120 insertions(+), 3 deletions(-) diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index ef3c356c57..dfad3fa3e9 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -13,10 +13,10 @@ ms.prod: w10 Applies to: Windows 10, version 1607 -The following is a known issue in Application Virtualization (App-V) for Windows 10, version 1607: - -**Windows Installer packages (.msi files) generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client** +The following are known issues in Application Virtualization (App-V) for Windows 10, version 1607. +## Windows Installer packages (.msi files) generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client + MSI packages that were generated using an App-V sequencer from previous versions of App-V (App-V versions 5.1 and earlier) include a check to validate that the App-V client is installed on client devices before allowing the MSI package to install. Now that the App-V client is installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. **Workaround**: @@ -41,6 +41,123 @@ MSI packages that were generated using an App-V sequencer from previous versions By default, the path to the Windows SDK installation will be:
    **C:\Program Files (x86)\Windows Kits\10** +## Error occurs during publishing refresh between App-V 5.0 SP3 Management Server and App-V Client on Windows 10 + +An error is generated during publishing refresh when synchronizing packages from the App-V 5.0 SP3 management server to an App-V client on Windows 10. This error occurs because the App-V 5.0 SP3 server does not understand the Windows 10 operating system that is specified in the publishing URL. The issue is fixed for App-V publishing server, but is not backported to versions of App-V 5.0 SP3 or earlier. + +**Workaround**: Upgrade the App-V 5.0 Management server to the App-V Management server for Windows 10 Clients. + +## Custom configurations do not get applied for packages that will be published globally if they are set using the App-V Server + +If you assign a package to an AD group that contains machine accounts and apply a custom configuration to that group using the App-V Server, the custom configuration will not be applied to those machines. The App-V Client will publish packages assigned to a machine account globally. However, it stores custom configuration files per user in each user’s profile. Globally published packages will not have access to this custom configuration. + +**Workaround**: Do one of the following: + +- Assign the package to groups containing only user accounts. This will ensure that the package’s custom configuration will be stored in each user’s profile and will be applied correctly. + +- Create a custom deployment configuration file and apply it to the package on the client using the Add-AppvClientPackage cmdlet with the –DynamicDeploymentConfiguration parameter. See [About App-V Dynamic Configuration](appv-dynamic-configuration.md) for more information. + +- Create a new package with the custom configuration using the App-V Sequencer. + +## Server files not deleted after new App-V Server installation + +If you uninstall the App-V 5.0 SP1 Server and then install the App-V Server, the installation fails, the wrong version of the Management server is installed, and an error message is returned. The issue occurs because the Server files are not being deleted when you uninstall App-V 5.0 SP1, so the installation process does an upgrade instead of a new installation. + +**Workaround**: Delete this registry key before you start installing App-V: + +Under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall, locate and delete the installation GUID key that contains the DWORD value "DisplayName" with value data "Microsoft Application Virtualization (App-V) Server". This is the only key that should be deleted. + +## File type associations added manually are not saved correctly + +File type associations added to an application package manually using the Shortcuts and FTAs tab at the end of the application upgrade wizard are not saved correctly. They will not be available to the App-V Client or to the Sequencer when updating the saved package again. + +**Workaround**: To add a file type association, open the package for modification and run the update wizard. During the Installation step, add the new file type association through the operating system. The sequencer will detect the new association in the system registry and add it to the package’s virtual registry, where it will be available to the client. + +## When streaming packages in Shared Content Store (SCS) mode to a client that is also managed with AppLocker, additional data is written to the local disk. + +To decrease the amount of data written to a client’s local disk, you can enable SCS mode on the App-V Client to stream the contents of a package on demand. However, if AppLocker manages an application within the package, some data might be written to the client’s local disk that would not otherwise be written. + +**Workaround**: None + +## In the Management Console Add Package dialog box, the Browse button is not available when using Chrome or Firefox + +On the Packages page of the Management Console, if you click **Add or Upgrade** in the lower-right corner, the **Add Package** dialog box appears. If you are accessing the Management Console using Chrome or Firefox as your browser, you will not be able to browse to the location of the package. + +**Workaround**: Type or copy and paste the path to the package into the **Add Package** input field. If the Management Console has access to this path, you will be able to add the package. If the package is on a network share, you can browse to the location using File Explorer by doing these steps: + +1. While pressing **Shift**, right-click on the package file + +2. Select **Copy as path** + +3. Paste the path into the **Add Package** dialog box input field + +## Upgrading App-V Management Server to 5.1 sometimes fails with the message “A database error occurred” + +If you install the App-V 5.0 SP1 Management Server, and then try to upgrade to App-V Server when multiple connection groups are configured and enabled, the following error is displayed: “A database error occurred. Reason: 'Invalid column name 'PackageOptional'. Invalid column name 'VersionOptional'.” + +**Workaround**: Run this command on your SQL database: + +`ALTER TABLE AppVManagement.dbo.PackageGroupMembers ADD PackageOptional bit NOT NULL DEFAULT 0, VersionOptional bit NOT NULL DEFAULT 0` + +where “AppVManagement” is the name of the database. + +## Users cannot open a package in a user-published connection group if you add or remove an optional package + +In environments that are running the RDS Client or that have multiple concurrent users per computer, logged-in users cannot open applications in packages that are in a user-published connection group if an optional package is added to or removed from the connection group. + +**Workaround**: Have users log out and then log back in. + +## Error message is erroneously displayed when the connection group is published only to the user + + +When you run Repair-AppvClientConnectionGroup, the following error is displayed, even when the connection group is published only to the user: “Internal App-V Integration error: Package not integrated for the user. Please ensure that the package is added to the machine and published to the user.” + +**Workaround**: Do one of the following: + +- Publish all packages in a connection group. + + The problem arises when the connection group being repaired has packages that are missing or not available to the user (that is, not published globally or to the user). However, the repair will work if all of the connection group’s packages are available, so ensure that all packages are published. + +- Repair packages individually using the Repair-AppvClientPackage command rather than the Repair-AppvClientConnectionGroup command. + + Determine which packages are available to users and then run the Repair-AppvClientPackage command once for each package. Use PowerShell cmdlets to do the following: + + 1. Get all the packages in a connection group. + + 2. Check to see if each package is currently published. + + 3. If the package is currently published, run Repair-AppvClientPackage on that package. + +## Icons not displayed properly in Sequencer + +Icons in the Shortcuts and File Type Associations tab are not displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons are not 16x16 or 32x32. + +**Workaround**: Only use icons that are 16x16 or 32x32. + +## InsertVersionInfo.sql script no longer required for the Management Database + + +The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. + +The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). + +**Important**   +**Step 1** is not required for versions of App-V later than App-V 5.0 SP3. + + +## Microsoft Visual Studio 2012 not supported + + +App-V does not support Visual Studio 2012. + +**Workaround**: None + +## Application filename restrictions for App-V Sequencer + + +The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. + +**Workaround**: Use a different filename ## Have a suggestion for App-V? From e14fdf319869d9679000b0947df3e39b18f83e24 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 12 Aug 2016 15:00:53 -0700 Subject: [PATCH 103/421] Deleting an old section about migrating clients - no longer applies --- ...grating-to-appv-from-a-previous-version.md | 37 ------------------- 1 file changed, 37 deletions(-) diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index 249d1366e3..ee780fe37e 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -207,45 +207,8 @@ It is recommended that you use the App-V sequencer for converting critical appli If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V sequencer. -  - [How to Convert a Package Created in a Previous Version of App-V](appv-convert-a-package-created-in-a-previous-version-of-appv.md) -## Migrating Clients - - -The following table displays the recommended method for upgrading clients. - - ---- - - - - - - - - - - - - - - - - -
    TaskMore Information

