From 0d1cefddef9c88ddedcc7993e3b22756e9d10c66 Mon Sep 17 00:00:00 2001 From: v-pegao Date: Thu, 26 Dec 2019 15:12:21 +0800 Subject: [PATCH 001/249] Remove double quote --- windows/deployment/index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 9530728934..33f5976173 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -28,7 +28,7 @@ sections: - href: windows-10-deployment-scenarios html:

Understand the different ways that Windows 10 can be deployed

image: - src: https://docs.microsoft.com/media/common/i_deploy.svg" + src: https://docs.microsoft.com/media/common/i_deploy.svg title: Windows 10 deployment scenarios - href: update html:

Update Windows 10 in the enterprise

From 730a43cdcbc2f923db9f9845f79b80994ed1f5bf Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Wed, 11 Mar 2020 17:50:28 -0700 Subject: [PATCH 002/249] HoloLens Kiosk, serious overhaul MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a LARGE change to this page. I've been wanting to do this for some time now. I've discussed with Yannis and Sarah and how it needed it. So I took the time to finally go about doing the work and making the changes. @yannisle @scooley As subject matter experts I'd like to review any information I've added and verify it's correct. @Teresa-Motiv I'm sure I've got several rough edges here. Would you please help me with consistency? I'm sure my information is correct but I need to learn to phrase and present it uniformly. • Redo the SAK vs MAK chart. • Create a chart or paragraph detailing when each deployment method should be used, it’s benefits, and limitations. • Add some examples for clarity • Move the Start layout XML stuff to the bottom as it’s optional now for MDM. Pointing to it as needed. • ACTUAL instructions for Kiosk Mode via Intune. • Reduce “Windows 10, version 1803” terminology. And make it less prominent in headers. • Reduce provisioning section and instead update the page we linked to. • Update the recommendations at the bottom. • Get rid of Bloom references. --- devices/hololens/hololens-kiosk.md | 275 ++++++++++++++++++++--------- 1 file changed, 194 insertions(+), 81 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index aab93e1b8a..5c23e398b7 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -20,97 +20,162 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#add-guest-access-to-the-kiosk-configuration-optional) +A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. +- All HoloLens 2 devices are Kiosk mode capable. +- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +# Picking a Kiosk Mode +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. - -The following table lists the device capabilities in the different kiosk modes. - -Kiosk mode | Voice and Bloom commands | Quick actions menu | Camera and video | Miracast ---- | --- | --- | --- | --- -Single-app kiosk | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) -Multi-app kiosk | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) with **Home** and **Volume** (default)

Photo and video buttons shown in Quick actions menu if the Camera app is enabled in the kiosk configuration.

Miracast is shown if the Camera app and device picker app are enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app is enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app and device picker app are enabled in the kiosk configuration. - -> [!NOTE] -> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. - -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. > > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. -For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. +The following table lists the device capabilities in the different kiosk modes. -## Start layout for HoloLens +| | Start Gesture / Pins Panel | Quick Actions Menu | Camera and Video | Miracast | Supported User Types | Auto Login | Can distinguish different users to use Kiosk mode or full access | +|------------------|----------------------------|--------------------|------------------|----------|----------------------|------------|------------------------------------------------------------------| +| Single-app kiosk | No | No | No* | No | MSA or Local | Yes | No | +| Multi-app kiosk | Yes | Yes* | Yes* | Yes* | AAD | No | Yes | -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +While camera and video voice commands and UI are disabled by default the button commands can still be used. +To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. +> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. -### Start layout file for MDM (Intune and others) +The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). +One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. +Examples scenarios of when to use which Kiosk: +- A device dedicated to Guides to help new hires: Single-app kiosk +- A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk +- You have a custom app and only allow access to it: Single-app kiosk +- You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). +# Picking a Deployment Method -```xml - - - - - - - - - -``` +There are three methods that you can use to configure the device as a kiosk: +- You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. +- You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -### Start layout for a provisioning package +| | Device Portal | Provisioning Package | MDM | +|------------------------------|---------------|----------------------|------| +| Single-app kiosk available | Yes | Yes | Yes | +| Multi-app kiosk available | No | Yes | Yes | +| Need device locally to apply | Yes | Yes | No | +| Need developer mode | Yes | No | No | +| Need AAD | No | No | Yes | +| Automatically deploy | No | No | Yes | +| Speed | Fastest | Fast | Slow | +| Recommended for scale | No | No | Yes | -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. -```xml - - - - - - - - - - - - - - - ]]> - - -``` +## Set up kiosk mode using Microsoft Intune or MDM -## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803) +Process: +1. Create a Device Configuration Policy +1. Select the settings you want to see in your Kiosk +1. Assign the Policy to the group to receive the policy +1. Set up the device + 1. Single app Kiosk + 1. Multi app Kiosk + +## Create a Device configuration policy + +Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +Select **Microsoft Intune > Device configuration - Profiles > + Create profile** +Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. +Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. +For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). + +## Select the settings you want to see in your Kiosk. + +### Single-app kiosk +Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. +For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). + +### Multi App Kiosk +**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. + +It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. + +To choose an app you’ve uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it’s **Application user model ID** by selecting **Add by AUMID**. +Some common in-box apps you may wish to use are: + +| App Name | AUMID | +|---------------|----------------------------------------------------------------------| +| Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). + +## Assign the Policy to the group to receive the policy +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + + +> [! IMPORTANT] +> If two more or more different Kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +Examples: +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. + + +## Set up the device +Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +### Single-app kiosk + +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm ), but sign in will be easy and can be automatic. + +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +### Multi app Kiosk +For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. + +If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. + +Once you’ve completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. + +To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) + +If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/en-us/intune/configuration/device-profile-monitor). + + +Additional information: For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. -## Set up kiosk mode using a provisioning package (Windows 10, version 1803) +## Set up kiosk mode using a provisioning package + +As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) @@ -170,25 +235,16 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box). +You can intially [apply a provisioning package to HoloLens during setup](https://docs.microsoft.com/hololens/hololens-provisioning#apply-a-provisioning-package-to-hololens-during-setup). -3. HoloLens will show up as a device in File Explorer on the PC. +You can also [apply a provisioning package to HoloLens after setup](https://docs.microsoft.com/hololens/hololens-provisioning#4-apply-a-provisioning-package-to-hololens-after-setup). -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE. - - -## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803) +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) + > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). @@ -202,16 +258,73 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ![Kiosk Mode](images/kiosk.png) > [!NOTE] - > The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md). + > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). 5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. +6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** + +## Start layout for HoloLens + +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. + +> [!NOTE] +> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. + +### Start layout file for MDM (Intune and others) + +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). + +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). + +```xml + + + + + + + + + +``` + +### Start layout for a provisioning package + +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. + +```xml + + + + + + + + + + + + + + + ]]> + + +``` + ## Kiosk app recommendations -- You cannot select Microsoft Edge, Microsoft Store, or the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app and the File Explorer app as a kiosk app. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From a223b23afca71e6d3e026f5ec1bb57ce7689c188 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 12 Mar 2020 13:26:10 -0700 Subject: [PATCH 003/249] Prelim cleanup --- devices/hololens/hololens-kiosk.md | 75 ++++++++++++++++-------------- 1 file changed, 41 insertions(+), 34 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5c23e398b7..c9585b911c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -7,8 +7,9 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 11/13/2018 +ms.date: 03/12/2020 ms.custom: +- CI 115262 - CI 111456 - CSSTroubleshooting ms.reviewer: @@ -20,46 +21,50 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -- All HoloLens 2 devices are Kiosk mode capable. -- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -# Picking a Kiosk Mode +- All HoloLens 2 devices are Kiosk mode capable. +- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. + +## Select a kiosk mode When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. -> [!WARNING] +> [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. -> +> > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. -| | Start Gesture / Pins Panel | Quick Actions Menu | Camera and Video | Miracast | Supported User Types | Auto Login | Can distinguish different users to use Kiosk mode or full access | -|------------------|----------------------------|--------------------|------------------|----------|----------------------|------------|------------------------------------------------------------------| -| Single-app kiosk | No | No | No* | No | MSA or Local | Yes | No | -| Multi-app kiosk | Yes | Yes* | Yes* | Yes* | AAD | No | Yes | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Auto sign-in | Can distinguish different users to use Kiosk mode or full access | +| --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | +|Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -> [!NOTE] +> [!NOTE] > Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. + Examples scenarios of when to use which Kiosk: + - A device dedicated to Guides to help new hires: Single-app kiosk - A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk - You have a custom app and only allow access to it: Single-app kiosk - You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) -# Picking a Deployment Method +## Select a deployment method There are three methods that you can use to configure the device as a kiosk: + - You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. - You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. - You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. @@ -75,33 +80,36 @@ There are three methods that you can use to configure the device as a kiosk: | Speed | Fastest | Fast | Slow | | Recommended for scale | No | No | Yes | +## Set up kiosk mode by using Microsoft Intune or MDM -## Set up kiosk mode using Microsoft Intune or MDM +Process: -Process: -1. Create a Device Configuration Policy -1. Select the settings you want to see in your Kiosk -1. Assign the Policy to the group to receive the policy -1. Set up the device - 1. Single app Kiosk - 1. Multi app Kiosk +1. [Create a Device Configuration Policy](#create-a-device-configuration-policy). +1. [Select the settings that you want to see in your kiosk](#select-the-settings-that-you-want-to-see-in-your-kiosk). +1. Assign the Policy to the group to receive the policy. +1. Set up the device. + - Single app Kiosk. + - Multi app Kiosk. -## Create a Device configuration policy +### Create a device configuration policy + +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** +1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. -Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -Select **Microsoft Intune > Device configuration - Profiles > + Create profile** -Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. + For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). -## Select the settings you want to see in your Kiosk. +### Select the settings that you want to see in your kiosk + +#### Configure a single-app kiosk -### Single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -### Multi App Kiosk +#### Configure a multi-app kiosk **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. @@ -122,26 +130,25 @@ Some common in-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). -## Assign the Policy to the group to receive the policy +## Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [! IMPORTANT] -> If two more or more different Kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. -Examples: +**Examples:** + - You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. - You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. - ## Set up the device Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. From 05cf6869e87006ecfaa3f6c4a063fce4aa4e6336 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 12 Mar 2020 14:00:17 -0700 Subject: [PATCH 004/249] Prelim cleanup --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c9585b911c..e388f7b9bc 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -84,12 +84,14 @@ There are three methods that you can use to configure the device as a kiosk: Process: -1. [Create a Device Configuration Policy](#create-a-device-configuration-policy). -1. [Select the settings that you want to see in your kiosk](#select-the-settings-that-you-want-to-see-in-your-kiosk). -1. Assign the Policy to the group to receive the policy. +1. [Create a device configuration policy](#create-a-device-configuration-policy). +1. Select the settings that you want to see in your kiosk. + - [Configure the settings for a single-app kiosk](#configure-the-settings-for-a-single-app-kiosk). + - [Configure the settings for a multi-app kiosk](#configure-the-settings-for-a-multi-app-kiosk). +1. [Assign the policy to the group to receive the policy](#assign-the-policy-to-the-group-to-receive-the-policy). 1. Set up the device. - - Single app Kiosk. - - Multi app Kiosk. + - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). + - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). ### Create a device configuration policy @@ -103,15 +105,15 @@ For full details creating a device profile for Kiosk mode check out [Kiosk setti ### Select the settings that you want to see in your kiosk -#### Configure a single-app kiosk +#### Configure the settings for a single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -#### Configure a multi-app kiosk +#### Configure the settings for a multi-app kiosk **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. @@ -152,9 +154,9 @@ There is an important distinction between the **User logon type** and the **Assi ## Set up the device Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -### Single-app kiosk +### Set up a single-app kiosk -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm ), but sign in will be easy and can be automatic. +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. @@ -162,7 +164,8 @@ Give your store app a short amount time to download as well as policy to be appl If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### Multi app Kiosk +### Set up a multi-app kiosk + For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. @@ -180,11 +183,12 @@ For HoloLens devices that are managed by Microsoft Intune, directions can be fou For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. -## Set up kiosk mode using a provisioning package +## Set up kiosk mode by using a provisioning package As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: + 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) From d6377d6d51c5d23fddb2c162dd65b996ac281584 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 09:54:46 -0700 Subject: [PATCH 005/249] Cleanup --- devices/hololens/hololens-kiosk.md | 90 ++++++++++++++++-------------- 1 file changed, 47 insertions(+), 43 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e388f7b9bc..e0157408b0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,19 +23,19 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -- All HoloLens 2 devices are Kiosk mode capable. -- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- All HoloLens 2 devices are Kiosk-mode capable. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. + +Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. @@ -44,17 +44,18 @@ The following table lists the device capabilities in the different kiosk modes. |Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | |Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | -While camera and video voice commands and UI are disabled by default the button commands can still be used. +While camera and video voice commands and UI are disabled by default the button commands can still be used. + To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] > Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. -One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. +One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. -Examples scenarios of when to use which Kiosk: +Examples scenarios of when to use which kiosk: - A device dedicated to Guides to help new hires: Single-app kiosk - A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk @@ -65,9 +66,9 @@ Examples scenarios of when to use which Kiosk: There are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. +- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -107,19 +108,20 @@ For full details creating a device profile for Kiosk mode check out [Kiosk setti #### Configure the settings for a single-app kiosk -Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. +Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). #### Configure the settings for a multi-app kiosk + **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. -It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you’ve uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it’s **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -130,16 +132,17 @@ Some common in-box apps you may wish to use are: | Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). ## Assign the policy to the group to receive the policy + Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] > If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. @@ -149,33 +152,35 @@ There is an important distinction between the **User logon type** and the **Assi - You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. ## Set up the device -Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. ### Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. -If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. + +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). ### Set up a multi-app kiosk -For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. +For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. -If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. +If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. -Once you’ve completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. +Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) -If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/en-us/intune/configuration/device-profile-monitor). - +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). Additional information: @@ -185,7 +190,7 @@ For other MDM services, check your provider's documentation for instructions. If ## Set up kiosk mode by using a provisioning package -As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). +As part of creating your Provisioning package, you'll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: @@ -208,11 +213,11 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ```xml - - - - - + + + + + ``` ### Add the kiosk configuration XML file to a provisioning package @@ -227,7 +232,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. +8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. 9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. 10. On the **File** menu, select **Save.** 11. On the **Export** menu, select **Provisioning package**. @@ -243,14 +248,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* 16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](https://docs.microsoft.com/hololens/hololens-provisioning#apply-a-provisioning-package-to-hololens-during-setup). +You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). -You can also [apply a provisioning package to HoloLens after setup](https://docs.microsoft.com/hololens/hololens-provisioning#4-apply-a-provisioning-package-to-hololens-after-setup). +You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -262,7 +266,7 @@ You can also [apply a provisioning package to HoloLens after setup](https://docs 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -277,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](https://docs ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From abf352a841b22c34a399eedaddec32959b250922 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:06:37 -0700 Subject: [PATCH 006/249] link fixes --- devices/hololens/hololens-kiosk.md | 14 +++++++------- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e0157408b0..975a5898f3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -24,7 +24,7 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. - All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode @@ -250,7 +250,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). @@ -260,7 +260,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - + 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml @@ -335,11 +335,11 @@ You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-wi ## Kiosk app recommendations -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index c350d951eb..bba98361ac 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From ef57582e23f68e30018d79e03809fe7424864a29 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:10:35 -0700 Subject: [PATCH 007/249] Cleanup --- devices/hololens/hololens-kiosk.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 975a5898f3..cb145ac7c3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -121,7 +121,8 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -140,7 +141,7 @@ Once you have created and saved your Kiosk mode policy you must assign it to the Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -281,7 +282,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. @@ -303,7 +304,7 @@ Save the following sample as an XML file. You can use this file when you configu - + From a46ad93ffde37318e0843e6b5f67792df0ea1fc7 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:36:33 -0700 Subject: [PATCH 008/249] link fixes --- devices/hololens/hololens-kiosk.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index cb145ac7c3..5c214f7da2 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -255,7 +255,7 @@ You can initially [apply a provisioning package to HoloLens during setup](holole You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode by using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -282,7 +282,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From 7ec55541a967447ecb162c9dfcae28a4fad09db1 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 11:58:11 -0700 Subject: [PATCH 009/249] Revert "HW-update" --- devices/hololens/hololens-kiosk.md | 29 +++++++++++------------ devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 17 insertions(+), 18 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5c214f7da2..e0157408b0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -24,7 +24,7 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. - All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -121,8 +121,7 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. - +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -141,7 +140,7 @@ Once you have created and saved your Kiosk mode policy you must assign it to the Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -251,17 +250,17 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode by using the Windows Device Portal +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - + 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. @@ -282,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. @@ -304,7 +303,7 @@ Save the following sample as an XML file. You can use this file when you configu - + @@ -312,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml @@ -336,11 +335,11 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Kiosk app recommendations -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index bba98361ac..c350d951eb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..6cfcb281b0 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From daabd2e4ef36aea51bf586205ef2ccacc344e259 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 12:33:21 -0700 Subject: [PATCH 010/249] Link fixes --- devices/hololens/hololens-kiosk.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e0157408b0..316597854b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -254,7 +254,7 @@ You can intially [apply a provisioning package to HoloLens during setup](hololen You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode by using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -281,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From 111324075aeb6897dbae38838446a35eef69f174 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 12:55:19 -0700 Subject: [PATCH 011/249] Link fixes --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-kiosk.md | 2 +- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 98ec5c6e06..69cc524581 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company’s users are in Azure Active Directory (Azure AD). +1. Ensure that your company's users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. +1. Ensure that your company's users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company’s users (or a group of users) can add devices. +These steps ensure that your company's users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) ## Certificates and Authentication diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 316597854b..7f34527d0d 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index c350d951eb..a0978a7caa 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 796aa4f928ea4ef103925af43e3e7642dd727d95 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 14:49:56 -0700 Subject: [PATCH 012/249] Smallcommit --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 7f34527d0d..ce33c8bcb8 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -275,7 +275,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro > [!NOTE] > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). -5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. +5. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. 6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** From 5a90807964ea482711bd72ac353012bebd387fba Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 14:58:21 -0700 Subject: [PATCH 013/249] Revert "HW-update" --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-kiosk.md | 2 +- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 69cc524581..98ec5c6e06 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company's users are in Azure Active Directory (Azure AD). +1. Ensure that your company’s users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company's users (or group of users) are assigned the necessary licenses. +1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company's users (or a group of users) can add devices. +These steps ensure that your company’s users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) ## Certificates and Authentication diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ce33c8bcb8..eabcdbfb87 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index a0978a7caa..c350d951eb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..6cfcb281b0 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 7b3ae68a4564ab3f16e90e35c9513f58f7fcc96f Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 15:46:57 -0700 Subject: [PATCH 014/249] Link fixes --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 98ec5c6e06..69cc524581 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company’s users are in Azure Active Directory (Azure AD). +1. Ensure that your company's users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. +1. Ensure that your company's users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company’s users (or a group of users) can add devices. +These steps ensure that your company's users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) ## Certificates and Authentication diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index dc85d351a4..f91fb8a234 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -33,7 +33,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -49,7 +49,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll the device in Azure Active Directory, or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From c6ecd83fe207649decc6a65d7fffc5a90e061661 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 16:01:48 -0700 Subject: [PATCH 015/249] Link fixes & checks --- devices/hololens/hololens-kiosk.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index eabcdbfb87..adc9a6f657 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -190,7 +190,7 @@ For other MDM services, check your provider's documentation for instructions. If ## Set up kiosk mode by using a provisioning package -As part of creating your Provisioning package, you'll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). +As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). Process: @@ -259,14 +259,14 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) + > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi){broken} or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb){broken}. -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password){broken} if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate){broken}. 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml From f10bf86869eb491adfd468a6dad492dbe252897e Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 16:47:53 -0700 Subject: [PATCH 016/249] edits --- devices/hololens/hololens-kiosk.md | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index adc9a6f657..9e311d3bc1 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -21,10 +21,13 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. +Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can choose one of three processes to set up and deploy the kiosk configuration. -- All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +## Kiosk mode requirements + +You can configure any HoloLens 2 device to use kiosk mode. + +To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. ## Select a kiosk mode @@ -83,7 +86,7 @@ There are three methods that you can use to configure the device as a kiosk: ## Set up kiosk mode by using Microsoft Intune or MDM -Process: +To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Create a device configuration policy](#create-a-device-configuration-policy). 1. Select the settings that you want to see in your kiosk. @@ -134,7 +137,7 @@ Some common in-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -## Assign the policy to the group to receive the policy +### Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. @@ -154,11 +157,11 @@ There is an important distinction between the **User logon type** and the **Assi - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. -## Set up the device +### Set up the device Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -### Set up a single-app kiosk +#### Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. @@ -170,7 +173,7 @@ Give your store app a short amount time to download as well as policy to be appl If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### Set up a multi-app kiosk +#### Set up a multi-app kiosk For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. @@ -192,7 +195,7 @@ For other MDM services, check your provider's documentation for instructions. If As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). -Process: +To set up kiosk mode by using a provisioning package, follow these steps. 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) @@ -256,6 +259,8 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Set up kiosk mode by using the Windows Device Portal +To set up kiosk mode by using the Windows Device Portal, follow these steps. + 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] @@ -303,7 +308,7 @@ Save the following sample as an XML file. You can use this file when you configu - + @@ -333,10 +338,10 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ``` -## Kiosk app recommendations +## Recommendations for selecting kiosk apps - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. From bced257a566dd019b37f54e56b49101e1dbb9b59 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Sun, 15 Mar 2020 18:00:35 -0700 Subject: [PATCH 017/249] Revisions --- devices/hololens/hololens-kiosk.md | 43 +++++++++++++++++++----------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 9e311d3bc1..81b7cd49f2 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -19,9 +19,11 @@ appliesto: - HoloLens 2 --- -# Set up HoloLens as a kiosk for specific applications +# Set up HoloLens as a kiosk -Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can choose one of three processes to set up and deploy the kiosk configuration. +Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. + +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-methods). ## Kiosk mode requirements @@ -52,7 +54,11 @@ While camera and video voice commands and UI are disabled by default the button To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] -> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. +> When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): +> +> - **Camera app AUMID**: `HoloCamera_cw5n1h2txyewy!HoloCamera` +> - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` +> For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. @@ -70,19 +76,26 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -| | Device Portal | Provisioning Package | MDM | -|------------------------------|---------------|----------------------|------| -| Single-app kiosk available | Yes | Yes | Yes | -| Multi-app kiosk available | No | Yes | Yes | -| Need device locally to apply | Yes | Yes | No | -| Need developer mode | Yes | No | No | -| Need AAD | No | No | Yes | -| Automatically deploy | No | No | Yes | -| Speed | Fastest | Fast | Slow | -| Recommended for scale | No | No | Yes | +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. + +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. + + > [!NOTE] + > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. + +The following table lists the capabilities and benefits of each of the three deployment methods. + +|   |Deploy by using Windows Device Portal |Deploy by using a provisioning package |Deploy by using MDM | +| --------------------------- | ------------- | -------------------- | ---- | +|Deploy single-app kiosks | Yes | Yes | Yes | +|Deploy multi-app kiosks | No | Yes | Yes | +|Deploy to local devices only | Yes | Yes | No | +|Deploy by using developer mode |Required | Not required | Not required | +|Deploy by using Azure Active Directory (AAD) | Not required | Not required | Required | +|Deploy automatically | No | No | Yes | +|Deployment speed | Fastest | Fast | Slow | +|Deploy at scale | Not recommended | Not recommended | Recommended | ## Set up kiosk mode by using Microsoft Intune or MDM From 46f99d6710edbfdc7d934b568041154343759744 Mon Sep 17 00:00:00 2001 From: Baard Hermansen Date: Fri, 20 Mar 2020 02:51:31 +0100 Subject: [PATCH 018/249] Update how-to-deploy-the-app-v-51-server-using-a-script.md Rewritten several HTML tables to "normal" text with headings and bulleted lists. Switched several HTML tables to markdown style. Tried to standardize text; For instance, there was a mix of **For example,**, **E.g.** and **For example:**. --- ...ploy-the-app-v-51-server-using-a-script.md | 1128 ++++++----------- 1 file changed, 356 insertions(+), 772 deletions(-) diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md b/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md index e3c13b3c79..5a39bf03ab 100644 --- a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md +++ b/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md @@ -10,787 +10,371 @@ ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 -ms.date: 06/16/2016 +ms.date: 03/20/2020 --- - # How to Deploy the App-V 5.1 Server Using a Script - In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. -**To Install the App-V 5.1 server using a script** - -- Use the following tables for more information about installing the App-V 5.1 server using the command line. - - **Note** - The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. - - - -~~~ -**Common parameters and Examples** - - ---- - - - - - - -

To Install the Management server and Management database on a local machine.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /MANAGEMENT_SERVER

    • -

  • /MANAGEMENT_ADMINACCOUNT

    • -

  • /MANAGEMENT_WEBSITE_NAME

    • -

  • /MANAGEMENT_WEBSITE_PORT

    • -

  • /DB_PREDEPLOY_MANAGEMENT

    • -

  • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /MANAGEMENT_DB_NAME

    • -
-

To use a custom instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /MANAGEMENT_SERVER

    • -

  • /MANAGEMENT_ADMINACCOUNT

    • -

  • /MANAGEMENT_WEBSITE_NAME

    • -

  • /MANAGEMENT_WEBSITE_PORT

    • -

  • /DB_PREDEPLOY_MANAGEMENT

    • -

  • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -

  • /MANAGEMENT_DB_NAME

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/MANAGEMENT_SERVER

-

/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

-

/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

-

/MANAGEMENT_WEBSITE_PORT=”8080”

-

/DB_PREDEPLOY_MANAGEMENT

-

/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

-

/MANAGEMENT_DB_NAME=”AppVManagement”

- - - - ---- - - - - - - -

To Install the Management server using an existing Management database on a local machine.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /MANAGEMENT_SERVER

    • -

  • /MANAGEMENT_ADMINACCOUNT

    • -

  • /MANAGEMENT_WEBSITE_NAME

    • -

  • /MANAGEMENT_WEBSITE_PORT

    • -

  • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    • -

  • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /EXISTING_MANAGEMENT_DB_NAME

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /MANAGEMENT_SERVER

    • -

  • /MANAGEMENT_ADMINACCOUNT

    • -

  • /MANAGEMENT_WEBSITE_NAME

    • -

  • /MANAGEMENT_WEBSITE_PORT

    • -

  • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    • -

  • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -

  • /EXISTING_MANAGEMENT_DB_NAME

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/MANAGEMENT_SERVER

-

/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

-

/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

-

/MANAGEMENT_WEBSITE_PORT=”8080”

-

/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

-

/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

-

/EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

- - - - ---- - - - - - - -

To install the Management server using an existing Management database on a remote machine.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /MANAGEMENT_SERVER

    • -

  • /MANAGEMENT_ADMINACCOUNT

    • -

  • /MANAGEMENT_WEBSITE_NAME

    • -

  • /MANAGEMENT_WEBSITE_PORT

    • -

  • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    • -

  • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /EXISTING_MANAGEMENT_DB_NAME

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /MANAGEMENT_SERVER

    • -

  • /MANAGEMENT_ADMINACCOUNT

    • -

  • /MANAGEMENT_WEBSITE_NAME

    • -

  • /MANAGEMENT_WEBSITE_PORT

    • -

  • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    • -

  • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -

  • /EXISTING_MANAGEMENT_DB_NAME

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/MANAGEMENT_SERVER

-

/MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

-

/MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

-

/MANAGEMENT_WEBSITE_PORT=”8080”

-

/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”

-

/EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

-

/EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

- - - - ---- - - - - - - -

To Install the Management database and the Management Server on the same computer.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /DB_PREDEPLOY_MANAGEMENT

    • -

  • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /MANAGEMENT_DB_NAME

    • -

  • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    • -

  • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /DB_PREDEPLOY_MANAGEMENT

    • -

  • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -

  • /MANAGEMENT_DB_NAME

    • -

  • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    • -

  • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/DB_PREDEPLOY_MANAGEMENT

-

/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

-

/MANAGEMENT_DB_NAME=”AppVManagement”

-

/MANAGEMENT_SERVER_MACHINE_USE_LOCAL

-

/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

- - - - ---- - - - - - - -

To install the Management database on a different computer than the Management server.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /DB_PREDEPLOY_MANAGEMENT

    • -

  • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /MANAGEMENT_DB_NAME

    • -

  • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    • -

  • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /DB_PREDEPLOY_MANAGEMENT

    • -

  • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -

  • /MANAGEMENT_DB_NAME

    • -

  • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    • -

  • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/DB_PREDEPLOY_MANAGEMENT

-

/MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

-

/MANAGEMENT_DB_NAME=”AppVManagement”

-

/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

-

/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

- - - - ---- - - - - - - -

To Install the publishing server.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /PUBLISHING_SERVER

    • -

  • /PUBLISHING_MGT_SERVER

    • -

  • /PUBLISHING_WEBSITE_NAME

    • -

  • /PUBLISHING_WEBSITE_PORT

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/PUBLISHING_SERVER

-

/PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”

-

/PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”

-

/PUBLISHING_WEBSITE_PORT=”8081”

- - - - ---- - - - - - - -

To Install the Reporting server and Reporting database on a local machine.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /REPORTING _SERVER

    • -

  • /REPORTING _WEBSITE_NAME

    • -

  • /REPORTING _WEBSITE_PORT

    • -

  • /DB_PREDEPLOY_REPORTING

    • -

  • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /REPORTING _DB_NAME

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /REPORTING _SERVER

    • -

  • /REPORTING _ADMINACCOUNT

    • -

  • /REPORTING _WEBSITE_NAME

    • -

  • /REPORTING _WEBSITE_PORT

    • -

  • /DB_PREDEPLOY_REPORTING

    • -

  • /REPORTING _DB_CUSTOM_SQLINSTANCE

    • -

  • /REPORTING _DB_NAME

    • -
-

Using a custom instance of Microsoft SQL Server example:

-
    -

  • /appv_server_setup.exe /QUIET

    • -

  • /REPORTING_SERVER

    • -

  • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    • -

  • /REPORTING_WEBSITE_PORT=”8082”

    • -

  • /DB_PREDEPLOY_REPORTING

    • -

  • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    • -

  • /REPORTING_DB_NAME=”AppVReporting”

    • -
- - - - ---- - - - - - - -

To Install the Reporting server and using an existing Reporting database on a local machine.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /REPORTING _SERVER

    • -

  • /REPORTING _WEBSITE_NAME

    • -

  • /REPORTING _WEBSITE_PORT

    • -

  • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    • -

  • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /EXISTING_REPORTING _DB_NAME

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /REPORTING _SERVER

    • -

  • /REPORTING _ADMINACCOUNT

    • -

  • /REPORTING _WEBSITE_NAME

    • -

  • /REPORTING _WEBSITE_PORT

    • -

  • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    • -

  • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

    • -

  • /EXISTING_REPORTING _DB_NAME

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/REPORTING_SERVER

-

/REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

-

/REPORTING_WEBSITE_PORT=”8082”

-

/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

-

/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

-

/EXITING_REPORTING_DB_NAME=”AppVReporting”

- - - - ---- - - - - - - -

To Install the Reporting server using an existing Reporting database on a remote machine.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /REPORTING _SERVER

    • -

  • /REPORTING _WEBSITE_NAME

    • -

  • /REPORTING _WEBSITE_PORT

    • -

  • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    • -

  • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /EXISTING_REPORTING _DB_NAME

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /REPORTING _SERVER

    • -

  • /REPORTING _ADMINACCOUNT

    • -

  • /REPORTING _WEBSITE_NAME

    • -

  • /REPORTING _WEBSITE_PORT

    • -

  • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    • -

  • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

    • -

  • /EXISTING_REPORTING _DB_NAME

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/REPORTING_SERVER

-

/REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

-

/REPORTING_WEBSITE_PORT=”8082”

-

/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”

-

/EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

-

/EXITING_REPORTING_DB_NAME=”AppVReporting”

- - - - ---- - - - - - - -

To install the Reporting database on the same computer as the Reporting server.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /DB_PREDEPLOY_REPORTING

    • -

  • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /REPORTING _DB_NAME

    • -

  • /REPORTING_SERVER_MACHINE_USE_LOCAL

    • -

  • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /DB_PREDEPLOY_REPORTING

    • -

  • /REPORTING _DB_CUSTOM_SQLINSTANCE

    • -

  • /REPORTING _DB_NAME

    • -

  • /REPORTING_SERVER_MACHINE_USE_LOCAL

    • -

  • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/DB_PREDEPLOY_REPORTING

-

/REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

-

/REPORTING_DB_NAME=”AppVReporting”

-

/REPORTING_SERVER_MACHINE_USE_LOCAL

-

/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

- - - - ---- - - - - - - -

To install the Reporting database on a different computer than the Reporting server.

To use the default instance of Microsoft SQL Server, use the following parameters:

-
    -

  • /DB_PREDEPLOY_REPORTING

    • -

  • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -

  • /REPORTING _DB_NAME

    • -

  • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    • -

  • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

To use a custom instance of Microsoft SQL Server, use these parameters:

-
    -

  • /DB_PREDEPLOY_REPORTING

    • -

  • /REPORTING _DB_CUSTOM_SQLINSTANCE

    • -

  • /REPORTING _DB_NAME

    • -

  • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    • -

  • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
-

Using a custom instance of Microsoft SQL Server example:

-

/appv_server_setup.exe /QUIET

-

/DB_PREDEPLOY_REPORTING

-

/REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

-

/REPORTING_DB_NAME=”AppVReporting”

-

/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

-

/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

- - - -**Parameter Definitions** - -**General Parameters** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/QUIET

Specifies silent install.

/UNINSTALL

Specifies an uninstall.

/LAYOUT

Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.

/LAYOUTDIR

Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”

/INSTALLDIR

Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”

/MUOPTIN

Enables Microsoft Update. No value is expected

/ACCEPTEULA

Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

- - - -**Management Server Installation Parameters** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/MANAGEMENT_SERVER

Specifies that the management server will be installed. No value is expected

/MANAGEMENT_ADMINACCOUNT

Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".

/MANAGEMENT_WEBSITE_NAME

Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”

MANAGEMENT_WEBSITE_PORT

Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.

- - - -**Parameters for the Management Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/DB_PREDEPLOY_MANAGEMENT

Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected

/MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

Indicates that the default SQL instance should be used. No value is expected.

/MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

/MANAGEMENT_DB_NAME

Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

/MANAGEMENT_SERVER_MACHINE_USE_LOCAL

Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”

/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”

- - - -**Parameters for Installing Publishing Server** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/PUBLISHING_SERVER

Specifies that the Publishing Server will be installed. No value is expected

/PUBLISHING_MGT_SERVER

Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored

/PUBLISHING_WEBSITE_NAME

Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”

/PUBLISHING_WEBSITE_PORT

Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83

- - - -**Parameters for Reporting Server** - - ---- - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/REPORTING_SERVER

Specifies that the Reporting Server will be installed. No value is expected

/REPORTING_WEBSITE_NAME

Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"

/REPORTING_WEBSITE_PORT

Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82

- - - -**Parameters for using an Existing Reporting Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.

/EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

/EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT

Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.

/EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE

Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

/EXISTING_ REPORTING _DB_NAME

Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting"

- - - -**Parameters for installing Reporting Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/DB_PREDEPLOY_REPORTING

Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected

/REPORTING_DB_SQLINSTANCE_USE_DEFAULT

Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

/REPORTING_DB_NAME

Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"

/REPORTING_SERVER_MACHINE_USE_LOCAL

Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"

/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"

- - - -**Parameters for using an existing Management Server Database** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterInformation

/EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

/EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

/EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

/EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

/EXISTING_MANAGEMENT_DB_NAME

Specifies the name of the existing management database that should be used. Example usage: /EXISTING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

-

-

Got a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).

-~~~ +## Install the App-V 5.1 server using a script +- Use the following information about installing the App-V 5.1 server using the command line. + > [!NOTE] + > The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. + +### Install the Management server and Management database on a local machine + +The following parameters are valid with both the default and custom instance of Microsoft SQL Server: + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /DB_PREDEPLOY_MANAGEMENT +- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT +- /MANAGEMENT_DB_NAME + +**Example: Using a custom instance of Microsoft SQL Server** + +```dos +appv_server_setup.exe /QUIET /MANAGEMENT_SERVER /MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" /MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" /MANAGEMENT_WEBSITE_PORT="8080" /DB_PREDEPLOY_MANAGEMENT /MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /MANAGEMENT_DB_NAME="AppVManagement" +``` + +### Install the Management server using an existing Management database on a local machine + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +- */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* +- /EXISTING_MANAGEMENT_DB_NAME + +To use a custom instance of Microsoft SQL Server, use the following parameters (difference from default instance in *italic*): + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL +- */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE* +- /EXISTING_MANAGEMENT_DB_NAME + +**Example: Using a custom instance of Microsoft SQL Server** + +```dos +appv_server_setup.exe /QUIET /MANAGEMENT_SERVER /MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" /MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" /MANAGEMENT_WEBSITE_PORT="8080" /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName" /EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" +``` + +### Install the Management server using an existing Management database on a remote machine + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME +- */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* +- /EXISTING_MANAGEMENT_DB_NAME + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /MANAGEMENT_SERVER +- /MANAGEMENT_ADMINACCOUNT +- /MANAGEMENT_WEBSITE_NAME +- /MANAGEMENT_WEBSITE_PORT +- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME +- */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE* +- /EXISTING_MANAGEMENT_DB_NAME + +**Example: Using a custom instance of Microsoft SQL Server:** + +```dos +appv_server_setup.exe /QUIET /MANAGEMENT_SERVER /MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" /MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" /MANAGEMENT_WEBSITE_PORT="8080" /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="SqlServermachine.domainName" /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName" /EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" +``` + +### Install the Management database and the Management Server on the same computer + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /DB_PREDEPLOY_MANAGEMENT +- */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /DB_PREDEPLOY_MANAGEMENT +- */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +**Example: Using a custom instance of Microsoft SQL Server** + +```dos +appv_server_setup.exe /QUIET /DB_PREDEPLOY_MANAGEMENT /MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /MANAGEMENT_DB_NAME="AppVManagement" /MANAGEMENT_SERVER_MACHINE_USE_LOCAL /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" +``` + +### Install the Management database on a different computer than the Management server + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /DB_PREDEPLOY_MANAGEMENT +- */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /DB_PREDEPLOY_MANAGEMENT +- */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* +- /MANAGEMENT_DB_NAME +- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT +- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT + +**Example: Using a custom instance of Microsoft SQL Server** + +```dos +appv_server_setup.exe /QUIET /DB_PREDEPLOY_MANAGEMENT /MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /MANAGEMENT_DB_NAME="AppVManagement" /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount" /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" +``` + +### Install the publishing server + +To use the default instance of Microsoft SQL Server, use the following parameters: + +- /PUBLISHING_SERVER +- /PUBLISHING_MGT_SERVER +- /PUBLISHING_WEBSITE_NAME +- /PUBLISHING_WEBSITE_PORT + +**Example: Using a custom instance of Microsoft SQL Server:** + +```dos +appv_server_setup.exe /QUIET /PUBLISHING_SERVER /PUBLISHING_MGT_SERVER="http://ManagementServerName:ManagementPort" /PUBLISHING_WEBSITE_NAME="Microsoft AppV Publishing Service" /PUBLISHING_WEBSITE_PORT="8081" +``` + +### Install the Reporting server and Reporting database on a local machine + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /DB_PREDEPLOY_REPORTING +- */REPORTING _DB_SQLINSTANCE_USE_DEFAULT* +- /REPORTING _DB_NAME + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /REPORTING _SERVER +- */REPORTING _ADMINACCOUNT* +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /DB_PREDEPLOY_REPORTING +- */REPORTING _DB_CUSTOM_SQLINSTANCE* +- /REPORTING _DB_NAME + +**Example: Using a custom instance of Microsoft SQL Server:** + +```dos +appv_server_setup.exe /QUIET /REPORTING_SERVER /REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" /REPORTING_WEBSITE_PORT="8082" /DB_PREDEPLOY_REPORTING /REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /REPORTING_DB_NAME="AppVReporting" +``` + +### Install the Reporting server and using an existing Reporting database on a local machine + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +- */EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT* +- /EXISTING_REPORTING _DB_NAME + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /REPORTING _SERVER +- */REPORTING _ADMINACCOUNT* +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL +- */EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE* +- /EXISTING_REPORTING _DB_NAME + +**Example: Using a custom instance of Microsoft SQL Server:** + +```dos +appv_server_setup.exe /QUIET /REPORTING_SERVER /REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" /REPORTING_WEBSITE_PORT="8082" /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /EXITING_REPORTING_DB_NAME="AppVReporting" +``` + +### Install the Reporting server using an existing Reporting database on a remote machine + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /REPORTING _SERVER +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME +- */EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT* +- /EXISTING_REPORTING _DB_NAME + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /REPORTING _SERVER +- */REPORTING _ADMINACCOUNT* +- /REPORTING _WEBSITE_NAME +- /REPORTING _WEBSITE_PORT +- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME +- */EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE* +- /EXISTING_REPORTING _DB_NAME + +**Example: Using a custom instance of Microsoft SQL Server:** + +```dos +appv_server_setup.exe /QUIET /REPORTING_SERVER /REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" /REPORTING_WEBSITE_PORT="8082" /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="SqlServerMachine.DomainName" /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /EXITING_REPORTING_DB_NAME="AppVReporting" +``` + +### Install the Reporting database on the same computer as the Reporting server + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /DB_PREDEPLOY_REPORTING +- */REPORTING _DB_SQLINSTANCE_USE_DEFAULT* +- /REPORTING _DB_NAME +- /REPORTING_SERVER_MACHINE_USE_LOCAL +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /DB_PREDEPLOY_REPORTING +- */REPORTING _DB_CUSTOM_SQLINSTANCE* +- /REPORTING _DB_NAME +- /REPORTING_SERVER_MACHINE_USE_LOCAL +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +**Example: Using a custom instance of Microsoft SQL Server:** + +```dos +appv_server_setup.exe /QUIET /DB_PREDEPLOY_REPORTING /REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /REPORTING_DB_NAME="AppVReporting" /REPORTING_SERVER_MACHINE_USE_LOCAL /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" +``` + +### Install the Reporting database on a different computer than the Reporting server + +To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT +- /REPORTING _DB_NAME +- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): + +- /DB_PREDEPLOY_REPORTING +- /REPORTING _DB_CUSTOM_SQLINSTANCE +- /REPORTING _DB_NAME +- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT +- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT + +**Example: Using a custom instance of Microsoft SQL Server:** + +```dos + appv_server_setup.exe /QUIET /DB_PREDEPLOY_REPORTING /REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /REPORTING_DB_NAME="AppVReporting" /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount" /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" +``` + +### Parameter Definitions + +#### General Parameters + +| Parameter | Information | +|--|--| +| /QUIET | Specifies silent install. | +| /UNINSTALL | Specifies an uninstall. | +| /LAYOUT | Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected. | +| /LAYOUTDIR | Specifies the layout directory. Takes a string. Example usage: **/LAYOUTDIR="C:\\Application Virtualization Server"** | +| /INSTALLDIR | Specifies the installation directory. Takes a string. Example usage: **/INSTALLDIR="C:\\Program Files\\Application Virtualization\\Server"** | +| /MUOPTIN | Enables Microsoft Update. No value is expected. | +| /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage: **/ACCEPTEULA** or **/ACCEPTEULA=1** | + +#### Management Server Installation Parameters + +|Parameter |Information | +|--|--| +| /MANAGEMENT_SERVER | Specifies that the management server will be installed. No value is expected | +| /MANAGEMENT_ADMINACCOUNT | Specifies the account that will be allowed Administrator access to the management server. This can be a user account or a group. Example usage: **/MANAGEMENT_ADMINACCOUNT="mydomain\\admin"**. If **/MANAGEMENT_SERVER** is not specified, this will be ignored. | +| /MANAGEMENT_WEBSITE_NAME | Specifies name of the website that will be created for the management service. Example usage: **/MANAGEMENT_WEBSITE_NAME="Microsoft App-V Management Service"** | +| MANAGEMENT_WEBSITE_PORT | Specifies the port number that will be used by the management service will use. Example usage: **/MANAGEMENT_WEBSITE_PORT=82** | + +#### Parameters for the Management Server Database + +| Parameter | Information | +|--|--| +| /DB_PREDEPLOY_MANAGEMENT | Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected. | +| /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance should be used. No value is expected. | +| /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: **/MANAGEMENT_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"**. If **/DB_PREDEPLOY_MANAGEMENT** is not specified, this will be ignored. | +| /MANAGEMENT_DB_NAME | Specifies the name of the new management database that should be created. Example usage: **/MANAGEMENT_DB_NAME="AppVMgmtDB"**. If **/DB_PREDEPLOY_MANAGEMENT** is not specified, this will be ignored. | +| /MANAGEMENT_SERVER_MACHINE_USE_LOCAL | Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | +| /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the management server will be installed on. Example usage: **/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="domain\\computername"** | +| /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the management server. Example usage: **/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT ="domain\\alias"** | + +#### Parameters for Installing Publishing Server + +| Parameter | Information | +|--|--| +| /PUBLISHING_SERVER | Specifies that the Publishing Server will be installed. No value is expected. | +| /PUBLISHING_MGT_SERVER | Specifies the URL to Management Service the Publishing server will connect to. Example usage: **http://<management server name>:<Management server port number>**. If **/PUBLISHING_SERVER** is not used, this parameter will be ignored. | +| /PUBLISHING_WEBSITE_NAME | Specifies name of the website that will be created for the publishing service. Example usage: **/PUBLISHING_WEBSITE_NAME="Microsoft App-V Publishing Service"** | +| /PUBLISHING_WEBSITE_PORT | Specifies the port number used by the publishing service. Example usage: **/PUBLISHING_WEBSITE_PORT=83** | + +#### Parameters for Reporting Server + +| Parameter | Information | +|--|--| +| /REPORTING_SERVER | Specifies that the Reporting Server will be installed. No value is expected. | +| /REPORTING_WEBSITE_NAME | Specifies name of the website that will be created for the Reporting Service. Example usage: **/REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"** | +| /REPORTING_WEBSITE_PORT | Specifies the port number that the Reporting Service will use. Example usage: **/REPORTING_WEBSITE_PORT=82** | + +#### Parameters for using an Existing Reporting Server Database + +| Parameter | Information | +|--|--| +| /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL | Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected. | +| /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. Example usage: **/EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"** | +| /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. | +| /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used. Takes a string. Example usage: **/EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"** | +| /EXISTING_ REPORTING _DB_NAME | Specifies the name of the existing Reporting database that should be used. Takes a string. Example usage: **/EXISTING_REPORTING_DB_NAME="AppVReporting"** | + +#### Parameters for installing Reporting Server Database + +| Parameter | Information | +|--|--| +| /DB_PREDEPLOY_REPORTING | Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected. | +| /REPORTING_DB_SQLINSTANCE_USE_DEFAULT | Specifies the name of the custom SQL instance that should be used. Takes a string. Example usage: **/REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"** | +| /REPORTING_DB_NAME | Specifies the name of the new Reporting database that should be created. Takes a string. Example usage: **/REPORTING_DB_NAME="AppVMgmtDB"** | +| /REPORTING_SERVER_MACHINE_USE_LOCAL | Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | +| /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. Example usage: **/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="domain\computername"** | +| /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. Example usage: **/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="domain\\alias"** | + +#### Parameters for using an existing Management Server Database + +| Parameter | Information | +|--|--| +| /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL | Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. Example usage: **/EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"** | +| /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that will be used. Example usage **/EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE="AppVManagement"**. If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | +| /EXISTING_MANAGEMENT_DB_NAME | Specifies the name of the existing management database that should be used. Example usage: **/EXISTING_MANAGEMENT_DB_NAME="AppVMgmtDB"**. If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | + +Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). ## Related topics - [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - - - - - - - - From 57f2babbbbb43beab3b9d7168fa2757a00f259f0 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 24 Mar 2020 15:21:35 -0700 Subject: [PATCH 019/249] Indented final paragraph in list items These corrections follow my review of [PR 2366](https://github.com/MicrosoftDocs/windows-docs-pr/pull/2366), where I discovered the final paragraphs in these two list items were not indented with the rest of the list items. --- .../microsoft-defender-atp/customize-exploit-protection.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md index 64a77031bf..30dd08b49c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md @@ -89,7 +89,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi > > Mikael then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, he enables the **Override system settings** option and sets the switch to **On**. There are no other apps listed in the **Program settings** section. > -> The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied. +> The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied. > > > * **Example 2** @@ -100,8 +100,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi > > Josie also adds the app *miles.exe* to the **Program settings** section and configures **Control flow guard (CFG)** to **On**. She doesn't enable the **Override system settings** option for DEP or any other mitigations for that app. > ->The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. ->CFG will be enabled for *miles.exe*. +> The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. CFG will be enabled for *miles.exe*. > [!NOTE] > If you have found any issues in this article, you can report it directly to a Windows Server/Windows Client partner or use the Microsoft technical support numbers for your country. From d7a12452b2e318899ec6e9303639564d81b2d4d0 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Thu, 26 Mar 2020 12:01:13 -0700 Subject: [PATCH 020/249] Feedback changes to Kiosk Adding Lavinder's feedback to the Kiosk doc. @Teresa-Motiv --- devices/hololens/hololens-kiosk.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 81b7cd49f2..ca615c8f6c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -33,18 +33,21 @@ To configure a HoloLens (1st gen) device to use kiosk mode, you must first make ## Select a kiosk mode -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user in the startup tiles user experience. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +> [!NOTE] +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) + > [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. +> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Auto sign-in | Can distinguish different users to use Kiosk mode or full access | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Accounts may sign-in automatically | Can distinguish different users to use Kiosk mode or full access | | --- | --- | --- | --- | --- | --- | --- | --- | |Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | |Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | @@ -52,6 +55,7 @@ The following table lists the device capabilities in the different kiosk modes. While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. +Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retreving your pictures, such as Photos, Mail, or OneDrive. > [!NOTE] > When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): @@ -147,6 +151,7 @@ Some common in-box apps you may wish to use are: | Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | | Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). @@ -164,9 +169,9 @@ There is an important distinction between the **User logon type** and the **Assi **Examples:** -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. -- You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. @@ -354,7 +359,7 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Recommendations for selecting kiosk apps - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. From 62285cab860d8630f68659caa7c38fc574a7aeb4 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 26 Mar 2020 13:08:01 -0700 Subject: [PATCH 021/249] Link fix --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ca615c8f6c..6bff0bc2ac 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,7 +23,7 @@ appliesto: Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. -This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-methods). +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). ## Kiosk mode requirements From 8fb3a255bf0185c92e4cd7a82c2bcb6fd240982c Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Fri, 27 Mar 2020 09:12:03 -0700 Subject: [PATCH 022/249] UI and Security note, Full AUMID List @Teresa-Motiv --- devices/hololens/hololens-kiosk.md | 35 ++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6bff0bc2ac..8045db06c4 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -25,6 +25,9 @@ Kiosk mode is a convenient feature that you can use to focus the HoloLens device This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). +> [!IMPORTANT] +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) + ## Kiosk mode requirements You can configure any HoloLens 2 device to use kiosk mode. @@ -37,9 +40,6 @@ When HoloLens is configured as a multi-app kiosk, only the allowed apps are avai Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. -> [!NOTE] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) - > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > @@ -142,16 +142,27 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. -Some common in-box apps you may wish to use are: +In-box apps you may wish to use are: -| App Name | AUMID | -|---------------|----------------------------------------------------------------------| -| Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| App Name | AUMID | +|----------------------------|----------------------------------------------------------------------------------| +| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| File Explorer | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail | +| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Microsoft Edge | Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge | +| Microsoft Store | Microsoft.WindowsStore_8wekyb3d8bbwe!App | +| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). From fa3c6c86bf0bb4854a5eb46eb4a822dbf8217216 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Mar 2020 16:27:22 -0700 Subject: [PATCH 023/249] Cleanup --- devices/hololens/hololens-kiosk.md | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 8045db06c4..c5fbfc557e 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,10 +23,10 @@ appliesto: Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. -This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). > [!IMPORTANT] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) ## Kiosk mode requirements @@ -83,7 +83,7 @@ There are three methods that you can use to configure the device as a kiosk: - You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -116,7 +116,7 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the ### Create a device configuration policy -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** 1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. @@ -139,9 +139,9 @@ For **User logon type**: Add one or more user accounts that can use the apps you It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. In-box apps you may wish to use are: | App Name | AUMID | @@ -169,10 +169,11 @@ For more information on settings for both modes of Kiosk visit [here](https://do ### Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -184,7 +185,7 @@ There is an important distinction between the **User logon type** and the **Assi - You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. ### Set up the device @@ -192,7 +193,7 @@ Now it's time to set up the device to both receive the policy and log into the a #### Set up a single-app kiosk -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. @@ -282,7 +283,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). @@ -317,7 +318,7 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. -> [!NOTE] +> [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. ### Start layout file for MDM (Intune and others) @@ -369,11 +370,11 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Recommendations for selecting kiosk apps -- You cannot select the Shell app as a kiosk app. +- You cannot select the Shell app as a kiosk app. - We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From fe23996d8691dfc0480cadc38459304fcac3eda9 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 31 Mar 2020 13:55:07 -0700 Subject: [PATCH 024/249] Revisions --- devices/hololens/hololens-kiosk.md | 266 ++++++++++++++++++----------- 1 file changed, 167 insertions(+), 99 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c5fbfc557e..0c51860a98 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -21,36 +21,52 @@ appliesto: # Set up HoloLens as a kiosk -Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. +You can configure a HoloLens device to function as a fixed-purpose device, also called a *kiosk*, by configuring the device to run in kiosk mode. Kiosk mode limits the applications (or users) that are available on the device. Kiosk mode is a convenient feature that you can use to dedicate a HoloLens device to business apps, or to use the HoloLens device in an app demo. This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). > [!IMPORTANT] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) +> Kiosk mode determines which apps are available when a user signs in to the device. However, kiosk mode is not a security limitation. It does not stop an "allowed" app from launching an app that is not allowed. In order to block apps or processes from launching, use [Windows Defender Application Control (WDAC) CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) to create appropriate policies. -## Kiosk mode requirements +You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. + +## Plan the kiosk deployment + +### Kiosk mode requirements You can configure any HoloLens 2 device to use kiosk mode. To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. -## Select a kiosk mode +### Decide between a single-app kiosk or a multi-app kiosk -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user in the startup tiles user experience. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +A single-app kiosk starts the specified app when the user signs in to the device. The Start menu is disabled, as is Cortana. A HoloLens 2 device does not respond to the [Start](hololens2-basic-usage.md#start-gesture) gesture. A HoloLens (1st gen) device does not respond to the [bloom](hololens1-basic-usage.md) gesture. Because only one app can run, the user cannot place other apps. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +A multi-app kiosk displays the start menu when the user signs in to the device. The kiosk configuration determines what apps are available on the Start menu. You can use a multi-app kiosk to provide an easy-to-understand experience for users by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. -> [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. -> -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +The following table lists the feature capabilities in the different kiosk modes. -The following table lists the device capabilities in the different kiosk modes. - -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Accounts may sign-in automatically | Can distinguish different users to use Kiosk mode or full access | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast | | --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | -|Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | +|Single-app kiosk |No |No |No* |No | +|Multi-app kiosk |Yes |Yes* |Yes* |Yes* | +\* For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). + +The following table lists the user capabilities in the different kiosk modes. + +|   |Supported user types | Automatic sign-in | Multiple access levels | +| --- | --- | --- | --- | +|Single-app kiosk |Managed Service Account (MSA) in Azure Active Directory (AAD) or local account |Yes |No | +|Multi-app kiosk |AAD account |No |Yes | + +For a better idea of how to use these capabilities, see the following table: + +|Use a single-app kiosk for: |Use a multi-app kiosk for: | +| --- | --- | +|A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | +|A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | + +### Select kiosk apps and features While camera and video voice commands and UI are disabled by default the button commands can still be used. @@ -65,17 +81,50 @@ Also while enabling the camera allows on to take pictures or video, you may also > For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +> [!WARNING] +> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. +> +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. + +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- You can select Cortana as a kiosk app. +- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. + +### Plan access control One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. -Examples scenarios of when to use which kiosk: +Assign the policy to the group to receive the policy -- A device dedicated to Guides to help new hires: Single-app kiosk -- A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk -- You have a custom app and only allow access to it: Single-app kiosk -- You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. -## Select a deployment method +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +**Examples:** + +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + + +### Select a deployment method + +What are you deploying: + +- Single-app kiosk +- Simple multi-app kiosk +- Fully-customized multi-app kiosk There are three methods that you can use to configure the device as a kiosk: @@ -101,6 +150,82 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | +### Create a kiosk configuration XML file + +Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: + +- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. +- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. + +#### Add guest access to the kiosk configuration (optional) + +In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. + +Use the following snippet in your kiosk configuration XML to enable the **Guest** account: + +```xml + + + + + + +``` + +## Start layout for HoloLens + +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. + +> [!NOTE] +> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. + +### Start layout file for MDM (Intune and others) + +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). + +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). + +```xml + + + + + + + + + +``` + +### Create a start layout for a customized multi-app kiosk + +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. + +```xml + + + + + + + + + + + + + + + ]]> + + +``` + ## Set up kiosk mode by using Microsoft Intune or MDM To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. @@ -114,7 +239,7 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). -### Create a device configuration policy +### [MDM] 1. Create a device configuration policy 1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** @@ -122,17 +247,23 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. -For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). +For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). ### Select the settings that you want to see in your kiosk -#### Configure the settings for a single-app kiosk +#### [MDM] 2. Configure the settings for a single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -#### Configure the settings for a multi-app kiosk +#### [MDM] 2. Configure the settings for a multi-app kiosk + +Additional information: + +- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). + +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. @@ -166,7 +297,7 @@ In-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -### Assign the policy to the group to receive the policy +### [MDM] 3. Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. @@ -191,7 +322,7 @@ There is an important distinction between the **User logon type** and the **Assi Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -#### Set up a single-app kiosk +#### [MDM] 4. Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. @@ -203,7 +334,7 @@ Give your store app a short amount time to download as well as policy to be appl If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -#### Set up a multi-app kiosk +#### [MDM] 4. Set up a multi-app kiosk For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. @@ -215,13 +346,9 @@ To enable Kiosk mode simply **sign out** of your account and **sign in** to a pr If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -Additional information: -For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -## Set up kiosk mode by using a provisioning package +## Use a provisioning package to set up a single-app or muti-app kiosk As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). @@ -231,7 +358,7 @@ To set up kiosk mode by using a provisioning package, follow these steps. 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) -### Create a kiosk configuration XML file +### [PP] 1. Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: @@ -253,7 +380,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ``` -### Add the kiosk configuration XML file to a provisioning package +### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 2. Choose **Advanced provisioning**. @@ -281,13 +408,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* 16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. -### Apply the provisioning package to HoloLens +### [PP] 3. Apply the provisioning package to HoloLens You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode by using the Windows Device Portal +## Use the Windows Device Portal to set up a single-app kiosk To set up kiosk mode by using the Windows Device Portal, follow these steps. @@ -296,12 +423,12 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi){broken} or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb){broken}. +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password){broken} if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate){broken}. + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#security_certificate). 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -314,67 +441,8 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. 6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** -## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. -> [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. - -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` - -### Start layout for a provisioning package - -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. - -```xml - - - - - - - - - - - - - - - ]]> - - -``` - -## Recommendations for selecting kiosk apps - -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From 6719e19444fbbda1c9fca64875c621bd6e0a15bd Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 31 Mar 2020 16:32:48 -0700 Subject: [PATCH 025/249] Revisions in progress (to be continued) --- devices/hololens/hololens-kiosk.md | 84 ++++++++++++++++++++++++++---- 1 file changed, 73 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 0c51860a98..1284f45cae 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -46,11 +46,12 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast | -| --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No* |No | -|Multi-app kiosk |Yes |Yes* |Yes* |Yes* | -\* For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |No |No |No1 |No |No1, 2 | +|Multi-app kiosk |Yes |Yes1 |Yes1 |Yes1 |Yes1 | +>1 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +>2 Even if Cortana is disabled, the built-in voice commands are available. The following table lists the user capabilities in the different kiosk modes. @@ -66,12 +67,26 @@ For a better idea of how to use these capabilities, see the following table: |A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | -### Select kiosk apps and features +### Select kiosk apps + +For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). + +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. If you use the Windows Device Portal to configure kiosk mode, you select the app to run during the setup process. + + + +While camera and video voice commands and UI are disabled by default the button + + + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). +[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) + +[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) -While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retreving your pictures, such as Photos, Mail, or OneDrive. +Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retrieving your pictures, such as Photos, Mail, or OneDrive. > [!NOTE] > When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): @@ -80,20 +95,67 @@ Also while enabling the camera allows on to take pictures or video, you may also > - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` > For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. + > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. + - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +> [!CAUTION] +> We recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as a kiosk app. + +In-box apps you may wish to use are: + +| App Name | AUMID | +|----------------------------|----------------------------------------------------------------------------------| +| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | + + + +### [MDM] 3. Assign the policy to the group to receive the policy + +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +**Examples:** + +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + ### Plan access control +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. Assign the policy to the group to receive the policy From d73fa1a7d64652eac8b2a3e549f92a73eedf9a47 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 2 Apr 2020 13:12:26 -0700 Subject: [PATCH 026/249] Revisions --- devices/hololens/hololens-kiosk.md | 83 +++++++++++++++--------------- 1 file changed, 42 insertions(+), 41 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 1284f45cae..63ba1b8546 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -46,21 +46,23 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana | -| --- | --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No1 |No |No1, 2 | -|Multi-app kiosk |Yes |Yes1 |Yes1 |Yes1 |Yes1 | ->1 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). ->2 Even if Cortana is disabled, the built-in voice commands are available. +|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | +|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | -The following table lists the user capabilities in the different kiosk modes. +> 1 Voice commands that relate to disabled features do not function. +> 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +> 3 Even if Cortana is disabled, the built-in voice commands are enabled. + +The following table lists the user support features of the different kiosk modes. |   |Supported user types | Automatic sign-in | Multiple access levels | | --- | --- | --- | --- | |Single-app kiosk |Managed Service Account (MSA) in Azure Active Directory (AAD) or local account |Yes |No | |Multi-app kiosk |AAD account |No |Yes | -For a better idea of how to use these capabilities, see the following table: +For examples of how to use these capabilities, see the following table. |Use a single-app kiosk for: |Use a multi-app kiosk for: | | --- | --- | @@ -71,67 +73,56 @@ For a better idea of how to use these capabilities, see the following table: For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. If you use the Windows Device Portal to configure kiosk mode, you select the app to run during the setup process. - - - -While camera and video voice commands and UI are disabled by default the button - - - -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) - -[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) - - -To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retrieving your pictures, such as Photos, Mail, or OneDrive. - -> [!NOTE] -> When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): -> -> - **Camera app AUMID**: `HoloCamera_cw5n1h2txyewy!HoloCamera` -> - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` -> For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). +If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. > [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. +> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide. These policies impact other users on the device. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. +To revert these policies, you have to reset the device to the factory settings. + +[the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). -- You cannot select the Shell app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. > [!CAUTION] -> We recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as a kiosk app. +> You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. +[Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): In-box apps you may wish to use are: | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | | Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Cortana2 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | | Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | | Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | | Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Miracast3 | | | Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | | OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | | Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | | Settings | HolographicSystemSettings_cw5n1h2txyewy!App | | Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +> 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. +> 2 When you enable the Camera app, be aware of the following: +> - The Quick Actions menu includes the Photo and Video buttons. +> - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). +> +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. +> 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. -### [MDM] 3. Assign the policy to the group to receive the policy +While camera and video voice commands and UI are disabled by default the button + +[MDM] 3. Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. @@ -182,6 +173,10 @@ There is an important distinction between the **User logon type** and the **Assi ### Select a deployment method + +While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. + + What are you deploying: - Single-app kiosk @@ -212,6 +207,12 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). +[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) + +[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) + ### Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: From 8542a813eb19ab643afb30b02b210f987e3cde5d Mon Sep 17 00:00:00 2001 From: mapalko Date: Thu, 2 Apr 2020 16:50:27 -0700 Subject: [PATCH 027/249] updates to WHFB PIN policy documentation --- .../hello-manage-in-organization.md | 124 +++++++++++++++--- 1 file changed, 104 insertions(+), 20 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index c9213a887f..8767eadd0d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -15,7 +15,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 10/18/2017 +ms.date: 4/2/2020 --- # Manage Windows Hello for Business in your organization @@ -34,21 +34,23 @@ You can create a Group Policy or mobile device management (MDM) policy that will ## Group Policy settings for Windows Hello for Business -The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. +The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. > [!NOTE] > Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**. - + + + @@ -56,15 +58,37 @@ The following table lists the Group Policy settings that you can configure for W + + + + + + + + + + + + + + + + + + + + + - - + +<
PolicyScope Options
Use Windows Hello for Business Computer or user -

Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

+

Not configured: Device does not provision Windows Hello for Business for any user.

Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

Disabled: Device does not provision Windows Hello for Business for any user.

Use a hardware security device Computer

Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

-

Enabled: Windows Hello for Business will only be provisioned using TPM.

+

Enabled: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.

Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.
Use certificate for on-premises authenticationComputer or user +

Not configured: Windows Hello for Business enrolls a key that is used for on-premises authentication.

+

Enabled: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.

+

Disabled: Windows Hello for Business enrolls a key that is used for on-premises authentication.

+
Use PIN recoveryComputer +

Added in Windows 10, version 1703

+

Not configured: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

+

Enabled: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

+

Disabled: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

+
Use biometrics Computer

Not configured: Biometrics can be used as a gesture in place of a PIN.

Enabled: Biometrics can be used as a gesture in place of a PIN.

@@ -74,6 +98,7 @@ The following table lists the Group Policy settings that you can configure for W
PIN Complexity Require digitsComputer

Not configured: Users must include a digit in their PIN.

Enabled: Users must include a digit in their PIN.

@@ -82,6 +107,7 @@ The following table lists the Group Policy settings that you can configure for W
Require lowercase lettersComputer

Not configured: Users cannot use lowercase letters in their PIN.

Enabled: Users must include at least one lowercase letter in their PIN.

@@ -90,6 +116,7 @@ The following table lists the Group Policy settings that you can configure for W
Maximum PIN lengthComputer

Not configured: PIN length must be less than or equal to 127.

Enabled: PIN length must be less than or equal to the number you specify.

@@ -98,6 +125,7 @@ The following table lists the Group Policy settings that you can configure for W
Minimum PIN lengthComputer

Not configured: PIN length must be greater than or equal to 4.

Enabled: PIN length must be greater than or equal to the number you specify.

@@ -106,6 +134,7 @@ The following table lists the Group Policy settings that you can configure for W
ExpirationComputer

Not configured: PIN does not expire.

Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

@@ -114,6 +143,7 @@ The following table lists the Group Policy settings that you can configure for W
HistoryComputer

Not configured: Previous PINs are not stored.

Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

@@ -124,6 +154,7 @@ The following table lists the Group Policy settings that you can configure for W
Require special charactersComputer

Not configured: Users cannot include a special character in their PIN.

Enabled: Users must include at least one special character in their PIN.

@@ -132,6 +163,7 @@ The following table lists the Group Policy settings that you can configure for W
Require uppercase lettersComputer

Not configured: Users cannot include an uppercase letter in their PIN.

Enabled: Users must include at least one uppercase letter in their PIN.

@@ -139,9 +171,9 @@ The following table lists the Group Policy settings that you can configure for W
>Phone Sign-in -

Use Phone Sign-in

+		Phone Sign-inUse Phone Sign-inComputer

Not currently supported.

@@ -154,7 +186,7 @@ The following table lists the Group Policy settings that you can configure for W The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=692070). >[!IMPORTANT] ->Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. +>Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. @@ -166,7 +198,7 @@ The following table lists the MDM policy settings that you can configure for Win - + - + + + + + + + + + + + + + + + @@ -261,7 +315,7 @@ The following table lists the MDM policy settings that you can configure for Win @@ -297,20 +351,50 @@ The following table lists the MDM policy settings that you can configure for Win
UsePassportForWork DeviceDevice or user True

True: Windows Hello for Business will be provisioned for all users on the device.

@@ -178,7 +210,7 @@ The following table lists the MDM policy settings that you can configure for Win
RequireSecurityDevice DeviceDevice or user False

True: Windows Hello for Business will only be provisioned using TPM.

@@ -186,6 +218,28 @@ The following table lists the MDM policy settings that you can configure for Win
Exclude Security DeviceTPM12DeviceFalse +

Added in Windows 10, version 1703

+

True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.

+

False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.

+
EnablePinRecoveryDevice or userFalse +

Added in Windows 10, version 1703

+

True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

+

False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

+
Biometrics

UseBiometrics

@@ -252,7 +306,7 @@ The following table lists the MDM policy settings that you can configure for Win 		Device or user 0 -

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. +

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.

Device or user 0 -

Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. +

Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.