    Upgrade your environment to the latest version of App-V 4.6

    [Application Virtualization Deployment and Upgrade Considerations](https://technet.microsoft.com/en-us/itpro/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy).

    Sequence and roll out App-V packages. As needed, unpublish App-V 4.6 packages.

    [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md).

    - -  - -**Important**   -You must be running the latest version of App-V 4.6 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section. - -  - ## Migrating the App-V server Server Full Infrastructure From 29bb728031536d7be0a60c32878f07ffffd6bb19 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Fri, 12 Aug 2016 15:13:37 -0700 Subject: [PATCH 104/421] remove cortana references --- devices/surface-hub/first-run-program-surface-hub.md | 6 ++---- .../i-am-done-finishing-your-surface-hub-meeting.md | 1 - devices/surface-hub/intro-to-surface-hub.md | 4 ---- 3 files changed, 2 insertions(+), 9 deletions(-) diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md index 8305a2bd53..b34943faf8 100644 --- a/devices/surface-hub/first-run-program-surface-hub.md +++ b/devices/surface-hub/first-run-program-surface-hub.md @@ -154,7 +154,7 @@ This screen is purely informational, and shows which recommended settings have b ### Details -You should read this screen and note which services have been enabled by default. All of them can be changed using the Settings app if need be, but you should be careful about the effects of doing so. For example, Cortana depends on some of these settings, and may not work if you disable them. See [Intro to Surface Hub](intro-to-surface-hub.md) for details. +You should read this screen and note which services have been enabled by default. All of them can be changed using the Settings app if need be, but you should be careful about the effects of doing so. See [Intro to Surface Hub](intro-to-surface-hub.md) for details. Once you're done reviewing the settings, click **Next** to go on. @@ -185,9 +185,8 @@ Click **Skip setting up a device account** to skip setting up a device account. - See a meeting calendar on the Welcome screen - Start a meeting from the Welcome screen -- Start a meeting using Cortana - Email whiteboards from OneNote -- Use Skype for Business for meetings. +- Use Skype for Business for meetings If you skip setting it up now, you can add a device account later by using the Settings app. @@ -222,7 +221,6 @@ Click **Skip setting up Exchange services** to skip this step. If you do, people - See a meeting calendar on the welcome screen. - Start a meeting from the welcome screen. -- Start a meeting using Cortana. - Email whiteboards from OneNote. See [Intro to Surface Hub](intro-to-surface-hub.md) for details on setup dependencies. diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md index 45d66f1d0a..3f17756233 100644 --- a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -62,7 +62,6 @@ User interface (UI) settings are returned to their default values when **I'm Don - Reset Quick Actions to default state - Clear Toast notifications - Reset volume levels -- Reset Cortana relaunch count - Reset sidebar width - Reset tablet mode layout diff --git a/devices/surface-hub/intro-to-surface-hub.md b/devices/surface-hub/intro-to-surface-hub.md index d8a4c1c1e2..ec1712c7a0 100644 --- a/devices/surface-hub/intro-to-surface-hub.md +++ b/devices/surface-hub/intro-to-surface-hub.md @@ -44,10 +44,6 @@ The capabilities of your Surface Hub will depend on what other Microsoft product

    Web browsing through Microsoft Edge

    Internet connectivity.

    - -

    Cortana meeting room assistant (voice commands, search)

    -

    Internet connectivity needed to process questions and do searches.

    -

    Remote and multi-device management

    Supported mobile device management (MDM) solutions (Microsoft Intune, System Center 2012 R2 Configuration Manager, or supported third-party solution).

    From 1fe35dbfce1948de1b205cd5292384eac2ce2b4a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 12 Aug 2016 15:19:03 -0700 Subject: [PATCH 105/421] clarify region taskbar --- windows/manage/configure-windows-10-taskbar.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/configure-windows-10-taskbar.md b/windows/manage/configure-windows-10-taskbar.md index f731255619..c99d67c4f2 100644 --- a/windows/manage/configure-windows-10-taskbar.md +++ b/windows/manage/configure-windows-10-taskbar.md @@ -175,7 +175,7 @@ If you only want to remove some of the default pinned apps, you would use this m ## Configure taskbar by country or region -The following example shows you how to configure taskbars by country or region. When you specify one or more country or region in ``, the pinned apps in that section are only pinned on computers that are configured for that country or region. When specifying taskbar configuration by country or region, the taskbar will concatenate pinlists together so long as the target computer meets the country or region requirements. If no country or region is specified for a `` node, it will apply to every country and region, only if the country or region has not been defined prior. Unspecified country or region in `` will not merge with a `` that has country or region specified. +The following example shows you how to configure taskbars by country or region. When the layout is applied to a computer, if there is no `` node with a region tag for the current region, the first `` node that has no specified region will be applied. When you specify one or more countries or regions in a `` node, the specified apps are pinned on computers configured for any of the specified countries or regions. ```xml From 24b0175fb524ba532bf670d7c9ec4b4c6ef8e97f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 12 Aug 2016 16:00:07 -0700 Subject: [PATCH 106/421] remove loc tag, change owner --- .../manage/application-development-for-windows-as-a-service.md | 2 +- windows/manage/introduction-to-windows-10-servicing.md | 3 +-- windows/plan/integration-with-management-solutions-.md | 2 +- windows/plan/setup-and-deployment.md | 2 +- windows/plan/windows-10-servicing-options.md | 2 +- windows/plan/windows-update-for-business.md | 1 - 6 files changed, 5 insertions(+), 7 deletions(-) diff --git a/windows/manage/application-development-for-windows-as-a-service.md b/windows/manage/application-development-for-windows-as-a-service.md index dedc91d3cd..2035251621 100644 --- a/windows/manage/application-development-for-windows-as-a-service.md +++ b/windows/manage/application-development-for-windows-as-a-service.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing -author: greg-lindsay +author: jdeckerMS --- # Application development for Windows as a service diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index 1e73d06398..ea13d5696b 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -7,8 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing -author: greg-lindsay -localizationpriority: high +author: jdeckerMS --- # Windows 10 servicing options diff --git a/windows/plan/integration-with-management-solutions-.md b/windows/plan/integration-with-management-solutions-.md index 83dcaee001..73206e6baf 100644 --- a/windows/plan/integration-with-management-solutions-.md +++ b/windows/plan/integration-with-management-solutions-.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices -author: TrudyHa +author: jdeckerMS --- # Integration with management solutions diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index 618c4b80a0..031ddf53b9 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices -author: TrudyHa +author: jdeckerMS --- # Setup and deployment diff --git a/windows/plan/windows-10-servicing-options.md b/windows/plan/windows-10-servicing-options.md index 00418ae8ae..83af9a41f3 100644 --- a/windows/plan/windows-10-servicing-options.md +++ b/windows/plan/windows-10-servicing-options.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: servicing ms.sitesec: library -author: greg-lindsay +author: jdeckerMS --- # Windows 10 servicing overview diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index f21911e790..663a7bba06 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -8,7 +8,6 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing; devices author: jdeckerMS -localizationpriority: high --- # Windows Update for Business From c4588f4262f222a7777dbce9482f89a83f534319 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 12 Aug 2016 16:02:21 -0700 Subject: [PATCH 107/421] Preparing to do a redirect of the install-the-appv-client SCS topic --- windows/manage/TOC.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index a9d6fefe63..b439a02e08 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -58,10 +58,9 @@ ##### [Planning to Use Folder Redirection with App-V](appv-planning-folder-redirection-with-appv.md) #### [App-V Planning Checklist](appv-planning-checklist.md) ### [Deploying App-V](appv-deploying-appv.md) -#### [Deploying the App-V Sequencer and Client](appv-deploying-the-appv-sequencer-and-client.md) +#### [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md) ##### [About Client Configuration Settings](appv-client-configuration-settings.md) ##### [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md) -##### [How to Install the App-V Client for Shared Content Store Mode](appv-install-the-appv-client-for-shared-content-store-mode.md) ##### [How to Install the Sequencer](appv-install-the-sequencer.md) ##### [How to Modify App-V Client Configuration Using the ADMX Template and Group Policy](appv-modify-client-configuration-with-the-admx-template-and-group-policy.md) #### [Deploying the App-V Server](appv-deploying-the-appv-server.md) From fc6701f469f6b31508753ce9f287b6f01f523997 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 12 Aug 2016 16:56:24 -0700 Subject: [PATCH 108/421] fix description field --- .../manage/application-development-for-windows-as-a-service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/application-development-for-windows-as-a-service.md b/windows/manage/application-development-for-windows-as-a-service.md index 2035251621..240810d9bd 100644 --- a/windows/manage/application-development-for-windows-as-a-service.md +++ b/windows/manage/application-development-for-windows-as-a-service.md @@ -1,6 +1,6 @@ --- title: Application development for Windows as a service (Windows 10) -description: In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. +description: Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. ms.assetid: 28E0D103-B0EE-4B14-8680-6F30BD373ACF ms.prod: w10 ms.mktglfcycl: manage From 92458538d59c8779f029c05f0c4390d4a87f7f16 Mon Sep 17 00:00:00 2001 From: Justinha Date: Fri, 12 Aug 2016 16:56:25 -0700 Subject: [PATCH 109/421] sweep files for 1607 changes --- windows/manage/appv-capacity-planning.md | 2 +- ...pv-deploy-the-appv-server-with-a-script.md | 1413 ++++++++--------- ...porting-databases-on-separate-computers.md | 26 +- ...agement-server-on-a-standalone-computer.md | 12 +- ...-publishing-server-on-a-remote-computer.md | 24 +- ...porting-server-on-a-standalone-computer.md | 12 +- ...grating-to-appv-from-a-previous-version.md | 4 +- windows/manage/appv-prerequisites.md | 2 +- windows/manage/appv-reporting.md | 42 +- .../manage/appv-supported-configurations.md | 123 +- 10 files changed, 745 insertions(+), 915 deletions(-) diff --git a/windows/manage/appv-capacity-planning.md b/windows/manage/appv-capacity-planning.md index eddcb1eb8c..32072d9331 100644 --- a/windows/manage/appv-capacity-planning.md +++ b/windows/manage/appv-capacity-planning.md @@ -63,7 +63,7 @@ You can also manage your App-V environment using an Electronic Software Distribu - With disconnected remote users who cannot connect to the App-V infrastructure. - - When you are running a software management system, such as Configuration Manager 2012. + - When you are running a software management system, such as System Center 2012 Configuration Manager. - When network bandwidth limitations inhibit electronic software distribution. diff --git a/windows/manage/appv-deploy-the-appv-server-with-a-script.md b/windows/manage/appv-deploy-the-appv-server-with-a-script.md index 1394472c33..0821433da2 100644 --- a/windows/manage/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/manage/appv-deploy-the-appv-server-with-a-script.md @@ -11,768 +11,727 @@ ms.prod: w10 # How to Deploy the App-V Server Using a Script - In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. **To Install the App-V server using a script** -- Use the following tables for more information about installing the App-V server using the command line. +Use the following tables for more information about installing the App-V server using the command line. **Note**   - The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. +The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. -   +**Common parameters and Examples** - **Common parameters and Examples** + ++++ + + + + + + +