>[!NOTE] -> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. +> InWindows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN. +## Policy conflicts from multiple policy sources + +Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device. + +Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. All PIN complexity policies are grouped together and enforced from a single policy source. + +Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis. + +>Examples +> +>The following are configured using computer Group Policy: +> +>- Use Windows Hello for Business - Enabled +>- User certificate for on-premises authentication - Enabled +>- Require digits - Enabled +>- Minimum PIN length - 6 +> +>The following are configured using device MDM Policy: +> +>- UsePassportForWork - Disabled +>- UseCertificateForOnPremAuth - Disabled +>- MinimumPINLength - 8 +>- Digits - 1 +>- LowercaseLetters - 1 +>- SpecialCharacters - 1 +> +>Enforced policy set: +> +>- Use Windows Hello for Business - Enabled +>- Use certificate for on-premises authentication - Enabled +>- Require digits - Enabled +>- Minimum PIN length - 6 ## How to use Windows Hello for Business with Azure Active Directory -There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: +There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: -- **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. -- **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. +- **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant's directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. +- **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won't be enabled unless and until the organization's administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. - **Organizations that have subscribed to Azure AD Premium** have access to the full set of Azure AD MDM features. These features include controls to manage Windows Hello for Business. You can set policies to disable or force the use of Windows Hello for Business, require the use of a TPM, and control the length and strength of PINs set on the device. -If you want to use Windows Hello for Business with certificates, you’ll need a device registration system. That means that you set up Configuration Manager, Microsoft Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. - - +If you want to use Windows Hello for Business with certificates, you'll need a device registration system. That means that you set up Configuration Manager, Microsoft Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. ## Related topics From 5e1e5596a1d3d12deac38f376efc778f4bd545e8 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 3 Apr 2020 16:46:04 -0700 Subject: [PATCH 028/249] Revisions --- devices/hololens/hololens-kiosk.md | 52 ++++++------------------------ 1 file changed, 10 insertions(+), 42 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 63ba1b8546..80514d9c93 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -30,6 +30,11 @@ This article provides information about aspects of configuring kiosks that are s You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. +> [!WARNING] +> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, [certain policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy) are enforced system-wide. These policies impact other users on the device. +> +> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. To revert these policies, you have to reset the device to the factory settings. + ## Plan the kiosk deployment ### Kiosk mode requirements @@ -69,42 +74,29 @@ For examples of how to use these capabilities, see the following table. |A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | -### Select kiosk apps +### Plan kiosk apps For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. -If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. - -> [!WARNING] -> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide. These policies impact other users on the device. -> -> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. -To revert these policies, you have to reset the device to the factory settings. - -[the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). - - +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. The CSP uses [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app) to identify applications. The following table lists the AUMIDs of some in-box applications that you can use in a multi-app kiosk. > [!CAUTION] > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. -[Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): -In-box apps you may wish to use are: - | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | | Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | | Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana2 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Cortana3 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | | Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | | Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | | Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Miracast3 | | +| Miracast4 | | | Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | | OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | | Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | @@ -116,33 +108,9 @@ In-box apps you may wish to use are: > - The Quick Actions menu includes the Photo and Video buttons. > - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). > -> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. - -While camera and video voice commands and UI are disabled by default the button - -[MDM] 3. Assign the policy to the group to receive the policy - -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. - -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. - -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). - -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. - -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. - ### Plan access control It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. From e646164a3385d51b40785b398c3e7f66bd09ab3a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 9 Apr 2020 15:57:10 -0700 Subject: [PATCH 029/249] fix acrolinx issues --- .../advanced-features.md | 45 ++++++++++--------- 1 file changed, 24 insertions(+), 21 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md index 798540594f..c372c8f63a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md @@ -20,6 +20,7 @@ ms.topic: article # Configure advanced features in Microsoft Defender ATP **Applies to:** + - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink) @@ -30,32 +31,36 @@ Use the following advanced features to get better protected from potentially mal ## Automated investigation -When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigation](automated-investigations.md). +Turn on this feature to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigation](automated-investigations.md). ## Live response -When you enable this feature, users with the appropriate permissions can initiate a live response session on machines. +Turn on this feature so that users with the appropriate permissions can start a live response session on machines. -For more information on role assignments see, [Create and manage roles](user-roles.md). +For more information about role assignments, see [Create and manage roles](user-roles.md). ## Live response unsigned script execution Enabling this feature allows you to run unsigned scripts in a live response session. -## Auto-resolve remediated alerts +## Autoresolve remediated alerts -For tenants created on or after Windows 10, version 1809 the automated investigation and remediation capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don’t want to have alerts auto-resolved, you’ll need to manually turn off the feature. +For tenants created on or after Windows 10, version 1809 the automated investigation and remediation capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don't want to have alerts auto-resolved, you'll need to manually turn off the feature. >[!TIP] >For tenants created prior that version, you'll need to manually turn this feature on from the [Advanced features](https://securitycenter.windows.com/preferences2/integration) page. >[!NOTE] -> - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. +> +>- The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. >- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it. ## Allow or block file -Blocking is only available if your organization uses Windows Defender Antivirus as the active antimalware solution, and if the cloud-based protection feature is enabled. +Blocking is only available if your organization fulfills these requirements: + +- Uses Windows Defender Antivirus as the active antimalware solution and, +- The cloud-based protection feature is enabled This feature enables you to block potentially malicious files in your network. Blocking a file will prevent it from being read, written, or executed on machines in your organization. @@ -69,24 +74,22 @@ To turn **Allow or block** files on: 1. Select **Save preferences** at the bottom of the page. -Once you have enabled this feature, you can [block files](respond-file-alerts.md#allow-or-block-file) via the **Add Indicator** tab on a file's profile page. - +After turning on this feature, you can [block files](respond-file-alerts.md#allow-or-block-file) via the **Add Indicator** tab on a file's profile page. ## Custom network indicators -Enabling this feature allows you to create indicators for IP addresses, domains, or URLs which determine whether they will be allowed or blocked based on your custom indicator list. +Turning on this feature allows you to create indicators for IP addresses, domains, or URLs, which determine whether they will be allowed or blocked based on your custom indicator list. -To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834). +To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834). For more information, see [Manage indicators](manage-indicators.md). >[!NOTE] >Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender ATP data. - ## Show user details -When you enable this feature, you'll be able to see user details stored in Azure Active Directory including a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views: +Turn on this feature so that you can see user details stored in Azure Active Directory. Details include a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views: - Security operations dashboard - Alert queue @@ -110,25 +113,25 @@ The integration with Azure Advanced Threat Protection allows you to pivot direct ## Microsoft Secure Score -Forwards Microsoft Defender ATP signals to Microsoft Secure Score in the Microsoft 365 security center. Turning this feature on gives Microsoft Secure Score visibility into the devices security posture. Forwarded data is stored and processed in the same location as the your Microsoft Secure Score data. +Forwards Microsoft Defender ATP signals to Microsoft Secure Score in the Microsoft 365 security center. Turning on this feature gives Microsoft Secure Score visibility into the devices security posture. Forwarded data is stored and processed in the same location as the your Microsoft Secure Score data. ### Enable the Microsoft Defender ATP integration from the Azure ATP portal To receive contextual machine integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal. -1. Login to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role. +1. Log in to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role. 2. Click **Create your instance**. 3. Toggle the Integration setting to **On** and click **Save**. -When you complete the integration steps on both portals, you'll be able to see relevant alerts in the machine details or user details page. +After completing the integration steps on both portals, you'll be able to see relevant alerts in the machine details or user details page. ## Office 365 Threat Intelligence connection This feature is only available if you have an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page. -When you enable this feature, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a holistic security investigation across Office 365 mailboxes and Windows machines. +When you turn this feature on, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a comprehensive security investigation across Office 365 mailboxes and Windows machines. >[!NOTE] >You'll need to have the appropriate license to enable this feature. @@ -137,7 +140,7 @@ To receive contextual machine integration in Office 365 Threat Intelligence, you ## Microsoft Threat Experts -Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability, while experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it. +Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability. Experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it. >[!NOTE] >The Microsoft Threat Experts capability in Microsoft Defender ATP is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security). @@ -151,11 +154,11 @@ Enabling this setting forwards Microsoft Defender ATP signals to Microsoft Cloud ## Azure Information Protection -Turning this setting on forwards signals to Azure Information Protection, giving data owners and administrators visibility into protected data on onboarded machines and machine risk ratings. +Turning on this setting allows signals to be forwarded to Azure Information Protection. It gives data owners and administrators visibility into protected data on onboarded machines and machine risk ratings. ## Microsoft Intune connection -Microsoft Defender ATP can be integrated with [Microsoft Intune](https://docs.microsoft.com/intune/what-is-intune) to [enable device risk-based conditional access](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). When you [enable this feature](configure-conditional-access.md), you'll be able to share Microsoft Defender ATP device information with Intune, enhancing policy enforcement. +Microsoft Defender ATP can be integrated with [Microsoft Intune](https://docs.microsoft.com/intune/what-is-intune) to [enable device risk-based conditional access](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). When you [turn on this feature](configure-conditional-access.md), you'll be able to share Microsoft Defender ATP device information with Intune, enhancing policy enforcement. >[!IMPORTANT] >You'll need to enable the integration on both Intune and Microsoft Defender ATP to use this feature. For more information on specific steps, see [Configure Conditional Access in Microsoft Defender ATP](configure-conditional-access.md). @@ -176,7 +179,7 @@ When you enable Intune integration, Intune will automatically create a classic C Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience. -You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available. +You'll have access to upcoming features, which you can provide feedback on to help improve the overall experience before features are generally available. ## Enable advanced features From ac81be317a7e322ec485761b18c2c57be8877f25 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 9 Apr 2020 16:08:08 -0700 Subject: [PATCH 030/249] fix acro --- .../microsoft-defender-atp/alerts-queue.md | 38 ++++++++++++------- 1 file changed, 24 insertions(+), 14 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md index 6255da37f0..a039772386 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md @@ -21,11 +21,12 @@ ms.date: 03/27/2020 # View and organize the Microsoft Defender Advanced Threat Protection Alerts queue **Applies to:** + - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-alertsq-abovefoldlink) -The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view, with the most recent alerts showing at the top of the list, helping you see the most recent alerts first. +The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view. The most recent alerts are showed at the top of the list helping you see the most recent alerts first. >[!NOTE] >The alerts queue is significantly reduced with automated investigation and remediation, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. When an alert contains a supported entity for automated investigation (for example, a file) in a machine that has a supported operating system for it, an automated investigation and remediation can start. For more information on automated investigations, see [Overview of Automated investigations](automated-investigations.md). @@ -33,6 +34,7 @@ The **Alerts queue** shows a list of alerts that were flagged from machines in y There are several options you can choose from to customize the alerts queue view. On the top navigation you can: + - Select grouped view or list view - Customize columns to add or remove columns - Select the items to show per page @@ -42,32 +44,36 @@ On the top navigation you can: ![Image of alerts queue](images/alerts-queue-list.png) ## Sort, filter, and group the alerts queue + You can apply the following filters to limit the list of alerts and get a more focused view the alerts. ### Severity Alert severity | Description :---|:--- -High
(Red) | Alerts commonly seen associated with advanced persistent threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on machines. Some examples of these are credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary. +High
(Red) | Alerts commonly seen associated with advanced persistent threats (APT). These alerts indicate a high risk because of the severity of damage they can inflict on machines. Some examples are: credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary. Medium
(Orange) | Alerts from endpoint detection and response post-breach behaviors that might be a part of an advanced persistent threat (APT). This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth. Although some might be part of internal security testing, it requires investigation as it might also be a part of an advanced attack. -Low
(Yellow) | Alerts on threats associated with prevalent malware, hack-tools, non-malware hack tools, such as running exploration commands, clearing logs, etc., that often do not indicate an advanced threat targeting the organization. It could also come from an isolated security tool testing by a user in your organization. +Low
(Yellow) | Alerts on threats associated with prevalent malware. For example, hack-tools, non-malware hack tools, such as running exploration commands, clearing logs, etc., that often do not indicate an advanced threat targeting the organization. It could also come from an isolated security tool testing by a user in your organization. Informational
(Grey) | Alerts that might not be considered harmful to the network but can drive organizational security awareness on potential security issues. #### Understanding alert severity -It is important to understand that the Windows Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes. + +Windows Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes. The Windows Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected. The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization. So, for example: -- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred. + +- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage. - An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat. - An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High". -- Suspicious behavioral alerts which were not blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations. +- Suspicious behavioral alerts, which weren't blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations. #### Understanding alert categories -We've redefined the alert categories to align to the [enterprise attack tactics](https://attack.mitre.org/tactics/enterprise/) in the [MITRE ATT&CK matrix](https://attack.mitre.org/). New category names apply to all new alerts. Existing alerts will retain the previous category names. + +We've redefined the alert categories to align to the [enterprise attack tactics](https://attack.mitre.org/tactics/enterprise/) in the [MITRE ATT&CK matrix](https://attack.mitre.org/). New category names apply to all new alerts. Existing alerts will keep the previous category names. The table below lists the current categories and how they generally map to previous categories. @@ -92,39 +98,43 @@ The table below lists the current categories and how they generally map to previ ### Status + You can choose to limit the list of alerts based on their status. ### Investigation state + Corresponds to the automated investigation state. ### Category + You can choose to filter the queue to display specific types of malicious activity. ### Assigned to + You can choose between showing alerts that are assigned to you or automation. ### Detection source -Select the source that triggered the alert detection. Microsoft Threat Experts preview participants can now filter and see detections from the new threat experts managed hunting service. + +Select the source that triggered the alert detection. Microsoft Threat Experts preview participants can now filter and see detections from the new threat experts-managed hunting service. >[!NOTE] >The Windows Defender Antivirus filter will only appear if machines are using Windows Defender Antivirus as the default real-time protection antimalware product. ### OS platform + Limit the alerts queue view by selecting the OS platform that you're interested in investigating. ### Machine group -If you have specific machine groups that you're interested in checking the alerts on, you can select the groups to limit the alerts queue view to display just those machine groups. + +If you have specific machine groups that you're interested in checking, you can select the groups to limit the alerts queue view. ### Associated threat + Use this filter to focus on alerts that are related to high profile threats. You can see the full list of high-profile threats in [Threat analytics](threat-analytics.md). - - - - - ## Related topics + - [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) - [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) - [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) From c3fc7ad14302c8cdd7e65a647ed9b601fd43f543 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 9 Apr 2020 16:16:19 -0700 Subject: [PATCH 031/249] fixes --- .../microsoft-defender-atp/alerts.md | 7 +++--- .../microsoft-defender-atp/api-explorer.md | 22 ++++++++++++------- 2 files changed, 18 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts.md b/windows/security/threat-protection/microsoft-defender-atp/alerts.md index 62a32da91b..d0fa10c5e9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts.md @@ -23,6 +23,7 @@ ms.topic: article - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) ## Methods + Method |Return Type |Description :---|:---|:--- [Get alert](get-alert-info-by-id.md) | [Alert](alerts.md) | Get a single [alert](alerts.md) object. @@ -37,7 +38,8 @@ Method |Return Type |Description ## Properties -Property | Type | Description + +Property | Type | Description :---|:---|:--- id | String | Alert ID. title | String | Alert title. @@ -61,7 +63,6 @@ threatFamilyName | String | Threat family. machineId | String | ID of a [machine](machine.md) entity that is associated with the alert. comments | List of Alert comments | Alert Comment is an object that contains: comment string, createdBy string and createTime date time. - ### Response example for getting single alert: ``` @@ -73,7 +74,7 @@ GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-2929 "id": "da637084217856368682_-292920499", "incidentId": 66860, "investigationId": 4416234, - "investigationState": "Running", + "investigationState": "Running", "assignedTo": "secop@contoso.com", "severity": "Low", "status": "New", diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md index 7558960aa6..891d09df60 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md @@ -1,7 +1,7 @@ --- title: API Explorer in Microsoft Defender ATP ms.reviewer: -description: Use the API Explorer to construct and perform API queries, test and send requests for any available API +description: Use the API Explorer to construct and do API queries, test, and send requests for any available API keywords: api, explorer, send, request, get, post, search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -19,14 +19,16 @@ ms.topic: conceptual --- # API Explorer + **Applies to:** + - [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) The Microsoft Defender ATP API Explorer is a tool that helps you explore various Microsoft Defender ATP APIs interactively. -The API Explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint. You can also use the API Explorer to perform actions or find data that might not yet be available through the user interface. +The API Explorer makes it easy to construct and do API queries, test, and send requests for any available Microsoft Defender ATP API endpoint. Use the API Explorer to take actions or find data that might not yet be available through the user interface. -The tool is useful during app development because it allows you to perform API queries that respect your user access settings, reducing the need to generate access tokens. +The tool is useful during app development. It allows you to perform API queries that respect your user access settings, reducing the need to generate access tokens. You can also use the tool to explore the gallery of sample queries, copy result code samples, and generate debug information. @@ -34,26 +36,30 @@ With the API Explorer, you can: - Run requests for any method and see responses in real-time - Quickly browse through the API samples and learn what parameters they support -- Make API calls with ease; no need to authenticate beyond the management portal sign-in +- Make API calls with ease; no need to authenticate beyond the management portal sign in ## Access API Explorer + From the left navigation menu, select **Partners & APIs** > **API Explorer**. -## Supported APIs +## Supported APIs + API Explorer supports all the APIs offered by Microsoft Defender ATP. The list of supported APIs is available in the [APIs documentation](apis-intro.md). ## Get started with the API Explorer + 1. In the left pane, there is a list of sample requests that you can use. 2. Follow the links and click **Run query**. -Some of the samples may require specifying a parameter in the URL, for example, {machine- id}. +Some of the samples may require specifying a parameter in the URL, for example, {machine- ID}. ## FAQ + **Do I need to have an API token to use the API Explorer?**
-Credentials to access an API are not needed since the API Explorer uses the Microsoft Defender ATP management portal token whenever it makes a request. +Credentials to access an API aren't needed. The API Explorer uses the Microsoft Defender ATP management portal token whenever it makes a request. The logged-in user authentication credential is used to verify that the API Explorer is authorized to access data on your behalf. -Specific API requests are limited based on your RBAC privileges; for example, a request to "Submit indicator" is limited to the security admin role. +Specific API requests are limited based on your RBAC privileges. For example, a request to "Submit indicator" is limited to the security admin role. From 81b25acdc95ecf7024d3bf59c45d74bff20a6d91 Mon Sep 17 00:00:00 2001 From: Mati Goldberg Date: Fri, 10 Apr 2020 03:38:03 +0300 Subject: [PATCH 032/249] added missing endpoints --- .../microsoft-defender-atp/microsoft-defender-atp-mac.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md index a22b112426..fe71625482 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac.md @@ -74,9 +74,9 @@ The following table lists the services and their associated URLs that your netwo | Service location | DNS record | | ---------------------------------------- | ----------------------- | | Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
officecdn-microsoft-com.akamaized.net
crl.microsoft.com
events.data.microsoft.com | -| European Union | europe.x.cp.wd.microsoft.com
eu-v20.events.data.microsoft.com
usseu1northprod.blob.core.windows.net 
usseu1westprod.blob.core.windows.net | -| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
uk-v20.events.data.microsoft.com
ussuk1southprod.blob.core.windows.net 
ussuk1westprod.blob.core.windows.net | -| United States | unitedstates.x.cp.wd.microsoft.com
us-v20.events.data.microsoft.com
ussus1eastprod.blob.core.windows.net 
ussus1westprod.blob.core.windows.net | +| European Union | europe.x.cp.wd.microsoft.com
eu-v20.events.data.microsoft.com
usseu1northprod.blob.core.windows.net 
usseu1westprod.blob.core.windows.net
winatp-gw-weu.microsoft.com
winatp-gw-neu.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
uk-v20.events.data.microsoft.com
ussuk1southprod.blob.core.windows.net 
ussuk1westprod.blob.core.windows.net
winatp-gw-ukw.microsoft.com
winatp-gw-uks.microsoft.com | +| United States | unitedstates.x.cp.wd.microsoft.com
us-v20.events.data.microsoft.com
ussus1eastprod.blob.core.windows.net 
ussus1westprod.blob.core.windows.net
winatp-gw-cus.microsoft.com
winatp-gw-eus.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Proxy auto-config (PAC) From e50af964ee9e213780dd45077c28207851567df6 Mon Sep 17 00:00:00 2001 From: illfated Date: Sat, 11 Apr 2020 22:47:14 +0200 Subject: [PATCH 033/249] Applies to: Windows 10, Windows Server 2019 As per issue ticket #6441 (Supported windows versions are not valid), this article incorrectly lists both deprecated and outdated OS versions, both for Server and Client computers. The article itself states that this policy was introduced in Windows 10, version 1703. Thanks to yogeshasalkar for reporting this issue. Changes proposed: - Change the "Applies to" section to only Windows 10 and Server 2019 - Remove redundant end-of-line whitespace from 3 lines. Ticket closure or reference: Closes #6441 --- .../interactive-logon-dont-display-username-at-sign-in.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md index e1d64c8cfd..84ae5e963d 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md @@ -2,7 +2,7 @@ title: Interactive logon Don't display username at sign-in (Windows 10) description: Describes the best practices, location, values, and security considerations for the Interactive logon Don't display username at sign-in security policy setting. ms.assetid: 98b24b03-95fe-4edc-8e97-cbdaa8e314fd -ms.reviewer: +ms.reviewer: ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy @@ -20,9 +20,9 @@ ms.date: 04/19/2017 # Interactive logon: Don't display username at sign-in **Applies to** -- Windows Server 2003, Windows Vista, Windows XP, Windows Server 2008, Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012, Windows 8, Windows 10 +- Windows 10, Windows Server 2019 -Describes the best practices, location, values, and security considerations for the **Interactive logon: Don't display username at sign-in** security policy setting. +Describes the best practices, location, values, and security considerations for the **Interactive logon: Don't display username at sign-in** security policy setting. ## Reference @@ -56,7 +56,7 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Domain controller effective default settings | Not defined| | Member server effective default settings | Not defined| | Effective GPO default settings on client computers | Not defined| - + ## Policy management This section describes features and tools that are available to help you manage this policy. From adf14256505cd07c682a9a33fe2495e71513f73f Mon Sep 17 00:00:00 2001 From: illfated Date: Sun, 12 Apr 2020 19:28:29 +0200 Subject: [PATCH 034/249] Threat Protection/Auditing: event 4985 page link Description: As reported in issue ticket #6470 (Incorrect link), the current link named "4985(S): The state of a transaction has changed." links to Event "4674(S, F): An operation was attempted on a privileged object." This typo is a "no-brainer" and is likely the result of a copy-paste mistake or a mass conversion oversight, not a dedicated operation. Thanks to azupwn for pointing out this issue. Changes proposed: - Insert the correct event number 4985 in the link - Reduce markdown bullet list spacing from 3 to 1 under "Applies to" Ticket closure or reference: Closes #6470 --- .../auditing/audit-other-privilege-use-events.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md index e13d22c6e3..f6d870f605 100644 --- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md +++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md @@ -2,7 +2,7 @@ title: Audit Other Privilege Use Events (Windows 10) description: This security policy setting is not used. ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security @@ -17,8 +17,8 @@ ms.date: 04/19/2017 # Audit Other Privilege Use Events **Applies to** -- Windows 10 -- Windows Server 2016 +- Windows 10 +- Windows Server 2016 This auditing subcategory should not have any events in it, but for some reason Success auditing will enable generation of event 4985(S): The state of a transaction has changed. @@ -31,7 +31,7 @@ This auditing subcategory should not have any events in it, but for some reason **Events List:** -- [4985](event-4674.md)(S): The state of a transaction has changed. +- [4985](event-4985.md)(S): The state of a transaction has changed. From 6ff5a3b14fff6000e027ee1367616f8424aefd13 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 13 Apr 2020 07:48:09 +0500 Subject: [PATCH 035/249] Update hello-feature-pin-reset.md --- .../hello-for-business/hello-feature-pin-reset.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 0b01799ab2..bafa944498 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -43,18 +43,19 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se ### Connect Azure Active Directory with the PIN reset service -1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. +1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 2. After you log in, click **Accept** to give consent for the PIN reset service to access your account. ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) -3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. +3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 4. After you log in, click **Accept** to give consent for the PIN reset client to access your account. + +> [!NOTE] +> After you Accept the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN Reset applications are listed for your tenant. + ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) 5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. ![PIN reset service permissions page](images/pinreset/pin-reset-applications.png) ->[!NOTE] ->After you Accept the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN Reset applications are listed for your tenant. - ### Configure Windows devices to use PIN reset using Group Policy You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. @@ -70,7 +71,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 #### Create a PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account. 2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
``` @@ -86,7 +87,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 #### Assign the PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account. 2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. 3. In the device configuration profile, click **Assignments**. 4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. From f5034fb18403432c8045d522913f386827bfa5f7 Mon Sep 17 00:00:00 2001 From: Rick Munck <33725928+jmunck@users.noreply.github.com> Date: Mon, 13 Apr 2020 09:01:39 -0500 Subject: [PATCH 036/249] Update windows-security-baselines.md Updated links to the Blog and Community --- .../security/threat-protection/windows-security-baselines.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index 48bfb00d06..060257832a 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -64,7 +64,7 @@ The security baselines are included in the [Security Compliance Toolkit (SCT)](s ## Community -[![Microsoft Security Guidance Blog](images/community.png)](https://blogs.technet.microsoft.com/secguide/) +[![Microsoft Security Guidance Blog](images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bd-p/Security-Baselines) ## Related Videos @@ -76,6 +76,6 @@ You may also be interested in this msdn channel 9 video: - [Microsoft Endpoint Configuration Manager](https://www.microsoft.com/cloud-platform/system-center-configuration-manager) - [Operations Management Suite](https://www.microsoft.com/cloud-platform/operations-management-suite) - [Configuration Management for Nano Server](https://blogs.technet.microsoft.com/grouppolicy/2016/05/09/configuration-management-on-servers/) -- [Microsoft Security Guidance Blog](https://blogs.technet.microsoft.com/secguide/) +- [Microsoft Security Guidance Blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) - [Microsoft Security Compliance Toolkit Download](https://www.microsoft.com/download/details.aspx?id=55319) - [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=55319) From 3824cdf52c6576ccddbcfa53bab5a9822605fd11 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Mon, 13 Apr 2020 18:30:19 +0300 Subject: [PATCH 037/249] Update configure-endpoints-vdi.md Providing clarification on servicing non-persistent Master images with Defender ATP. --- .../configure-endpoints-vdi.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 449dd5010c..a7f11fde8f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -95,6 +95,29 @@ The following steps will guide you through onboarding VDI machines and will high 8. Use the search function by entering the machine name and select **Machine** as search type. +# Updating non-persistent virtual desktop infrastructure (VDI) images +- As a best practice, we recommend using offline servicing tools to patch golden/master images.
+For example, you can use the below commands to install an update while the image remains offline:
+DISM /Mount-image /ImageFile:"D:\Win10-1909.vhdx" /index:1 /MountDir:"C:\Temp\OfflineServicing"
+DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu"
+DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit
+ +For more information on DISM commands and offline servicing, please refer to the articles below:
+https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism
+https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14
+https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image
+ +- If offline servicing is not an a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health:
+1. After booting the master image for online servicing or patching, run the offboarding script to turn off the defender ATP sensor.
+2. Ensure the sensor is off by running 'sc query sense'.
+3. Service the image as needed.
+4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumelated since boot:
+*PsExec.exe -s cmd.exe*
+*cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber"*
+*del ``*.*`` /f /s /q*
+*exit*
+5. Re-seal the golden/master image as you normally would.
+ ## Related topics - [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) - [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) From 66987cd3f34fa3dbb60246654b31619c14f0f60b Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Mon, 13 Apr 2020 18:33:48 +0300 Subject: [PATCH 038/249] Update configure-endpoints-vdi.md Changing commands to italic text --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index a7f11fde8f..3b13abc972 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -98,9 +98,9 @@ The following steps will guide you through onboarding VDI machines and will high # Updating non-persistent virtual desktop infrastructure (VDI) images - As a best practice, we recommend using offline servicing tools to patch golden/master images.
For example, you can use the below commands to install an update while the image remains offline:
-DISM /Mount-image /ImageFile:"D:\Win10-1909.vhdx" /index:1 /MountDir:"C:\Temp\OfflineServicing"
-DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu"
-DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit
+*DISM /Mount-image /ImageFile:"D:\Win10-1909.vhdx" /index:1 /MountDir:"C:\Temp\OfflineServicing"*
+*DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu"*
+*DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit*
For more information on DISM commands and offline servicing, please refer to the articles below:
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism
From 31ec79e9c9418982d5d0f3b946dd206935e26ca9 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Mon, 13 Apr 2020 18:36:31 +0300 Subject: [PATCH 039/249] Update configure-endpoints-vdi.md Minor text changes --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 3b13abc972..2310049183 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -108,7 +108,9 @@ https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-image https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image
- If offline servicing is not an a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health:
-1. After booting the master image for online servicing or patching, run the offboarding script to turn off the defender ATP sensor.
+1. After booting the master image for online servicing or patching, run an offboarding script to turn off the defender ATP sensor.
+Refer to the article below for guidance on offboarding script:
+https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script#offboard-machines-using-a-local-script
2. Ensure the sensor is off by running 'sc query sense'.
3. Service the image as needed.
4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumelated since boot:
From 4de7b9e9349c552f1dbf810631c631849c64bd7b Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Mon, 13 Apr 2020 18:41:36 +0300 Subject: [PATCH 040/249] Update configure-endpoints-vdi.md fixed typo... should be "accumulated" instead of "accumelated" --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 2310049183..a8ea3f78e2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -113,7 +113,7 @@ Refer to the article below for guidance on offboarding script:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script#offboard-machines-using-a-local-script
2. Ensure the sensor is off by running 'sc query sense'.
3. Service the image as needed.
-4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumelated since boot:
+4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumulated since boot:
*PsExec.exe -s cmd.exe*
*cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber"*
*del ``*.*`` /f /s /q*
From 03fe9e3e855fdf7d534a241d07653a19b421a937 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 13 Apr 2020 10:24:22 -0700 Subject: [PATCH 041/249] Update windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index a8ea3f78e2..049359c4b1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -102,10 +102,10 @@ For example, you can use the below commands to install an update while the image *DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu"*
*DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit*
-For more information on DISM commands and offline servicing, please refer to the articles below:
-https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism
-https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14
-https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image
+For more information on DISM commands and offline servicing, please refer to the articles below: +- [Modify a Windows image using DISM](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism) +- [DISM Image Management Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14) +- [Reduce the Size of the Component Store in an Offline Windows Image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image) - If offline servicing is not an a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health:
1. After booting the master image for online servicing or patching, run an offboarding script to turn off the defender ATP sensor.
@@ -127,4 +127,3 @@ https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-de - [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) - [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) - From c0b24b332d9de75171c42411c3378bb34deeaba7 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 13 Apr 2020 10:24:30 -0700 Subject: [PATCH 042/249] Update windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../configure-endpoints-vdi.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 049359c4b1..1a18153408 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -107,18 +107,18 @@ For more information on DISM commands and offline servicing, please refer to the - [DISM Image Management Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14) - [Reduce the Size of the Component Store in an Offline Windows Image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image) -- If offline servicing is not an a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health:
+- If offline servicing is not a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health: 1. After booting the master image for online servicing or patching, run an offboarding script to turn off the defender ATP sensor.
-Refer to the article below for guidance on offboarding script:
-https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script#offboard-machines-using-a-local-script
-2. Ensure the sensor is off by running 'sc query sense'.
-3. Service the image as needed.
+Refer to the article below for guidance on using an offboarding script:
+https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script#offboard-machines-using-a-local-script +2. Ensure the sensor is off by running 'sc query sense'. +3. Service the image as needed. 4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumulated since boot:
*PsExec.exe -s cmd.exe*
*cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber"*
*del ``*.*`` /f /s /q*
-*exit*
-5. Re-seal the golden/master image as you normally would.
+*exit* +5. Re-seal the golden/master image as you normally would. ## Related topics - [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) @@ -126,4 +126,3 @@ https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-de - [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) - [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) - [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) - From 228b47e6c7d252cf654bd64cdd8f6b9051a12ce4 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 13 Apr 2020 10:30:09 -0700 Subject: [PATCH 043/249] Update configure-endpoints-vdi.md --- .../configure-endpoints-vdi.md | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 1a18153408..6f8288d1fa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -108,16 +108,22 @@ For more information on DISM commands and offline servicing, please refer to the - [Reduce the Size of the Component Store in an Offline Windows Image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image) - If offline servicing is not a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health: -1. After booting the master image for online servicing or patching, run an offboarding script to turn off the defender ATP sensor.
-Refer to the article below for guidance on using an offboarding script:
-https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script#offboard-machines-using-a-local-script + +1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](onfigure-endpoints-script.md#offboard-machines-using-a-local-script). + 2. Ensure the sensor is off by running 'sc query sense'. + 3. Service the image as needed. -4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumulated since boot:
-*PsExec.exe -s cmd.exe*
-*cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber"*
-*del ``*.*`` /f /s /q*
-*exit* + +4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumulated since boot: + +``` +PsExec.exe -s cmd.exe +cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber" +del ``*.*`` /f /s /q +exit +``` + 5. Re-seal the golden/master image as you normally would. ## Related topics From 957dd0686cb2b0a95114c7f73feb07e0185ba9ff Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 13 Apr 2020 10:30:51 -0700 Subject: [PATCH 044/249] Update configure-endpoints-vdi.md --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 6f8288d1fa..6735bd018b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -120,7 +120,7 @@ For more information on DISM commands and offline servicing, please refer to the ``` PsExec.exe -s cmd.exe cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber" -del ``*.*`` /f /s /q +del *.* /f /s /q exit ``` From ad8008fa5eb3188c0cbc1a6d0773fef405958a8a Mon Sep 17 00:00:00 2001 From: Rick Munck <33725928+jmunck@users.noreply.github.com> Date: Mon, 13 Apr 2020 12:55:21 -0500 Subject: [PATCH 045/249] Update windows/security/threat-protection/windows-security-baselines.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../security/threat-protection/windows-security-baselines.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index 060257832a..9520338818 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -75,7 +75,7 @@ You may also be interested in this msdn channel 9 video: - [Microsoft Endpoint Configuration Manager](https://www.microsoft.com/cloud-platform/system-center-configuration-manager) - [Operations Management Suite](https://www.microsoft.com/cloud-platform/operations-management-suite) -- [Configuration Management for Nano Server](https://blogs.technet.microsoft.com/grouppolicy/2016/05/09/configuration-management-on-servers/) +- [Configuration Management for Nano Server](https://docs.microsoft.com/archive/blogs/grouppolicy/configuration-management-on-servers/) - [Microsoft Security Guidance Blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) - [Microsoft Security Compliance Toolkit Download](https://www.microsoft.com/download/details.aspx?id=55319) - [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=55319) From ad0ff9739b45abee792295a7e77300b439480c75 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 13 Apr 2020 10:57:30 -0700 Subject: [PATCH 046/249] Update configure-endpoints-vdi.md --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 6735bd018b..37dc800e2e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -97,10 +97,13 @@ The following steps will guide you through onboarding VDI machines and will high # Updating non-persistent virtual desktop infrastructure (VDI) images - As a best practice, we recommend using offline servicing tools to patch golden/master images.
-For example, you can use the below commands to install an update while the image remains offline:
-*DISM /Mount-image /ImageFile:"D:\Win10-1909.vhdx" /index:1 /MountDir:"C:\Temp\OfflineServicing"*
-*DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu"*
-*DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit*
+For example, you can use the below commands to install an update while the image remains offline: + +``` +DISM /Mount-image /ImageFile:"D:\Win10-1909.vhdx" /index:1 /MountDir:"C:\Temp\OfflineServicing" +DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu" +DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit +``` For more information on DISM commands and offline servicing, please refer to the articles below: - [Modify a Windows image using DISM](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism) From 5af95cd6dae7c94e435f9de936eced6ec6b54e28 Mon Sep 17 00:00:00 2001 From: Rick Munck <33725928+jmunck@users.noreply.github.com> Date: Mon, 13 Apr 2020 13:16:39 -0500 Subject: [PATCH 047/249] Update windows/security/threat-protection/windows-security-baselines.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../security/threat-protection/windows-security-baselines.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index 9520338818..4ed9d4f9e8 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -73,8 +73,8 @@ You may also be interested in this msdn channel 9 video: ## See Also -- [Microsoft Endpoint Configuration Manager](https://www.microsoft.com/cloud-platform/system-center-configuration-manager) -- [Operations Management Suite](https://www.microsoft.com/cloud-platform/operations-management-suite) +- [Microsoft Endpoint Configuration Manager](https://www.microsoft.com/cloud-platform/system-center-configuration-manager) +- [Operations Management Suite](https://www.microsoft.com/cloud-platform/operations-management-suite) - [Configuration Management for Nano Server](https://docs.microsoft.com/archive/blogs/grouppolicy/configuration-management-on-servers/) - [Microsoft Security Guidance Blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) - [Microsoft Security Compliance Toolkit Download](https://www.microsoft.com/download/details.aspx?id=55319) From 12b713411d24bb0df9495cf532f6d0010c8d0914 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 13 Apr 2020 15:29:01 -0700 Subject: [PATCH 048/249] Update monitor-the-use-of-removable-storage-devices.md Removable storage note per CSS --- .../monitor-the-use-of-removable-storage-devices.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 18d2e3d8c2..870101a427 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/19/2017 +ms.date: --- # Monitor the use of removable storage devices @@ -28,7 +28,9 @@ If you configure this policy setting, an audit event is generated each time a us Use the following procedures to monitor the use of removable storage devices and to verify that the devices are being monitored. ->**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. +Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/en-us/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/en-us/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. **To configure settings to monitor removable storage devices** From 9696af861e0037f7125a4e61c2ba775130a2df88 Mon Sep 17 00:00:00 2001 From: Rona Song <38082753+qrscharmed@users.noreply.github.com> Date: Mon, 13 Apr 2020 15:54:09 -0700 Subject: [PATCH 049/249] Update reqs-wd-app-guard.md Removing: |Windows Defender Exploit Protection settings|The following settings should be configured or verified in the **Windows Security** app under **App & browser control** > **Exploit protection** > **Exploit protection settings** > **System Settings**.

**Control flow guard (CFG)** must be set to **Use default (On)** or **Off by default**. If set to **On by default**, [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard) will not launch.

**Randomize memory allocations (Bottom-up ASLR)** must be set to **Use default (On)** or **Off by default**. If set to "On by default", the `Vmmem` process will have high CPU utilization while a Windows Defender Application Guard window is open.| --- .../windows-defender-application-guard/reqs-wd-app-guard.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md index 5c81b7eb36..ca449ea92c 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md @@ -42,4 +42,3 @@ Your environment needs the following software to run Windows Defender Applicatio |Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with WDAG for Professional editions. | |Browser|Microsoft Edge and Internet Explorer| |Management system
(only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/)

**-OR-**

[Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| -|Windows Defender Exploit Protection settings|The following settings should be configured or verified in the **Windows Security** app under **App & browser control** > **Exploit protection** > **Exploit protection settings** > **System Settings**.

**Control flow guard (CFG)** must be set to **Use default (On)** or **Off by default**. If set to **On by default**, [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard) will not launch.

**Randomize memory allocations (Bottom-up ASLR)** must be set to **Use default (On)** or **Off by default**. If set to "On by default", the `Vmmem` process will have high CPU utilization while a Windows Defender Application Guard window is open.| From 61b0ffb053f509534fa61099a7b8ed8e69b2438d Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 13 Apr 2020 15:58:44 -0700 Subject: [PATCH 050/249] Update monitor-the-use-of-removable-storage-devices.md --- .../auditing/monitor-the-use-of-removable-storage-devices.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 870101a427..1188b932e6 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -30,7 +30,7 @@ Use the following procedures to monitor the use of removable storage devices and Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/en-us/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/en-us/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. +> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. **To configure settings to monitor removable storage devices** From 3eb8b1dc5ac1ddf29d5ed63e9d5e730f7c68847e Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:54:02 +0500 Subject: [PATCH 051/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index bafa944498..b5cb6203e0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -44,7 +44,7 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se ### Connect Azure Active Directory with the PIN reset service 1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. -2. After you log in, click **Accept** to give consent for the PIN reset service to access your account. +2. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) 3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 4. After you log in, click **Accept** to give consent for the PIN reset client to access your account. From 3c0c024c27c44b572bef3ea80f7688a6fef623d6 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:54:11 +0500 Subject: [PATCH 052/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index b5cb6203e0..6ce49e5f4d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -47,7 +47,7 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se 2. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) 3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. -4. After you log in, click **Accept** to give consent for the PIN reset client to access your account. +4. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. > [!NOTE] > After you Accept the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN Reset applications are listed for your tenant. From d211a61451a10d2ffa64a05abda1f8381154a34a Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:54:21 +0500 Subject: [PATCH 053/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 6ce49e5f4d..2e883b4615 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -50,7 +50,7 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se 4. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. > [!NOTE] -> After you Accept the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN Reset applications are listed for your tenant. +> After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) 5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. From 7c7e82f220c04ae50557338fac8a1a58a4b18ee2 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:54:31 +0500 Subject: [PATCH 054/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 2e883b4615..fbfd7364b8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -53,6 +53,7 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se > After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) + 5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. ![PIN reset service permissions page](images/pinreset/pin-reset-applications.png) From 2fdfd135a63923807bd712d3f7c510f82a31f72d Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:54:59 +0500 Subject: [PATCH 055/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index fbfd7364b8..571417baa2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -73,7 +73,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 #### Create a PIN Reset Device configuration profile using Microsoft Intune 1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account. -2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
+2. You need your tenant ID to complete the following task. You can discover your tenant ID by viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a Command window on any Azure AD-joined or hybrid Azure AD-joined computer.
``` dsregcmd /status | findstr -snip "tenantid" From 21018f240e1d84cc8149350228345ecd51a3d1e5 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:55:11 +0500 Subject: [PATCH 056/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 571417baa2..861ad26756 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -88,7 +88,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 #### Assign the PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account. +1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account. 2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. 3. In the device configuration profile, click **Assignments**. 4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. From 01ea39518a228d7971f4f48ed26b0cb5bc49d5b7 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:55:21 +0500 Subject: [PATCH 057/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 861ad26756..1b4d731ff0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -89,7 +89,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 #### Assign the PIN Reset Device configuration profile using Microsoft Intune 1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account. -2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. +2. Navigate to the Microsoft Intune blade. Choose **Device configuration** > **Profiles**. From the list of device configuration profiles, choose the profile that contains the PIN reset configuration. 3. In the device configuration profile, click **Assignments**. 4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. From 86d52111306692ed8771f378a6158dc1c7f587d4 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 16:55:32 +0500 Subject: [PATCH 058/249] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 1b4d731ff0..33a9c450e1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -90,7 +90,7 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account. 2. Navigate to the Microsoft Intune blade. Choose **Device configuration** > **Profiles**. From the list of device configuration profiles, choose the profile that contains the PIN reset configuration. -3. In the device configuration profile, click **Assignments**. +3. In the device configuration profile, select **Assignments**. 4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. ## On-premises Deployments From 150ca08574ae889962693682d7b684e757d9c77f Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 14 Apr 2020 17:55:00 +0500 Subject: [PATCH 059/249] Update hello-hybrid-aadj-sso-cert.md --- .../hello-hybrid-aadj-sso-cert.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 54f37c9b50..0aa1e47937 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -644,28 +644,28 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Select **Device Configuration**, and then click **Profiles**. 4. Select **Create Profile**. ![Intune Device Configuration Create Profile](images/aadjcert/intunedeviceconfigurationcreateprofile.png) -5. Next to **Name**, type **WHFB Certificate Enrollment**. -6. Next to **Description**, provide a description meaningful for your environment. -7. Select **Windows 10 and later** from the **Platform** list. -8. Select **SCEP certificate** from the **Profile** list. - ![WHFB Scep Profile Blade](images/aadjcert/intunewhfbscepprofile-00.png) -9. The **SCEP Certificate** blade should open. Configure **Certificate validity period** to match your organization. +5. Select **Windows 10 and later** from the **Platform** list. +6. Choose **SCEP certificate** from the **Profile** list, and select **Create**. +7. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. +8. Next to **Description**, provide a description meaningful for your environment, then select **Next**. +9. Select **User** as a certificate type. +10. Configure **Certificate validity period** to match your organization. > [!IMPORTANT] > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. -10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. -11. Select **Custom** from the **Subject name format** list. -12. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. -13. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value. -14. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. -15. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. +11. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. +12. Select **Custom** from the **Subject name format** list. +13. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. +14. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value. +15. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. +16. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. ![WHFB SCEP certificate profile Trusted Certificate selection](images/aadjcert/intunewhfbscepprofile-01.png) -16. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. -17. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. +17. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. +18. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. ![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) -18. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. -19. Click **OK**. -20. Click **Create**. +19. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. +20. Click **Next**. +21. Click **Next** two more times to skip **Scope tags** and **Assignments** steps of the wizard and click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. From ba64f0e083002d642abfa126d0c9ae5e05dc8631 Mon Sep 17 00:00:00 2001 From: Obi Eze Ajoku <62227226+linque1@users.noreply.github.com> Date: Tue, 14 Apr 2020 06:59:51 -0700 Subject: [PATCH 060/249] Fixed Warning line 43 > string --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 03b72907ac..eadc81def6 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -40,7 +40,7 @@ Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline] >Regarding the Windows Restricted Traffic Limited Functionality Baseline, the 1903 settings (folder) are applicable to 1909 Windows >Enterprise devices. There were no additional settings required for the 1909 release. >[!Warning] ->If a user executes the "Reset this PC" command (Settings -> Update & Security -> Recovery) with the "Keep my files" option (or the >"Remove Everything" option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order >re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline >settings. +>If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) From fc97842bd9dd03f94e829c1536fb3ab2cc1a001e Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 14 Apr 2020 10:29:11 -0700 Subject: [PATCH 061/249] Fixed the error in filename rules. Also added example. --- .../select-types-of-rules-to-create.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index c8e505e884..ab45f10ade 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -129,9 +129,9 @@ Wildcards can be used at the beginning or end of a path rule; only one wildcard ## Windows Defender Application Control filename rules -File name rule levels provide administrators to specify the file attributes off which to base a file name rule. File name rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Specification of the file name level occurs when creating new policy rules. In addition, to combine file name levels found in multiple policies, you can merge multiple policies. +File name rule levels provide administrators to specify the file attributes off which to base a file name rule. File name rules provide the same security guarantees that explicit signer rules do, as they are based on non-mutable file attributes. Specification of the file name level occurs when creating new policy rules. In addition, to combine file name levels found in multiple policies, you can merge multiple policies. -Use Table 3 to select the appropriate file name level for your available administrative resources and Windows Defender Application Control deployment scenario. +Use Table 3 to select the appropriate file name level for your available administrative resources and Windows Defender Application Control deployment scenario. For instance, an LOB or production application and its binaries (eg. DLLs) may all share the same product name. This allows users to easily create targeted policies based on the Product Name filename rule level. **Table 3. Windows Defender Application Control policy - filename levels** From 24e12f071f32b193227c49afada5d3828af82729 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Tue, 14 Apr 2020 13:02:00 -0700 Subject: [PATCH 062/249] Adding Autopilot to HoloLens Insider Preview page @scooley Since you drove the work / @Teresa-Motiv Since you wrote up the Autopilot doc Can one of you take a look at this for review and then signoff if it's good? Since the autopilot doc went live (yay!), I was considering adding more details onto the HoloLens Release preview notes. I was thinking mostly to update the email to instead go to the akams link we have there. As well as a small action about autopilot taken directly from the top of the autopilot page. I remember at some point someone being wary about having autopilot be a strongly featured on the Insider page because they were worried that everyone would think they could magically use it once they updated. This seemed odd to me, but now that the page is an very strong resource on setting it up and requirements I think it merits me adding it in. Unless anyone has any objections. FYI @yannisle --- devices/hololens/hololens-insider.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md index 60ac0094b5..109128cdd8 100644 --- a/devices/hololens/hololens-insider.md +++ b/devices/hololens/hololens-insider.md @@ -64,7 +64,7 @@ Here's a quick summary of what's new: - Support for FIDO2 Security Keys to enable secure and easy authentication for shared devices - Seamlessly apply a provisioning package from a USB drive to your HoloLens - Use a provisioning packages to enroll your HoloLens to your Mobile Device Management system -- Use Windows AutoPilot to set up and pre-configure new devices, quickly getting them ready for productive use. Send a note to hlappreview@microsoft.com to join the preview. +- Use Windows AutoPilot to set up and pre-configure new devices, quickly getting them ready for productive use. To participate in the program, you have to use a tenant that is flighted for HoloLens. To do this, go to [Windows Autopilot for HoloLens Private Preview request](https://aka.ms/APHoloLensTAP). - Dark Mode - HoloLens customers can now choose the default mode for apps that support both color schemes! Based on customer feedback, with this update we are setting the default app mode to "dark," but you can easily change this setting at any time. - Support for additional system voice commands - An updated Cortana app with a focus on productivity @@ -120,6 +120,19 @@ Here are some of the in-box apps that support Dark mode! - 3D Viewer - Movies & TV +### Windows Autopilot for HoloLens 2 + +This Autopilot program supports Autopilot self-deploying mode to provision HoloLens 2 devices as shared devices under your tenant. Self-deploying mode leverages the device's preinstalled OEM image and drivers during the provisioning process. A user can provision the device without putting the device on and going through the Out-of-the-box Experience (OOBE). + +When a user starts the Autopilot self-deploying process, the process completes the following steps: +1. Join the device to Azure Active Directory (Azure AD). +2. Use Azure AD to enroll the device in Microsoft Intune (or another MDM service). +3. Download the device-targeted policies, certificates, and networking profiles. +4. Provision the device. +5. Present the sign-in screen to the user. + +For full information on Autopilot please visit: [Windows Autopilot for HoloLens 2 evaluation guide](https://docs.microsoft.com/hololens/hololens2-autopilot) + ### FFU download and flash directions To test with a flight signed ffu, you first have to flight unlock your device prior to flashing the flight signed ffu. 1. On PC From 31496c76d172f543dac09971e9a52ac6952e6fb0 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Tue, 14 Apr 2020 13:51:27 -0700 Subject: [PATCH 063/249] Review --- devices/hololens/hololens-insider.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md index 109128cdd8..8951d206f9 100644 --- a/devices/hololens/hololens-insider.md +++ b/devices/hololens/hololens-insider.md @@ -11,7 +11,7 @@ ms.custom: - CSSTroubleshooting ms.localizationpriority: medium audience: ITPro -ms.date: 1/6/2020 +ms.date: 4/14/2020 ms.reviewer: manager: laurawi appliesto: @@ -64,7 +64,7 @@ Here's a quick summary of what's new: - Support for FIDO2 Security Keys to enable secure and easy authentication for shared devices - Seamlessly apply a provisioning package from a USB drive to your HoloLens - Use a provisioning packages to enroll your HoloLens to your Mobile Device Management system -- Use Windows AutoPilot to set up and pre-configure new devices, quickly getting them ready for productive use. To participate in the program, you have to use a tenant that is flighted for HoloLens. To do this, go to [Windows Autopilot for HoloLens Private Preview request](https://aka.ms/APHoloLensTAP). +- Use Windows Autopilot to set up and pre-configure new devices, quickly getting them ready for productive use. To participate in the program, you have to use a tenant that is flighted for HoloLens. To sign up for this program, see [Windows Autopilot for HoloLens Private Preview request](https://aka.ms/APHoloLensTAP). - Dark Mode - HoloLens customers can now choose the default mode for apps that support both color schemes! Based on customer feedback, with this update we are setting the default app mode to "dark," but you can easily change this setting at any time. - Support for additional system voice commands - An updated Cortana app with a focus on productivity @@ -131,7 +131,7 @@ When a user starts the Autopilot self-deploying process, the process completes t 4. Provision the device. 5. Present the sign-in screen to the user. -For full information on Autopilot please visit: [Windows Autopilot for HoloLens 2 evaluation guide](https://docs.microsoft.com/hololens/hololens2-autopilot) +For full information about Autopilot, see [Windows Autopilot for HoloLens 2 evaluation guide](hololens2-autopilot.md). ### FFU download and flash directions To test with a flight signed ffu, you first have to flight unlock your device prior to flashing the flight signed ffu. From fad867331a5379c4299ec858a52f51778364783c Mon Sep 17 00:00:00 2001 From: illfated Date: Tue, 14 Apr 2020 23:06:36 +0200 Subject: [PATCH 064/249] chore: Whitespace consistency & MD compatibility Description: - follow-up to my previous PR #6060 (chore: MarkDown Note marker compatibility spacing) Main directory: /browsers/ This is a follow-up attempt to standardize the MarkDown Note bubbles by adding the recommended single space after the quote marker. MarkDown codestyle & whitespace usage consistency is the main goal here. Additional proposed changes: - Remove redundant end-of-line (EOL) whitespace - Simplify blank space usage in bullet point lists/numbered lists to 1 - Replace some tab characters with 4 blank spaces (GitHub compatibility) - Reduce redundant blank line whitespace usage: - remove excessive blank lines between sections - remove surplus blank lines in minimal bullet point lists File-specific improvement change: browsers/edge/microsoft-edge-kiosk-mode-deploy.md - Add back missing table readability spacing and cell dividers. Ticket reference or closure: None that I know of (at least not yet). Additional notes: - I have split this modification chore into sub-folder sections to keep the number of files within a reasonably manageable amount. - Some of the whitespace changes could not be applied due to layout. --- browsers/edge/about-microsoft-edge.md | 10 +- .../group-policies/favorites-management-gp.md | 24 ++-- ...interoperability-enterprise-guidance-gp.md | 20 ++-- .../includes/configure-home-button-include.md | 21 ++-- .../configure-open-edge-with-include.md | 16 +-- .../includes/provision-favorites-include.md | 12 +- .../send-all-intranet-sites-ie-include.md | 18 +-- .../edge/microsoft-edge-kiosk-mode-deploy.md | 64 +++++------ browsers/edge/web-app-compat-toolkit.md | 16 +-- ...e-change-request-enterprise-mode-portal.md | 24 ++-- .../enterprise-mode-features-include.md | 7 +- ...-changes-preprod-enterprise-mode-portal.md | 18 +-- ...e-enterprise-mode-site-list-mgr-include.md | 6 +- ...eroperability-goals-enterprise-guidance.md | 5 +- ...e-change-request-enterprise-mode-portal.md | 25 ++-- ...-changes-preprod-enterprise-mode-portal.md | 18 +-- .../what-is-enterprise-mode.md | 20 ++-- .../ie11-faq/faq-ie11-blocker-toolkit.md | 108 +++++++++--------- browsers/internet-explorer/ie11-ieak/index.md | 8 +- .../licensing-version-and-features-ieak11.md | 14 +-- 20 files changed, 222 insertions(+), 232 deletions(-) diff --git a/browsers/edge/about-microsoft-edge.md b/browsers/edge/about-microsoft-edge.md index 5cd357aea7..e2453e5990 100644 --- a/browsers/edge/about-microsoft-edge.md +++ b/browsers/edge/about-microsoft-edge.md @@ -2,7 +2,7 @@ title: Microsoft Edge system and language requirements description: Overview information about Microsoft Edge, the default browser for Windows 10. This topic includes links to other Microsoft Edge topics. ms.assetid: 70377735-b2f9-4b0b-9658-4cf7c1d745bb -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.author: dansimp @@ -17,7 +17,7 @@ ms.date: 10/02/2018 --- # Microsoft Edge system and language requirements ->Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile +> Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile > [!NOTE] > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). @@ -25,8 +25,8 @@ ms.date: 10/02/2018 Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. ->[!IMPORTANT] ->The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don’t include Microsoft Edge or many other Universal Windows Platform (UWP) apps. Systems running the LTSB operating systems do not support these apps because their services get frequently updated with new functionality. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11. +> [!IMPORTANT] +> The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don’t include Microsoft Edge or many other Universal Windows Platform (UWP) apps. Systems running the LTSB operating systems do not support these apps because their services get frequently updated with new functionality. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11. ## Minimum system requirements @@ -49,7 +49,7 @@ Some of the components might also need additional system resources. Check the co ## Supported languages -Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. +Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. If the extension does not work after install, restart Microsoft Edge. If the extension still does not work, provide feedback through the Feedback Hub. diff --git a/browsers/edge/group-policies/favorites-management-gp.md b/browsers/edge/group-policies/favorites-management-gp.md index 9a022da181..c8584e28f5 100644 --- a/browsers/edge/group-policies/favorites-management-gp.md +++ b/browsers/edge/group-policies/favorites-management-gp.md @@ -1,43 +1,43 @@ --- title: Microsoft Edge - Favorites group policies description: Configure Microsoft Edge to either show or hide the favorites bar on all pages. Microsoft Edge hides the favorites bar by default but shows the favorites bar on the Start and New tab pages. Also, by default, the favorites bar toggle, in Settings, is set to Off but enabled allowing users to make changes. -services: -keywords: +services: +keywords: ms.localizationpriority: medium audience: itpro manager: dansimp author: dansimp ms.author: dansimp ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: ms.topic: reference ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library --- -# Favorites +# Favorites > [!NOTE] > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). -You can customize the favorites bar, for example, you can turn off features such as Save a Favorite and Import settings, and hide or show the favorites bar on all pages. Another customization you can make is provisioning a standard list of favorites, including folders, to appear in addition to the user’s favorites. If it’s important to keep the favorites in both IE11 and Microsoft Edge synced, you can turn on syncing where changes to the list of favorites in one browser reflect in the other. +You can customize the favorites bar, for example, you can turn off features such as Save a Favorite and Import settings, and hide or show the favorites bar on all pages. Another customization you can make is provisioning a standard list of favorites, including folders, to appear in addition to the user’s favorites. If it’s important to keep the favorites in both IE11 and Microsoft Edge synced, you can turn on syncing where changes to the list of favorites in one browser reflect in the other. ->[!TIP] ->You can find the Favorites under C:\\Users\\<_username_>\\Favorites. +> [!TIP] +> You can find the Favorites under C:\\Users\\<_username_>\\Favorites. You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy:       **Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\** -## Configure Favorites Bar +## Configure Favorites Bar [!INCLUDE [configure-favorites-bar-include](../includes/configure-favorites-bar-include.md)] -## Keep favorites in sync between Internet Explorer and Microsoft Edge -[!INCLUDE [keep-fav-sync-ie-edge-include](../includes/keep-fav-sync-ie-edge-include.md)] +## Keep favorites in sync between Internet Explorer and Microsoft Edge +[!INCLUDE [keep-fav-sync-ie-edge-include](../includes/keep-fav-sync-ie-edge-include.md)] ## Prevent changes to Favorites on Microsoft Edge -[!INCLUDE [prevent-changes-to-favorites-include](../includes/prevent-changes-to-favorites-include.md)] +[!INCLUDE [prevent-changes-to-favorites-include](../includes/prevent-changes-to-favorites-include.md)] -## Provision Favorites +## Provision Favorites [!INCLUDE [provision-favorites-include](../includes/provision-favorites-include.md)] diff --git a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md index f1a0929bb3..bd34273cc4 100644 --- a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md +++ b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md @@ -7,7 +7,7 @@ manager: dansimp ms.author: dansimp author: dansimp ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library @@ -21,11 +21,10 @@ ms.topic: reference Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. ->[!TIP] ->If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. - -**Technology not supported by Microsoft Edge** +> [!TIP] +> If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. +**Technology not supported by Microsoft Edge** - ActiveX controls @@ -39,20 +38,19 @@ Microsoft Edge is the default browser experience for Windows 10 and Windows 10 M - Legacy document modes -If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. +If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. ## Relevant group policies +1. [Configure the Enterprise Mode Site List](#configure-the-enterprise-mode-site-list) -1. [Configure the Enterprise Mode Site List](#configure-the-enterprise-mode-site-list) +2. [Send all intranet sites to Internet Explorer 11](#send-all-intranet-sites-to-internet-explorer-11) -2. [Send all intranet sites to Internet Explorer 11](#send-all-intranet-sites-to-internet-explorer-11) +3. [Show message when opening sites in Internet Explorer](#show-message-when-opening-sites-in-internet-explorer) -3. [Show message when opening sites in Internet Explorer](#show-message-when-opening-sites-in-internet-explorer) - -4. [(IE11 policy) Send all sites not included in the Enterprise Mode Site List to Microsoft Edge](#ie11-policy-send-all-sites-not-included-in-the-enterprise-mode-site-list-to-microsoft-edge) +4. [(IE11 policy) Send all sites not included in the Enterprise Mode Site List to Microsoft Edge](#ie11-policy-send-all-sites-not-included-in-the-enterprise-mode-site-list-to-microsoft-edge) You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: diff --git a/browsers/edge/includes/configure-home-button-include.md b/browsers/edge/includes/configure-home-button-include.md index 3082d3014b..24d2cadb77 100644 --- a/browsers/edge/includes/configure-home-button-include.md +++ b/browsers/edge/includes/configure-home-button-include.md @@ -2,15 +2,15 @@ author: eavena ms.author: eravena ms.date: 10/28/2018 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.prod: edge ms.topic: include --- - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Show home button and load the Start page)* + +> *Supported versions: Microsoft Edge on Windows 10, version 1809*
+> *Default setting: Disabled or not configured (Show home button and load the Start page)* [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] @@ -28,9 +28,8 @@ ms.topic: include --- ->[!TIP] ->If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
- +> [!TIP] +> If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
### ADMX info and settings #### ADMX info @@ -43,19 +42,17 @@ ms.topic: include #### MDM settings - **MDM name:** Browser/[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) - **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton - **Data type:** Integer #### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings - **Value name:** ConfigureHomeButton - **Value type:** REG_DWORD ### Related policies - [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] - -- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] - +- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)]
diff --git a/browsers/edge/includes/configure-open-edge-with-include.md b/browsers/edge/includes/configure-open-edge-with-include.md index a86cf568ce..ab0140e30c 100644 --- a/browsers/edge/includes/configure-open-edge-with-include.md +++ b/browsers/edge/includes/configure-open-edge-with-include.md @@ -2,7 +2,7 @@ author: eavena ms.author: eravena ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.prod: edge ms.topic: include @@ -10,8 +10,8 @@ ms.topic: include ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled (A specific page or pages)* +> *Supported versions: Microsoft Edge on Windows 10, version 1809*
+> *Default setting: Enabled (A specific page or pages)* [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] @@ -31,10 +31,8 @@ ms.topic: include --- - ->[!TIP] ->If you want to make changes to this policy:
  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
- +> [!TIP] +> If you want to make changes to this policy:
  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
### ADMX info and settings @@ -58,11 +56,7 @@ ms.topic: include ### Related policies - [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] - - [Disable lockdown of Start pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] - - - --- diff --git a/browsers/edge/includes/provision-favorites-include.md b/browsers/edge/includes/provision-favorites-include.md index fdb0016715..5ec37da07a 100644 --- a/browsers/edge/includes/provision-favorites-include.md +++ b/browsers/edge/includes/provision-favorites-include.md @@ -2,21 +2,21 @@ author: eavena ms.author: eravena ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.prod: edge ms.topic: include --- ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Disabled or not configured (Customizable)* +> *Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+> *Default setting: Disabled or not configured (Customizable)* [!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] ->[!IMPORTANT] ->Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. +> [!IMPORTANT] +> Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. ### Supported values @@ -38,7 +38,7 @@ ms.topic: include #### MDM settings - **MDM name:** Browser/[ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) - **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites - **Data type:** String #### Registry settings diff --git a/browsers/edge/includes/send-all-intranet-sites-ie-include.md b/browsers/edge/includes/send-all-intranet-sites-ie-include.md index 2d8195f03e..b59221443f 100644 --- a/browsers/edge/includes/send-all-intranet-sites-ie-include.md +++ b/browsers/edge/includes/send-all-intranet-sites-ie-include.md @@ -2,20 +2,20 @@ author: eavena ms.author: eravena ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.prod: edge ms.topic: include --- ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled or not configured* +> *Supported versions: Microsoft Edge on Windows 10*
+> *Default setting: Disabled or not configured* -[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] +[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] ->[!TIP] ->Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. +> [!TIP] +> Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. ### Supported values @@ -30,7 +30,7 @@ ms.topic: include ### ADMX info and settings #### ADMX info -- **GP English name:** Send all intranet sites to Internet Explorer 11 +- **GP English name:** Send all intranet sites to Internet Explorer 11 - **GP name:** SendIntranetTraffictoInternetExplorer - **GP path:** Windows Components/Microsoft Edge - **GP ADMX file name:** MicrosoftEdge.admx @@ -38,7 +38,7 @@ ms.topic: include #### MDM settings - **MDM name:** Browser/[SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) - **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer - **Data type:** Integer #### Registry settings @@ -53,7 +53,7 @@ ms.topic: include ### Related topics -- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. +- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. - [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). Learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. diff --git a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md index c4141688d8..8249262926 100644 --- a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md +++ b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md @@ -1,8 +1,8 @@ --- title: Deploy Microsoft Edge Legacy kiosk mode description: Microsoft Edge Legacy kiosk mode works with assigned access to allow IT admins to create a tailored browsing experience designed for kiosk devices. To use Microsoft Edge Legacy kiosk mode, you must configure Microsoft Edge Legacy as an application in assigned access. -ms.assetid: -ms.reviewer: +ms.assetid: +ms.reviewer: audience: itpro manager: dansimp author: dansimp @@ -16,28 +16,28 @@ ms.date: 01/17/2020 # Deploy Microsoft Edge Legacy kiosk mode ->Applies to: Microsoft Edge Legacy (version 45 and earlier) on Windows 10, version 1809 or later ->Professional, Enterprise, and Education +> Applies to: Microsoft Edge Legacy (version 45 and earlier) on Windows 10, version 1809 or later +> Professional, Enterprise, and Education > [!NOTE] > You've reached the documentation for Microsoft Edge Legacy (version 45 and earlier.) To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). For information about kiosk mode in the new version of Microsoft Edge, see [Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-kiosk-mode). In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge Legacy as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge Legacy in kiosk mode. -In this topic, you'll learn: +In this topic, you'll learn: - How to configure the behavior of Microsoft Edge Legacy when it's running in kiosk mode with assigned access. -- What's required to run Microsoft Edge Legacy kiosk mode on your kiosk devices. -- You'll also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or an other MDM service. +- What's required to run Microsoft Edge Legacy kiosk mode on your kiosk devices. +- You'll also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or an other MDM service. -At the end of this topic, you can find a list of [supported policies](#supported-policies-for-kiosk-mode) for kiosk mode and a [feature comparison](#feature-comparison-of-kiosk-mode-and-kiosk-browser-app) of the kiosk mode policy and kiosk browser app. You also find instructions on how to provide us feedback or get support. +At the end of this topic, you can find a list of [supported policies](#supported-policies-for-kiosk-mode) for kiosk mode and a [feature comparison](#feature-comparison-of-kiosk-mode-and-kiosk-browser-app) of the kiosk mode policy and kiosk browser app. You also find instructions on how to provide us feedback or get support. ## Kiosk mode configuration types ->**Policy** = Configure kiosk mode (ConfigureKioskMode) +> **Policy** = Configure kiosk mode (ConfigureKioskMode) -Microsoft Edge Legacy kiosk mode supports four configurations types that depend on how Microsoft Edge Legacy is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. +Microsoft Edge Legacy kiosk mode supports four configurations types that depend on how Microsoft Edge Legacy is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. - Learn about [creating a kiosk experience](https://docs.microsoft.com/windows-hardware/customize/enterprise/create-a-kiosk-image) @@ -50,9 +50,9 @@ Microsoft Edge Legacy kiosk mode supports four configurations types that depend ### Important things to note before getting started -- There are [required steps to follow](#setup- required-for-microsoft-edge-legacy-kiosk-mode) in order to use the following Microsoft Edge Legacy kiosk mode types either alongside the new version of Microsoft Edge or prevent the new version of Microsoft Edge from being installed on your kiosk device. +- There are [required steps to follow](#setup- required-for-microsoft-edge-legacy-kiosk-mode) in order to use the following Microsoft Edge Legacy kiosk mode types either alongside the new version of Microsoft Edge or prevent the new version of Microsoft Edge from being installed on your kiosk device. -- The public browsing kiosk types run Microsoft Edge Legacy InPrivate mode to protect user data with a browsing experience designed for public kiosks. +- The public browsing kiosk types run Microsoft Edge Legacy InPrivate mode to protect user data with a browsing experience designed for public kiosks. - Microsoft Edge Legacy kiosk mode has a built-in timer to help keep data safe in public browsing sessions. When the idle time (no user activity) meets the time limit, a confirmation message prompts the user to continue, and if no user activity Microsoft Edge Legacy resets the session to the default URL. By default, the idle timer is 5 minutes, but you can choose a value of your own. @@ -67,7 +67,7 @@ Microsoft Edge Legacy kiosk mode supports four configurations types that depend - [Guidelines for choosing an app for assigned access (kiosk mode)](https://aka.ms/Ul7dw3). -### Supported configuration types +### Supported configuration types [!INCLUDE [configure-kiosk-mode-supported-values-include](includes/configure-kiosk-mode-supported-values-include.md)] @@ -75,9 +75,9 @@ Microsoft Edge Legacy kiosk mode supports four configurations types that depend Now that you're familiar with the different kiosk mode configurations and have the one you want to use in mind, you can use one of the following methods to set up Microsoft Edge Legacy kiosk mode: -- **Windows Settings.** Use only to set up a couple of single-app devices because you perform these steps physically on each device. For a multi-app kiosk device, use Microsoft Intune or other MDM service. +- **Windows Settings.** Use only to set up a couple of single-app devices because you perform these steps physically on each device. For a multi-app kiosk device, use Microsoft Intune or other MDM service. -- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge Legacy kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). +- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge Legacy kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). ### Prerequisites @@ -89,14 +89,14 @@ Now that you're familiar with the different kiosk mode configurations and have t - URL to load when the kiosk launches. The URL that you provide sets the Home button, Start page, and New Tab page. - _**For Microsoft Intune or other MDM service**_, you must have the AppUserModelID (AUMID) to set up Microsoft Edge Legacy: - + ``` Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge ``` ### Setup required for Microsoft Edge Legacy kiosk mode -When the new version of Microsoft Edge Stable channel is installed, Microsoft Edge Legacy is hidden and all attempts to launch Microsoft Edge Legacy are redirected to the new version of Microsoft Edge. +When the new version of Microsoft Edge Stable channel is installed, Microsoft Edge Legacy is hidden and all attempts to launch Microsoft Edge Legacy are redirected to the new version of Microsoft Edge. To continue using Microsoft Edge Legacy kiosk mode on your kiosk devices take one of the following actions: @@ -104,11 +104,11 @@ To continue using Microsoft Edge Legacy kiosk mode on your kiosk devices take on - To prevent Microsoft Edge Stable channel from being installed on your kiosk devices deploy the Microsoft Edge [Allow installation default](https://docs.microsoft.com/DeployEdge/microsoft-edge-update-policies#installdefault) policy for Stable channel or consider using the [Blocker toolkit](https://docs.microsoft.com/DeployEdge/microsoft-edge-blocker-toolkit) to disable automatic delivery of Microsoft Edge. > [!NOTE] -> For more information about accessing Microsoft Edge Legacy after installing Microsoft Edge, see [How to access the old version of Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-sysupdate-access-old-edge). +> For more information about accessing Microsoft Edge Legacy after installing Microsoft Edge, see [How to access the old version of Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-sysupdate-access-old-edge). ### Use Windows Settings -Windows Settings is the simplest and the only way to set up one or a couple of single-app devices. +Windows Settings is the simplest and the only way to set up one or a couple of single-app devices. 1. On the kiosk device, open Windows Settings, and in the search field type **kiosk** and then select **Set up a kiosk (assigned access)**. @@ -120,9 +120,9 @@ Windows Settings is the simplest and the only way to set up one or a couple of s 5. Select how Microsoft Edge Legacy displays when running in kiosk mode: - - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge Legacy InPrivate protecting user data. + - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge Legacy InPrivate protecting user data. - - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge Legacy, protecting user data. + - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge Legacy, protecting user data. 6. Select **Next**. @@ -136,23 +136,23 @@ Windows Settings is the simplest and the only way to set up one or a couple of s 11. Restart the kiosk device and sign in with the local kiosk account to validate the configuration. -**_Congratulations!_**

You’ve just finished setting up a single-app kiosk device using Windows Settings. +**_Congratulations!_**

You’ve just finished setting up a single-app kiosk device using Windows Settings. -**_What's next?_** +**_What's next?_** - User your new kiosk device.

OR

- Make changes to your kiosk device. In Windows Settings, on the **Set up a kiosk** page, make your changes to **Choose a kiosk mode** and **Set up Microsoft Edge Legacy**. ---- +--- ### Use Microsoft Intune or other MDM service With this method, you can use Microsoft Intune or other MDM services to configure Microsoft Edge Legacy kiosk mode in assigned access and how it behaves on a kiosk device. To learn about a few app fundamentals and requirements before adding them to Intune, see [Add apps to Microsoft Intune](https://docs.microsoft.com/intune/apps-add). ->[!IMPORTANT] ->If you are using a local account as a kiosk account in Microsoft Intune, make sure to sign into this account and then sign out before configuring the kiosk device. +> [!IMPORTANT] +> If you are using a local account as a kiosk account in Microsoft Intune, make sure to sign into this account and then sign out before configuring the kiosk device. 1. In Microsoft Intune or other MDM service, configure [AssignedAccess](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to prevent users from accessing the file system, running executables, or other apps. @@ -166,7 +166,7 @@ With this method, you can use Microsoft Intune or other MDM services to configur | **[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)**

![](images/icon-thin-line-computer.png) | Configure how the Home Button behaves.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton

**Data type:** Integer

**Allowed values:**

  • **0 (default)** - Not configured. Show home button, and load the default Start page.
  • **1** - Enabled. Show home button and load New Tab page
  • **2** - Enabled. Show home button & set a specific page.
  • **3** - Enabled. Hide the home button.
| | **[SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)**

![](images/icon-thin-line-computer.png) | If you set ConfigureHomeButton to 2, configure the home button URL.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.bing.com | | **[SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)**

![](images/icon-thin-line-computer.png) | Set a custom URL for the New Tab page.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.msn.com | - + **_Congratulations!_**

You’ve just finished setting up a kiosk or digital signage with policies for Microsoft Edge Legacy kiosk mode using Microsoft Intune or other MDM service. @@ -177,7 +177,7 @@ With this method, you can use Microsoft Intune or other MDM services to configur ## Supported policies for kiosk mode -Use any of the Microsoft Edge Legacy policies listed below to enhance the kiosk experience depending on the Microsoft Edge Legacy kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). +Use any of the Microsoft Edge Legacy policies listed below to enhance the kiosk experience depending on the Microsoft Edge Legacy kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). Make sure to check with your provider for instructions. @@ -251,18 +251,18 @@ Make sure to check with your provider for instructions.        ![Not supported](images/148766.png) = Not applicable or not supported
       ![Supported](images/148767.png) = Supported ---- +--- ## Feature comparison of kiosk mode and kiosk browser app In the following table, we show you the features available in both Microsoft Edge Legacy kiosk mode and Kiosk Browser app available in Microsoft Store. Both kiosk mode and kiosk browser app work in assigned access. -| **Feature** | **Microsoft Edge Legacy kiosk mode** | **Microsoft Kiosk browser app** | +| **Feature** | **Microsoft Edge Legacy kiosk mode** | **Microsoft Kiosk browser app** | |-----------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------:| | Print support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | | Multi-tab support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Allow/Block URL support | ![Not Supported](images/148766.png) ![Supported](images/148767.png) | +| Allow/Block URL support | ![Not Supported](images/148766.png) | ![Supported](images/148767.png) | | Configure Home Button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | | Set Start page(s) URL | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*Same as Home button URL* | | Set New Tab page URL | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | @@ -280,6 +280,6 @@ To prevent access to unwanted websites on your kiosk device, use Windows Defende ## Provide feedback or get support -To provide feedback on Microsoft Edge Legacy kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. +To provide feedback on Microsoft Edge Legacy kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. **_For multi-app kiosk only._** If you have set up the Feedback Hub in assigned access, you can you submit the feedback from the device running Microsoft Edge in kiosk mode in which you can include diagnostic logs. In the Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. diff --git a/browsers/edge/web-app-compat-toolkit.md b/browsers/edge/web-app-compat-toolkit.md index 8ec157e607..00e7a02d51 100644 --- a/browsers/edge/web-app-compat-toolkit.md +++ b/browsers/edge/web-app-compat-toolkit.md @@ -1,6 +1,6 @@ --- title: Web Application Compatibility lab kit -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp description: Learn how to use the web application compatibility toolkit for Microsoft Edge. @@ -14,7 +14,7 @@ ms.localizationpriority: high # Web Application Compatibility lab kit ->Updated: October, 2017 +> Updated: October, 2017 Upgrading web applications to modern standards is the best long-term solution to ensure compatibility with today’s web browsers, but using backward compatibility can save time and money. Internet Explorer 11 has features that can ease your browser and operating system upgrades, reducing web application testing and remediation costs. On Windows 10, you can standardize on Microsoft Edge for faster, safer browsing and fall back to Internet Explorer 11 just for sites that need backward compatibility. @@ -22,7 +22,7 @@ The Web Application Compatibility Lab Kit is a primer for the features and techn The Web Application Compatibility Lab Kit includes: -- A pre-configured Windows 7 and Windows 10 virtual lab environment with: +- A pre-configured Windows 7 and Windows 10 virtual lab environment with: - Windows 7 Enterprise Evaluation - Windows 10 Enterprise Evaluation (version 1607) - Enterprise Mode Site List Manager @@ -36,10 +36,10 @@ Depending on your environment, your web apps may "just work” using the methods There are two versions of the lab kit available: -- Full version (8 GB) - includes a complete virtual lab environment +- Full version (8 GB) - includes a complete virtual lab environment - Lite version (400 MB) - includes guidance for running the Lab Kit on your own Windows 7 or Windows 10 operating system -The Web Application Compatibility Lab Kit is also available in the following languages: +The Web Application Compatibility Lab Kit is also available in the following languages: - Chinese (Simplified) - Chinese (Traditional) @@ -48,11 +48,11 @@ The Web Application Compatibility Lab Kit is also available in the following lan - Italian - Japanese - Korean -- Portuguese (Brazil) +- Portuguese (Brazil) - Russian - Spanish [DOWNLOAD THE LAB KIT](https://www.microsoft.com/evalcenter/evaluate-windows-10-web-application-compatibility-lab) ->[!TIP] ->Please use a broad bandwidth to download this content to enhance your downloading experience. Lab environment requires 8 GB of available memory and 100 GB of free disk space. +> [!TIP] +> Please use a broad bandwidth to download this content to enhance your downloading experience. Lab environment requires 8 GB of available memory and 100 GB of free disk space. diff --git a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md index cbfc5f11b5..8f33595d7e 100644 --- a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md @@ -8,7 +8,7 @@ ms.prod: ie11 title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp --- @@ -17,16 +17,16 @@ ms.author: dansimp **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) Employees assigned to the Requester role can create a change request. A change request is used to tell the Approvers and the Administrator that a website needs to be added or removed from the Enterprise Mode Site List. The employee can navigate to each stage of the process by using the workflow links provided at the top of each page of the portal. ->[!Important] ->Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. +> [!Important] +> Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. **To create a new change request** 1. The Requester (an employee that has been assigned the Requester role) signs into the Enterprise Mode Site List Portal, and clicks **Create new request**. @@ -36,7 +36,7 @@ Employees assigned to the Requester role can create a change request. A change r 2. Fill out the required fields, based on the group and the app, including: - **Group name.** Select the name of your group from the dropdown box. - + - **App name.** Type the name of the app you want to add, delete, or update in the Enterprise Mode Site List. - **Search all apps.** If you can't remember the name of your app, you can click **Search all apps** and search the list. @@ -58,15 +58,15 @@ Employees assigned to the Requester role can create a change request. A change r - **App best viewed in.** Select the best browser experience for the app. This can be Internet Explorer 5 through Internet Explorer 11 or one of the IE7Enterprise or IE8Enterprise modes. - **Is an x-ua tag used?** Select **Yes** or **No** whether an x-ua-compatible tag is used by the app. For more info about x-ua-compatible tags, see the topics in [Defining document compatibility](https://msdn.microsoft.com/library/cc288325(v=vs.85).aspx). - + 4. Click **Save and continue** to save the request and get the app info sent to the pre-production environment site list for testing. - + A message appears that the request was successful, including a **Request ID** number, saying that the change is being made to the pre-production environment site list. 5. The Requester gets an email with a batch script, that when run, configures their test machine for the pre-production environment, along with the necessary steps to make sure the changed info is correct. - **If the change is correct.** The Requester asks the approvers to approve the change request by selecting **Successful** and clicking **Send for approval**. - + - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. ## Next steps diff --git a/browsers/enterprise-mode/enterprise-mode-features-include.md b/browsers/enterprise-mode/enterprise-mode-features-include.md index 8090fc9ba8..9da0e79778 100644 --- a/browsers/enterprise-mode/enterprise-mode-features-include.md +++ b/browsers/enterprise-mode/enterprise-mode-features-include.md @@ -1,4 +1,5 @@ ### Enterprise Mode features + Enterprise Mode includes the following features: - **Improved web app and website compatibility.** Through improved emulation, Enterprise Mode lets many legacy web apps run unmodified on IE11, supporting several site patterns that aren’t currently supported by existing document modes. @@ -8,9 +9,9 @@ Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microso - **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools. - >[!Important] - >All centrally-made decisions override any locally-made choices. + > [!Important] + > All centrally-made decisions override any locally-made choices. - **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites. -- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. \ No newline at end of file +- **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. diff --git a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md b/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md index a72f720a3f..3e06b8b806 100644 --- a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md @@ -8,7 +8,7 @@ ms.prod: ie11 title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp --- @@ -17,18 +17,18 @@ ms.author: dansimp **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) ->[!Important] ->This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. +> [!Important] +> This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. The Requester successfully submits a change request to the Enterprise Mode Site List Portal and then gets an email, including: -- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. +- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. - **Test steps**. The suggested steps about how to test the change request details to make sure they're accurate in the pre-production environment. diff --git a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md index 22464cc569..0b86c29226 100644 --- a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md +++ b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md @@ -2,7 +2,7 @@ author: eavena ms.author: eravena ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.prod: edge ms.topic: include @@ -10,8 +10,8 @@ ms.topic: include If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. ->[!IMPORTANT] ->Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. +> [!IMPORTANT] +> Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. 1. In the Enterprise Mode Site List Manager, click **File \> Import**. diff --git a/browsers/includes/interoperability-goals-enterprise-guidance.md b/browsers/includes/interoperability-goals-enterprise-guidance.md index 04470d33af..407e07bf91 100644 --- a/browsers/includes/interoperability-goals-enterprise-guidance.md +++ b/browsers/includes/interoperability-goals-enterprise-guidance.md @@ -26,8 +26,8 @@ You must continue using IE11 if web apps use any of the following: If you have uninstalled IE11, you can download it from the Microsoft Store or the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. ->[!TIP] ->If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=620714). +> [!TIP] +> If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=620714). |Technology |Why it existed |Why we don't need it anymore | @@ -38,4 +38,3 @@ If you have uninstalled IE11, you can download it from the Microsoft Store or th --- - diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md index d15192b9d3..6c1a210e27 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md @@ -8,7 +8,7 @@ ms.prod: ie11 title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.author: dansimp @@ -18,16 +18,16 @@ ms.author: dansimp **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) Employees assigned to the Requester role can create a change request. A change request is used to tell the Approvers and the Administrator that a website needs to be added or removed from the Enterprise Mode Site List. The employee can navigate to each stage of the process by using the workflow links provided at the top of each page of the portal. ->[!Important] ->Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. +> [!Important] +> Each Requester must have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. **To create a new change request** 1. The Requester (an employee that has been assigned the Requester role) signs into the Enterprise Mode Site List Portal, and clicks **Create new request**. @@ -37,7 +37,7 @@ Employees assigned to the Requester role can create a change request. A change r 2. Fill out the required fields, based on the group and the app, including: - **Group name.** Select the name of your group from the dropdown box. - + - **App name.** Type the name of the app you want to add, delete, or update in the Enterprise Mode Site List. - **Search all apps.** If you can't remember the name of your app, you can click **Search all apps** and search the list. @@ -59,16 +59,17 @@ Employees assigned to the Requester role can create a change request. A change r - **App best viewed in.** Select the best browser experience for the app. This can be Internet Explorer 5 through Internet Explorer 11 or one of the IE7Enterprise or IE8Enterprise modes. - **Is an x-ua tag used?** Select **Yes** or **No** whether an x-ua-compatible tag is used by the app. For more info about x-ua-compatible tags, see the topics in [Defining document compatibility](https://msdn.microsoft.com/library/cc288325(v=vs.85).aspx). - + 4. Click **Save and continue** to save the request and get the app info sent to the pre-production environment site list for testing. - + A message appears that the request was successful, including a **Request ID** number, saying that the change is being made to the pre-production environment site list. 5. The Requester gets an email with a batch script, that when run, configures their test machine for the pre-production environment, along with the necessary steps to make sure the changed info is correct. - **If the change is correct.** The Requester asks the approvers to approve the change request by selecting **Successful** and clicking **Send for approval**. - + - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. ## Next steps + After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md index 8a161b2ffb..a3fce1731d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md @@ -8,7 +8,7 @@ ms.prod: ie11 title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.author: dansimp @@ -18,18 +18,18 @@ ms.author: dansimp **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) ->[!Important] ->This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. +> [!Important] +> This step requires that each Requester have access to a test machine with Administrator rights, letting him or her get to the pre-production environment to make sure that the requested change is correct. The Requester successfully submits a change request to the Enterprise Mode Site List Portal and then gets an email, including: -- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. +- **EMIE_RegKey**. A batch file that when run, sets the registry key to point to the local pre-production Enterprise Mode Site List. - **Test steps**. The suggested steps about how to test the change request details to make sure they're accurate in the pre-production environment. diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md index da309b68cd..1a2c6fc17a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md @@ -20,11 +20,11 @@ ms.date: 10/25/2018 **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) Internet Explorer and Microsoft Edge can work together to support your legacy web apps, while still defaulting to the higher bar for security and modern experiences enabled by Microsoft Edge. Working with multiple browsers can be difficult, particularly if you have a substantial number of internal sites. To help manage this dual-browser experience, we are introducing a new web tool specifically targeted towards larger organizations: the [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). @@ -33,7 +33,7 @@ If you have specific websites and apps that you know have compatibility problems Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. ->[!TIP] +> [!TIP] > If you are running an earlier version of Internet Explorer, we recommend upgrading to IE11, so that any legacy apps continue to work correctly. For Windows 10 and Windows 10 Mobile, Microsoft Edge is the default browser experience. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. @@ -54,8 +54,8 @@ Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microso - **Centralized control.** You can specify the websites or web apps to interpret using Enterprise Mode, through an XML file on a website or stored locally. Domains and paths within those domains can be treated differently, allowing granular control. Use Group Policy to let users turn Enterprise Mode on or off from the Tools menu and to decide whether the Enterprise browser profile appears on the Emulation tab of the F12 developer tools. - >[!Important] - >All centrally-made decisions override any locally-made choices. + > [!Important] + > All centrally-made decisions override any locally-made choices. - **Integrated browsing.** When Enterprise Mode is set up, users can browse the web normally, letting the browser change modes automatically to accommodate Enterprise Mode sites. @@ -121,11 +121,11 @@ There are 2 versions of this tool, both supported on Windows 7, Windows 8.1, and - [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501). This is an older version of the schema that you must use if you want to create and update your Enterprise Mode Site List for devices running the v.1 version of the schema. - We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). + We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974). The updated version of the schema, including new functionality. You can use this version of the schema to create and update your Enterprise Mode Site List for devices running the v.2 version of the schema. - If you open a v.1 version of your Enterprise Mode Site List using this version, it will update the schema to v.2, automatically. For more info, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + If you open a v.1 version of your Enterprise Mode Site List using this version, it will update the schema to v.2, automatically. For more info, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). If your list is too large to add individual sites, or if you have more than one person managing the site list, we recommend using the Enterprise Site List Portal. diff --git a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md index a4cb639bc5..e35b64b8a4 100644 --- a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md +++ b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md @@ -5,8 +5,8 @@ description: Get answers to commonly asked questions about the Internet Explorer author: dansimp ms.author: dansimp ms.prod: ie11 -ms.assetid: -ms.reviewer: +ms.assetid: +ms.reviewer: audience: itpro manager: dansimp title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions @@ -16,50 +16,50 @@ ms.date: 05/10/2018 # Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions -Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. +Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. ->[!Important] ->If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or System Center 2012 Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment. +> [!Important] +> If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or System Center 2012 Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment. -- [Automatic updates delivery process](#automatic-updates-delivery-process) +- [Automatic updates delivery process](#automatic-updates-delivery-process) -- [How the Internet Explorer 11 Blocker Toolkit works](#how-the-internet-explorer-11-blocker-toolkit-works) +- [How the Internet Explorer 11 Blocker Toolkit works](#how-the-internet-explorer-11-blocker-toolkit-works) -- [Internet Explorer 11 Blocker Toolkit and other update services](#internet-explorer-11-blocker-toolkit-and-other-update-services) +- [Internet Explorer 11 Blocker Toolkit and other update services](#internet-explorer-11-blocker-toolkit-and-other-update-services) ## Automatic Updates delivery process -**Q. Which users will receive Internet Explorer 11 as an important update?** -A. Users running either Windows 7 with Service Pack 1 (SP1) or the 64-bit version of Windows Server 2008 R2 with Service Pack 1 (SP1) will receive Internet Explorer 11 as an important update, if Automatic Updates are turned on. Windows Update is manually run. Automatic Updates will automatically download and install the Internet Explorer 11 files if it’s turned on. For more information about how Internet Explorer works with Automatic Updates and information about other deployment blocking options, see [Internet Explorer 11 Delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md). - -**Q. When is the Blocker Toolkit available?** -A. The Blocker Toolkit is currently available from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). - -**Q. What tools can I use to manage Windows Updates and Microsoft Updates in my company?** -A. We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You can also use the more advanced configuration management tool, [System Center 2012 Configuration Manager](https://technet.microsoft.com/library/gg682041.aspx). - -**Q. How long does the blocker mechanism work?** -A. The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts as long as the registry key value isn’t removed or changed. - -**Q. Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of Automatic Updates?** -A. Automatic Updates provide you with ongoing critical security and reliability updates. Turning this feature off can leave your computers more vulnerable. Instead, we suggest that you use an update management solution, such as WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers. - +**Q. Which users will receive Internet Explorer 11 as an important update?** +A. Users running either Windows 7 with Service Pack 1 (SP1) or the 64-bit version of Windows Server 2008 R2 with Service Pack 1 (SP1) will receive Internet Explorer 11 as an important update, if Automatic Updates are turned on. Windows Update is manually run. Automatic Updates will automatically download and install the Internet Explorer 11 files if it’s turned on. For more information about how Internet Explorer works with Automatic Updates and information about other deployment blocking options, see [Internet Explorer 11 Delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md). + +**Q. When is the Blocker Toolkit available?** +A. The Blocker Toolkit is currently available from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722). + +**Q. What tools can I use to manage Windows Updates and Microsoft Updates in my company?** +A. We encourage anyone who wants full control over their company’s deployment of Windows Updates and Microsoft Updates, to use [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), a free tool for users of Windows Server. You can also use the more advanced configuration management tool, [System Center 2012 Configuration Manager](https://technet.microsoft.com/library/gg682041.aspx). + +**Q. How long does the blocker mechanism work?** +A. The Internet Explorer 11 Blocker Toolkit uses a registry key value to permanently turn off the automatic delivery of Internet Explorer 11. This behavior lasts as long as the registry key value isn’t removed or changed. + +**Q. Why should I use the Internet Explorer 11 Blocker Toolkit to stop delivery of Internet Explorer 11? Why can’t I just disable all of Automatic Updates?** +A. Automatic Updates provide you with ongoing critical security and reliability updates. Turning this feature off can leave your computers more vulnerable. Instead, we suggest that you use an update management solution, such as WSUS, to fully control your environment while leaving this feature running, managing how and when the updates get to your user’s computers. + The Internet Explorer 11 Blocker Toolkit safely allows Internet Explorer 11 to download and install in companies that can’t use WSUS, Configuration Manager, or -other update management solution. - -**Q. Why don’t we just block URL access to Windows Update or Microsoft Update?** +other update management solution. + +**Q. Why don’t we just block URL access to Windows Update or Microsoft Update?** A. Blocking the Windows Update or Microsoft Update URLs also stops delivery of critical security and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable. ## How the Internet Explorer 11 Blocker Toolkit works -**Q. How should I test the Internet Explorer 11 Blocker Toolkit in my company?** -A. Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additional impact or side effects to your environment. No additional testing should be necessary. - -**Q. What’s the registry key used to block delivery of Internet Explorer 11?** -A. HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0 - -**Q. What’s the registry key name and values?** +**Q. How should I test the Internet Explorer 11 Blocker Toolkit in my company?** +A. Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additional impact or side effects to your environment. No additional testing should be necessary. + +**Q. What’s the registry key used to block delivery of Internet Explorer 11?** +A. HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\11.0 + +**Q. What’s the registry key name and values?** The registry key name is **DoNotAllowIE11**, where: - A value of **1** turns off the automatic delivery of Internet Explorer 11 using Automatic Updates and turns off the Express install option. @@ -67,23 +67,23 @@ The registry key name is **DoNotAllowIE11**, where: - Not providing a registry key, or using a value of anything other than **1**, lets the user install Internet Explorer 11 through Automatic Updates or a manual update. -**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11?** -A. No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users can still download and install Internet Explorer 11 from the Microsoft Download Center or from external media. - -**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11?** -A. Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. - -**Q. How does the provided script work?** +**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from manually installing Internet Explorer 11?** +A. No. The Internet Explorer 11 Blocker Toolkit only stops computers from automatically installing Internet Explorer 11 through Automatic Updates. Users can still download and install Internet Explorer 11 from the Microsoft Download Center or from external media. + +**Q. Does the Internet Explorer 11 Blocker Toolkit stop users from automatically upgrading to Internet Explorer 11?** +A. Yes. The Internet Explorer 11 Blocker Toolkit also prevents Automatic Updates from automatically upgrading a computer from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. + +**Q. How does the provided script work?** A. The script accepts one of two command line options: - **Block:** Creates the registry key that stops Internet Explorer 11 from installing through Automatic Updates. - **Unblock:** Removes the registry key that stops Internet Explorer 11 from installing through Automatic Updates. -**Q. What’s the ADM template file used for?** -A. The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company. - -**Q. Is the tool localized?** +**Q. What’s the ADM template file used for?** +A. The Administrative Template (.adm file) lets you import the new Group Policy environment and use Group Policy Objects to centrally manage all of the computers in your company. + +**Q. Is the tool localized?** A. No. The tool isn’t localized, it’s only available in English (en-us). However, it does work, without any modifications, on any language edition of the supported operating systems. ## Internet Explorer 11 Blocker Toolkit and other update services @@ -91,17 +91,17 @@ A. No. The tool isn’t localized, it’s only available in English (en-us). How **Q: Is there a version of the Internet Explorer Blocker Toolkit that will prevent automatic installation of IE11?**
Yes. The IE11 Blocker Toolkit is available for download. For more information, see [Toolkit to Disable Automatic Delivery of IE11](https://go.microsoft.com/fwlink/p/?LinkId=328195) on the Microsoft Download Center. -**Q. Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like WSUS?** -A. No. You can still deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies that don’t use upgrade management solutions. - -**Q. If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company?** +**Q. Does the Internet Explorer 11 blocking mechanism also block delivery of Internet Explorer 11 through update management solutions, like WSUS?** +A. No. You can still deploy Internet Explorer 11 using one of the upgrade management solutions, even if the blocking mechanism is activated. The Internet Explorer 11 Blocker Toolkit is only intended for companies that don’t use upgrade management solutions. + +**Q. If WSUS is set to 'auto-approve' Update Rollup packages (this is not the default configuration), how do I stop Internet Explorer 11 from automatically installing throughout my company?** A. You only need to change your settings if: -- You use WSUS to manage updates and allow auto-approvals for Update Rollup installation. +- You use WSUS to manage updates and allow auto-approvals for Update Rollup installation. -and- -- You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed. +- You have computers running either Windows 7 SP1 or Windows Server 2008 R2 (SP1) with Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 installed. -and- @@ -112,10 +112,10 @@ If these scenarios apply to your company, see [Internet Explorer 11 delivery thr ## Additional resources -- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) +- [Internet Explorer 11 Blocker Toolkit download](https://www.microsoft.com/download/details.aspx?id=40722) -- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) +- [Internet Explorer 11 FAQ for IT pros](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11) -- [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) +- [Internet Explorer 11 delivery through automatic updates](../ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) -- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) +- [Internet Explorer 11 deployment guide](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/index) diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md index 3187f8b507..29b8c0ceca 100644 --- a/browsers/internet-explorer/ie11-ieak/index.md +++ b/browsers/internet-explorer/ie11-ieak/index.md @@ -14,12 +14,12 @@ manager: dansimp # Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide -The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. +The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. Use this guide to learn about the several options and processes you'll need to consider while you're using the Internet Explorer Administration Kit 11 (IEAK 11) to customize, deploy, and manage Internet Explorer 11 for your employee's devices. ->[!IMPORTANT] ->Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary. +> [!IMPORTANT] +> Because this content isn't intended to be a step-by-step guide, not all of the steps are necessary. ## Included technology @@ -41,7 +41,7 @@ IE11 and IEAK 11 offers differing experiences between Windows 7 and Windows 8.1 ## Related topics - [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) -- [Download IEAK 11](ieak-information-and-downloads.md) +- [Download IEAK 11](ieak-information-and-downloads.md) - [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) - [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) - [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md) diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index 296dec1688..ea1f1cb9e1 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -6,7 +6,7 @@ author: dansimp ms.author: dansimp ms.prod: ie11 ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) @@ -21,8 +21,8 @@ In addition to the Software License Terms for the Internet Explorer Administrati During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment. - **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you are an ISP or an ICP, your license agreement also states that you must show the Internet Explorer logo on your packaging and promotional goods, as well as on your website. - >[!IMPORTANT] - >Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. + > [!IMPORTANT] + > Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. - **Internal Distribution via a Corporate Intranet.** This version is for network admins that plan to directly deploy IE11 into a corporate environment. @@ -64,10 +64,10 @@ During installation, you must pick a version of IEAK 11, either **External** or Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. -- **External Distribution** +- **External Distribution** This mode is available to anyone who wants to create a customized browser for distribution outside their company (for example, websites, magazines, retailers, non-profit organizations, independent hardware vendors, independent software vendors, Internet service providers, Internet content providers, software developers, and marketers). -- **Internal Distribution** +- **Internal Distribution** This mode is available to companies for the creation and distribution of a customized browser only to their employees over a corporate intranet. The table below identifies which customizations you may or may not perform based on the mode you selected. @@ -100,8 +100,8 @@ Support for some of the Internet Explorer settings on the wizard pages varies de Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. -- **External Distribution** +- **External Distribution** You shall use commercially reasonable efforts to maintain the quality of (i) any non-Microsoft software distributed with Internet Explorer 11, and (ii) any media used for distribution (for example, optical media, flash drives), at a level that meets or exceeds the highest industry standards. If you distribute add-ons with Internet Explorer 11, those add-ons must comply with the [Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy). -- **Internal Distribution - corporate intranet** +- **Internal Distribution - corporate intranet** The software is solely for use by your employees within your company's organization and affiliated companies through your corporate intranet. Neither you nor any of your employees may permit redistribution of the software to or for use by third parties other than for third parties such as consultants, contractors, and temporary staff accessing your corporate intranet. From 500c91786254f25cd1f142c5d67dd2856f5ea54a Mon Sep 17 00:00:00 2001 From: illfated Date: Tue, 14 Apr 2020 23:22:54 +0200 Subject: [PATCH 065/249] Windows/Unix line endings: replace ^M with NewLine - 5 NewLine replacements for the CR/LF character from Windows --- .../includes/configure-home-button-include.md | 117 ++++++++-------- .../configure-open-edge-with-include.md | 125 +++++++++--------- .../includes/provision-favorites-include.md | 105 +++++++-------- .../send-all-intranet-sites-ie-include.md | 125 +++++++++--------- ...e-enterprise-mode-site-list-mgr-include.md | 45 ++++--- 5 files changed, 261 insertions(+), 256 deletions(-) diff --git a/browsers/edge/includes/configure-home-button-include.md b/browsers/edge/includes/configure-home-button-include.md index 24d2cadb77..90f6acdac2 100644 --- a/browsers/edge/includes/configure-home-button-include.md +++ b/browsers/edge/includes/configure-home-button-include.md @@ -1,58 +1,59 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/28/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - -> *Supported versions: Microsoft Edge on Windows 10, version 1809*
-> *Default setting: Disabled or not configured (Show home button and load the Start page)* - - -[!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] - - -### Supported values - -| Group Policy | MDM | Registry | Description | -|---------------------------------------------|:---:|:--------:|----------------------------------------------------------------| -| Disabled or not configured
**(default)** | 0 | 0 | Load the Start page. | -| Enabled | 1 | 1 | Load the New Tab page. | -| Enabled | 2 | 2 | Load the custom URL defined in the Set Home Button URL policy. | -| Enabled | 3 | 3 | Hide the home button. | - ---- - - -> [!TIP] -> If you want to make changes to this policy:

  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
- -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Home Button -- **GP name:** ConfigureHomeButton -- **GP element:** ConfigureHomeButtonDropdown -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ConfigureHomeButton -- **Value type:** REG_DWORD - -### Related policies - -- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] -- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/28/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +> *Supported versions: Microsoft Edge on Windows 10, version 1809*
+> *Default setting: Disabled or not configured (Show home button and load the Start page)* + + +[!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] + + +### Supported values + +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:---:|:--------:|----------------------------------------------------------------| +| Disabled or not configured
**(default)** | 0 | 0 | Load the Start page. | +| Enabled | 1 | 1 | Load the New Tab page. | +| Enabled | 2 | 2 | Load the custom URL defined in the Set Home Button URL policy. | +| Enabled | 3 | 3 | Hide the home button. | + +--- + + +> [!TIP] +> If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
+ +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Home Button +- **GP name:** ConfigureHomeButton +- **GP element:** ConfigureHomeButtonDropdown +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ConfigureHomeButton +- **Value type:** REG_DWORD + +### Related policies + +- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] +- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] + +
diff --git a/browsers/edge/includes/configure-open-edge-with-include.md b/browsers/edge/includes/configure-open-edge-with-include.md index ab0140e30c..273b7fdea4 100644 --- a/browsers/edge/includes/configure-open-edge-with-include.md +++ b/browsers/edge/includes/configure-open-edge-with-include.md @@ -1,62 +1,63 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - - -> *Supported versions: Microsoft Edge on Windows 10, version 1809*
-> *Default setting: Enabled (A specific page or pages)* - -[!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] - -**Version 1703 or later:**
If you don't want to send traffic to Microsoft, use the \ value, which honors both domain and non domain-joined devices when it's the only configured URL. - -**version 1809:**
When you enable this policy (Configure Open Microsoft Edge With) and select an option, and also enable the Configure Start Pages policy, Microsoft Edge ignores the Configure Start Page policy.