    To Install the Management server and Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /MANAGEMENT_SERVER

      • +

    • /MANAGEMENT_ADMINACCOUNT

      • +

    • /MANAGEMENT_WEBSITE_NAME

      • +

    • /MANAGEMENT_WEBSITE_PORT

      • +

    • /DB_PREDEPLOY_MANAGEMENT

      • +

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /MANAGEMENT_DB_NAME

      • +
    +

    To use a custom instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /MANAGEMENT_SERVER

      • +

    • /MANAGEMENT_ADMINACCOUNT

      • +

    • /MANAGEMENT_WEBSITE_NAME

      • +

    • /MANAGEMENT_WEBSITE_PORT

      • +

    • /DB_PREDEPLOY_MANAGEMENT

      • +

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • +

    • /MANAGEMENT_DB_NAME

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /MANAGEMENT_SERVER

    +

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    +

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    +

    /MANAGEMENT_WEBSITE_PORT=”8080”

    +

    /DB_PREDEPLOY_MANAGEMENT

    +

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    +

    /MANAGEMENT_DB_NAME=”AppVManagement”

    - - - - - - - - - - - -

    To Install the Management server and Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /MANAGEMENT_DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /MANAGEMENT_DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    + ++++ + + + + + + +

    To Install the Management server using an existing Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /MANAGEMENT_SERVER

      • +

    • /MANAGEMENT_ADMINACCOUNT

      • +

    • /MANAGEMENT_WEBSITE_NAME

      • +

    • /MANAGEMENT_WEBSITE_PORT

      • +

    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

      • +

    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /EXISTING_MANAGEMENT_DB_NAME

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /MANAGEMENT_SERVER

      • +

    • /MANAGEMENT_ADMINACCOUNT

      • +

    • /MANAGEMENT_WEBSITE_NAME

      • +

    • /MANAGEMENT_WEBSITE_PORT

      • +

    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

      • +

    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • +

    • /EXISTING_MANAGEMENT_DB_NAME

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /MANAGEMENT_SERVER

    +

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    +

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    +

    /MANAGEMENT_WEBSITE_PORT=”8080”

    +

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    +

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    +

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

    -   + ++++ + + + + + + +

    To install the Management server using an existing Management database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /MANAGEMENT_SERVER

      • +

    • /MANAGEMENT_ADMINACCOUNT

      • +

    • /MANAGEMENT_WEBSITE_NAME

      • +

    • /MANAGEMENT_WEBSITE_PORT

      • +

    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

      • +

    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /EXISTING_MANAGEMENT_DB_NAME

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /MANAGEMENT_SERVER

      • +

    • /MANAGEMENT_ADMINACCOUNT

      • +

    • /MANAGEMENT_WEBSITE_NAME

      • +

    • /MANAGEMENT_WEBSITE_PORT

      • +

    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

      • +

    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • +

    • /EXISTING_MANAGEMENT_DB_NAME

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /MANAGEMENT_SERVER

    +

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    +

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    +

    /MANAGEMENT_WEBSITE_PORT=”8080”

    +

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”

    +

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    +

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

    - - - - - - - - - - - -

    To Install the Management server using an existing Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    -

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    -

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

    + ++++ + + + + + + +

    To Install the Management database and the Management Server on the same computer.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /DB_PREDEPLOY_MANAGEMENT

      • +

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /MANAGEMENT_DB_NAME

      • +

    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

      • +

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /DB_PREDEPLOY_MANAGEMENT

      • +

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • +

    • /MANAGEMENT_DB_NAME

      • +

    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

      • +

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /DB_PREDEPLOY_MANAGEMENT

    +

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    +

    /MANAGEMENT_DB_NAME=”AppVManagement”

    +

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    +

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

      -   + ++++ + + + + + + +

    To install the Management database on a different computer than the Management server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /DB_PREDEPLOY_MANAGEMENT

      • +

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /MANAGEMENT_DB_NAME

      • +

    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

      • +

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /DB_PREDEPLOY_MANAGEMENT

      • +

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • +

    • /MANAGEMENT_DB_NAME

      • +

    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

      • +

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /DB_PREDEPLOY_MANAGEMENT

    +

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    +

    /MANAGEMENT_DB_NAME=”AppVManagement”

    +

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    +

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    - - - - - - - - - - - -

    To install the Management server using an existing Management database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /MANAGEMENT_SERVER

      • -

    • /MANAGEMENT_ADMINACCOUNT

      • -

    • /MANAGEMENT_WEBSITE_NAME

      • -

    • /MANAGEMENT_WEBSITE_PORT

      • -

    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_MANAGEMENT_DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”

    -

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    -

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

    + ++++ + + + + + + +

    To Install the publishing server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /PUBLISHING_SERVER

      • +

    • /PUBLISHING_MGT_SERVER

      • +

    • /PUBLISHING_WEBSITE_NAME

      • +

    • /PUBLISHING_WEBSITE_PORT

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /PUBLISHING_SERVER

    +

    /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”

    +

    /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”

    +

    /PUBLISHING_WEBSITE_PORT=”8081”

    -   + ++++ + + + + + + +

    To Install the Reporting server and Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /REPORTING _SERVER

      • +

    • /REPORTING _WEBSITE_NAME

      • +

    • /REPORTING _WEBSITE_PORT

      • +

    • /DB_PREDEPLOY_REPORTING

      • +

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /REPORTING _DB_NAME

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /REPORTING _SERVER

      • +

    • /REPORTING _ADMINACCOUNT

      • +

    • /REPORTING _WEBSITE_NAME

      • +

    • /REPORTING _WEBSITE_PORT

      • +

    • /DB_PREDEPLOY_REPORTING

      • +

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • +

    • /REPORTING _DB_NAME

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +
      +

    • /appv_server_setup.exe /QUIET

      • +

    • /REPORTING_SERVER

      • +

    • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

      • +

    • /REPORTING_WEBSITE_PORT=”8082”

      • +

    • /DB_PREDEPLOY_REPORTING

      • +

    • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

      • +

    • /REPORTING_DB_NAME=”AppVReporting”

      • +
    - - - - - - - - - - - -

    To Install the Management database and the Management Server on the same computer.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    -

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    -

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    + ++++ + + + + + + +

    To Install the Reporting server and using an existing Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /REPORTING _SERVER

      • +

    • /REPORTING _WEBSITE_NAME

      • +

    • /REPORTING _WEBSITE_PORT

      • +

    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

      • +

    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /EXISTING_REPORTING _DB_NAME

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /REPORTING _SERVER

      • +

    • /REPORTING _ADMINACCOUNT

      • +

    • /REPORTING _WEBSITE_NAME

      • +

    • /REPORTING _WEBSITE_PORT

      • +

    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

      • +

    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

      • +

    • /EXISTING_REPORTING _DB_NAME

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /REPORTING_SERVER

    +

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    +

    /REPORTING_WEBSITE_PORT=”8082”