- -### Supported values - -| Group Policy | MDM | Registry | Description | -|--------------------------|:-----:|:--------:|---------------------------------------------------------------------------------------------------------------------------------------------| -| Not configured | Blank | Blank | If you don't configure this policy and you enable the Disable Lockdown of Start Pages policy, users can change or customize the Start page. | -| Enabled | 0 | 0 | Load the Start page. | -| Enabled | 1 | 1 | Load the New Tab page. | -| Enabled | 2 | 2 | Load the previous pages. | -| Enabled
**(default)** | 3 | 3 | Load a specific page or pages. | - ---- - -> [!TIP] -> If you want to make changes to this policy:

  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Open Microsoft Edge With -- **GP name:** ConfigureOpenMicrosoftEdgeWith -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureOpenEdgeWith -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ConfigureOpenEdgeWith -- **Value type:** REG_DWORD - -### Related policies - -- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] -- [Disable lockdown of Start pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] - - ---- +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +> *Supported versions: Microsoft Edge on Windows 10, version 1809*
+> *Default setting: Enabled (A specific page or pages)* + +[!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] + +**Version 1703 or later:**
If you don't want to send traffic to Microsoft, use the \ value, which honors both domain and non domain-joined devices when it's the only configured URL. + +**version 1809:**
When you enable this policy (Configure Open Microsoft Edge With) and select an option, and also enable the Configure Start Pages policy, Microsoft Edge ignores the Configure Start Page policy.

+ +### Supported values + +| Group Policy | MDM | Registry | Description | +|--------------------------|:-----:|:--------:|---------------------------------------------------------------------------------------------------------------------------------------------| +| Not configured | Blank | Blank | If you don't configure this policy and you enable the Disable Lockdown of Start Pages policy, users can change or customize the Start page. | +| Enabled | 0 | 0 | Load the Start page. | +| Enabled | 1 | 1 | Load the New Tab page. | +| Enabled | 2 | 2 | Load the previous pages. | +| Enabled
**(default)** | 3 | 3 | Load a specific page or pages. | + +--- + +> [!TIP] +> If you want to make changes to this policy:

  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
+ + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Open Microsoft Edge With +- **GP name:** ConfigureOpenMicrosoftEdgeWith +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureOpenEdgeWith +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ConfigureOpenEdgeWith +- **Value type:** REG_DWORD + +### Related policies + +- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] +- [Disable lockdown of Start pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] + + +--- diff --git a/browsers/edge/includes/provision-favorites-include.md b/browsers/edge/includes/provision-favorites-include.md index 5ec37da07a..739f15e3be 100644 --- a/browsers/edge/includes/provision-favorites-include.md +++ b/browsers/edge/includes/provision-favorites-include.md @@ -1,52 +1,53 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - -> *Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
-> *Default setting: Disabled or not configured (Customizable)* - -[!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] - - -> [!IMPORTANT] -> Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. - -### Supported values - -| Group Policy | Description | Most restricted | -|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| -| Disabled or not configured
**(default)** | Users can customize the favorites list, such as adding folders, or adding and removing favorites. | | -| Enabled | Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file** and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
| ![Most restricted value](../images/check-gn.png) | - ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Provision Favorites -- **GP name:** ConfiguredFavorites -- **GP element:** ConfiguredFavoritesPrompt -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites -- **Data type:** String - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Favorites -- **Value name:** ConfiguredFavorites -- **Value type:** REG_SZ - -### Related policies -[Keep favorites in sync between Internet Explorer and Microsoft Edge](../available-policies.md#keep-favorites-in-sync-between-internet-explorer-and-microsoft-edge): [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +> *Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+> *Default setting: Disabled or not configured (Customizable)* + +[!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] + + +> [!IMPORTANT] +> Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. + +### Supported values + +| Group Policy | Description | Most restricted | +|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | Users can customize the favorites list, such as adding folders, or adding and removing favorites. | | +| Enabled | Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file** and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
| ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Provision Favorites +- **GP name:** ConfiguredFavorites +- **GP element:** ConfiguredFavoritesPrompt +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites +- **Data type:** String + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Favorites +- **Value name:** ConfiguredFavorites +- **Value type:** REG_SZ + +### Related policies +[Keep favorites in sync between Internet Explorer and Microsoft Edge](../available-policies.md#keep-favorites-in-sync-between-internet-explorer-and-microsoft-edge): [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] + +
diff --git a/browsers/edge/includes/send-all-intranet-sites-ie-include.md b/browsers/edge/includes/send-all-intranet-sites-ie-include.md index b59221443f..0f909d31d7 100644 --- a/browsers/edge/includes/send-all-intranet-sites-ie-include.md +++ b/browsers/edge/includes/send-all-intranet-sites-ie-include.md @@ -1,62 +1,63 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - -> *Supported versions: Microsoft Edge on Windows 10*
-> *Default setting: Disabled or not configured* - -[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] - -> [!TIP] -> Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. - - -### Supported values - -| Group Policy | MDM | Registry | Description | Most restricted | -|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| -| Disabled or not configured
**(default)** | 0 | 0 | All sites, including intranet sites, open in Microsoft Edge automatically. | ![Most restricted value](../images/check-gn.png) | -| Enabled | 1 | 1 | Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy opens all intranet sites in IE11 automatically, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file**

  2. Click **Enable** and then refresh the policy to view the affected sites in Microsoft Edge.

    A message opens stating that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | - ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Send all intranet sites to Internet Explorer 11 -- **GP name:** SendIntranetTraffictoInternetExplorer -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** SendIntranetTraffictoInternetExplorer -- **Value type:** REG_DWORD - -### Related Policies -- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] - -- [Show message when opening sites in Internet Explorer](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] - - -### Related topics -- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. - -- [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). Learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. - -- [Use the Enterprise Mode Site List Manager](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager). You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +> *Supported versions: Microsoft Edge on Windows 10*
+> *Default setting: Disabled or not configured* + +[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] + +> [!TIP] +> Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. + + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | All sites, including intranet sites, open in Microsoft Edge automatically. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy opens all intranet sites in IE11 automatically, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file**

  2. Click **Enable** and then refresh the policy to view the affected sites in Microsoft Edge.

    A message opens stating that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Send all intranet sites to Internet Explorer 11 +- **GP name:** SendIntranetTraffictoInternetExplorer +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** SendIntranetTraffictoInternetExplorer +- **Value type:** REG_DWORD + +### Related Policies +- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] + +- [Show message when opening sites in Internet Explorer](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] + + +### Related topics +- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. + +- [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). Learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. + +- [Use the Enterprise Mode Site List Manager](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager). You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. + +
diff --git a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md index 0b86c29226..31961c97a1 100644 --- a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md +++ b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md @@ -1,22 +1,23 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - -If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. - -> [!IMPORTANT] -> Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. - -1. In the Enterprise Mode Site List Manager, click **File \> Import**. - -2. Go to the exported .EMIE file.

For example, `C:\users\\documents\sites.emie` - -1. Click **Open**. - -2. Review the alert message about all of your entries being overwritten and click **Yes**. +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + +If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. + +> [!IMPORTANT] +> Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. + +1. In the Enterprise Mode Site List Manager, click **File \> Import**. + +2. Go to the exported .EMIE file.

For example, `C:\users\\documents\sites.emie` + +1. Click **Open**. + +2. Review the alert message about all of your entries being overwritten and click **Yes**. From c8975281192dd1c4bd3c4a5c0c348dee13a1486b Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 15 Apr 2020 11:08:36 +0500 Subject: [PATCH 066/249] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 0aa1e47937..de36c85817 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -665,7 +665,7 @@ Sign-in a workstation with access equivalent to a _domain user_. ![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) 19. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. 20. Click **Next**. -21. Click **Next** two more times to skip **Scope tags** and **Assignments** steps of the wizard and click **Create**. +21. Click **Next** two more times to skip the **Scope tags** and **Assignments** steps of the wizard and click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. From 04cfd5f60fb1a0bbb40260e69d3b2e6ee6702c17 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Wed, 15 Apr 2020 11:41:51 -0700 Subject: [PATCH 067/249] Update surface-pro-arm-app-management.md --- devices/surface/surface-pro-arm-app-management.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md index fd98f72368..2ba2628778 100644 --- a/devices/surface/surface-pro-arm-app-management.md +++ b/devices/surface/surface-pro-arm-app-management.md @@ -8,7 +8,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 1/22/2020 +ms.date: 4/15/2020 ms.reviewer: jessko manager: dansimp ms.audience: itpro @@ -44,7 +44,7 @@ Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager A component of Microsoft Enterprise Mobility + Security, Intune integrates with Azure Active Directory for identity and access control and provides granular management of enrolled Surface Pro X devices. Intune mobile device management (MDM) policies have a number of advantages over older on-premises tools such as Windows Group Policy. This includes faster device login times and a more streamlined catalog of policies enabling full device management from the cloud. For example, you can manage LTE using eSIM profiles to configure data plans and deploy activation codes to multiple devices.
-For more information about setting up Intune, refer to the [Intune documentation](https://docs.microsoft.com/intune/). +For more information about using Intune, refer to the [Intune documentation](https://docs.microsoft.com/intune/). ### Co-management @@ -109,9 +109,9 @@ Popular browsers run on Surface Pro X: ## Installing and using Microsoft Office - Use Office 365 for the best experience on a Windows 10 PC on an ARM-based processor. -- Office 365 “click-to-run” installs Outlook, Word, Excel, and PowerPoint, optimized to run on a Windows 10 PC on an ARM-based processor. +- Office 365 "click-to-run" installs Outlook, Word, Excel, and PowerPoint, optimized to run on a Windows 10 PC on an ARM-based processor. - Microsoft Teams runs great on Surface Pro X. -- For “perpetual versions” of Office such as Office 2019, install the 32-bit version. +- For "perpetual versions" of Office such as Office 2019, install the 32-bit version. ## VPN From a8177276758c91c8f16d88992ac3f3720f53fc4f Mon Sep 17 00:00:00 2001 From: mapalko Date: Wed, 15 Apr 2020 11:47:57 -0700 Subject: [PATCH 068/249] Added note about MDMWinsOverGP --- .../hello-for-business/hello-manage-in-organization.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 8767eadd0d..b957c2cc87 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -351,8 +351,8 @@ The following table lists the MDM policy settings that you can configure for Win