    +

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    +

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    +

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

      -   + ++++ + + + + + + +

    To Install the Reporting server using an existing Reporting database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /REPORTING _SERVER

      • +

    • /REPORTING _WEBSITE_NAME

      • +

    • /REPORTING _WEBSITE_PORT

      • +

    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

      • +

    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /EXISTING_REPORTING _DB_NAME

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /REPORTING _SERVER

      • +

    • /REPORTING _ADMINACCOUNT

      • +

    • /REPORTING _WEBSITE_NAME

      • +

    • /REPORTING _WEBSITE_PORT

      • +

    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

      • +

    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

      • +

    • /EXISTING_REPORTING _DB_NAME

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /REPORTING_SERVER

    +

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    +

    /REPORTING_WEBSITE_PORT=”8082”

    +

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”

    +

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    +

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

    - - - - - - - - - - - -

    To install the Management database on a different computer than the Management server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_MANAGEMENT

      • -

    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

      • -

    • /MANAGEMENT_DB_NAME

      • -

    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    -

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    -

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    + ++++ + + + + + + +

    To install the Reporting database on the same computer as the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /DB_PREDEPLOY_REPORTING

      • +

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /REPORTING _DB_NAME

      • +

    • /REPORTING_SERVER_MACHINE_USE_LOCAL

      • +

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /DB_PREDEPLOY_REPORTING

      • +

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • +

    • /REPORTING _DB_NAME

      • +

    • /REPORTING_SERVER_MACHINE_USE_LOCAL

      • +

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /DB_PREDEPLOY_REPORTING

    +

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    +

    /REPORTING_DB_NAME=”AppVReporting”

    +

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    +

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    -   + ++++ + + + + + + +

    To install the Reporting database on a different computer than the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    +
      +

    • /DB_PREDEPLOY_REPORTING

      • +

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • +

    • /REPORTING _DB_NAME

      • +

    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

      • +

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    To use a custom instance of Microsoft SQL Server, use these parameters:

    +
      +

    • /DB_PREDEPLOY_REPORTING

      • +

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • +

    • /REPORTING _DB_NAME

      • +

    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

      • +

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • +
    +

    Using a custom instance of Microsoft SQL Server example:

    +

    /appv_server_setup.exe /QUIET

    +

    /DB_PREDEPLOY_REPORTING

    +

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    +

    /REPORTING_DB_NAME=”AppVReporting”

    +

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    +

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    - - - - - - - - - - - -

    To Install the publishing server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /PUBLISHING_SERVER

      • -

    • /PUBLISHING_MGT_SERVER

      • -

    • /PUBLISHING_WEBSITE_NAME

      • -

    • /PUBLISHING_WEBSITE_PORT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /PUBLISHING_SERVER

    -

    /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”

    -

    /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”

    -

    /PUBLISHING_WEBSITE_PORT=”8081”

    +**Parameter Definitions** -   +**General Parameters** - - - - - - - - - - - -

    To Install the Reporting server and Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /REPORTING _DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _ADMINACCOUNT

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /REPORTING _DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -
      -

    • /appv_server_setup.exe /QUIET

      • -

    • /REPORTING_SERVER

      • -

    • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

      • -

    • /REPORTING_WEBSITE_PORT=”8082”

      • -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

      • -

    • /REPORTING_DB_NAME=”AppVReporting”

      • -
    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /QUIET

    Specifies silent install.

    /UNINSTALL

    Specifies an uninstall.

    /LAYOUT

    Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.

    /LAYOUTDIR

    Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”

    /INSTALLDIR

    Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”

    /MUOPTIN

    Enables Microsoft Update. No value is expected

    /ACCEPTEULA

    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

    -   +**Management Server Installation Parameters** - - - - - - - - - - - -

    To Install the Reporting server and using an existing Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _ADMINACCOUNT

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

      • -

    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /REPORTING_SERVER

    -

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    -

    /REPORTING_WEBSITE_PORT=”8082”

    -

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    -

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /MANAGEMENT_SERVER

    Specifies that the management server will be installed. No value is expected

    /MANAGEMENT_ADMINACCOUNT

    Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".

    /MANAGEMENT_WEBSITE_NAME

    Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”

    MANAGEMENT_WEBSITE_PORT

    Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.

    -   +**Parameters for the Management Server Database** - - - - - - - - - - - -

    To Install the Reporting server using an existing Reporting database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /REPORTING _SERVER

      • -

    • /REPORTING _ADMINACCOUNT

      • -

    • /REPORTING _WEBSITE_NAME

      • -

    • /REPORTING _WEBSITE_PORT

      • -

    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

      • -

    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /EXISTING_REPORTING _DB_NAME

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /REPORTING_SERVER

    -

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    -

    /REPORTING_WEBSITE_PORT=”8082”

    -

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”

    -

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /DB_PREDEPLOY_MANAGEMENT

    Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected

    /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance should be used. No value is expected.

    /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_DB_NAME

    Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”

    -   +**Parameters for Installing Publishing Server** - - - - - - - - - - - -

    To install the Reporting database on the same computer as the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_SERVER_MACHINE_USE_LOCAL

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_SERVER_MACHINE_USE_LOCAL

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_REPORTING

    -

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /REPORTING_DB_NAME=”AppVReporting”

    -

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    -

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /PUBLISHING_SERVER

    Specifies that the Publishing Server will be installed. No value is expected

    /PUBLISHING_MGT_SERVER

    Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored

    /PUBLISHING_WEBSITE_NAME

    Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”

    /PUBLISHING_WEBSITE_PORT

    Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83

    -   +**Parameters for Reporting Server** - - - - - - - - - - - -

    To install the Reporting database on a different computer than the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -

    • /DB_PREDEPLOY_REPORTING

      • -

    • /REPORTING _DB_CUSTOM_SQLINSTANCE

      • -

    • /REPORTING _DB_NAME

      • -

    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

      • -

    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

      • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_REPORTING

    -

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /REPORTING_DB_NAME=”AppVReporting”

    -

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    -

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    + ++++ + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /REPORTING_SERVER

    Specifies that the Reporting Server will be installed. No value is expected

    /REPORTING_WEBSITE_NAME

    Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"

    /REPORTING_WEBSITE_PORT

    Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82

      -   +**Parameters for using an Existing Reporting Server Database** - **Parameter Definitions** + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.

    /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /EXISTING_ REPORTING _DB_NAME

    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISITING_REPORTING_DB_NAME="AppVReporting"

      - **General Parameters** +**Parameters for installing Reporting Server Database** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /QUIET

    Specifies silent install.

    /UNINSTALL

    Specifies an uninstall.

    /LAYOUT

    Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.

    /LAYOUTDIR

    Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”

    /INSTALLDIR

    Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”

    /MUOPTIN

    Enables Microsoft Update. No value is expected

    /ACCEPTEULA

    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /DB_PREDEPLOY_REPORTING

    Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected

    /REPORTING_DB_SQLINSTANCE_USE_DEFAULT

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /REPORTING_DB_NAME

    Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"

    -   +**Parameters for using an existing Management Server Database** - **Management Server Installation Parameters** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /MANAGEMENT_SERVER

    Specifies that the management server will be installed. No value is expected

    /MANAGEMENT_ADMINACCOUNT

    Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".

    /MANAGEMENT_WEBSITE_NAME

    Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”

    MANAGEMENT_WEBSITE_PORT

    Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.

    - -   - - **Parameters for the Management Server Database** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /DB_PREDEPLOY_MANAGEMENT

    Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected

    /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance should be used. No value is expected.

    /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_DB_NAME

    Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”

    - -   - - **Parameters for Installing Publishing Server** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /PUBLISHING_SERVER

    Specifies that the Publishing Server will be installed. No value is expected

    /PUBLISHING_MGT_SERVER

    Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored

    /PUBLISHING_WEBSITE_NAME

    Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”

    /PUBLISHING_WEBSITE_PORT

    Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83

    - -   - - **Parameters for Reporting Server** - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /REPORTING_SERVER

    Specifies that the Reporting Server will be installed. No value is expected

    /REPORTING_WEBSITE_NAME

    Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"

    /REPORTING_WEBSITE_PORT

    Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82

    - -   - - **Parameters for using an Existing Reporting Server Database** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.

    /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /EXISTING_ REPORTING _DB_NAME

    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISITING_REPORTING_DB_NAME="AppVReporting"

    - -   - - **Parameters for installing Reporting Server Database** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /DB_PREDEPLOY_REPORTING

    Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected

    /REPORTING_DB_SQLINSTANCE_USE_DEFAULT

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /REPORTING_DB_NAME

    Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"

    - -   - - **Parameters for using an existing Management Server Database** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_NAME

    Specifies the name of the existing management database that should be used. Example usage: /EXISITING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    -

    -

    Have a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).

    - -   + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterInformation

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_NAME

    Specifies the name of the existing management database that should be used. Example usage: /EXISITING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    +

    +

    Have a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).