>[!NOTE] -> InWindows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN. - +> In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN. + ## Policy conflicts from multiple policy sources Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device. @@ -361,6 +361,9 @@ Policies for Windows Hello for Business are enforced using the following hierarc Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis. +>[!Note] +> Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP. + >Examples > >The following are configured using computer Group Policy: From 723ee8fdcb07e4b34b0c4def15d1e82c0da34c9a Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Wed, 15 Apr 2020 12:08:50 -0700 Subject: [PATCH 069/249] Requirements --- devices/hololens/hololens-insider.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md index 8951d206f9..c4d1cee1a2 100644 --- a/devices/hololens/hololens-insider.md +++ b/devices/hololens/hololens-insider.md @@ -64,7 +64,7 @@ Here's a quick summary of what's new: - Support for FIDO2 Security Keys to enable secure and easy authentication for shared devices - Seamlessly apply a provisioning package from a USB drive to your HoloLens - Use a provisioning packages to enroll your HoloLens to your Mobile Device Management system -- Use Windows Autopilot to set up and pre-configure new devices, quickly getting them ready for productive use. To participate in the program, you have to use a tenant that is flighted for HoloLens. To sign up for this program, see [Windows Autopilot for HoloLens Private Preview request](https://aka.ms/APHoloLensTAP). +- Use Windows Autopilot to set up and pre-configure new devices, quickly getting them ready for productive use. To participate in the program you'll need to meet a few requirements. While the program is in preview mode you'll need to be using Microsoft Intune. You'll need to use a tenant that is flighted for HoloLens. Lastly you'll need to have installed an insider preview buildon your HoloLens 2. To praticipate in the preview of this new program send a note to hlappreview@microsoft.com to join the preview. - Dark Mode - HoloLens customers can now choose the default mode for apps that support both color schemes! Based on customer feedback, with this update we are setting the default app mode to "dark," but you can easily change this setting at any time. - Support for additional system voice commands - An updated Cortana app with a focus on productivity From 445e36e406d3eed025c2fb9e58c7ceedfa3d5175 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 15 Apr 2020 15:08:31 -0700 Subject: [PATCH 070/249] updated file with new info and image --- ...crosoft-Defender-Smartscreen-submission.png | Bin 0 -> 154708 bytes .../windows-defender-smartscreen-overview.md | 8 ++++++++ 2 files changed, 8 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-smartscreen/images/Microsoft-Defender-Smartscreen-submission.png diff --git a/windows/security/threat-protection/windows-defender-smartscreen/images/Microsoft-Defender-Smartscreen-submission.png b/windows/security/threat-protection/windows-defender-smartscreen/images/Microsoft-Defender-Smartscreen-submission.png new file mode 100644 index 0000000000000000000000000000000000000000..74f9fb15ed2d935e68b7213da2e7a732f3d3776f GIT binary patch literal 154708 zcmZ6y1yCJ9vjz$WJGfhLcXtTx1h)j&;4TM(ySoQHxVyVM1b26L5BBokd;fZ`UR7^x z&DKuOOn=?qRQK$LD=SJPBYZ)CfPg@jm61?|fB-N+KtMhK0so$~pwV^yyFoguN{c~M z{UJR0*MK$`RS<=MsEtK@GlKcohIf$Ba)y9F>Hp6KIc#5I3IXw1C@UeV?yi6S4(FvY z+{hBM_38PvkuiWQ@5)kZLKAaAxn%jLQ7yA&oi{vdd8nv_Cx|j#1Z&3gsuMAHQw0Va z8i*zXP`5~kg9gISukrD_es*nfy%NH&wX!_DzY9%`E*LMHKTf1KE>>vOFHYF~rMa+& zdhG~=TL@l6k;#|iG(gTw98&NxNf=HGFVBMQR{xRn3x2l;#j*|z28M~ne|uS^D( zPU=R-l zS|2$;B9sT*|4j4WuyC}^)p>pqKm_$Ds)rs%mO_Y!h*Hb=A<& zIM{+%`Y-I(@NF5Fa1Q4P+xym5R@-+wZ|DHKt*#3sNgx^!^PNY0d9);J+LsJK_Ev(d z{COStTx5*;T-pOgMv6e$?(uM%%c^as1gSqmz9s5!`+Y2J3E}$mK-i#p_FzPz z(~!ZL287|V=zsP7@RF64RZ*E~bw2uo@;^?7)UzerlLNKAjNLN@wSB$w_@9ZR0c+S) zb;zNCHX&$?f8ofE4q84$WnzVMB1KLy2+8BxJ{ITZ=7ir$Dq}ewN$K@l9CBM)@KkYd zaI*Pb%fR66fpE;1mzQC}X<_02TZXRz1PKZ+GsF`L4eEE_!wLKrZ(iRZhyk+mh#D$Y zN1zd)7eFSi7bA|QB0v^|4NVq=haGhPd{>BG@(Ej#pAXeee_nZdc2>JkR$AK2{10Ix zG=Fp_5mFgg(fa!OSYpBSLcCIye;KrtXD5C@1~Sy>4r0g|86U3{#O`Vsr8L-(P^lt95k>_`i` zN0Wvqhv;dDi$j5g!6?LrMUR4EL1=(k(o>PHq@<+%{r!T1f`Ng7prD|ZmX_uJM!G;y zS{h!mKTT|GZ0I+*p6334C{jrDUi80|^9FeXxha=n^*Y?q+p!+vwAIwqGWJe*kC4d* zaDzxzu8yah;Z)IO^a9kT^z#KvNZe&i~~BRD>`Rj3}W`83H*p zp&H3nhaCX9va9REWCoA@R#!A>fGt`RXPC$`Y$mgBZ zy;SuN;4DGU$A8H2_jjX2FaznQzx}`bG!Nwj#IYg>y3W;ClN5QeZVtE%7b($12NIB; zXJ2l1dY&yZNz{+0vQX4z33>Ai3mceo{Wr$I;65l3VK+a0`W~VXsCi2e=rJ6VMovx+ zjlIgCJLaEC)KgzF6#t^nU|uOwm{W|*HuwVOUM_C##f1e8P0f_lR1;5_Sw23#Hc|tK ztO!3vo&R^A@U;+u=Kpm|NvP;}+L zphSf(sH$Ri#XNqzSOXe=uhMOGzcDs4GP1L?^YCcf{V$}U8#)+I zt@Rg0Yx8`v)6vQBpw_wYhoFCh_^1b}8yNV$|8+f5AU&^{ot<^j{68dFA>K);s9*?^ z0|Ed+QQuOTjiB=FVBRayfeRw4TLI$RV$fw(Rj|4L+y!kA1rh20(-B34R#r~VNhnHL zMPV_Am_Thq1SJd%NVqZp$?`iobUU$wfCa=O zmnSDL|6?^RUI}na3<{@%6zK!$`pw=j2RnPu|F8SMV63R9n34n!4Gnd30r(7H|IPxF zva?ZO`J4aGx_A(9q)DVAre*Z-uCn7&!azCP&58O&i|X0 z0RoWf=H@0$WH^SXzX--3YDZiW{Ll3tRO!Vgwy^x?&q^%3E>^jY#zibGEe*lWuPlBa zM%f=%MP+ZeTbiyZI$4d+wK{2>8T8*ZKz!J{G8GGsTFWdn(uC7vl(NF#8)GW=kifuG zKc_*Jp2H*wmKNO0!aGR^Rahdy>h$}@StY;gL4M0TM8Er156PO?B0sBH)CHB?GKo-i zlg}@vNmWtlixkqVXR)Ny#ST=+)~=M^X=y)mT{N>s(BWPdGBEEI`4r*FTeoRNuq_^~ zw3~}u$IvnOkB{#iMcn?57ipJLf+@=BVd$^EzFTigI4i3~1*NK&Xb&sp7`w)a$)aFM z_WI9+!XJNMuI`A9H?9yFp7F&hu`8pPx++!gai&5|0K8*ykybs;7+t)(l$1P><-h6g zdTXFeD`}Andt`$t&ddQG$zlnZ!&e4$>R5z%kI8q^EH43X5DO7}8VoDlC}qFpzJjH> z8&pkp3P_W|6^Qw`vZa2k$@eemU1gqfSr!Q+4XBkYQw0tmB!FEYKtf6?Btis8_#gU4 zMn?WT00s#ve*z00MM_IcYin!yo4c`H#{H~V#S|6DVoA8n%p#Zlmka58(PLs~0%*7= zXA4)_SW8HuNeaC3l8eFqeCy>a$X_EwN$IRi2PrVu4VNpR)5_Ri zyRh5sVpSth(`Zi4vq48n0PlCMb-5}{!D-Wq2WiGkQ7AOIG6Sh8hA2_M$}}!goHA|> z?XC)h`d)X~T=WfjN+5kk!NFjL@E5LpEjpjHF7aE zx4%WfyO>>R79T5L+iKFL?CmN42Cyvt3}I@ z<_s=Gk2Y7-n`z`M)qas13X&H96Ex37aK0Lq*kMNY=?Z=Jqn_ytxki^69r88tPvpde8%AOpu7`qUR2 zg$&jo7TkxrZ67THwEp~*Amsx6QL}>Tp%_O7RSp(4T4^U1ZPZyc%Iw-{vnI$nadCL zMC`kpqHr={R1TJ>X-9_ixY1cCu$33={MV8(q)sUd#fTO$&v}7$neOU^#$;*anRPtqNS`X@ zh~gT@1Eb1pCNXe^2r!v4I?u-KptjkXua|ux{YUoA{a3st4_wei$|3B^{v7epvSi0U z_`hH@_F`Ct+(KZk4guxx&UUY5k-#Y7aBUXkjD+YVIS^&VVOH`n%+7=lT@b_g{>yI3 zgp&u`anjWT_Bn5iqUag4As=a`UN6H zjUZ<%(&j@kZ|CO!PzeVNxpz*(E2{q4f7YmYb^Ns2w#M^^P{!a2+dOURvk*PIy0nlA z?=9L`Y{1-D-8I?B2dTeta(=${uCPq;{>}f5pJU5lkh7#ZBQ?xqV&bosqJrV4LE+y) zyHKiGii?v5t6SyVdEQQbd4r1c@k^f*NwQu?5(z1T*FY8kF2pziYoEhIERJ2i=8?vb z!?xhvdxw~KJmpInX}~kWSE6aA7U;bjO;@eRE?vrqSqrph5g-Mu#teL%5*xAZ?hyJvod(~ zCPg~h;_}cNax8i;4?-zB!Cb!PC_D>kcp~P-iZGCc`0zg3Q2afHTq*R6E(Y2WVyBS~ zLz@(bwC{|zjcNnq{ouqgoGXG%$$UFqa2a2W7`~oaZW#ck0wX949}kv+Xu577MNUQoV7dbn_oqzijSP35o&(dXL~OrUJ)oi*iIU8I z&p2QM8eUUY$+hemRdB>^f-Lt>n8pw1JRTI>i9-~mlNPAxC=n82_MtdLBdM!&()C2; zLo~(HaQOJR8WpLUV~ic5q~I_`+3$6M30R~41Ez$K$KY9rpPJ$!*ms^B6eRC+0r1v) zrNu7uo%v%Y(l)STk zyo3~J%JY;1ay-Go6uB(dhPtMH!A{1e?+d+4+yE6WbrvQO7f}NdL2=xrNo^V9i%3y6 zRNuB2*(>qbm!frH>QkeuVnl% zVNb)TUY$!tnbN~{B%LQndGX5rcxd1pTe6d4u><06QqUEvBd54nB~mt4Nf9T25>nNW z&d0w9`mDzKC3^La_$;LL>P6r12dEI;MF!$>+VqmuIS~>UiXw%biYy?hYkm+uO6nJX z!cuDjuT>$u2px{?!_O9n(BQHGHOn)LN^NqepQ}vKAlnK5+1|bUY(kQz^B}gprWDX% zwt>0ON|84W>CYDFxADCvQ}t1hv`NdD^>lW6!e77d=P~3ILtzD#4NO$f7%N5{lz?zb zfQa*i{D)fwWmqY_2A^5GjSu?WW=`tsNO633nzxs9aEdN!sRzr(z&#B*LeZ@ zcpy+i6j~4U6ssvBsy`)ZHIq;U_^Q%yveJuKWj<4T=|N2C+$2A z3zv$Rfeh6oWJGq_6M?X_aMBOc;&$EBDGJixEg|GZmN!iRyv`&9q#eP*pNcmc3g* zi6sS=5(LLq^!lPBG~xl&YnUb`rlXze6&Nh%_3zh&CVq}v`v^E!a{y{Hz=0%$L~Vok z80;v8WJc!}K?&vt*HFxc{uEliuGg-e2*XBd^xy}XoZNXk+AopTPwzhiJB*1PRz5RM zLIXgi)ngSa?s=B)qXLj{Qy)IEt509Kp+mE5;#A0vFLHI=A*&o5VcXEqV%`uYD!6K5T$K8Tza2qRjrF zrf2Yrqsv!PD)-#<`MyVRUn_@{cpV#GQB;Ly-^;FkH}14N3f8(rD9WCai+Tye?F1`;kE}u{<1lr5o$&ii%EL=FUFHN+KE9;T_23*I6nWC32TqnD09*ogs!7P1Nm zPQ*e;FimkZ^6yYY=3@oG#ABwF9C%A}?pK-;gzlv>$aNp!oV6W5KhmZFB*YtQwo#FW z6mMkI&BOVnvt>uvRZK+G&f_EsMZOD=RW=PiKHg`sv{e4RyU%L&2=6(xsJt`Qae_Qf z`b-?SSx8JcVhE^qgm$WcPEH>vW4x}8jA=x^{dym#^kx83$Kt-@hQi21StpTdkeefq z&@uUTY3xmg33X4&?a(uzZ<$X?n`m&N?nTJ!X!^?;0vX+Z=#uv?ZYg)mzT07L=Z8if zC83FHyI2Jrd{yNd!c6HnUBK z3z?RN*wJ%#q7HqOvb6T@LZs)GSDn%f$E#yVb~diqAK1iG@-()E01~7iQ(r88R{`g@(sLh=N!Q*lK*VDhm#Yj1lv^W56+A zSH&K!&wYsDC>WfPS}4Ol0iysYf7--)>@!FNHQgHKgaMhix>~|Pn$spqQXCoX5_5y3 z<$%#w$ZN+lXFFtg84s(|ojj=+A%hDg5zwfT7_x11EC9Z-*MypY6$k|d{-Lk; z2v}O>6f^VK0?7qr^@jc=VP)e=+@yV@z&0!Qg4jB0a3!t(je(Tr426M8%n#DyV#;|s z!I7WvCFp886*9~bA5IH}uN|oEHo}2f{85SCp@$Oe#3!ov`1IiAll1RDV$dNmJ8|W> z_kXkD*G!8sBpFyNfe!T;x=liDN`5-e6q5&GP}040L}>Xc!6!j{7IFOCs|I#;DUp+g z#)#+g&VjqVvVWQQQEk|x%nt^-p*TDV-pv_grDTQu_J*(rdKkOea%7CV1Q4)_*AdLijhR_zGZJTAYo= zwOwI_zIa03Hlbit*7y=Y;RK6f%IHE2$2TiE^uG$$YRxHBU#zR_K!J zL@Hzg*r?PmG@MEOm}BVyC!J756V{wq^4^cKYNRGrj@Eh5abodP@yg`4B^+;XMJ5kD z7|O=i{irMPSVtsxanKdPxST9cT>kI}GUAboR!ctZyNra9uT5&K>XvqOTG4rI3vNKA zZhyuVJ||uXts@{aD^z6fFCKM%Nj+JD45F^-KjV~mV)Ek3()up6w)jhQ90-5E2HL3< z6uQ$HtCHq9bGk;?p8w;;18>rqV6_e2h+@O8>y#7p&lb4hV)^L9PA;rjZC(b$YF_@K z3q*K0F4%~eKQNW7c9C2(89!4ii%DE!-{ywI3@w^Koaz}&hU8n#%u?it zhpd^b9!CI#sBMop|8f{a*Cll0xOhShY>R-pzVCV|2Kvk@vwg++VUaS9;;fL5==^-rEF6r~4b~sb|Zc z2f1&<)h+XsLuzy+!2-+HoFc?1;Y0Qd_j}QQB^^JjSG$M??Ux3I7zYhppF2Ps9yP$_ zinL3@Y9QbP<$m|jVE;5hNJN+E)-E@Ns#EhpU!cQ#kDMvG;L{WsVR(C4`Au^b*OH(+ zT1+Vce}k{WOH=^MU5px4lWGtk^w&_r)H;+`mm3lth*a*ke_kzyqs`B244*&`i*8s( z4VJ}MMnEwYvc6q^Wg+IzzQ{Q`?dVM~V15A_u!O(D=Svwd=jVnDz> zikhFEKO2Cgkylg<78n7D>xGdI62L$Tm$e$XX9%ih2W+%D|0@BAC`y7`T6nV-woou+ zk_1chtG;A_E}LM`k25ymITEbwH=hUnjuuoOU4}UiNh@PgF0_wv?I{rK$1(?PV zwHO{>=yC-nt)eGp6vFk#9E>hM{0h|V|7h6Jt&a;f=&xdUFG|rZBxJ*3O zgRd^y@vQ>#V0%O~1;f4PZB1J{OYn+%)Ho9MKvZtprXk){DiCxWk+M~xk-i+KNsb8x zO@^V^&NM+v7YT_tT{^Vdr0Y3NW3*pD5w7sHldNMJ<5mP-&b0$pI-rKIf<$z7-I{wB zF6xxCvf#Ubms(`iYz(JGa3y7VgQ+2O?#(E+rNxgeTGHQ)#w%X}In$W=3cdSjPHy5% z__DAdIA^>Y{1eEmXk02@H5uD}B&g*JvXecCUbO^LT_`xk2SgE4pb$zd${iP=e3_fI zvl#4DSAjbAqt47Do@oV%{5Y*MCXxX;AaF-w-=nKfuM7NL75|Vn&{lSm+?NpZ?L}OZ zW;JFhfIcV|Xq?x+?Mu^VQ}rhm%bF=OJpAi~yH`@g?-6RZXtCO=$y8i-Ca(~BE0E+* zr1H&>8ybCN9j2H9S+r?fj9l5tF7U)65VYF_8kbkD%)=GLQvf<_+HJ23tzX1V%hkq%c0NhNKx63 zlM)Ckn9$aO9K@>2kdOo=b<}flWsYO}B*@TMRnvp5zsU2)_1*Jrl@qm=4{BP5S~qYg zU_AenpTSy#L*KM%x)tLOx@t%S-uo)d#TbIrwXE7&H6)=*&=91Z@2lpkh$?65>@9!0 zHDYjNfTcS*MKao)f^lppd74da4hRoTbNxsGSt3n{dfJ+TH1=|hpf0ucpL-$>K1MK< z`LKJU!~UqRI~e0;-{okpW@hOviD_2(jvH((AT!->0>u}pV?7~S5vYw8>+CGGcp4hc zzTlV|Mmu3HX}G|$QiZ|Z`FJjj_L@A&FMEGMmzhLi6*ISVH;umTr6Tajb!r8UJfa~z zZwFIvn0aG?d-g80ow8E2$`2MTzbl*r9Hw!P(Y%9tEK2wz#lixhB>HG+zX>gr6|PTX zST$x!U6g%=ilT48?uPth;SW8^hdymUx#;yTLyHz+MLeMoffEe9oW9dfEbJJ4yq##U z_Za*z(_-F*oUbfHifLx>V5CMgfpl3mnR#~5kteW$;nMF*3qyv(mdBe>bIlVsRxjOpgLQemm9GHL&aWq?t*5ouj@PDUGn$F; zYGy8no}MoX(>N5~3*g{$ft_};z3amEn%Jb-%_$t}j`P+_{M6)XciT4`$G-Ro#k80@ zzmbHdZbrekgwL*{_ea5twwH_PG}qtXm18;q(EjnFhJ^id2xfNQHbKw28NpP8l}$Z* zmR;>ioz0i)P#@C72>g$ir_NpNV>IWqIc+yTe*I*?g8Nk?Qg}M8145AXWk6mnJ)iGW z+;Z4*zi*V?nQ}k(+BE+($zST^qv*4i_5leBVtG&+VPwba4_RrT`t_+f0mKS+Gg7u~ ze+dc5`8J>K@(dRvXM5fEGo`*gX+&*#f-ZCSD$Qa>s`kIta}#akxU@~m)#ei3^S`z| zs*8*nK81NpD)7Q+0nNDa;zbKWzw0HbJS=7|lPE4jQ3+qQpDo=bi0v|CyQ$Gzw6v$P zv?#Cbh724aqTf8X{%i&`7qwl`Kksy8+QSh0ny%t63F1;;OlH(@xLRwX!{H*^V&!jE zU5s?GnYm8HzJ2!|ww`nAa1%PKyGflx2_gKN_^Xuw3Yv+I;9pJJr=!kx=y6}Godc~_ zj*E%(?^uS~QwKZf!xM76mOd|k=7tPi`?~rML+=-b)w(p3t~1QMDQ=^_VuMRpgRJX_ z&$eOdYWG3!&rptpIpzj>Pe1!r1DB&jt`nBnt%rB`*Bs*Z4;~KkCBoA3S`HU~{tn8K z0Jx;zOC^&EmEOKav#4)wLPxC+d{Y-w(Q9vyQOD8J3@`gIiz;;*;2}<1XZ=a<&CysT z;cy2SeZ2SJR}QFVQ=+e~8L(!x$A~EUvU6W9R&V=%GOsx=5|-x@SFm?8nj%@H>NHI2 z;gbo>IvD8G>+s6bO|{5@^Rd1T@g*WU$`&2j>o>cc~(tMbeKWF{6J)_Wrf2x zO_3lb>89c+DnXy4uUr3k{T2Q%x%~C9_j?T`2a>u-$ieDj6+e-i?sC`uaL{MVd$K-< z+4GP2>lIF+%~-o@W2hjzW6Z5BbfGC?vmMR>x4T4XFz%$CcH?`n;HHjZ2fo)eOm&u0 z)W&t*@L>+D4M{f_P5l@`C`u!y$WT?UTq;en(y|jLb2FhauB&A)`jO9R`@yRnLHAzg z8Jt?*@a0#3yhW71q)Zb?W>w{AJ196@F~aUQ4=a`|9)#|o`=+aywa4@;yQ#@v@l*=* zl!lk2nfGZE4vc9{sI7z!TbXcfu|!tu@pC=`G0^8ME%WldCy9)jjea$&9_UPM7puVn zP4H_m@~f`*`-22&{b;C~j^Kimer$N*OqXLiH~AEA7S9VW&qaUi@Zwd|N(e4v+9h*c zg!P2hJJt!!&BMfYT?-Vob&u1_`|g0Zia#|6g^+#%jZ}n z7|&}EI7#2|xDc)Gv>Uz;S9@EXN4&_UCXG8&#|UKVM99^R4*lu_gNRj!W6@{)X z?ooL4Z*Bg%2$Owv@&3Rx;SoA(Jv#8K`3^-v{IvWT^!*vLOXaG1gyF=9G^hg4?V8zc zri%pcrDxfD&RGXH=iKX$>k?wN(H0`o=jOh+(#yG5pUKkG@bG!XG_%!e)cu&WkltO= z+8^9u5_dbV<+-lVf2C3U(>4>;dnz<_Hf+7X-yRiVzs%+nrZg$@Uuj1xuDln$cSdHc zNgSg8l3;%OaFsg|HzCh{HXY_5x$?e=El<3)N+yr$FzmIaGZP>r$AZRhjcYYoqQ3a! zYdl|vp1;(!-TefI>DI~pYYLU-(znm~if1UK^Gia4hOAQW1%RY2aeT7lEx0L#crxlF z$S_XX<+Yt;lHjAaO_W(>E8XkdSAOJUC~Y}ZIvDxI;!J7CzLHa!hPm81=i@GY>QJ($ z*=dC##rrnoq1~U2V*Tmr>qgjbh`O-wH2V_4xvEY<;T^Uorm5!(Zz_jR2FTa!hgE^u zpGR>@pbxtbbjBe2wPlu@id#SYLrf{eJA~IC?XBY#w(_mF&jy-;UqMsiU87s+F1H`y z!&k2^S8=i2!uP2UIgAR0atfT`eZ&_Vg)~xa5?@amue7>}wvd-^I>CZda6}%9pVRqO z0=}Fl+v$65=!iy08@CWJEDfam z+^_@Q$HalJ*3k&Fgt{2A|`4^hmoO)U&7a z<6Ev;9|I*+TQ_Sj4OiKz)We-$`F3g@1xVc1o`|N1&{HSU3Z^Mntsi4_^g^~K!im4y zg|2no1}>~}dcxT)N5MT% zsIePtE;i4@XHz)Mv)ZJ1I8y5D3J@EOB73@AD(~`Akxk5}yND!}zs~27r=n4Pjl|}k zXofr4=?-O|E|gkq16?l|eqMtOoqkr&RJ@znjZM$234(CU8?9IrA_#ZtUWWZWefPW1 zTH)bHTvoW|1#YF)Os3Xz<6_49=8xJk)1`+hzHocYISUz8{|)Ipbl(21w%4^+XL3DE z;EPAt{^&x(=|=~3Vn~gbzEwfjx<#@1^A5g3c_v=`C6(B1ga6<8Sfz9s*htFi1of{! z73m*vXY|SUkm%Lxyr-(ZRmE*xc1yK9W@M61lc2R+TtI$KhQs!PrOMRHqTJ;#?$&W~Au~GqUcH#nNs~@-@q6Ld|!=tPxYd0>;^XELN#5o$ezPNouProB(kzfGZVD@9pmW4Su7>{zF1|B#K|bn@S3PN;5QWkDU29x^)R(4e)f#Wg`h)5H0ZYJy!V+ zR6eXIIN+F?&gkdh3-xi`%5JIWT&M5DUUU>?)mutOt?te(;s)lCJgq)WJO^g5tQvj) zac!IfQ`G+FQRo2waXo2Xsn6=)?k`CBaT?C7FFIDuu~j$y)}vQ3UkitU8bGVHS^Dm- z|LBd$uCJwi>!KWR^zjYfc9pI@#eC+_RNDY)q{UZvo#9&q^`V>KPWQ|A$hk)iOUWO8 zfhL8IdoX;c&qac#M9J!_17|cHtTIM*)*e214M!{)QE zFjQbY||XsnD$ z(8!yb)H29zpWsgI+x{u}!BSi8g}aGludpZ8r_s}c0n5ajyOx=1A?Q!fxAX&KCbWmD zWR{+HUd|_@*pZw`#Z|9Gho;o;-Kfo0y;>LI-l`#Ogb2$Sv9kWTK?!682^Q)42`FmO zem1d1mEYcDx5I)@qAi)U?V3SDRR;tOgD*qHUj4*(%b$O4*CXo=#Ay3ldhfa#Z_jx; z61IN)+SxMu`QhR-^vIBT{xdygwJch|-8;>Gw!aEay1G|eCg*Azkv&&s@RQqes^Ph8 zUuPAjUej(CVXeWH#zQ|N>y9Po+{4z#t|~kcC0&BH+je2|hxbPYF&(kMl+o|VM#(}w zPw(FFUS@O>7NtO+wnAZ%%fka*eWwj`qadAU8l7>lL)1(}$KO!lwd;vz)12kU zC=?L=Q~@^lYqR&`M;+FA-vAo(v>*Btwy6y!y;{B!elSgda9v5vLSj9JvBg!7zH#>FuS6 zL^0ey8s#C{+sLV};MtlcV-S&5J2!a6Y+yHwvW-#OsQvM-6s|@^FJUgC6>c&ivjndn zDKy*dnp~`2wPu!0jzlV@mN^$4 z*QO#9z}St~F?SMGZv2!;w+j}rqZxSf+UC-uglA0+AcBfYX{ zlOXZ`{V{UWA(aJlEP{bXDMI`VVm2y~L&9Gb^PwfXF?RkfTJGHPhq$#`Ip1>cF;#fC z>-BY0Aa)Tm+F1&QtR4AGK>~4NUZ3DG)vFl`V2EJ*)dcSl`#o#a5*T|-M~Rh=Gw;(; zdd&7T;z&^MA3{H&QLZPTW$9z(HPPS2mVxLw{S&K9C`2MzklpOn?G0sc{u%=^-Q>d$ z>u~=AarMcoFWX_G^ChZPg_}w}I*MiKvIawzRs=JyFTq*${9t$k)2IFVt0u-Vupj{9 zSfJtk=5Q|dRkGuhr1s@UsCGLzW0@H8f}dQj_;GdqI8?XamtFWu7uDKm@A!Oi_fnc> z04Xc!VIXMvU#+80MQjI+cu|aD(8WAcQ!|2HA2aAHSa-9slbzw+zlQ?Vz2I4byTlWo zG?K!`M$}`EwR`^ctv)9$^Fdo?y_6WonDGl!65meSPyR=I#`v<9B2OeF#p~^^^XGoz-F(vg)?`fA zY}L1ASt<-TsQaC_iTJ(84_ZpP_INo6E<%+Ucj0%7Ba_XYsaE@MZ9|$J8&s7RMa$JD zkyDP_E{c+%lIQig!NQ#v^lSH&iI_B;Kh5szp&`s{Jd{oZWBH) zKX5FsWczDAwR*IgE@5e?HhpH|c)WTs`I99Tx_V=<$A7^H2f7&a^%VOv5Ij=hp=d-4 zWg0)t5*JZA+jUWYw6;eeIEONEdcxYZ!{K*n4euj|FnprXki!j6n z@*E}Int$EM6W^`s;rEB%E_5F?9N|cBIHHz9B_iRmD%Pdx)#XaBm3!Igc>CN*f8L!} zXM{I`9^lcbltOGVZ?c$@AN@>OiYMEAebmnnPt3%gy#|b6E4<#MN7%nm`gX7rC5Rwl z^~u$|z7$!{Uo~s=#K|^q@Re};d+~GHhOE`&xjBJ7`qC_nY zr>)9^v%heMcHk2b=m(IxO$0Gf6&<}j2_1AC+(3-v^>o*Y?kp@5ZAyUxbus0N1A^=W`XrmhqHlN-DxWq?^fh z7sZG%?~$IfcWN>Ft{mz;-)`4jL3UK=PF*}SpF&#{fx3C1R7c=6AN>m8ZvUiuDT`!3 z^?ogQR2e{+d3_*mpg`S3N%7%q2cGL#Px16IlqUyjpR$%2Ilv3zXO=E?6!cnn?_Tb{cs zgpqlS;|3Wt%eNjk{>GV~&r@_@!s^c=ebZns*i6gqQWx8Hq{faYsi;Qj@<9)aFr{HD z;lwBA9agUBwlLnNP{N~;2qxlNxS9+nI3W^r5?fSGJzf%@b;Et?N$`W1H1gKiu!k!qvB%H} zvRz}+>r4`@cNK;DaqQi4gVe;>t?PN?L<7UM+E53&c%7?*{WYi*RyrgEA8GBx2{OUp zT;;S0_o=OMsj(ibPNhyBQRB?)?R@iN18v2vbF_WrI(mMXD5`6)SjQXIFr9v^QbQh78@!#xPQl>$33`2|_^Hcu3n7twwUqp?l2Q*w@fM03 zEwO%itf)r$%j3Rossn01uPIsQ%0_`Wc2;|Ph=jO1%QjtqW-l{7Vb9jriH7pDhiN z%Kxc!x@Ljk60@5%C-s(3EtteAzQ$O+-D=g|1?i*Q%{51NrsuMp%+7vgRgs8xGYqOSp>fu4pM)tPU zej{_i{=I(MmJO-XjWEAaW7oLZZdJ?w{Zt2sb5R^Q^`W$s#FIk8QaAo1GOnX@*b)pw z-14}c7?wnS$%WC($pK2kgf-FlAudW+$?M*s+r~+S%k1C_^T$S zC(+oF9Hw3A40%FLWmW>#f}Q{bBMgwo(G3$n6bNA6?*^ zCBbyD_N&PTcs`~;?%zQz`iSO2Rj1I=e*eFOHgCK)i3}P&ETEo@d^%KMEW~5r%@O|s zl4@Nhw-NsgN{C&6?BMZTe@8ewTX|U_(Tv2i9c^!hDUB3^AI2amYw`E#W+zRC(6YB} zjnX|THSt*DQSM9-DB-(vj?$ajTdb^}Hs=Wgj;gQnX{%Z%CFG{`j0d#i38k8`8yASIB#6cU7} z4SwxJ=q4I*jd^9AWn#YlXZg3jZYF-`+(gw{foZOS;Rdc=Dpr6>G+@$9e^3>^pyt=$ zeN;zg5$P(kvX-$^MNKL^VYlWMaAm*FC=Vy?q|T)YTVutYf0Y?Zr? zy6SfH(PLXK@7Fb43Q{;N-Eo+);^J3&-Mqog!c~GieN0~GQc|Q9tjfSM*A1^{qZ}aP z;8zgt&#i4}XayHY+fu}$kDHLZvr(;&f8VOJ101a{j*IU~65M%ACj{@qrx6&T_S9E% z6(UQ$S7~+(bQ7hYX>93j0_nhn=}Z=LKE#APUK5+GCvL2B+dq%VMG+{diJ`0RX6RP7 zu4RAtp2A*B?q#Z63dDGg3%+GBVdLd)>UZ5vE=@Z$+~(t6V;a_;{67HFKrO$V`CGoJ zPfpG_ah-1VGSE*%B*)z?G z$>1MbKh!1ice69F_JJ@E7?OBwIy%TT?)}XSX#{@mi)MG=e8*7lh^GQ$kJs@DbWnrg ziu}&_&1*!+KsH7@fUyfs43zV4Yb&yQ#_gzhV{ZEQCPqE$e`uIj2La^4+}o|bm-|<=O2GU&UZs|pPN_k?M3H@ z2j>p*OZ?7+u)|lnFb~lc`EEE`izoyfAtzrc0qfvH7lwLA{$#-sEV{W5l&f&p?b?S+ zlZLp3f3%%rDiUGU$G6A1B7sYliz*ZRB_whTA zKjE<}IH4B(MG!h~)BbIG%p>0Wc3-8>;w1!|0j>a^y|71Ha@z9Qp_-r0%ld9`{8JO- zp!}g8al<_0NBG6~M_j>X7d^sgRa+T>9`=eKA6}xaAVCxG&JfaM?ym0Aelj=fpS@Fu zPe1XU(1IUKKl+ndM_-+L?EABGe>@}m=QHzP2|4-1l!E`|SMc=I{PVIY6l0S(Cboci zDv=HWk}G@2iEeH@YZ|rl;?Eake|K8)vjMS#T*G1K4^GHJRGyGn3u_?-tGU&J)!~VU zJR&^zo`r1CiBLAli?>}66)U0NEKYySH6mdDHP&L^A>W3_uwF81yN|bx-*f5pr6<2V zJ@YB=n8$o#zTp}DtqDo@k53rA_q=!>IvzNU->yA}eX8rWQw|Tnxp~8`{dCSzEHr0C zmqTnWXk==*Z#_1A?Do;S$}r*>2$X|$af|lnWyvGl!v?#@Jm;VI>89eyQfsxWS<%WY zUszB^^1-&NgI%LP+i7+P0eXgos`N2vWvlL!MuCs|>Wx&VKZac3%8kqBt z&*7iUh$%L4z*_7YRvNEOIQY1G#G>pD@v8Jm+yV$uEMp38Ya;{T6H_)7*25eT`#=*` z<+eTR0k`n?HkIFUTz`izw)eDZR(^8{OCE%iWye|`^iO*%D5a>8t$J))F(XhmBGB^8 zT1-wDs7w<4M|aF9d3S61H{GNB_MQa`h^@MbdMw5r5h(h1vyZ9>gf5_8Zkw|QyTtv` z8G*puZil1XQqb~E)VV)!3X4RG@U4K0|b?B%2 zhPfPk-1ESXLsMU$m;U=L<-go=W3ca$p`Iy=k9Kj+aQ6VJj)Bl$wBlA>?b{&X`urOY zdL=#=oC7t2g%Sg;Q1#)qvWGolKUtNB2&5hofr)1z0!>Q4&o^n`S#C)?jr79ru08uu zz>x<7bN*>;%s1U4hxB7U|YvsO0E5DeY9YSBJgo-t_j0q@9LT=}vasN|%w($QexxgrH- zV085`w}U^P9ADVQt50yC+l%Z^x*z(Ee`H(@2jvSO<|?4%Q4t8~N~iY2(7XrTqUR)* zgDEr!2~jTiW>6lrtLh=wsBv3)S&8<5`7SMi2K?FSwU4@PMFdi@5C)GX=h`&SZMn~R zZXGge^GJ_2~@3&t4?aulk6SKeNo!}pT16pEdY?dag_STBi4|zs=?co>O=#ByKHdZV;dm#Kp zoA%qqDUZ8F1|F<~#?0b&(EQ+qjyI+r_@4XDCtdbpAM^B-qraGU>b-Rpzu9s9nRx}@ z@=N$+_jzov#Ocs!ytS_QK96YkZKsguh>MR0!qoWcN8ES+W?ovkJYt72%4^nM4~c)q zWlPi*dL(F@#%$-}tGrX2l5peuAx9q`dvK)tp-0ASe|LWJ{=z$$O=^gNi6(#EdKnRD z?1lmiC@cqs5F7|+yR=F1H=m!7G}JA2glEEtvHLz;ni(UHrEp|%b15D+v0}UG&`R7fS zfk2R3pb&NK$}1s!x5g#xq( zD0%eG%Y$9Q+_vPw>xme81VSwYLj)S`zU!wm5>9pTp)BA-q(81d`H1&{r+mYL4pu~! z_MWWQYAkd&*u*R<&<496cp)g_XnS7-+LK*5#53yIX}niQ7ATkJyVjm)y5Bqcd$TgG z$@^PVQf`cJ*}5U87Lwq!q*Hq_DCWh$sB^c8JUg}Nu`xS*WUmG#gARr@s?6|GVC3LW zx4t|7@aEjxDd#(2|Cle=tT%0%DD?A|lv~vf*=Q3m| zd8J!>b$aFlUWZ48Rc*UqNx0CQP;@)IwENIyYwRUMY*|a}g{Jt@=C}*DQ%dU~62!3Z z!*tM-*(!epm5&3+2Si{4JI*z~IyLEmKW}{hQ9WOVL)BSLdvp2eK_0Pw z@r^3*gL}PQ`_;;GEZoH}wt*<^O8Hy)d%I=W1IM!?pF+7y9k7SLVZYbxedCe#-RoLAVCqL6O@}RR-+2a zVtMqGFo>8+?J2K4PmDh_E0vejU`A)#wVzCh7(8b8>?7^4TA*Q$qmA4zXXZqu@#*pL zkBm>)c(MUgh4&Th+>?&kbn+38#NV$izb@bKpa5_V@Z@%jsn-Arf#Vfc_Mk`9Yjblh zb#r|RYGsYKmqOB11j3N32~R_|bL$3o_Qx&754j!i-&+6+fcz|{GsUXIijsiXI#|s6 zGn1~!bA3oE0wFAYys-=>3-NiQQ9Zg=Y{kA|*yQZ=T7AL*a8yaG1v*5aMWq2-Y4oC` zTYF>rfd@a`_UXQw3$jm#mJp|5kx))voAz>0#3LS&3v#-|&+^Sms#j0wjeboJCpbc$ zb@{gjdBv*;Bvru2;mabBo!?H$yrm7Dl6n95#Qi5~Kn_H}_m68%4D|?qXT^ytasiicSSaUVhjs;l~T|R0IMYltW`5uS^~0mHh7u zPXh-A2CG36kOhJm1TUZi?N3`TJ>VYw?(+1jvhc*HZ7tJA_(s64qUtEj7vQf(psO8> zK!e>5&P}`kbA~p0YmS7yV*jL{10sl@530)I8`N^VD=kAT@SS z9vWha{lw&qp}w&hHGJUkSF6uH?iY@|7&O*lqo@9l)n}e?-@pIF9jNQW4d=1Y-hKQI z8e&HardYLnyz0m|NA38{>T`wdba0RXUJERsw2MaVSF;Zfa@*$>Q{9NsG|`{kvS`0q zlrz#REFhfE2UG3Pgp6E|nLDI67oK=v%%KS}HIN702SKnyuW^I{pagtTXp&ERbaUsA zvTm&2P>9)tr6{xu?!`9kH!BW*Yuv$i)|Z!<_((Spj99~p9My8@^hx!Eq5&1yQ>Rf4?bJ+WICf9Oc)ZdfcSW2$_U?Z z_lRm#AqxI}P2o_NeM?iWf*r&_b3SYYdRdX3(VlINxQ6R3r_bw9-RH4U+S{~(Q&oxh0J2E z(V+wkD2_B+{O8YC318m`gl>zMgP!?_3vy6jx6Nv@S+VJnC)pT)AcL+ed0Z#yruMYo z!4W>Op+~xK3Z-A{)qXW6dZ_0v-{`9t)DCQ7LD9t(ci6Z?&Ip7k z2wrHu^StGu3F$*8q~zCg7V`ErsKLSzCb`jrKZTLWa})M9%t7=np;mjwYx`3^;ala7 zI=T-$sJO*ug9l8yrM>8{MPB-V zg8~k^oGRIX;FJ@VgMLkpC>iRR@RNBbs^}1T6#>Zb0(0XFANGj+&a}+z+v4C5%DHy7 z^kTgTFDVaCmTKAyvyKh+O_~^e9$wNQe+XmO1@lwB2fppMFTRe0@&)*-5eR#rAI;8t z&^=P^fgqtQEg?UW4JFtEAp*H=$pJ4~i~PMJX2hN+r-lzanE;mW6kl|Aoq z;H}x2WfDbH$Dv7d2XVqDuJKb$j~46$}`Zfiz|_Q<4+U#%>x2Stpuy!19Fvwh^)T~qd7Ea=6~KI=LELuZ<}Uco9F zdM;|v-VECPm`C{R923HJmw0);u3)uc0fCj@Yr&}xc*eOz)ni1!7t62)llHp>IcO3X zb{0+8O;kW1(iV0yYIE_^KCy3xW?Yn~)q#L=ByfZc@Ofe^9QX(duYh&(feZs(EpO!s zccF)PbEI8+K6u}QzR@#I*x-DPYA`TA&AmM)t*Bl5(ZoYTJr7MtsK-1aSj|m{e=Caa z#~x@mBM|6=6d0hV$Yani*tOp+N*OWkP(UQ(7RIg|z9nS;V?L3tkvE`BbQ8#&CU$=K z{Cp?YzEO{Pq>SBG&8u(%zJ+|c|Pdj#OHNav^UIUiGFNNk-*!b-GljFl) z3XaVeTV>aHtr!bg3&J^0kuWh0U})EpfX8LDWWG}PI$njt;33IX zI3%iCT||N%!201zRpfx)p%RP$W()L%LfG_zoVIUIj2|>+_m=aVvA~D@jar*F(sSpp zmL9nzkC%WBd=e-Cfjf-dCm#$t`Y&Dy>rOYqs-S0#4NTBu$MO4J1CMK17 z*4`+89|*>3f+5re#$JEa zGZGPKQFaIDvw7ceNHCKnI(mXrv;xk${M+|=CqEmU>xe)q3i6)T2iwaAc}9PQgnzxnX^Da{7IqF=2&wF$4&laHH|n+EZ>@AMxBjGqVNb)sA2Q;}@rco}z1T1bosA zyvf4K&r-@8GZdzukN~BbX@`m*_KN?v1&l!0)<}%Ewc50SiiH5& zPD$_p5v(dOtZPrUkMv6%=^Y(=nNOpsPd4lm57h%@z%KtBvU z1}{G+u^fV-gtp9KVsGF$M(w(W4UOwoY6&t(1fsRWu%Salpa(r-e=;-vbT`Kcto^nX zjQGojcjg_z0_d*X0YO4XK)lePy*BUoVDI>!&Wu0aN^L_7v|5+f@~=MWkA)n=9*A0k zU07|HHSjyLj&?oZvj2mv<+G1#_qj#}r}4uC@(wZ^V!iU1>+at!J+`<=8|)MPyOnT; z)G&GhogBMv_<6v#N4*ZtK4!tFp<$<4pQjLJeO}j-UeWN0do5k79M@f zBTPjg3WNWsm4SvltBYWkh1^?!I1EMz(cZ8vf5Izluvf%{1i2my7FON|`sIo<_j|_p z?dJQxGB?Q%x&<$2qf{ag)`H_B8ZcPEDe2N)^;tK69$Pf@@$EGy26^mt-OhV6d~!y0P&WM~ZQ6H(Glu#l?Y*KcI8r}o+?G$a z^M*0xr|8gvnI8s*T0p-=MqjfUEM@~r$~EnkC8gi+O7`7*8nT(pR^Yt9scf)k{Frt8 z1|5fn&tlSwFrjeD>plF!NGrOT*QI@bdfuRM2d1ar=6Zswl`9($0p_w|4DguEfPH{v-FjWzV-yBmBh|kXT!a`v2f81Vyz2Jvy zPM{0u2wI^@UY+@w$w`CU5AH4CXE9NNVJ$Ohe_neGYf`KpBCl{XL0NrR9K5>8YG z5$M&>WB0ko%ueLz{!rqGK(rai^U1EN!7kzBw&o*GcIrNm0F)4t-Zb28&zsW^U2JDJ z(PUb9$&+6DpAAfkzsr5F@{d?zqxr;$>-Ue@|McX;FZ*pi)l5HyK?lwn{!z!|?@Zf*EGBNM7gjn}l~;~J$V?H6-0Mo!QE;kLR5ePd^3 z@^uAuoe;H!&Dv{|whRx5d~a996)_>S?UpOpx!8jE9~$PD@XziMo{2Z1SV)dO->_=G zU6lEl=bnJ@0*on##u1DWKd^T>W7J-s6La6_J^wa0FRP9BCeaZ301`MNT3qYa5(}zs z8?{#2In>VO4t{%kWs>n~FSkc$8?~PYg%5HKAAO(>@+emTg+LogHQLib>GzM%`j&6J zUqT&10{dgv8m!uHRu&BQIEV;De=Xw&zMzI92E77X#`$qW$AuvRVe-NuTrz0Cp0<0a z>;8Av7F`pMgdxKbT|3gGeP>$IgZ^m`dF77Y$-7qIg8tq_7+Z4&d*ZP>&LcEp>Z#Gj z5u*=9`5mep;T`$GuBtbdoqX2+(Dq_p(6(?viJn@_MtfryCJ`^df+mIoJ_!w*>{?c% z_W0D}|LPLEHjmx_@0wMe$aiU6hC86_B_pv(dd*fEW=(Y2YE02Z5 zR>od59Idrw+|hQHcKL-}cx_tZ5V!D0+;?v)Y=(+~k5Mh|v7__R-0Vp)%JuNYvA(wR2x#gME)o{{P*oESG|JL)-w;EVsT z<@^xWT>*Ov91%!2P4pI4GAZWDNSB?zos)tH1Zrr4SnIO+#9-IR4>n%}K~4wRPQiA| zdbF2=!biC5erG{)$_?#It5(>cU2V2>%Gw11!)zs{#l#OeblGUK<#z3@SxHZNMm_Hx z7aChr+{K6Y&bDdmGOxVkzW%NCSDu@C>wRWI6gDCUPToKlPzWyxRm4?k z-wB8u?y>)ef%|5~mZ#m&&YQJ!?TqNVi@HBsk^JwjbIR|s7xJet7>21>u@1^c%|M0J zDD*b_KncGixiANNAh3Wuz(EEYz~-zP4q# z9x-;0`<5Imt0_HNGCZ(rP;Y43jmKTL{(4$CA`q7OK#09;ebRF`4D5%YIr}bH&Ub1U z#Pk}A@1~P4dx!mYUD;5#y+50}r=W>)LVPgYn0IG{d))UYrxx9TucxTI>1E@ija3%y zt=Tan{o=8cerI0N)n1OcsF$A*#4H$p=<>h#CI4$s&XYm$F_n~AG|vqD?AXm&54i4l zBq+f>{7Tkc?LwOdIky+yeaV08ua=#DIW%vOSD1Gczb2(dzs`znMEc{Ny8^>cz_8h0 z&0;1ivc)MlZaUNOxDWTKugywWbhP&LUF}l4RwiS#E$_ydMG+rNS##6O-k~oTUbD!< zZh;1tfp#-yBDO)}mSjHa8vdkj+@y$#{AR7FgCC^XklXOXpzzn0UU+VP@dI9w6XL6t zw?)%>oA&ndwr_!R7f{(Vl`1^H+%XT8 ziI;l*urOhWOW3Q^4xhM9X~C<}u6?kzbeLD9+nRK79V|Rr+4;tVbyLF5#$L9UbZ8ek z*nHR7?ziUWKjm`p->1f&>r$SRH@zLJCCt$dEaB83(uTh}_!>qaB;`RJiE)^F2so_# zTl{R-VE3s1F)r?#KIudK(}s8_jPOqy<{dL++}=T-Z2aNW`1L2dFti*4&SI#~(rnh& z9IbwG{QiG(4ZnZV(UE}(&rM7k?iTr^$3c(XXTxf>$9z+UjXAJ3yBcc;n+2mxzdvSm z>X6U2{Cf5IjTPFxUJutaA133Cv1zBFYhp8O2ZMq z;J0`1C+k+F@M+YVQ^Si!{AJ1Ofjh65 zSPPn%y<=7#9{lmfKP}Hu5lG=9;dD++*@&^*hWIBx6p%GEApLQVJ&{Fslv&%&d{rL( zhqnO_9NOjUSjiXKUiIa>BZFMy9t+GEIX?E;pr~P^R*cpF#@vE%)ax+p9M!eGHT`H?mLJ3Mn66|^{ENbPkZlu z&U5>dA1(aL+yfmQsbETqydwfl*_<)>qwT+#k#!x589`E>7nTLXI9cEO z(c1K3W41l?>7hscj*Og;^{{{H$Vo@;AA9hL(L3DM9?PqxZrK8jB?9d{Ykq9hmgmQA zPL=1Bz5qg8Bte4GRHoNttLfJME#Sb=kJrqP=Cu)uE9-RBf)4zV%i6rhK3MFrDi(R@ z0d}Igrfy2jjJrJSqZL02*nOs(0SUv0h4b{d%0c4}e9J9%gikaA!^p|;Lp*l9qm8Zy}ZB@7SyU>(je_8FnI}cL~ipADP zb{gICIxse07EIn%c^%LBC*C(^Ki2P02Bbe1l=ZBC`cs~9PmSI8{HT?aHpbuRmSMFp zLMRL17nwi?lf!0#%Yr7eui1YP5Ifu};hS!U9-W-}%%sCut35Gh?fXm9WAAD|4^196 zdXw*-a~KrbA;!Y4{d#Wd!=pBOZaA!8nzL{X2l{k$^5XVyC#`w>gM|~}u!S!)P}HgY zd``lHt_OzsCJ!H=kYCE&)SC$N&>lw0BKI<}`YLPCUJuxVA$!y(?6HaQ zg98(W1;$||J@U^Be>WpCuA~Ef=MY+L;Pr=<#|D40Va%dP5K-%%6LqFny*CUVvwi6J zxW|H0AN5asG9ckmuR}vW-SOKwsWGMeo)%T=*eHuNK&{>K4mhh=_SM1H@jj61r`}aA z#|-L^0b>ZUPK>J5rew7LabMk2({mmPJUqfT?osck?@x;VWK-d)W6kPQ*-&>!H&=Od zNwzNJVAk79I{#xw`5?c0A@4fheAbLTXo$(b z>saNKgC%S7+p*z|tI@_Dxb{R~3bxh50uKLhN>pH2QARy4IKVgnn68+Ukojh}HZQJh z;{L+S(mU-|-U5|gz`A(x0#j~VZgudUoXF#su}te$kDAC=!jOg7ktI#j4xV0>c)pGg zSa9U;+O!?nRg=TZHs{_J-)AwTSG~0$b%TV z!eaTb8P~sx#cd+sY(~pkuiG3VW)3kF2hBlkS`a*_A$-*8YQ1HMW~Ce)?5!%zBcdJ5ck-JTw+If zC%rs1%VqoJ&Bt1*dSpQ(MhSsCL7MUkEhF|r7L&=?W#JS)d|mU{U-`=1qYrt7BaZ%b zX4-<(y5e4biegb*(d4}a2T$|5BE(a(Z)JLQ(1DUeg*Q>i9$Mk`IZR-LW20Hyl6-1j z*qQjV%{@35qlIJ1>(IOoUU_xekw<+}hK*0eWSn^5(%BYr*>?2ejEH0V&(tZ4LR4t& z)ixff#=JO~a|zAGVyI6^yq<;#6q??MNQUr`eTx=?umlOwBLlz8%+oDd)t_xR_CioN zBG5N|83koIlio zL9=)9UOJz=)bE)?iC8d}cWGF_oVjH#yKAj%wcR$e3JujWIiRCP*KRUcEPQ+!>W6+W zv~eSKu9@GFZ4(Q|P64hNlo8_PrZm@4D95(5QQpAll<$t9E%rABcX-+AQVYvr;;`CY zaFTJ74F6Cg$|0fZ0uoruN7&3Z6Q7Vl6CiL-%26T&+?*L2RT9Dx0|82at3VHs!72KS zwFx@~yAsc9F&eC9SO!1DP}-~&weW9lUhNXf3G$%g9l>@w<>I-B> zY-Z@PnlP7v1HLH48WVDIeAoii`E)6_`qHGlQ#;v6RiCccu5_>j>r+&LCR*{ScYxZE z=|PB#JE#IVsz@RLI>K!nRseDd1!_cw7qk&rFh}JkGbmr~&^T$5{hjXpS|6t`l@ra&QYk0}Hgm0>8XfE4ZnhsI^xb z$O}V%N1ic(Awd!@U&xKmuEAQ6ASC!gHZDQn5>wfifC`mXUu=f)sE{z|dm<%|F>nLI!^QkOI_Lc>OKA&RTR=s~3@|Pho+vR$azS zv0C`e5EOE-)K(8XFcf0ss3J!Zn}583?5Ij5s+yj)J=&QnTR~0l4I`f~fR<4U{04cZ z5qWA)*r5;!D`Wy@lgZ5Q`+$d`2SbQO?MGXRzu_AGmt7Sgi((|zQ?|f=HSaX746dwE z%eteT?9i%uNs}Ya>4pUBqGEssA`k$*=9Wh00t&0;F^Us)mNU2Q#cf)(t^c6Fc_<=G zN&p!_%wkEZCtneK?II8~3>_)Uka6#pZ-~Hjp zX1FG}0C;zC1k|7nrp>o};RVqcs3z_RP|-`D4x{Y_3p1vGg;s3DJ{}E898!R|1#1fC zu`{4`k|4k7O9AMhSOta9^6kCwzbwbD)yUs?dH*3inj6}1TzGk&R2PP&J^vG_}QKHanl22d}xbg&FU~zfKUOUI8m!GGGZ-X?z zLb+NBP`&1MiVcS=Os!xAAuXD*S6v{)e+(G1Yz0yvsQTLj@dbgc90{UG*Q6E1AFY!WRjZk0cjt zjJ^aoKfzNmrDhxgAi<<4A{1+cCZ!j=@B%TgCBed<5+WwSAVdK4!3b{X2yLAmlHHpG zCUFhu9`y}GAY;)FUj~}8Q0qWL71g@L7~oc6=IA%Zlx9yn09FrNK;R5}Tts8kA_1TK zBgv>UC_yF(Hn1>k3uX}G7a2nm2J&7r9}$&AJp4dhvXejSj>Oj|D81Rjw{H<7aVo=P z?J)BTd{BbmVQ-~AwILk?ZHWFdcP78#`hGh5Nfd6xyqVze9y)G-3_;vmkDjIx9x5#RyWY(^9W zWqmLNU&*5AaaSi#ND#pcGFGsLhSi_JhC=F0rL2{dxc1wHCKVrC7*xoC=n*}2Q zryf(U(L%OpV(x@8XyTyKF6&*49mN25;tNSA4?3V{)LjY^D&atSdf8BkE$GZ3VVK}n zdL3jyfIs@dfvWnb7kxGGHQfUt!OTQ697SkVAA4sZ-^}7$A+Q7*I~HYDOE15u0u$}U zBxD0ASF=k#qbRORg$?}jnN+wN+BP4dp*dpu(bv%Qtz5@|lNveMi<6#eD**|WbV(>w ztoVz)TCdm#!vjwFTqf~Z$@j?EiuMd&!mW&m12Q;8SA;&o1wA!RElR4sBzDT3I*9PE z(a4HKu3|Z5K!Qvx2M@Y;P6e929w&gz`3BLO<;gwh87>e(SMIW*ikHi};j@5<)(q{y z<;??}=_23<taZ;$>Bb%rGbFL^er^5<%iC zYPfxb-Y|?F_Kja_<5-SnnZIzA4mMCd;RLO$4(uRmw*x##h?e{ zV>3ia(T2Qfg92S1%n>A`%>^|OeoU5$6QV9Z;T!(?%)}A|SRljmDq`ylFSfO(EIzUX(CW|kk>JG(f>@xCCuA%3&Hk(@Fp$Y{C0C4s0P*`>o(#raX<*eWj zysbzk`h-DS3|N3eNIk|28sFNnLl69%s{!@`v!Ur@_)Kk@sRMn2B7i6xJLF^m0M(HT zHU%IEsRWS0<`PHt+6I$Ta`p!@lmv0HWX6b-5a=+rVk{)abMYq|T%3sDvg!q(t0?G| zKPfBa*#7kP*sZc}wD425)D_A_(k}xUSq5g^f2yHD63Hz5I6AlQVs%6!if9iT770R7 zu{o4T_Se%aLCk#g;YS>$R`!lqJ&YQrOU!n|tZ5^j+4A5E-f_M;y>bI<3kj zxB?S%lpYyddCUTne2S1FVq8H2&4nVxz&eB@qE4VrS{L)2v7o?_!T}6mXN_`!@l=cU zlbH#_MsHe}cm=0aG7SWj0ie*?W9Eeu*{MpQ5Qiii;SS?xyPh+!EK>P=yO>k{Y3#r+i?wE6i7l}9enK~5P`EuC7w}zl3<-m(&ff3K(#2I1wmAx;D;Z3@*(S zlZ2s%7Xi==vlrB;U;ePa)F->gQx!!ht(?kyhPw1KwCIx6fs{+g)91Yos-4UV120uD z4{BWg8Za#&I|q(qE_gC3G9+lI5{oGesiOa43kY@H+&{@PwQ!<91CEXN*XeiA1mz&E zbjUu*CILSvXYaVs(G5vCFPVzsUOx{M2@Q}yRwc@OPbD>uB5Fy5!8sYBmU#HFs67gp zDm4QE!^cZ@d?ksSd-+SXf-X(4fZ$>R0Sh>2iiqFKjRK^_kcp1v3M*VTECxw5BiDve zEmevVXu?=9G#pl4Fb)!bF(`KReM?4fp8_rwqT+L0vK>)y@qa6 zk5UT&N186PoC@j*QnUsxZJrx2061e&*o9w|tJM+}Lp5STslN(ATCfx-gx5TAhL$K~ z4ogjJus~SO6fY~UOB+lG@;nDBmq%~~+_s`mP#EHgK0A~={6XTyKg2mse#{WLqDcN2 zL=GG=s4)T5cX9Gc98#>27o7rYGuR9%iUs$l!-k>|G0RixIhyOs!Nu_syj3( zv41n4GFAIOqQM}*06K?fp#8{7R7Cme;A zC$5f!X+tNDatA@Sg5)@t>CGEHLX#$_sL{`}9;f1jFisI~rZhrEjEyC!`{3BPy( zPs}-rVkHkJKdM23DpTud(iC9apu$-Qf21y~LmHlQZkT~ddq#;aw;tXYAhEB7A9AQ1 z3FT<6bj~;j@-lPCMG)|#lOa>c2v!&e(F4N|10K|lB9I~hDhH#4@u%lh+QV?kH|^;! z;71vjpjxPMSqfQBc47<+%Fr@R3s#1vGDg%k*aDx# z@B_ut7n8NF7Wz(_4KSfBB?}TuaRU1>LogXf5*4cl4k)ReHy7T}Bbd-|Sb(I@Ru~N& z9EV;EiX(tT6v#lbSS7G)7%C*C9%`PK8L%pm>l7>@cgn69fCjHF@L@uf0|gX$U}tsV zbXD^gN0#ZvsID=HH)m4xE$tfrUI!I{#4=&ZNkop+Fn(nUU@*B#z?qphv1md>0X~$C zF{XWzofWJXLj)(2MfA^U4a?)(BNBn2 zS732Ipd3t4f&rD*Uk!Yn_due088ej}ptMdcIIEn=0YvCma<9ttQWVl|F)9vBmguaJ zWs#KN=)e$z*R9=A2psYP9heBPS*F+a^+GRTQZ$9ElsZwwsyVo^Wn9Qru23oOAYOB}UGf(%L21nBFCj>$3<0+F3!3kQO$C`PJY73nMlQwnqn_khUesFkex(Wxout5p~Z0mptx{Yop{UT6KU3eiV z!vXgQyA^3AEI1~VULv&cL)+F#JA{$Bqmb@Zqwwm(ca}N8QLNhPr#cRE;1A8;TMp23 zY~?6NUa5|B`ao6d`21x90N02Ndf8XnUmU$^#7CPR`E19ZSDuKv(A_9%!KzO!vz*Ow za11LLAqgmI`mf^tIT`v&6a@#7FG4@n>6k*tQ7ERRi~m)@*D?YreL1?#)CcH4To@zs zmsI|ZptqqLLbl(Kuteq|&*cCRt5PQ{#7Y6JWEgY|U0P%@JSsjBRIM{9G*VOEZ$|D?^^m36zHDoJd>NR~O4zfaoqRMK|(H)UlekHL= z=~n!j5NE!B6DDW|5y)``Ullq?I1BV*b*?J)A{`T1T{d;1j(TVBt^IN!nlzDwQ)k{; zB4gC2G=N^kgQ72I&L8xY-6uFO34M8|>If>!GyMm(ih|w+mJuikPw?AUiW3+ik@Yh5 zqn{A^W&2e*N~K>qO$@6%XNu^e^H*}n*r~NSYeb)F207?(ltD*LOh>scr*ub06Zs|E zA5^7)qZj{0xTlpm`C{rz zYAzaf))GF?T>ym&-=Qn@qn{A&Idh&kiu7Ok!FJoC<^@jCD={&UW(~^Kc3j~*r;lo{ z+rXDaASIpyO-eow{fepNK0W`sF z{u;=9(9@S1x;_U$K}qFII^1(|FMPgS*P#+gI69j55mCI9KAreP1$X99;Lwgz6hW0E ziHh_>0i3FI58PXN?-}89r}uzV^hZ$ADp4I3B28cZZ;3!e106@_Q01fmQ0n41vOq8F z&!rzYOZv)*sfr!+|BIj+>sd8G94Ti}zglP32_olz2KV$r&#F@%Rdbz!UQ2M$>{oOz zz96XDemM6O^grRbI!IHlW)NhQ=JoXiYDIxK!K_3OA`5Av(BwptLrWY}yG;hnp6o&pFyfZ{iu_=SAi(dYx~Mr(Eo(z z>Y$&>OavF{siG<)C^?Bh>Ux@9f}}T;Up7=zuYb9qImS^z|9l@%$$fhMFT$6QR7GE? zPz9=|U?|TYB4d&l<~rq(3-ug0kHgu;J9grJ{(u9QF){fcqgr?D@9vsMI? zW{NxWD02{!U%`=ss#29w4^X89z0gsoekDs#c_>zNE3F*Wa!@5I@mvWn^H$~IjPw># zFY-%?0Gg{FvD(o}P?dmsGoI*Ko!vcElKR6JO8_VVBWF2rKmZ(-4kaV-dE))y3nkLV z*+NvLdemP?1^wIJOXN$yiQtg=^Q682QY%=xu2gdTC_qD4g&2k^mjZ>L3RJr1L?s1+ ztN^A!S-(cA&mNrAn1jHwwe2fGaw6aW@&0-Q!cjl%U*!Z+6AB91p`5=NzJ#PI`a*>i zz$y@V_>d!XCPg^od-0m7S)Oo1(1Cl!1|A9_=6_Y5zc2XvjzC`=x+s7@f-6NjUsbNeQK&*(Wd%^7I0#c6R3W?I0FuxN z=%;e?TnE;I9oi^wh`dg$uZ^PFAJ~e&I;wt(Ge>jPM3+R7(Q*6fTtD{J0aUpHei zYL&u78S(K$fmIm`6i80W^(tK?b<+2X`9i;`pCjpH`wDp0|3oDPl2>~B;-W+VH7Wvq zuG|T1qJ+E`KCd^S@WmnKgq5!K;s0L)@G{!?N`=mtvRJV1F-hW%2USQIBrBirM*6=h z&;MiiJB>h&S`1g8G5zPD+DhVjjm9cACnZA1K}>8Ebu9kU2&BV31w26m$i}In&)CmL zAWjkovLmrXdZeE!aP+ay%hR2almkac*MFS90QTtKQ<}OWsLJ&!=0s*B(FsvdqVVrQ z1)!Y4Rmk_1<5zW1bzE_AlqgcVQ^t{{l8~1O1Vsr=RjvbY)g>2)P8f3d;uR`b2xlj1 zaXhmp_=<5A`#rM{r zQ1r%QKgnrYQcqBnomb<5i9~Au*8s$!f0KIOt5biEr|B>l$_Te^s9U$MAO- zfnYtDJXU$bOE)^@lpzw1>aB7}rAiTX1bht}41Iq+QS#jxFk9;(N03((6s;LS19y7fR0W%23Z8EmrsgI9~tg5muQyWZocBKCMwRY{LGNN zUn+FKk?*(DM)^)3QeAERorY%8M>l~f-{V4p4#`jlO3VAe$;T(4lQhW8-a% ztl6ert-juPx87oGs=itRT;UEJOGV|?7DJarR!|d1ubAP$A@1#HZ>p)ju1*2+WlRy2 z1C1OMVm9`2xIuzS13(P95n?jw?^zol0kHYjpxn4dp%?%P)o1TyHUNY*MuU3PN0XmQ zxAz=Q$-H{`1}cx`=AS;5f9dl1>$TND>gnZ*LB5fuHQi|~yI3xL(W7avRWt^U=&-|K z_nNwCLh{85)ZVDQ*?PB$GgLr-F_W!0ce>izZ`IZ@-btwyGYGR49!0YoE!3h|1Jnfr zag3K{F`B3)42-e0?b?-UU|g@M>+0!7M@{mww%&aKBfmjwgAUOYlMC_#AJyyt9&YPyrG>*}953o~=&i<<8;wzWBfy~3(Bt9hS8~2weS6Ac z5a)%Ag zmwT9UW|7YZbCN?+Bqeap(cA^I=U6(s=y4HNP3E>cO=CYD)!ud&eh|&NjhsL7(FOpH z-KS6IOqw{&DJSMLM8$+QSbJ~OT$ ziG&P4n4CN^FR#Rdlzgm3G(-Et=ylFrJY(*>#W!nOVh<(Gnl|(J@gpl%%}-4~+-{K1 zjw$*kOYyl2QzlKdS&dftpff0-iXI<(FX&A^?kO+OnN7{NV|MR?xCWCw&@bR*?lC0* z9R`K4%Qq&Fv!6SC#>>s!YNR7J86`qvOeBiH2=tdQQHaR{d!`*x3HTwI-kyu6PX$ew zf|9Ah(@zu}heRTj05*5LxCJ?_GHNL2H@6@NdJP8HcA!LF#Gx4))%t+@NXA=!YD5W( zT1TW&YgsARfyR1ot$g2vi(SSlksZnTLZLN7}>7V}b4?XR74L$9K zZhk~+&g>P@(P`|9>Tycgy6-mCT)KR0KZBta9;d0br>geOot9P!4sbIj zo23~+sH5EgQBA!zLr+KJ&FaR68%DW+y>r{zK%cS3u67_pja9XEH)|{T!Dh^OQ*Wo) zcBi@HHrD=DepeZ~Y`WWs?%%vwSzA}hu0tl1)=*bpeXYW5=|VibT2uMX+wY$~e#X$! zsF}OfRSW3n?ybga6{Q$x%+fY&9}qRMbd9_aIl(F7vU5rgIQd7-B+o~x|B&{$u^v4*H(u8G)?3v#01{Il>XRl@{cTe*e9a^A|Dni{>uOPS5P=&=-Z!L3<}Z zt;UN7cJ0iG(=(=qbhmZYR@QJcZRCgh8gJHKx_q&@qX|+Y?sj(@Fhup0SG$^TV>nRQ zZM8SGG*^}u7v<+no-`fnhmhH!XNn6sUokr_Rn*~xx~*RNLGuA%F|ZmY*&=J!(N>F1VqBi3BlvKYF1;KbCbPI(WwyW6*Kmz9;Zx6`(9 zymaYOb2I;pDgX|!rlz{G@+!C@VKQB-tiIdCk6p=H3kxBO+6gfRqgSlZe?c7y8OC53 z1RBWQfqvzJ%-laL{JrdfSh8mIazr5JFde`Kzz&-MQg-Ugo-$>k$+d%vl{3aTqfyE+Kl# zw4j-@XRKMh0j9{c9Sy5DKK{V0Ia7kB2CiAZ15+sV@KH~9kNtbLhfJM>nT$T(X=t1@ zIbhM!c?*^<{PpiXJXc)Bc39OKThARo>fz4OBPHH^6hHBQ&v&x;U742!J@+{ z@i%W&hs>F?XxZ|~f&K?~Z8sXa-90_7-?)iMdFfj9%vp1fq-CvKuow=z^wgO^Pp{RB z7W;d7jrz+6-Q9QZHr)=HwJ2on@(GhCmt83bL%A&0Qd)Kb`w2|Xl`B^-SvY6qqS;>V zpQhwwUA=XEyziJly#4Pn5eM7bI~OinHEZrXh_r3fa)gr;XHG(@Wh>X6Jd(9x+0uZ3 z;1#Pkjr#DzhOX@C_ zZeFu2_xOqC4&%PP5uwvU7tfnLX`=ttn>Si4R-b?X4AatuAwlCkuU64>?1iJfAnVt%Ny0RXU8;I0#~dI{p{oa$U2+`Yq?NV7(6L(>7tbr1E$VN9Ze#ZCi-eaFS7Wx>I+iY+y!Pf07v-6LFY)o=iU~uUC#miDt(+f`( z&z?RDR(hfM)Z~f53m2}OIy2;Y-L>lSVxKXi_U_$3XUVeh(}y- zjk_(gXNDH!Z%Ttb^5f~tCuccHGh`-r+>OoT8s#kl$ATi)no1A+3ufw5Il7@ z)=pDr&OCGejLB|XvvJj&d2<7UrbI_2m=Iy1M7uRQ>fp5CiBzW5xNy;&jO@&l=Pw2X zPhYWkZji70vD`dtwL<4C$j>{DPpe_+O=zIYHFO9;1UxP;Y^k- zTXy8gk-K;AE?Ke!2ySj}g@uK{*|B2>91g~%>UwosNBe?>i;>(td`=b=LJ(~KDUKvw zjg)K35^qQxLxjW<#2!RD?8cFiLcLrLZ2XT4U;7B8Mo&uWZ`F<+GwRb(9~YiJqfq|z z-e2a0F2cCBcQlU~JL-DPwR!Vr$Hqlsft-+#5F8v_Sy}Dr;d`gC1w^m_JX=`e?e3wO z4aEh=L+7q+H)U(dLU76|=2p&d@`IAv&_wG4pHuR*# z#Z7P@-+sHz-^aJ5`7X91K~tw6icXCzQXFISVb$7t#vJI4Lug)3;lzwcu1=rJ^!wN8W0;NtFoqpt06%8~cpc~`RsK$@xpmF0 z+jTGg+fT3Fx@|IbESev(cJpSeNwK>289Vx7anYPPbJlL$WU$!bUlI}zpU6GFV*Vm~ zch3Y@_p-vX*i0SI&i?3wKNt+n!P6#X<(%oUX^}~Z6Q@n??(T+8u$e3_Ix>CQEKDCy zPtW;trfasYqBA*v8v8M}L8nd~S-*0w-E3U9Zo~358~C^CG=s0_s3Y0Q71u8P==C?6 zTln|W=1iI7A2=OCrAEiU{fnQ1Z0*gekH@*Tb(;8HM_$-B&z?Iq=13wIt&=CuzI&qu zt!7V|kahG(N!evz?@2uvHk*0(j*Y?dW&`KVci&4*ho|dUJZI|cxyuaL(J1pVS^V9- z8r!>|on=cldb#*%R(r#(nz#Prt!_h?1-qCYECkGxr%yape5$##eSE-VbxlZK2{d23 zdfDH50s?(>c+@*@{q}n0rR=QK9b2~M<(>+fx)i&Rg=;n>XC~dbSsWZVx}&q3-k$HV z_qzJ~%v-q-@*GKx8t>+=neF~Qp5+&cA=1V*o3?IUTTpNmE(@oy1OyB)Y-?}&`^l)!nr>bH%YVFOGql6hTa3Ke$_q+%ThEQkIpbYy z#-`S`J0JhWrR?H$NKsaH5tQ#Vw#&q^^jhvt2z1TMJpqo(m#tpDYOzsknjAXe?%i%! z`n;LTj%DX)w)XjpretKNU#qz>#>2n9nccwv9!<}gJ}KB@Yz-LiQFQh^2rgZ{a?{pz zRi%Y*|Ki6D4Goa+4`V+*dLq--b}QK11+Ad%8PjK;FFY3;8MSD^Lb!;ujP$9~f;o@z z-=A@i?_9!SQDDd|7hW*3op)UwX*dD>@!M$LaTTxN*;fEiBoz-eKSB#I5IMN{=CJCh}EK< zFDdu)^wq3}oWsdeLl(lP9zT6-$`n8NfY6Y+w;K6JM0(8Knzg6u+{G!L{xGawo5|Z} zLg|GHyV+EJu4vJW`MIe%Z~XMYhG1BtQGa?2s8%m6zdj;G3sTTYTc=CAPy%x7<0E6+LIs0(fD&-B6I58st0f zW__*O#9&_Mwsi-Nce&AY7d?V;?_9U$;ND%;)zyKMr?hnT_y$JycoH44ZNr9Tg(YW#rq5*HwDhi+J?n6K z9_HnltlXs`!3gmU&G0XtO|8b3n%0=@;WH;seE-jH?@kD7)68C8le!wwQ`6$v!Nnzo ztJZDYwJQ>;v-h;uR+afp4!G9X=n*)v{_btf-kh0qFm&E>^p|`LW>ZVs1P|}3TMh7u zYuD@w+Z_e-F?6+hjQ6Olt!k-l*uHvw=E4O=#^-;j6o$huX_i_R40<`hhtwxZLf&0V!2B`dl8Zt3LlpL80G^n2U` z^|}Z6oG!=ayQ8w~R7haZmGh;){pBy_%$z=JTByf3&%Jv$pE{MjaQ*_b(LQ_D{Nm#C zJqF&13<{bNAD<;73y;$kGBW^Dp)beIoEtmN6$_5li)Q`d?O!D)C!$dORUAa1ma7+L zcz>dqn@^m~4W2R&no)l=WP<;c(hHU7MX#y5qr2v}@BC!a#AzYZ76nh8v1IwYPOaW| zs%vfSUD)TW;Dtw0)4_4h{E2xdbN5BYELzPNfSy2@?2O!y$wo>mYjbDLn-(1E z7Zk8*>zdMn?D5p z_VNxD?=2ObKIiW}UQOuGklBahleHdGT-g4_3#WZD`u&gv^Nn`R!y};ja;0W%zg&_x zYff-XYTD%4OE9dkw<~A!rca-X2sv%u{IcqbrE3@c$DiMs6*_Zz$n3G7dECC)47su0 z*K7u?z>eo-=I3W^+_3se^;O?#GpIC7oZb#^Pp`7_tFvY;%s!Hb&Buk)XFmSSyQ5cI zFmL7I};gnKdn5#jGC0@43U$|HV>E!mH79XFuVEz(5`6zUb=NC>1 zoQw#Rl^8!YWD(Z**u_tr=$RB5g*{NWnNOj}$EkWR9y{ef#sf@^R!|NqDY^*%QeJd+ z*2Iv~Qx|4T3AS0yJtqCnA0UCe)nd9(aBh;9kJi(4IyY^>j5(-SGIu>9P-fv)I8tlB^W7lrfmb5Xf54O}kQudDEn*9DwephxoJF^LAxlf(_;E!Q<*daH zZ_e!SeSCIf!o*2icJ7%zYYvE{C#S7ku=q}Oo$r`&yamzSQ+@S{uaC#ATi0CN#$3J* z->)9ap(f>1zKs{p9|;Pag2_02+SL4<6wT0h_x3fhtBrp^KMNY(vNDIkVytGfft)Ff(`2#2}1?!O}C@+qa>~5ISK_^p*oy zPApk9FDx_muGagPKf84{7_nPiG;8wdQ~7(t4z6CcLu{e9wB*G2sS|E>cliW|UF4R%)z<9rB!--v$G+tDGdDN$)`Pc2NU8nN0;Ourq#PHR5 zkh0sFuM|&r|3EX{xqPM6%VSax@4Q$#yIMwn=6=2E4tt_mZZ=%-8UIOhQn(`R+J+;kiJ zm-eO(3szcmlg5iDkIoG6f}4gO7HwV~k$kZG*5#RgE(R<1kJ|L$Y5AF1=-|9Lb9e06 zv2^*ewvKknB2akp%+#PM^uso7>4GI0$!Q0+?p!o8#AIwt&5WMCWHGo;oH+aP#R|>b za{bbYxeI2bG14ai_AU^k{8 zj#;^E{)P=J&YnHq*m7sAe_$&gJuqm7mH__=)z@!MnKCOqH471_ru@nuKk`823!Sy> za8iamHb_7R*RNl{dGluE;q>6~qNAfHO_~IES6EoctE1p%vE=4vzxUod8CjV#XV1zw znr(*R!zaiC2UycE2#HZ)e+v;Ee{+_X2vn6MEMT!hL*hzSCD9m~NXPzh;cFOy5G^=V z%sS0hMj|IOB_%$(_Il0Xlnftlf2&Cw_le7=fBxjw&6?<#a5rz)j;_{iTQ^RbJh8U+ z`lTzEYwBum-MZ!J?uET}UG43wSFWEran|)Scw0kGT8f9)B-jGn#-Xqszx(xX3eS{a zsFC=WC~fAum9?%Pjjp&{ZnRlOk8v%#c*$-yo;#60*(b=@VsINhIwm&aM#IfhB^R1H zt*|*ba0ppiSmN^0$8gr!X^B()13_*|z^uf$j9a&Ee=_RN$Mdu6YOkL@Rl+XP%1qVO zWgm}v@A|DvnR%H{ef#^DD;wex(}RPjbKzsR_<4>mI$aXJ?_kK(Nx&>PmH*PquV?2` zPHZnU>)oul-QRijmAtb>a6s;(KPWzxT~>bHZQ^vb2Z{*WI&nrwMRo0&lLeE<`!?LX zff*HkDDt~6|KQX)5=l->nmGya*fz<>H*ELbJN36#ELr@im~gM+bKvZSP>xOw|k z)?B|-b{0{v;m-B^Q^$NKPUiCyR>S-$6C)y$;OX;I(n9>aA!k!d;~zd5Q+un;Z>-=QMYD_;K5OWWfPv}jge->I2NIri?Z;6UHZtkjm)_D?_cIG%sHzP2hfbV^EAN@I8X zC~v>|rY3m&xUj7=X3XdOR&&;D@^|-$Pf71EYYP{y-MM)$rhivw>sSw$!r~%77uRbg zC1s_>-+uAgBgaoRws($oA9teQczXx`U@n{6w7i_$M@Ec1b^HXJ$M1giHh0f9TS8p2 z=lGe3YSZQ~PD)E`s4ekv{Zn_3Y@O^Dv$5TKQo!-z0_-X-T{s!w<)Il&GpA2pvwC^c z?dEfZC2egD>FIG(Cr<$vFVFEGee_9n?bXEOxUplsy1K+G@e#l7)oT|`n;mks?&gd+ z3x56Ux4K&ImKUGyY`L>+*^-Sr_b4}uY0}$J6Xf#Y*;7Zlx?6(+X71V%QBzaB|G@4g zi&tU+#wWblla7#?6XwrbcI!raMfug*n^mpG8=e!!R#x7GpPL#uGdVUM9B0f5IGmYM zf460ni%(|W>FT;$bvJIM9nR!_#cG&4bLxu4D;pbH&J-8cH`bj$l@sLc0_q0MK6lmP zsH8)d)_UL3e?EEkRGX=HQqaVlj0~H}e7fM&2OoT}@4$XqkJX|sZWWw3qC{*{V6ox8{{tRWn6Z)P?c+uX)|I>Fz&$Ix!F zn0!P=<(lmAIWJI9s+#DBI_sW{uic44O z>Tln?)wp^4j_w{lR?3mp-I}saDRCskb@?GCDl8+lb4({BIHoik^JhR$CACkSdy zH|yq24?(N!oa1#>H zw1ypwynVY7mDes+q{JRZRm08NnX{&ZgihOY@Ia4|Pce~{UAtLRd+0zIX4~~^R}*7n zu+T}2Pbn!b!y37)qBLYm(1O{sQ&aM|P~==OSS($!aS@@R!Mk?t*uLlBjXND>SFXn; zC6m3?6crI$d9BuBvhLfpbIIHpana#nhvLdBZ_3>YgJ$c<&rF;UJazHLP18eX<>q9; z12*2OkBUpf{Il|pR~jN>BWKNBFl**q%un88&}`M!)r%G{Z8P$Dud>n-M0CxBJ)~iJ z$js2WbJA0iBf<^cSjk_TG_?YnZc9Rty~rt7n4(T8XY)){_^z6Gb+xX&&kRxEvv9t z?Z640Ju`U5%)=S!y{0ZhZ`Xn7*gLKKgJz}Y3R02|qm%008qH$FCj2E3kERbS+r8wDEQW zsO{f-ATvD!6iSMUV-qv6vduV}TV8h2)P5&?&o=lLK5H&^6O|BGalMk}+E5!6e!yZh zba!gQAxU>n`^Jr%Lub!lvSe9P(;cI^D?TxXCT-VJlG2LL6+!IujFi&yi@=5k zLgy?9o)%J2P*7P}9UTdeY-?|8S+{2W+`03Ytypd_bYH)AIWd-=8gb=FZVmzfG?Si^ z2otKSzXjX4die^7!!sZP6&Dv%6g9cTr$Fw5uJ-mh`(BS1!VG1919K(o;Ppa z(W5zvkqiV~6c(eKH*Z89{pvFIu3fibM#!{H8`r9*+AJ2^mMz=nhtAo(bJwoj`+=04 zlvY$!f-2D)kARYrlF-o5nKNgeIdi71t!;t8fddEN+~DzM&z=pP!^;8FWHMo7rvy(0 zLdE4vSa&X5ya-C5L;`S_BAX82(Jyg&_AmKw0$;xfgxSpX8<*Wy2}1BET#aB`0IzD~ zn|fF!GT3O^_;IeKT%y|4CFvft#YUFTSn@gwx3qj^kAI~Yt@s!+EtAi>fg~p|P7OV) zmo45G9!al_O74RthlDA_M}B3y!mGF` z)t#CcJqspI)c|DgXw!O)Y$U9EoHmUg(C6QBmJ{S5GL^&Y6*j)HBemkxY<%+xrw09x zfuaR!`Emnxhw@S+ORQF2ZD&`N;Jp4pn$)aO9)#83?6X>oRy%8v_$-vs$QG2;WYaqB zMtEMn?uiqNt=DSpggnI3Ae=}q%0vko;Y|7pIWz-Lknc6fpOTc0=o%C6VY8?=LU0Po zvMmz%;h9L*W`=}(y#}~CWp)2R0bda2t_Iy91$nd?T^5Dd5Ux}?X<>kIWP3udnU+R% z$qOzb70iq`u~DmzM3eVOCQqJRR0Qv@mt$J7PC(wNBu7*!$E|8rLj_K13K^gdN zj#|-wkx_p@b5tqNi~0cyf#Af^OQjVx;{cTh0>r>>I3y$lr?45-P*8X`MP-y!3O?5h zKz}aCgEH`)yqsNA8A|48$Tz4ozAxeF=~-7-hkSoV3RDT0DlSfH3RJC=mpq9>=-*R- zvz01`04no2*_^Gw%PHglDEPWwg@aXyE5R>D4+aI7to3%lFY%AP!$f3sH?CM+U3v+= zldmm{V^KR8ETgapR9;uS0CPwnjJ#}z;TL$FV%3VZ^X4vUYiog*gj4G_%Bx~#gbLm` zMH68Si?s2x8A=+o=DVd`7JE;xjcDY^hjEqgWWmH+J-j*%lJZB3CCW&ZAcG2m1ZJH$ zDdE*&*4YUizK#eix?Wf<9J0koY9f-w4j0{hCjaQ#ojc)5N!4sr6HmlbOt}50!Q;fj zmp0+OdJXWxHiScU#hC~eL^ctlPk55RIj@^(ww@0Dm15+0Ccy3}Hu%r`ZG3yuj3^>3 zc(Z_iT#JuRu!%J5vf1VRO!3#kN?ybPx`Dw9ZK(qgO7)ixUPaHdJr*qfoe6EjGU4i2VUIDT518Zpi6p!FSW9P1qkO zmjtKW-!}nSWF~yhXDR2X08_wOt49BGt<#S0RD*w3>1vmwA|FGu-lshH) zTq^)dup4l9cgLRFiPpafBv*M5cXrn4sR636e~A-NuG*@=rV14(Q9&G`ef;?GM~)on z&k;wQI?48Li$W&?j?OBuP_hA>g(yMZSq^Hd3K>PYKd9O-mJfh}uji8poUx|xk3UrZ8P^Mi?(BZ zPY+D)h>ZA=1PK|0#F42tE`cnsYJ(^}m&5|LvGsI94PXLQ0FB!hD;y<1MooQv$Ce2GLJ>Q#xl;v*XD!SKmh1lg!(@?ty| zc06)N$O=R(%7&s|Y-J1x11KbMkr};WxWZf|22c4}0)$daFBQNT4Ba6I`WPsSyc#Tu zMS(+SV1#IAv?08cArk84$#1l_m>4{OPeia`DI5qe&{MM!>k`nB7aU1n#*#{AIf|eq zwo}>wDL#?Rp=XF@N07`0ezA#TL}chnNCTj3RZiVgV*V#J_604K1Hya}Y=SDmkuvoI zX9+TDiaE=jdF4h`UV+nZBBLm)LIvuye-mfk$xiuD1z+khRqRwQ9yI&oD?myALbwG` zb`nQM(R9kwA5^XL_&GW%qc$Q=B`C^HfM6&AC^J$|-995@(^h+y_v#{V5E9g0Ec!!VtkiksM3EdrLs zoa$JgvP_DVONA5Ug(Xsh&)@}gMVtuc9s~+-A+@eHSR=~eX}C;=?}81Bt;=i+PL^pXcfevE0Yl$OIh6TSU+&kGk@a zM3eF*8C_DwEO5{c=EQ9fY^sYvpXFEov3E*iPakrtl>>hnbliCo#m#mMk+fGcz+YGc(DuB(o%gn5AXr-TzhB>}V}J`7Ze{ ziRGJ@&bYg}y1Ke&y598c>`F`&{VEXgJ3q1X+liT=Y7yW6fJ?|DLpx57c(y6PaShjr z91~^m(n5wVS>DSEa4f?@<09)Ypb3MlAaAW?$VTM00Gi7;^=Qa#SQn;V3_6V+-sI=UFp&jNF8evK?e(&$$=Q%U}z4+X0}D36ZO0`|K6F!4l3e z^35R}0HA{-if9D{cL%VC!G2-_0px>?bDrBmN5~XNxE~n^CkiQW0&zNtf#|GaSAoFc z@!<|sL_s$NJLut@a+32Dj_I<10GAIaL_F`JNPxS18(mn!fYu90fGoS(6dbFLf<+5WLV5CcSnFspORqh`!JnJ!vAY zgP)j8iiI?A>WCB&oauQFc|c4?RN!(@*rO;foWa;VUK?*f=n0`1G6Fp+>44$U4A4GA zbd6TDSAaoEP^N_Mivo$$-_Vd7u^UFq8FK{Ye)i*;7Aj3nN}1o2l~8>B*c}} z$mO!?>GM4C^h~T;@UxYiLN!|WXbTDF!6IZI4m-(v!9^Gsyb>OYhh}JjIY1L`YIi#L z*E|IixWu`DvX?%Dqk0^~bt(${Yz=!mj0w)u8(HKk-5C%G!9y`xN<>$rMh&sI^w5tV z!7fz^YkX=z<@}pt!XtR<17!-wX||~grc$C|Zp?%C%J=dd(Sm_>B;|qteRM0rAnEfF zQ4FSpJ7kmeM24dtbmY)41Iny$&tC2cXrd$Tg)K9%*jWe!_b%tTcXm|{=v>SPZUW-~ zY%(Rw9-@|81^WzPz9269Mn7C6fGW9`fuigHIs(utm`G4$S6RpkqDBHF!8YM)z7at| zKFWaSYzGFHMvzsk~K*%^filG=w>JD^3E$OmDnbW0<*Dha*q2B4y6*MW_ zC*Hb!=-|n;O#P+nHxiN($vo(iKahYSpI@Jy9C7N9UT;LGrx1tRf4B2m%=PPWiR_8^ z_?>Q?QKarMvGlW~2yHXvn;T0HT=eu09Y*tPiF7J6caR`jt72#~g5 zm=^J|6aK?ub`up_5l85=3VJbtM(9mWOgeDt40cTL2c6=GE-*ST{UR!PMOwI%7b{Aw zRv$Zd%x0$tQ#?j$!>)>i`4KxjP`&ng>h_; z2eJtnDN*nCYjL-3+)SW;UDAuQ$U7~DlV{Jzr)Oav!P6`k34P&Oq9M{0P`_{(Im|zu zI54Xe-uO~Mmx7Hr0Pzw+Cg1%yfYpQ^Y`0gqd>G2c75B-Ci5xS*9 z(Am3xpQ=#NIdd0MS8gZhL0o#cDiNfFJ#LF#li(57r z2JsRDLI+j>GFE0(>I&2#Z6)Z@AFf(j2y}Ce0`z(3M*|Woi+@{_8iIc4!zbansFWsA z3WC^Z5H$*55R{NXA43NZQI&c4)RkCL7lWmJp$A(Q@l%>;NzKtIJ(O6sY+2zV#lj;m z(t}U*ik$~BBbmek7QK-!+)ccEx=ayOx4uKMYNNv=RxO-^E#%cJmsF|}lV{As_2YDl zFO9rf51R6NH2>ZQE*2RlOhcT(*>TQEcJmA3Hm{WAX{;6*aw`TnKLGzJQG0; zMPr(N_(}!p0Xn#TJwEq~wO*@Q?J1`f{4ETlt;3p;l31i<*{*#CiD?(FlTeq`$nUdw zUFP0HhtFTJ7ER)=UK~GuB3kLQQ`@y}b}I6!1zJeNqx`S18F=_c5%JDQ2gnjS(-?0c zREZTQ-IXK5Lg*lmBe%-eR<;nVkEP0ahFp}}%E|!pa*;E9WM#I0H&82A$z&sU#2MI; zjj&DlDLc$^9OVq_$U=tfGr)OPlM!r+tAdX*aRO)#A&NLMST0Yv+!sq2tS=P=f?Wcj z07wNf8?t`Bh6?V(HxY2==t%}nsdQH9l;O_Yb!zK|@+#F=pMKM`@310e%Dw#ht5zd! ztLaQEpid>Ao zsx#Xs&z-k*=MKRE7Qf4yo11Hbrq6$F?^gJ{bm?;D3ya0#wwXWw{PR~o`obteo5hUD zGwX~L>oIKd-{-K~ECz$YW&xQ|*mPM<76+{W3$_u&H2#eAT)TXm3!kup=~Eb%#QW&`~eGMdqcDbyvl1!lW0OP8Gu zBSXMR@ij=L? zqyJD$gjSQCfpg40(x3F#Z(6swROKoct|uHmbYR@bp$!{0-n3z(Rg(b*s`jr})Yzy? z&rT6>&_;m*1^34N$v{$+K@!0aiJop<*tzLpmFnn$N43f9~ZvU;pxQ)o1K!sjV8+d*$tq%`X3q=!ohSO6=IU z^4$6GXI}r{?8TVd7tcNaNV%@vdjI>)4^N#swR^|r7oLBrT8*mhJ9jsUUCF?n-77!( z$cwdJsaf-1KmF7Yx8LNI-@9t*qKZX|msF{qefotRdk=iqph53}{e4zL%=uHVzwlg@ zDo-?M*GX^loZGwY(ZZ@l3l?HXJq8ReRl4lEuhx3`h3DV;@&}{eKW^NFDwQi$s`yyH zfg=zO$+Fw3%}o5{;}0Kt=%Ff)J}$o2>T2Dr@duxNS+_~^Mh)wFoR%Kl`&6s`OtmUi zcW>K8L6bHp4xKLZty*t={>~>Ye*W>v%4J)&YS%WjQ^g7ofA`hb2(`Jnn%dufRq3I! zPd;9C!@7-#<00)@zVY5W&0Du>+qBV`;X_JRdMqweJ$}lJij^MQvST++Xh@4jk5nl8 zuUfC4i@t{O9zAm4u_vont@+GHAAMA|Y}ts5S3yoVGkUGzjTc`T*0&${qi)^r|NZJ) z*}1kAi`GGSboa)O-+g)U@>QL>4J@K6QK49w_g;TFIx4(emFk~<^V7SpyjZnT*~P2Z z>D=O>tJm+etLM)g`E-?sDwTVvL8JEI!E?tC)_AmBn>KBpd+C)bHJ@3#X)Ar|<0Ga< z>eIdBqYsrTTekGTfdf4bYbLIQufMMN$PKaUw-^P zJLyJ7YC_?1mDcY(ME+st;pD4DfdU2h#(l^@2*tP;rYM8ei(`O+Y-cyEe7umVV@T&^ zYj%{V@L0RB4%i>m`R?l%-+b%L)tC=H{^p18>Ri8kwn#Bm?WQe`oxl3lzutJfa7p{^ z8{fYFUil~fW%c`G!%sY-Qf*i^=jiccs-hKl96fjI!qGR@Jvy|%bopwzCu;T`IwI=mA?$&U?B26|_dZpTQd8#4KelIA z#d4*-Ytnkp`Aa2Al7=BT7R{PJT&9dUC#!M& zU(mMJTOUlFI(EwVk!8z0eELkp^vP4o6fYfjGXt~aa;Tlw+(#a+QSFhZFCN|d!zXVb z_Re3tX2z7M#S5vntl#XgIS(BP7Q6-SXH>_bG2TZIA-LS;e$(8 zsyKhunu?D-*{U`D-dF2ZEuMVx$;haS?K^dS<<-|?FGW20Smn>Y|K-f3n6JP3qIh9d z?5zaQhS5qN%YF6!r(eAHzDb|?>TCZhq$+m&==mPq27dJJhgZUnl`Ec(Aq^wt8 zeEYMvKaRV6Au2i?d!RSo|2*QzzV}{!=A}2^%XQNo2c2k-A^gO)TbIL+A3Uro^62b^ z8_%CST&|d^LBn5n9Xk4Wwd!xa`yT&|POr=Avg&v3+?telYs2d0MOCU3$B*{y+gF9m z$+KspV$(Bn_pDor`-9%2#wY5X{kjdTQR$JZ*CRUg2(9_jzcJf2pQv84aN)1M`Fj11 z?JvIm)@NURo1KvrzNHa8_RH>7R5zCF6knmm@azkct(UVo=a+m8HhH+De^11V7OJGkE&NYIa9 zAdl_p!Ce(ps%lR>r7B$Zg;(CPIGo9`*B^bj{G(4j^Wk?tJ^b+FRUds~`s5KsOQ`lo zMBDxTMN{WjQ56OQegENyk3ato_8eDEA9}K=YTL>MM^Bzo6?5O_dZ!nHE`$z z=uewCu6!}ooA12({uiGjI(P5Ur(=s&Pn56VaM35qAAkJ)`yYObuuBh)T=bT0_vURM zD_+*1)0;i+a@DGZbnSF-+lF!~)jO}h^3i8ss!Eip+py`m0|y=}R%FwPVwZ(jf6`*j+jaww9s--CGwODeKLqpnr_~FOTJ@agpN)@sb zZZ`e3UZtwfB`){FltQLN;)UB^U>Gh21(l`A||_q!&3m$83X z(_$sdrDU7pZ^V@;q*^d*j>%x|)UEr+pMUk@ORttLULxaWbV&2MtWm9MwHjZ2SG&?Gu353PT*;!5 zm#$jHMypZ*aZ=% z4&e@9_4*B%^EyBO^wPgy*4aJul$}*nTurdHaSIYWxF%SD1P$&U+}+*X-Gh6O!3plc z-GaNjI}FY+z`#G>zs}vcIybZS#jL&du3g<-UG?-^e;S8l|5}aiP4_&VL6!{=rtR08 z?dO{TM)}LzUbYvh-Wru4ivxzb<)b3HMe=v{1R>qK-7&)eNFNO+BVq0J^%0q`K^a&S z!t4Hhm!S4|h(A0P3*C9OiS5q%*Z`qS`TYxN8$-*WtF$BJ$i5qLsCk+~ccC;S1(iRfZ>0mSmpa{B zOYIQxBGP@m8X(coV5wSbuzs0MA^er$jiQSi^QFZE>{8na>f69S=c?MQcO6(#AGfGP ztMq_kxGvyGcM`p7Y3=!HT_NafgFD?5EHE>af=sSb?%}A{ecUUeeoFV4)0O(s`!AaZ zkE@23|J&!r(%qUi*V?I=c(L{n z$6n!bV)w)2JjeAC*TE!#l^Y}Y?}6Yke3F(+0jK+w+^)on^}pqYdEK8W0yvh<9$xeu zdz8=95_;x*PU66Htf4D!)9l}3jF=#h$j5U#*E!o2%jkWpn{FUgU%k|%i`p5Ee9U#CY_$&>OjQd`> z-hB1g3Q!bOKFqYt%j5CvJ9~g~?VIiPmklZs>W!LnwQSJyEhTEkiQ!r^QnCi#?Bl2(x5d9>0T8!W`q`oH^6ZPct*K1oEz5sXlg#Ys{#c3ZY#~7Xmdm zPutMNFqd zWHmv`mF3FLTo!rBx@@TQhyHWm478S8-|mKrSUx__jXJ6d(a*#j zj@nm|isL)EKBGD8ge+yh)Hgg1?0!CBJI#g3+|8Ju#jPAys=svyTn3m*JrMJclyQ@8 zHaDuw;s`-*UB@5E)G8V%{O$#)^H*s``u82d_M0}JDP-m3msTdj8P%Vgfvke2QyGq( zuSeOnSf4m8cA`+*YzF!+*Jt*p9!L}@_|#j)Gi$rw>+L(z!+(`+y`Od9VrLBW_y3C{ z(mfn4?RhN-zR$)Wcb)c#lfz@+Hy`^8+VbgeGfv~Z`8O@(rwfcO72#yb_PARMHy=yG zyj*a9ic)qxW-ipV%lh21X%*1wwphFUvUOGG=J-}AtNv9$DsXqfS$r4VNDxcTj?GtU zJRlWtf66U^hCkWrTz1pvC8V3vv;4=;X`=^letw#K& za3BJMM9`xDUp3#tX|!X{Tyb4k-1N&_k*OIQN`w9kRhO@XtVY~RzOEU zgs%JX^g&z#K(DR0c)Oezf$=FsV5XN!RgrW{SFJ>+)$X&_@c@=kl|~Wo?;r!p>))O= z+R)ToJ-Pog=xhc}fW@HGYqvoi9vRbawll6`WPs0uVobgb?Xlu{Zv92UFq_BNWy>(X4Z&0*$e%0;E#3}IC_4xa~q!2`{DZ{{TckZyV zqTgInA*;=L|G7{C?SbO^?8&1k^Ai9`ZZ7-`KPDuhY0n^|&2Y`TLy~+O06gfdv$lz*Gj*yt6@_iI!=y9?-VBz{?pPSZr z^ri>O2&R$3BImX4F9sV?wi8OKIX|~d>(7=b%N2=O-gJl|-RJQJ=5CuhThO&wFFzL5 z20pbJ+cvHOoGxXTo0%0!c|+=3HMjoWByTmQCm1mE>w0sV9gus`T_q10arpujYMw z>aXOD^Se!-$h!E@fAe{yZyOs5d0J>`Nu{i2<$fewDqNkVv2>G^YWx$Y+ho`6G^8SptV|Nj{-cQVb!nEtli2%jG@XEa{mc%6nwew$OGk}40m51 zJ&ZqO{T0>evXO{6l6Ne%xFbiw1$vsX0@&N!I}C_yTGX@G%k@)ET`hGsffHc|bw^Yr z+(369hzvtCnW%0{+48qjNtJAc&6bOeea{Y!DZsk<&Io$;Q%KqL<%6!pH2L=506^Qk zrRT{Hx8a(UXl~QBNDj<|_~^I2 zAM?5kklRoSlFA|U8CK_~&U@E#1^uUJ_#sAh0k^lTVPn8Ilason{d^chJbEQ3#f?04 zT7v3(EYYw2EfH{7TK&hj?a=O~w9T?B95aD?zLfWek|&fVD<>Ua1+ONeKaAnkq}p3>-PfKSgQSpTxDa9;k@&D( zRoE|=3phBT3Eg?2btj&)Eh33hswN6gKZS0n+iB(0%n1U&C3SxjhAUv`4i~Gv_Nim2 z_Zpf;RA$avmk(ft5dVF;B>^^_jyEgZyezGJxZRP#Uizjkt&zPgKmE_5VM2ari<1K5r-AgX_Lz)Kny%(3HnU%wNPt$USCKDTUPm2ebU;gGVsl*zA zfOvn_d_KctuUjBrgk$q5bRI2w`ZR5ePJGz`s|;};r^gFHy+Iaf$kX@a1MR&SyvGFM z7YtnrkFVD$Zf@VBSls78w>b37aQPrRE7n{dwN96~q4oG*(fF=s9$pyQhW@XQAdIYJ zioZ-Q1*nhXWor4teFDxxY%_q~_R?PZ^zVn^iP$-W#B(~OUSY3ehqg9duR1m^#CjNi zCH_iIP)cAjCFiXFVlyd`hVvGE&XW_Rd^1j=X3`epC=U8m{DldzcdXCITt>)<3g$_Y zU`G6}Xzo83DO@7@6c%n{C8Bo}c?MQt?{YBNBPuM9cZi=bOCF-A68R+dUzrrz`0~VgV1B@=K$2EyY8icobYdi>zpOV(S(07@D{+jNu#i#wbkhh9a0*!tVJ1C* zdGDm$6-u%nIU>V5WDJx|>bH251P2(Bg$`UOPvbZ;Kqpp%)_08 zPmMcyI(vTaBsj!C;?~4E1Sg46UDED$r_`7q4VZHOjRS6SGbEGl;FRlh z8bp3VPBgq%ZmPSFEL>A{2!!N>`2UR*{vBV+$4^Aw>0MZ$gWSWfyk%$PwjzcdlX zLjwm4p(&Q0P~>-c1g{T5NyGLGme5Ce7rCB7(#+_DO=j;y>+?oL!#fxVeg6_d3fGEq z+*T&smxpBdJ`x30Qo>t;i@(*#cJ#-4R?go6-2`0)L!S%!0{$Pu|K~~w{{MUx`jQe1 zd?P@l&AHvh^xoq3hil`b^$zzNVb3-^jMs26ES~06`3#{MEm0xw++&415V0A0-zb01 zqn?rd^bsQahnAvvj;wVca$73jKG)oN#4_0Cj<+z-tJu3br1zGO3h$Qbh^j1Fsa;I< zK#LmnG|%_J#c|h>D$l||x13NWS@F{0HPQyo+w`f2a)I_?N2Bj{TQvU}>03ks4o$lRv* zWRQN$aw`^>_$`Gfs}jophibjBT5TXSc@f5eDeP%jP7o<8%11QccIty|u#GmI60K0U zzxH8`t1KF3EcTe%QT@k!npn9Y;z@W~*a9cr6BN`3(R{X_G61#^H#2`_^odUxJTt#2 zQ)fz^xV|>ws0cR*=YtFQu?{@v04U9Wg!=+15COsBspummM&j;sYbkKZG9Trwn3dDR zaa#ErD68#ZWvD*RmrL8eVIqyq(_t{^6d)ALl+wQGSZz^!4ndb)_(h5rtriZSS^y7W z8vTwym2qpP$M{Q{`DZjr4DqLu9(vh8J@t`rK{OQ_%t6uqXh!j#)Pl~Lf~?+F(tx~B zdznCe4kI~QoAJw4m@Ly`LE@?lEbIO_7CI9KLW$ zMLo^LwAiMt`>Yr$Qfl%t6R|WEk<19elflFbtPGZjy96j(U$(ox?{f!o;Phu*2z5+MSc+CBf1lZm=s# zxqP%rrK(2-%(yb5G=QqDRH_EQ5EHm#_7?$t ze+mqD;>RqLvofk*;^bBFKD2$pEOR)%lopgKgYUuJ#c#A9@cJY^Vu@Q)9oO)rBCjOF}5|xFE%ocqc%KB=_DGfBEoGVgB7RjPuU|o}WM-aga|Kr4_7(Pr#Ytk=~ zL?`?7ac18D?lX)H2bKuVF4rU#-_IJ^$wOMCY)u^AV82|BYu2n3)0}XWC3tjN@V_ik z?TLg0pU5m)=#(MY>pvkZyhSXk9M;UI$x!Pj0|xbB+*-o^Jrp@6^~-QATSeTpK29QEGHHco|YkR9HN3oR9;Rw1o`XM5y?f zIqx#Um~57c$Ob|_3SC&@kcj*(<$b7ghNLi@DJ2>^Nt8dioVcztnXKj? znC#@~54Opik32j0hSF6*)bgx&T9o@hYMJ7|L2P)eiHL780i*T{2il?H#*~O43bc># zBEN-xMVqts?*(G1L@p%dSXtkl4JFZP-QB~Ch8Q8B3c*l)wwZXQZvD8!o@}Nu0@tLX z4V0i%WPyJ!93_*{_|WiAz0Vu<_h*-k94Y+4U=p(eMe^H|Pr;0XU;DH~iSB8fKcUgm z)`saVMW%)aYke(l&@;RJ3*O#wvlMyL9P6v{LZ`=(zXiO|p}E+krVM(fjlA1#Rxb%|7<6!|m(Yl7E+*!OW{hUXbWItxryBMF|Dh5Kpzo|WKO z=6Ue>h1NVTGzGd?aRbGW;NZ@KHPim;z*X`}vtZt?jq6GjqHIv1q68urV{z8YCY9nd z=_r?eWSdmN`+^k0E}8fd@AgwvkQ1c|H;8Tz6Ow%_yn_o@9=pabBqPI7B72jNuN5DA zL0-aNB8(U6E3Fm|cP7Jf+6eDWD&vdzOenJwEQF~hBC=D%f)Fm zo0iIfGI}BXFqv&MEQiEJ%G-q&Tk#Ml_$?UoD0nI=QM&r}2P(2M9m9xl=22v4I}NLd zSuxjjBA1gIPS&@8<4`FA8Yxp$D`hmv-tL(sPI?jg$ylopopyy*l>=)x4#$O@ix1M? zHOaOm8Y2T$eqE?ZT3@(G3()CkiOfg4)rtdGT%1($cdq_HCZWDwSO7y6FB;-Qb(~1m z;9XrzpjIp#L|wZTq(?au+qg&J1H{uh{%dj?IF_PqFx`(rz;8w$96X^nbfeD^h9rSI zO3!9;7!!dmj*RSIBW$i^;eon9&4i45gC(?PLPiP?t3V$em}I<7i%i=VCEw66A*>S3 z5#FLyq+BFxLV5P7WGCuhD;>PC)!aIQXr9ilAzt`RkkY-+ab_~|mvMXmjAA?i$ z0fO`sb{-5w3<(iFdK9}tjPg2x~LwxJL|^&6eq;Jb<7jib?A z84puRh+aPY9RVH!t4ne!E%SG$SH+1woB~=y-;D^W+hFYyZ-V4bjlO#^>IDAmJPv_}WXb^^o_J*@D4Gr(bwy1k;3OC`+sYZ3b_StIT$S{{hX{hWZrgxz` ze2HX!j)Yco-I*|<-qyaHbz&F;HX&^w{Qz1&CapI*?Oy62 zi&^q{NqjL|J8s@g6ulT5W(Re<2t)pKjcj!>qe=>OZCN;zO4<*E3*lfb1T+K{Nl*TN zK|wI8n0unB5~ab|$XzMSIGFUZxlT9^PB?L>{jh4H(&*yUDgv>-2H27F_=PJN_#wJ=TcQy}d(6}EVjM4=qh zTCZZ2t5mpw-3AV!k$HFOgTm@>^u#lt#fht?y-(56P!U83!r%Qr3OCC4kky9dbyJYsUcbLIiyv(S=ym90h|40|I$iA7+?D znfeYNsYN1nP?U5L)adLb%HZBRssn1_$5WU7LR)m1X+r{Nb;eFaohaViTdT~5L*dig z(?nrJBNNiOheXSio}9pX9zU_dX6CbVJh0nGvAI1Ie#`gZzQq{Kk_gWtcca!6@VhCW z7E#88fg`vqwhni_F8@3#xx6&l0G8|`D1MXCJqzR9?U(js9zDzmu!Xz1iFG3LQ1hpx zUu$=M4%f+pXOCbhGws->%ei|Jpq}ZVzcp2`=jtF2bzSvt?_%jd-TdMA<8xubAlV5@ zBaKVq$|xRVNel7Ez)c+Es4#+S;flg?8YF64q|i~j`U2ll!p{pP9;a%Qv+sCXT?*X# zI6n|ETehc)8Kz3t5zRT0o}GLL>&loWpf^&cP{VrR%9y!te`O&t`|Xf7WIC%G=YTaO zXsw)vD8-h9G^=M=z#D-TY0i_fesu`1?FVu!u5&U?Qd~NfS1@xTWw@9QI6S zAH&b@o#D+=Gr99c^F&pGdbj9V7Nyy&+{7Os4-$Xr;KKd0m#evnI3-g6{2U)z1h@d- zHRr@hZjkRsaHjC8v2_@7P-$Ic^oXHxeR!)Q5z5X(?{^sC+2mv#ZkvN^L4VA>+cjn3AYq?^}vfDw@NiBQSvO9}~ zmr|te{V&D;^7G-y7~sqbT6jgY z@e1r5!ZiM<%v3nx#_iyRWX$szAB3SDGIc%lAzRcQOWHiw&+nS#p!ivZ12IWi;;~X-i)!ikZ>4;ZygL1Nc1$A{mbLEzmp;Gm#oUALAnbK`Auj-j z)+Q7e)8*a=ppl~cEs^82it0-r)yBt~j-M=hI326BdJ=?gacJxT$iV0_&Zjl9fZKz~ zVg##rBF<)=CL8W~6?wP!;9ToJ-#iLwDQebWJ|v^&C~YPd_>ZTtF19+)Cwh=oE_n&c znW9`SbT8Sm>P-0Xj_v`YvwHDGN?7Pvyko~Yj3H|mRp=Aw1g&-|!67}EARhSHXY?v~ zP;^R1rH1cG_;H^9U6ZGwAFz7l`V+P|sRG^Rxp6_(1rS>Jd|tJ*`B8=B1W&9@YN9DT zi~ondcZWiH2I1$U+hnPWi+fqoOc4I@cW%hxdW+E0#L2C${25zG41{E@J<316kW`vt6t8%`hil(}y%OTeh1x9B;TXxAuEHNO-7 zVQJO}bmEMq;F*phOWw08a}h$1g=LJ9gyPZy;4K#HD{>&tT1Z+yM5vA8-=ulj&}Lwe zP?O;EJacAe7(MV109|p5@;&7HAkc5b&_o5<*NMPp&T_PY(=`+nxDgd;x5(zy3J`s+ zjb`rMk{qfS)MRZ4ixmDkF5lby?3_G=5>8ivPc>ZFb=$`7+VneUpJOqQ^vJ~}2fbUi zkHoplU`6Hzg{3FP>OTQ|u@D?K&SGSmz+IGB z-${z&f1r)mS#)E&*4vfXRB}^%)3NF~1g&(LD#KoR((F3|DyGFxl^@6j&ZHWj_n_3}=) z8Kr^AoS85fH(0WI%{_o0*B_th_Kvm3>#ivS zf*HDOd^T5fZ0p!VxYQQYmoN5lR9fB&ALnt5@9G_zL6-P%tXcju=VodB$}l<(87n{L z2GTB|qM}~x77pbRJ_CL3ixSkH+Kpqbvi`p83`}EQZb%rmd9GPb{)VibI|kl}0o=%d z5Qs-9yvU^Or2qcmv4PjosS7?uTznfepD7jp>Gk%GQ!b5#*W?**!-LCV*0=BV!Jw8$ z6H1fFm0B7;c{WB&va7P4aXRo@oE6t>@>Lsj&7Iw15`BM;(_!_0oQ>qeA{DDzG%E>f za(JC%s(sUH2_C+5TepY2V7!6GYyIzrj*k^7S~A`90-i*oO-d@4y*zfVcjecc)XQbl zs;|A)JqkRaivwx%3Fjtnc-QOgc%J{GwxkcE!qOlEyP@|T1gVEhRzY6$X>w{3^?Z)( z?e*1l^S3RxP2jdu-^S;tQ|O0$-n(;b(mCJAoY&!S^jSD__-ECQ1V4CJHmu-Yti zX~QucPKfCwc)9Tu0t)z$f{;xmG0V5hswER(plp!oRJLQ!!=rC)tq$8h)P!Yd8QxFP zgc&tjtSh6t4J5>z*8D#AS~HJHo4$hJ*N)#LsN|K+jxCAH+ur*SMIi+_`LM{M;h%ox zOS(N=_L9b38wbdGGtSn6dSCJy3k$)-%v(y;=b>^t~G* zd~<)EXnP7PRul~A(WuS{bl9LCwyG!Qm?U1hn)7uk-3r|bIFFM**VzBn5cG9(YcRXM zRz0w=SoYz}qyQ114s+R9vwWmh)_SYK2*j}44 zh1cuq47KnN%YHyZ_Ad#BO>WBT@tg7nfiDUGX8~Pw?SKUL>uc<$Ew55{t6|b=SpOT> zHd86AcdeI~26Ndi5O6()kU8I-4v1}a2!&2EcDpSp4|u?vmCF+hDryf`8F_gEuDKY_ zo0o=dcE*`16+<5^xa>AgR+qP@>%rYn9JR&3fA)&A#aah?a`wH;Y4N$#(2Ie#xOzSH zZuG@bqZ~Z(yS(v;`FG&cOt)jtYgND4;g_G8xs@$hb_+v?roIL>8g2jXYA19WxHxx@ za1%6H^dG8F9o7@y5!Ql_N(~MC_T59ZTaQ~ZIYwC*%9fx= zWF(Uyulo^c#xP{-#qj}%qf+j&TEPBibBRw)qQV`>F?hJt{nF=(CG>UxrPN9jvi&}@ zJtx_4qGd4O%?y|mGUqNc7K@EGV965+HTZX=A5wU`yw|g11in2c-AZWIY}Q$UZLX!V z3FPJQSotg;`@cM#YX+1}WTr@cQ6w@fbBfM8=Ui)dU0$2a9#{8zZDbAHs57semp?}D zc1O3?FRZfxH!K!OB`h6$i6`Z`E|6U$tlfAXCCq!*I<^h{e!R~r$Y9uZbiX=&Jdx}D z{8W!K#MorL3bkwe$#S_jF7&q0zQ@j~9WD#h~t3JBel!-j8zY?|e^ zH>7LweEI%#6;(XoOO ziL%s`ff7DLlON>E;6`5e`*VR*Zl8vIe^mL9dblqLDBwNTYWl(zPr|9B-m2G?zNwHK zjfZZgYDp)cR$y|u=3bYl!{vzC%0qp&)@wjEhNn82#qIgnAFiFrP!x&feP3TOu4x}| z4pBT`0P{RNr|Bqa20p}jmMR)P)iO@=->s-Fvo*N6rBVIWEk(ajsxPZ>XqD%om`x{I;n+6fo&@zl$8!kW-7=k?WF7aG#e=Tsfk0t@{>4uGQxeXUNn63Fn>sx|lF zE%E$6bYKai!JmLTE^NBT7AvI=wV~mLuUqXsTz)s;(pLpYP`5t0|K6ws({j)4W90VR z(}%Td7G%PSx`I%Wh1!=(Zo|)CHX;z@bnUjF+2;?+iJwNUmRYsA>NTp5W$~E6YjRg5 zbVmW82g?LCMnMzltE+$~1NGZo$T2I_(~fHe177}x7vam5Z$VDx189bO?*FYP2;Gd- zV2uB&RLl0bOcN9bbs#^UgAZ`k-M%ng%+X+@>1E{!c^_{ob_d5#mQ_DFwK)<;T0!1q zXol6)%5h9t0&n{w69nG;w)=2O%2FNpy|}f(sg>)Q$;$2H8%*FPJZM&*7u0)t?dztvT=hB; z;|L<>pxR3soKg@EPDfsA!Doac>*h2S|1&^L$K{PJkddSbPA+mKey|= z9wQyQA0LtPW=&;d+I7NlXe8tKy^cC7tTNSgn~e$A>wt=jdHzg11K<@g_3R~kX~>K% zN;}i6<*!sTq{qeWg{r!$gJFgC!*1ZBPxX7$4QtOsL4|nR z*SNmu4#XSmgUoq4&a<48vJV7}*p(zW()BXb1JDgPXKNl2N&)(f1fEPtYw9`3_Tvp* zLbjTky2nx~qM_gO7OwgjhvTbjDGMOmlf;cdLigp^P|&AC%ozT7MxcReSXV3G*?Gy^E`yZvQCRt8v zl)ql{QFLy%TGP0nO^SxAi5*Wzv%maGe*@*i&Ocu2Yqz%AOg2NP_k5eI8O$lF=bEJy zYq!%Xrx4)X&ld>`mQ6+&mAhr%jrZ*$?zL4T1a8GAZKk^$-1j3~KF7pSaAVvT%1zU2 z7SF8Ii{Z}W%-Fo9YHMT<*wqU>j?4@AVoDr1MR|^Ww>D^W-b$5m?71@-oh$Kh(0kla zRj&|uw<+@2)NQhjfy}&u=heg2&OIqgxqCaeV%KjZV)*BZ){T0kgp8#L)eH7kZRD;L z3ZN4*z_vgWhTtc$wn7Onp7ZPuNa$`ucQU{paZA)u$nRx{FwgJ#QI`UpjA!%$l2Zs6Jp`C#7MtjrD^##B7o z>)o7vm=3r%w_i9@b=2@JyWZIyh?mk=PpfDR7&hpcewaMY6slVX+L9i(WgZinB1wo3#kCs- zPG9XBzbp4VT28;cq_tOz)gwPYuGeD7e4keLEi`yBUa@8de1~=QeN%~@I&Rs!y>Cyb zHVA85a|Oadn}SnZdxf*1YTvXu*p^G>_WyC|t8#A54SYL|Y%b7meJTzRp6Z6Jm3+?^d11Ygp^KE@OvMfEsme1k}Q%lCqQP}0lv#MhL(-Q z&`q35ah=V-i8dQRrUq-fQ}%hlgUo0{f{}pbAKG+g)x8%bmK0R7gsz}ZokSGZExcfHyXUR-ZrF?7#b^zNW&$ptz!l?iwd&!b^i@sRp0q{ex zZ;wIcEYkrHsr}PBL6iBxuDWH(QJ~X#XiQg=HLXUgP20+MrEXO|FA$qJJ^cOS}T}`4HmM1vVu8*vq)Nrf-czqn7&J8#Vx7YRbwA-xlyD6;yu357ktBlXc z<Z_=sjAiKLQ6Z%X0x3v|0Om|SDm8r{-&j;YNPooB|*sVada$w zBQ;l_cjuqqX@xt@v-=Pb!#AJlX0&1szq@wbXtUxFe=NQH_CSuHL#Wuiv|&hY8mc%m zf7Dc;F+FGyqk_-0{iAq!@we_CK(KMV#`kWrg(9Gg+6(wHEu>yPM#|^CJF+!7jO9Qk z=<~B+uY}t{YqLq!>cM9Eg3rrldpG6#cjx*fY%D@nogR^thw~PpJFB>{5~hD4yK(U%S`?3Mff#G zzvu{8Q4sv(IxWy*v}F=?!6lb5WxQA+sNCiAU|ck8%+q8u-wtFI0t-C;Eq-F{c|M9h zQ&g`sxVzpR2*`W!dph;pe%ZOPSrmG|{h%c$BLnS%fMw`+b2y$++mGiD>bva3!M`~o zx$1s=UU#lv7J9vg2*O*-)qA~ldKy-z0dgafxUAPIo>ixX464sIz^-*ahQ_T8LPbEU zba~UcJjh`jb|*Vnf=|6h-^?tE1t4yd_~%Q9Syhf*FRQKfDgFk-CF6u!;GKQCO2LPH ztfmy4eWB;4`6Scf=$6VZhVs)MF1uG~7;ND6wkn_9GVoN3ai(7Tc+fcA)oQe>(wdQ+ zvr;UR!l<761d?lNcGyD7a~!44{HN1oP_5t5yy-9m7NI|1Z(LVh z%q`PyJUW>*)mP|HD5}=%!9FUMj3b7U$|0Cj3(&&}%1t_P(@^PV3(l*pE>Nar?#sbG zh}Rt*8i9l6=b)l`*|&YjSEuMcEz6C@lVdupZ|4_ncPI+J9u#HTkaDDlv-y}#LC1%R zMZxC_*KDu(7{SC|??xWtK+O)>)!Xaio6@{99=EzFhv@hp?_;j-qPozT-d##Uvh(?f z?;4qo`e;nzqRgd%J@Bn$YhO_f!*=;O1#1f+=+FC1Eabg5Kg}PxYPGVnOkwlB=kmhY z_8f0a_N~S;&;NO*uj_Xguf@5r$6c;Z7R=wz!W@V&CO`)y0t(F3@0y4|$ZO77~q z6BNK{%dcH@G*2TH=iC9{t#0?eOF#L5Iu7&FY#u|5kBHMFdC2T?vr#jSxV51|9v~QJ!qJ?4|0~mTruU6Aujc0BZu;SLecQtI zhutIjX8Up#n4@NTKN8Dsz5NEt!oQb@6d9f^IWE@#L{jehUam07MV2q;!tb{H4i8sa zvnR~OVLaqA61l!L*)5Ji8>n=FkFrlQt&y@XtFeTJYY6@AwL13NN-Nc?Z&x%811zDv z0#Z0Q-1TDlK`zySj?iv)SFY%n%lqTgJq_ys_!q3F=gR3i^NBHqn&ter{Y9I-VyMb% z{F;{)kLgEfJPCoulPBam!}BK@%dvW?3FzsKnA?-EPU{wpR5aZS45u?o!^bVULz*$- zINL`B#5Haz_t-qo$(4VVP7$do{B=K?tWc@Kl93*gn+xCS#^})(F*^Q0cOuzL+d_>& zT<1SSR{p)|);>t{3NuKX$eBRWf!*>W*}Rph8-cp-v^Wlp(udanri+3BUf@hL7E=m6 z9gq?qgaot~(Cd_ca@QEN7ueBR>FT*UKyJG*RH=lKNOpRQD^ihZ%U$oqK@P&O9v z3RaG>m2nw0sdxI~b>?KfOFyk!hvg^ks!c(YT$wZ1qKne%b66A`B$KPiIN~vr)7Ae| z)T(6wFBt#8_UDvSY2PwAZC{Zv{_?Ng=Mcqu^rc~J;cfaTZ|v=)LROfl@t^$U`#Qfr z`h|`T4#^j^Ot2tgi9m}R7>LoqGc=ye zX^;T7Ng{#0oVh@Cz4on`TI^Pz4$I%C{%RK zVq6j{qT&|mCYrF`fbpQ|jq=r>Jq*Yw%vmxAtLo&16T)^FM9)VlC}KIkKVmaxY7^~E zd<0x)XmyeEx+aFoJe`a4BRo=-sn$OAe>E4TvJ&2v_lrr*zDs&IMX7l3`mTQ|CMrk3 zI$I(~I1?-JY6Al+*bWg2czd|x%=;G}{0%iyDLjH-2&{nnkze^b5r7`MCR2p@^NS)j z<+&4*QKM2AL0Dg|>C;{YSy`JMY*uU7>W@lTdKW1+Gk-HJXeB-T&_yg_gP@6R9=;(* zJ1(XHPVwuDV(n9r_m1zd10g^U2v0{$q_7vA8KXc55u2C0>Z4&*paAgY(9FbVU&Xwx z2oA1cfzVp#f2Wloa+CYm@~!1G@8T^1%$AMba=f${@B2dLuoGuuJj-(FMvH z+}9vBmx=tUXyp-kE#_%aBTeKlVhJZ1T^JUs97%v+|5-Y1V=|6iv|YFtVWXo&i`W)U z!Dm<`;7W`_{kCYIn82Q)TM&(o2$2!i>W|y6#s%oW_|4u4%7MFqAeU>>t<`j^-=Fzy z%m%Fq;c-!7!v}nFiH{GHs0Tcp%&02s2O4y~DGl)|!Tg}HDgN0#8hK|I$=%?#z0((f zLz5P`Id$HrJ?Ks7%U9+lfEh4$=6>6(?w7uw5-^Ar9S(EpBS8QVb!f^)P?Twc(MukN z;-uRNA%nu6wYb`F8BXY!GS?raSlE=tpF1Osoa%%>9U@z?AWI-)){1_07oosIbs{7! z8VaE^@|M#VqZDsIjDNZ?sC)m4$}doq2(z zloEyC*J`AZ?gdqtM~lMS+a(`KXqW2hI7IhG11Dt^Yfn6vJ<&CdHUoCMm8Okvm4Z?$ ziiZ1`B+Cfo)egg9Cf`O-Y5>Hm8Ou7r3VaL|u*lUc8=~ZwPA!eh`UJ=hJjPgjtyZz) zA9B@cPn=2GRG4Rirz4ctyVtGZ;1Lmkk{t;Jl;1ysnEVo(MbN9bVMJNRD1MD3?+krG zR&5T70H+t)WriZ+9iStPlZ~c-_oy+y{yWkXlp`fZ3T~umlUksj4%R}7tz$dpfzJmC zCwYjHS~`p89Vi*Ogu#)fM4$%SQJ@K5FTg@&{%I)B^BGrgf#ESOf{GzOqMjtFaMpf^ z-4|m<6N~PER!Qd^LhW6|xIR#^(U0ZDeK*^O!Ska0IA*hfwxc|fcnC%s-yHRB!#{4* z&`7kUN@69cNlVyB+6W7V9fKfYX%OtGxggP?Ieb9$Ir{PmML`7Tsl9Cd@Na*j6SREk z!TS}H&wj=kJ_sy<&-O!9bgfmIs&A1cz@1Ri$z%`!XLqEpf1)#W+<^j}lzf$X1(C-H zI}aWPPz)sW5b1d0d)2jxyh&G4deLCU4`ZufMtISI(gdQo;Eo4#)L{lew!{qEL-a4~ zD=5d#=s>a}6#h6W^1YuiC=_D&2HTc!{ZztUh)u z1YKc+CFB`Rr=%psU`P_3JTT*PaCel^U_u5?lQ3;(Mv5BZk{JbUW{)B9cx-Eo9-5nRQ8VGt)J^S6KHDW6( zV_Oy$vgEX7Io-;dsQvW2UtEF86R_&{I3G%y3?8n?Et}Npbt#+@Yiy~TQHuQP^nQL+>k;WKIE2>L(o4aMvf z_^I6sMflx^;>ALL?g>L=!o5HLb}{=iN|$vV6Jy; zSy=1%BahABaAM(-@aQr+tC7yG|9AJFwMFkRaEd4j}>~O^v-Pg^PfpHpn zz67b!O35wAYo>cKl-uV98X}0ibJHozB2QmzB`QIK1dzy<^?~IN_R%@ zJkBIs1PA;if6x5+Zfc)_hp`&0Mr+o>=+;vKF;*Wot%#RWBf}y@QgR?#;7SV zP~;m1HT~SCOL*{`>$RN2Z%L>~7H^+Q!Og|qrDxh@U5D35GxcRNjp0|fQbw~##*3he z0V?$sD)kq!a8WE=_9mfl7#)_gZIM~iU@&%>@3k$7~yYm&Gtt0U|HAZa zC%;MPEcct%2>hCf4|Rn=RK$G-()bDCuduBePj|!137u8&|I47VDNe`-HHUa%ew@;t zI{Wt>Bg^CrC}10)5#@mqltWUbHIv3HP%^<+dF!CUB85KSQREze(8KFjk!bc}#pAHr zC1!;v7U7wn3ciOpenYMF@W7z3F)~_HsoD=bS_DQMesT2|^@0xd%jOJ>^&6|<%QW3; zU=Po(5-kK(ZN>9fUgl1Gh^GW}`m(2oaiq>?CG8XD^SB5?kN}J1ybAOQAsOubk0X$| zXg^?{+s4dud)b^t(dn~r*Hm2r*@f8wgzOv^GM_pCc_L4_!S`?Esdf} z{Y{C^>=6%jU7gxY70hMJ#AUeVIA0x#&3(Ae7etr^hxm>H^h8RAMOy3j?@&V#p6j#e z@6l=@-xxb&X74GrO@Sl@7?!yP0PC_~&LZseyZJ_%v-LW1ZJee8rN%%L(HYm~0%uzyQ>en0@ zqDVPT znJVY12LHWL{S@?-A1l{B;GnJRw(jQ^7U;@0>1&p3whNLtkjA$5{X29lWrKqt?UGYN z2W7UG)2FC6@!#|}+mw`w63iyN|BASY4}=wYJ)Wm{Dt^0PC?GEvj`RROqyG}B66G3n z-25<;Fj=S9yX(@Qv&k$l7DPG^r%L)FHn4>Q0HvX=>NSJ+1hY-BBnM@Co{PREh6EC0 z!NIoyYM}YC8to>Z;pWSeEZX2p6t*A0)yAuZ(? z-_Ew}2{YL?Cyp{twojUDooZ^bJ(I1;IN7!)*JR__-~aR5uX=Glb=rHcd)@20FWmcx z5=9?Me=Y0=S@1>rkg$F}mk8Sc<<^cR6CHZidqU|$W$p-VJ3AHID2rD9v97wfrj0X2 zhfy$-*0yV}V20}1v#i{p+$+t2l+z$>${vf~TCZs7Du_frhMsvhuU-1-RZ;(OdXX@v z0iF#=6a}N+a^VbppT62V#v4A<;&UL6l9JLhRN(HPgy-X^kfHG}Ytnd`!Oo9Cv<$#i z#6Uh)3V3GYYC8v~7vjw0w8yC%l}$o!E2c@NjJ z6Yla^_h>4S39xaKG_Fnc@`tb8%3%*Ps2hq;B5~wCa&@V-7)|%$<3}Pur1YAVP5ip| zBj}CxnF#);ZAT24zXD8T?XNLsqtH?r{%CaNFDy}{T`*^^Th1}({UVbEPC9DVoBM7s zrAeMm?&5v_?d=OZgxIFNOm=_fcVl=|*va?iu^+H2mG3bMH($GhyCkpn$07y&$M=h< z>n$H1uJ)S%-vZbDv)=GH-HKa!1xRR4=cb!ietwnR5*p8n$LTU6-~Atte})9uRH6}F z97e5n!-Yfp6PZN{_J*CkW=gT@`n-;>hchKjfQP@$-0$*o){G%hpU0RNAM0UBN4+M; zl@^bQfeJligu1PIAT4OU-FF`%0|f$exgSPb>V$*+Mj9)g?`VK#!S84mwfs4nxPaeY zztj9`03CM=7k8^y0TSQ`a>0{0E)d$Q*>QqWFyH4$1_T}q*>l2wv#Zmc16fA0L!-c= z`sMJ7Rx1kVJOZB2oue(6iiuu7m+jwE))r_V+)A@)z1eo1c}2cTF@2vC{`ZYG#axwuujwb-UGMSSdZO79rASr<_eGW10#^kK1z6krcL}VU=)GYisLhVvaD=^Y1{& z@5M!AI2L6K4rx}}&pL}!`LbB?7@bzP!?6s3tt|jA4|(?(zjxWMyk$Aj(!WvAdnr4t zq?REH{v%%y2r~=}qTO`u6QSyZ!-KL4n-%ckSRmY$wMxKY#Gu9H-L3a1uy|@RoFD#t z(5i~+aQjp-$7;}lF_z`9kj$1bo+DABxesWur){{Lsj@81R)0oQh>`Ac7)w8 z@B2`90FHEgv1&%6*VP{2K?8U|?9Er)18f`xqd#Q$KDH;#N^RhOYqjR&o^*_i7C=MG z!oos=4kKczmbKpQN?akGw0f=PY_obgX1h>;)`owMqigNzB2cbl%Qw^84m7xC7M3Qs zBJET$cL!4iJ|6#Iu~FeWT=#o>>BmbfEl!r}GB!LGTivfh(f4<@LG$H0h=i{NBm5cW zW33JHWubZ|;!C7(vWim8%DJ1ceU4lj4@4u;ZlWJ0>hXcSHXQ!1HW!2 zpdU5_0iJVa=H{sA*EKl&k_uRq#hoWgk&4VO7ClErBfeDLCc^yuMC6o-YMtP}?-h+< z89c=Jk)jlHbI#AtcNF5}WM$7sQ1lw@#mN02cam0+zd#7r{NP|jhQQ7y!&@x1U4R|d z@lk{AtT$yR2UD87S1t&?V)1u$E70UkQ z8IEh?jjOrUMK%lnk-yF(U!L1|A6 ztNo|9!lgn$5~lXM-HTmJ+U;xi0cQ!j!7uVaV;IXnew=a(=8jc~t>69V;BM?^T;dCylG#Exm`>VCAbsqHm4>Tv0ALC5{0zKt1wEx&3&yTu+D zgp3ndmzfjzzFuFdvke~{?{`%30voSUbL$fwcJ_YV#A8a+wlkB;YjXcz!-V0l{`4Pg zjfB{19AF6%^a3K`Q*g3vQ-yT&+&1|y0fPTkl-$+Ka>|vavyGw;-{gsE?)#G%%&F60YONm+y;(d$lLM2d?NidMgB~Aj>s3o>MTHA?4 z6q$wg_F4(ca{stLH3A5*oh5)BIL$eJ5&>tP!3~n}VE3Vf$~*j3{?Tr1xk@XkvLb{`!R8)n-qW zgu3j9oe#@fD1QwE5%17}Mc6ZdI7@GD6ya!PaM1|gk-%KtdV&Q)M0!s7717D%4K3kV z{NVNH*@A!f@+`!5inz6L$*z$32SO#LT{TQ2DM@rLpOk2iRMV&=Qgqs#%4I1b(qj(d z_`^TW`1=`GFO07dug??R(s|)%9*Y%6)nDdLtAF#nj0sx>Wk!XZuus1_!*WY4+ZZk-uwuo{emr8Nn@Y(!$KfdxHoY1OpA+vU*&nLK(4 zUtHjcG92SLL(yJSBvVMJWnb4ZWIMxsQzh`n=EG z=5$*O2T$x9z9iubCx2bCl`;Z7*(3+!eW7~BBo1Oc&NpZLJZ#19j5r4nu!MtCG7Xid zePen&E^S!$a*d-GJhU^gJm`&bGc)?bmIo=ypB@YXq~WDc&Bt3H11zFbPmMVTj*#mC za7I?>%D;Rjmn_I6hfULl(R;TQdNv}AB~P6P`QJfL$k@YF5n5kp_K@lPvT-#KziPzC z0%isAxm`J{FkZW`9k{_i^-QAa?c+ia9Y&s*j+B#@xT(411V1+H=JbhiV|#sf@Wal) z2keQ1Wzk-tUF7Bo5rLUOfmF8QO=g4hK&KEDHvQx%*KMiyu?Z0ceun;5}pw*;liI-oLp_%CDW?wH_Q4V8(avsJlE#oHo>d ztkc2f)6*7m^F2(qji++xtg$QmNw`w^y?Ji>qrE1b*sM!`Z-o}n0FsdxyNnTOS$9_I zN58{v(0Q};4cEgq zdRA>p%W*S0*XiW@2R6D@Ybv6?(Y^3%lA{Le-Agrjxt(;Jw^s_Xzn1QQHWNQ?!|RD_ z8+*%N$e(B%e{6-G7$I?xH`={jpgf{8{)zJP1sLK$g4?t2BLO?Lq;v|qL95H(k7i~J zCkk?MataDY1d{TBK@zd0(MdthT<R+NViDCQW-q#;X+%M&WaNoFd-=7Z&t(5jLczrOg_W zHU7FWP{T@=B38y4kUeNG-}&vh>F_)FxBH5{;@7_}K5JBFK#w_MeJ5D{fBwKv1{QIj zDkfB>_RN%{-&;ivsW$@9w8$r85|j@NLPDe%W}GCGlrZnND`|l?Oug4Ej{qZ@<$t$G z#iDF|n=_S?D0&RUzZ@f+@kv=BamuVVAQ^+GZQVFegfnrf_{++*5K-{F)uainvGoC_ z2Ape4t|_mMMqkhDF)vZ@y2ErYgkOZ7DdV*fCRrffuo;-P-+-nCq28HmB|ajsi)Zm50s+z;CU0AB6{D$< z)NRF=QBkkNeOS}UMasg}M>Uu?M>46)D1Z4md34Rss*s4MIHcm(h_%rbJW871>q0I1FZJ**WaR!5b41pvYmLRc^ zQmz0WR-_ZVYa*T>xOA+@ZEFzUI4qsScOOJNfQ5!m%pMaL2hASJUDz|Tv@kcH62^jw zRtB2KH-fWcF%8apSDO2f3@JCL`WA_kWWiKGG7VIWMl<(W2ls;>D-lKB5CS8-985!X z*SGS430|5)a`kp9g<0-XXTmh1xHV@p)zZ8OjAI04jS!zyW-B-i$q(8xY*DK$>H_-@ z5t;$z@HD}63)>O8{6P>wc+`bjGU9}A=N6IK%V!$wmYKs43FaPk!ARX(3QSlkZf>id z@j(ceHl}pIRc&VMW<+2#*>CBDxC1#bhU7xLB(n4wq8C59uVCZ~SP&yulO$0ds!%%A z;6j`k=scL$H9RPZm12y8CoZxYFQFNNBggNf{;W3Vk2os12p=e+!JC1xtwZr{969Rx zA-=a1Oi~ZdByA^h8Kqt=NHnhr>@ue1KH6UQMUGd?5lhU@hQNXnKwiqxAGfFw-+0kP z;hm|(X(GBvZ!_XtnxzP#I^#0zO+5+kP`+6OiNer==wc)xp0aBQJrwzQ6nWKvIUH5H zlPe4l0s_SLq?5aQrE>Tb3E`PMqK+iu zQG)_QhdRW8dWiruEpwE1@7Nx-m(dgkK8+R%#nq#C$>?I1Jz)V2aKy=y-x}ta$e9Yz8 zokF`6QZylzK_)#zahdJm{-B{w7s12HhLfMHCC+eyoxU?zp^b%zB1f-;j0rotjY7K` zK+#@+CJiS4rXQkQDu=Wagw+%T2iP~%Wd_DS$;lApjV8BvQ0N5h(V$}BC{*?*@CdF6 z_Q1`;?BeMqj8x(}{gV!d?Rr)p;EYNiRK@M;`N#Qvg@h>R{I zGJ%D#KZOVpm4MNz;WN_+L8Oo>8`M^@$bq6WB`AETwQHa$odL_X4x^aqdz0NZ(Mc-S zb4{n6x=g2LDQ@G_2ltn5Svp&^4>;5bQt}r_A*;cCS}G?AGt9~uWBr+tSOkE1PsoU= zfy{IWBoU_gAWRV2vs9Q2o+S**RvrZ?7X$TjHMydO8$`X5@U$IF;6LnBmkumBZO zj$!MvfK!V_(S zR})EQi?*S5Q+F+>JTal+Q70&1tf(&Vw4uP zODnis5{mxZNM=-X0$M1pu!co7MHho)BDplX2XbyiS|FnpytJ7ytQfaY4Q~B58ywko z1XW(Ii#R~g7%4~ULa~5v7|bP7i4=VdBJ&8O^BH-xi;Z?dYVRU&r1wM)U=*bLT!1Fb z3Hh$6N%Sm>D_!5e+xv}woN_CIj$ksmZPSob8w~%gnQD=1H^Jm7mBIl|)d8!@iS{CQ zkzltvAWUDDsyG)_V3I-(WeSbd0nRB7W`9fc3BFnxNJ_9VL6e)kgi+cs-gV5*AG|7< zJI1L_3tXfLrVe^Bh;I(ZkG_8(XR=`VO3JF)zLd|SgGnR;AqrpFbAd9IWC~FSx(Ppv zPDk=s#^s2+UK}-)pXdYTQ>zl5IN3e4Hj=RHv_X;(I*1d7DhzX`kSh{FXmc+ntt=Im z>(?KrFqvE3y=0I<`rhHeTv`zI02UvH6L1`jFYsW_jcSsmFoWe)Fak=+eK4ImF)wVX zN$Y>;z{{ii?kB{JNyH$=wrf3WV6CL{1^x`%B`i`mJuLRQbgJm5h8e8@niVeC~L7 zJIohp(h`_1LUf_1W?hX?jIqL@6Bj`f@4hYF7; z(83~y%Xs{kRD0cmek=EYz;d;?wbRHJFWZU0U}Ok|*!O3IX5_=oDO21jVpn(X|J_^? z6mbBB=CzqUxWCxZkm-|3mA5E|$yb3wD7mEXW8x8n6y#;Ota`9OMBMR`5Yb%{bXN=; zE_tl<(omMcynr2`{a$Xg_c@r%gNNfBH^Cwm4E}8huu4x?JSKCcO4PD~-m2paH(@Y( zSj)Tp-d20=^}dQC|0&UZ}(H3mc_6K_6+V0Dp}p02eK zI~c2RvU{Rf;()zaIiu^m&Q@E120M>FvxDD$nc>|#Ddcof_yZ6S5SqxS8YHfphYo{} zm`l`A6QYjny(=WEN01l57)`_m7OU=p8~muDp0wQ+1z0Bx2(S_v0F}$~GWP&i3YqbWi7^=A;&9bx#WdJh5X4D}nCPrD% zs8b$I%zm`iCNNGsep6!#Egnn7LXys}T1A+lt?4!zm-Kof_vRRf3o^mO)1%JH405l= zD~#yGq_OaxN$g#BOj!QkTm@D1w!@C{d?9mkDw z?Uv7p7OKu=u@#Vsf1On1UkV1ku%+|eJ*~E`vVw5Q*Y*IrRl`<-tfZs>oQk>Mj;j%4 zgNibvU&~zS=z656BEAGbccNq4olkXDbjidvdhM^r$ZLoT=v`-9P*l{)DqNvzFUS}* z%lg4c7-w?@`xSZ@-te~{cy*W{)Gxor?|%In($OJJ)z_fkBX((9OHWRA+3N8^@W`3) zKblR8lX%!Z`l;PC5*PxYvtsk0A|}tHRlC)7Ku=8M`tm+htAyO8zV$ncF#D~ywl)-i zz3JT!c$W_bOZ5bHaFjSDD-2VTGQCB_xkLmMM&r6c{KAxtztZqaKjbN2OwB$A)+B7z|sy#b`r28qFIf1>QT)-=1v`_l_u@VW@uOc$(@%|3zfLr=1CeplRAZn-^t{!M5uF2RLtZt zFJMvM?60v&ic&V^Sf}4f@Sxo5jj7iFB!*`~mHcOISCd%W{eBDBEIL)udRSGlr&Jl% zwD^(>*dI>j^={I>0QjNz`DAwSm>;D$Xfmx1%3&CFu*hO|ow^0A$Mt4s`UA_2b(t)Y zn}ZF<#Q{vcQ?->NKH!jxMJfhz3THQ{>gyYjmwP*Z(At=DsQx~;7bYR_e0WSv#IA2$ z>*KClw{VIo;aaacVib$i(5pmUMj`0g?7F~?mGUxsXu8(wK_+ZR)2N^{bePCE=6$&F zFOGzN>i0KCz0O+G5_W*1M9t~O;0f9)XA$ew1sExLG8q;##S?CxFEvex%Z=!i5+IFE zhpf)$?Ula1(ejv8T6iP~DL-qufh__tj!l!euXL*$xrDDpv3xMON#dtt*YqmcEOOD( zjmL_NHf%~0x%!Jm3k>qvCWW_8rX_rK^DZ~bgvBR)dpG`%*H<~otm~Pc7sG>RSsXbM zD}TIZ3hPw_D&tPcnbfkYZH9{9@n{KS4rq>%VN>vapI?<5SzyZ$_W850FF9yC|NAC% z@L*(X-^cBU*J<~FG@5AVBtVMNA{cs#ak%`qtH#tXyg{|V$Qc{*g~x3-!W;8QJwtfu z-xY^$t@GeHs!+?Xm&b6S6H?`r3Dna`*Xcqp%9T*nEKZ^XUfL}%pz%cp^hr({8|vb| z)NVl{Fq*T(|6mJ?^aVc65h4FJPKtop5VVTYPCcOxP}21iSaRZrY&I|-P~dK^w; z+TWds!%TCN)>zjCsm@pEwwulrW1Z@*xY?Wptu!6GUH0j8E+qV**r;}n=-=MxFn@{2 zds!9lT;C1p=#|ddF-;6qesT1~-%^J^hEouXY={(_oGJif4MZUgnEd@0i#7DQ_IASm zjmh3}yLjUJb8pgaF1S+C!yB`N{iW{M+q)&4FNPxec`U|{=ZZ2m$`7Y6wKyjq$`&%3 ztb)V*I!FF_up03Hi{_B1Uv}ef>rk5UhC-;XX^@H-_y8;1;h(m#I%th`yRiX~ITayhx4Vzp0 zV*sUBh?~gdAAYZ!_n<&OiLZ{Xr?fx z$RGUhJAvPC=oWuVkT8kLbt_z(F|deVN>e`_-z^oZlYq~=&L|Q)%o9uW;KFvUpOw+<f$F0R^!9jU{LIJ;;T`hjZrZ&Tk zWhgT1@mh6!^jZhA;PK9|TW-l)OBeNj z-JR%oTr$4QaJ}jLe&w!zGWQDqq?#rQPb~TQvH~cpa4GXAI#*9Olqb$lYg9ft9cx-u zI#?>%yuEfV_11vxu(n>w9JhH---{3S^YzXI?tVeH>n2t7QXsu23e(^}aKAyzbfpe{ z2IE3znZr`~X+=h)Lpaw5o|_bJd%VPkCR2_khbbB@+vyB3a2?_TNxO;#QC!cN5nL-1 zJg!=naOe)OcmFq0>D&Tlw4EzNgnpO6SakdI^l~`(WAo2ir=@fq^c2U9nlh~gH9rG~ zCQVhx)z(O#tH{LSE|WSr$2xKW2VEYUYmL6i5iKkDq{Iv?q}nCcwN`f#*S*!oinh-C z=M`tul5{pm(MU>64rh<~Oi(L3bfD1+fBVjpDUO84{SlNh(dqOENGdHvDEy*(t3Ht% zU|IIH6pW?MP93|j5_vnGZWn!^%`<_jQTPMua%cKDN)j+hV#(;>ly*kL0f@W#&Tjd9 z4*Ku*SfX0_Um#|BgOK0$>?LAd@>u5PU8?F)%;YU4m{JtWVt8=$b{WGkx5NXe)&ySHY^_2v75tr)<`aPmlO%w~1W;EKlp4<zwW!%O; z!w%3?=~Qoiets+XkkF6a=JER1A|a(vb*FkBTgYL+?gk{!6IJ0LpT zZ(wHM#jw+}=F7_bKsiRV?#yqmw$x(*UvWJLHTgsfN{5Z{Y1`T`>_hULObgDL97WE< zdilpG8+2A}mFcn%ceKEJr?IIKKpL??ei~RF)?7y1`Bap>eh4%__WKY6VYfpc5k8Nr zc{T%)ko&O#Lt6Vv{kA_=H@`m>Kzj(lw3|QPDeuQo3c#h23sf~&EoqmH44nR%_=kpy zD&%#^>yWtv+UZ^PAm?*g9T+1I!=ygA6MCld+5Pz;Hof6Gos9>onl5P04u-!f8P5^~ zu{xB`A!RI?h2KQDLSY*wnZ}~7=bvGeWL=HE2#EP z&+xSgI3BDOwU3swOS&Y1M$9ioE+=dGe4*Ic zS;;`;PSAC`aKgHdgfF5Wg_W|+Bd(Ro*2Sw1ld-}OdFvLlES>k>`mi?Cm5A*?$V~f% zQT3VsDoF~SzjAr^%4DY4cCEOD@nvrqu`V1VZPWe9QNi$JtyoU&V}5t8E&06l>aI0@ zF$8*;En)vqKjq4Kq^U|C7>M&s%$l=NVU!BBMYLRaY1l$d=WoQ5R_9JCf?`2DI$g|2?YEzIL#rDr%9r)4 z*4Eqg{*{(Si&yPDHYjJc-7FkZw4_;Q^(-@%SdxrlwE>Cd!QS_EM33{Bm900df$R=Pjoa8Dj+Hi2xEE%6W*7{Lfm(J(d;_>fQ zIVIn5JxZs|!F{?jdF7ex$F(TFwG|IF;JmM-&eRRTJ1J02GT=vIpsQn)vo~L@h zgk$S*y23`Vvx(J7^|qo4a5%0sH~K2x%@(fi9@mWd|AzN>@|EoGj z$FaR;fo9nN)ftd+#a{;dyjJS`f)*!Ak?2W|QSUf1Z}T%dv%xHQ4mkbcQ%+wprM&YU zh;atWTVwMxReQykt3Au{>{Kofi@5Ceoo$Coz0TkBA2>kRZfC1rPUmxF3lljK3wfrB zva*8ggB`v|9k)k%;5NSZkKY0DA%D4^<19IjtE(#?(8^GXnjttK9uOBac-P^QfBE;f zbg;M+v`_@A3Z&!Yd;D8Ry%3OxkkmT75ViICTu962P#MH(Mq`Ok*I_C-&Ze@4{fkQ z42d`+lfvnhPnBVtpq+6iE&OAZcHR88lMmbN3lRFY(LkN>HK!np(`I#-g{O8ll{Ylg(tMoq zh(WSwJ309ON_gH!B=jOx8a3Dfe6BPdvgn~! zyTk1~_$N&2X^G1op^_EYu`=f-H;cA;Gk3u?>t924C919v}LXRqwq8_h?Ss_Hr=9Qvg-31xz{S!tb(0 zYxfIv$_!ea4CTEmM^2l3?8^9AkC)1hGllAk)pNYW7#&^)++P5%m<@m9=TkF%TH!3D zx}%F``B;(`oBoe>gA{5!jNdP3m5?&}&Fc0TO0JJqk2Pxtc5j(VR`uI#8lh=E&-bql zdf=t4vblD*+w%Jma>h2Vqk2+7+mU28of;R^K@8&EaY`R#EDBMp$pBL*_EtNRz*#Uv=wdLX!tiWh>_Pos6+yM@c?IglCK=9}N83rtGJ! zxlp~cgqXDUopgNt!ben110@7$)u=7TPMy6@H6QoNy9=8ZN3p`$UI)h5vxK3226FiH zDi7_c>L*N_F$<@4%P;cLE5=`ae32@Ir;ckxGR1?t|27Ic58rrK%&Gmu2Z5Z2CyDG} z9evN|WBm@VO$eHAoqkRy3V%=wgttryT|~NMR^e}(x0<%PNp<;Z;-(fpw$m6bQCU#5 zkn&;}PN@}5yaqTy)M~}8AO0eBN;M2ACLTFGC#CP93{$*g`M-wfoQ5-g22|Mj9n>eG zcDRCP5k4P)V?XoP;-SJKXDp^7X6mR~```|)nKFo85rqqjmV~rG3B9*AJ}7A>(h1&I z)@ky`r!uZ1%*El|-wjk5BR16mNVDFFYi2WL)-y1lyI&gaM}8uO=&D3_8&@x7>1Lsd zP-(z1M5Lb2TF8mcNNpI`1UIo-w9kPiNv^%yW{g8sDV0=g%A`z#*`jsq8;?f$3+D0{ z{tDv~9zJDX>%lBKPDS_N2%nN5dSX2>wJ%vTw#|}J`ua}imUJ8_(_1_?e5@FdkFgAt zNy6A}is({D^5zdUBlO3M?KJo;pv`P1a*EO=+%V+e+)FGN=X6r-Q{PH)53%l+HPJmF zlU%oQTA}2Gqdh==LQ?rPV$qIA=`OT~rbzgS$`bjuJ0;aJW6XqGI2MVVWDqoxw;?@k zwq#G0wVb~&?G-X18yA?P+QWzR8sM0!tq&8wa|ukAXW`=GkGI1au2Y3F=0FXm?SA$}Vy1)Xc|4>Z~WzIU3^dpr^3f z?~BsWxb+(VEP+cDKC)S93auMIlAb01eJD9SA*Fo7SgCyWp!D`oYVbX25Nit}qaD#y&ou39btQGL!e&aQuL@|n$r{!U9Ptq31VDQl=^s)MZ{~Edo zbHSO(Hp(N(aRhcSC-C%G!qhQ@bz#kHq;CB(_HFFN!^>CN#Fj%BddVA?%#NK|PXP0P z1_Q>Wdug%gN&i~A$%{2l!SXB~PMO2$bm>jan-x|ab|nq{Fy$^wkTS9e&Jrbl9b|vm z54iGTu~G~AdlF2N0C5oKY`e~eQ>&P_5Lhl}_x2$-Ol#PsQbiPiy%$}N(;!il3X}=7 zq#2IZ=>NosQ^(x#1qe3jx9E|@FyjTO%Q&mnk03`Wcod7!jD9}ZyO;aK&7tn%(BB^2 zEKj8IAypS>`4sG1x5Bm3|VV_L!`e-_kH#W<&jj+!+tKX=DBA)gD8u!0J1_6z zq{*seEd~|Sd;F;25&hT`wZCx2j}J#2 z$!6%{Dap|${2=+1%^s@GMl$HYsq6epo0TkKUyK^8c&@;ykuCARYV!Y&SJZ!v zWfOv^Y^+(Rl+-<)EGu5BIO74o?678afsfAmKfbWyJEKK*Z{4UN;Zgm7TM9&Mm%C+B zSHM%eXM6C+nhHHnE06ShH}Nj7Pl>`l5!VDDe*eb?VH5a8lT6&64 zf;v)^R`Hw{M=SVfDm)T* z+G&pmbG2hqL`~lpk<|ROkg!zy)KGHKMG2^+sIo_ih*bKhq%b{CJnrjc+(#VvC8>H6 z5xg@;jgVU4#Uywpz5pc7w~~19k=ntVJxz;2fy~K~i)=kPirqA!8;Y~C_1k~y|Iua; zpdtEe>=Fvxc{j6)WDpYG zclu_YE=ky83=qvEw)2C54~>)kITgyluPvK z2GTZ_NoJ=XGaR`zl5cdpW;Q|;<7dy|UVkpbYF{KvS+gXZ%s1ab`G5^ayz+-P_#?y% zgAmX6c-W}R^7+l9Xn`%eDo%q$k3l(SpX3w*+xA0fmCr~ZW*@glL`7R2B8ljvnmCT_go)cW z!fsXQ;6V)b3%wc#1cV#Nt5MEKBY}=1)n?Tg|A&_s08fC`617W$hMpc?A^Ev~5cOkc zXiV;ZpN<7a)P`8VffJpFkx~9XKD`7Q9{gH|FZqayysj=8WHYamN=NFjDV`_^=%b&y zMrg&vvQpql6dx!QrGN{R8xn%hG1B|77dKjU{H_1~WlfzkNi067lU$nsh6913L6?mP zJvr~cX{A5GA2FN=7PT9cAm z2ku&5>@x3=dbv`ZtDo?)=dvh*DjQ`wx&taK2)eD|2M ztR64IeI&Id%t0<1c#=gWFG6%zV^eh3j-Q1k(l-FXm|8F zQsIN9q(XVXAFGel;`DKqQ!KoBT@BR%7)dRtPnoHygQWb-cjOqAAWG(Ha?YM_@pU)~ zF#SnM1QfL0xMDrXyGzK-U0l0U6!w1~w%(6BW%HoDQg}8x_x0zV1QHMs0MlIr521Uy zxWCXEZ0Qg`UK2!=gl^mqIHUpabo&WXpBe*1S?PnrA{LBsiE6o7C3}E?=uiD$yXSGD zrx2uNO-h|v_rfMEDO3CXAiv-g_z{ID!YCfgQNK`BeUhbOr;Vczpi0}K3B<)ngd(Cg zfr15x9SR7eCc_yCXcWRQ^EoKYDG8SB1Fj|&2)~F#9gtzd66E#D=LWBHfycWrQ-dgs z_i1J0Qt@|N2-ABpOY@>E<$(aP;)J+Vm2y?!i4dRw|3e=xrZPG$UNx;lTnnZ`qJgacQ1G#5@vG zD>%*w-Rtp+T=;5kvRXuDN&NOMMtt(?CF(OoHM-v5AVzEi1rk}dfU6KXZccP`J4`R$ zzJ$LTNXE$RGFV^q`_=M=+J=Yq0f&QCk>ViAFyF;MibrO;U|kZ}MVeN5;>m6X$sV53 z*8(*3+yDvGM$Vs zij5RL0oO<_1r)EeN^dRQG!KkGaAdT=IZxZl+0bR z-@P<7&iA|UBk0uv|LYdefNnt=MJ6{y0_E?Z48%N4(1AZgC+GrZuvdlvwqBY_fw=$; z?35I$-8(6TAxD*5gWY{gPrJqc)i`a3BV7`iy_@wKchTfqg}jFug1C%T)5?vv*z6=) zI?7`zbG=+&xK3#vQ39OYD3wRJE(rolt=1&$py?KN2*tJu&M?k)glJq)us9FwLcW4_ z82Q11F{dQ*Opxv#A&jsUgs#hnrZGnI94$Sb1|D5Qo-n44EQ)iS^gssRR0=6uGNQvt zHojhvyp+shcf5`iAdeUA{SU~L^ppe$L9CU4E!XAW5p82;IFw)7fzUW= zg<_pL3vE9V!X7%&KHRb-dKRcE$`lSMf^4c>f)+Pap~eE29e4W>mW&MaM|%_)TLbDc zJ3Bj8B=p*@GbSOSZ)J1ze<}gkeJWoL;FYd4*rxP@0{Ir9&$(=Ma16}sI<-?=NmSGn4skZ?P| zVTdn49YCan@w$iKVGV>!@8u#$2;@dCSA-o*Ti7DE_$d~GgXtVXSsx^B*F&8uU2zc7 zL)Ue7;k1YeNuc#E{hlUJ#t{(#G8ru|w7>r+n_i>;+v_>hO>huK;U?U1`-->!F-NUq{kqf#Nfv2V0x8qJvV4FS5YF9`hcex z6}HWm&>b9~TObCE08MzAsAFjmRt!MQK|%Gcd1D6gJB2W|%F9ql8E_l0+`InQRZ8^% zx;f#B$CI=#IY9b2w!}Q7!&4{D)2b0bFi#p543B5pN~Uu4YCX4N7X@Y8N3<$$j@F3F ztIbD>6Pe;T3|c*bsV<<$?E0O_XDeT2DE4@L=z6-$7lVlIx!Kh%=6xOX#+XRUe`Ygb zXz+Ama{c}F`5{jHaW})UL$3z(4e-wHxZf_b{$ly=T@j6g>3hITe74lt*XifV zsjMd@KuK!+I2bS#hD{APgX|NQY0@=fQ*#})>>C|zI66r`R{(*9zy$Fa$f~XsYf~ix zWwX3W{~gq)HJd2!GjihJq?mN6J%dG7A8nQIHN^mtCtETpxv) zi@r$H+;ae|c3f(uboJca-0F``fspbz98MQC*e<-@@5H6B>SE+eI|CdqdifYdCFRgE z*S)dRg{qBsso*bocv`GF!v0%9Tl5NMg+)2S;6DJEx7mqbq6RwAZLkB82v^k%en81K z(Pv$Up=tTq8w^!5Xmvkbt+LcAU~K!;p3|eA^HD{`juNlYWaJk8Q^JBNJBLAIH2{QX zi@S;nz3b5WS1A*Y8PVo!-ydZTNNd9_7An_L*mX!L-EX%0M{;wF$Y1MCc8=~tn#T=* zTy1jX*Mp@3jzM}6Wge@|YCm6OgLb@>gzUsb)u%A}@H;-6uS{a}N(Ds~lCrX9EAimS zAygn0S?`aXpQf7kLbjM@)soYtirJ~K>O^K#2c=Ji&wgWg992|Q%W|{ovGPJCgo^+E zNnHXG+gk0twB34hyr!a>#_6hCaz?qcQ^}gjb<>by)Jd4qY(6t@B76ViZxwWaLd=tyhy8V?Y5jP*Ou_E+^I-whC)6F% z0`{HgXs?i2epkexp2q3io!OGMq~rT^r_*k;lx@%knEqA00K;1`@Og>RQKq1?RE4{R z*>4{1x&&?>mxNmG+B$A-XTOJ-5BI(ZJn@&l|0{WE?ky#8ls40aL$AHiBR=b&mHZCt zHI`jn-L{%lC(E=9B7eb((eeVOl|Yntv&=%acQn0L0l2k1nrOmy>38IqLriSj^l$ea zy(ZI9qIR{Mm1>jVnG*H8lchG-k~4vAymF%b?RQsUaVI4+mWP-vmJ`{PMx7l~R#aj( z&-K6Rd=1}rm3RgqX}i@v&h$AyG6R1JIvMMgY2M%`Zcp>8%``dctd&Y-ElYeScHjCTW$7@}`gcp_=?~RYdD_g=HN~#;eH^vW%E7{b zu4?kezr|Mb-XO&24q!Z$Fq7~>)6r(FGPqxbxN9~tG5%TnEy{eP^W`xEP?PK0L&zf| z-H%?pZw4?M){O^>Sy&3JPmRD-%Z@ib0~l2E`DaySDOIUlmbX4R-|HP_23i}AW2l9^ zABG7jTfuhJ%NG0d_NwF!e56_IO%?7dMCim-TDD@=X-D;}oEq$(HCu&0&Rq!I$1gj0WS zbliY-nycP=S)}YgRUhi3ix}of()a0MP=B-@fD3)f* zb=LX{GY$`br544K3wRvNUQ8wgOT1pcEMtDqa@1~dUMW8Kuuugpe*N6^|7bePfT+H& zZ36>CcXvuicXvxFDM%wJ-ObQlf^@flba#Vv2}p-@J9NFr-~WBS@NwpFX79E4TK8Jl zZD8Nz)*n@@a`asD*z*IQbP-_Y|Fw{M3c>FGHlB4hYrA00bSmt&+UDT!yr%-pMJ=H( zk2>k-^V{NjZP`RyumbHCbx!>mytb)k3{JFL7JySoe2!2Budc>iU4x#eh1}P#M-A4e z1gF5{d>s%3n^%AX>%JF1?jDkTi?=T!^05}1O zJBs+O_u)&+$MBL=(trJYb%)%Ki0Py|4(@b+{_SSud;J;E64k=OU$1O;LK+&zKk=6J zB_%E7D~|ouVY4CsX5xnkJ)B11sdv8qE*g%Jg&}_1&%Xh{r2wr7y@J0oGPX6y_m=H> zf?h}4U2kfAZIAtvZQ~>0gj$REf#^Uy{NHtzh5`#5CF1ej{q%QjGtQ)8%iSLj@g|$a z^)tsRy;hM16(s{zxy-#-vueZN?H=b-=p=y6i+7=9^&&tmXf}E^%*(1gnIBR)I{)3d zaPDE$>0T=t>^(D+ND@1_|F>Gd{jfCGU(nYapjlskn8We)C)9I0UthC#3C6xmg{ zWiCEEH`Nbg_};xR5Eh!rp^*xHzLNQ;H2rp2NC$wW`Q*Z1iSJrRb12BU8jA>$(6obI~_F0?MImU0X8?~he?ExT+QTb2GGZFcau?;vI> zCth@Dyl)(xaVb?X+`sZdZEwK16v(o#W{}SQn*8l|oprrmyZhslfArk<1@rUOwqlhr zV9G7d&vO3<`QEru{!FWXH017I!2VY>ruwJI1=BM;K_daDjt$j!yuu>r84YRm#PNQn@2u%x6SR{#eLu5=TvU$}YFml(dgDM4J(sNj| z75ux&w$<-Zn`KrqI4p*U^SkZh8L%9hmRV2CE~oQ@+ue@CW;j6;S)7FF%&BG> zJocP^zfVq1R+E!?vQ>js78r87R!SX!v&$Quh{JgChp3Qx&iiJU+a}6@7yJ3NEf6AR zi~r8vATz&S^Qrq^xjHd^+nLqF*bIIOF8BGC!@1ddKuyhRaeUyZ5aOq0Dwj^3WMG%c ziV)CwOr>N18cMw{0>RfLYi;StIT@F>!QP;U+p~rC;~#4)b-TW&*)4p6s26wQ7&;~#N{RBO}yN_szj*#!Xt6)-Q?V3m{pQQ{HKcB?0U02UTUvEEB15rx-(YX9HAo?-=>3zZzbwZ!S>woP_SeJlWC&Vnu z%z6(rFDQ%Du|$LeOG=j|+|_x4#R?w6II*UeLU{nlc&k=na= zQSsdf+|aH-Nx#3^g^Zls&@jW1E0kXU!@B~# zOuu`*`9w3ssj%G9g+q;57aR@exw#(ha_!)~zTy$T;dq%(ok?#Z7#NslzW*v38s3QL zu4+n~Yiw;!vd)*)q3z zm&C_Ud-hO_JB&H}soQ2gb5qa4Tkf4R%^f&>zGyr~(@nL6@5Y;qPx;Uquu;kC8ShbW zmUEYS=lx|>WeG^hdVlQ$unXo?_P)JH++iTbA;u{vC{E5CaU3FIkaswW^`#|#C3C?Q z&S?Mw9~4a^j-Knu*Bk%^M$hPVs#XK7@R6eK+n)1-BQfK6cL~V}QOioIk!lK2YJ(9U zYOhBvz}p^MaA-vx#m|(I|B^{;AesDJL>C0vl(5joXkn1I9r^jI$kLozqQZq+QoQZc z&$(t6Uhl^BvY=UbaiL3rMa<-^hT>> zZeDIBOAHS=SbYGSlq_+oXUQ6}U$nnzFBa{;CQ-4#z%b_k_u102-3MyisgdD=~f8;b0gOWg;$8F7<7>TfeRq59CO$;- z^sF2U4&rOQY(Cz(gp^Dq`}x^nDM4#u*YVMr^cZX6!;yZP`zT4v(q5O7*_!qs@zK#p z=v()1p4h5Foj7>lhpB(vFhT#)nUQ^S%WZn{4u~nq*;V}l()P!t%rf4VMLsH1OPnd= z&q3d2XF<(NT;bH;q!SR{DM%v8v4p|@g5SWJM)<`_2Xnw6EKFF`2My+k(#5n7#;;Qo zH;y7OhpngH6^y8_fw7Jg5`M#qEkY-1+4s7v=j}x;j7W-$RO^$6c~kGqgLHbB{u`QA zsaa#B&4rN{`^7Y7eAk=G9}a~0T=TXpq@*n@w(R9Y)y zjpmPFe{QpM+PCZ+`dwqfe`rVe3G*NVF2x*K5QJ-`XlCtR5qX(TYv&pcua6^wEf zdmU=Foyng}$58&w4^<&>Gt7&L18a8__xGi_g4hTS*|OIU1R2)HaYY>G(gGv!0yti^ z_nbBjl6($SqZmDni6f#vrBrL9bbT;Y?`YRC-L*|(=k)K!54Hh8gavc~?^6Y|WECx_ zR+{U(kvyUV+*Ao-uvefa8bvk-(YS;rsWHnDx&B+l^f!=Xd8s04cgCqr>^0#_U0t=i zp^wPDXd%j2phUA>w0micn(X#Rbc*bt4S5a_6QExFR|k4_il})+?0N7gZSTz|z9Y|m z0+iGDL^HWaf$Op*ge(X8>3FGc1P?-ZOup^3STVnmuzH7`ORa@aJC=RMdBvST*M+z{ z^Gx3&@6JvMN@RcqF;ab_5UU{|iM3IaSE_+41%*Z;e>@Uy-Ioj2`@U=MsIA zGshZfCO;g6hcqJ~4bY8_;N^cb4Gqj1>O-SjhVR`i`a2W>BPd?CQ_x`fKn~vC&PJ1| zcO|SHjihECvB@Kz=Q`#Jc1-Zp443Y#EUrv=F)(wJyEM zSL{5mF6blDuS8lVD*k=FAMY4Gj3yHYDM;N_?in3*XsBicA=72%<+c+ursdX|yCWGKU%A74e_AgLMhRrLGDdRLAa9$oVE~ zIIHTC z%z>^^4eH=_jf;T){i+DT5SW)JkO=6ws8oYUMM-G~EsZgO=m}lr&?f_~E~wJQXv=;I zc64PtrlAAg=B{5lA#*nqiz-)!;Dxxz@{a1gW}iMSloz6b=HkQn zYTD`ro7%U45(Wro2}BXEZQK&wZiS1sJW&3k#C%G_F(ow3(MYFe)!snEOmQZltDqJh zNf%p}#G;XZpK~A9VwzqoIg(4#hHoRPAe`s~6L5@b+6$XVfTM;4N_36rz_VvplyyyzkR`ayW zr`mWkWX`%_k}RHNut>ofJtVLaz+3 zQ#i-UfheiMC3lzcl4W%Wkf?iG9A&WOTVRFN14;C1Kib26CK^uUO>E9!^{!I&#$kMd zm?h{^O_L^slTiQ%yYnpF1V`l-QVsWkZ0`n|vRGVNz`uQuhvy02)(T(8j-U=vLb|+& zas#w6H}w#V@5WKvm5!u1Xd!NC&RA;iQK>y3g@%}Wj!UPLtDkC6JD<=|6KDqtgI803asJ9VX=-nZDN+75={X|*9+rfe0wm(ErS ziGoN>@-2G_fKsQKz@fBYIAgvgBsV&)GSkemJ_&X64}h}fWU&S6M#}!OB#IF1 zBv2n=N3ivm6~D;l#cW1nA@eGvRU~)_W!KQpfe}5pus5lBO#GmIEA&Vv#43(5>}A^$ zF)^#~7A7d2{Uoj&^{Xge&>-3s%gG+!f`~m+qya4!dF+zB_zT#_gdRAM*B&?77Ji%A zzSAyR%!Pz{2p8Q6UDO52jR`!lX1=`nh<;5xmDKt{nTvC$J!Swg!5kVj((E6{ps1b< zs<+VSdQh`hQ4O+&BM~3|Q}(7Us8r(Laex3I1w1>qtng~Flu+X&l)T6$VDeso zrmheLCuAqkXFmE1u{==-9321mgsoO^0%8IrL`4#Itv6tgqC`=*ClUPvH|)`nRfxD% z^j|n(M;M$Rf4ZhaM7Ip7AP5wwR~P7_1rZbIWudsbh>zUei^Jx@2G}_6vLn(Md_iPu z#igZ%Mijy)7cowY07d!Ya46*;?({!_5$hH}ncmgSA=R|x%Ln~c*KM{ZCzD>19gy1& zyC8ESCLU0U`;D~hyqa8*SGiz191L8zBq>*rc*B1KoH{_g7>_f6tRctWjbtJ2a3H8k z3CQIrV%%_IP4=@K8&lCo&)6UuWL(RA@!KSIlNl(|5+-jd1WMbsVONb2?;RN=i$@XxR_TWj8;;V^{|2=0(B14Tj>x~Dx&GO;XmNpPf=Yh z_7i$F7;^Ddn7ZML2T!dR0OM3a!xe%HkGRA<*^>;cK;H*PzW=`fMMC>27+G2WJl}3? z)R=&H-XnmW+dEHxhhmWO!7WIKp&?^phBsS9A)#nQbU2cNB*BRp=mo4-b)U;>;a!8Z zBg!b^QN6NNLHB?(((Zoh4b%kyxeidK7XDma$jfX}Hvm}6&$_z00M%$HhB%lFE6xOQ z&7{qk5|%`?54H*OZ02BIuM?~p5|7A#HQso+G#iFE*YGCqI-gtn5Ey7EP2l}1vZO5NjW<7Oa95GZWL3l6{4@pVCpWE$e5KRD`ZiTaMkjUiV&WZ^^i1N$C1$@m=q#Q3}u*SMOI4h0sA z3Wgv7e#Yt9{`eYv^6JCwF-$A@u83tBzGdUwNl^IDMCNk#?Wz9B8SBps4Zr-lvn%{@ z5xJ=KYQs(xxSnz8)A4j}Ngsut$3k1WqvK=FvRR<09^M*+2~-E!OR(FC#N<*_Q^WVv zLu-(SF^Yi|PK94T16?6B%;L23er`Ml5K&9^FweTmdm2D>Nz@l!Fe0QbmBk=|m-0(U z>tOP>ZXv2wzo!X|IK=gd6A~O(H7Oy~hV2a~t}JC$t-4eqQhJ0xBzmPQ9)ssN0ep4c^yB2+;(3Uw&00 z{4Jfz;^enA+*;-?V95uhVpMJ}uD!|Z=#jlD{&g~5F0<1k-gBt;<5J?+#)Z^?=T-J_ zbP`?dPp*uXuLm)lTgJmLoq~V&Kda=5SdWirR?)UF+OE$IF1xpLSd0@X19*hF-Z~Lz z?@S~)6?p*90a{VvO8yFW!dN+c=Z`U7Ex*T`wGO}Gnq5~T-FC-An|C%384Jwv#qi<28EB^rXl16=$k~~iYwMvJhp?Lc#5wNb+`7_^HXx$wBS*~cnm?-yr zVlx`q*O7f3a4O8X-^i`}R6BpJo&A0FG22i?MmM8VgjIBBsr(5N92VM}ObyMmTWK?S zNaoy91?o}$uMheN`)?<+n7z*KUtNSw^_GO~KJDe4>NnId2!37)jnjeh5I_^qe|9)+)-#4Gg4wps>A{Ow(f|`x+XXyK1uCiCJTS=5A zoTM<%a?1q`aTHI9J_fiE+8TLX4xWcp^XLwLOBAS!f;=E0zziiih{w!^xVj3v z`hbH1&M(>><_%<&O&f$B&{f0&E`MhsC^elgxm`%8Zg0M1YzX>FGiL_$J2n{yjNGH3^b;7#gwj&6mqVjnMA2#}#aC zI$pL>yH! z&3(=NRiVX9Fk#SUUd*3IUH34^?q6#^>=c&&?Gy$MtO7EQX;Oy{ zlhk=X#Q3iDb|X`pFzJMwv*i>n-x{4Jbjtbjp@lIbn}@W^i$U_1`E#@{YfaR)FD%XS z_ST)3h8xY9`bW|xlyG4$&yT68x$uMXg6R2LPA)k`fH`JA>Z9(vr5LH4pFb zVDfs)$&d9mem#Ua{Fc2j*7fg=QnJbORjY@Kk(v@VirvD<2zD|ZIzDLly*zjMja!&8 zxPr0zt(dicWQ+MwV9F=dJFWeUnWyfp`R-Y?(Y?;xz3VHfs0h?k8Fy!ee80+B?w+he zh{}v!J^n^VC}m{mg`pF-8TSS?9xsLp^?e^^RiK%tfu;-i!^vu8XH4x3&Kyn)VN!}- z?c_ce>|JR=|6JW~oc&#|^!kYUjm5Ct36#4O=Qw?=8IDQjS^oXqF;Yr4E4h#W2rXH} z6~09t_1?MJA)CwJrvJLB+3?)VhL;B8=z7*=C``%r8~eu=Dq$?JowdLLd&fmz9J#Qg z_JusDqqYo2LYz2(D|mM1bUKzeqMDy0fdHzVoOM6p;6Jxyld$%ZEBf~-nYex{e6h+v zv?XApW@_QMabr_@av$@HZ^rwb~bPnMB&AI}wc=m~^%gnzvG^QpX|dAWG~ zysO)E;vraGElXI(zqYO5Hj|xFsKaAya>D3!uX*e{8-8jECNbai4t68PdD(msdWB9P zWN$n>QPAm~S?1vJHSMa`&9Y^z1#SW5;3>{$WX@@5`JAEOeM&)4UtxGW&$?C5)A?%W z@$R7p6D{|5_JykDn%aX;ALaIzLs0^r@uDB4*$a-BbGaWe0cak6(yE zTVts<@#H_zTT<%17-Fha?3-7NYo`oqJSRI^i;D*re=MZr2p?a5XKRkJQ$3@Y#Ng4~v>(c<465Ikz-)IvQC3uR zYBQk7)v*v?4wSKTo9Ga9*`G>}wzGCpl$9NXrgPU3jCcF~`95}P&_O3``_d=sb4wdL zaww(3dm>4trJHu{UJfvV8q;G;x~t3c?*}4rBrk;Ccx_c4GGLt9bvt!J#|67f>vzB0 zk27({{W%f!GtX_Tq9_7j{VSD!_t>(yEiopkv+y@5vXBMd*n`W3UUa94737fL`n3u>af<0`Wl}Ala`FwMo8jbk z$!vm*#{)7cIwjmC&}jU z*#kWN@fZWgJocqv+6aFWK09(gSprVxG^%D{<@!>|lntie((5%!mtF>v@Bw-wgja9L z{TVXuK-sF8F*KVnTP;*jSZKRr0M7pf^@NQo?`)_apR60i*gRDyIjdzh9P`>Mo9!c# zw?Ul@rG$p4zdGKNm{CO%-Q9DG1)*l?fvX}$FV5M8Pp7>c9kdnp%M7;jG(%YA0_rww z01{kOM@^8X_rV$=%y;vTMdwR3t^IhHsgOK)yL%T?5m+Sw1_<8!IrR3=4?p5j#4f|g zpdW3ji$-dQ>EIuGC5VtJQCwY{8Z+hNCs(`NNa^8QgXr`S!pC;Bv!H_SOACS^cZBHE z*j9?#i5Gnq?~^5a4+v?u+0lCW=*Tcg6&4R;d^zBTR>;#7*-zW(wCYT5I_z^bhRA#X ze*NrJIf@v&-&?7qwWK4w5h zgH2t*)P~CqgkT{>2H}S#S`0>7fe(;s13@4S{M4!Fkarfdgjc>N?FCUX8;_C);V384 zk}^^?1a`{_hY1im7*%l*Z)u-t4DWD-sDr=KU!}jDAjRM*#~;ZH7APtwR|-rQ9ziAZ z(ru;Vr^gY;_TCLs;-|TP;ruHEIy_)Ic;Uoy&O!+(y?1CyY&m$e=s0NlAV>O1K;4_4 zI-w#~QCa+$Mpc5Cv-M-F?LkzUi8&qeYByof0mEBpKVoGZ{MOJ#SD9dI#t7T1Fjh!~ z6x|?hEegz3q@vD6#`~Rek8j_o4l){pL=A7+y)OGhCc0YE=PyfTbijQiCqE^0zw4^& z4*GtEy|gBWxoRCJ#c^=JY7?4;^k#~1+d&XuDu(c)w$$po;FR8#PSWj2f6j${1 zA7FCn_N~WQoW|$uS4azB&{0LhvsI9i#Rk(z2x6IGuU`*ON_5zM1A}JrfG%v1Y(;HG z4DU|K`{7)i+Yt#jH#gla`me~Szf5Z{cpe>7FoJrGdk8p1eK9=5E<8o@cg*C~jHz;3 zC}o}=4LLCRvqT_`yft<%e^z zfX{?6>eJQsjUF8Q)`S7~mp_rziA+R(m;sUlkTY)EO`DtU>{nG-rRF_c94OcW-u0w> z4UK^;iSl!r(seTp+lOKczGn)%spZ5X#4!A-vqv)BxJxey*KQa}$CmrnELG>%B~@T` zgpWzyNWttm`x>&NeO40fqmY;)G^E{ex1^Az?+~%iG#cr7Rr_ZW=h@a(DSWH{5|#c*(^qhjdVGgFQcMR7ZX*W4@~{D(@kB@wOj|8g8@fyt5`~4cnKyH6lq9**+UR(b#7L{s zLB5)Wj^VH55enIJ6bKUDXwc0~3SuNqb@TVKW>n;tfdSD)+j(m93?cSY5-=XwjuWb> z10p4-xkItH;lQ2G{ji)JN#)Ic2MT61x%~{X0Oh4Q=?Eg1>L2m&9eLlk?<@YuDPagdev$d~J&hB_-xfnQn}W!-V|r21Nn# za`;TOKinfB0ygc#-pUaGe#yU=)a!&Ut?V*uLJXLy4C+#@I8zca2Bz&2F_7sjXU{As zCzra2DYRd?Gx7(o+baIQ_~!oKjv{Ts%N|$@4X)`nXXFGIv^zpA^TkitR@aCb!|sGA zDO(8RQXdg4spJItkxQ6CgQsxGe__!EDh|=0Fpz4be>o~Glm+ZOYuBt#G*b1ng*J~* zDIrc732DiVO^qk?FwN7I7YR?rDd52xmCSDEz|xu{K7fTY!v6ORatAjaTLPe3x_kB) zL{k3>^yI=>{)rxmi=@Qvo&YH{yuw_>42Xh@IfcEuD{3mtdlIUy$Xe8~lMGx9=YWIX zQMNlc@$n_E)S>@-J8+;&c*Om{6`}}=?Y6@;u^{(X}P(@d7*)vPV_V*dXxN~U=NQzPsPPHt+1cTYz-KFXW4p33Wd zCBP>ID7Jw>&s!~pUYM1QnB@P8M;Anpef-vG$ljDh7a|4wksu#l@I+_Lmjf2=HM)v! zhCQo*p7G}nEnm_hwQU0GGaWg8B$R;>6R21at95$PET|)LqmAV=U?Jt(>Tds?F|#hC zM}lL4gnq(&cmJg@V!!|QNc?#%WvH|m4ve#>N>{P9DT)`yYzIb@Rh+LF8z1~Q2k#b1 zLccqwSrO#4&2cqRf(dOied#JL4?Th@T=m3R*vu^<5 zAubYpj|9+8G(a-&O=G59qqOF2?FZmhTyEw8$J2cp!l7nDf9gEIWg5~{}t%KUobI|5$?VxTRu6~PuvXtOk3Gs~Rf?)r5DbGzzjNz|G zj6&fOtQmnwy;@iaD3(-;)B&;9@9CD0ZvsPrMS?xD`$YFW>L~K*;O*YBeQBjtH4yRfPfa*O>t}KQ7QQPahhSG}nwBk8JE86Lm zjQ7NmOx$!o<yjRomkG>zElQUP3CGO(E`$Xw09Q9qc8spWh2 zF++J|Z{Rx$er;j6*%WL8ecl^|A-pQ?UWYoZz7!v|dL*n6?0k7mQK=AbKqI{bfGJUtxgLYi>3o9(2ijzfE=v+sUvDtv zM4L2|jTky-`lZwJ8iz>1DTyrsu}K6rchVP;6ZT=)F)=K@N%spl7@1_68Uu$ucUUwH z#nVf7#BRtjK>}kB9fTYzG%b^KN=2Ra=UV+!(0xCr3_C%+v?G;5y>uQ{FkEBJ*{2Z* zPV*SMlKuNYVd+Z5xFV`id+BN79v){y#ECq+%G)I#nu#f_T^J&gNiv|w#F=bLXk5iu zU<#F1+0Nsh4hQX{sTsc$oG`XCZMuh(gwxNFQxOIBo*z5c!r>&sC^zLHoB8-TT zrw~qVK-knI-Y6(K#6w#YWBCx%Rlq<@9ov_aXQUt`ucz>xVXEdQO%9ivO6&Uli7esQ z`9oi;FrRB5KUG--ObFA~u*u)pp$C&uY0Jq>lT^DcRd_bOyU(63c)iwn8brisVO83n zMro2S@BK_Xp9*kS3BVYD61-UvriR%#X-TU*IcprF9R$5+7GX6FCF zGA|y^zbVj~qu8~r&Lx-|D~=#gxd@idQRaV94skW~t1#TUiFDXxc4jQNw#|xo{_2Vlue0*;FnL8(JyF<_X(4d&esX>*GrVZmgrjA-&ssD z>{gS(gCRi*c>*9fs6y}$D<2qF73p@J5uXg(m-F87Rn3WW@j7{$&K`0PmZD73mjFgK ze6(a|@Kvs1!adSr>`!&28ppb=-pd!sCe*Alu#tqTVHZk$u3`O>1lg{}R<)!WuKOyk zK}Kr1Z^@>UCALylZ90*(apg^Mwk=Su|GNg72bNml#-FiY;~9dOFDPz3dG764 zC^qCK=(tGq{huVM8@2G3!dOiO#wmWA5`LpX)L#;`nJ?qD{dKZjUlH(nE2%V=%1$Zn zFLFfnVF0MCLKAx#D3SfSHkErMCFz@BxSWbSF)*V33kXnn@T?H1Rqzo9ci2;u97Abm z6VmDb@OPixz#82%OR*pEMBH;z<|Q3qWe0J7GiNvGU=ap@SDc)+<>koVni~O3@f)Bo zh3aqT?Rv13=MXS46-&%bFDTerS&6n#qMUt(9;VD^B6Bq2vdEd|tsK=c`76ueck>24rlZ1t4;qi(SUYaH1Me^g(_zXfF48|nqVq`zpRMOu$ z_kZnk>GpCTemUhEt@A#OYJe6c5;O5OrVyOZL<}@Q8#sdz z-^3|Xf~3AzRAdS`(XfpF{Mok)s4U7EJl1>T=>l0uOdRlJw0KpzwQ$AK;W0~{J|2t! zhS6hK?PY(zkZWkG2NG-Oclw5mw`MH%Vecv`sr9b~;Du?mG+mS}e1jYmQg$#hvx*JO zm`!9Y?XSJKSWIDtb)>Qx0eCQV8=D7UCWqV|VGTgiqFKVB1&Rs~a~J@QAn;ozs9ov& z4io_oFrwSZL;{Xf9n_Nv**$NzR`3E7f}92Q0HaL>xq_n;%p6~=u6)ir&z;AB0XY^{ zVZ>+YaE!H17agyUhnQWjYrx%L9C1jB{{fGh+r{<06Vp+pZj*E0U2O(I2G8fGq1a4G z1=Ybuz_rnun?779sJio4dsE5TU9I%S!*F-IH$a)A>A2V)Ti{Kt_|9w?@HZta3@jrH zh*8^5m4kfkhqvsnB%eYH#eL*{6(MU(ve`+$l#|*fWCd&)ztH-5R9Wr;e z85pICil7In%3gbQaF?h66OVr`cZM01iH05gfzWIZ==eyjfF?x?BI`dhmwQGfN^LW_*iV<|leY|#<)G=CW4p`hCbm{YV zlGxzK)*3gev04qe><;+z$M$-0!>4;{Fq+p91MnFj2WCaq*L+HpGf=e1sael8x5{Fm zZEaCTBDY2wz+@Yzhh(+kd8OVrgZIh&Up60s{+MlZae3Zt#w$H6N7|(|Ob-N#q$2?ilKR$pW3WWneIm_4l z&%i90ZaWS>w=n)>PJ?6xp2aK*I+xPCAGT3I^ID zra-*@p+9zL1FMm8RaX8M^hP;X)N*XHb2E*; zP}FNT&8YKkB_jh>FMNYluL0vW4Z3^iLQpV&h>Z9|-Va7+5&hcDXgdka=NrU;An7~`+e_HYAxyJn9JX6x1#NoPvC3Kkx}IiOfy_9ROn#UkqKo5pJD9os;2X# zQ&b(#JG<{&Sj31Jd9|r^>x|j3eOvt0uB*SVRXi7dV^Q*ETR~AZb?W@elgy$&C30t0 zFJ?gEyA@?-qKL4qq4%Cu&3VSc*ic-SkgM@S@es59#I5~CK5xo(=y0563{e={^wdG^ z+|4ePllP)$4 zFx8Gmfy?k=H}I%M?O#>*u>cXM{p>?+A=9yADX&-A0VfOMGg}y;aD5T^=P&)u{<@zu zD-hO5Q>Suyyuz3(JNdt;ABNI!OkaZ9XT#C?`I@^fe~xLTe0IF$ww&^Qxlh&f7@i)0 z@{;l)Hcp2sEp$HK@RLkLEkMWPUqwIPNmOwQ_}q-2zYYfwr0N6}$MA6$Sv%Z%IXpi! zGG2YhVBO706SR3rN;yD9YcN;52^r^ zPbnxWZmBsmHBbUt?Y{P|hzDByW_(K|oCtJFxi;a`!OKM~<+dJt&Rx#6wxUh-=- zrC9bkrmbA?0_~Wk8o8nh+3xj2wqb4oN|fo1k6oeM8{kNBh8PM5eRL^#y-)3Gv0nLA zvp4A3ecu@1U%Cj>z1Lg@cqkzL(li(o_63}MqE-%3LK}i6iXcX{>CLapw8IZD7T=Nnv^ z{T(NS5q-Zn^}6>vmM@+^L;-qnW&nD`_<*lwS^6z2tHWmDZI(Dv7+{PVy)&jJKu!t! zuY%I`uZp9CN2GwCCE3h>g1vEe{kv?`1uK9GZn^gJAZoXtzLrp9&F%D$Sm2;ceg0k4 z%57V{K!w4`Ccx=1gjQ9^eGVO!1Z_|X+s^|=FhlXVKU(@?S%(Iap^53l{Yl}e$vP6L z8*k#L6b#$n3U7K)3M6oQ9$=|a=^ARyIZRI%H9%7;bY|-34NIq3ZK zrQ;2mD*GsEli8euf38|YVYN~W*yI_hXoNmCIfI<^In?!%U+Z6=2mjdW2=jIiS9HDn zY}e;MN2P&BZ5>j{aw>1i7Z4X0wpA4%x_a#6wip+8dWd1i%M!C3%IgJEm<)bCm)W+) z%$_+!%u`aXmH<7QtGk&U_=+m--Od^H+u4e0txshbVBh|5%l76iZ++>Fbp4woHS8y4NkzU!C>jXS z>>k_K%91R_x$r@#-Z;DQ%qoz__LaQyGwjX3KQy2kJ#PM814@X4;5k`-_JJ{xYc3T-Q64-^Vw5VQp zaDMCGe3XQcyJ+V=VrS7y&1l?Gv$5~N#P)GksK3e%96b28-47TqXfxR4&ecHjIuun2 zp0VN5Cx`n2ZS91bV!=y8z1N7Spb;3OUmD;Ks;Ej=?5@M{4y<_t{Z5D?jIcrW-h!iN zFwbQGVe`1osH%cIk?UbQr6i9~UO_6Rc-ry`9$rx|oIcwBp#&mdpyScInY61ViMgk3FgRCWVY&ro zq$GqLPW_3ke}hOyuf&Mu+G1ew@v7ZGkE+LBu{9{_yKW^CCR)(M;cZ>+c~g1Rrc-b09BH|3 z7?+=$W++4RZ#voQK!c#Iz_A_8ENB*UR@c{cA2$SF=x0H!u>P$)S+?>tc)FUsd=(sW zsBzBl4!UcUD*Lm0OXUa#M+nYE%T``Ld4{w$Ub9;9)bXA9D21cacXR2*2!qXmHxDA^ zxM;h#KAb;CguinYh*(~T*w}wFw9);AHt%?SSe5mir88L2uKb0oxN=U0+#d#)E9?q{u3mx$(;{fjf8^b}tu`Ex`ktn9f%kjZ{@bD5F zxpwCMvv(Pa{6{eIrP}p0KMmajI@%I4{f+0dF}taiS`W4G)~`GH3p&M1&tRV17Z|Iw z0-k2VuVM8FGF`x%-P^OslA5Lv&J#K#OcNsG%_;el_wW4%140X%d%6ncT?p#%_VIzb zEbI?Td(C9LiT%{rG3bv6M%OQN2=&Gnhp*Q^37sR3pf~L3dsOekZ_6r1%e=mre)6#Li#4jr^~xj z$D||>CuE9};EfE;2dtTxBQDe+(nLfrg-EYiBo26CKZA+r;-BK+C}l_F$8F+!Tb_#t zxIE_MzOMzsrF1lvkU2z9Ppy=2JBYqbG=f5XFgy*$2`5S&c8IDe@R43;^NI=#2YO$* z1MK#ibi*YX{akSc@_Ro7bckPRc&7uSFsO?v0(tT`siTk#a{>BG=JJ3`glyIU zQHNA6&71EMzB^!8vmB{BHVZyrZh~5Qpvku%d$xuEKC< z5G8Gn+<$QrX)OnsfQc@nU|9VgvIK&&M0vlJm@W2@iB;S=5}q3dGGB?{=(!yXG31Cs zdSdsX#ks`qBWbIE|7k2s@u2G}W!rs5-*9Y7IO0>RJdqCv7Y8$`Q!3q$1E7gA==p6I6;^AgG~)XY5SovBD7u- zds^v~F}vJGiXzybsYvKj>Q+9=Fg)?$eRt9sBaSdQk-zrk0A1SLMn~-Vz#Io%#)eCA za)GTA&@J;A8G6@Tz^3?VFGQfhqx#Y!Ng_>^5_v`|fo1?T3FpWFj`|}*95Eb_mkS6( zgC#ic+`tbZ|AnaNoL&jCUG#K)x~UNnw-87g^X^#+cFIpUk^%w}x_e-o_{xc&I8dvP z7SMdaFL$9drbuUfWOU;MAz{z9r8IjUXzkiXCCo0^f{{WdBfyuTXRiPV@ zkNr7fa$Szs?t~V?$|R|(DV+?V;f5)c?5D9~Vt7bp_$kAip$t%%COHQrR3AF+97W)f zAB401A5T}|S7orYfdhx`?gl|px?8$a>F)0CZV-@eY3c6n1_?pByBojPd++c23(k9X zc4v3yi798Bq5TiArhl8&?y&ZyKU}mW-b}PBrPbitx0x*=(}((LhK~i!y|H%u?+b); z-R^@l-mruBNE0`>Ku-(Z-t}XIM1d0`@J0&u;|7uYM6#l>Mu`?1keSqVX(1gH6l5X| zP~>=kqjqXMz}L!Y?q+1EAXy5eA}OY4L>*1=bvYM)#F6=Y#m>%uqveGGLf>2`yPVDP z;0B3!%rYYF;s7Y5$J}qck?{Sjz?S4t2m3$j9(3kunH(#mLSzfN-vUP@>%(bE)A$^a zrjO{+9U4c-!76lUz_*MPB7$a#S?tK8UOyp|T22Y`(+&w+^!X zRDY=TG$zmyghv|4;TMMybfD@HM(Y~CJwdu<{oh7Dl!jJ-I3>XfdHLeh$S~PMiOPcJ za}xdu4Hzq7oX5T8<2;^9-lb4PaMzb3Z;&P8O7S@f4c<}pi!u`WOZ$kt1DK*KzqcekhN)`H!-15byA$LgcKorY!!2e44}fL|qjuM5 zXPDjJAZm%@YYT=hiNd6^f6GAT^t0_8gF4_VqwvFs?4E3SxI|oJ2_p0@)8^Fh+Y^bp zyqk~au9O|Qz}suilHl!+_~TJ*Xo~LEw*ln*S%>hfO1ob(byIG*R91?8ckjPRUU{N1 z&aBfD%n{?kT`Ix{w zYNl}Y7cKk<^goP9(AbBF?LZCmD0VfA2UqdEnt@DkU3X^vY^is49xpF0w#OufcJ4{5L z4)3`3&)(dB-B4Iz6Jd?XNIMj~) z5cd-fZWDy|`Z|a;xHgosFV!2KcpXImNV^nc?6*{`{%sjT_VSj4l25bd)%Mr&F{pN< zTj~4i?~4Wuc`ff5|}neT-zOb%2=%TT6FY<*xyDzDd&wd*6WAv;97qtr5csW zou-6y+sDCTeyihnv*LJhZcq z!~Sd?fi=?;s;7m*PE^ueOfe#G^LF&0jlXUi38vF7?ezXp$4=iv#^{_x+yjK{+D zmE0YI$B6s+1fP1**0zHE*cqYamyyA|XPh5|d19eBlmR~FrN|ZIMJO(0O^B5wC80|o z#l8lSAgRC&@{TfT3=G%6YTX7@nkf;1A4B42vD>lRqeJ-30}@5bt9+z|<>lone7H@{ z6Ql*u3?|;lnaU`Vy%L(Ka?P{vCPDKD9`q28wJ9Y@CC9O^B{-KbmUO(PkEU5|aPpgV z`H(rQRvf`0Gts~IB*D+uJ;{6`qD(B%3v?KXXlqJA5H_UG&BfLlh!L_eA79CS1F+Wp-{izvl^%~RFrtRPt64yLzEcjPcI8BmN060{-+)e7N@932I6&M?!4N< z$p4Uq(SbZ*IG&ny>O_C|t+W?bvRbREic{q7kt4qRam}fH)}g7?WHBnmuNt+gM_2)O zeK2U_;iXTjXa?Hc_w9KR`J|a!J$L-5e-s&vK~2cd5rzszfCjmZT;prql z8grZ22sB0S;btdaKXD#T^k9$=H0Jkgl&blYht^Iw{?bp)A@qn8c%|<{DSn_o={ z3=aU$ihuk7eBtnZLT5l~p&*D5*T7Y(t3hIJ-gqWBUv2MkRB)9>!HQs?nxU?^)z!$& zHYjn&^tu^T_358 zR;b&`0)u^$&un1^2C=>hmuT`-+_L2r}@RZf_y#Cg#Clx&FURteobm>POag*mvm$I^{Q<9!!CW) zUw^;ro3V1MN5pdu7R!sS7p8s8oxx)QL7zvU_sY8X-Q1)@X937Hxehex} z{QqsDG~*03JJa<1G}S>V*iZOJ!QnAdLXK?%RT0u+FZwN7?RN9~6SKyfc^e)(u|?m| zfu_~T-Tg_0#!p0WLntCHU|sa-q32JR?@PzkGar+=!}vZipmO8)JRWH{!UPm`{&&ZB zT>Ad~CM-}wuUn|@fX}O) z!CwA1vF>BzrCQ zt)ikr-|uM;h+QBeK*j=Q2sb$bGqrYxL&O3TkIG=3oDdPFOp4+Y#m)adz%KsM5h24v zaTguEnHF-t-gR_f%P=uB+xBo&#LDE#nVDVh)r3~0{MQ<@`w!>xo>z3MRh5=myT#%5 zv5fX+s_EBa41plG_udb>dR$Axi!ct^AJe0CfSEttXd08IRrb{Uuro~@vHS7iD15px znrL9)R4%h3QI6O9Ys&8KZ22%VZ*k49L{2XqKatrcdBQa2oNmjr@+<*9z%sM}fI7c8 zn+1EIeSLdS^y4)hvJp|vX38Bt!4+RTyMylUx=J28{oPE9hk}KbL%`?PuyKLx8shAP z5<|=dXcJ<26+;eT6=eRZD#b(Uqw~iOgnvqS7fgtQg%uzJ zJ9&2WPB}<=zK?FaZcM`>OQVu3FO5pw{NzUGMh40H90D=Jt)l#paH3nj%*%>U_;yzs5A+(r~I( ztkyJFNGH>hPo{~xSUj2B-kt+`qvUbpxIX7g%s)3ekS%NCg(_EwjmQqud925#bhSn3 z8LNHy8u?XAni-06z*%k2>%0)`^l56_pgKP0GO1~B%zT`D)x`mYyJ*y9drXe|H*18yFX ztIqT07uSY|`S88Kc%7zhtJ)I&?b&+co%Y7#@8>pIk?M=XUa?@{I0I*+scXJs`aIiP zqe?5b#%g8GMqCXL?rYVVNIN^T1(Em_ZRVhX4ezeu7iQOiGdm@`j=TOnuqKv)N599e z(b7-R(r~M|?K4Y)egnSU!X9plwrTt?bPMYaudXJITbQv5`YKK_^O5yGPH!rAp#j4u zNyVU6?`9i4|05M!3D3si`K=rGEJjBCX3w|$opAK+$5%sfjM$}<&GU7p*3PQpjt-*e zH3Rl)?QX~U{VLp(pTXBUcFf+$8duLpzS(URxS85^WR;HXtdUG|S3l%4S%e(k0O1=z zv4RC_)ZA%j{+jqlOO9I7T(UXlc8U`xgapgD@*m7&E7_LO0uE|Zeg9AAMF2hpm*MQ+X15< z<)n<~ZfViIkbrg^e(6gAz>ez>a??!$^+x^1z4r(vnf-I*8p<(AUmj&}Q%k9#AI+ue3%cnTRX(xfRLqVcyay` z1K~P3dl*My>~7_-eTxyce@ZHDb$lu;q(`#44=_HZ1WKll1ZqEMTOm1xZuilGScqt* z1S}BhYhmE?p~~iF-+JR3|8>%+y?S)Hv8f3fve>adQ?Oo7-g0K&wZ-V;;o!_QFHaD z))g*^Z0sF^lK%b&t<|T4pA?l>PyBflS`l ^asr2XQbZ^i3{d(PQ(zJs~{HfeI;T zW%7xhbZE!&RIyASF&Dy}AwhI?prTUIZqXvRPb!De2sH?tXe-|*ha9*q>c4d8d7VR; za;p@4D1giGM3K*pJ4el;`v12-U=DDln;YKcii{JGOHJP=^r&~A$c;eYBlv8@*;tIK z_WMl3L7EILXl3oC5ZX3BQUXH_z3&OE4Z-251f@PQkTkUH3A6AS-C9DJrb&y$07Z>* z3Sz6KU9U7OB{yXQ7yh7!lX?B(!U@>6n< z*BAt2#NV}BVtzZMFGGTvv5dzCw#jCsu3kmts#YS2mhG)Bpv`eZ5zIlwZ-zh zto7so5jBh)Gx9M^ifmNyi~JLWeO$`uTC-*nv_%j}Ox%(P-D(~qtIn++P7{A1O$Xz# z!_OdGVRWm4Z__jo0$E@4kWXMSBUJ22swXljW99Uat(2pzmZ=MM@xJX|&EZgm$o+yr zayCYslh8J!4cjTo4RxJQXf+c=`-zN`B*NP!^cdMYFLmjRDv2+Q()2oG9G#(61U!WR zo=zuzgguYib>kyx1=F+k`f2m#W(Ijgh!*eHWW>c16&j)iBGJ2xg^&wBJR@GAJinsC zkw3l*CAoy=7*EQVzp0`!?M-Zb1wZ34jD*|{9kbbu5hp7#h#`QU*ZFHYlL`?%=aS!~8! zu5y2wt=5cVf69hd!N$(H85WPRF>?CYGI>={7*5%Q1A&HWPR1|_=)&zcx`?BFfZ_n~ zs*+X5lKA(d+=pgJA*!)|1;Fsj!_Bwho-%)+2Ze6UziIbWv}Ti}%^$ctahKF!jOABp z?+Y;v)4wQTGC=>Jv}Hn-R--j8i4d=QkJv1XPSY0Q+@R<6;x@8|gm}AbchLF-unnjA zZzfRvE`yN?IWG|$*8Up-%y$&=D`ZR*63jJLL4!rKt4FPweo7KD0#K`X$vFC`I7+pc zd*=tR5l4Dh3&aN;&=p)H;`Gxl8lXv=ownT&5L!%9H_rzm-IF(ll@gcQR2y0m3ynx~!37joeI zR;wqdEY3RzRH0b4jSvO`*X<4?z1IW0gE$po%$Ak5|6Qe@?prmXzRQEDc4<7i5ntBC z#YqN!0|=d$U+h>^46X65x;5zfV(P%`v!^OSYFv|MOcVSKguaktKx znnPd3R7`_(h|Ua5kecI`m2t6-zxYV06wGlP8r?RZu#ceZni`C_Y&%qneR5{Rid&|5 zln{ndYK_SHKo!m(yT~{pn(Za10BZQUt&jmWbX0Q8cBzwp?-PXeu)u)trU7^`zc3V~ z693wZCPHvIMmW^JSHXbYE)maiGw~YWA~EF233-&I_06i=*9KZl-6N>E(@aI zwfJ5$X49A;sLuK&#wW)!o@k8(zR?(?@iI<0*ZrFmYcQE1G`au+8zy+U5VU)TtubcR z=amAlZY(;P7%+)PMl)}RYvF?O3Dvly3N(zYVPuDe!AlXOs%)#l*1)H}Vpwln!;LV5 z#wrW2@)dC1>>RpdQbdJLylER68nhU2myK|R-+l9|CL!coFl;PJ?X9dVENy#m=4NIV{@B^rvo$v~^giT6wFP;(EMQMo zB@WmMzsH)b5`4}0oe#-d``gIE!qVP?gS|O3Z_dcV-dgnG?ryoMxw)yCgOjVVnIMB8 zV|LlBAt~y|uODGUoS>AZO!+%xt{AiaSi+^uOhU?j0}D%|xit?}t*Ld0#(!%friv&n z&W4%ey!5*7MpHG*8>?f-&c4;HffPW~fqwv=u(r3hwEw~MrR2K~2pUsCb!pjzy#YV} z#}@b-=yNc(Rar({dvLCY5918`HXP^HfYt7kt|1FvjT#Tgu*_Lg;b-Ry#JzC^n-Z$9 zyAhcI_!Y{!#eJAC#+0qc?{YxxfU9D%jC0x33~?hY^1dtoLOL~q=ruOJPcpE zjbz3J6#v2|?z^zf63te|Mt)S%F&cJz2n*B|q!DrShp#ZRR!yUB(ly*@X!$e}Km)Gs zI~}L!u7Nu@HNLh*u!P$(9i2w6VdHPLG|X%jQe6i&2vLu#z<{qbi8JBS1J`_zt40V% zC#8wIwogGa7@A}KWLgUM^OAZ8m5wmgt8|GomiBn>LSPDSJ8H)*+OhJ?xON>d=jx}_a|HVtkBW+gX$t;yPS6A>Ev#koSxZQ}+5m@Pu{tq?m5DD|c3n4md2 z1ke;>jJ6@>rNZA1hd6Ebve}}vOVk*VNnP@8PV?0`=HdVp1m1_g&e4G1U6`6JhTodmjl zX}@U-kre>h`%IZ_eT@R#Wd_=L^p+3#fJQ`~1-TN`dpe|vaZr3%ICj-1sy^X@6%($) z6dO&G3L`Euu*#&y0(BRqJi^%NYSL0U{JCx3CT2?&Mik1ykgU^A})?rl_{NCaApV{M znUj!ZsMBVRBC91rAK|h2ihkk%4jP839kGMCiZMVJ5ekwPPcW&&BaT`(sV6|==CPqM zu2{F3>4WqzR8Krq28VB7fst|e@J7r^xPxC|@V5WpN3e=aM5_Mglg0v`1JVu&20BU< zL1H3ESQ`O;T7v3ew){_xQOA+9sB0l&sp{;)R3Z2*t8!#mUtsKm9W4E3h{1y)1@wna z-zPQ=N~qe@N@gvJe!Hh;4jr{HvmCsN2oqOAb$xrZa~GNL;6%v|Y-4Tv2)e3AGx&J; z9)Jc59URg-^W%dG*sW$^Bn^lr1G(1Mj;C52zkab$cblReB>%!cE z6}#5SPfoZ3OruY~VU&kzMLY&{1w-OXKN?|c5l^*HE!-<$XojyEWzc;sJQO#3&KpL$ ziSYWMxAl}bhBcYMqTZpJI>b*o2KlBGK^dvg{c;^UE`JvLDRu!27KJHL507CipCuh) z(13`dNz(%8lFF+@vov+SV zt^E9@W+GkC^Jxy|V||(#^B1?>%h8DmIz9Umc-G|8R1@4c4mjQ~4r09nx@Z+W$Cr2! zA*+9+w@(6m$g*U(;ea?+3YbcKic%ZNdTxaX(%`xZU6jwje`VW=P9FsU_`* zMx6Ee0N@fkn+-VLvY-h(c~GQwDZ&Bg9=ro>XJf!T|_P4xz#VUG_ zuVJcif*HPJ&1Q7ETn#buW$W3h?Js1lQMxdXubrn7>y_BBul(d{C@1l6Ux6xjZZEnq zHCMreg~ti*Hwug1XnrvGJVd3AEM4ARJ803wJwpivL*f#!%Yq;mJ!+F;;$>6WT8s>f zni>qApaBUSejdQ{e2p(%G6{R*$}|o@Nod^}iv283wW-V2va)B(@inH(R%FrA)-s!$ zv%cjttN-j%{zvsuAy1>NO8hvt;8V1oO1!ES8;Qpti$SwuZwosKJ1YzJhQ>@e9IsZH zgjKoE6FJ+esg=5IW;^uZ>qs|P@CPvzGE+ayKola)v@>hVP{zWF`)*?1*4hBfFc6tM zJ~nOqZs_}J3On7aF)RkBz+VgfZ$}RHj|e*q+chuQaCuhg6W+^AXIaeR8abyV?~ zcz8jPlb2UiP?#JWLxA=H++(OgWptQ7;1Fl(7FGl|GrVJ=dri;RDnrjij0@=Ju!pb(WaaN z@25^B0h?FfqjbGy_3uir4wTuS^l|FrxbGK#Uk%>Mi@n`!*6V#Aj#MQq>2{zXZSAM7 zb{l4mhvj+o)!|n!y>y1-NC0Z7Wa{2W&7TaDdV2mKHC|5Rh3_#jF>P&afMfknt(+=L zVwk5ATqd0uhY$e_+iXtLmwyd>t zV`hOB^T(~{NmY6MQ*lY$>utCHvioMjSOph@LUmr-aJ+*5ez$*(+m+9#Sx!BfH(;5+ z9kGy9U{sSm2#`Co218*e=K-2GzSq-s%HFu9hHk0ji*NnGbXl8Dqv6uf1NbhToBU?| zkG+1EN7>Kw)rg{7)^to*6oM{xZ*>_JFDs`E)uid&y=wh-6xwP3x25>GIW{>OOcWdi z86rD5ZpmG(V~-ELxPl6xeUJgie)4T_c4jJ8IF&ta<;No_%Mu z0UU|_a*ZL-AW~EyalCzG)$bAVe}4tW#hfoUIs-OAg1OAh%=Q!CSwllZnLA&->lcIQ zJ~A@;J}qjZ5b+55U1y2(CrgYnd_2n!XmJ^RU4M!5dj0BjyvyU9YW3COanoG}0YyHY z+sp4)lDxK)-_yxPnub~+C7P0Mbp-(z?`Q=t=TF^6llN`5P*cpI$)9DG9ye$2t>FrB z_(GP4mxjFoignswwKIldi9t&p)=NJ*te2*o(_EcBQ{JO8{s>vju{pm>5G^KVuAy@zVw{M@Eht@tWW#oEp zF$S-H@pv5>A@3Au3TvGoQrGLUdayLp)Vc;=$L}$G=T$-cNT|s;nZ>^}pHIx|W8^aQ z!7D|wCj6~yD;U<4`Rl2g+AO)LNemMcPl?ysPKg}1>;1xUmG#^wRgmAqmKdy=T&CXF zulL8+omotOC%$~SxFbGvd+rf7zd?*6=H++2#>!GoPv2qEYYU#%uC zOnxe#XOgKZDCF@z3X0Xf594i2#IJX|5Ug|so5>UUp7t~)j*1;jeQB{7Of~(;waC@9 zLgbdF+NPt;X*~A9SoZB_Rc0M76C*tXEQpv-gWY7gba2HQhgrMT`+|hqYsJu&CuOlh zV|RDAQm^wF0R1p&x*qaZWR3wzRbiY|rJg2j<^Qoj&1ORd@1z5WBKWp@zX!*?8b17&1qy?r>Q@ zJnaz*pZEWHdDtO6`n8ACd#nXCJpIfuX;G(`&fdB;O*ERGxYTmj&@EApTM$ z67)0J@Efp-DhTKy$UF=_guC0e?>+Ju=~V<}2YNw}%mEF9U%mcz&GmU?)%t%02M5go zgHWeqwH#npmmmWmkc47L0sP>!wFRty#hjknB#*M&^*ycy!zyHPCnhEa8ruD7Grd1u z0o-Gje(L^neRZ;ud3r(+mq@GDscv0cUN*y^u2}y=gd$U+$(YIM+*RsUR3yJrf1tE{ zAx(6BKAUAbjytX2Z5J(uq|@0xVG6+5Y|8sr-3w^MlU&0zz>TNGp_Y%FS! zNE1Cf^E(F(Y%HzSu}AGV1HymmR}cb&1ObOz?8Qc(!E!p)5`gMXuAvRASjsr=OV@+l z`rz>wwvval8^4~7KxMHE0s{S~xA7HO+-7#J_gh+_KTWPTu_t%--HWnVd$WZA#*m}z zT=qWsfFYKlq2oZ|Ig^<&9`fDBeJbB=#opOcLBF)A9B^6r9hVyI?QSC@lj+d7Qfs)Q zaoI3^kbeNK+8?{wLy2zu>+S3OKnhU|2se-W23O7f?ikGT0x6%<<*Slu<+WOU2A`si zA6}5p4`)&tz6iLko=(*Ombg}be*)ubh|>8TF;LDQuP~jRP_K=_WZ@gpVi}l8ap9P+ zL^JrMu$zV^WXYpJTCl4QP?Wbk+TU_>P}-!Yru6@a1Fyh&$I30(S)idi_D`f+X z)>4^NSzKl$yeyX=MP|c4DLp-@BV^s|be;D^EyrUkjM-?ZY2sHpA6n!cz8uL@h{^8k zon>l%;1v6FMLCR0(&=x}Sv ziY!W|?_k}Yr6pyFTzZrLMsKRde3WbZ>V)W9N_3_sBSLE>;OeU=N9@@;Yk;O>7H(o^ zt<`0)T32alm}~uX%qXThG?kvYI5#&yvXVDqbC#hVDHirqE90z2I?d{2Zl29-I-AXZ zG>FjlP7*PGLWhNsk;Cz|MJ~D5(S0_NGz3V} z$Y!d_4e~IHE92zVO*1DkGT|Bqi<=8REW=>;l6XiXt)1La4BK!TllZ*n9o`aDqJ$fu zOC%exJ$KllilU8{wDC>gh}8Y|QIKYD9CwSJCREW8k%lLnsH_d2!NF9# zGu0H!!tj3fJqoC~A9125ZP;70nM&wC))i8oHXDG&={9dZMq#qq)EjYTm2=rRO4W(M zmDbs?%G9u7vBRMxQz2lLd-Uz;&80vC|*faF+Ddd$1-&X0I zsT4LHSu(M4ac`rlrrdN76vVzYkfbeNEQf>o!Dhp;1yKswtnY}X8sxEN#~d~k|H&)| zWVyR}Ia|AMr4*El!3(;B;4f07=*hoAw94vtxrpfM5?e50pSywEB)9kslYqsaGZ{#e zSiNFw-4yh71S8;j>y#L!MfM*2v9sF>`;f0l>g&WAMgex=s1@cUCp^?&I}YuH1FW+= zio<$7tU?J#DUy1aH!aiqQRvKC^}6&UUGjGNWdSWChk1=~QF{l3+fQ*6(M#2f$b`Ij zu&CqH=V(W!$`uAI8HR+ysGljp`PFNe!%WMPnn$#hRNo^Y;F@Nm`P{smae|a@0x462 z-cUpeB3b7T;Kh6GSQ>*Fdc03}z#8{QoX4zwlG~~(qi-sJ= z1V>`&79V(F3i}O2C}sJy5LCmzBe7A+FcrcNi^2SbcT4Y95}!PCGn$lYAh_Zf5hp-+ z+B(sIFg5ylq>b@PO`jt+kM*<*El@P&sm+cEQ_s9XEq8Q-l!5m10@e`Tg4p&XneyK zv_Hrdrfp$QniPbDr3g8oGc!(6*qCBs@ai@{@v3G0Y`Ijaq=`RFIKA~m&V=tEv~<1L z9Ke)?;03wr^Jghips`3HSWKAZe1-_IZH9=4H{fi-gMyt)G$KaDJM0%NfQVnSv*6^T z3jRR(EVeM>j}JYYzi6fg9V|JR=-QAT<6>g(dO}Jj%U>CE?O+m1I z%My8sgLZN*7TS;>*&m~nQvlFz!x&1lcy!e7N7p4y>M z6kmIu_#qN~iBU1o(4^`RFr2i|4ws28TW=>d>XF$^SkoEI24Hapjg!?1$(rGEG-i!m zXGW#-xBc$$fPBJ&~Bg{B*->}7*U1ic* zO<<9=>ZDY%hF@3_)0C(h`l(xE*@$vh@TRv{S9KG`=(9-BWppC`To=1%Oo*w0TwH54 zQrRd8eU}cV-|PG4a;;Ib+Z7YIz}gGFNb{{(MH(nU^C-8pG9m;8w zd^(s=-5BM+s!kuSk$BE!o4vnn9@-xcvE+Lr*0Y^}r%HH=H%9cNJ7z;x8{1tLiWh*~ z8taxQKkvt*u~30)+#vMbeJMos^S{maCv=8>R=%}QM(E~vKIEEr@=r*=`4yC0qAf;a zeptw8_($e{cQ1qp+6>OG^X1y$kHdK$1=<0mP-Jx*>!<#uXt%HpQ*i@t zCx3Wk4j5!>dt1LpPT%U?JfYJHWveByuwNwZMujXyh3wXae4F!Lr%4k`(s|WVVQq@1 zx+0SD6qQj+P+$^ME+Sau$xTp^(AE$q(4tF&PMRydE?uj7_^C}ZbF&c9p-7wK#mjn8 zh7J=?olQL{EfG(h^W-wNGL16&gWElk1rG@r z+!$xEl)sZKCRrkh{&2oVKFSoW%ehj_$>TFw(aHWYk_NtbQoBy4-Rx4O$C$ImP+_Jj z%2t%B@SwWOX^Jn>;AgEnu4PY~Jeozi4dR6h7$YH7mE}w$#tZUFZC}G}Lk<0{wtzE}`-z z7pUnc{|Onm?r^$KU;*G|0w`rJLys_Vc8035`^B2X24RD&M&>dTVBg9-#q-{p4@*i- z8e0mZK#Jr7IYkiS5)XBtPz2Srg$4CP8WjCah!X(`@@skC_pk`qs~OJ%Of}&>wSr>W zp#`cKh~6xJ8yDo#h(2PiB!o8llCe?hTmpamJM_1;Uvy4wW=@7kY5;;B5%^t=3?hg> zN$2UPsGu5Ut-fKz^3D?Fc@;P~lV)M@DEO|V=?+G6JiQkd{&q3+IO~L~Fg?zZO+sNCx z;rVflB$)^gyg&io^3?MwkwY4ihQPU*ax8xFhYhqVC4Gx2(cIrQEvAU&AW-f42arJ6 zAL)n?j3j3MY_;cN5uO`apU>T9we7;AK8Anz{+k*B1q}c&`2@94f>x?HlXu(q7xl7y zui3=nKba$g+l0Gvps@Cb6P*=*TX|JNEDUDGNvg`^;6=`atVhds zCnPwsl9z4M)hx{TJde*`7SIY~8>DTSs(tezC$CC9&!62$pwA)FO-azYy|r*#Lb3IX z$0`VnUA}jdUFH;MDt?SXln`P7dqIoImU&VXpCSgMPB9`k!mtLY{{Yi{d29bwX$S89wKc z-?nL!rUetV9$lPfDf@3Q!*KaI>aJO9;OO(rWClxAWrdP`?vK#T(WCPsC~B}+WEj^$ zMZW_U4a$b+ri2nT5?Nl6xKG`@Jxaxqu+s2pxh_Vo9A{?^nT3_XZI>oaN4T&DCMjM> zkORW>`@zf;-mw2o8-V)*!0=SW!2-Lw@v8I01i?)cfBeqSdRT@|9Z#Dgl%w%xVTF99eXoL0(PP8&A9H0sdfQ07 zkysEZ#kBl?VxJ z9v+0{_!u2ZvrLwJ))3@e%EMQS2 z6ZFZTzhRo*mcM4Fkp=IyobD*;77Y@IRhapckcNF_)vmUZw4N>YsYAFGi`DsAcPCH} zxJYIjF66nd%X+oDzkRt3oyaJG#r3gw8Ra94tv+S(=Mi|YrgTnSY0$S%e7EV@x`>_d zb}!so1bBVYlfG6Xz0=5i*K2bh?d@&6cwSbW*$`2e8yk^V6*W2id5ceL2MTECr)iOx z!IS(`IoZbf+PC;25i|2>I!dv7YGN$BGt-5124obnA*TBH4bF~{2FMnt$^6eR!l=yu zSa(vxw6Q2vl!u9Q;3U&TKbK+p^Z_!Xybqw+_D>Fz@jrC)!YA#njvmMgtuYVL!=faU zKavpZTr193pSxN21Ks4LmZzg$KEX7dM`l%~>WX;`u3zRkcM7dVZ(`TaXG!;c<-h## z9BuU5Q=2+HMf0uiInJt8onAekx+vMQU!9BsAtP(keyENi}>mO}VlTMx3+*w$aWv0+-P zR)0rZ(~@2t=*;`^noP>pBPv*~_5`P@Yn;I*%e$3VdCQ+vLR589Uk$$e}j}>NXkSCsm(+2?oKI%lR)R}gUFR*e4I--L!9P` z2qbzS20{94{Sy%Zl30K~Bq-uy^%W020Vg%<_DX`!Yc zeHfW^Qh#78=UK0Kd-m2@F{WG&&x3~iNk#OlSl^6uE@{gRVPxi?-x`{EmdqyVKiez! z^yXq z?c;fQAMb;UvWchNkg(<&@_y0r=>EPx1r&g}_(OlBsM999#1m9VUMk)@ zM~usgbLEB7SQsv9Z_7h&W#P+~{yI6`2*oo#fBoC2e^&1>Yig^KWAB*Q^c?bfwxRIm zwXx?f;ISw~&9q^+@Lbu-|5V!6Ht{!Bv*c~v`{Up3Y;2)yPpe#QK$M`Wf7o~-D|Y?Y zXETsPezgeWuYL^o{qAMobWwJpX2j=j{OQV1+)^Koh&uQB^>4R^Y916t_+RaQ7t)aQ_NCN#%=W zw&?r#s@}9qF4~*zpI=%|o9n;CUp>*TfA#wLG`DXgyF~umF(%cr9QFllhf z55g~r=39@+a1Yd2JOZ50MxsW0n1zI-@@ zPvHf-)!*#gei!z~y*V`Q5Y}f1u@!B4Co|oypZL1QKlh*hkPOdyRa2S$TUGnlF8V}M zo8MoM;;(h#wcaw_yGh~8^zfp9Xz$8X$Ut3)$vyIgavFs{^!CGc3pG|axyX|^Cp+4E zIK_PmG*cOFjsnyBSe}4vG*&n&D{z|rKS1zaq>aG>u~p~4Yh@Fc!?_uwq~Y`*KI6e{ zLHQ<;?e!Vcoz8Q!hWjx?%|z0M5qW(&!df3DRDLh}mJ|XxoI|2~ zy?e=)E5nn*ayYXyN)0a-g^@H)8u)&Tcv>&OlH^|!KCk%A*dqwq@;#jNKBe{hOl~`U zu3WzP77nhg0om-2jZp8>E0#}aWN^3SXe>$!3JTmraV~jc!^0>nN|NEf(4AI@Tlw68 z7G#z$N`+Mo>yEM^(~Zm31jXUQ-w(=Lq$Gbe7;0fwoLtbFQlQ3HmO`FMeX%yS5>hj%cyx) zm_&{ikG1i5wqbi%B|1mSkQBT4#inEU!&C3nqtK;zR4GcgfE2jsigtSp<8$A444I-7 zf10;bO)y|``HKe3-fOhrPkLxL1c1pn(J;R#Ai=Ax&a~{t;#ZUl`8zv7zwm$Y_I>3> zyY_IiUyu5j>sBa&m1TP`oE`3qX?S@hsk#EYlC;&uEGT&V=}P>T`6DU)?iC$7_Tb07 z<{@+RD&pc-U`q;G6Q3~APbl1%kUeh_N;gF0$UsbsEZ4&uklkuMkCXz{*&aM4@XU35 zW(M2oDjC#zvajU-Cq4;(Li^zo0Yz5qn@lqbaV`=snPB($nTq@QnqBg#hBTUqdvd=& zN9h~q$>Tv-ZXRlTY$Y{?G=rj4P+>PJn4)`n2NfEhGI~YQaV$rnKq}(Z58NR{k@9tb zSCL9ND}+}q`FbUjmn@8Z8@>i65t%!ff{TG&jS z47WG-k2iD#zfp%tuvjj_S>#AD29dQG&SG@(57;#>(iCY>Dm(+JE16D$;o#G{TcJKj zF+x$)I#;2#+blQDoTl9NJJbNRN?>C7%Lx7EePy8MPjNh-2A^f9 zmN$iSgm2IJXKxt}iFx5pow*rDJ6@Y_-G-yP_=rYyp%%3YbY-`@kJ=5Ia7Cm1A6xGf zU0JlX?Z&oMv2EL_*mf$mv0|%Y+o{;L&5Bd8ZR4zc_V<5(JFT6Yv~{sAl9@5*9HaOC zK2QIJQr72sR-?z~TIYEW``y&Bih?iW;ZPpck9QU8FW~lF7~z>wu~Fy)!22fvk8&~3 zj!>Q_j=@hH4^=v$ut^D=$fZt3Icoh6oyf90J1t7Wodn|e2OZ$q@J1glg z_LJw{^)91K6;3ckbe57o15P$Rn6aE}#v}Ph9>#a2dfAN@7o5j;L=em(=qKMn|8L!7cf4V9d3kwtwG9|!Jv%#_n3w?a zILTd4UfPs>dK#cq08g90?f9IY)~Y01!JXpgNW(|%1n(ce@O$U{xAPvi??VH9dj9$! z8zQaUANF_lxX#`kium-fI&N#${pk9f3~p6D%Fkv(;zf8}Fe)#cVnW_}9q#8b#7Vp# zCh3g-I_uL%S)L?3@OQcqEG97|$bJv)hZa&?dIJ2Ko2f-we@zi7&VyGc6upC7Z>Y)0 zM^cYoMgIe0j42Hc@vnb?si*gxDV*?QU}qEf@o+n-^`h3vNCJ9@bKLxQ)szp^|Nf~% zpuvzL)U>n{laqX2cLy{-cm;8@`PCiY)ON@By_VEDXg|es^qaLLDvc5W&F*$??LPhO zze`fq@9^x#dHmfo9JE6%v_sExTXR!>363?ur9@h2w+nT4v32ry9dtR!l+e9*(RB_q z7L&HU0364?kli&?E9oZnrJ1T8m;{LoRCc8X4>4&o>1$5(v~czGPIV2CnsW~irIqlk z3ql^UsR|yv&V0Sv;Y$FM=SpRme$wut4%)>$Nvz)!Q9DuhyHzIF6Ze7Onje(4<_-?G z8@l9KG!2y3xc}X=-o&$_%;?V{+e$J+?6at453TyiDRoHmZ?;CBIgf-4mTYN%aVzNq zEiU>MS@7G360Ip)oCK7&5%QvPUrlY(IAforJxg}raj?+pgT^H^s@dGzj!65PMaOZ~ zoLS}RziP+-;0k1}VPn>s-+mULDIfMWil4o3pu206_F(>!bP-guMR72jbSa0gA+KPj z#7eaaG3uI8$U49x;GB#55}X^134gd2CIF=I4~!z{Vn;#)<`_gBsNs-oNeF^+#7zbk z^}e|4;2(Bza#L*!&5|JbF39Jge~Ih$N&QTijq3QxZ<2(PB*b9P2Ibrv;o!E>XF4Fl z@tP1i#{{0x8Jq0~)Z7qg%#%1q5?EFq_CT0Pnl!qiF6tk&SQC-9x;^&?y(QGUf!4fo zzx*}2;Locbcn5coxS#y*B$W>~QVqy-H79gPZPN=olL^q@neQcc1w|bPqo*Rr-KL0| zF8%?ZB!pDu4j)nm84YgIDp?BlY7Py%Eg?u3mDWkZNs`d=4_9BxsTDUrlM9*A>t9xc z+U_y4P!BgWLmOVbFRMx9gxxDqqhru1TpQ-jQT#WEBjVh6^M8W5|JhL}=&h?<#JMrm z+o(C0xE>P8WI5SIvDf;46HhC*Gv zNFkrWdv4}a`9Og~o=m`&#$JD{C7Wrp76BTBl{5hFA()-k|0Jpdy~De_GZ28~qSz%P zzNby){R{W{Tu57dlR_*8k|#bc0%o9}p^K>U1w_bdvpQ`RVvF(_dS(ugTIk}Ys{2sR zVw@^|EP;r~)9!hueYa zi;)(@dngV_pn6j;aG8`o3f^m#xLUg`S&D$B)kvXO$ez0|Ak^-WA}a7g6qyy|7YOO z_4TLb^Meu!b+`#}IPL&W#MQtlf-4nNkP@&o)H;t$PS{Gwm$;k+mQvaejqy_} z&UE#8g@XeWWkljYToZCuJd=uzaoNYmUIyf8UKbzH)5csVo0MYlR%3?_%PKyvc{({@eu72 zVa`fD)(Z&a)BBs?Lsvtc?Fr9{V0fhSF~Frz@01ZcyKFF=C_q^2C1@Nb5sxyu@EpcG z=CQ~mC~LzCiu`Nfcs9{Mpz3&W(gt))VUl+cy$k`)M)+s<1f}sv;29g zc=g1~A>l^ejaiot$V zhVY4xz#Z@G^mr`}lnD;~zvG=zXF)l(p94HRJ9e+zA(^`CI|d0L=wneyqoCzsn3Mk? z4C6r*e2eQ3w-Cc_A!l9Ug?(ojrITh&l7rcQw%>E$Ae4i1ii#-fsq zqYX$PvERT#x3Ng)Q#Lu}bdjKOZ*rq3{Z>V<0{vVKGL1NZkm{TdxQZYAA%GA-oae+l z13d*U8M{t-atvk4{Q(CRzGTEq6NQdd1Y@2LgQ z3q@P%5MjGolPF{jkyXz+@M|FqACNlx-fQ;1`F%l%LIABB)0g5*(tS*hY%f?mtA%)8 z(45DcoUXA)(nW#`CosSpWcFYOJp2&kr!mPz2q(LUJT=79+K+}M%0d|0Px~c%t8m}C zMN9VR#6^;JVNo1nZ}zP9F;{p`#=X0I^s4}m{?4P3n?GUO(6RO62XA;wFU3yBla;q} z)cuSLb203-P^t;SNENrHp!s-5pl&aqd*H|3AO~dA$0(iU0Y~L=!9fgt$G8%!&H*XP zxUk92>anr0mXN~8Bfqzd5EjYFQm? z1AX_3QYXRj5M<3CcolynCI)FHXc=I)diUo)ld?U)8A}){MuaejVhT7g$5ovTgu>!< zd8iH!soL`U5}bBEjBR)hXY~#u z%Cl$j)Ex#c9V&y;CF@VOOdYO-Hz-WkxjmQGy1e`FAs4FhdY^D23~vxo3^SLvI9O3| z>){9p4%3t{m^$-iImqG3Zx>A3LD9b=NO^QkhnQ`mW~9)sc6JFT@v|U8MDcOftEA|< z2Su<8V+Y-2f%;|*;6vvwsv>=MtEAIzqWGEMZD7JkReM8y$9Wrl6Eq<~q8Eh`|BS`T zrAT0!`fbZaU6M`en5Tad_`1-qiVCq8QT}ySZFeqO3qgUFV9vt6WzZ2JIV*D5ips(e zka2WeD~T~0l>nci-hz`?0@ZEW(={u^et^WUi?*JF5+9Z5+wDu$4K+|gUm|4hN~)wh&`5MR3U?b2gFCWKVMnDkwGtU^5bBsiL( zT2yeWcM4;#ptM=0$ztvz+8z+?YCC!=LH8Y)uJ6+4!Pm*4h!~}#zu4Qeam8pt^)asA(MX_kvXc5-kP^8kip2cn$p^J# zK^_~z8r(t!Yg8}gk%9DusTrzw##+ms0}XWXdH+pQHbxlDUA^I3??iT zwr0Ucv#9`c=frIU*6FHjrag=ro`90=SrKIe<{GQYn>aZ035~>!wQBOT z+78@laQ&wmq!qrJdHF!)A$A|T7o>X0iA#QvctPxl|e&Ndb zsGfeecgieI9&eK1wb{Fci5`2*8XqP>wtw{fR6P&hj_=>~Ui(B}f!E zS6w{FgFV=`Ubj1}u2RDAy5Hmau)A2}{OWJEmiqdHSz0v_o+(B~#vZ_{^At`D%rOt` zYBdr;l@hUKqZXpwr2?d0L=lL!$V0$6648+MU zG*YT6jXY7z2#u(}ZqT%Ns(H37)+*HdD+P=-NgzOw6o%Fan;;mTG8_M)FQWd(=^1gACRMAxp-lnf9vZ~yy%j3dsq}oU&5e{5C2Xd6q zv$?GyAZ&I`>|>o=X+^m$me+jME~Zft1sofUgUjW_~(UA!=UzjJ8Zw5 z*ZLK_iF(x~Kn=lX4qB-HUls;iN^Mn4lI>9ioHnW2D|E@#IvCG>SA zP}SI@)dBuoVH&7VRV*IMP+Z9}>L7(;RMMRnqZ#Ae(Ml8XNlp5iD&FI#F-n*F>~>XP zEDWSGICq|g5*;re+8P+Kl8hsaWyk~aRHa+3+P2v;VcS>ei&LH(RsUD32@XG?4CODs^~#d_PI1he%xW_zJdaQtDJ3KdzvODWY;A3O8{r z`vvpgp4ES5f=@U@RqM4N{fV0Zr$MuRM}NLQ)|kv%{jHX#9KNPC{q8RAxe%61;2TF` zWrW<%Tt#kq;zQOf*W0{QuL8w%IqkMP`KXwB9rsHa?vJJz_ ze!IJ@xt+r1DI4er#NTbL!Xk(;h5lWomu_ck2fk>gkgnzO3U>s3<#9Fy3k2V=lAI(Z zUv9L1U9Nn0yx7kBe~$Xc&EVVzU;Fx>ry|OX59WR^MRRr@JiqNw_kJpVKc)FUK31H; zhgv9nPxb=t^S(~6fBuB`e_x2sFr~WMbh$a-eo0Ggu$FirJVp z=AM1>SuIo9JoghRblJ`|dewt+Glq3A=qI;OvpIC5B&%IsYy|QK23tUv0?HtXJ5b@o z3wUt^>cnR>hv-h~+uLz1^i@?CgCyXOXY&;6Bj($j?!)A>IJIn#7<9Slwb&ixj>gW` zf0oJG+P3E!I_{m+2V1HGpZJ@r&L?vPDRi2(TJ?q9|5nQs^M;1VErF7>mxJ-7$;sJw zu&=_x#M4EKtL?1C=bY!aC%+Zz7QOPSOcv9T(?zOZ>Y_?~4quy*NmSL_Z3Rarmjz_u z(XuoB!NG1CjE1*DLT^s<8I9ZtSTlyqK1WqRpHK`2^vwQ!YBpUCukU)Ks#0M#zpwRD z1tu^tv9US`IhkfLo5fXDarRMfDkXgL`dWsXLsmsI#Wcp}_O|ntov~=4*RA4laMN!n z@V(j7-6^6Ik?3pCTI!a~?e`*lwROJ2$doR0Y^{IUa1p9wv2&5pH8nLwd`qg4ROk0O zg3D%+rm41fFf}gF<~LX>n|5x*1_ZlS{8l~T40=_1B@6g(Tb^*D7hGHZCf!}tXYM>B zmE*Xq*YB%rmcP;Gc_twe=wG^ezTfV0oHp{jTuS@CH0-^9{(k$H6aM>SrT6>h)5FLA zIQ-jhPwtkl_nNIqaWCCT^?R@O>qw~QJNWwJ-*(U42V0&Ozwv#`W6@}w_fy*Jj`w$7 z@2i801;gtSd@bO3`|H!;dwcui`g(AaP9c8Rgr-AVY>Hw1o`W;xA*h%TEC*ZDs;f&PC@ANFZ%Z97IMqQW@aYK zOSgxAuhVcL(dQ^KTCS(-Sh@1}VB*)Q&GyGe@9U_?+k;1&Ize<*J@6U5@;#o({Fo3D zlK1tt;&nW`Z=!Jzy%3J{b$2ZE-A(jC-&+ot$)>68eFO9z`t+^@VCVUsZht?%yW8v! zgtC1-z6+%$Gw&t1Sit+ee!$Q6-gKTeT1@Bi6@BMFf89%M^Z8s&Rd#QE>}h_#(HXuU z^$jH?mJQO5-6$C3>3ALu?NMkG<~9CXZLoE7_uKvRSDD7==@Kg1cD2cAzL3I3!(q&z zf%F8{>(}+~SiZ0a{JC`{E?VE!iC@tTN7LG@{&z&DNND zXJ?Q28r24T7JeEAB7S*(*Vt)Tmz%9N{e`bQ;XrDaZ)?j{Veyz`B_s*u9`Za%>?DDq z_mN&L*S2813%7vV!InUK{*yM_@!=sRkTG}K*FTsJxZQQ#gzxN{T#> ztGNGr-9H#^K9#AhrN<7`BKq>YI}OJ-8wp}TN?6&)O`EvUo%QHth!VVkxV2yUx*G*JrVO-U=RjI*Zk9pdh%t?Qg(}L5uBLR~6(tG9ey^yPnrlC@^%_N=4OL zP=Z;&l?vMhasu&muYSK1fUZandh*|LZTwzxY^g@vAeLk0zWKDbU0(p|ADWvBvZU~R z>szVWkL~vLOdx`Auj1nmlYdG1)85xVAHmO;{cFS@M=MPROg&kfOadIHCV3)a6*DRR zm(hlGn{9WU$9|k1Uk|7ErQL7KHjZ!Gui@7FN}GbyW%hc4-x=FI)HeMEWLx-L&Z`FpF+EJZ94sz>xq4rpU5*)FA8QR68L97R z6--_3eSE#YznWJxYjjhRmwO%Z(t!4;s?#KuGPxSIjIY)mtrK8sv}160 zrz>I6=kvgW%HtZ`_v`8377rw(LGAW04|e?uMxLDKjkN90-EaO@qyE3ZdsD~@;<0-B z(fhjDZ~G;yw^K!z)l~AR_jB}nLTh;UcOzAt!1qV(F}>EuqT$DfX0NZ`#*F;;r;rdm zBh%YuCDZc{R)Ex1LRrtvQY@b{zes$%n8pP~$?HAVRHB+s8(W>(@E#DZ*)HWwsgUK` z^EPmU8cFl#bbnMnm)|MVG6if#cy~T%xbfI3C-*dot*Uf+y<&oA@pvYudFS&PYAPp- z1L)bok9`b`_fWjrS~}+ntk$gg*ZylG@IHmZ@qwx5g%k&-9+h#|#>U2JLLrm=Pkuf~ z8B-xJp4mcg(B*l$P_mlC>08Q#k(yoO1&?j_uibR5BE`6x%+A&O@i0@^!tu7jmfIT` zBf?m+Y?f)TW?8dP%u+SbW3m71*}CZQX4aoN&DY|vk(1})ewi8T(6i(-vkAFRDIa>V z+SrRuWm47x7+**lRSdYv_5T7UDb35`2ss>fgAOY-`;Yb(5{G5eh_C9?r-GJBqY`yh zCZc~HO{K3b%yBzia90;{&X$?oS_SQ90Gf^qB_wWiG*>GU=Ri&^=lm@j9Fz(i}n$_!F zF2@&;@F#ATOI9t5jm%o}KzMS+!`#1MsQ>8_bDI)-SB)84F7ooJjQoDz-u|k&xyTqr zL(^c=&F*&H_5ZjiqvNvs_{j5pq7r%?FYEnSYM<2jc#snEdyie|{kn9(%&t6n?A-D- zBudW~{7L~nwhW!Gn1r4)@HtYLzK_0374V_I-`i*XpQgEde0N<8GXzZM8)v`$p1LH? zHLAb1TEF`jwqD}CZ#*{KuhaCmkjml(9NxHk-+!bn&zEi61i$yNSUc`H_&;sVFyQw- zHGe)dTafg>xy^Qwm;4sdOvfH4FHEsU)x-o_Ny(wjtLuoTx~2b z`;oa^jCH?z91^SoH!Q_(NBCuMicESPX3Jge_*@Q|Ssbi@akS6^nh8GbL5%`Mv*W!Ep zwVC}2k9|PM&ujq%5m>+={YV7PaqnIG>25m?_HR8m)n6m5(Lc$cQ>J00l#-Wps6Bsm z^PI0Z=(XAp<_f$|OwdZk;rd*>jGtvjk1A$Q5b%8+j4w7XaoA{7WeYLE>jN#ah%8E5 z83S}HwG<^KghIa76HR}L*hbsbsK8+2&YEyy6l8joocuOVSki2)seb3xIm~VWGmSI3 z0{9jV&w*Aqwa)SSTIu%;tS(>gkitU^ElLo~L{NbDp%EiX8f6K{${G}goQx1XCErgKHb z4A5}cUQ%K;5@Qt`%jH-C_J&IEfH0PLQNk@ub$@?EucxJ@!|QjZR^jV9av zi>ZV^-Oz}7ZPsp|hc@VJBfoJ{y<3V4{~15MY+4{?Z!!BX&36O6xZ$z6oQJ$VY%~YA zwg&A0rR^SVc+K@+afRy&1pl}IHz-Py;jQR`ECRo79&pjC3T0J-D+cHF{M}9$esL;m zH`-r*Z3=#T@NtFa&gb5C3`z*jKo^Shss&!~tS6-mZ|a#$PNE&t6>9hHYfPQglh0ptQt#P*wQ28j^y zC<^2dxu&DPGuW*L+FdAq{VJ)ho~BYHJXVAX@*{XKY9*ay9caEyqQb;VODFi9O(s?M z(9e@j0PmBmjP@TG_KP^M830bL%DPYih=IYZ`v2pGk z&XJKTd$%q(Qdg?||54pP2SQOb`R0N2@-FQlFwc7C9 zAXOmg!Hu?%|LEB#m_%N=JF$2NZv9fF z+rWW(lZHoK1c)&(nJXf-hqub)A{cpeD-$|-4%;~-sEB|+4!BtS(3wNz&MC;hc-|G( ziG|8jm86UL%h+k_UbJXc7JdZ~=^WqfM;W|w3|CYVn6@*YH&6ND-pgd$!tEH*ZTW}$ zgM^E}4X8a8&G|x-lSXmbi_f{)aSvZJ<}wawy9&F#xJ1obxfc7iiXeq`bTFuF%@4dih8PSemv=h$HW9GOrTzP`CWYb4 zdbq;L<1%VoMC82_7 z_dpv%%tMbfZc>H}*lkEKKu{6TNP<8Wrvk8Ncbc&U>+giBCv3eB-q^W=N<>{8<&B1@ zwvY%bQ#j&u-;zvlR)Vf7mb`D?R;(`qq$`;cUkFgq zMWp%yqy}93JWM_3plp;8@25&L4GblG9nskH$y@_@E#Zj+>xp}Iy_v1*77q(OVotnp z`D-SivR#VvI##5eENbOkw6BNXM$9^d542QSMt! z0B3VjD8it_HjCVcd@JbvgfZ#N5Nw6Rf02IdbmSGZ;x9%ho=^z>^Mg*lj;7+k%7IJA z_U7xd&Ak=BIuS9gq{TfNR6z+%-!WM$=7yy$RRTU-KLHb2qg%C*2p#M*B4~JXD<~zl zQu#&rts+RjLD%W?oOx}Ub9{YyU0TSc&+n?=mV;Z|8yY!cK`5Kp4oSB9v;NVELBnIQA9I{~&B*$EOSw)PZZj_~l)O+W9ckHEqj`dkX2} zJ_(st&#ru;PCP431ZmVbDu8i+aKp|C%0?3LpGct_jm!?FObDZ|Pt2IG!)QfcIB5;aw-_jilJD;+R3TB zccH}a2Sm0YlLtWpJOU{JvZh>_%mm8`utlYVA!3x=C|2{v7SB}5aG^N#dur@}xd3IO z=y{U=Rs@t-<8fKy2Wi*qw#1{)n57?B&`#XboxB)#5;qm*Bjp?D5@n0=c^*J<^lle1 zTk-?KBaAM@!P`=cQTolD2fRq8m>YEgiJR8!Jeb%TOd8GF0YuPNS||)g)9D0SCs;sI zW*iiF3@5i?(d3^1o*nN#ftz199FBXAyiF9|B0;2RjpKcfZJ3xyH=`a17FLMDj9t;c(sy0`Ebn$>?-@7#6^D!DGjAg$NyD#LyXw&@m#v zYd`*V1WUaqv@7=1=+Hlm1Btn#n;?w(IQH0(=2(Ad!R*@Kcn`sJsLNge-ftO`%?hu_ z9L^7Vcl7Ue0^o`x$jGFVnW?T#@*EpLxel*w(wt8+0*|)$F`6~FGRn_gi+n%FL4OQ& z{~P2)1a)?lJm4@t*jxt7F=GI6FnNG;3dEW;pqQo!4htPJsGh|H9uc4??ee*LXSKUz zgr*NyCr3b>j`-Pj)i(}K2!^{KFM^3zNEsGKiHv7LCh>ndT*Si#3qObp&gBc%0=qRH# zod(H>bNfuf@>mzB4A&7aWbGZ7#RB2ot3J)D+dY%fYU@D`$K}nl1%kQF5ZP z&>EBIPig1FScbx2Bc=4PJ*Z=$YjLY*J1K|oMnd+N-)>zznVjLT%D+XRsB*RbdsPYm zX#KQ-RKjQlj>o(Iq_%vU6;({mx?Wu{%Mf_i+KtZ#cF7w~tu2kz^l!x^4KKyGg#5)0j>Hmg(@_ULu#V^r<~J-43hWGqZ zVx_4%d*&du!iQiuwtws*$+Z9h5SfTt3T<7X=OX0d{ZZsDP*FJ30B8@C{19%aC{H>J zlGUKi5n<`=%t7i9=eE|^IS{5;HFLK%4^sj$grW4XwZ4#z!E?vllL@S1VOla0p2TJ(60){+y9_N&9dRNX^(pD= z@#TTXW&%45@L6qa4Ci#%T3uM)G~>+X(Ns}WJ4j4XrBb-wXm9OkGr2pt1(u2h