    ## Related topics diff --git a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md index 9558f87d73..9f74a81f7a 100644 --- a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -17,8 +17,6 @@ Use the following procedure to install the database server and management server >**Note**   After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. -  - **To install the management database and the management server on separate computers** 1. Copy the App-V server installation files to the computer on which you want to install it on. To start the App-V server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. @@ -40,11 +38,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. >**Note**   - If you plan to deploy the management server on the same computer you must select **Use this local computer**. - -   - - Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. + If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. 8. To start the installation, click **Install**. @@ -66,14 +60,10 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance If you are using a custom database name, then select **Custom configuration** and type the database name. -7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. +7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: Domain\\MachineAccount. **Note**   - If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. - -   - - Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. + If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. Click **Next**. 8. To start the installation, click **Install**. @@ -83,7 +73,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”**. + **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”** 3. After the extraction has been completed, to access the App-V database scripts and instructions readme file: @@ -94,13 +84,13 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. **Note**   - For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md). - -   + For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md).   5. Run the scripts on the computer running Microsoft SQL Server. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md index 433492faf0..28cdb2f0b8 100644 --- a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md @@ -29,13 +29,7 @@ Use the following procedure to install the management server on a standalone com 6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. >**Note**   - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - -   - - For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - - Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. + If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. 7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation @@ -45,7 +39,9 @@ Use the following procedure to install the management server on a standalone com 9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. -**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md index 64a5da1508..414c59f646 100644 --- a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md @@ -46,23 +46,27 @@ Use the following procedure to install the publishing server on a separate compu 9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: - `` + ```syntax + + + - ` ` + + + - ` ` + - ` ` + - ` ` + - ` ` + + ``` - ` ` +## Have a suggestion for App-V? - `` - -**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md index 92d0971f36..db35c6f9aa 100644 --- a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -34,13 +34,7 @@ Before performing the following procedure you should read and understand [About 6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. **Note**   - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - -   - - For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - - Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. + If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. 7. On the **Configure Reporting Server Configuration** page. @@ -50,7 +44,9 @@ Before performing the following procedure you should read and understand [About 8. Click **Install**. -**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +## Have a suggestion for App-V? + +Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index 249d1366e3..8baa974696 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -200,10 +200,10 @@ After you convert an existing package you should test the package prior to deplo   -When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. +When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. **Note**   -It is recommended that you use the App-V sequencer for converting critical applications or applications that need to take advantage of features. See, [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). +It is recommended that you use the App-V sequencer for converting critical applications or applications that need to take advantage of features. See [How to Sequence a New Application with App-V](appv-sequence-a-new-application.md). If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V sequencer. diff --git a/windows/manage/appv-prerequisites.md b/windows/manage/appv-prerequisites.md index 5ba350c779..3b9173f2be 100644 --- a/windows/manage/appv-prerequisites.md +++ b/windows/manage/appv-prerequisites.md @@ -50,7 +50,7 @@ The following table indicates the software that is already installed for differe -

    Windows Server 2012

    +

    Windows Server 2016

    The following prerequisite software is already installed:

    @@ -166,7 +166,7 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot
     
    -

  • Download and install [KB2533623](http://go.microsoft.com/fwlink/?LinkId=286102 ) (http://go.microsoft.com/fwlink/?LinkId=286102)

    +

  • Download and install [KB2533623](https://go.microsoft.com/fwlink/?LinkId=286102 ) (https://go.microsoft.com/fwlink/?LinkId=286102)

    Important   @@ -181,7 +181,7 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot

  • [Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) (http://www.microsoft.com/download/details.aspx?id=40784)

    This prerequisite is required only if you have installed Hotfix Package 4 for Application Virtualization 5.0 SP2 or later.

    • -

  • [The Microsoft Visual C++ 2010 Redistributable](http://www.microsoft.com/download/details.aspx?id=26999) (http://go.microsoft.com/fwlink/?LinkId=26999)

    +

  • [The Microsoft Visual C++ 2010 Redistributable](http://www.microsoft.com/download/details.aspx?id=26999) (https://go.microsoft.com/fwlink/?LinkId=26999)

  • [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](http://www.microsoft.com/download/details.aspx?id=5638) (http://www.microsoft.com/download/details.aspx?id=5638)

    • @@ -230,7 +230,7 @@ If the system requirements of a locally installed application exceed the require

  • Download and install [KB2533623](http://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)

    • -

  • For computers running Microsoft Windows Server 2008 R2 SP1, download and install [KB2533623](http://go.microsoft.com/fwlink/?LinkId=286102 ) (http://go.microsoft.com/fwlink/?LinkId=286102)

    +

  • For computers running Microsoft Windows Server 2008 R2 SP1, download and install [KB2533623](https://go.microsoft.com/fwlink/?LinkId=286102 ) (https://go.microsoft.com/fwlink/?LinkId=286102)

    Important   @@ -313,7 +313,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve  

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x64)](http://www.microsoft.com/download/details.aspx?id=13523) (http://www.microsoft.com/download/details.aspx?id=13523)

    • -

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](http://go.microsoft.com/fwlink/?LinkId=267110) (http://go.microsoft.com/fwlink/?LinkId=267110)

    • +

  • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110) (https://go.microsoft.com/fwlink/?LinkId=267110)

  • 64-bit ASP.NET registration

    • The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server.

    @@ -345,7 +345,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve

    • [Microsoft .NET Framework 4 (Full Package)](http://www.microsoft.com/download/details.aspx?id=17718) (http://www.microsoft.com/download/details.aspx?id=17718)

      • -

    • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](http://go.microsoft.com/fwlink/?LinkId=267110)(http://go.microsoft.com/fwlink/?LinkId=267110)

      • +

    • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110)(https://go.microsoft.com/fwlink/?LinkId=267110)

    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.

      @@ -354,14 +354,14 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve

    • Custom App-V 5.0 database name (if applicable) – you must specify a unique database name. The default value for the management database is AppVManagement.

    • App-V 5.0 management server location – specifies the machine account on which the management server is deployed. This should be specified in the following format Domain\MachineAccount.

    • App-V 5.0 management server installation administrator - specifies the account that will be used to install the App-V 5.0 management server. You should use the following format: Domain\AdministratorLoginName.

      • -

    • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see [Configure SQL Server Agent to Restart Services Automatically](http://go.microsoft.com/fwlink/?LinkId=273725) (http://go.microsoft.com/fwlink/?LinkId=273725).

      • +

    • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see [Configure SQL Server Agent to Restart Services Automatically](https://go.microsoft.com/fwlink/?LinkId=273725) (https://go.microsoft.com/fwlink/?LinkId=273725).

    Reporting Server