|> zb=GwzD=W`8HZBs^=jM#qT9(x`Z70_Zon8}3`F<0u=J~v6C5`VXNp!}PD7HQdn?D2u zQHuj}g)ZEyia+lO2-BEXg4Hd}72%Y6AmL7sw3CI>vBfgkP#h#Uv=7T$f$lvf3JUsg zD`E;_!ttNFBf@`4Y@)yaU|K{(P&^0nz4ylll#dPYJ|A5<@VIvsmO z{N(Rg1`z*GAQgBuB=kB4;r3gr)_HwCF1q&1G^?~o%1!z+KG4GzkMgKjyWG&JEj+)A z2lgc@HLJJ%Zvrlyb!?B0mVvy!WuTPU7wCQm`ttlwt5*~W_SfR+h@_=6E7xUw2V<}Odd4$w*p^hO~Vf1ti@h>_=csiVL` z>?m+f2p{-^8bq;o#z|GrVd=a6A`ak)REtP=^3QKcIG_sZ^jZL3jp>t+&1BCZ7v!|7 zIKEjiwY~Y~BXH3FscGThN~h#d2G5(Yc>T+@vuSzqsq~+?Iq2%@0@em6Vot9gPlZTX znzsYKlmv^fZ-zj}(MJ^P;gI_O1Qf1s=z3gk0R>C!Zp%$MqewOD9m?l(lyNzh_3M1R zO{HfYurx)3yEg@kR9K9<9p0Z|i=h&YM~wXHT3xnFXTF`S4_BY-d+Ig@er3;B`nqNE zIq@zx>GK6T`mCWMz`1x-a=roLB*^}#VjY493#xhZQlSs6ljnwhMDr(8rx;P~n|>S^ zc9E*VH5l&`8MrH%@!$Zpcnx}TOB`5VQqj(_gOahxf1_ezCd72;Gs4PL!?N0tr^x2{ zp0%U*`-ep&22`W}T-~c*nRo2(=iE5|zsp2>`T^P~N}VWm2^(UC;$FpuVv&(U)$qj9B14T)&$yDw5z z;<&PA#jxg24NeM=)8y4=5`_g`jNQXQ{n~CF&ab&};tbme{i`Wq7*}Q(1q6DnC}xyl zMU)Q1@Jv*!KxU|h3Ug54)Gc9aGbp=SB^}kW92ZISY!9#-$(X^~zp1 z;bh!NOsz|A#L9Sov)j^I^U+{H=d{?$+KJA6AjtncI-qN!?Rv}mwVuz_1eYOWTN>Lv zU;RTbRoL`lUcoUGow$)AUZfg0eKy%C!NaC_}?3GCxt=?|= z68~jo-!Bt)(V^qzwNr6HXURpEzg#h#3%~>l{>vrEW5v zJho8*ILCKtM>A8j@u;1mnCCc<|Gm3lyjK-v7Hk*^VS(y*llni5WmOAVT#ldaG9^?i zRloB)7wwB3AmWKqFQ7U_O14W{+BOsQn_Da0qgBxukn&*g?h1cz+QZY?dj}7dWd8DQ zMgxte=KcYfQmCulBCQYy`=!S`9;L7L&wcGzDn)-}X5pIjb@syfAM+&nF{EU9BiYCGtW4i8BCR2}HYncl6NdBJ zh;X!PT_1@m#}g}F^oiH)lj`@`H9hFmN2R-j+sdAV-nm*bad`n9s2oPYmHtaxfj%od z|G|gwD)N8USTYNWuGQvyU-!Ua|FP&xilB#jYgJ!F-XSW8PDVcw%GDZ0C5Q;RWkgHi z=t7|%|B(vWC#k%?qo!!}2`pE|R2uJhr^4T1DOT8IVZSc(i6j4a!U^YSlq(G>aFGhrEKvF@=xx~``!&SVT)sDwAZqwXeD5~ufC6}o3NjUI-TXjk! z!Y~*Y2cxeQ!8j7$P;w0mhWml5a0f`(_7R`sIn*IK#-H$%orB^?*g#926bFX!WC#I- zB6wG{X8~g&<3;JFt*31EdrG4OK;~_d(7b^bcd^khoCn+xnYKWa9s&iA?O$ zp~y0}oE26kYzpwBS`ZujC#LuVE~*0#nsx}d0pvX(({i5*cHBMDffIMR3JlcR6GUl_ znp-j#bhvdR^+g>8lH=FxRkdgA5Fq&EQSZyy2Lx`tU$RHNiwlL&z=wlv&q)aYtfmO! zcI~u+RC;V^F@c`gt&Q}v77`E!uDVuDWVwSpWCOx-S7XA@;aX)xK$o$>Jt)L~pN1z0 z;yhY@o528L@C2#>Mi!J%nu}7^Y(6n%&0XQpbjMAdVDUI#O5Qg0DTq13bta9V5Jxqx;@K|hPS3_sIzqf&AzO|HMO_RT@ zCRRi7hs58Mzr(R@=fw#+^!Ae91ti-*q?e zheO`;SI;{@9ke8g%TPcK{Dg3W9L`OVoX}oB>Gd!zy3~lcu{nn!5?wX zxpqS?O@=1>Q>(PIJ2W3WPcz>Gq*XO=45WxGK1k1RC28_S^2+x&$RSuqoKN;5e$yBp zsjOLd7UU)$xK`x6Z0o{<-OG_6aEEl>Rwy)aYOh!AR4cxB=cOL#_v?eUOHp>${b(v6 zB1!yALcU{t)b4mGZyVzAM%}pHE>tDt9x5 z|2d`Q{QT4&!*%-c!LDr`w5H9EH9o*|>2lmqKCoP!&=lm2iXoa&b=C-!5WHt_z~6B$ zaF%Y4FF@CeYM@yeI-bO%M3|g^uc504xfMa>$?;tF_Y-xz)RNx@oa?af3eH^jaN|ff zTIA$0(a%6`{F8dU?s6HBe}Q<4-vG>H86H;PPSFsvNdhE2@W@j?@I<2ne1Qq98YYd~ z!H4zvK*mPC($TjY`e9acp*3(Ls;cc|G>KoKl=A}$PCVN0-;Czl%?1MRjTfXhwBrV5 z1ia-Y7q+qVBD$-ZCP)Wz27bjOZ8dDQ}L$wY?_xoyEh{QdK`h9VwfQ<7>^3gpj=)tOu&K+Ww)#=J}`%IiBpU=;( z8VmM&O=lN$uF>Kv*Jh#q$xMSmbsDDo0!N=CTCM}JB6REEGUASuE647tm7Uvhb!VS< z3QPNy`(7Q&RK3f4R{hcQb1OGXLCrhUJ9g@|q&Bd-eGOurXs(iT;#40Uh{*@7xMzOO zeB^y>x>Fge+2vLg*PVN~2c(@RT9iJ-fwbVH-*O%u>!8GO`<6|#)!Ki^u4^cZG)*P< z!a97^Odm*%zqb>?NI+MbMyGwLC+&n}hHz%R$*=n82Aq!_V|~m2;qr z2z+~ENT_RmdRzy)s*?&k@4ywd-nSoyU+lMp?_{+rw@{2Hk+cf^o1kb7WfE~|%S9e` z+o)0RPddh*7|?j`cL*4zs-@!M|J9uuLGh3_WyC#b(4W$LC7+9@kNet97hhI8z`q`N zN*}eA9#9R^d}#;%I?Hj*)M=!wt@5Ow z!%)FUG9}7n8Fm^a8b!GClm7HV`Hl;H3ibydebGNtj+ zxOcGX?UD?mc`@_FD&^DOl4YcYFnmk286t{;@1-OC2jIK;j8HP8zWp$6%74b5_lkes z$qE{bf(~1$S-(Nb-QDsNxIZ#jhl&=g;3fZb7DU`DWy3X2(ko)t#c5m{x%rC7AS0Q0hRP3oQrI-atYE7wB z!z&t>%SdErcs(HWu*R@0PxcWskm_kKTOq-flf2XBL9%Yf`f5tA9*bHXdo;Rw^oC-l zIYTm)4#tml{)2EhfJYYW&Q+*i_eF~i{5D1~>5j@<2{(v9pw_IL(7+KMW`W?054~&; zlLCFH$R?MyOfBgn#jEAtp9(T{fdt_MLn@KuQ;vDHp~&Mai>FMuA_!hdkXDqTi8j~| zh?YpNTZ~8&Us{Si@s-MnD`x3)lFkcBZO)Nr#ua^pu|1 zL6Tk8&Uqdq^IA3%X{r^t0iJ2FS?I5~P7S9Or63S9_bAe>L;u%kWLQbmG&wRBqshgY}>8&WxOm zjEs+@qPUW&Ml_RSEvz<4=4h>P&GokRL=_;hBu$nW(ac2&lVbg(U`QR7?(Xx6_a;Nj_mJEVEXyIqa}OLm^X$YdbE`!2zD#2Qq_*}DQWdN`ior((YH+pSeqINL7D z-L5smt0ZALqIY{sBZcz#l)L*cJ1;*!4S+Y8AP4F^X|ZC@b_Lr>a#;I#=yVE0q%=Kh zo@J9tvm{gy_-qhqV^%yshxS z1Iw5dAs~y*OFoOX-~aU&7=-8eejf|L#=(rRv-OR>183e9zizL;bK`3L_3a-0-wi*$ zh`#5qzxs*3HNW?TzSB6CetkdYeH{0G`+OhfeOCI%DSz+X$(hHSBGGJa&Hk2+m5or8 zmhI=3vd60i8?txNf}f0f3xk?vVzN7C%#i%$#BJwZHhsp*rgaN8#lgnn*VNkGSl`~* zbJ^6EjD`uWqfx;)JIgqmL)$(!aAIq|fA~6_aj6F&g}p`OsEENLqr;ZXM#7H>_uK8P z^}pGB{iW=5+PA~J30bI4Q=);t54Z|C2#SVPwPGJiVPX_<(HQyIyZE?!g=fZJE<&w` zEW#5vZ(i3wwvb%jWMe0ur%mP500aX%I@ep4Q?c#$v zg?IWKQna(NiJ_=wO^X`14%O|Ljo7lVxx=6LndPyZ(_jX12$dka+WMOV@Z};nS(@o?+ zwKCZ5BzqNFYJFBuqip|Tk3b*8k!OdE&y1Ul?tbS4C9C`_pDq6lDI9So#O`Kfco_1H z?FgR9KySdKzrP@694@2(2INsbCN?}gOhQtiveE&t+rfS^hM!)=nI=jf7wHMrJh&U7 z7SDKL8OZivpcRdR%epAUORrg3T2^KZRl&o`diQZRymK;^djo+=rFUFM)Vu6cS*NB>Ub&zR>*pep27zHAEv%BJg#tUx3O*8wrx-B#&#Ms zXl&a?W81ck#+jtCoizDopKE{Tob_{lt~J;DKF>{d95XT*p}uAI7@fKn!(P!4nUKrN z|92@$T5hqIrndCI3_k$BfX{x|@rV;s<1dFIA49jdw}}l4A}>QC zQL&L42yI_)Mqg8P-M>&uCObQmK>yOuFO)R;!~$cjIM&EX*vI z={Vr~3&St0Kr0_lGat{Yl15Gr5gukL8($Cn4|Y!OJZ%j@URHj7_RQqeI#nAK4{j{A zfgvBG&y%lrf&Iks0`87#EBHuG9u5i)rbIScm3R*rZ+;H-C25$^dMtRz#dHK9@~SW= zD=n`OG)sDV`d2o|$H?-7y^_N(UsG{u>CMHvt?0kAh5NnhCGDlLT&s=}oPm~=<>lkE z)BJq=-!n2DDyvjtRCt9!xJD;GKYvnE5;r&ZY|dXZGqcDEx!}X0uArfo;MiwjUlw+5 zQy)7eDlFaR&g0F^2VhEWE|Ki%?Cj3&zplQSxH-&=9OBChixR;gU&rZ28BEY2#s2hQ z(AL&`xLhk91*I@9#72}x<4tqshY^qp_sKj81G&TJP{Rjn<(rG4xOyl0!%Gxl#AF8>L=Knk^1RM4@p zu`w{1d3fkiCzqC$X=`gAqL!-V=BDPSWjz8L;w7s&@ns+E+jNVDD4^fo77hR#E1@mh zu|m0dnb}6z`4L6p6jPIvjg5_%uBTVW(pEq0#FVc-KmGh%RHe*vU#At!sUUyXd z(Q$BKd_aAUB-2dO*Tf{X7fvjWHLEMyN9JV;N9e;6Sngb2R8m99hv=E>=F467tFINe zCpQV7y~MQhgPVF@4i3u7v!}Okz%i2s;_ItotS6o}RcjC1x2HE~J5Ep^lev{uvBlTb zm`GGiOiEr}8YZx;gep39aW=7cv9fV=aWe00^l!D0hyV=@k5TOU^8;;Pr>nCwE=F$K zjT-8IC&gS(@)I;@li3IxCykG$zRzcoj|~-n;Q9UIUr*u4xX71%qmR(%Vwv*2k)tCS z68|?)tM%p4kALqXZ&L;9I)9EVJgqMMpJ4hxNBx5lBqU9`w$_%{O~YgnyKby8)HKZN^G6M5S~tB}L|Zd+SxMFJ9?H}a7%jt-InL2@)-}5Zz=`Q19tEyn(ASL&- zrReYIXshd`YG42=Ks0oAcDAs1yj#S^Jb4|_mA4iDr7$$R@A&iQPY-WtZ&O=$8w-1L z19h`(BLFS=$O*9ID$!)sHjw!@6{YoX638;(lyz=bNk1jPzxnp&eFyJad}wNgeJt|w zQhfZ>Iw#!6!PAFJhEES_|MKR_(?)v!+}vDk zHDe1WkDvSX)#|FWma?UTIuUTg)?#Q#f`H)MWm$&gpRaKN3lkHQh=>R~ySJ||yGR`` zOB*du*~wL|4A30~A47=DquYP)zD3(xI&EP*1(>FRsgsN;VSFN8g=DUpMTT-%nPpbw=R+Ni=>ay-lwO$xT~zur=-ftkAua*qQRo1v$W%ws7091UWI5o*fB4tgWG@m-1Mks zoOUZf(=gEGCl~d;|MmXGIIZ$k2lB*yF8RNS4AYGIz9i>=g!{icu`n}FbD!sb?S38a zkYKcoV0MqKE{*`llgVGP&OY^P>^u5m(Y;7fRjGwZYiOtw*@?NbGMs0*!1<$H&gh< z1q@%QWMN^h#%@w1v(mM*HBUMgRn694(b@nQCGyPcKa+e78T~G!67o9GRNtQ8*&!w% z=<94WW7lJgHqy&enoxAKml$72LB*&_tx~P4UcP8ttc=O=T|2VSl5_bQ=A}1fYr=Yk zN`(s5ER}j(!Rp}CRjX)kY7(MkeEB?-F;h>5qno%f2aS0T(+0Y7uQz+JjpS=)nDXOt z#?Jj_*EASS$rT%?Pd{W-y>4%A_Li3=#eFaS=KF8*%t!0Mi)Z8|gPBat&USbE?!@ht z*FZHt?T3?4Q&PUXy-CF9ON~hg;3W^8%O&X9c<`}+HUq6!^eFEGR7Vpj?ef7ppPEKYH zL|{?(2ZCfAHJ+}VWCEIY0Oq=Ba~$(GDMuZMWQmm!kR z^S+M(|L5JW)2Gq9A6lSaKJMTBgaHL%ogX3}V}19@&sWf4B_?S^csPv9(bFDFr<1dj z{SS+Gw#FJS>o3ND`K8DSvA+H~hV#j$=*Hlpq2F46|B(-d|1KLWGHZcut*>`=aBpj= z=%Q__ukEz=E$Qm%AfsnApi|BLlYg!WEdnxIpPt$Wf} z1Wzqeyf^W$P6b7o6=n?9Kt~V6pfvy(Cnu(eanH0XEZ7>*Vq;Sm<_6zn!vChN#Z)WV zaXL9(%+4@Fy+HA-a)!c4Eo-hmdm>@}OWF{! zw0HbFj2E%JJQwo!8(=>kh?`~c`}~}Jlb4hwT_?OlB_z~Y1H3QK;d~GzqoP3E-66n) zOVdx%ADUsf$@grZot$39_+jrXt9^}V=X;{Kg-V9Ef9JiA`oTc203Ph?<1Ntp&v|I z3dhl5sQvNb`SG_qc{_a>XIULP_aCNi2f*d6@O;09uHIkI$t>R9-t?993Q-7l^pp1- zO(SJNMMbFv+Pbecekt+gN$1eJ(#iqj?q~!MW*lx`&K~ zpO}q@vXtXK$RvKC0}G{>lV_BXhXN0Kb$K~AJ$ZU^GCnuWI58)utQ4gfV{>v{Zf9dX z&f+l3FrpfDf?j&^x_xEJ7K*|ydq9-WEvZ_K zG#Wnf;_~9l)_w*q{@Y$KitxXWrlTXxvK4!dyyL%ucBkhn0+&-$hw)ebZ%z5zx3|%? z)wK~(C`)?o-c64FHXNG*pq0S>hdBS5+*DZ8eSQtm0LR; z`kjs7@*3YjfBnpkp!uW*BRE-w#7n^53P74FZ^q6+Wl_4)!WBJ*@B^UX z$q>1&10YmN{HKnrukXRrs-Lv9w42-X=2`3avGJ0Fsj2(wkBi}E%C*;xt0!gO21jcsz0I^JhC)trp(yZ|BxT-7S`v zM{IrMT;@J5G>FA2)1eaW_IS#as*+RtyxjOXJKunw(NSqpQBg(3t$~4sohvj+T0S}i za!%pS`K{%n`i)2ane~2vxphXJQU7gZz(OX5S<(T9+T0Y2}+w2#7i@B5k z4|8A9qBPPsxp76Wi~Gl?0p!k5u{tIO`k2^AW?EXE-5v4zpX7;zM1*ljh#8#x(F66| z0&T3q4V-*G>RZgzY>g)-KiCgW2S3Q0mk$nHO-&CzfacZ(MnBEhUoL>-AHa{h#ix(E z3@u5zpo@v%C1+{Pc1O<@$4q5se=^>)2Mz)a)I* zQ$ECE$5qur4>WGj1p!a;W!l!w(#a#I-i~bos!?@o>ZcVqcOz8AJSQvo&OGvC)Z-k# zU(J8dWvR-TTQoG>Kujg+!vQjuY(cQ3344M-Y71{di@p-K*4#QCHl_7)Wxv8z!n zyP4{3>i~}R=q82W*$Ce~hvuw}SzN`Ejs+4z|VC;O2rJ2cFym|vKV4iy_)noZOk(8SB%ictCdg7c9sHx%=2@0xL2aAlGh?&9I z7HU|NQmPL&Sf;qYJ`&jWbj%|r#a#xHpec%1aWUnsS>dwdo}NXl=B`n7ZG&;#cstK;V1DbJtn>DJ?EM&EkfKfUNim!>D_t@T-CnBg~aft zd4l}N$?VBa2|w`G3Sv5-*A&c$+~3Xk?FMyiZkNAcjVr-xv4YGEVeXbfEPqq>%;$SZ{6D~@Me1uK~WD_f5^gf7=7%;^h)CpE} zW+b94fJ@bRGsiq(8L0SUk{1=nNX8 z9tjRg3iCs-kcYiJ**nQzra%i{}1xwciPlN zHJ(WXpfaJVqS2KFdHxKSBGFkgoSw@|jwEYzrhYxJnLSa*nJ3KzB5G7CL+ls0Rgjwr zgd1#Ep|xw%w>5b73S2BQ^m0`@plx!RAOXTq1b79OvE?xBJk7BBJW4yprbMn8HyMxP zcT>tbIA4F;JG12Vo$o6(UnF{N?0f~2mmSW5@O-%s25O4w(snQc0!m7xu^3HDJH*G40}SA zm6t=xgbGZj1_XssS_1owJ_U*6W(`EL~s0rS3O+okZq*=fvV6=nuQAzD6$yN#6zF;QIc$g zc!P+9vP4i2&ZN^2*`_4CV6{iT@6A_Lo||>1Z#dv-;_s|u;Q1zC+-Z=PX_XTAip3&$ zQ+=W#Dvg^&H#On$Y^am^^eh^5O%PoVccLVJ(|ud*=i)39?^<#tswTQ6grh}UCkx=P zrDP|A%(&tGi^NH5V{zpGMH~GxY%PuzvFl#q)Njs92$wxS0H8R~PsY0=O-{5eB85dq z4u>yNs_+MVdqn9Z3F5{WO3H+xmUreg$7Vi$<1S)g7unZRO9sgNL|+M1U561OnbHZa zOx#SoQuO_74b%#c(+$ur$c_fh5xCk9%kZOQ(DWyfEqW*U1q7~>p%e%oNw<#k4H-4I zSk$rfZj2L1E!_brAVo;x@n!mXzT&}?Zc9?1m5FQ#$(#d%dQ0pl3*sDm05W}*=Vs}y$-r4`1k zo`bPDDiXrZ5jvEj?E$Drx?)6Rhpv!Ou#&K3=lz4_->h-A;IW}6ipmD~oY`;hHDROk z;2{7$uJ9VQK}gQgdeB&b4wUec)=*Sw70vX6JzC5uJbI zHba~=FW9$OAKfNAz5Nw3SQoV<(T#U;3mB>_X(k&UXkD~Pp7@O`oM}9HSU*8zeEkoM zPJ~h0?oX)BiS|^s`IQm4$#;*kU}QgfsacNnjX_fkbZi4=8HryjFS2zbOm)j-EV$r&HhorIXd%_GAdHG>of<7vqz=v*Jy9WCrW8!vFtLRKJRvjo zz-wI&UZQV*gWT%xJBA{S!Kbz?Z12L9E{^#n)vpx0rWZ<7L42o9i)LB zBG1Mm!61XAR)}K)c=`;o*SD$QYo_&73+IxZax)_A^No$kRV^`_(Ai;r!#TO1G|7K- zqc=kEH|FgNj4@+pp?3#Wb;8)n*+103f5#&tqCkzf&Ko!Wcu6G|p zq3y9U8l8@YmW{>L&Ymuaoq^w<1A#R)v1d_(iGd!W8udNBtn`R~HO{?_!x;vhL86v42mi;Buz z|2%2PUs+1rEL;LYq5;J;)Ewn_ox-{*pYpP~kakIWeI1>QtW0R5m>ET+800697Rxd! zB}9}9Cr5D@WfWz}vB4!XF!HeEVzWX(dq>B{!Uj{?_;fXq`qp9czole|5JR;>*=kji z=#eo3pD42ie`kQTd5HBh>qCXnSO5IYL-mRa8Cr6H9J%1xwT+Qs)`~4EmF%oRt6K^$ z8#E|I#x_4QJ8V#_AH>YXDbMeX85#=RHz~kpZk8-DPtUb-aupL7Xs{M*P;G4P+B-Oi z@bf|+UOPDzdblPk`qC%BL#Zbp9%2m9$2Qh<{c^Fpm!-c&i6_j&Og<}5B}BlV#39nnUQb)$$Ik^K(jZ797rCbFhhq5!oYxwf5=)G z=q>F1ZcY4~#g5@z$gsz>5OK4EwGHtd%k=1NQMy3oTX&R8;B0qKydUY+$*GaSh9I^q zipns4jm=MUQ#UulQHt8err#|`nYFWNGuuL?i5o(~S10G0Ik^qIHPX^+BFo#WJGf|g zWGPK%wYt!1p_ zHq8;Kh>wBu&dB|{u;F)YXGv+HAo;RWLD>%z+e%h}uLX&^$Clj6q|TH1_WpvKF_mr} z9uEo%3WVrrwI%fe=RL+m*@uVIrIHfL4{;y%#l>qs7b|acM!EmMY01g=kLq>XL%}q? zJB1Ak`P)6}`bOb4?3mV0W>www>$_836}7}_ZXi*AUhhs?EpmQAK+M+k@3+c2;dd`J z`-flwPvkbwWK(o}JN!m94z!Pw(h?634-n*T{ugLr@z=IlI(lViT|;1gmur3D^|0?X zp2k(z#LLT1UQ6BU663nelVnF^d$a3#zl;rTLgXK?DR7@IdnMG^{+ER?gV5>35X%^d zR^f(TP?mG~Twfobp4QM(KE|jU^MQH)3*YjU465a(X%+Y_zM3yB-yezJIz49&O|Hq@*gL9-)>9JSZ~#(b)L+__)=xt;qCn zv9S>%h(d3(P>W*3qNT-sW=9yzy+sMw-5_r>PoG6VkCAL@ijI!M-75TfFtvO!o$q_| zc{i$N=c8^dX)Ig*RXp~*Y)chEgaPYnA@6i-MoPTP;CQOb>kW_0pO~EfXKVBB;Ew%F zmvh|B(h+;`e)!x@77cw>#DBk%aq7#{|Ir`m+1;R*cUQ+~W_J4ZB6v<7VbUy*O1}oD zNL{zUUsl)aaZdQB2#?71p^C_$IsP;P)%fIO(8k`_$CjY=knval$OfPNXn?N1{?zpJ z$Hy!V1jP_q!yNK(P-vn{RY_c~#3)iEDpub81bJnZ-J(A*RxeS5@5O&q~oXZtHU9p0!lGU3phjcjc$2 zt#8tlrPEYc&g$vw`|$EoU*Eo0tRgJ=0G*o#;`@*uU%f`kEghA$eDoEpMKk)G00xQ| zJwBc*dZ{ap=T{`MvT{A$f-3THRaKRWF|h(|9eQW@oqq%tlanp2sMEBM)fbbLxPNG< z9qc`%`2SpfJvtgZu=TYUm-lU4D;}$uun`jjzG^|Lo%ozUzrVkek&z)vSK+(lXQ!M(rpshfM?#@<1Tvg>Fg|+jz^_ z@WXP>)`yD7KS36nuPTb>#JJ?ME&jcOCnqr#)_*; zf+rMMT>~AdGSdhCCRGlQR3aZJ67c~JZXykUDT_s$Atq*$INyH{?c2NSb1iF806T6((CkhYrQ ze--gO5nL1u80V#GY^Gr{M!(Q8&_LxHC6qMWJgq;spXp~A9-k35*0-_=vwz*4*qEtL zQB2>CjagciO<0&92(YoC5fdY~xw*M2 zNVYb#HFfuDz04?G;3J;FT(`tQu&iWW({r zz{2C7oWb3qq`{R+Kn#KTeMa9S7#bRW|NhNeJ)<8#CPtp={{E4Eav~F-;Ok>Q zc>D11BBc2$to81!GAzyVD3W%Irhi&*>I@%Vf&Q|UgTri?u&b$N;rX;U=|FI`ng_3? zgAecWvc|=QjmYrwnZ$2pV;ic^!O@AUg)=-%Qm^Kz|65<@=Gj3v`px0^JP6d!N+iQs z)D!4pcXcIFR?xDv)z-JOHb%8$^%45;F0T{eVl%OK`{`%WSzD+zc0z%Ep#Sbo^7^Kr zxp|xxcQ%PX>_P_@ITTC*>Mr&2f?8Pt{#$iU6feBFz11}^2q7LG9tLGZgSh6UKcjj1 zeYE3@7u62=7X%6_ibVN2`Sa#uto+20K@;4FgwQNVVAIN)jM!+}}uAe7SY z`RPXO{?459JQ-<8ak#a;t+TtkBrbCmfPhGF9bzT9D^fsJ@X*k)c6vJZDr#%d_P-Bs z7RIzW(T}{2L zB8D0o0oHJA02QaN%~fWz)`73mP_Kva>BL^3EPHNu#rrOuW zHVX{(Z}Flc+^&|+-rDZpq_cPQ?_r=gJRt`(Cid@<_I>+$8HSv`DuglebFZtZu_*7e^D=4dsbOOy zqZZ-7AcXIQ$exLr^A>rEjEV4ic%hTFk(bvqHYWW&J-%T~{wz#3>Gg7BVsBrq!3Y+w zsHE74=v4&OD=#M(C@du{!&JkVuBmxNM8sTE!_CQc_V|W_GuOq>-_w)#CiEEg@$mQn zl6~qtAtMXkz45d18n^eAmGx}cm`p~&<5>NjgjWC!rDu0~*3J>=96BAG+)sG63(H$k zaMj|Gt;^b4DG#k}3X%s_k&$Ypm3=in9_FroF8d3~V+23$OLe_sHrV;O^mUhh9($W` zo>WdLbmt3)IV#1V{Bf}Cnps@k>~3rff$OTPa{>V7H%Gmd44I0AVEO2AQBiMhJ~6EC z7k2#2C3Pfq%t4H6PpX-#V`Wbn#7;RagUHr4-SkYy^GI%a#L4SMN9E*Q&-Nu~LAu&u zrnR$if4n=kbn{JW^9KN&d1>FBJyCX$A5ie|@a(Lu@rj8;{l{bSOy(^}K*jLaJ3XPH zP#p$&X=!3k>a7_yv6@QR_XKtv3^VRZRp)l@GmoYXsK{_parl{8XBQ_(2$72N@?sLa zHLZvLdOm{4n}!y)mpq++3JM6VZEmds)=uu1am0mLSp#@+w;`5bA3TPotpybEd%YiS z>`1P+2Ej|^F$f4qu+evPmPmPdD;SxL^mW8<@b?aLGc&LF+h~4MmHxJvC%6g7t+@CMU{uB)lw6(YOVx3w<+v%C9vj}n6F;qfRo<)GzZUa+=1H@5bd4%5!mzPqe!&b}2B zD^*cZ@zwi1G+eqrF#2AB>U9LL1@b)4->|OhYJERF$I&oQW8)IqUEcbxz5CIU?qp)Z zW*-KAdFcrK=JonhL~dq!b6tqGrg{-~yenvwX6*R5tUzdh?DG|B1Gp^$^x)0KXRF3H zLG4&r5OUqY|F2XVgpNh1>Qse(ubG&ct17Rg%tvmjPe2Nd+WLiXCYj^r;Zmzng$a*W zyjD+LljTdVZzCNc?l{4kg+~|ki?#TZcs`(mqu`3d|JCp&dYToIX}GsUWY4G;|TN)?64H(H`Td&Xq#%w4`^us~H$ z(K}e$fuqSA>ve~r!(B(kaSNP_1M!a3vjR?1+!Y7g4yufm8p4i~Orn|T)i`Isei2nV zgbFs1QST}jN*d6mNwzj_fu0_#IX;3cP^Bi{P(Z<>kqlEvh)l47v3ErgPH-zAB(%M@ z_V@Crt+&&~($iQa0>(fxUqc$TCmMEG0K7!gvBk`ogbh-iY*!D3L;ly#vOI$Le!!gw3K zQ7#^AO|}G&=c*Q{qROd2JgHg*2-vU`!H(wAyQ5^Z4{pOP&Lp(rrm#{}LNzHcD?adG zct!8HpOzXjcp$lJPmSy*R3THh1=?06w%{tl)&N+VM=w57i~_D_uX;yJC79;9=UGE| z=YQsEO>7@Cb7d=)gA3B9((U;_;1EVrORq^7QT!5B8bl*{9%kt13vQZmbU)$rE*lBV zgaMKy!*OzU92(S8dj4zh=ov6)ZFHu94;3$#j7U(H!UiZ|bv!SK_X1{rm4C0%vULYK zpqBHcQK7?~DTlx?jqk?J9KH|N2qHY+@yRn?Y;A3Y+`eGMNLP^ftL2U4(P9Q`6;t1t zwK&&BE+xUh6;fS-65c$g-HIh!T)8 zpiLl45PS}B7{E-4+4u9h1C@=1uuoWy%Z%NxNA#SRfC3+j9M=^B?P2q@+X!rLcNqqr&rVSM0Afeg*{=!1&HuIyxP-y$hs zUbIRnRVIuxb6A&8xuB)zbd33I9J#!5A%FcLNJQdr!DlS&E$XX>X_0>HC@UN<=EJ8d z|5Kt$V9tK0tEos76EkZ}uGvraGB699I^HbG9DLp1yJxc=2kAErhOr--QrKATDy3=Txfyg;l!7{4aug90eDjt9b?43C@HeN z=YKgMVo^hzG^+NY6U-LAX&0EOa4cpwV>W zzM6a^ayY~oI^1&kG~!9La)MZFj2OySa$9S^YY*{$kQ`%b0>T6|28|+sm#-p%cni{l z(^f-gq=y`qkR~~k&oPt)fM5+_jdSmoQk0-@3eI>`DGo%Xgz8uRSWLCD!jV-DN5aGB z3i+q13rTW=F zp${t->p&zFrWP;73|8&Jzzi!!oFH0TFwp2^N0B&V);c)Uke%a#zVR21XUo zi9SmTB2rEUVvw;q=MLEnG>3$EqH14tnDL_425X)u%dR8!2JI$b(TfKQenfgm2^*kU zBV*CwZ4ZtEBE|c|l|U|x(0ar>38Qq;he)4Qr1v5~Ml5>a12B+g*31APORazM^Tbdm zzBO!{m;`(ssZa7}yEe_9v;D6>-&po>Jd!@g80M8mFJlA0>8T+4eS<`TAFakSL+1>v zSx=6Ut>-9%(VX2oCarO#-@29aCN)epmA+p?V@p%l zqmF)q^)@aWn=8jOVe0`)BefqS(;4-?5apbf-N6QPfcQlLvkVowh#O&n*C5-UgrQ=~ zM{i;uvHI}Ejo}w9=Y4jGq`W81FJH~=PXdD zd36SrQ@O+u@kBZVuuWBD)RenWMu?NK*#FTK8Y&BtZ@6nwu%o*z1Z*PresPwH6-x~dcSMUdlc~}cn#|+YB27f=?!)8%nZPpTgv^4{3vc~a15uyv z0eumPSg~8Ls3i^y@_S6ex&X*ODRbpZ+1RQjqdFkGmcX=%4sfk?0>lqR$gFVOJ!R2QVU3@rrfnsZ`M{wM{Ev`B2|? zh3Apw@IxT}k0e4P&{_)>{RT%iffeCIx>i(sR4dMZ0zp|c^yMfbJ4c*sArk!%*bBARu}r zM^5CqDuM#a%=8ctd`Ok2cKHuXntG@JAsfd|;k{(@k`UN3d{mJ>lP0NvQDJ&uPa$l^ z#N$cePuaQv+;S~OvTHesZB&Q>$`rZp*D86TR5Vwj#U+B35eC)L-J@W3^Gx;VQ*J`^ z;F)nD;S^m z%NeE&gXDWh#O_$Qx~^P&e0*dSl!j5uCSwdQG(u0!%p|mzHES}lRLMXuUUE!|l8EkF zq-x2ll~wXPTwKEMItCWi$UOrw2L+G?^dXYvERrcvP`@Zttnsez07q(r{c!k-$$Yt z1i}RU>mf?0(=$U=NU=Qc&~s8JU?jEHu=V#R;lhfP%+AicRhD zha3}-56x&Xo~=q5FOi`c0|aev|7wa%jiOR3gbmNnBiwhMu4B{O{_`hMendtFW_--C z&C#*e48s;CHK^4@$lh2dS(JX6<9ABTLsXV+(+s^TttT?_k*#9kqpc7*qQ0YvoQcgy zgD5=>8dS$(Jt(xxhAUNbJbq*}4_@UB+FN31XqI^v3jOr#82k4ZzYs;b&C@facwh{d zK!GTE;RR5V6fzJ)8<@;GB`=zz zQxUnVH434pn_G~PYm0={x`?nGNbYM}ZIa(b3DCM4Qb1L~{OBygZ8w^eC%&dX>Hmv$ zLezgLh#*r0<4P=9v-RER*4s^_f6UI?x1_h0nv$25iOI~-kB^}%pdlw!lgsltR!egY z8WJ)kHI-~OA|?hA8Tsn;6bz;40AyfcU|=YB_w^OjdV78S^|dpeuUIv!2Cn9hMQ68d_B!qW6 zWhATaEfq}Exf_sR;j~eq44;dn3HEm#JXYcOmNi~T%J*{wXVA|g=MAe2QR8>V25;6oe{Q%;cV>BR{5wpfE zXJ+U0H*`SaOL|&5_wRx%HPw?K9~1BFh1Hxod*cuID3H4pLk)zWtBbr}M90O&33!5( z?Z|`o2|VU;>n^^&oK#d)3^eZ($uyu&G!$Y%Tc_)XM>tc(*0`sgx6ZV0UkNocJwro> zDJjiiVPVb9&C$_Kqodxiwpt#WTOX9B1@#H@HL;h#Va&VFpzgu6->XwN=@wK+7#QkI zOb!X45d0^f=PL>CA3yF5=Zs2#Ryb?g0xU+fqP+aBIK1GbuE>en1%KfGn;Qaxl-&$n zB?7gGu<$y&IXzzw2nPVJYT^z`EAQ7|-Bn#8yp-r}gvl8@%bTF60a8{Fy9RP+78Vvh zK0fYQxYkB>X)^Nh;blKPJr#&XgcpdC{#&?B3@Q0pwXJ5L0no@WQZs<{3f?2TS+vz) zU{LV#;)6|PZ(Lkk)q3LLq4gxsOIbP>6ng4b_U~;AJ(h z_a~(zLv#7FzAh^(i|Qvu4%SRVLsQk;yj)8G_>0$R>?CJ#=GB8bQ zaddgpH~;2azr!QkNfdV17jWd+!`E_8D&%-PwS=jT~NLq#Yk%72fs)zp^~B}`2A zkB)wfGuc8yZEopN)zRGC3atw$Dk(Q*)Zp1<5;=f!6eO@LQmsu-HnzK-&(83@ecsVz z$uNWE8t~{kQcK^9)bA3>U6;r^hyo0zzow z<`nk&VC7>woxlK{V!8DYNC*?Cz3;B3@G`vc$Q<<$TH zQFVnw;KMM8cELWmBqBg-U>CXHn_|iH7D7Zo;^p0EfVLc9J)gp{89N|w~Tnmadgf{C%?Ykg{phm@yIlv!I`q^PI}z%?(Vhutf# zTOL zpoouqj*7a+PPZ(~a$##=kK8(+Sjwy2sf;=U9epHU+dlCm!jVzltvx;2X=#DW>+8O5 zZs_><#HhF*^UpS3>V^jLi=(sLJxqC9D&s=N@9>~6MfJa5N;NP61zDpi6G-lH zHuXrVN4cr5tBtp>K+7&xTAEyQmZ?S_ORsd56g3KDX5PniCNU)nff5i97>7)drKF>y zE2r+LTDQi85B>4u2Y&9R@uFE{UsqSG(J+;KXw242m1c6+{1ZcS+^6e39&mxGg2 z9x-tRC3>)4VM>&T=cW-BK5$xrSn+RM1v|e`4RTw9a8Kl4SBxhqdjAk+nKjF z`lQINaDoY2i^R*F9b`y}Lee^jewI~+jy2|!_UlYyLL%~*`IBY^hN&{}#1Y%{$#I%x z+@_QHbxk#B1~^j79GMle>aZDcNlUNLqHHW zzMDsO=+;3s%{6a>Zgo~wodif%wAvr!Gchy2#ZmdKhWad8v49^`Hvk~*%#+8|QiBrz zBsK8X&(bO;_jGho88kye$Hg0xsiAsSBxvDBD5A*KDoe`7o4)J7nMgoYf?|TKsnYaL zYbZ~pzq4hj!IuxtF%gU_^&BpQ1%?@EAoQ(I3Y|$739-w%>)n|nJ}U~JRZu%Qk$UnG zbhJT`ET}d5z1AyG?jqw&Y$*B=Qa;sx6n4%C*{BQW~WU zHJUL)qhiJ_+uB;XxTMgQX2Q7pp{SAFY!X9cTAS;1VO8Hj`+fg@=l}DZ=YF1Z&htEH zXk_%_|LXm!)E@30_`zm8QX_6nV(SOLa590R!)Xw|&-=xDs?Z;iMLVm;cl5LDJWH=D z%|HAW<3l{N$BN6mW5&*$N8f!qn4sPBwkY+xKQ)in922b+tNE9Y%}V43tn=9knG`7G z!I-{R$cOi~9ciuWp@j#_g<~_mw&YkJ8RL=D5>6OA-_w zIPggw098hxwOjLrI$c77LfH$S?h}LrYobqrL0vjbJr$a3^u(`6%w)Rq; zo8PmgK#|cw*L2ktbh(yKNc%@$U{P}kb8BnLR$sXsPpG;)dBMSX9JqrAqE3>W6lwD5 z5M%$Fx)hjsH}>Hh`f*e=CXG2BjL~p=x%w4Ui7aKawBn3Vc&d{V=G_BYw@X11Z|B;^w&T zdiA$_snp`xRsX{eBuKSO%Z|<+phit8KP@lDvgf`e?nBQxj{m(nWoT}N;e_2+n$E0* z`C*!d{i6-9CN%$B-cbWjNgH0Ju$PKbCrQm5B41x|DJrSAq=3LET5suW0GQ&!m=x{( z>Tm!5iS?@6QTe*w85tZ>sJsB;Tj&p|?*3mj(NK1@UGx>WK&y9FRMxhznoup={GmcD zdqHtOTP~fK!vg_NC*1t3>rIa^+%mY{7M2U$jZS3rykS; z;$N`F%vc0yUcvuZH=eJbJWvP^+ARkg(Y?ybcT982!=VNak=&|Xp`ueI5<#X9B9mHG zak2Qi05+<#Wy_X22f}nS#$+<^U!3ho+;pOnVr4Hj}NMLp9El1}cZGi679R#sM67~8&QoHl9h z8x)jRZN4!5Vn}dso-aMfn0SYiq7zMMXt*8F2f^u^;YKS65e6kqGY33=9m$uP%Zi z@-2gdgE17!hzDKC!$Q=PVf>TW;OTjkzsU31DwhfCk@xxKT%7h{8M2jnjp zM>RDyy?ps{{OP}|W1CTmAa!;&9&b%iYik8{3SAmS8}QMDMvKFuGR#SZWTr(TtEqwB zEP^*}ZQdZ8-4?dx^mDQ;jO3YLZRN5FFj=@S?&24 za!_^zsk;U54LsknZ_Oo&>nbhMon0yp9_ir3E^&a%+{!vK{NimlpA_IY950 zJ20Mg6Qpwq&?6vNffA39q=UzhaMT0<^h9$X5mMQbd6>{xhHyY0xcs_*i68?5&%#c- z!otFWgXLN$4cgc?lG_XV*YN6PQ(V^k)2A9@n5KZ5Q)t|Nekp)I(me6+N*6p)Xw zxb6jeZWrPxN#7)>x6Rm5uo+_L4m3jRWHLgnq?`SQ>Cws+ja8D6t|4543&t1MW*+pW z_5eEtwjZY#{#jFvqMS-|*G6y@F)|!)L~e$wupF3Cf>_ehW{#V`jrfjE8yjVS4LTOE!Q^Mr4P-mS#l`5p|c9;Ns_>& z*zgW9!f2T9i^nP5^Rm*}Vy2PMuDFjaAvEG!B7OU8yAsd9%;#HThtIF;lHX%$_RCarj1p$_%{W(1b9j=OqXEG#?j9pV z1_$<&>hY0y6Jz{NiDNePm9e*aEV-o#`3aWHuqrMr+Gt;_?`EQTlLF7R_%GIc$s}q; zrNbflakXL_w<}Paf`uF8ht`YdentiXEMr?AJ1z`RT&6)i=j(ETwF)|X_2*$+NYkRn ziZ(G9ZkM>dxg8yzIO)cGt#wt}WymAs7?~q2<@uN)LyMR67v})~}d!aWcxE_emyJ0SFduzN$A}0}{(DDcS}kA&eVO3#`Wl zaLrvzXg&`MT*wjOv;(RCl5?VfUOt4C82;je`&`uMQAu1zt!y=QD~}*cpXFKB1fZl3 zq040r(8~R`9wru^hLWL@Ww_t1$l(L}gZ&+gbo8$gMb0_Y{MK&jBF`l~5k``w7cWII zcCgK5WpX{%Yfn!k-((oK(!-W|WN}wFoX|5L4a@m)tJ|5x)Z40esJ6ckt z8-_?geSThFM8lisEMd7;-dg|C9Nd5xD<&jubVIFO-COr?;zth+LFB{9;O33!#t7-!jAjO8`z`J0SX( z&IW7afz+^D7;Amq(N;^slCOHf3G+CG*w}tKV?84HZk_Zl5dveA=QdiIdw9}+0A6Cp A%>V!Z literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 176974ae38..98e29d4091 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -56,6 +56,14 @@ Windows Defender SmartScreen provide an early warning system against websites th > [!IMPORTANT] > SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares. +## Submit files to Windows Defender SmartScreen for review + +If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/en-us/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/submission-guide). + +When submitting Microsoft Defender Smartscreen products, make sure to select Microsoft Defender Smartscreen from the menu. + +![Windows Security, Windows Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) + ## Viewing Windows Defender SmartScreen anti-phishing events When Windows Defender SmartScreen warns or blocks a user from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx). From 9e69a8df864dcb3d9d009008594dfc14d51d3f27 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 15 Apr 2020 15:24:59 -0700 Subject: [PATCH 071/249] Update windows-defender-smartscreen-overview.md --- .../windows-defender-smartscreen-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 98e29d4091..c85995784e 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -60,7 +60,7 @@ Windows Defender SmartScreen provide an early warning system against websites th If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/en-us/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/submission-guide). -When submitting Microsoft Defender Smartscreen products, make sure to select Microsoft Defender Smartscreen from the menu. +When submitting Microsoft Defender Smartscreen products, make sure to select **Microsoft Defender SmartScreen** from the menu. ![Windows Security, Windows Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) From 0e745a6624f6c92f12736d34e2dc6b2107ba078f Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 15 Apr 2020 15:50:43 -0700 Subject: [PATCH 072/249] Update windows-defender-smartscreen-overview.md --- .../windows-defender-smartscreen-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index c85995784e..b42ddf8b2e 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -58,7 +58,7 @@ Windows Defender SmartScreen provide an early warning system against websites th ## Submit files to Windows Defender SmartScreen for review -If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/en-us/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/submission-guide). +If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide). When submitting Microsoft Defender Smartscreen products, make sure to select **Microsoft Defender SmartScreen** from the menu. From 303eb1b00cb29b6efe40616944ad4be59aa315b7 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 16 Apr 2020 17:11:25 +0500 Subject: [PATCH 073/249] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index de36c85817..1df6239643 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -651,7 +651,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 9. Select **User** as a certificate type. 10. Configure **Certificate validity period** to match your organization. > [!IMPORTANT] - > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. + > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. 11. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. 12. Select **Custom** from the **Subject name format** list. From 2617a4e9efd35ee13b65255a39c7f538c66e7bd2 Mon Sep 17 00:00:00 2001 From: Ikko Ashimine Date: Fri, 17 Apr 2020 00:34:15 +0900 Subject: [PATCH 074/249] Fix typo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Micosoft→Microsoft --- windows/client-management/mdm/get-product-packages.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/get-product-packages.md b/windows/client-management/mdm/get-product-packages.md index 394b64e58c..5ad2851bc5 100644 --- a/windows/client-management/mdm/get-product-packages.md +++ b/windows/client-management/mdm/get-product-packages.md @@ -1,6 +1,6 @@ --- title: Get product packages -description: The Get product packages operation retrieves the information about applications in the Micosoft Store for Business. +description: The Get product packages operation retrieves the information about applications in the Microsoft Store for Business. ms.assetid: 039468BF-B9EE-4E1C-810C-9ACDD55C0835 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get product packages -The **Get product packages** operation retrieves the information about applications in the Micosoft Store for Business. +The **Get product packages** operation retrieves the information about applications in the Microsoft Store for Business. ## Request From f9de90c5815216da00cd5837ba233fd3498a2b62 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Thu, 16 Apr 2020 10:20:14 -0700 Subject: [PATCH 075/249] pencil edits --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index ee074d0b7c..121fd50e7c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -96,8 +96,8 @@ The following steps will guide you through onboarding VDI machines and will high 8. Use the search function by entering the machine name and select **Machine** as search type. -# Updating non-persistent virtual desktop infrastructure (VDI) images -- As a best practice, we recommend using offline servicing tools to patch golden/master images.
+## Updating non-persistent virtual desktop infrastructure (VDI) images +As a best practice, we recommend using offline servicing tools to patch golden/master images.
For example, you can use the below commands to install an update while the image remains offline: ``` @@ -113,7 +113,7 @@ For more information on DISM commands and offline servicing, please refer to the - If offline servicing is not a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health: -1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](onfigure-endpoints-script.md#offboard-machines-using-a-local-script). +1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script). 2. Ensure the sensor is off by running 'sc query sense'. From f8f181a1f54bdd504c32c85c4032b90b6a0f5220 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Thu, 16 Apr 2020 11:09:16 -0700 Subject: [PATCH 076/249] Update windows-defender-smartscreen-overview.md --- .../windows-defender-smartscreen-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index b42ddf8b2e..061727134b 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -60,7 +60,7 @@ Windows Defender SmartScreen provide an early warning system against websites th If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide). -When submitting Microsoft Defender Smartscreen products, make sure to select **Microsoft Defender SmartScreen** from the menu. +When submitting Microsoft Defender Smartscreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu. ![Windows Security, Windows Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) From a1a1fc928482ad5108a899b484afbc06aa554ab4 Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Thu, 16 Apr 2020 21:25:15 +0300 Subject: [PATCH 077/249] Update configure-endpoints-vdi.md Proposing minor adjustments --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 121fd50e7c..e4551828c9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -111,11 +111,14 @@ For more information on DISM commands and offline servicing, please refer to the - [DISM Image Management Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14) - [Reduce the Size of the Component Store in an Offline Windows Image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image) -- If offline servicing is not a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health: +If offline servicing is not a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health: 1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script). -2. Ensure the sensor is off by running 'sc query sense'. +2. Ensure the sensor is 'STOPPED' by running the command below in CMD window: +``` +sc query sense +``` 3. Service the image as needed. From bb15f02474593626e8eddea1cbc58ce4f8d52544 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Apr 2020 11:44:54 -0700 Subject: [PATCH 078/249] Update configure-endpoints-vdi.md --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index e4551828c9..455785a8c3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -15,7 +15,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 +ms.date: 04/16/2020 --- # Onboard non-persistent virtual desktop infrastructure (VDI) machines @@ -115,7 +115,7 @@ If offline servicing is not a viable option for your non-persistent VDI environm 1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script). -2. Ensure the sensor is 'STOPPED' by running the command below in CMD window: +2. Ensure the sensor is stopped by running the command below in CMD window: ``` sc query sense ``` From 112625a19ac56f854e6448cee060427747b1c019 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Thu, 16 Apr 2020 11:45:29 -0700 Subject: [PATCH 079/249] Update windows-defender-smartscreen-overview.md --- .../windows-defender-smartscreen-overview.md | 56 +++++++++---------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 061727134b..d6fb411a83 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -1,7 +1,7 @@ --- -title: Windows Defender SmartScreen overview (Windows 10) -description: Conceptual info about Windows Defender SmartScreen. -keywords: SmartScreen Filter, Windows SmartScreen, Windows Defender SmartScreen +title: Microsoft Defender SmartScreen overview (Windows 10) +description: Conceptual info about Microsoft Defender SmartScreen. +keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -15,7 +15,7 @@ ms.reviewer: manager: dansimp --- -# Windows Defender SmartScreen +# Microsoft Defender SmartScreen **Applies to:** @@ -23,53 +23,53 @@ manager: dansimp - Windows 10 Mobile - Microsoft Edge -Windows Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. +Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. -**Windows Defender SmartScreen determines whether a site is potentially malicious by:** +**Microsoft Defender SmartScreen determines whether a site is potentially malicious by:** -- Analyzing visited webpages looking for indications of suspicious behavior. If Windows Defender SmartScreen determines that a page is suspicious, it will show a warning page to advise caution. +- Analyzing visited webpages looking for indications of suspicious behavior. If Microsoft Defender SmartScreen determines that a page is suspicious, it will show a warning page to advise caution. -- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, Windows Defender SmartScreen shows a warning to let the user know that the site might be malicious. +- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, Microsoft Defender SmartScreen shows a warning to let the user know that the site might be malicious. -**Windows Defender SmartScreen determines whether a downloaded app or app installer is potentially malicious by:** +**Microsoft Defender SmartScreen determines whether a downloaded app or app installer is potentially malicious by:** -- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, Windows Defender SmartScreen shows a warning to let the user know that the site might be malicious. +- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, Microsoft Defender SmartScreen shows a warning to let the user know that the site might be malicious. -- Checking downloaded files against a list of files that are well known and downloaded by many Windows users. If the file isn't on that list, Windows Defender SmartScreen shows a warning, advising caution. +- Checking downloaded files against a list of files that are well known and downloaded by many Windows users. If the file isn't on that list, Microsoft Defender SmartScreen shows a warning, advising caution. -## Benefits of Windows Defender SmartScreen +## Benefits of Microsoft Defender SmartScreen -Windows Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are: +Microsoft Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are: -- **Anti-phishing and anti-malware support.** Windows Defender SmartScreen helps to protect users from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Windows Defender SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97) +- **Anti-phishing and anti-malware support.** Microsoft Defender SmartScreen helps to protect users from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Microsoft Defender SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97) -- **Reputation-based URL and app protection.** Windows Defender SmartScreen evaluates a website's URLs to determine if they're known to distribute or host unsafe content. It also provides reputation checks for apps, checking downloaded programs and the digital signature used to sign a file. If a URL, a file, an app, or a certificate has an established reputation, users won't see any warnings. If, however, there's no reputation, the item is marked as a higher risk and presents a warning to the user. +- **Reputation-based URL and app protection.** Microsoft Defender SmartScreen evaluates a website's URLs to determine if they're known to distribute or host unsafe content. It also provides reputation checks for apps, checking downloaded programs and the digital signature used to sign a file. If a URL, a file, an app, or a certificate has an established reputation, users won't see any warnings. If, however, there's no reputation, the item is marked as a higher risk and presents a warning to the user. -- **Operating system integration.** Windows Defender SmartScreen is integrated into the Windows 10 operating system, meaning that it checks any files an app (including 3rd-party browsers and email clients) attempts to download and run. +- **Operating system integration.** Microsoft Defender SmartScreen is integrated into the Windows 10 operating system, meaning that it checks any files an app (including 3rd-party browsers and email clients) attempts to download and run. -- **Improved heuristics and diagnostic data.** Windows Defender SmartScreen is constantly learning and endeavoring to stay up-to-date, so it can help to protect you against potentially malicious sites and files. +- **Improved heuristics and diagnostic data.** Microsoft Defender SmartScreen is constantly learning and endeavoring to stay up-to-date, so it can help to protect you against potentially malicious sites and files. -- **Management through Group Policy and Microsoft Intune.** Windows Defender SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md). +- **Management through Group Policy and Microsoft Intune.** Microsoft Defender SmartScreen supports usfing both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md). - **Blocking URLs associated with potentially unwanted applications.** In Microsoft Edge (based on Chromium), SmartScreen blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md). > [!IMPORTANT] > SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares. -## Submit files to Windows Defender SmartScreen for review +## Submit files to Microsoft Defender SmartScreen for review If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide). When submitting Microsoft Defender Smartscreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu. -![Windows Security, Windows Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) +![Windows Security, Microsoft Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) -## Viewing Windows Defender SmartScreen anti-phishing events +## Viewing Microsoft Defender SmartScreen anti-phishing events -When Windows Defender SmartScreen warns or blocks a user from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx). +When Microsoft Defender SmartScreen warns or blocks a user from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx). -## Viewing Windows event logs for Windows Defender SmartScreen -Windows Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer. +## Viewing Windows event logs for Microsoft Defender SmartScreen +Microsoft Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer. Windows event log for SmartScreen is disabled by default, users can use Event Viewer UI to enable the log or use the command line to enable it: @@ -83,10 +83,10 @@ wevtutil sl Microsoft-Windows-SmartScreen/Debug /e:true EventID | Description -|- -1000 | Application Windows Defender SmartScreen Event -1001 | Uri Windows Defender SmartScreen Event -1002 | User Decision Windows Defender SmartScreen Event +1000 | Application Microsoft Defender SmartScreen Event +1001 | Uri Microsoft Defender SmartScreen Event +1002 | User Decision Microsoft Defender SmartScreen Event ## Related topics - [Threat protection](../index.md) -- [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings) +- [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings) From 87718feff4528a0a59982bdda483af19158829a5 Mon Sep 17 00:00:00 2001 From: Drew Baron <52174821+drewbaron-wifi@users.noreply.github.com> Date: Thu, 16 Apr 2020 11:51:21 -0700 Subject: [PATCH 080/249] Update miracast-over-infrastructure.md --- devices/surface-hub/miracast-over-infrastructure.md | 1 - 1 file changed, 1 deletion(-) diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md index 0e871c1ca4..2bb6381924 100644 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ b/devices/surface-hub/miracast-over-infrastructure.md @@ -41,7 +41,6 @@ If you have a Surface Hub or other Windows 10 device that has been updated to Wi - As a Miracast source, the Windows PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. - The DNS Hostname (device name) of the Surface Hub or device needs to be resolvable via your DNS servers. You can achieve this by either allowing your Surface Hub to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the Surface Hub's hostname. - Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. -- On Windows 10 PCs, the **Projecting to this PC** feature must be enabled within System Settings, and the device must have a Wi-Fi interface enabled in order to respond to discovery requests. It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method. From 06891ea03d6148a9be281aec7161a1429e1ccbaf Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 16 Apr 2020 12:47:33 -0700 Subject: [PATCH 081/249] Update windows/security/threat-protection/windows-security-baselines.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../threat-protection/windows-security-baselines.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index 4ed9d4f9e8..535af777d7 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -76,6 +76,6 @@ You may also be interested in this msdn channel 9 video: - [Microsoft Endpoint Configuration Manager](https://www.microsoft.com/cloud-platform/system-center-configuration-manager) - [Operations Management Suite](https://www.microsoft.com/cloud-platform/operations-management-suite) - [Configuration Management for Nano Server](https://docs.microsoft.com/archive/blogs/grouppolicy/configuration-management-on-servers/) -- [Microsoft Security Guidance Blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) -- [Microsoft Security Compliance Toolkit Download](https://www.microsoft.com/download/details.aspx?id=55319) -- [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=55319) +- [Microsoft Security Guidance Blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) +- [Microsoft Security Compliance Toolkit Download](https://www.microsoft.com/download/details.aspx?id=55319) +- [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=55319) From a4de951e5d126aebec42e4267bbb18e2feca3ed0 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 16 Apr 2020 12:48:56 -0700 Subject: [PATCH 082/249] Update windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 455785a8c3..776b06c87e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -111,7 +111,7 @@ For more information on DISM commands and offline servicing, please refer to the - [DISM Image Management Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14) - [Reduce the Size of the Component Store in an Offline Windows Image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image) -If offline servicing is not a viable option for your non-persistent VDI environment, then the following steps should be taken to ensure consistency and sensor health: +If offline servicing is not a viable option for your non-persistent VDI environment, the following steps should be taken to ensure consistency and sensor health: 1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script). From c7d6bda764f6b38fc0d1ff8284bd655a08d16f7e Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 16 Apr 2020 12:49:10 -0700 Subject: [PATCH 083/249] Update windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 776b06c87e..28deb56cbf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -115,7 +115,7 @@ If offline servicing is not a viable option for your non-persistent VDI environm 1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script). -2. Ensure the sensor is stopped by running the command below in CMD window: +2. Ensure the sensor is stopped by running the command below in a CMD window: ``` sc query sense ``` From 47eb6206b1bce7f832940d2e81ebacbce9320948 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Thu, 16 Apr 2020 14:04:42 -0700 Subject: [PATCH 084/249] Update windows-defender-smartscreen-overview.md --- .../windows-defender-smartscreen-overview.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index d6fb411a83..2822f80344 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -83,9 +83,9 @@ wevtutil sl Microsoft-Windows-SmartScreen/Debug /e:true EventID | Description -|- -1000 | Application Microsoft Defender SmartScreen Event -1001 | Uri Microsoft Defender SmartScreen Event -1002 | User Decision Microsoft Defender SmartScreen Event +1000 | Application Windows Defender SmartScreen Event +1001 | Uri Windows Defender SmartScreen Event +1002 | User Decision Windows Defender SmartScreen Event ## Related topics - [Threat protection](../index.md) From dfb6de199472ed3f37f317c45b943016d64ec973 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Thu, 16 Apr 2020 14:15:30 -0700 Subject: [PATCH 085/249] Update windows-defender-smartscreen-available-settings.md --- ...defender-smartscreen-available-settings.md | 58 +++++++++---------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md index 150df52cc5..8181c99856 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md @@ -1,7 +1,7 @@ --- -title: Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows 10) -description: A list of all available settings for Windows Defender SmartScreen using Group Policy and mobile device management (MDM) settings. -keywords: SmartScreen Filter, Windows SmartScreen, Windows Defender SmartScreen +title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows 10) +description: A list of all available settings for Microsoft Defender SmartScreen using Group Policy and mobile device management (MDM) settings. +keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -13,13 +13,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp --- -# Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings +# Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings **Applies to:** - Windows 10 - Windows 10 Mobile -Windows Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Windows Defender SmartScreen, you can show employees a warning page and let them continue to the site, or you can block the site entirely. +Microsoft Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Microsoft Defender SmartScreen, you can show employees a warning page and let them continue to the site, or you can block the site entirely. See [Windows 10 (and later) settings to protect devices using Intune](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune. @@ -35,7 +35,7 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

Windows 10, Version 1607 and earlier:
Administrative Templates\Windows Components\File Explorer\Configure Windows SmartScreen At least Windows Server 2012, Windows 8 or Windows RT -This policy setting turns on Windows Defender SmartScreen.

If you enable this setting, it turns on Windows Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Windows Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).

If you disable this setting, it turns off Windows Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Windows Defender SmartScreen. +This policy setting turns on Microsoft Defender SmartScreen.

If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Microsoft Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).

If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen. Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control @@ -45,38 +45,38 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen

Windows 10, Version 1607 and earlier:
Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen Microsoft Edge on Windows 10 or later -This policy setting turns on Windows Defender SmartScreen.

If you enable this setting, it turns on Windows Defender SmartScreen and your employees are unable to turn it off.

If you disable this setting, it turns off Windows Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Windows Defender SmartScreen. +This policy setting turns on Microsoft Defender SmartScreen.

If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off.

If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen. Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files

Windows 10, Version 1511 and 1607:
Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for files Microsoft Edge on Windows 10, version 1511 or later -This policy setting stops employees from bypassing the Windows Defender SmartScreen warnings about potentially malicious files.

If you enable this setting, it stops employees from bypassing the warning, stopping the file download.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files. +This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious files.

If you enable this setting, it stops employees from bypassing the warning, stopping the file download.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files. Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites

Windows 10, Version 1511 and 1607:
Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for sites Microsoft Edge on Windows 10, version 1511 or later -This policy setting stops employees from bypassing the Windows Defender SmartScreen warnings about potentially malicious sites.

If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site. +This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious sites.

If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site. Administrative Templates\Windows Components\Internet Explorer\Prevent managing SmartScreen Filter Internet Explorer 9 or later -This policy setting prevents the employee from managing Windows Defender SmartScreen.

If you enable this policy setting, the employee isn't prompted to turn on Windows Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the employee.

If you disable or don't configure this policy setting, the employee is prompted to decide whether to turn on Windows Defender SmartScreen during the first-run experience. +This policy setting prevents the employee from managing Microsoft Defender SmartScreen.

If you enable this policy setting, the employee isn't prompted to turn on Microsoft Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the employee.

If you disable or don't configure this policy setting, the employee is prompted to decide whether to turn on Microsoft Defender SmartScreen during the first-run experience. Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings Internet Explorer 8 or later -This policy setting determines whether an employee can bypass warnings from Windows Defender SmartScreen.

If you enable this policy setting, Windows Defender SmartScreen warnings block the employee.

If you disable or don't configure this policy setting, the employee can bypass Windows Defender SmartScreen warnings. +This policy setting determines whether an employee can bypass warnings from Microsoft Defender SmartScreen.

If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings. Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet Internet Explorer 9 or later -This policy setting determines whether the employee can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen warns the employee about executable files that Internet Explorer users do not commonly download from the Internet.

If you enable this policy setting, Windows Defender SmartScreen warnings block the employee.

If you disable or don't configure this policy setting, the employee can bypass Windows Defender SmartScreen warnings. +This policy setting determines whether the employee can bypass warnings from Microsoft Defender SmartScreen. Microsoft Defender SmartScreen warns the employee about executable files that Internet Explorer users do not commonly download from the Internet.

If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings. ## MDM settings If you manage your policies using Microsoft Intune, you'll want to use these MDM policy settings. All settings support both desktop computers (running Windows 10 Pro or Windows 10 Enterprise, enrolled with Microsoft Intune) and Windows 10 Mobile devices.

-For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP - InternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer). +For Microsoft Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP - InternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer). @@ -91,8 +91,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
  • URI full path. ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
  • Data type. Integer
  • Allowed values:
      -
    • 0 . Turns off Windows Defender SmartScreen in Edge.
      • -
    • 1. Turns on Windows Defender SmartScreen in Edge.
    • +
  • 0 . Turns off Microsoft Defender SmartScreen in Edge.
    • +
  • 1. Turns on Microsoft Defender SmartScreen in Edge.
    • @@ -115,8 +115,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
  • URI full path. ./Vendor/MSFT/Policy/Config/SmartScreen/EnableSmartScreenInShell
  • Data type. Integer
  • Allowed values:
      -
    • 0 . Turns off Windows Defender SmartScreen in Windows for app and file execution.
      • -
    • 1. Turns on Windows Defender SmartScreen in Windows for app and file execution.
    • +
  • 0 . Turns off Microsoft Defender SmartScreen in Windows for app and file execution.
    • +
  • 1. Turns on Microsoft Defender SmartScreen in Windows for app and file execution.
    • @@ -127,8 +127,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
  • URI full path. ./Vendor/MSFT/Policy/Config/SmartScreen/PreventOverrideForFilesInShell
  • Data type. Integer
  • Allowed values:
      -
    • 0 . Employees can ignore Windows Defender SmartScreen warnings and run malicious files.
      • -
    • 1. Employees can't ignore Windows Defender SmartScreen warnings and run malicious files.
    • +
  • 0 . Employees can ignore Microsoft Defender SmartScreen warnings and run malicious files.
    • +
  • 1. Employees can't ignore Microsoft Defender SmartScreen warnings and run malicious files.
    • @@ -139,8 +139,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
  • URI full path. ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride
  • Data type. Integer
  • Allowed values:
      -
    • 0 . Employees can ignore Windows Defender SmartScreen warnings.
      • -
    • 1. Employees can't ignore Windows Defender SmartScreen warnings.
    • +
  • 0 . Employees can ignore Microsoft Defender SmartScreen warnings.
    • +
  • 1. Employees can't ignore Microsoft Defender SmartScreen warnings.
    • @@ -151,16 +151,16 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
  • URI full path. ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles
  • Data type. Integer
  • Allowed values:
      -
    • 0 . Employees can ignore Windows Defender SmartScreen warnings for files.
      • -
    • 1. Employees can't ignore Windows Defender SmartScreen warnings for files.
    • +
  • 0 . Employees can ignore Microsoft Defender SmartScreen warnings for files.
    • +
  • 1. Employees can't ignore Microsoft Defender SmartScreen warnings for files.
    • Setting
    ## Recommended Group Policy and MDM settings for your organization -By default, Windows Defender SmartScreen lets employees bypass warnings. Unfortunately, this can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Windows Defender SmartScreen to block high-risk interactions instead of providing just a warning. +By default, Microsoft Defender SmartScreen lets employees bypass warnings. Unfortunately, this can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Microsoft Defender SmartScreen to block high-risk interactions instead of providing just a warning. -To better help you protect your organization, we recommend turning on and using these specific Windows Defender SmartScreen Group Policy and MDM settings. +To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen Group Policy and MDM settings. @@ -168,7 +168,7 @@ To better help you protect your organization, we recommend turning on and using - + @@ -191,7 +191,7 @@ To better help you protect your organization, we recommend turning on and using - + @@ -203,7 +203,7 @@ To better help you protect your organization, we recommend turning on and using - + @@ -214,7 +214,7 @@ To better help you protect your organization, we recommend turning on and using ## Related topics - [Threat protection](../index.md) -- [Windows Defender SmartScreen overview](windows-defender-smartscreen-overview.md) +- [Microsoft Defender SmartScreen overview](windows-defender-smartscreen-overview.md) - [Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies) From 4559ab1e0a3389cc01a447b3d8f79a5974b1918f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 16 Apr 2020 14:19:47 -0700 Subject: [PATCH 086/249] Indented code blocks, trying to get hanging indent in other list items --- .../configure-endpoints-vdi.md | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 28deb56cbf..2c8c2b2f66 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -81,15 +81,15 @@ The following steps will guide you through onboarding VDI machines and will high 6. Test your solution: - a. Create a pool with one machine. + a. Create a pool with one machine. - b. Logon to machine. + b. Logon to machine. - c. Logoff from machine. + c. Logoff from machine. - d. Logon to machine with another user. + d. Logon to machine with another user. - e. **For single entry for each machine**: Check only one entry in Microsoft Defender Security Center.
    + e. **For single entry for each machine**: Check only one entry in Microsoft Defender Security Center.
    **For multiple entries for each machine**: Check multiple entries in Microsoft Defender Security Center. 7. Click **Machines list** on the Navigation pane. @@ -116,20 +116,21 @@ If offline servicing is not a viable option for your non-persistent VDI environm 1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script). 2. Ensure the sensor is stopped by running the command below in a CMD window: -``` -sc query sense -``` + + ``` + sc query sense + ``` 3. Service the image as needed. 4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumulated since boot: -``` -PsExec.exe -s cmd.exe -cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber" -del *.* /f /s /q -exit -``` + ``` + PsExec.exe -s cmd.exe + cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber" + del *.* /f /s /q + exit + ``` 5. Re-seal the golden/master image as you normally would. From 44207cfc97ffb1267a86bbd0ee08b367b545e242 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 16 Apr 2020 14:53:38 -0700 Subject: [PATCH 087/249] Acrolinx: corrected "usfing" --- .../windows-defender-smartscreen-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 2822f80344..56b4084b8b 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -49,7 +49,7 @@ Microsoft Defender SmartScreen provide an early warning system against websites - **Improved heuristics and diagnostic data.** Microsoft Defender SmartScreen is constantly learning and endeavoring to stay up-to-date, so it can help to protect you against potentially malicious sites and files. -- **Management through Group Policy and Microsoft Intune.** Microsoft Defender SmartScreen supports usfing both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md). +- **Management through Group Policy and Microsoft Intune.** Microsoft Defender SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md). - **Blocking URLs associated with potentially unwanted applications.** In Microsoft Edge (based on Chromium), SmartScreen blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md). From c5b2ef0657b7179036b7464c1d417dbb0b6ac907 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 16 Apr 2020 14:59:38 -0700 Subject: [PATCH 088/249] Update monitor-the-use-of-removable-storage-devices.md fix note style --- .../auditing/monitor-the-use-of-removable-storage-devices.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 1188b932e6..ee4ffad617 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -30,7 +30,8 @@ Use the following procedures to monitor the use of removable storage devices and Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. -> [!NOTE] When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. +> [!NOTE] +> When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. **To configure settings to monitor removable storage devices** From 01f7774740c59d3811fac1765a388974951e0a58 Mon Sep 17 00:00:00 2001 From: mapalko Date: Thu, 16 Apr 2020 15:18:00 -0700 Subject: [PATCH 089/249] updating PIN complexity MDM settings --- .../hello-manage-in-organization.md | 177 +++++------------- 1 file changed, 46 insertions(+), 131 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index b957c2cc87..93619515f1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -15,26 +15,27 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 4/2/2020 +ms.date: 10/18/2017 --- # Manage Windows Hello for Business in your organization **Applies to** -- Windows 10 + +- Windows 10 You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. >[!IMPORTANT] ->The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511. +>The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511. > ->Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. +>Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. > >Use **PIN Complexity** policy settings to manage PINs for Windows Hello for Business. - + ## Group Policy settings for Windows Hello for Business -The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. +The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. > [!NOTE] > Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**. @@ -42,15 +43,13 @@ The following table lists the Group Policy settings that you can configure for W
    Group Policy setting
    Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreenEnable. Turns on Windows Defender SmartScreen.Enable. Turns on Microsoft Defender SmartScreen.
    Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites
    Browser/AllowSmartScreen1. Turns on Windows Defender SmartScreen.1. Turns on Microsoft Defender SmartScreen.
    Browser/PreventSmartScreenPromptOverride
    SmartScreen/EnableSmartScreenInShell1. Turns on Windows Defender SmartScreen in Windows.

    Requires at least Windows 10, version 1703.

    		1. Turns on Microsoft Defender SmartScreen in Windows.

    Requires at least Windows 10, version 1703.
    SmartScreen/PreventOverrideForFilesInShell
    - - @@ -58,37 +57,15 @@ The following table lists the Group Policy settings that you can configure for W - - - - - - - - - - - - - - - - - - - - - - - -< + + - + - + - - - - - - - - - - - - - - - + - + + + + + + + + + + + + + @@ -306,7 +275,7 @@ The following table lists the MDM policy settings that you can configure for Win @@ -315,29 +284,11 @@ The following table lists the MDM policy settings that you can configure for Win - - - - - - - - - - - -
    PolicyScope Options
    Use Windows Hello for Business Computer or user -

    Not configured: Device does not provision Windows Hello for Business for any user.

    +

    Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

    Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

    Disabled: Device does not provision Windows Hello for Business for any user.

    Use a hardware security device Computer

    Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    -

    Enabled: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.

    +

    Enabled: Windows Hello for Business will only be provisioned using TPM.

    Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.
    Use certificate for on-premises authenticationComputer or user -

    Not configured: Windows Hello for Business enrolls a key that is used for on-premises authentication.

    -

    Enabled: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.

    -

    Disabled: Windows Hello for Business enrolls a key that is used for on-premises authentication.

    -
    Use PIN recoveryComputer -

    Added in Windows 10, version 1703

    -

    Not configured: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    -

    Enabled: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

    -

    Disabled: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    -
    Use biometrics Computer

    Not configured: Biometrics can be used as a gesture in place of a PIN.

    Enabled: Biometrics can be used as a gesture in place of a PIN.

    @@ -98,7 +75,6 @@ The following table lists the Group Policy settings that you can configure for W
    PIN Complexity Require digitsComputer

    Not configured: Users must include a digit in their PIN.

    Enabled: Users must include a digit in their PIN.

    @@ -107,7 +83,6 @@ The following table lists the Group Policy settings that you can configure for W
    Require lowercase lettersComputer

    Not configured: Users cannot use lowercase letters in their PIN.

    Enabled: Users must include at least one lowercase letter in their PIN.

    @@ -116,7 +91,6 @@ The following table lists the Group Policy settings that you can configure for W
    Maximum PIN lengthComputer

    Not configured: PIN length must be less than or equal to 127.

    Enabled: PIN length must be less than or equal to the number you specify.

    @@ -125,7 +99,6 @@ The following table lists the Group Policy settings that you can configure for W
    Minimum PIN lengthComputer

    Not configured: PIN length must be greater than or equal to 4.

    Enabled: PIN length must be greater than or equal to the number you specify.

    @@ -134,7 +107,6 @@ The following table lists the Group Policy settings that you can configure for W
    ExpirationComputer

    Not configured: PIN does not expire.

    Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

    @@ -143,7 +115,6 @@ The following table lists the Group Policy settings that you can configure for W
    HistoryComputer

    Not configured: Previous PINs are not stored.

    Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

    @@ -154,7 +125,6 @@ The following table lists the Group Policy settings that you can configure for W
    Require special charactersComputer

    Not configured: Users cannot include a special character in their PIN.

    Enabled: Users must include at least one special character in their PIN.

    @@ -163,7 +133,6 @@ The following table lists the Group Policy settings that you can configure for W
    Require uppercase lettersComputer

    Not configured: Users cannot include an uppercase letter in their PIN.

    Enabled: Users must include at least one uppercase letter in their PIN.

    @@ -171,9 +140,9 @@ The following table lists the Group Policy settings that you can configure for W
    Phone Sign-inUse Phone Sign-inComputer>Phone Sign-in +

    Use Phone Sign-in

    Not currently supported.

    @@ -198,7 +167,7 @@ The following table lists the MDM policy settings that you can configure for Win
    UsePassportForWork Device or userDevice True

    True: Windows Hello for Business will be provisioned for all users on the device.

    @@ -210,7 +179,7 @@ The following table lists the MDM policy settings that you can configure for Win
    RequireSecurityDevice Device or userDevice False

    True: Windows Hello for Business will only be provisioned using TPM.

    @@ -218,28 +187,6 @@ The following table lists the MDM policy settings that you can configure for Win
    Exclude Security DeviceTPM12DeviceFalse -

    Added in Windows 10, version 1703

    -

    True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.

    -

    False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.

    -
    EnablePinRecoveryDevice or userFalse -

    Added in Windows 10, version 1703

    -

    True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

    -

    False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    -
    Biometrics

    UseBiometrics

    @@ -270,19 +217,41 @@ The following table lists the MDM policy settings that you can configure for Win
    Digits Device or user2 1 -

    1: Numbers are not allowed.

    -

    2: At least one number is required.

    +

    0: Numbers are allowed.

    +

    1: At least one number is required.

    +

    2: Numbers are not allowed.

    Lowercase letters Device or user1 2 -

    1: Lowercase letters are not allowed.

    -

    2: At least one lowercase letter is required.

    +

    0: Lowercase letters are allowed.

    +

    1: At least one lowercase letter is required.

    +

    2: Lowercase letters are not allowed.

    +
    Special charactersDevice or user2 +

    0: Special characters are allowed.

    +

    1: At least one special character is required.

    +

    2: Special characters are not allowed.

    +
    Uppercase lettersDevice or user2 +

    0: Uppercase letters are allowed.

    +

    1: At least one uppercase letter is required.

    +

    2: Uppercase letters are not allowed.

    Device or user 0 -

    Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire. +

    Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.

    Device or user 0 -

    Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. +

    Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.

    Special charactersDevice or user1 -

    1: Special characters are not allowed.

    -

    2: At least one special character is required.

    -
    Uppercase lettersDevice or user1 -

    1: Uppercase letters are not allowed

    -

    2: At least one uppercase letter is required

    -
    Remote

    UseRemotePassport

    @@ -351,47 +302,11 @@ The following table lists the MDM policy settings that you can configure for Win
    >[!NOTE] -> In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN. - -## Policy conflicts from multiple policy sources - -Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device. - -Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. All PIN complexity policies are grouped together and enforced from a single policy source. - -Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis. - ->[!Note] -> Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP. - ->Examples -> ->The following are configured using computer Group Policy: -> ->- Use Windows Hello for Business - Enabled ->- User certificate for on-premises authentication - Enabled ->- Require digits - Enabled ->- Minimum PIN length - 6 -> ->The following are configured using device MDM Policy: -> ->- UsePassportForWork - Disabled ->- UseCertificateForOnPremAuth - Disabled ->- MinimumPINLength - 8 ->- Digits - 1 ->- LowercaseLetters - 1 ->- SpecialCharacters - 1 -> ->Enforced policy set: -> ->- Use Windows Hello for Business - Enabled ->- Use certificate for on-premises authentication - Enabled ->- Require digits - Enabled ->- Minimum PIN length - 6 +> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. ## How to use Windows Hello for Business with Azure Active Directory -There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: +There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: - **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant's directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. - **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won't be enabled unless and until the organization's administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. From 68fdbf25bb8c1c5419bb0a4b2fe6048529d02df4 Mon Sep 17 00:00:00 2001 From: mapalko Date: Thu, 16 Apr 2020 15:38:37 -0700 Subject: [PATCH 090/249] updating PIN complexity MDM settings --- .../hello-manage-in-organization.md | 113 ++++++++++++++++-- 1 file changed, 101 insertions(+), 12 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 93619515f1..0656bcd49c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -15,13 +15,12 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 10/18/2017 +ms.date: 4/16/2017 --- # Manage Windows Hello for Business in your organization **Applies to** - - Windows 10 You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. @@ -35,7 +34,7 @@ You can create a Group Policy or mobile device management (MDM) policy that will ## Group Policy settings for Windows Hello for Business -The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. +The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. > [!NOTE] > Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**. @@ -43,13 +42,15 @@ The following table lists the Group Policy settings that you can configure for W + + @@ -57,15 +58,37 @@ The following table lists the Group Policy settings that you can configure for W + + + + + + + + + + + + + + + + + + + + + - - + + - + - + + + + + + + + + + + + + + +
    PolicyScope Options
    Use Windows Hello for Business Computer or user -

    Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

    +

    Not configured: Device does not provision Windows Hello for Business for any user.

    Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

    Disabled: Device does not provision Windows Hello for Business for any user.

    Use a hardware security device Computer

    Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    -

    Enabled: Windows Hello for Business will only be provisioned using TPM.

    +

    Enabled: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.

    Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.
    Use certificate for on-premises authenticationComputer or user +

    Not configured: Windows Hello for Business enrolls a key that is used for on-premises authentication.

    +

    Enabled: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.

    +

    Disabled: Windows Hello for Business enrolls a key that is used for on-premises authentication.

    +
    Use PIN recoveryComputer +

    Added in Windows 10, version 1703

    +

    Not configured: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    +

    Enabled: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

    +

    Disabled: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    +
    Use biometrics Computer

    Not configured: Biometrics can be used as a gesture in place of a PIN.

    Enabled: Biometrics can be used as a gesture in place of a PIN.

    @@ -75,6 +98,7 @@ The following table lists the Group Policy settings that you can configure for W
    PIN Complexity Require digitsComputer

    Not configured: Users must include a digit in their PIN.

    Enabled: Users must include a digit in their PIN.

    @@ -83,6 +107,7 @@ The following table lists the Group Policy settings that you can configure for W
    Require lowercase lettersComputer

    Not configured: Users cannot use lowercase letters in their PIN.

    Enabled: Users must include at least one lowercase letter in their PIN.

    @@ -91,6 +116,7 @@ The following table lists the Group Policy settings that you can configure for W
    Maximum PIN lengthComputer

    Not configured: PIN length must be less than or equal to 127.

    Enabled: PIN length must be less than or equal to the number you specify.

    @@ -99,6 +125,7 @@ The following table lists the Group Policy settings that you can configure for W
    Minimum PIN lengthComputer

    Not configured: PIN length must be greater than or equal to 4.

    Enabled: PIN length must be greater than or equal to the number you specify.

    @@ -107,6 +134,7 @@ The following table lists the Group Policy settings that you can configure for W
    ExpirationComputer

    Not configured: PIN does not expire.

    Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

    @@ -115,6 +143,7 @@ The following table lists the Group Policy settings that you can configure for W
    HistoryComputer

    Not configured: Previous PINs are not stored.

    Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

    @@ -125,6 +154,7 @@ The following table lists the Group Policy settings that you can configure for W
    Require special charactersComputer

    Not configured: Users cannot include a special character in their PIN.

    Enabled: Users must include at least one special character in their PIN.

    @@ -133,6 +163,7 @@ The following table lists the Group Policy settings that you can configure for W
    Require uppercase lettersComputer

    Not configured: Users cannot include an uppercase letter in their PIN.

    Enabled: Users must include at least one uppercase letter in their PIN.

    @@ -140,9 +171,9 @@ The following table lists the Group Policy settings that you can configure for W
    >Phone Sign-in -

    Use Phone Sign-in

    +    		Phone Sign-inUse Phone Sign-inComputer

    Not currently supported.

    @@ -167,7 +198,7 @@ The following table lists the MDM policy settings that you can configure for Win
    UsePassportForWork DeviceDevice or user True

    True: Windows Hello for Business will be provisioned for all users on the device.

    @@ -179,7 +210,7 @@ The following table lists the MDM policy settings that you can configure for Win
    RequireSecurityDevice DeviceDevice or user False

    True: Windows Hello for Business will only be provisioned using TPM.

    @@ -187,6 +218,28 @@ The following table lists the MDM policy settings that you can configure for Win
    Exclude Security DeviceTPM12DeviceFalse +

    Added in Windows 10, version 1703

    +

    True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.

    +

    False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.

    +
    EnablePinRecoveryDevice or userFalse +

    Added in Windows 10, version 1703

    +

    True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

    +

    False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    +
    Biometrics

    UseBiometrics

    @@ -302,11 +355,47 @@ The following table lists the MDM policy settings that you can configure for Win
    >[!NOTE] -> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. +> In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN. + +## Policy conflicts from multiple policy sources + +Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device. + +Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. All PIN complexity policies are grouped together and enforced from a single policy source. + +Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis. + +>[!NOTE] +> Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP. + +>Examples +> +>The following are configured using computer Group Policy: +> +>- Use Windows Hello for Business - Enabled +>- User certificate for on-premises authentication - Enabled +>- Require digits - Enabled +>- Minimum PIN length - 6 +> +>The following are configured using device MDM Policy: +> +>- UsePassportForWork - Disabled +>- UseCertificateForOnPremAuth - Disabled +>- MinimumPINLength - 8 +>- Digits - 1 +>- LowercaseLetters - 1 +>- SpecialCharacters - 1 +> +>Enforced policy set: +> +>- Use Windows Hello for Business - Enabled +>- Use certificate for on-premises authentication - Enabled +>- Require digits - Enabled +>- Minimum PIN length - 6d ## How to use Windows Hello for Business with Azure Active Directory -There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: +There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: - **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant's directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. - **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won't be enabled unless and until the organization's administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. From a4fd66c001620d9920e513fd20ee7e165d5a2ec6 Mon Sep 17 00:00:00 2001 From: Kweku Ako-Adjei Date: Thu, 16 Apr 2020 16:01:15 -0700 Subject: [PATCH 091/249] Update release-history-microsoft-store-business-education.md --- .../release-history-microsoft-store-business-education.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index cc3bbbad3c..c2e6c18cf4 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -45,7 +45,7 @@ Looking for info on the latest release? Check out [What's new in Microsoft Store - **Private store collection updates** - We’ve made it easier to find apps when creating private store collections – now you can search and filter results. [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-collections) - **Manage Skype Communication credits** - Office 365 customers that own Skype Communication Credits can now see and manage them in Microsoft Store for Business. You can view your account, add funds to your account, and manage auto-recharge settings. -- **Upgrade Office 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 Business to Office 365 Business Premium. +- **Upgrade Office 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 Business to Microsoft 365 Business Standard. ## January and February 2018 - **One place for apps, software, and subscriptions** - The new **Products & services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. @@ -61,7 +61,7 @@ Looking for info on the latest release? Check out [What's new in Microsoft Store - **Export list of Minecraft: Education Edition users** - Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file. ## October 2017 -- Bug fixes and performance improvements. +- Bug fixes and performance improvements. ## September 2017 From 19c2b0f3d45d86661acd6279cc37781234cf560e Mon Sep 17 00:00:00 2001 From: Kweku Ako-Adjei Date: Thu, 16 Apr 2020 16:14:51 -0700 Subject: [PATCH 092/249] Sku changes for Microsoft 365 --- ...d-deployment-surface-hub-device-accounts.md | 2 +- .../deploy-windows-10-in-a-school-district.md | 12 ++++++------ .../windows/deploy-windows-10-in-a-school.md | 8 ++++---- .../windows/set-up-school-pcs-whats-new.md | 2 +- ...ing-microsoft-office-2013-by-using-app-v.md | 4 ++-- ...g-microsoft-office-2013-by-using-app-v51.md | 4 ++-- ...ing-microsoft-office-2016-by-using-app-v.md | 8 ++++---- ...g-microsoft-office-2016-by-using-app-v51.md | 8 ++++---- .../planning-for-using-app-v-with-office.md | 2 +- .../planning-for-using-app-v-with-office51.md | 2 +- smb/cloud-mode-business-setup.md | 10 +++++----- ...story-microsoft-store-business-education.md | 2 +- ...eploying-microsoft-office-2013-with-appv.md | 4 ++-- ...eploying-microsoft-office-2016-with-appv.md | 8 ++++---- ...appv-planning-for-using-appv-with-office.md | 2 +- ...erver-side-mobile-application-management.md | 4 ++-- windows/client-management/mdm/office-csp.md | 2 +- .../provision-pcs-with-apps.md | 2 +- windows/deployment/deploy-whats-new.md | 6 +++--- .../create-a-windows-10-reference-image.md | 18 +++++++++--------- windows/deployment/index.yml | 2 +- ...pare-your-organization-for-windows-to-go.md | 2 +- .../deployment/update/windows-as-a-service.md | 2 +- .../autopilot-device-guidelines.md | 2 +- .../windows-autopilot-requirements.md | 4 ++-- ...ows-diagnostic-data-in-your-organization.md | 2 +- windows/privacy/gdpr-win10-whitepaper.md | 2 +- .../enlightened-microsoft-apps-and-wip.md | 4 ++-- .../security-compliance-toolkit-10.md | 2 +- .../windows-security-baselines.md | 4 ++-- .../whats-new-windows-10-version-1903.md | 2 +- .../whats-new-windows-10-version-1909.md | 2 +- 32 files changed, 70 insertions(+), 70 deletions(-) diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index 73c94f6557..329f00f931 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -144,7 +144,7 @@ Next, you enable the device account with [Skype for Business Online](#skype-for- To enable Skype for Business online, your tenant users must have Exchange mailboxes (at least one Exchange mailbox in the tenant is required). The following table explains which plans or additional services you need. -| Skype room system scenario | If you have Office 365 Premium, Office 365 ProPlus, or Skype for Business Standalone Plan 2, you need: | If you have an Enterprise-based plan, you need: | If you have Skype for Business Server 2015 (on-premises or hybrid), you need: | +| Skype room system scenario | If you have Office 365 Premium, Microsoft 365 Apps for enterprise, or Skype for Business Standalone Plan 2, you need: | If you have an Enterprise-based plan, you need: | If you have Skype for Business Server 2015 (on-premises or hybrid), you need: | | --- | --- | --- | --- | | Join a scheduled meeting | Skype for Business Standalone Plan 1 | E1, 3, 4, or 5 | Skype for Business Server Standard CAL | | Initiate an ad-hoc meeting | Skype for Business Standalone Plan 2 | E 1, 3, 4, or 5 | Skype for Business Server Standard CAL or Enterprise CAL | diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index c081cfa696..280778ccb4 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -558,16 +558,16 @@ Complete the following steps to select the appropriate Office 365 Education lice 1. Determine the number of faculty members and students who will use the classroom. Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan. -2. Determine the faculty members and students who need to install Microsoft Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 8 lists the advantages and disadvantages of standard and Office 365 ProPlus plans. +2. Determine the faculty members and students who need to install Microsoft Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Microsoft 365 Apps for enterprise plans). Table 8 lists the advantages and disadvantages of standard and Microsoft 365 Apps for enterprise plans. |Plan |Advantages |Disadvantages | |----- |----------- |------------- | - |Office 365 Education |

    • Less expensive than Office 365 ProPlus
    • Can be run from any device
    • No installation necessary
    |
    • Must have an Internet connection to use it
    • Does not support all the features found in Office 365 ProPlus
    | - |Office 365 ProPlus |
    • Only requires an Internet connection every 30 days (for activation)
    • Supports the full set of Office features
    • Can be installed on five devices per user (there is no limit to the number of devices on which you can run Office apps online)
    |
    • Requires installation
    • More expensive than Office 365 Education
    | + |Office 365 Education |
    • Less expensive than Microsoft 365 Apps for enterprise
    • Can be run from any device
    • No installation necessary
    |
    • Must have an Internet connection to use it
    • Does not support all the features found in Microsoft 365 Apps for enterprise
    | + |Microsoft 365 Apps for enterprise |
    • Only requires an Internet connection every 30 days (for activation)
    • Supports the full set of Office features
    • Can be installed on five devices per user (there is no limit to the number of devices on which you can run Office apps online)
    |
    • Requires installation
    • More expensive than Office 365 Education
    | - *Table 8. Comparison of standard and Office 365 ProPlus plans* + *Table 8. Comparison of standard and Microsoft 365 Apps for enterprise plans* - The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. + The best user experience is to run Microsoft 365 Apps for enterprise or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. 3. Determine whether students or faculty need Azure Rights Management. @@ -1259,7 +1259,7 @@ Your MDT deployment share and Microsoft Endpoint Configuration Manager are now r ## Capture the reference image -The reference device is a device that you use as the template for all the other devices in your district. On this device, you install any Windows desktop apps the classroom needs. For example, install the Windows desktop apps for Office 365 ProPlus if you selected that student license plan. +The reference device is a device that you use as the template for all the other devices in your district. On this device, you install any Windows desktop apps the classroom needs. For example, install the Windows desktop apps for Microsoft 365 Apps for enterprise if you selected that student license plan. After you deploy Windows 10 and the desktop apps to the reference device, you capture an image of the device (the reference image). You import the reference image to an MDT deployment share or into Configuration Manager. Finally, you create a task sequence to deploy the reference image to faculty and student devices. diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index f582026716..1c429d1f52 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -173,9 +173,9 @@ Complete the following steps to select the appropriate Office 365 Education lice
    1. Determine the number of faculty members and students who will use the classroom.
      Office 365 Education licensing plans are available specifically for faculty and students. You must assign faculty and students the correct licensing plan.
      2. -
    2. Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
      3. +
    3. Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Microsoft 365 Apps for enterprise plans). Table 1 lists the advantages and disadvantages of standard and Microsoft 365 Apps for enterprise plans.

      4. -Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans +Table 1. Comparison of standard and Microsoft Microsoft 365 Apps for enterprise plans
      @@ -191,13 +191,13 @@ Complete the following steps to select the appropriate Office 365 Education lice - +
      Standard
      • Less expensive than Office 365 ProPlus
      • Can be run from any device
      • No installation necessary
      • Must have an Internet connection to use it
      • Does not support all the features found in Office 365 ProPlus
      Standard
      • Less expensive than Microsoft 365 Apps for enterprise
      • Can be run from any device
      • No installation necessary
      • Must have an Internet connection to use it
      • Does not support all the features found in Microsoft 365 Apps for enterprise
      Office ProPlus
      • Only requires an Internet connection every 30 days (for activation)
      • Supports full set of Office features
      • Requires installation
      • Can be installed on only five devices per user (there is no limit to the number of devices on which you can run Office apps online)

      -The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device. +The best user experience is to run Microsoft 365 Apps for enterprise or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device.
    4. Determine whether students or faculty need Azure Rights Management.
      You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see Azure Rights Management.
    5. Record the Office 365 Education license plans needed for the classroom in Table 2.

      diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md index 7d74f93c5d..fe8d0d640e 100644 --- a/education/windows/set-up-school-pcs-whats-new.md +++ b/education/windows/set-up-school-pcs-whats-new.md @@ -21,7 +21,7 @@ Learn what’s new with the Set up School PCs app each week. Find out about new ## Week of September 23, 2019 ### Easier way to deploy Office 365 to your classroom devices - Microsoft Office now appears as an option on the **Apps** screen. Select the app to add it to your provisioning package. Devices install Office 365 ProPlus. This version includes the cloud-connected and most current versions of apps such as Word, PowerPoint, Excel, and Teams. + Microsoft Office now appears as an option on the **Apps** screen. Select the app to add it to your provisioning package. Devices install Microsoft 365 Apps for enterprise. This version includes the cloud-connected and most current versions of apps such as Word, PowerPoint, Excel, and Teams. ## Week of June 24, 2019 diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md index 6ac193ddbc..ec3642bc65 100644 --- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md +++ b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md @@ -101,7 +101,7 @@ Before you deploy Office by using App-V, review the following requirements.

      Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

        -

      • Office 365 ProPlus

        • +

      • Microsoft 365 Apps for enterprise

      • Visio Pro for Office 365

      • Project Pro for Office 365

      @@ -640,7 +640,7 @@ Use the steps in this section to enable Office plug-ins with your Office package 1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. -2. Sequence your plug-ins using the App-V 5.0 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. +2. Sequence your plug-ins using the App-V 5.0 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. 3. Create an App-V 5.0 package that includes the desired plug-ins. diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md index 2e781bfa2b..3c08f56eaf 100644 --- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md +++ b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md @@ -100,7 +100,7 @@ Before you deploy Office by using App-V, review the following requirements.

      Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

        -

      • Office 365 ProPlus

        • +

      • Microsoft 365 Apps for enterprise

      • Visio Pro for Office 365

      • Project Pro for Office 365

      @@ -648,7 +648,7 @@ Use the steps in this section to enable Office plug-ins with your Office package 1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. -2. Sequence your plug-ins using the App-V 5.1 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. +2. Sequence your plug-ins using the App-V 5.1 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. 3. Create an App-V 5.1 package that includes the desired plug-ins. diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md index f66484192f..2856f34f5d 100644 --- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md +++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md @@ -102,7 +102,7 @@ Before you deploy Office by using App-V, review the following requirements.

      Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

        -

      • Office 365 ProPlus

        • +

      • Microsoft 365 Apps for enterprise

      • Visio Pro for Office 365

      • Project Pro for Office 365

      @@ -293,7 +293,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc

      Channel (attribute of Add element)

      -

      Optional. Specifies the update channel for the product that you want to download or install.

      For more information about update channels, see Overview of update channels for Office 365 ProPlus.

      +

      Optional. Specifies the update channel for the product that you want to download or install.

      For more information about update channels, see Overview of update channels for Microsoft 365 Apps for enterprise.

      Channel="Deferred"

      @@ -348,7 +348,7 @@ After you download the Office 2016 applications through the Office Deployment To The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. ->**Note**  You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. +>**Note**  You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. @@ -588,7 +588,7 @@ Use the steps in this section to enable Office plug-ins with your Office package 1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. +2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. 3. Create an App-V package that includes the desired plug-ins. diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md index 317e8df4e7..6d6021c95e 100644 --- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md +++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md @@ -102,7 +102,7 @@ Before you deploy Office by using App-V, review the following requirements. @@ -293,7 +293,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc - + @@ -348,7 +348,7 @@ After you download the Office 2016 applications through the Office Deployment To The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. ->**Note**  You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. +>**Note**  You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported.

      Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

        -

      • Office 365 ProPlus

        • +

      • Microsoft 365 Apps for enterprise

      • Visio Pro for Office 365

      • Project Pro for Office 365

      Branch (attribute of Add element)

      Optional. Specifies the update branch for the product that you want to download or install.

      For more information about update branches, see Overview of update branches for Office 365 ProPlus.

      Optional. Specifies the update branch for the product that you want to download or install.

      For more information about update branches, see Overview of update branches for Microsoft 365 Apps for enterprise.

      Branch = "Business"
      @@ -588,7 +588,7 @@ Use the steps in this section to enable Office plug-ins with your Office package 1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. +2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. 3. Create an App-V package that includes the desired plug-ins. diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office.md b/mdop/appv-v5/planning-for-using-app-v-with-office.md index 7f570f7070..bb0f791a10 100644 --- a/mdop/appv-v5/planning-for-using-app-v-with-office.md +++ b/mdop/appv-v5/planning-for-using-app-v-with-office.md @@ -61,7 +61,7 @@ The following table lists the versions of Microsoft Office that App-V supports, - +

      Microsoft 365 Apps for business (the version of Office that comes with some Microsoft 365 plans, such as Business Premium.)

      - + diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index ec46006921..58e1e0a8e9 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -65,7 +65,7 @@ The only supported operation is Get. ## Examples -Sample SyncML to install Office 365 Business Retail from current channel. +Sample SyncML to install Microsoft 365 Apps for business Retail from current channel. ```xml diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index b69a8c78e1..3de98a5454 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -27,7 +27,7 @@ In Windows 10, version 1703, you can install multiple Universal Windows Platform When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). >[!IMPORTANT] ->If you plan to use Intune to manage your devices, we recommend using Intune to install Office 365 ProPlus 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Office 365 ProPlus). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Office 365 ProPlus 2016 apps using Microsoft Intune.](https://docs.microsoft.com/intune/apps-add-office365) +>If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Microsoft 365 Apps for enterprise). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Microsoft 365 Apps for enterprise 2016 apps using Microsoft Intune.](https://docs.microsoft.com/intune/apps-add-office365) ## Settings for UWP apps diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index bc0b6b6602..4e60ac99b8 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -36,7 +36,7 @@ New [Windows Autopilot](#windows-autopilot) content is available.
      ## The Modern Desktop Deployment Center -The [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) has launched with tons of content to help you with large-scale deployment of Windows 10 and Office 365 ProPlus. +The [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) has launched with tons of content to help you with large-scale deployment of Windows 10 and Microsoft 365 Apps for enterprise. ## Microsoft 365 @@ -49,7 +49,7 @@ See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, whic ## Windows 10 servicing and support -- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon! +- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon! - [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. - [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. @@ -58,7 +58,7 @@ See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, whic - **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. - **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. -Microsoft previously announced that we are [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Office 365 ProPlus will continue to be supported for 18 months (there is no change for these editions). These support policies are summarized in the table below. +Microsoft previously announced that we are [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Microsoft 365 Apps for enterprise will continue to be supported for 18 months (there is no change for these editions). These support policies are summarized in the table below. ![Support lifecycle](images/support-cycle.png) diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md index aada4ef42f..c55b476746 100644 --- a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md +++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md @@ -160,10 +160,10 @@ Download all three items in this list to the D:\\Downloads folder on MDT01. ### Create configuration file: Microsoft Office 365 Professional Plus x64 1. After downloading the most current version of the Office Deployment tool from the Microsoft Download Center using the link provided above, run the self-extracting executable file and extract the files to **D:\\Downloads\\Office365**. The Office Deployment Tool (setup.exe) and several sample configuration.xml files will be extracted. -2. Using a text editor (such as Notepad), create an XML file in the D:\\Downloads\\Office365 directory with the installation settings for Office 365 ProPlus that are appropriate for your organization. The file uses an XML format, so the file you create must have an extension of .xml but the file can have any filename. +2. Using a text editor (such as Notepad), create an XML file in the D:\\Downloads\\Office365 directory with the installation settings for Microsoft 365 Apps for enterprise that are appropriate for your organization. The file uses an XML format, so the file you create must have an extension of .xml but the file can have any filename. For example, you can use the following configuration.xml file, which provides these configuration settings: - - Install the 64-bit version of Office 365 ProPlus in English directly from the Office Content Delivery Network (CDN) on the internet. Note: 64-bit is now the default and recommended edition. + - Install the 64-bit version of Microsoft 365 Apps for enterprise in English directly from the Office Content Delivery Network (CDN) on the internet. Note: 64-bit is now the default and recommended edition. - Use the Semi-Annual Channel and get updates directly from the Office CDN on the internet. - Perform a silent installation. You won’t see anything that shows the progress of the installation and you won’t see any error messages. @@ -179,7 +179,7 @@ Download all three items in this list to the D:\\Downloads folder on MDT01. ``` - By using these settings, any time you build the reference image you’ll be installing the most up-to-date Semi-Annual Channel version of Office 365 ProPlus. + By using these settings, any time you build the reference image you’ll be installing the most up-to-date Semi-Annual Channel version of Microsoft 365 Apps for enterprise. >[!TIP] >You can also use the web-based interface of the [Office Customization Tool](https://config.office.com/) to help you create your configuration.xml file. @@ -190,16 +190,16 @@ Download all three items in this list to the D:\\Downloads folder on MDT01. ![folder](../images/office-folder.png) - Assuming you have named the file "configuration.xml" as shown above, we will use the command "**setup.exe /configure configuration.xml**" when we create the application in MDT. This will perform the installation of Office 365 ProPlus using the configuration settings in the configuration.xml file. Do not perform this step yet. + Assuming you have named the file "configuration.xml" as shown above, we will use the command "**setup.exe /configure configuration.xml**" when we create the application in MDT. This will perform the installation of Microsoft 365 Apps for enterprise using the configuration settings in the configuration.xml file. Do not perform this step yet. >[!IMPORTANT] - >After Office 365 ProPlus is installed on the reference image, do NOT open any Office programs. if you open an Office program, you are prompted to sign-in, which activates the installation of Office 365 ProPlus. Even if you don't sign in and you close the Sign in to set up Office dialog box, a temporary product key is installed. You don't want any kind of product key for Office 365 ProPlus installed as part of your reference image. + >After Microsoft 365 Apps for enterprise is installed on the reference image, do NOT open any Office programs. if you open an Office program, you are prompted to sign-in, which activates the installation of Microsoft 365 Apps for enterprise. Even if you don't sign in and you close the Sign in to set up Office dialog box, a temporary product key is installed. You don't want any kind of product key for Microsoft 365 Apps for enterprise installed as part of your reference image. Additional information -- Office 365 ProPlus is usually updated on a monthly basis with security updates and other quality updates (bug fixes), and possibly new features (depending on which update channel you’re using). That means that once you’ve deployed your reference image, Office 365 ProPlus will most likely need to download and install the latest updates that have been released since you created your reference image. +- Microsoft 365 Apps for enterprise is usually updated on a monthly basis with security updates and other quality updates (bug fixes), and possibly new features (depending on which update channel you’re using). That means that once you’ve deployed your reference image, Microsoft 365 Apps for enterprise will most likely need to download and install the latest updates that have been released since you created your reference image. -- **Note**: By using installing Office Deployment Tool as part of the reference image, Office 365 ProPlus is installed immediately after the reference image is deployed to the user’s device, rather than including Office apps part of the reference image. This way the user will have the most up-to-date version of Office 365 ProPlus right away and won’t have to download any new updates (which is most likely what would happen if Office 365 ProPlus was installed as part of the reference image.) - - When you are creating your reference image, instead of installing Office 365 ProPlus directly from the Office CDN on the internet, you can install Office 365 ProPlus from a location on your local network, such as a file share. To do that, you would use the Office Deployment Tool in /download mode to download the installation files to that file share. Then you could use the Office Deployment Tool in /configure mode to install Office 365 ProPlus from that location on to your reference image. As part of that, you’ll need to point to that location in your configuration.xml file so that the Office Deployment Tool knows where to get the Office 365 ProPlus files. If you decide to do this, the next time you create a new reference image, you’ll want to be sure to use the Office Deployment Tool to download the most up-to-date installation files for Office 365 ProPlus to that location on your internal network. That way your new reference image will have a more up-to-date installation of Office 365 ProPlus. +- **Note**: By using installing Office Deployment Tool as part of the reference image, Microsoft 365 Apps for enterprise is installed immediately after the reference image is deployed to the user’s device, rather than including Office apps part of the reference image. This way the user will have the most up-to-date version of Microsoft 365 Apps for enterprise right away and won’t have to download any new updates (which is most likely what would happen if Microsoft 365 Apps for enterprise was installed as part of the reference image.) + - When you are creating your reference image, instead of installing Microsoft 365 Apps for enterprise directly from the Office CDN on the internet, you can install Microsoft 365 Apps for enterprise from a location on your local network, such as a file share. To do that, you would use the Office Deployment Tool in /download mode to download the installation files to that file share. Then you could use the Office Deployment Tool in /configure mode to install Microsoft 365 Apps for enterprise from that location on to your reference image. As part of that, you’ll need to point to that location in your configuration.xml file so that the Office Deployment Tool knows where to get the Microsoft 365 Apps for enterprise files. If you decide to do this, the next time you create a new reference image, you’ll want to be sure to use the Office Deployment Tool to download the most up-to-date installation files for Microsoft 365 Apps for enterprise to that location on your internal network. That way your new reference image will have a more up-to-date installation of Microsoft 365 Apps for enterprise. ### Connect to the deployment share using Windows PowerShell @@ -353,7 +353,7 @@ On **MDT01**: 6. **State Restore > Custom Tasks (Pre-Windows Update)**: After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action (selected from the **General** group) with the following settings: 1. Name: Microsoft Visual C++ Redistributable 2019 - x86 2. Install a Single Application: browse to **Install - MSVC 2019 - x86** - 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Office 365 ProPlus as well. + 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Microsoft 365 Apps for enterprise as well. 3. Click **OK**. ![apps](../images/mdt-apps.png) diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 4cdab97bba..2e6bb17812 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -45,7 +45,7 @@ sections: text: "

      Office 365 ProPlus

      +

      Microsoft 365 Apps for enterprise

      Also supported:

      • Visio Pro for Office 365

        • diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office51.md b/mdop/appv-v5/planning-for-using-app-v-with-office51.md index 6564a0e784..76e791e8a6 100644 --- a/mdop/appv-v5/planning-for-using-app-v-with-office51.md +++ b/mdop/appv-v5/planning-for-using-app-v-with-office51.md @@ -40,7 +40,7 @@ Microsoft Visio and Microsoft Project do not provide support for the Thai Langua ## Supported versions of Microsoft Office See [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click) for a list of supported Office products. ->**Note**  You must use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. You cannot use the App-V Sequencer. +>**Note**  You must use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. You cannot use the App-V Sequencer. diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index b3f0ec8f06..bfd209c329 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -21,12 +21,12 @@ ms.localizationpriority: medium **Applies to:** -- Office 365 Business Premium, Azure AD Premium, Intune, Microsoft Store for Business, Windows 10 +- Microsoft 365 Business Standard, Azure AD Premium, Intune, Microsoft Store for Business, Windows 10 Are you ready to move your business to the cloud or wondering what it takes to make this happen with Microsoft cloud services and tools? -In this walkthrough, we'll show you how to deploy and manage a full cloud IT solution for your small to medium business using Office 365 Business Premium, Microsoft Azure AD, Intune, Microsoft Store for Business, and Windows 10. We'll show you the basics on how to: -- Acquire an Office 365 business domain +In this walkthrough, we'll show you how to deploy and manage a full cloud IT solution for your small to medium business using Microsoft 365 Business Standard, Microsoft Azure AD, Intune, Microsoft Store for Business, and Windows 10. We'll show you the basics on how to: +- Acquire an Microsoft 365 for business domain - Add Microsoft Intune and Azure Active Directory (AD) Premium licenses to your business tenant - Set up Microsoft Store for Business and manage app deployment and sync with Intune - Add users and groups in Azure AD and Intune @@ -52,11 +52,11 @@ See Get Started with Office 365 for business. +To set up your Microsoft 365 for business tenant, see Get Started with Microsoft 365 for business. If this is the first time you're setting this up, and you'd like to see how it's done, you can follow these steps to get started: -1. Go to the Office 365 page in the Microsoft Business site. Select **Try now** to use the Office 365 Business Premium Trial or select **Buy now** to sign up for Office 365 Business Premium. In this walkthrough, we'll select **Try now**. +1. Go to the Office 365 page in the Microsoft Business site. Select **Try now** to use the Microsoft 365 Business Standard Trial or select **Buy now** to sign up for Microsoft 365 Business Standard. In this walkthrough, we'll select **Try now**. **Figure 1** - Try or buy Office 365 diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index c2e6c18cf4..03c3b38bdf 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -45,7 +45,7 @@ Looking for info on the latest release? Check out [What's new in Microsoft Store - **Private store collection updates** - We’ve made it easier to find apps when creating private store collections – now you can search and filter results. [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-collections) - **Manage Skype Communication credits** - Office 365 customers that own Skype Communication Credits can now see and manage them in Microsoft Store for Business. You can view your account, add funds to your account, and manage auto-recharge settings. -- **Upgrade Office 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 Business to Microsoft 365 Business Standard. +- **Upgrade Microsoft 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 for business subscription to a Microsoft 365 for business subscription. ## January and February 2018 - **One place for apps, software, and subscriptions** - The new **Products & services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md index 40175562d2..4379625ee0 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md @@ -39,7 +39,7 @@ Before you deploy Office with App-V, review the following requirements. |---|---| |Packaging|All Office applications you wish to deploy to users must be in a single package.
        In App-V and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
        If you're deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#deploying-visio-2013-and-project-2013-with-office).| |Publishing|You can only publish one Office package per client computer.
        You must publish the Office package globally, not to the user.| -|Deploying Office 365 ProPlus, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).
        You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.| +|Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).
        You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.| ### Excluding Office applications from a package @@ -285,7 +285,7 @@ Use the steps in this section to enable Office plug-ins with your Office package #### To enable plug-ins for Office App-V packages 1. Add a Connection Group through App-V Server, Microsoft Endpoint Configuration Manager, or a Windows PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It's a good idea to use Office 365 ProPlus (non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. +2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It's a good idea to use Microsoft 365 Apps for enterprise (non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. 3. Create an App-V package that includes the desired plug-ins. 4. Add a Connection Group through App-V Server, Configuration Manager, or a Windows PowerShell cmdlet. 5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md index 8f016604df..e90fc8be78 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md @@ -39,7 +39,7 @@ Before you deploy Office with App-V, review the following requirements. |-----------|-------------------| | Packaging. | All Office applications that you deploy to users must be in a single package.
        In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.
        If you're deploying Microsoft Visio 2016 and Microsoft Project 2016 at the same time as Office, you must put them all in the same package. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#deploying-visio-2016-and-project-2016-with-office). | | Publishing. | You can only publish one Office package per client computer.
        You must publish the Office package globally, not to the user. | -| Deploying Office 365 ProPlus, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer with Remote Desktop Services. | You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus). | +| Deploying Microsoft 365 Apps for enterprise, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer with Remote Desktop Services. | You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus). | ### Excluding Office applications from a package @@ -124,7 +124,7 @@ The XML file included in the Office Deployment Tool specifies the product detail | Language element | Specifies which language the applications support. | `Language ID="en-us"` | | Version (attribute of **Add** element) | Optional. Specifies which build the package will use.
        Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` | | SourcePath (attribute of **Add** element) | Specifies the location the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` | - | Channel (part of **Add** element) | Optional. Defines which channel will be used to update Office after installation.
        The default is **Deferred** for Office 365 ProPlus and **Current** for Visio Pro for Office 365 and Project Desktop Client.
        For more information about update channels, see [Overview of update channels for Office 365 ProPlus](https://docs.microsoft.com/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
        `Channel="Deferred"`
        `Channel="FirstReleaseDeferred"`
        `Channel="FirstReleaseCurrent"` | + | Channel (part of **Add** element) | Optional. Defines which channel will be used to update Office after installation.
        The default is **Deferred** for Microsoft 365 Apps for enterprise and **Current** for Visio Pro for Office 365 and Project Desktop Client.
        For more information about update channels, see [Overview of update channels for Microsoft 365 Apps for enterprise](https://docs.microsoft.com/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
        `Channel="Deferred"`
        `Channel="FirstReleaseDeferred"`
        `Channel="FirstReleaseCurrent"` | After editing the **configuration.xml** file to specify the desired product, languages, and the location where the Office 2016 applications will be saved to, you can save the configuration file under a name of your choice, such as "Customconfig.xml." 2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2016 applications that will later be converted into an App-V package. The following is an example command: @@ -152,7 +152,7 @@ After you download the Office 2016 applications through the Office Deployment To The following table summarizes the values you need to enter in the **Customconfig.xml** file. The steps in the sections that follow the table will specify the exact entries you need to make. >[!NOTE] ->You can use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. +>You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. | Product ID | Subscription licensing | |---|---| @@ -268,7 +268,7 @@ The following steps will tell you how to enable Office plug-ins with your Office #### Enable plug-ins for Office App-V packages 1. Add a Connection Group through App-V Server, Microsoft Endpoint Configuration Manager, or a Windows PowerShell cmdlet. -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer that will be used to sequence the plug-in. We recommend that you use Office 365 ProPlus (non-virtual) on the sequencing computer when sequencing Office 2016 plug-ins. +2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer that will be used to sequence the plug-in. We recommend that you use Microsoft 365 Apps for enterprise (non-virtual) on the sequencing computer when sequencing Office 2016 plug-ins. 3. Create an App-V package that includes the plug-ins you want. 4. Add a Connection Group through the App-V Server, Configuration Manager, or a Windows PowerShell cmdlet. 5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. diff --git a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md index dac8271c33..da919b1dbf 100644 --- a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md +++ b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md @@ -30,7 +30,7 @@ You can use the App-V Sequencer to create plug-in packages for language packs, l For a list of supported Office products, see [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click). >[!NOTE] ->You must use the Office Deployment Tool instead of the App-V Sequencer to create App-V packages for Office 365 ProPlus. App-V does not support package creation for volume-licensed versions of Office Professional Plus or Office Standard. Support for the [Office 2013 version of Office 365 ended in February 2017](https://support.microsoft.com/kb/3199744). +>You must use the Office Deployment Tool instead of the App-V Sequencer to create App-V packages for Microsoft 365 Apps for enterprise. App-V does not support package creation for volume-licensed versions of Office Professional Plus or Office Standard. Support for the [Office 2013 version of Office 365 ended in February 2017](https://support.microsoft.com/kb/3199744). ## Using App-V with coexisting versions of Office diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md index 254c91259b..57d1c57718 100644 --- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md +++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md @@ -151,13 +151,13 @@ We have updated Skype for Business to work with MAM. The following table explain
      		March 9 2017

      Visio Pro for Office 365

      Project Desktop Client

      -

      Office 365 Business (the version of Office that comes with some Office 365 plans, such as Business Premium.)
      Deferred channel Provide users with new features of Office only a few times a year. October 10 2017Office 365 ProPlusMicrosoft 365 Apps for enterprise
      First release for Deferred channel Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.
      - + diff --git a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md index 08cbf28585..80928366c3 100644 --- a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md +++ b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md @@ -74,7 +74,7 @@ Because Windows To Go requires no additional software and minimal configuration, Windows To Go uses volume activation. You can use either Active Directory-based activation or KMS activation with Windows To Go. The Windows To Go workspace counts as another installation when assessing compliance with application licensing agreements. -Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Office 365 ProPlus, Office 365 ProPlus subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Office 365 ProPlus or Office 365 Enterprise SKUs containing Office 365 ProPlus via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). +Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Microsoft 365 Apps for enterprise, Microsoft 365 Apps for enterprise subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Microsoft 365 Apps for enterprise or Office 365 Enterprise SKUs containing Microsoft 365 Apps for enterprise via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). You should investigate other software manufacturer’s licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index 6dca369b35..4390f47e44 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -125,7 +125,7 @@ Looking to learn more? These informative session replays from Microsoft Ignite 2 [BRK3027: Deploying Windows 10: Making the update experience smooth and seamless](https://myignite.techcommunity.microsoft.com/sessions/64612#ignite-html-anchor) -[BRK3039: Windows 10 and Microsoft Office 365 ProPlus lifecycle and servicing update](https://myignite.techcommunity.microsoft.com/sessions/66763#ignite-html-anchor) +[BRK3039: Windows 10 and Microsoft Microsoft 365 Apps for enterprise lifecycle and servicing update](https://myignite.techcommunity.microsoft.com/sessions/66763#ignite-html-anchor) [BRK3211: Ask the Experts: Successfully deploying, servicing, managing Windows 10](https://myignite.techcommunity.microsoft.com/sessions/65963#ignite-html-anchor) diff --git a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md index 43ac6da548..7784e955ea 100644 --- a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md +++ b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md @@ -37,7 +37,7 @@ The following additional best practices ensure that devices can easily be provis ## Software best practice guidelines for Windows Autopilot - The Windows Autopilot device should be preinstalled with only a Windows 10 base image plus drivers. -- You can preinstall your licensed version of Office, such as [Office 365 ProPlus](https://docs.microsoft.com/deployoffice/about-office-365-proplus-in-the-enterprise). +- You can preinstall your licensed version of Office, such as [Microsoft 365 Apps for enterprise](https://docs.microsoft.com/deployoffice/about-office-365-proplus-in-the-enterprise). - Unless explicitly requested by the customer, no other preinstalled software should be included. - Per OEM Policy, Windows 10 features, including built-in apps, should not be disabled or removed. diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index 75f70fe534..b129a7a7fb 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -78,7 +78,7 @@ If the WNS services are not available, the Autopilot process will still continue If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps. - @@ -218,7 +222,7 @@ The following table lists the MDM policy settings that you can configure for Win - + @@ -237,6 +241,10 @@ The following table lists the MDM policy settings that you can configure for Win

      Added in Windows 10, version 1703

      True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

      False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

      +

      + +For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md). +

      @@ -272,9 +280,9 @@ The following table lists the MDM policy settings that you can configure for Win From c55560820f22d8bbad3c15d4f2070feb0db514a9 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 17 Apr 2020 16:34:57 -0700 Subject: [PATCH 112/249] Tidied a cross reference --- .../create-change-request-enterprise-mode-portal.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md index 8f33595d7e..867bb143b8 100644 --- a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md @@ -70,4 +70,4 @@ Employees assigned to the Requester role can create a change request. A change r - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. ## Next steps -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. +After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md). From 860e752cbc5589a2ee8bb8d707a4bccfccc7e549 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 17 Apr 2020 16:35:40 -0700 Subject: [PATCH 113/249] Tidied a cross reference --- .../create-change-request-enterprise-mode-portal.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md index 6c1a210e27..278408ab38 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md @@ -72,4 +72,4 @@ Employees assigned to the Requester role can create a change request. A change r ## Next steps -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. +After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md). From 9f180218da5060741d8b090b9acb113e5596f8ba Mon Sep 17 00:00:00 2001 From: Ikko Ashimine Date: Sun, 19 Apr 2020 16:28:49 +0900 Subject: [PATCH 114/249] Fix typo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Micosoft→Microsoft --- windows/client-management/mdm/get-seats.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/get-seats.md b/windows/client-management/mdm/get-seats.md index 21d8f631c1..a510b2460c 100644 --- a/windows/client-management/mdm/get-seats.md +++ b/windows/client-management/mdm/get-seats.md @@ -1,6 +1,6 @@ --- title: Get seats -description: The Get seats operation retrieves the information about active seats in the Micosoft Store for Business. +description: The Get seats operation retrieves the information about active seats in the Micorsoft Store for Business. ms.assetid: 32945788-47AC-4259-B616-F359D48F4F2F ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get seats -The **Get seats** operation retrieves the information about active seats in the Micosoft Store for Business. +The **Get seats** operation retrieves the information about active seats in the Microsoft Store for Business. ## Request From e27bb2da07fe243cbfc2f62aba41e26a05e455bf Mon Sep 17 00:00:00 2001 From: illfated Date: Sun, 19 Apr 2020 21:03:48 +0200 Subject: [PATCH 115/249] MD-ATP/Exploit Protection: corrections & updates Description: As reported in issue ticket #6531 (Redirect Exploit protection "Evaluation Package" link directly to right site), the aka.ms link to the Evaluation Package points to the Windows Defender test ground page. The suggestion is to point the link directly to the Exploit Protection (EP) page instead. Thanks to beerisgood for reporting this issue. Additional changes: Link corrections and updates to counteract the fact that some of the old technet links do not lead directly to the correct topic pages, so it is better to insert traceable direct links instead. I have not found any formatting worth correcting on this page, so the various outdated or bad links will be the main focus in this PR. Changes proposed: - Replace the aka.ms/mp7z2w link with the direct EP download page link - Replace technet/msdn links with current docs.microsoft.com page links - Replace 1 technet link with support.microsoft.com/help - Remove bad go.microsoft.com/fwlink (Windows 10 edition comparison PDF) - Insert direct link to local neighboring page for MD-ATP (same folder) Ticket closure or reference: Closes #6531 --- .../import-export-exploit-protection-emet-xml.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md index 174242a934..415a4bb13e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md @@ -21,11 +21,11 @@ manager: dansimp **Applies to:** -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](microsoft-defender-advanced-threat-protection.md) Exploit protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level. -Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are now included in exploit protection. +Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://support.microsoft.com/help/2458544/) are now included in exploit protection. You use the Windows Security app or PowerShell to create a set of mitigations (known as a configuration). You can then export this configuration as an XML file and share it with multiple machines on your network so they all have the same set of mitigation settings. @@ -33,7 +33,7 @@ You can also convert and import an existing EMET configuration XML file into an This topic describes how to create a configuration file and deploy it across your network, and how to convert an EMET configuration. -The [Evaluation Package](https://aka.ms/mp7z2w) contains a sample configuration file (name *ProcessMitigation-Selfhost-v4.xml* that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic. +The [Evaluation Package](https://demo.wd.microsoft.com/Page/EP) contains a sample configuration file (name *ProcessMitigation-Selfhost-v4.xml* that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic. ## Create and export a configuration file @@ -141,7 +141,7 @@ You can use Group Policy to deploy the configuration you've created to multiple ### Use Group Policy to distribute the configuration -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal)), right-click the Group Policy Object you want to configure and click **Edit**. 2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. @@ -158,7 +158,7 @@ You can use Group Policy to deploy the configuration you've created to multiple * https://localhost:8080/Config.xml * C:\ExploitConfigfile.xml -6. Click **OK** and [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). +6. Click **OK** and [Deploy the updated GPO as you normally do](https://docs.microsoft.com/windows/win32/srvnodes/group-policy). ## Related topics From 980c6e949d9d0048ddb28e82dfa630da98f241a4 Mon Sep 17 00:00:00 2001 From: illfated Date: Sun, 19 Apr 2020 21:10:50 +0200 Subject: [PATCH 116/249] XML Filename correction * Forgot to rename the XML filename in the main PR commit Ref. #6531 --- .../import-export-exploit-protection-emet-xml.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md index 415a4bb13e..f5e315dcb9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md @@ -33,7 +33,7 @@ You can also convert and import an existing EMET configuration XML file into an This topic describes how to create a configuration file and deploy it across your network, and how to convert an EMET configuration. -The [Evaluation Package](https://demo.wd.microsoft.com/Page/EP) contains a sample configuration file (name *ProcessMitigation-Selfhost-v4.xml* that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic. +The [Evaluation Package](https://demo.wd.microsoft.com/Page/EP) contains a sample configuration file (name *ProcessMitigation.xml* (Selfhost v4) that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic. ## Create and export a configuration file From d88f5f4cb913d40074de759236397d3ce8bda1db Mon Sep 17 00:00:00 2001 From: illfated Date: Sun, 19 Apr 2020 21:28:41 +0200 Subject: [PATCH 117/249] Double closing bracket (link) correction * Oversight caused by my attempt at being quick & efficient (it hardly ever works for me, I just make more mistakes). Ref. #6531 --- .../import-export-exploit-protection-emet-xml.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md index f5e315dcb9..55dd84f8c5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md @@ -141,7 +141,7 @@ You can use Group Policy to deploy the configuration you've created to multiple ### Use Group Policy to distribute the configuration -1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal)), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. 2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. From 8672dd14638542fa6ea52447a5788c61ba1fb078 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Mon, 20 Apr 2020 09:08:09 -0700 Subject: [PATCH 118/249] note about Azure activationi --- windows/deployment/windows-10-subscription-activation.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index d953b17ab2..0f8c21c1b1 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -79,6 +79,9 @@ The following figure illustrates how deploying Windows 10 has evolved with each ### Windows 10 Enterprise requirements +> [!NOTE] +> The following requirements do not apply to general Windows 10 activation on Azure. Azure activation requires a connection to Azure KMS only, and supports workgroup, Hybrid, and Azure AD-joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure Virtual Machines](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/troubleshoot-activation-problems#understanding-azure-kms-endpoints-for-windows-product-activation-of-azure-virtual-machines). + For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following: - Windows 10 (Pro or Enterprise) version 1703 or later installed on the devices to be upgraded. From 4eae06d0bd3820822a1938278bc3b6cfcb1f6752 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 20 Apr 2020 10:32:19 -0700 Subject: [PATCH 119/249] ioc content updates --- .../manage-indicators.md | 32 ++++++++++++++----- .../post-ti-indicator.md | 21 ++++++------ 2 files changed, 36 insertions(+), 17 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index c6e5f743ca..354ce7015c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- title: Manage indicators ms.reviewer: -description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. +description: Create indicators for a file hash, IP address, URLs, or domains that define the detection, prevention, and exclusion of entities. keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -26,7 +26,7 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) -Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). +Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. @@ -54,7 +54,7 @@ You can create an indicator for: - URLs/domains >[!NOTE] ->There is a limit of 5000 indicators per tenant. +>There is a limit of 15,000 indicators per tenant. ![Image of indicators settings page](images/rules-indicators.png) @@ -103,17 +103,17 @@ One of the options when taking [response actions on a file](respond-file-alerts. When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a machine in your organization attempts to run it. -Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. +Files automatically blocked by an indicator won't show up in the file's Action center, but the alerts will still be visible in the Alerts queue. ## Create indicators for IPs and URLs/domains (preview) Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs, through Windows Defender SmartScreen for Microsoft browsers, and through Network Protection for non-Microsoft browsers or calls made outside of a browser. The threat intelligence data set for this has been managed by Microsoft. -By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others. +By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others. ### Before you begin -It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: +It's important to understand the following prerequisites prior to creating indicators for IPS, URLs, or domains: - URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md). - The Antimalware client version must be 4.18.1906.x or later. - Supported on machines on Windows 10, version 1709 or later. @@ -132,7 +132,7 @@ It's important to understand the following prerequisites prior to creating indic >[!NOTE] >There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked. -### Create an indicator for IPs, URLs or domains from the settings page +### Create an indicator for IPs, URLs, or domains from the settings page 1. In the navigation pane, select **Settings** > **Indicators**. @@ -163,8 +163,24 @@ You can also choose to upload a CSV file that defines the attributes of indicato Download the sample CSV to know the supported column attributes. +The following table shows the supported parameters. + +Parameter | Type | Description +:---|:---|:--- +indicatorType | Enum | Type of the indicator. Possible values are: "FileSha1", "FileSha256", "IpAddress", "DomainName" and "Url". **Required** +indicatorValue | String | Identity of the [Indicator](ti-indicator.md) entity. **Required** +action | Enum | The action that will be taken if the indicator will be discovered in the organization. Possible values are: "Alert", "AlertAndBlock", and "Allowed". **Required** +title | String | Indicator alert title. **Required** +description | String | Description of the indicator. **Required** +expirationTime | DateTimeOffset | The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. **Optional** +severity | Enum | The severity of the indicator. Possible values are: "Informational", "Low", "Medium" and "High". **Optional** +recommendedActions | String | TI indicator alert recommended actions. **Optional** +rbacGroupNames | String | Comma-separated list of RBAC group names the indicator would be applied to. **Optional** + + + + ## Related topic - [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) - [Use the Microsoft Defender ATP indicators API](ti-indicator.md) - [Use partner integrated solutions](partner-applications.md) - diff --git a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md index b865033486..b02f9d6f58 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md @@ -71,6 +71,7 @@ description | String | Description of the indicator. **Required** expirationTime | DateTimeOffset | The expiration time of the indicator. **Optional** severity | Enum | The severity of the indicator. possible values are: "Informational", "Low", "Medium" and "High". **Optional** recommendedActions | String | TI indicator alert recommended actions. **Optional** +rbacGroupNames | String | Comma-separated list of RBAC group names the indicator would be applied to. **Optional** ## Response @@ -87,16 +88,18 @@ Here is an example of the request. POST https://api.securitycenter.windows.com/api/indicators Content-type: application/json { - "indicatorValue": "220e7d15b011d7fac48f2bd61114db1022197f7f", - "indicatorType": "FileSha1", - "title": "test", - "application": "demo-test", - "expirationTime": "2020-12-12T00:00:00Z", - "action": "AlertAndBlock", - "severity": "Informational", - "description": "test", - "recommendedActions": "nothing" + "indicatorValue": "220e7d15b011d7fac48f2bd61114db1022197f7f", + "indicatorType": "FileSha1", + "title": "test", + "application": "demo-test", + "expirationTime": "2020-12-12T00:00:00Z", + "action": "AlertAndBlock", + "severity": "Informational", + "description": "test", + "recommendedActions": "nothing", + “rbacGroupNames": [“group1”, “group2”] } +``` ## Related topic - [Manage indicators](manage-indicators.md) \ No newline at end of file From 34053af140ec96100b44f26220ea752e706fc84b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 20 Apr 2020 10:36:44 -0700 Subject: [PATCH 120/249] add steps --- .../microsoft-defender-atp/manage-indicators.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 354ce7015c..76908992e4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -163,6 +163,16 @@ You can also choose to upload a CSV file that defines the attributes of indicato Download the sample CSV to know the supported column attributes. +1. In the navigation pane, select **Settings** > **Indicators**. + +2. Select the tab of the entity type you'd like to import indicators for. + +3. Select **Import** > **Choose file**. + +4. Select **Import**. Do this for all the files you'd like to import. + +5. Select **Done**. + The following table shows the supported parameters. Parameter | Type | Description @@ -179,7 +189,6 @@ rbacGroupNames | String | Comma-separated list of RBAC group names the indicator - ## Related topic - [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) - [Use the Microsoft Defender ATP indicators API](ti-indicator.md) From 4e18fdbb29347542348109d5a7790e078e233745 Mon Sep 17 00:00:00 2001 From: v-miegge <49650192+v-miegge@users.noreply.github.com> Date: Mon, 20 Apr 2020 11:14:46 -0700 Subject: [PATCH 121/249] CI 113983 - updated file --- devices/surface/support-solutions-surface.md | 60 +++++++++----------- 1 file changed, 28 insertions(+), 32 deletions(-) diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md index a7ef242da7..543d6250ee 100644 --- a/devices/surface/support-solutions-surface.md +++ b/devices/surface/support-solutions-surface.md @@ -20,16 +20,36 @@ ms.audience: itpro # Top support solutions for Surface devices > [!Note] -> **Home users**: This article is only intended for use by IT professionals and technical support agents, and applies only to Surface devices. If you're looking for help with a problem with your home device, please see [Surface Devices Help](https://support.microsoft.com/products/surface-devices). +> **Home users**: This article is only intended for use by IT professionals and technical support agents, and applies only to Surface devices. If you're looking for help with a problem with your home device, please see [Surface Devices Help](https://support.microsoft.com/products/surface-devices). -Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated. For a complete listing of the update history, see [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) and [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined). +These are the Microsoft Support solutions for common issues you may experience using Surface devices in an enterprise. If your issue is not listed here, [contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection). +## Surface Drivers and Firmware -These are the top Microsoft Support solutions for common issues experienced when using Surface devices in an enterprise. +Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated. + +- [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) +- [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined) +- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482) +- [Deploy the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) +- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates) +- [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906) + +## Surface Dock Issues + +- [Troubleshoot Surface Dock and docking stations](https://support.microsoft.com/help/4023468/surface-troubleshoot-surface-dock-and-docking-stations) + +- [Troubleshoot connecting Surface to a second screen](https://support.microsoft.com/help/4023496) + +- [Microsoft Surface Dock Firmware Update](https://docs.microsoft.com/surface/surface-dock-updater) + +## Device cover or keyboard issues + +- [Troubleshoot your Surface Type Cover or keyboard](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-surface-keyboards) ## Screen cracked or scratched issues -- [Contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection) +- [Contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection) ## Surface Power or battery Issues @@ -41,29 +61,13 @@ These are the top Microsoft Support solutions for common issues experienced when - [Maximize your Surface battery life](https://support.microsoft.com/help/4483194) -## Device cover or keyboard issues +## Reset device -- [Troubleshoot your Surface Type Cover or keyboard](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-surface-keyboards) +- [Creating and using a USB recovery drive for Surface](https://support.microsoft.com/help/4023512) -## Surface Dock Issues +- [FAQ: Protecting your data if you send your Surface in for Service](https://support.microsoft.com/help/4023508) -- [Troubleshoot Surface Dock and docking stations](https://support.microsoft.com/help/4023468/surface-troubleshoot-surface-dock-and-docking-stations) - -- [Troubleshoot connecting Surface to a second screen](https://support.microsoft.com/help/4023496) - -- [Microsoft Surface Dock Firmware Update](https://docs.microsoft.com/surface/surface-dock-updater) - -## Surface Drivers and Firmware - -- [Surface Update History](https://support.microsoft.com/help/4036283) - -- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482) - -- [Deploy the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) - -- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates) - -- [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906) +- [Microsoft Surface Data Eraser](https://docs.microsoft.com/surface/microsoft-surface-data-eraser) ## Deployment Issues @@ -72,11 +76,3 @@ These are the top Microsoft Support solutions for common issues experienced when - [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/help/4046105) - [System SKU reference](https://docs.microsoft.com/surface/surface-system-sku-reference) - -## Reset device - -- [Creating and using a USB recovery drive for Surface](https://support.microsoft.com/help/4023512) - -- [FAQ: Protecting your data if you send your Surface in for Service](https://support.microsoft.com/help/4023508) - -- [Microsoft Surface Data Eraser](https://docs.microsoft.com/surface/microsoft-surface-data-eraser) From 0fbb7fe300ddb889a2535c2b3bb5308ccda8047e Mon Sep 17 00:00:00 2001 From: illfated Date: Mon, 20 Apr 2020 21:25:02 +0200 Subject: [PATCH 122/249] BitLocker/MDT: TPM typo & link updates Description: As reported in issue ticket #6538 (TPM, not TMP), there is a typo where the initialism TPM is misspelled as "TMP". Although a common variable in the Microsoft Windows environment, it is not correct in this note. Thanks to ntw2 for reporting this typo. Further changes suggested: Replace 2 out of 3 fwlinks with their current target page links (the 3rd is a rabbit hole too deep for now). Changes proposed: - "TMP" corrected to TPM (as it should be) - fwlink/p/?LinkId=619548 -> docs.microsoft.com/previous-versions/ windows/it-pro/windows-7/dd875529(v=ws.10) ((could use a new page)) - fwlink/p/?LinkId=167133 -> gallery.technet.microsoft.com/ ScriptCenter/b4dee016-053e-4aa3-a278-3cebf70d1191 ((marked for retirement, needs a backup or replacement)) - Remove redundant end-of-line whitespace for 2 lines Additional notes: Please feel free to suggest improved link replacements, especially for the untouched fwlink, [Check to see if the TPM is enabled.] (https://go.microsoft.com/fwlink/p/?LinkId=619549) This link lands on the top blog archive menu: https://docs.microsoft.com/archive/blogs/ . Ticket closure or reference: Closes #6538 --- .../deploy-windows-mdt/set-up-mdt-for-bitlocker.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md index d54f06dc77..c6400f67e9 100644 --- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md +++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md @@ -31,15 +31,15 @@ To configure your environment for BitLocker, you will need to do the following: 4. Configure the rules (CustomSettings.ini) for BitLocker. > [!NOTE] -> Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery password in Active Directory. For additional information about this feature, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds). +> Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery password in Active Directory. For additional information about this feature, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. > [!NOTE] -> Backing up TMP to Active Directory was supported only on Windows 10 version 1507 and 1511. +> Backing up TPM to Active Directory was supported only on Windows 10 version 1507 and 1511. >[!NOTE] ->Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://go.microsoft.com/fwlink/p/?LinkId=619548). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. - +>Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/dd875529(v=ws.10)). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. + For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md). ## Configure Active Directory for BitLocker @@ -95,7 +95,7 @@ Following these steps, you enable the backup of BitLocker and TPM recovery infor ### Set permissions in Active Directory for BitLocker -In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the [Add-TPMSelfWriteACE.vbs script](https://go.microsoft.com/fwlink/p/?LinkId=167133) from Microsoft to C:\\Setup\\Scripts on DC01. +In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the [Add-TPMSelfWriteACE.vbs script](https://gallery.technet.microsoft.com/ScriptCenter/b4dee016-053e-4aa3-a278-3cebf70d1191) from Microsoft to C:\\Setup\\Scripts on DC01. 1. On DC01, start an elevated PowerShell prompt (run as Administrator). 2. Configure the permissions by running the following command: From affddd2f291ba7a890cf00e8c66505e04f375097 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 20 Apr 2020 13:58:44 -0700 Subject: [PATCH 123/249] Update Known issues pages Added sections for All HL, HL2, HL1, and Emu. Rearranged issues into sections. Added the new HL2 Insider issue. --- devices/hololens/hololens-known-issues.md | 89 ++++++++++++++++------- 1 file changed, 62 insertions(+), 27 deletions(-) diff --git a/devices/hololens/hololens-known-issues.md b/devices/hololens/hololens-known-issues.md index e3ac50bec3..de39da5999 100644 --- a/devices/hololens/hololens-known-issues.md +++ b/devices/hololens/hololens-known-issues.md @@ -4,7 +4,7 @@ description: This is the list of known issues that may affect HoloLens developer keywords: troubleshoot, known issue, help author: mattzmsft ms.author: mazeller -ms.date: 8/30/2019 +ms.date: 4/20/2020 ms.topic: article ms.custom: - CI 111456 @@ -13,14 +13,60 @@ HoloLens and holograms: Frequently asked questions manager: jarrettr ms.prod: hololens appliesto: -- HoloLens 1 +- HoloLens (1st Gen) +- HoloLens 2 --- # Known issues for HoloLens -This is the current list of known issues for HoloLens that affect developers. Check here first if you are seeing an odd behavior. This list will be kept updated as new issues are discovered or reported, or as issues are addressed in future HoloLens software updates. +This is the current list of known issues for HoloLens devices. Check here first if you are seeing an odd behavior. This list will be kept updated as new issues are discovered or reported, or as issues are addressed in future HoloLens software updates. -## Unable to connect and deploy to HoloLens through Visual Studio +>[!NOTE] +> - If you discover an issue that is not blocking you please report it on your HoloLens device via [Feedback Hub](hololens-feedback.md). +> - If the issue you are facing is blocking you, in addtion to filing feedback, please [file a support request](https://aka.ms/hlsupport). + +- [Known issues for all HoloLens generations](#known-issues-for-all-hololens-generations) +- [Known issues for HoloLens 2 devices](#known-issues-for-hololens-2-devices) +- [Known issues for HoloLens (1st Gen)](#known-issues-for-hololens-1st-gen) +- [Known issues for HoloLens emulator](#known-issues-for-hololens-emulator) + +## Known issues for all HoloLens generations + +### Unity + +- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Unity recommended for HoloLens development. +- Known issues with the Unity HoloLens Technical Preview are documented in the [HoloLens Unity forums](https://forum.unity3d.com/threads/known-issues.394627/). + +### Windows Device Portal + +- The Live Preview feature in Mixed Reality capture may exhibit several seconds of latency. +- On the Virtual Input page, the Gesture and Scroll controls under the Virtual Gestures section are not functional. Using them will have no effect. The virtual keyboard on the same page works correctly. +- After enabling Developer Mode in Settings, it may take a few seconds before the switch to turn on the Device Portal is enabled. + +## Known issues for HoloLens 2 devices + +### Blue screen is shown after unenrolling from Insider preview builds on a device reflashed with a Insider build + +This is an issue affecting that affects users who are were on an Insider preview build, reflashed their HoloLens 2 with a new insider preview build, and then unenrolled from the Insider program. + +This does not affect: +- Users who are not enrolled in Windows Insider +- Insiders: + - If a device has been enrolled since Insider builds were version 18362.x + - If they flashed a Insider signed 19041.x build AND stay enrolled in the Insider program + +Work-around: +- Avoid the issue + - Flash a non-insider build. One of the regular monthly updates. + - Stay on Insider Preview +- Reflash the device + 1. Put the [HoloLens 2 into flashing mode](https://review.docs.microsoft.com/hololens/hololens-recovery?branch=master#hololens-2) manually by fully powering down while not connect. Then while holding Volume up, tap the Power button. + 1. Connect to the PC and open Advanced Recovery Companion. + 1. Flash the HoloLens 2 to the default build. + +## Known issues for HoloLens (1st Gen) + +### Unable to connect and deploy to HoloLens through Visual Studio > [!NOTE] > Last Update: 8/8 @ 5:11PM - Visual Studio has released VS 2019 Version 16.2 which includes a fix to this issue. We recommend updating to this newest version to avoid experiencing this error. @@ -29,7 +75,7 @@ Visual Studio has released VS 2019 Version 16.2 which includes a fix to this iss Issue root-cause: Users who used Visual Studio 2015 or early releases of Visual Studio 2017 to deploy and debug applications on their HoloLens and then subsequently used the latest versions of Visual Studio 2017 or Visual Studio 2019 with the same HoloLens will be affected. The newer releases of Visual Studio deploy a new version of a component, but files from the older version are left over on the device, causing the newer version to fail. This causes the following error message: DEP0100: Please ensure that target device has developer mode enabled. Could not obtain a developer license on \ due to error 80004005. -### Workaround +#### Workaround Our team is currently working on a fix. In the meantime, you can use the following steps to work around the issue and help unblock deployment and debugging: @@ -79,7 +125,7 @@ Our team is currently working on a fix. In the meantime, you can use the followi We will provide further updates as they become available. -## Issues launching the Microsoft Store and apps on HoloLens +### Issues launching the Microsoft Store and apps on HoloLens > [!NOTE] > Last Update: 4/2 @ 10 AM - Issue resolved. @@ -126,38 +172,27 @@ If your device is still unable to load apps, you can sideload a version of the . We appreciate your patience as we have gone through the process to get this issue resolved, and we look forward to continued working with our community to create successful Mixed Reality experiences. -## Device Update +### Device Update - 30 seconds after a new update, the shell may disappear one time. Please perform the **bloom** gesture to resume your session. -## Visual Studio +### Visual Studio - See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Visual Studio that is recommended for HoloLens development. - When deploying an app from Visual Studio to your HoloLens, you may see the error: **The requested operation cannot be performed on a file with a user-mapped section open. (Exception from HRESULT: 0x800704C8)**. If this happens, try again and your deployment will generally succeed. -## Emulator - -- Not all apps in the Microsoft Store are compatible with the emulator. For example, Young Conker and Fragments are not playable on the emulator. -- You cannot use the PC webcam in the Emulator. -- The Live Preview feature of the Windows Device Portal does not work with the emulator. You can still capture Mixed Reality videos and images. - -## Unity - -- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Unity recommended for HoloLens development. -- Known issues with the Unity HoloLens Technical Preview are documented in the [HoloLens Unity forums](https://forum.unity3d.com/threads/known-issues.394627/). - -## Windows Device Portal - -- The Live Preview feature in Mixed Reality capture may exhibit several seconds of latency. -- On the Virtual Input page, the Gesture and Scroll controls under the Virtual Gestures section are not functional. Using them will have no effect. The virtual keyboard on the same page works correctly. -- After enabling Developer Mode in Settings, it may take a few seconds before the switch to turn on the Device Portal is enabled. - -## API +### API - If the application sets the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) behind the user or the normal to camera.forward, holograms will not appear in Mixed Reality Capture photos or videos. Until this bug is fixed in Windows, if applications actively set the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) they should ensure the plane normal is set opposite camera-forward (for example, normal = -camera.forward). -## Xbox Wireless Controller +### Xbox Wireless Controller - Xbox Wireless Controller S must be updated before it can be used with HoloLens. Ensure you are [up to date](https://support.xbox.com/xbox-one/accessories/update-controller-for-stereo-headset-adapter) before attempting to pair your controller with a HoloLens. - If you reboot your HoloLens while the Xbox Wireless Controller is connected, the controller will not automatically reconnect to HoloLens. The Guide button light will flash slowly until the controller powers off after 3 minutes. To reconnect your controller immediately, power off the controller by holding the Guide button until the light turns off. When you power your controller on again, it will reconnect to HoloLens. - If your HoloLens enters standby while the Xbox Wireless Controller is connected, any input on the controller will wake the HoloLens. You can prevent this by powering off your controller when you are done using it. + +## Known issues for HoloLens emulator + +- Not all apps in the Microsoft Store are compatible with the emulator. For example, Young Conker and Fragments are not playable on the emulator. +- You cannot use the PC webcam in the Emulator. +- The Live Preview feature of the Windows Device Portal does not work with the emulator. You can still capture Mixed Reality videos and images. From 58f802b84e4b51f1a61a13daefc384cf9c300892 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 20 Apr 2020 16:35:23 -0700 Subject: [PATCH 124/249] Indented content in list items, added missing end punctuation --- ...port-export-exploit-protection-emet-xml.md | 34 ++++++++++--------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md index 55dd84f8c5..95806be4e6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md @@ -53,27 +53,28 @@ When you have configured exploit protection to your desired state (including bot 3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved. -> [!IMPORTANT] -> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file. + > [!IMPORTANT] + > If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file. -![Highlight of the Export Settings option](../images/wdsc-exp-prot-export.png) + ![Highlight of the Export Settings option](../images/wdsc-exp-prot-export.png) -> [!NOTE] -> When you export the settings, all settings for both app-level and system-level mitigations are saved. This means you don't need to export a file from both the **System settings** and **Program settings** sections - either section will export all settings. + > [!NOTE] + > When you export the settings, all settings for both app-level and system-level mitigations are saved. This means you don't need to export a file from both the **System settings** and **Program settings** sections—either section will export all settings. ### Use PowerShell to export a configuration file -1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**. 2. Enter the following cmdlet: ```PowerShell Get-ProcessMitigation -RegistryConfigFilePath filename.xml ``` -Change `filename` to any name or location of your choosing. + Change `filename` to any name or location of your choosing. -Example command -**Get-ProcessMitigation -RegistryConfigFilePath C:\ExploitConfigfile.xml** + Example command: + + **Get-ProcessMitigation -RegistryConfigFilePath C:\ExploitConfigfile.xml** > [!IMPORTANT] > When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration file. Ensure you place the file in a shared location. @@ -86,17 +87,18 @@ After importing, the settings will be instantly applied and can be reviewed in t ### Use PowerShell to import a configuration file -1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**. 2. Enter the following cmdlet: ```PowerShell Set-ProcessMitigation -PolicyFilePath filename.xml ``` -Change `filename` to the location and name of the exploit protection XML file. + Change `filename` to the location and name of the exploit protection XML file. -Example command -**Set-ProcessMitigation -PolicyFilePath C:\ExploitConfigfile.xml** + Example command: + + **Set-ProcessMitigation -PolicyFilePath C:\ExploitConfigfile.xml** > [!IMPORTANT] > @@ -116,14 +118,14 @@ You can only do this conversion in PowerShell. > > You can then convert that file using the PowerShell cmdlet described here before importing the settings into Exploit protection. -1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**. 2. Enter the following cmdlet: ```PowerShell ConvertTo-ProcessMitigationPolicy -EMETFilePath emetFile.xml -OutputFilePath filename.xml ``` -Change `emetFile` to the name and location of the EMET configuration file, and change `filename` to whichever location and file name you want to use. + Change `emetFile` to the name and location of the EMET configuration file, and change `filename` to whichever location and file name you want to use. > [!IMPORTANT] > @@ -151,7 +153,7 @@ You can use Group Policy to deploy the configuration you've created to multiple 4. Double-click the **Use a common set of Exploit protection settings** setting and set the option to **Enabled**. -5. In the **Options::** section, enter the location and filename of the Exploit protection configuration file that you want to use, such as in the following examples: +5. In the **Options::** section, enter the location and file name of the Exploit protection configuration file that you want to use, such as in the following examples: * C:\MitigationSettings\Config.XML * \\\Server\Share\Config.xml From 504e9258a286a2d5c291a1a61001fd0c123ee243 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 20 Apr 2020 21:05:30 -0700 Subject: [PATCH 125/249] Clarify that system-wide HTTPS_PROXY is not supported --- .../microsoft-defender-atp/linux-support-connectivity.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md b/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md index 308e1695b1..4a25d355bf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-support-connectivity.md @@ -64,6 +64,9 @@ $ curl -x http://proxy_address:port -w ' %{url_effective}\n' 'https://x.cp.wd.mi Ensure that you use the same proxy address and port as configured in the `/lib/system/system/mdatp.service` file. Check your proxy configuration if there are errors from the above commands. +> [!WARNING] +> The static proxy cannot be configured through a system-wide `HTTPS_PROXY` environment variable. Instead, ensure that `HTTPS_PROXY` is properly set in the `/lib/system/system/mdatp.service` file. + To use a static proxy, the `mdatp.service` file must be modified. Ensure the leading `#` is removed to uncomment the following line from `/lib/systemd/system/mdatp.service`: ```bash From 957a8ef934df4399a7152196401d2002acb27fc6 Mon Sep 17 00:00:00 2001 From: illfated Date: Tue, 21 Apr 2020 19:40:24 +0200 Subject: [PATCH 126/249] MD-ATP/Alerts: copy-paste error correction Description: As reported in issue ticket #6541 (lastUpdateTime), the description text for lastUpdateTime is identical to the entry for firstEventTime. This is not a correct description for 'lastUpdateTime'. Thanks to harveywargo2 (Harvey Wargo) for reporting this. Changes proposed: - Replace the misplaced copy-pasted text with a suitable description. - Remove 5 end-of-line blanks (whitespace correction). The page author is, of course, invited to improve the phrasing. Ticket closure or reference: Closes #6541 --- .../microsoft-defender-atp/alerts.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts.md b/windows/security/threat-protection/microsoft-defender-atp/alerts.md index 62a32da91b..52af85f56b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts.md @@ -12,7 +12,7 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article --- @@ -20,7 +20,7 @@ ms.topic: article **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) ## Methods Method |Return Type |Description @@ -45,15 +45,15 @@ description | String | Alert description. alertCreationTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was created. lastEventTime | Nullable DateTimeOffset | The last occurrence of the event that triggered the alert on the same machine. firstEventTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that machine. -lastUpdateTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that machine. +lastUpdateTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was last updated. resolvedTime | Nullable DateTimeOffset | The date and time in which the status of the alert was changed to 'Resolved'. -incidentId | Nullable Long | The [Incident](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) ID of the Alert. -investigationId | Nullable Long | The [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) ID related to the Alert. +incidentId | Nullable Long | The [Incident](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) ID of the Alert. +investigationId | Nullable Long | The [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) ID related to the Alert. investigationState | Nullable Enum | The current state of the [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). Possible values are: 'Unknown', 'Terminated', 'SuccessfullyRemediated', 'Benign', 'Failed', 'PartiallyRemediated', 'Running', 'PendingApproval', 'PendingResource', 'PartiallyInvestigated', 'TerminatedByUser', 'TerminatedBySystem', 'Queued', 'InnerFailure', 'PreexistingAlert', 'UnsupportedOs', 'UnsupportedAlertType', 'SuppressedAlert'. assignedTo | String | Owner of the alert. severity | Enum | Severity of the alert. Possible values are: 'UnSpecified', 'Informational', 'Low', 'Medium' and 'High'. status | Enum | Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. -classification | Nullable Enum | Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'. +classification | Nullable Enum | Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'. determination | Nullable Enum | Specifies the determination of the alert. Possible values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'. category| String | Category of the alert. detectionSource | String | Detection source. From 85393cd14bbea64ea8fc112dd8ee77600706ff8c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 21 Apr 2020 11:02:03 -0700 Subject: [PATCH 127/249] add remote worker link --- windows/security/threat-protection/index.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 039851e80d..38daa97fbb 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -7,8 +7,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: dansimp -author: DulceMontemayor +ms.author: macapara +author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -19,6 +19,9 @@ ms.topic: conceptual # Threat Protection [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture. +>[!TIP] +> Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/). +

      Microsoft Defender ATP

      [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) Check out the new Modern Deskop Deployment Center and discover content to help you with your Windows 10 and Office 365 ProPlus deployments.
      [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) Check out the new Modern Deskop Deployment Center and discover content to help you with your Windows 10 and Microsoft 365 Apps for enterprise deployments.
      [What's new in Windows 10 deployment](deploy-whats-new.md) See this topic for a summary of new features and some recent changes related to deploying Windows 10 in your organization.
      [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task.
      [Windows Autopilot](windows-autopilot/windows-autopilot.md) Windows Autopilot enables an IT department to pre-configure new devices and repurpose existing devices with a simple process that requires little to no infrastructure.
      Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). +
      Office 365As part of the Intune device configuration, installation of Microsoft 365 Apps for enterprise may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above).
      Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains.
      Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode
      Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips (including devices from any other manufacturer) come with these certificates preinstalled. See TPM recommendations for more details. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested: @@ -106,7 +106,7 @@ To provide needed Azure Active Directory (automatic MDM enrollment and company b > Even when using Microsoft 365 subscriptions, you still need to [assign Intune licenses to the users](https://docs.microsoft.com/intune/fundamentals/licenses-assign). Additionally, the following are also recommended (but not required): -- [Office 365 ProPlus](https://www.microsoft.com/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services). +- [Microsoft 365 Apps for enterprise](https://www.microsoft.com/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services). - [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise. ## Configuration requirements diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 52f53de9e4..518fe19374 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -201,7 +201,7 @@ IT pros can use various methods, including Group Policy and Mobile Device Manage Use the steps in this article to set and/or adjust the diagnostic data settings for Windows and Windows Server in your organization. > [!IMPORTANT] -> These diagnostic data levels only apply to Windows and Windows Server components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Office 365 ProPlus](/deployoffice/privacy/overview-privacy-controls). +> These diagnostic data levels only apply to Windows and Windows Server components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](/deployoffice/privacy/overview-privacy-controls). The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server is **Enhanced**. diff --git a/windows/privacy/gdpr-win10-whitepaper.md b/windows/privacy/gdpr-win10-whitepaper.md index fb8707befe..302909fefa 100644 --- a/windows/privacy/gdpr-win10-whitepaper.md +++ b/windows/privacy/gdpr-win10-whitepaper.md @@ -296,7 +296,7 @@ Windows Information Protection helps people separate their work and personal dat For example, employees can’t send protected work files from a personal email account instead of their work account. They also can’t accidently post personal or sensitive data from a corporate site into a tweet. Windows Information Protection also helps ensure that they aren’t saving personal or sensitive data in a public cloud storage location. #### Capabilities to classify, assign permissions and share data -Windows Information Protection is designed to coexist with advanced data loss prevention (DLP) capabilities found in Office 365 ProPlus, Azure Information Protection, and Azure Rights Management. Advanced DLP prevents printing, for example, or protects work data that is emailed outside your company. +Windows Information Protection is designed to coexist with advanced data loss prevention (DLP) capabilities found in Microsoft 365 Apps for enterprise, Azure Information Protection, and Azure Rights Management. Advanced DLP prevents printing, for example, or protects work data that is emailed outside your company. To continuously protect your data, regardless of where it is stored, with whom it is shared, or if the device is running iOS, Android or Windows, the classification and protection needs to be built into the file itself, so this protection can travel with the data wherever it goes. Microsoft Azure Information Protection (AIP) is designed to provide this persistent data protection both on-premises and in the cloud. diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 8879dec483..48c612f49d 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -53,7 +53,7 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar -- Office 365 ProPlus apps, including Word, Excel, PowerPoint, OneNote, and Outlook +- Microsoft 365 Apps for enterprise apps, including Word, Excel, PowerPoint, OneNote, and Outlook - OneDrive app @@ -99,7 +99,7 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li | PowerPoint Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
      **Product Name:** Microsoft.Office.PowerPoint
      **App Type:** Universal app | | OneNote | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
      **Product Name:** Microsoft.Office.OneNote
      **App Type:** Universal app | | Outlook Mail and Calendar | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
      **Product Name:** microsoft.windowscommunicationsapps
      **App Type:** Universal app | -| Office 365 ProPlus and Office 2019 Professional Plus | Office 365 ProPlus and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
      We don't recommend setting up Office by using individual paths or publisher rules. | +| Microsoft 365 Apps for enterprise and Office 2019 Professional Plus | Microsoft 365 Apps for enterprise and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
      We don't recommend setting up Office by using individual paths or publisher rules. | | Microsoft Photos | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
      **Product Name:** Microsoft.Windows.Photos
      **App Type:** Universal app | | Groove Music | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
      **Product Name:** Microsoft.ZuneMusic
      **App Type:** Universal app | | Microsoft Movies & TV | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
      **Product Name:** Microsoft.ZuneVideo
      **App Type:** Universal app | diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index de8bac35db..0ac210bfc0 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -41,7 +41,7 @@ The Security Compliance Toolkit consists of: - Windows Server 2012 R2 - Microsoft Office security baseline - - Office 365 ProPlus (Sept 2019) + - Microsoft 365 Apps for enterprise (Sept 2019) - Microsoft Edge security baseline - Version 80 diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index 535af777d7..1c44d0d42f 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -1,6 +1,6 @@ --- title: Windows security baselines -description: Learn how to use Windows security baselines in your organization. Specific to Windows 10, Windows Server, and Office 365 ProPlus. +description: Learn how to use Windows security baselines in your organization. Specific to Windows 10, Windows Server, and Microsoft 365 Apps for enterprise. keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy @@ -21,7 +21,7 @@ ms.reviewer: - Windows 10 - Windows Server -- Office 365 ProPlus +- Microsoft 365 Apps for enterprise ## Using security baselines in your organization diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index f13c8d694c..ec640e3eea 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -53,7 +53,7 @@ SetupDiag is a command-line tool that can help diagnose why a Windows 10 update ## Servicing -- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon! +- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon! - [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. - [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. diff --git a/windows/whats-new/whats-new-windows-10-version-1909.md b/windows/whats-new/whats-new-windows-10-version-1909.md index 89e6ad37a5..5d019f5d03 100644 --- a/windows/whats-new/whats-new-windows-10-version-1909.md +++ b/windows/whats-new/whats-new-windows-10-version-1909.md @@ -72,7 +72,7 @@ This update includes 5 fixes to allow the host to run down-level containers on u [Windows Virtual Desktop](https://docs.microsoft.com/azure/virtual-desktop/overview) (WVD) is now generally available globally! -Windows Virtual Desktop is a comprehensive desktop and app virtualization service running in the cloud. It’s the only virtual desktop infrastructure (VDI) that delivers simplified management, multi-session Windows 10, optimizations for Office 365 ProPlus, and support for Remote Desktop Services (RDS) environments. Deploy and scale your Windows desktops and apps on Azure in minutes, and get built-in security and compliance features. Windows Virtual Desktop requires a Microsoft E3 or E5 license, or a Microsoft 365 E3 or E5 license, as well as an Azure tenant. +Windows Virtual Desktop is a comprehensive desktop and app virtualization service running in the cloud. It’s the only virtual desktop infrastructure (VDI) that delivers simplified management, multi-session Windows 10, optimizations for Microsoft 365 Apps for enterprise, and support for Remote Desktop Services (RDS) environments. Deploy and scale your Windows desktops and apps on Azure in minutes, and get built-in security and compliance features. Windows Virtual Desktop requires a Microsoft E3 or E5 license, or a Microsoft 365 E3 or E5 license, as well as an Azure tenant. ## Deployment From 7310d54a74e443b9b19d4ad7fee24a234e41ff54 Mon Sep 17 00:00:00 2001 From: Kweku Ako-Adjei Date: Thu, 16 Apr 2020 16:25:03 -0700 Subject: [PATCH 093/249] updated to Microsoft 365 groups --- education/windows/deploy-windows-10-in-a-school.md | 4 ++-- .../windows/education-scenarios-store-for-business.md | 2 +- education/windows/teacher-get-minecraft.md | 2 +- smb/cloud-mode-business-setup.md | 10 +++++----- ...join-windows-10-mobile-to-azure-active-directory.md | 4 ++-- ...add-an-azure-ad-tenant-and-azure-ad-subscription.md | 4 ++-- ...er-your-free-azure-active-directory-subscription.md | 2 +- windows/privacy/manage-windows-1709-endpoints.md | 6 +++--- windows/privacy/manage-windows-1803-endpoints.md | 6 +++--- windows/privacy/manage-windows-1809-endpoints.md | 6 +++--- windows/privacy/manage-windows-1903-endpoints.md | 4 ++-- .../windows-endpoints-1709-non-enterprise-editions.md | 8 ++++---- .../windows-endpoints-1803-non-enterprise-editions.md | 8 ++++---- .../windows-endpoints-1809-non-enterprise-editions.md | 6 +++--- .../windows-endpoints-1903-non-enterprise-editions.md | 4 ++-- 15 files changed, 38 insertions(+), 38 deletions(-) diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index 1c429d1f52..5631f3e6ab 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -506,7 +506,7 @@ Assign SharePoint Online resource permissions to Office 365 security groups, not **Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. -For information about creating security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). +For information about creating security groups, see [Create and manage Microsoft 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). You can add and remove users from security groups at any time. @@ -520,7 +520,7 @@ You can create email distribution groups based on job role (such as teachers, ad **Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. -For information about how to create security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). +For information about how to create security groups, see [Create and manage Microsoft 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). ### Summary diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index 3149237ba1..de941be3c6 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -83,7 +83,7 @@ Applies to: IT admins Self-service sign up makes it easier for teachers and students in your organization to get started with **Minecraft: Education Edition**. If you have self-service sign up enabled in your tenant, teachers can assign **Minecraft: Education Edition** to students before they have a work or school account. Students receive an email that steps them through the process of signing up for a work or school account. For more information on self-service sign up, see [Using self-service sign up in your organization](https://support.office.com/article/Using-self-service-sign-up-in-your-organization-4f8712ff-9346-4c6c-bb63-a21ad7a62cbd?ui=en-US&rs=en-US&ad=US). ### Domain verification -For education organizations, domain verification ensures you are on the academic verification list. As an admin, you might need to verify your domain using the Office 365 portal. For more information, see [Verify your Office 365 domain to prove ownership, nonprofit or education status](https://support.office.com/article/Verify-your-Office-365-domain-to-prove-ownership-nonprofit-or-education-status-or-to-activate-Yammer-87d1844e-aa47-4dc0-a61b-1b773fd4e590?ui=en-US&rs=en-US&ad=US). +For education organizations, domain verification ensures you are on the academic verification list. As an admin, you might need to verify your domain using the Microsoft 365 admin center. For more information, see [Verify your Office 365 domain to prove ownership, nonprofit or education status](https://support.office.com/article/Verify-your-Office-365-domain-to-prove-ownership-nonprofit-or-education-status-or-to-activate-Yammer-87d1844e-aa47-4dc0-a61b-1b773fd4e590?ui=en-US&rs=en-US&ad=US). ## Acquire apps Applies to: IT admins and teachers diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 501e3f3249..136499ee4c 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -93,7 +93,7 @@ Enter email addresses for your students, and each student will get an email with ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) You can assign the app to students with work or school accounts.
      - If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Office 365 portal where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. + If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Microsoft 365 admin center where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. **To finish Minecraft install (for students)** diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index bfd209c329..b62b89b55a 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -68,14 +68,14 @@ If this is the first time you're setting this up, and you'd like to see how it's This step creates an onmicrosoft.com email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into https://portal.office.com (the admin portal). 4. Select **Create my account** and then enter the phone number you used in step 2 to verify your identity. You'll be asked to enter your verification code. -5. Select **You're ready to go...** which will take you to the Office 365 portal. +5. Select **You're ready to go...** which will take you to the Microsoft 365 admin center. > [!NOTE] - > In the Office 365 portal, icons that are greyed out are still installing. + > In the Microsoft 365 admin center, icons that are greyed out are still installing. - **Figure 2** - Office 365 portal + **Figure 2** - Microsoft 365 admin center - ![Office 365 portal](images/office365_portal.png) + ![Microsoft 365 admin center](images/office365_portal.png) 6. Select the **Admin** tile to go to the admin center. @@ -560,7 +560,7 @@ For other devices, such as those personally-owned by employees who need to conne 9. You can confirm that the new device and user are showing up as Intune-managed by going to the Intune management portal and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. ### 4.2 Add a new user -You can add new users to your tenant simply by adding them to the Office 365 groups. Adding new users to Office 365 groups automatically adds them to the corresponding groups in Microsoft Intune. +You can add new users to your tenant simply by adding them to the Microsoft 365 groups. Adding new users to Microsoft 365 groups automatically adds them to the corresponding groups in Microsoft Intune. See [Add users to Office 365](https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc?ui=en-US&rs=en-US&ad=US&fromAR=1) to learn more. Once you're done adding new users, go to the Intune management portal and verify that the same users were added to the Intune groups as well. diff --git a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md index 688b2e776c..0511eea424 100644 --- a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md @@ -31,7 +31,7 @@ When a device running Windows 10 Mobile is joined to Azure AD, the device can e - Single sign-on (SSO) in applications like Mail, Word, and OneDrive using resources backed by Azure AD. -- SSO in Microsoft Edge browser to Azure AD-connected web applications like Office 365 Portal, Visual Studio, and more than [2500 non-Microsoft apps](https://go.microsoft.com/fwlink/p/?LinkID=746211). +- SSO in Microsoft Edge browser to Azure AD-connected web applications like Microsoft 365 admin center, Visual Studio, and more than [2500 non-Microsoft apps](https://go.microsoft.com/fwlink/p/?LinkID=746211). - SSO to resources on-premises. @@ -177,7 +177,7 @@ The OneDrive application also uses SSO, showing you all your documents and enabl ![onedrive](images/aadjonedrive.jpg) -In addition to application SSO, Azure AD joined devices also get SSO for browser applications which trust Azure AD, such as web applications, Visual Studio, Office 365 portal, and OneDrive for Business. +In addition to application SSO, Azure AD joined devices also get SSO for browser applications which trust Azure AD, such as web applications, Visual Studio, Microsoft 365 admin center, and OneDrive for Business. ![browser apps](images/aadjbrowser.jpg) diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 1eae18e33a..79b168c90e 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -45,7 +45,7 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a ![login to office 365](images/azure-ad-add-tenant5.png) -7. In the Office 365 portal, select **Purchase Services** from the left nagivation. +7. In the Microsoft 365 admin center, select **Purchase Services** from the left nagivation. ![purchase service option in admin center menu](images/azure-ad-add-tenant6.png) @@ -67,7 +67,7 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. Here's a step-by-step guide to register your free Azure AD subscription using an Office 365 Premium Business subscription. -1. Sign in to the Office 365 portal at using your organization's account. +1. Sign in to the Microsoft 365 admin center at using your organization's account. ![register azuread](images/azure-ad-add-tenant10.png) diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index cfa669f4e5..be9c8a5339 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -21,7 +21,7 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent   ## Register your free Azure Active Directory subscription -1. Sign in to the Office 365 portal at using your organization's account. +1. Sign in to the Microsoft 365 admin center at using your organization's account. ![register azuread](images/azure-ad-add-tenant10.png) diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 32fc4b968a..aec2607c4f 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -84,7 +84,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a |----------------|----------|------------| | | | star-mini.c10r.facebook.com | -The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. +The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. @@ -293,7 +293,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Office -The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -304,7 +304,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | | | *.e-msedge.net | | | | *.s-msedge.net | -The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index f62497b8ad..75b7e8cde2 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -85,7 +85,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a |----------------|----------|------------| | | | star-mini.c10r.facebook.com | -The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. +The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. @@ -297,7 +297,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Office -The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -309,7 +309,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | | | *.s-msedge.net | | | HTTPS | ocos-office365-s2s.msedge.net | -The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 0504d6eceb..6367bb1968 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -85,7 +85,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a |----------------|----------|------------| | | | star-mini.c10r.facebook.com | -The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. +The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. @@ -311,7 +311,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Office -The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -325,7 +325,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | | HTTPS | nexusrules.officeapps.live.com | | | HTTPS | officeclient.microsoft.com | -The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index e4464fdddc..f3b541e69a 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -57,7 +57,7 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/livetile/?Language=en-US ||The following endpoint is used for Twitter updates. To turn off traffic for these endpoints, either uninstall Twitter or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|*.twimg.com*| ||The following endpoint is used for Candy Crush Saga updates. To turn off traffic for this endpoint, either uninstall Candy Crush Saga or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|candycrushsoda.king.com| -||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|evoke-windowsservices-tas.msedge.net| ||The following endpoint is used for by the Microsoft Wallet app. To turn off traffic for this endpoint, either uninstall the Wallet app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|wallet.microsoft.com| ||The following endpoint is used by the Groove Music app for update HTTP handler status. If you turn off traffic for this endpoint, apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app.|HTTPS|mediaredirect.microsoft.com| ||The following endpoints are used when using the Whiteboard app. To turn off traffic for this endpoint disable the Microsoft Store.|HTTPS|int.whiteboard.microsoft.com| @@ -119,7 +119,7 @@ The following methodology was used to derive these network endpoints: |||HTTP |share.microsoft.com| |Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| ||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTP|www.msftconnecttest.com*| -|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|Office|The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| |||HTTP|*.c-msedge.net| |||HTTPS|*.e-msedge.net| |||HTTPS|*.s-msedge.net| diff --git a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md index 29accd3e32..944800a1d5 100644 --- a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md @@ -65,7 +65,7 @@ We used the following methodology to derive these network endpoints: | candycrushsoda.king.com | TLSv1.2 | Used for Candy Crush Saga updates. | | cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. | | cdn.onenote.net | HTTP | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net | HTTP | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net | HTTP | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com | HTTP | Used to retrieve Skype configuration values. | | ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. | @@ -157,7 +157,7 @@ We used the following methodology to derive these network endpoints: | candycrushsoda.king.com | HTTPS | Used for Candy Crush Saga updates. | | cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. | | cdn.onenote.net | HTTPS | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. | | ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). | @@ -167,7 +167,7 @@ We used the following methodology to derive these network endpoints: | definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. | | displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. | | download.windowsupdate.com | HTTP | Enables connections to Windows Update. | -| evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office. | +| evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | @@ -255,7 +255,7 @@ We used the following methodology to derive these network endpoints: | cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. | | dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | download.windowsupdate.com | HTTP | Enables connections to Windows Update. | -| evoke-windowsservices-tas.msedge.net/ab | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office. | +| evoke-windowsservices-tas.msedge.net/ab | HTTPS | Used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. | | fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. | | fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. | diff --git a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md index 1744c60ff7..a93b73468f 100644 --- a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md @@ -47,7 +47,7 @@ We used the following methodology to derive these network endpoints: | *.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ | HTTP | Enables connections to Windows Update. | | arc.msn.com.nsatc.net | HTTPS | Used to retrieve Windows Spotlight metadata. | | arc.msn.com/v3/Delivery/Placement | HTTPS | Used to retrieve Windows Spotlight metadata. | -| client-office365-tas.msedge.net* | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net* | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com/config/* | HTTPS | Used to retrieve Skype configuration values. | | ctldl.windowsupdate.com/msdownload/update* | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cy2.displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store. | @@ -67,7 +67,7 @@ We used the following methodology to derive these network endpoints: | location-inference-westus.cloudapp.net | HTTPS | Used for location data. | | maps.windows.com/windows-app-web-link | HTTPS | Link to Maps application. | | modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. | -| ocos-office365-s2s.msedge.net* | HTTPS | Used to connect to the Office 365 portal's shared infrastructure. | +| ocos-office365-s2s.msedge.net* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure. | | ocsp.digicert.com* | HTTP | CRL and OCSP checks to the issuing certificate authorities. | | oneclient.sfx.ms* | HTTPS | Used by OneDrive for Business to download and verify app updates. | | onecollector.cloudapp.aria.akadns.net | HTTPS | Office Telemetry | @@ -129,7 +129,7 @@ We used the following methodology to derive these network endpoints: | *geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | au.download.windowsupdate.com* | HTTP | Enables connections to Windows Update. | | cdn.onenote.net/livetile/* | HTTPS | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | cloudtile.photos.microsoft.com.akadns.net | HTTPS | Photos App in MS Store | config.edge.skype.com/* | HTTPS | Used to retrieve Skype configuration values.  | | ctldl.windowsupdate.com/* | HTTP | Used to download certificates that are publicly known to be fraudulent. | @@ -149,7 +149,7 @@ We used the following methodology to derive these network endpoints: | licensing.mp.microsoft.com/* | HTTPS | Used for online activation and some app licensing. | | maps.windows.com/windows-app-web-link | HTTPS | Link to Maps application | | modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. | -| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Office 365 portal's shared infrastructure. | +| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure. | | ocsp.digicert.com* | HTTP | CRL and OCSP checks to the issuing certificate authorities. | | oneclient.sfx.ms/* | HTTPS | Used by OneDrive for Business to download and verify app updates. | | onecollector.cloudapp.aria.akadns.net | HTTPS | Office telemetry | diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md index 0bde8377e9..aea47d78e8 100644 --- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md @@ -65,7 +65,7 @@ We used the following methodology to derive these network endpoints: |\*wns.windows.com\* | HTTPS, TLSv1.2 | Used for the Windows Push Notification Services (WNS). |\*wpc.v0cdn.net* | | Windows Telemetry related traffic |auth.gfx.ms/16.000.27934.1/OldConvergedLogin_PCore.js | | MSA related -|evoke-windowsservices-tas.msedge* | HTTPS | The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +|evoke-windowsservices-tas.msedge* | HTTPS | The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. |fe2.update.microsoft.com\* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |fe3.\*.mp.microsoft.com.\* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |fs.microsoft.com | | Font Streaming (in ENT traffic) @@ -133,7 +133,7 @@ We used the following methodology to derive these network endpoints: | *geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. | | au.download.windowsupdate.com\* | HTTP | Enables connections to Windows Update. | | cdn.onenote.net/livetile/* | HTTPS | Used for OneNote Live Tile. | -| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. | +| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center’s shared infrastructure, including Office. | | config.edge.skype.com/* | HTTPS | Used to retrieve Skype configuration values.  | | ctldl.windowsupdate.com/* | HTTP | Used to download certificates that are publicly known to be fraudulent. | | cy2.displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store. | @@ -151,7 +151,7 @@ We used the following methodology to derive these network endpoints: | licensing.mp.microsoft.com/* | HTTPS | Used for online activation and some app licensing. | | maps.windows.com/windows-app-web-link | HTTPS | Link to Maps application | | modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. | -| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Office 365 portal's shared infrastructure. | +| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure. | | ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities. | | oneclient.sfx.ms/* | HTTPS | Used by OneDrive for Business to download and verify app updates. | | settings-win.data.microsoft.com/settings/* | HTTPS | Used as a way for apps to dynamically update their configuration. | diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md index 6c791a5536..b9920c7acc 100644 --- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md @@ -228,7 +228,7 @@ The following methodology was used to derive the network endpoints: |browser.pipe.aria.microsoft.com|HTTP|Used by OfficeHub to get the metadata of Office apps |cdn.onenote.net/livetile/*|HTTPS|Used for OneNote Live Tile |cds.p9u4n2q3.hwcdn.net|HTTP|Used by the Highwinds Content Delivery Network to perform Windows updates -|client-office365-tas.msedge.net/*|HTTPS|Office 365 portal and Office in a browser +|client-office365-tas.msedge.net/*|HTTPS|Microsoft 365 admin center and Office in a browser |ctldl.windowsupdate.com*|HTTP|Used to download certificates that are publicly known to be fraudulent |displaycatalog.mp.microsoft.com/*|HTTPS|Microsoft Store |dmd.metaservices.microsoft.com*|HTTP|Device Authentication @@ -248,7 +248,7 @@ The following methodology was used to derive the network endpoints: |maps.windows.com/windows-app-web-link|HTTPS|Maps application |modern.watson.data.microsoft.com.akadns.net|HTTPS|Used by Windows Error Reporting |msagfx.live.com|HTTPS|OneDrive -|ocos-office365-s2s.msedge.net/*|HTTPS|Used to connect to the Office 365 portal's shared infrastructure +|ocos-office365-s2s.msedge.net/*|HTTPS|Used to connect to the Microsoft 365 admin center's shared infrastructure |ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities |oneclient.sfx.ms/*|HTTPS|Used by OneDrive for Business to download and verify app updates |onecollector.cloudapp.aria.akadns.net|HTTPS|Microsoft Office From 9087c2b6a904f95fe5395d3ab842afc4cfc24662 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Thu, 16 Apr 2020 16:51:10 -0700 Subject: [PATCH 094/249] Update windows-defender-smartscreen-set-individual-device.md --- ...ender-smartscreen-set-individual-device.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md index 1bdb879cd4..b0e7163ee4 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md @@ -1,7 +1,7 @@ --- -title: Set up and use Windows Defender SmartScreen on individual devices (Windows 10) -description: Learn how employees can use Windows Security to set up Windows Defender SmartScreen. Windows Defender SmartScreen protects users from running malicious apps. -keywords: SmartScreen Filter, Windows SmartScreen, Windows Defender SmartScreen +title: Set up and use Microsoft Defender SmartScreen on individual devices (Windows 10) +description: Learn how employees can use Windows Security to set up Microsoft Defender SmartScreen. Microsoft Defender SmartScreen protects users from running malicious apps. +keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -14,22 +14,22 @@ manager: dansimp ms.author: macapara --- -# Set up and use Windows Defender SmartScreen on individual devices +# Set up and use Microsoft Defender SmartScreen on individual devices **Applies to:** - Windows 10, version 1703 - Windows 10 Mobile - Microsoft Edge -Windows Defender SmartScreen helps to protect users if they try to visit sites previously reported as phishing or malware websites, or if a user tries to download potentially malicious files. +Microsoft Defender SmartScreen helps to protect users if they try to visit sites previously reported as phishing or malware websites, or if a user tries to download potentially malicious files. -## How users can use Windows Security to set up Windows Defender SmartScreen -Starting with Windows 10, version 1703, users can use Windows Security to set up Windows Defender SmartScreen for an individual device; unless and administrator has used Group Policy or Microsoft Intune to prevent it. +## How users can use Windows Security to set up Microsoft Defender SmartScreen +Starting with Windows 10, version 1703, users can use Windows Security to set up Microsoft Defender SmartScreen for an individual device; unless and administrator has used Group Policy or Microsoft Intune to prevent it. >[!NOTE] >If any of the following settings are managed through Group Policy or mobile device management (MDM) settings, it appears as unavailable to the employee. -**To use Windows Security to set up Windows Defender SmartScreen on a device** +**To use Windows Security to set up Microsoft Defender SmartScreen on a device** 1. Open the Windows Security app, and then select **App & browser control** > **Reputation-based protection settings**. 2. In the **Reputation-based protection** screen, choose from the following options: @@ -38,13 +38,13 @@ Starting with Windows 10, version 1703, users can use Windows Security to set up - **On.** Warns users that the apps and files being downloaded from the web are potentially dangerous but allows the action to continue. - - **Off.** Turns off Windows Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files. + - **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files. - - In the **Windows Defender SmartScreen for Microsoft Edge** area: + - In the **Microsoft Defender SmartScreen for Microsoft Edge** area: - **On.** Warns users that sites and downloads are potentially dangerous but allows the action to continue while running in Microsoft Edge. - - **Off.** Turns off Windows Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files. + - **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files. - In the **Potentially unwanted app blocking** area: - **On.** Turns on both the 'Block apps' and 'Block downloads settings. To learn more, see [How Microsoft identifies malware and potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/intelligence/criteria#potentially-unwanted-application-pua). @@ -54,21 +54,21 @@ Starting with Windows 10, version 1703, users can use Windows Security to set up - **Off.** Turns off Potentially unwanted app blocking, so a user isn't alerted or stopped from downloading or installing potentially unwanted apps. - - In the **Windows Defender SmartScreen from Microsoft Store apps** area: + - In the **Microsoft Defender SmartScreen from Microsoft Store apps** area: - **On.** Warns users that the sites and downloads used by Microsoft Store apps are potentially dangerous but allows the action to continue. - - **Off.** Turns off Windows Defender SmartScreen, so a user isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files. + - **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files. - ![Windows Security, Windows Defender SmartScreen controls](images/windows-defender-smartscreen-control-2020.png) + ![Windows Security, Microsoft Defender SmartScreen controls](images/windows-defender-smartscreen-control-2020.png) -## How Windows Defender SmartScreen works when a user tries to run an app -Windows Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Windows Defender SmartScreen can warn the user or block the app from running entirely, depending on how you've configured the feature to run in your organization. +## How Microsoft Defender SmartScreen works when a user tries to run an app +Microsoft Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Microsoft Defender SmartScreen can warn the user or block the app from running entirely, depending on how you've configured the feature to run in your organization. -By default, users can bypass Windows Defender SmartScreen protection, letting them run legitimate apps after accepting a warning message prompt. You can also use Group Policy or Microsoft Intune to block your employees from using unrecognized apps, or to entirely turn off Windows Defender SmartScreen (not recommended). +By default, users can bypass Microsoft Defender SmartScreen protection, letting them run legitimate apps after accepting a warning message prompt. You can also use Group Policy or Microsoft Intune to block your employees from using unrecognized apps, or to entirely turn off Microsoft Defender SmartScreen (not recommended). ## How users can report websites as safe or unsafe -Windows Defender SmartScreen can be configured to warn users from going to a potentially dangerous site. Users can then choose to report a website as safe from the warning message or as unsafe from within Microsoft Edge and Internet Explorer 11. +Microsoft Defender SmartScreen can be configured to warn users from going to a potentially dangerous site. Users can then choose to report a website as safe from the warning message or as unsafe from within Microsoft Edge and Internet Explorer 11. **To report a website as safe from the warning message** - On the warning screen for the site, click **More Information**, and then click **Report that this site does not contain threats**. The site info is sent to the Microsoft feedback site, which provides further instructions. @@ -82,7 +82,7 @@ Windows Defender SmartScreen can be configured to warn users from going to a pot ## Related topics - [Threat protection](../index.md) -- [Windows Defender SmartScreen overview](windows-defender-smartscreen-overview.md) +- [Microsoft Defender SmartScreen overview](windows-defender-smartscreen-overview.md) >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). From fc718902ee90ae5717c54db75de87de1d6960019 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Thu, 16 Apr 2020 17:03:45 -0700 Subject: [PATCH 095/249] Update windows-defender-smartscreen-set-individual-device.md --- .../windows-defender-smartscreen-set-individual-device.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md index b0e7163ee4..dd2eb47e6c 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md @@ -24,7 +24,7 @@ ms.author: macapara Microsoft Defender SmartScreen helps to protect users if they try to visit sites previously reported as phishing or malware websites, or if a user tries to download potentially malicious files. ## How users can use Windows Security to set up Microsoft Defender SmartScreen -Starting with Windows 10, version 1703, users can use Windows Security to set up Microsoft Defender SmartScreen for an individual device; unless and administrator has used Group Policy or Microsoft Intune to prevent it. +Starting with Windows 10, version 1703, users can use Windows Security to set up Microsoft Defender SmartScreen for an individual device; unless an administrator has used Group Policy or Microsoft Intune to prevent it. >[!NOTE] >If any of the following settings are managed through Group Policy or mobile device management (MDM) settings, it appears as unavailable to the employee. From 53f3baeef6d285c955bb3f6938cae303af84a816 Mon Sep 17 00:00:00 2001 From: Obi Eze Ajoku <62227226+linque1@users.noreply.github.com> Date: Fri, 17 Apr 2020 01:56:14 -0700 Subject: [PATCH 096/249] Update windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- ...indows-operating-system-components-to-microsoft-services.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index eadc81def6..171740e483 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -40,7 +40,7 @@ Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline] >Regarding the Windows Restricted Traffic Limited Functionality Baseline, the 1903 settings (folder) are applicable to 1909 Windows >Enterprise devices. There were no additional settings required for the 1909 release. >[!Warning] ->If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. +> If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) @@ -1898,4 +1898,3 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre To learn more, see [Device update management](https://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](https://technet.microsoft.com/library/cc720539.aspx). - From bc5214eb980784895b9c5ccb196b805ccd3067fd Mon Sep 17 00:00:00 2001 From: Obi Eze Ajoku <62227226+linque1@users.noreply.github.com> Date: Fri, 17 Apr 2020 01:56:25 -0700 Subject: [PATCH 097/249] Update windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 171740e483..8bb8bf8e3c 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -39,7 +39,7 @@ Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline] >[!Note] >Regarding the Windows Restricted Traffic Limited Functionality Baseline, the 1903 settings (folder) are applicable to 1909 Windows >Enterprise devices. There were no additional settings required for the 1909 release. ->[!Warning] +> [!Warning] > If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) From be13208188f92bef16c69a83f31be131e16ad8d6 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Fri, 17 Apr 2020 09:01:51 -0700 Subject: [PATCH 098/249] pencil edit --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 8bb8bf8e3c..6dd9518dcf 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.localizationpriority: high audience: ITPro author: medgarmedgar -ms.author: v-medgar +ms.author: robsize manager: robsize ms.collection: M365-security-compliance ms.topic: article From 8e2412b0e93fc1f8e868b7a7aebc9d16ff2c985c Mon Sep 17 00:00:00 2001 From: Charles Inglis <32555877+cinglis-msft@users.noreply.github.com> Date: Fri, 17 Apr 2020 09:23:48 -0700 Subject: [PATCH 099/249] Remove exact retirement dates In response to Comms team feedback. Will add dates back when we know more. --- windows/deployment/update/update-compliance-monitor.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 255adfa845..102ee54ac9 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -18,9 +18,9 @@ ms.topic: article # Monitor Windows Updates with Update Compliance > [!IMPORTANT] -> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. A few retirements are planned, noted below, but are placed on hold until the current situation stabilizes. -> * As of March 31, 2020, The Windows Defender Antivirus reporting feature of Update Compliance is no longer supported and will soon be retired. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). -> * As of March 31, 2020, The Perspectives feature of Update Compliance is no longer supported and will soon be retired in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. +> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. A few retirements are planned, noted below, but are placed **on hold** until the current situation stabilizes. +> * The Windows Defender Antivirus reporting feature of Update Compliance will soon be retired. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). +> * As of March 31, 2020, The Perspectives feature of Update Compliance will soon be retired in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. ## Introduction From b922559c8c016ad26ef2cfda1b20569538db0435 Mon Sep 17 00:00:00 2001 From: pk2311 <37248711+pk2311@users.noreply.github.com> Date: Fri, 17 Apr 2020 22:37:20 +0530 Subject: [PATCH 100/249] ### Existing Enterprise deployments I have just added "caution" after the first paragraph, i am making this comment after doing testing in my customer's environment. If OOBE is automated using unatend.xml, the Firmware-embedded Windows 10 activation doesn't happen automatically, we need to manually activate and then enroll with AAD for E3 license switch to happen --- windows/deployment/windows-10-subscription-activation.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index d953b17ab2..478b92108d 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -191,6 +191,8 @@ When you have the required Azure AD subscription, group-based licensing is the p If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. +Caution: Firmware-embedded Windows 10 activation happens automatically only when we go through OOBE(Out Of Box Experience) + If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt: From bb839997863630700744f6b93b0e74bc40c0277a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 11:46:55 -0700 Subject: [PATCH 101/249] AIR fixes --- .../auto-investigation-action-center.md | 34 ++++++++++--------- .../manage-auto-investigation.md | 22 +++++++----- 2 files changed, 32 insertions(+), 24 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index fdb2c392fa..753419a56d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -18,7 +18,7 @@ ms.topic: article # View details and results of automated investigations -Pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) are listed in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)). +During and after an automated investigation, certain remediation actions can be identified. Depending on the threat and how Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) is configured for your organization, some actions are taken automatically. If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)). You can also use the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to view details about an investigation. >[!NOTE] >If your organization has implemented role-based access to manage portal access, only authorized users or user groups who have permission to view the machine or machine group will be able to view the entire investigation. @@ -27,12 +27,13 @@ Pending and completed [remediation actions](manage-auto-investigation.md#remedia ![Action center page](images/action-center.png) -The action center consists of two main tabs, as described in the following table. - -|Tab |Description | -|---------|---------| -|Pending actions |Displays a list of ongoing investigations that require attention. Recommended actions are presented that your security operations team can approve or reject.

      **NOTE**: The Pending tab appears only if there are pending actions to be approved (or rejected). | -|History |Acts as an audit log for all of the following:
      - All actions taken by automated investigation and remediation in Microsoft Defender ATP
      Actions that were approved by your security operations team (some actions, such as sending a file to quarantine, can be undone)
      - All commands ran and remediation actions that were applied in Live Response sessions (some actions can be undone)
      - Remediation actions that were applied by Windows Defender Antivirus (some actions can be undone) | +The action center consists of two main tabs: **Pending actions** and **History**. +- **Pending actions** Displays a list of ongoing investigations that require attention. Recommended actions are presented that your security operations team can approve or reject. The Pending tab appears only if there are pending actions to be approved (or rejected). +- **History** Acts as an audit log for all of the following:
      + - Remediation actions that were taken as a result of an automated investigation + - Remediation actions that were approved by your security operations team (some actions, such as sending a file to quarantine, can be undone) + - Commands that were run and remediation actions that were applied in Live Response sessions (some actions can be undone) + - Remediation actions that were applied by Windows Defender Antivirus (some actions can be undone) Use the **Customize columns** menu to select columns that you'd like to show or hide. @@ -70,17 +71,18 @@ An automated investigation can be have one of the following status values: |Status |Description | |---------|---------| -| No threats found | No malicious entities found during the investigation. | -| Failed | A problem has interrupted the investigation, preventing it from completing. | -| Partially remediated | A problem prevented the remediation of some malicious entities. | -| Pending action | Remediation actions require review and approval. | +| Running | The investigation process has started and is underway. Malicious artifacts that are found are remediated. | +| Partially investigated | Entities directly related to the alert have been investigated. However, a problem stopped the investigation of collateral entities. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for specific details. | +| No threats found | The investigation has finished and no threats were identified.
      If you suspect something was missed (such as a false negative), you can use [advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). | +| Pending action | The investigation has found a threat, and an action to remediate that threat is awaiting approval. The Pending Action state is triggered when any threat with a corresponding action is found. However, the list of pending actions can increase as an investigation runs. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to see if other items are still pending completion. | +| Remediated | The investigation finished and all actions were approved (fully remediated). | +| Partially remediated | The investigation resulted in remediation actions, and some were approved and completed. Other actions are still pending. | +| Terminated by system | The investigation stopped. An investigation can stop for several reasons:
      - The investigation's pending actions expired. Pending actions can time out after awaiting approval for an extended period of time.
      - There are too many actions in the list.
      Visit the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) to view and approve any pending actions. | +| Failed | At least one investigation analyzer ran into a problem where it could not complete properly.

      If an investigation fails after remediation actions were approved, the remediation actions might still have succeeded. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for detailed results. | +| Queued | An investigation is being held in a queue. When other investigations complete, queued investigations begin. | | Waiting for machine | Investigation paused. The investigation will resume as soon as the machine is available. | -| Queued | Investigation has been queued and will resume as soon as other remediation activities are completed. | -| Running | Investigation ongoing. Malicious entities found will be remediated. | -| Remediated | Malicious entities found were successfully remediated. | -| Terminated by system | Investigation was stopped by the system. | | Terminated by user | A user stopped the investigation before it could complete. | -| Partially investigated | Entities directly related to the alert have been investigated. However, a problem stopped the investigation of collateral entities. | + ## View details about an automated investigation diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index a9250abb97..62199ea6b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -24,17 +24,17 @@ ms.topic: conceptual When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *Clean*. Depending on the type of threat and resulting verdict, remediation actions occur automatically or upon approval by your organization’s security operations team. For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed. When a verdict of *Malicious* is reached for a piece of evidence, Microsoft Defender Advanced Threat Protection takes one of the following remediation actions automatically: -- Quarantine file -- Remove registry key -- Kill process -- Stop service -- Remove registry key -- Disable driver -- Remove scheduled task +- Quarantine a file +- Remove a registry key +- Kill a process +- Stop a service +- Remove a registry key +- Disable a driver +- Remove a scheduled task Evidence determined as *Suspicious* results in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible. This helps your automated investigations complete in a timely manner. -No actions are taken when evidence is determined to be *Clean*. +No actions are taken when evidence is determined to be *No threats found*. In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). @@ -61,6 +61,12 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and 4. Select an item to view more details about that remediation action. +## Next steps + +- [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center) + +- [Get an overview of live response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/live-response) + ## Related articles - [Automated investigation and response in Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air) From bac04464feed4ee422704ba3842bc37a47beca39 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 11:54:26 -0700 Subject: [PATCH 102/249] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 62199ea6b6..f4da4cd929 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -21,7 +21,7 @@ ms.topic: conceptual ## Remediation actions -When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *Clean*. Depending on the type of threat and resulting verdict, remediation actions occur automatically or upon approval by your organization’s security operations team. For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed. +When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat and resulting verdict, remediation actions occur automatically or upon approval by your organization’s security operations team. For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed. When a verdict of *Malicious* is reached for a piece of evidence, Microsoft Defender Advanced Threat Protection takes one of the following remediation actions automatically: - Quarantine a file From cdd2514612eb0911ed6195264cd15044027abcbc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 11:56:54 -0700 Subject: [PATCH 103/249] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index f4da4cd929..a9c3330152 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -32,15 +32,15 @@ When a verdict of *Malicious* is reached for a piece of evidence, Microsoft Defe - Disable a driver - Remove a scheduled task -Evidence determined as *Suspicious* results in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible. This helps your automated investigations complete in a timely manner. +Evidence determined as *Suspicious* results in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible so that you automated investigations complete in a timely manner. -No actions are taken when evidence is determined to be *No threats found*. +No actions are taken when a verdict of *No threats found* is reached for a piece of evidence. In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). ## Review pending actions -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. This takes you to your Security dashboard. +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the Security dashboard. 2. On the Security dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**. @@ -53,7 +53,7 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and ## Review completed actions -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. This takes you to your Security dashboard. +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the Security dashboard. 2. On the Security dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**. From dd93974f67f242862cd54352440c8462e6e50f62 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 11:59:21 -0700 Subject: [PATCH 104/249] Acrolinx fixes --- .../auto-investigation-action-center.md | 4 ++-- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index 753419a56d..dff6e8f43b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -29,7 +29,7 @@ During and after an automated investigation, certain remediation actions can be The action center consists of two main tabs: **Pending actions** and **History**. - **Pending actions** Displays a list of ongoing investigations that require attention. Recommended actions are presented that your security operations team can approve or reject. The Pending tab appears only if there are pending actions to be approved (or rejected). -- **History** Acts as an audit log for all of the following:
      +- **History** Acts as an audit log for all of the following items:
      - Remediation actions that were taken as a result of an automated investigation - Remediation actions that were approved by your security operations team (some actions, such as sending a file to quarantine, can be undone) - Commands that were run and remediation actions that were applied in Live Response sessions (some actions can be undone) @@ -60,7 +60,7 @@ On the **Investigations** page, you can view details and use filters to focus on |**Status** |(See [Automated investigation status](#automated-investigation-status)) | |**Triggering alert** | The alert that initiated the automated investigation | |**Detection source** |The source of the alert that initiated the automated investigation. | -|**Entities** | These can include device or machines, and machine groups. You can filter the automated investigations list to zone in a specific machine to see other investigations related to the machine, or to see specific machine groups that you might have created. | +|**Entities** | Entities can include device or machines, and machine groups. You can filter the automated investigations list to zone in a specific machine to see other investigations related to the machine, or to see specific machine groups that you might have created. | |**Threat** |The category of threat detected during the automated investigation. | |**Tags** |Filter using manually added tags that capture the context of an automated investigation.| |**Comments** |Select between filtering the list between automated investigations that have comments and those that don't.| diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index a9c3330152..8ae4bbb815 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -46,7 +46,7 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and 3. Review any items on the **Pending** tab. - Selecting an investigation from any of the categories opens a panel where you can approve or reject the remediation. Other details such as file or service details, investigation details, and alert details are displayed. From the panel, you can click on the **Open investigation page** link to see the investigation details. + Select an investigation from any of the categories to open a panel where you can approve or reject remediation actions. Other details such as file or service details, investigation details, and alert details are displayed. From the panel, you can click on the **Open investigation page** link to see the investigation details. You can also select multiple investigations to approve or reject actions on multiple investigations. From 746f5c00d195bc1aabd8c14fe0c6ae881d3d3c1f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 12:00:42 -0700 Subject: [PATCH 105/249] Update auto-investigation-action-center.md --- .../auto-investigation-action-center.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index dff6e8f43b..bf12057c2b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -18,7 +18,9 @@ ms.topic: article # View details and results of automated investigations -During and after an automated investigation, certain remediation actions can be identified. Depending on the threat and how Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) is configured for your organization, some actions are taken automatically. If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)). You can also use the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to view details about an investigation. +During and after an automated investigation, certain remediation actions can be identified. Depending on the threat and how [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (Microsoft Defender ATP) is configured for your organization, some remediation actions are taken automatically. + +If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)). You can also use the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to view details about an investigation. >[!NOTE] >If your organization has implemented role-based access to manage portal access, only authorized users or user groups who have permission to view the machine or machine group will be able to view the entire investigation. From 804093eecac99267ddabaa0d464836963ed33edf Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 12:02:01 -0700 Subject: [PATCH 106/249] Update auto-investigation-action-center.md --- .../auto-investigation-action-center.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index bf12057c2b..ed3177a88f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -61,11 +61,11 @@ On the **Investigations** page, you can view details and use filters to focus on |---------|---------| |**Status** |(See [Automated investigation status](#automated-investigation-status)) | |**Triggering alert** | The alert that initiated the automated investigation | -|**Detection source** |The source of the alert that initiated the automated investigation. | -|**Entities** | Entities can include device or machines, and machine groups. You can filter the automated investigations list to zone in a specific machine to see other investigations related to the machine, or to see specific machine groups that you might have created. | -|**Threat** |The category of threat detected during the automated investigation. | -|**Tags** |Filter using manually added tags that capture the context of an automated investigation.| -|**Comments** |Select between filtering the list between automated investigations that have comments and those that don't.| +|**Detection source** |The source of the alert that initiated the automated investigation | +|**Entities** | Entities can include device or machines, and machine groups. You can filter the automated investigations list to zone in a specific machine to see other investigations related to the machine, or to see specific machine groups that were created. | +|**Threat** |The category of threat detected during the automated investigation | +|**Tags** |Filter using manually added tags that capture the context of an automated investigation| +|**Comments** |Select between filtering the list between automated investigations that have comments and those that don't| ## Automated investigation status From 0525248210e71a2fdf198583f15f10b29d546073 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 12:02:26 -0700 Subject: [PATCH 107/249] Update auto-investigation-action-center.md --- .../microsoft-defender-atp/auto-investigation-action-center.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index ed3177a88f..a63a18d41e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -69,7 +69,7 @@ On the **Investigations** page, you can view details and use filters to focus on ## Automated investigation status -An automated investigation can be have one of the following status values: +An automated investigation can have one of the following status values: |Status |Description | |---------|---------| From 22e8f670f28dd7ac00bdad26548f5365f50cc62d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 12:03:25 -0700 Subject: [PATCH 108/249] Update auto-investigation-action-center.md --- .../auto-investigation-action-center.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index a63a18d41e..f01105729e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -96,7 +96,7 @@ In this view, you'll see the name of the investigation, when it started and ende ### Investigation graph -The investigation graph provides a graphical representation of an automated investigation. All investigation related information is simplified and arranged in specific sections. Clicking on any of the icons brings you the relevant section where you can view more information. +The investigation graph provides a graphical representation of an automated investigation. All investigation-related information is simplified and arranged in specific sections. Clicking on any of the icons brings you the relevant section where you can view more information. A progress ring shows two status indicators: - Orange ring - shows the pending portion of the investigation @@ -112,7 +112,7 @@ From this view, you can also view and add comments and tags about the investigat ### Alerts -The **Alerts** tab for an automated investigation shows details such as a short description of the alert that initiated the automated investigation, severity, category, the machine associated with the alert, user, time in queue, status, investigation state, and who the investigation is assigned to. +The **Alerts** tab for an automated investigation shows details such as a short description of the alert that initiated the automated investigation, severity, category, the machine associated with the alert, user, time in queue, status, investigation state, and to whom the investigation is assigned. Additional alerts seen on a machine can be added to an automated investigation as long as the investigation is ongoing. From 349e7089afa80eefdc3ae6aa6bff2243ff5d8ebd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Apr 2020 12:04:22 -0700 Subject: [PATCH 109/249] Update auto-investigation-action-center.md --- .../auto-investigation-action-center.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index f01105729e..eceb1d2833 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -128,7 +128,7 @@ Machines that show the same threat can be added to an ongoing investigation and Selecting a machine using the checkbox brings up the machine details pane where you can see more information such as machine details and logged-on users. -Clicking on an machine name brings you the machine page. +Clicking on a machine name brings you the machine page. ### Evidence @@ -150,7 +150,7 @@ You can also click on an action to bring up the details pane where you'll see in ### Pending actions -If there are pending actions on an automated investigation, you'll see a pop up similar to the following image. +If there are pending actions on an automated investigation, you'll see a pop-up similar to the following image. ![Image of pending actions](images/pending-actions.png) From fc8bda7dd4318f9ea4be91117ba188131b06c0eb Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 17 Apr 2020 13:14:25 -0700 Subject: [PATCH 110/249] remove wip --- .openpublishing.redirection.json | 5 + .../how-wip-works-with-labels.md | 122 ------------------ 2 files changed, 5 insertions(+), 122 deletions(-) delete mode 100644 windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 3b8c2ce3db..066d1d1e75 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -86,6 +86,11 @@ "redirect_document_id": true }, { +"source_path": "windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", +"redirect_document_id": false +}, +{ "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md", "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", "redirect_document_id": false diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md deleted file mode 100644 index 684b78d8e2..0000000000 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: How Windows Information Protection (WIP) protects files with a sensitivity label (Windows 10) -description: Explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label. -keywords: sensitivity, labels, WIP, Windows Information Protection, EDP, Enterprise Data Protection -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dulcemontemayor -ms.author: dansimp -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 04/30/2019 -ms.reviewer: ---- - -# How Windows Information Protection (WIP) protects a file that has a sensitivity label - -**Applies to:** - -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows 10, version 1903 -- Windows 10, version 1809 - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -This topic explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label. -Microsoft information protection technologies work together as an integrated solution to help enterprises: - -- Discover corporate data on endpoint devices -- Classify and label information based on its content and context -- Protect corporate data from unintentionally leaving to non-business environments -- Enable audit reports of user interactions with corporate data on endpoint devices - -Microsoft information protection technologies include: - -- [Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) is built in to Windows 10 and protects local data at rest on endpoint devices, and manages apps to protect local data in use. Data that leaves the endpoint device, such as email attachment, is not protected by WIP. - -- [Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection) is a cloud-based solution that can be purchased either standalone or as part of Microsoft 365 Enterprise. It helps an organization classify and protect its documents and emails by applying labels. Azure Information Protection is applied directly to content, and roams with the content as it's moved between locations and cloud services. - -- [Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security) is a cloud access security broker (CASB) solution that allows you to discover, classify, protect, and monitor user data in first-party and third-party Software-as-a-Service (SaaS) apps used by your organization. - -## How WIP protects sensitivity labels with endpoint data loss prevention - -You can create and manage [sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) in the Microsoft 365 compliance center. -When you [create a sensitivity label](https://docs.microsoft.com/microsoft-365/compliance/create-sensitivity-labels), you can specify that endpoint data loss prevention applies to content with that label. - -![Endpoint data loss prevention](images/sensitivity-label-endpoint-dlp.png) - -Office app users can choose a sensitivity label from a menu and apply it to a file. - -![Sensitivity labels](images/sensitivity-labels.png) - -WIP enforces default endpoint protection as follows: - -- If endpoint data loss prevention is enabled, the device enforces work protection for any file with the label -- If endpoint data loss prevention is not enabled: - - The device enforces work protection to a file downloaded from a work site - - The device does not enforce work protection to a file downloaded from a personal site - -Here's an example where a file remains protected without any work context beyond the sensitivity label: - -1. Sara creates a PDF file on a Mac and labels it as **Confidential**. -1. She emails the PDF from her Gmail account to Laura. -1. Laura opens the PDF file on her Windows 10 device. -1. Windows Defender Advanced Threat Protection (Windows Defender ATP) scans Windows 10 for any file that gets modified or created, including files that were created on a personal site. -1. Windows Defender ATP triggers WIP policy. -1. WIP policy protects the file even though it came from a personal site. - -## How WIP protects automatically classified files - -The next sections cover how Windows Defender ATP extends discovery and protection of sensitive information with improvements in Windows 10 version 1903. - -### Discovery - -Windows Defender ATP can extract the content of the file itself and evaluate whether it contains sensitive information types such as credit card numbers or employee ID numbers. -When you create a sensitivity label, you can specify that the label be added to any file that contains a sensitive information type. - -![Sensitivity labels](images/sensitivity-label-auto-label.png) - -A default set of [sensitive information types](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for) in Microsoft 365 compliance center includes credit card numbers, phone numbers, driver's license numbers, and so on. -You can also [create a custom sensitive information type](https://docs.microsoft.com/office365/securitycompliance/create-a-custom-sensitive-information-type), which can include any keyword or expression that you want to evaluate. - -### Protection - -When a file is created or edited on a Windows 10 endpoint, Windows Defender ATP extracts the content and evaluates if it contains any default or custom sensitive information types that have been defined. -If the file has a match, Windows Defender ATP applies endpoint data loss prevention even if the file had no label previously. - -Windows Defender ATP is integrated with Azure Information Protection for data discovery and reports sensitive information types that were discovered. -Azure Information Protection aggregates the files with sensitivity labels and the sensitive information types they contain across the enterprise. - -![Image of Azure Information Protection - Data discovery](images/azure-data-discovery.png) - -You can see sensitive information types in Microsoft 365 compliance under **Classifications**. Default sensitive information types have Microsoft as the publisher. The publisher for custom types is the tenant name. - -![Sensitive information types](images/sensitive-info-types.png) - ->[!NOTE] ->Automatic classification does not change the file itself, but it applies protection based on the label. ->WIP protects a file that contains a sensitive information type as a work file. ->Azure Information Protection works differently in that it extends a file with a new attribute so the protection persists if the file is copied. - -## Prerequisites - -- Endpoint data loss prevention requires Windows 10, version 1809 -- Auto labelling requires Windows 10, version 1903 -- Devices need to be onboarded to [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection), which scans content for a label and applies WIP policy -- [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in Microsoft 365 compliance center -- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](overview-create-wip-policy-configmgr.md) - - - - - - - - - From 7e4ea2c73aa4e800d8671ba946ef1e7804b96ffc Mon Sep 17 00:00:00 2001 From: mapalko Date: Fri, 17 Apr 2020 14:04:42 -0700 Subject: [PATCH 111/249] minor edits in repsonse to mlindgren feedback --- .../hello-manage-in-organization.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 0656bcd49c..18f6f3dbf0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -83,6 +83,10 @@ The following table lists the Group Policy settings that you can configure for W

      Not configured: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

      Enabled: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

      Disabled: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

      +

      + +For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md). +
      Exclude Security DeviceExcludeSecurityDevice TPM12 Device False
      Device or user 1 -

      0: Numbers are allowed.

      -

      1: At least one number is required.

      -

      2: Numbers are not allowed.

      +

      0: Digits are allowed.

      +

      1: At least one digit is required.

      +

      2: Digits are not allowed.

      From 032d82827c2ca8511f31e0356cd93ff321ac4f54 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 21 Apr 2020 11:18:46 -0700 Subject: [PATCH 128/249] typo --- .../microsoft-defender-atp/post-ti-indicator.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md index b02f9d6f58..b4b27d638f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md @@ -97,7 +97,7 @@ Content-type: application/json "severity": "Informational", "description": "test", "recommendedActions": "nothing", - “rbacGroupNames": [“group1”, “group2”] + "rbacGroupNames": ["group1", "group2"] } ``` From 0de78dc058a0d8bc875833e487f59b2f4347733d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 21 Apr 2020 13:11:37 -0700 Subject: [PATCH 129/249] update topic --- .../configure-server-endpoints.md | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index e7da43acc6..9a9e8530ab 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -43,26 +43,15 @@ The service supports the onboarding of the following servers: For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128). -> [!NOTE] -> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services) ## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016 There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP: -- **Option 1**: Onboard through Azure Security Center -- **Option 2**: Onboard through Microsoft Defender Security Center +- **Option 1**: Onboard through Microsoft Defender Security Center +- **Option 2**: Onboard through Azure Security Center -### Option 1: Onboard servers through Azure Security Center -1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. - -2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system. - -3. Click **Onboard Servers in Azure Security Center**. - -4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). - -### Option 2: Onboard servers through Microsoft Defender Security Center +### Option 1: Onboard servers through Microsoft Defender Security Center You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center. - For Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements: @@ -125,6 +114,19 @@ Once completed, you should see onboarded servers in the portal within an hour. - If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). + +### Option 2: Onboard servers through Azure Security Center +1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. + +2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system. + +3. Click **Onboard Servers in Azure Security Center**. + +4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). + +> [!NOTE] +> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services) + ## Windows Server, version 1803 and Windows Server 2019 To onboard Windows Server, version 1803 or Windows Server 2019, refer to the supported methods and versions below. @@ -169,7 +171,7 @@ Support for Windows Server, provide deeper insight into activities happening on ## Integration with Azure Security Center -Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. +Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. The following capabilities are included in this integration: - Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding). From 223e0f27a32fb7747aafebd5dcea17704e1cf244 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Tue, 21 Apr 2020 14:00:47 -0700 Subject: [PATCH 130/249] fix incorrect redirect --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 3b8c2ce3db..cc5c366449 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -15793,7 +15793,7 @@ }, { "source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/get-started-with-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", "redirect_document_id": false }, { From d92a7736bf5c15cd89f01ccedc73acc94a024822 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Tue, 21 Apr 2020 14:50:00 -0700 Subject: [PATCH 131/249] Update TOC.md --- windows/security/threat-protection/TOC.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 99d33dcb26..44e43335b6 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -700,9 +700,9 @@ #### [Family options](windows-defender-security-center/wdsc-family-options.md) -### [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) -#### [Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) -#### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) +### [Microsoft Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) +#### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) +#### [Set up and use Microsft Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) ### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md) #### [Windows Sandbox architecture](windows-sandbox/windows-sandbox-architecture.md) From 87ee74186500ad3670427b05f959f0595b5f20a3 Mon Sep 17 00:00:00 2001 From: Mizanur Rahman <41208456+Mizanurra@users.noreply.github.com> Date: Tue, 21 Apr 2020 16:24:12 -0700 Subject: [PATCH 132/249] Update hololens2-autopilot.md Moved requirements verification steps before submitting the private preview request and also added user-targeted apps clarification. --- devices/hololens/hololens2-autopilot.md | 64 ++++++++++++------------- 1 file changed, 31 insertions(+), 33 deletions(-) diff --git a/devices/hololens/hololens2-autopilot.md b/devices/hololens/hololens2-autopilot.md index 1d2c68e80e..4a84b33ae9 100644 --- a/devices/hololens/hololens2-autopilot.md +++ b/devices/hololens/hololens2-autopilot.md @@ -31,7 +31,7 @@ When a user starts the Autopilot self-deploying process, the process completes t > [!NOTE] > Autopilot for HoloLens does not support Active Directory join or Hybrid Azure AD join. 1. Use Azure AD to enroll the device in Microsoft Intune (or another MDM service). -1. Download the device-targeted policies, certificates, and networking profiles. +1. Download the device-targeted policies, user-targeted apps, certificates, and networking profiles. 1. Provision the device. 1. Present the sign-in screen to the user. @@ -39,8 +39,8 @@ When a user starts the Autopilot self-deploying process, the process completes t The following steps summarize the process of setting up your environment for the Windows Autopilot for HoloLens 2. The rest of this section provides the details of these steps. -1. Enroll in the Windows Autopilot for HoloLens 2 program. 1. Make sure that you meet the requirements for Windows Autopilot for HoloLens. +1. Enroll in the Windows Autopilot for HoloLens 2 program. 1. Verify that your tenant is flighted (enrolled to participate in the program). 1. Register devices in Windows Autopilot. 1. Create a device group. @@ -49,7 +49,35 @@ The following steps summarize the process of setting up your environment for the 1. Configure a custom configuration profile for HoloLens devices (known issue). 1. Verify the profile status of the HoloLens devices. -### 1. Enroll in the Windows Autopilot for HoloLens 2 program +### 1. Make sure that you meet the requirements for Windows Autopilot for HoloLens +For the latest information about how to participate in the program, review [Windows Insider Release Notes](hololens-insider.md#windows-insider-release-notes). + +Review the following sections of the Windows Autopilot requirements article: + +- [Network requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#networking-requirements) +- [Licensing requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#licensing-requirements) +- [Configuration requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#configuration-requirements) +> [!IMPORTANT] +> Unlike other Windows Autopilot programs, Windows Autopilot for HoloLens 2 has specific operating system requirements. + +Review the "[Requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/self-deploying#requirements)" section of the Windows Autopilot Self-Deploying mode article. Your environment has to meet these requirements as well as the standard Windows Autopilot requirements. + +> [!NOTE] +> You do not have to review the "Step by step" and "Validation" sections of the article. The procedures later in this article provide corresponding steps that are specific to HoloLens. +> [!IMPORTANT] +> For information about how to register devices and configure profiles, see [4. Register devices in Windows Autopilot](#4-register-devices-in-windows-autopilot) and [6. Create a deployment profile](#6-create-a-deployment-profile) in this article. These sections provide steps that are specific to HoloLens. + +Before you start the OOBE and provisioning process, make sure that the HoloLens devices meet the following requirements: + +- The devices are not already members of Azure AD, and are not enrolled in Intune (or another MDM system). The Autopilot self-deploying process completes these steps. To make sure that all the device-related information is cleaned up, check the **Devices** pages in both Azure AD and Intune. +- Every device can connect to the internet. You can use a wired or wireless connection. +- Every device can connect to a computer by using a USB-C cable, and that computer has the following available: + - Advanced Recovery Companion (ARC) + - The latest Windows update: Windows 10, version 19041.1002.200107-0909 or a later version) + +To configure and manage the Autopilot self-deploying mode profiles, make sure that you have access to [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com). + +### 2. Enroll in the Windows Autopilot for HoloLens 2 program To participate in the program, you have to use a tenant that is flighted for HoloLens. To do this, go to [Windows Autopilot for HoloLens Private Preview request](https://aka.ms/APHoloLensTAP) or use the following QR code to submit a request. @@ -62,36 +90,6 @@ In this request, provide the following information: - Number of HoloLens 2 devices that are participating in this evaluation - Number of HoloLens 2 devices that you plan to deploy by using Autopilot self-deploying mode -### 2. Make sure that you meet the requirements for Windows Autopilot for HoloLens - -For the latest information about how to participate in the program, review [Windows Insider Release Notes](hololens-insider.md#windows-insider-release-notes). - -Review the following sections of the Windows Autopilot requirements article: - -- [Network requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#networking-requirements) -- [Licensing requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#licensing-requirements) -- [Configuration requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#configuration-requirements) - > [!IMPORTANT] - > For information about how to register devices and configure profiles, see [4. Register devices in Windows Autopilot](#4-register-devices-in-windows-autopilot) and [6. Create a deployment profile](#6-create-a-deployment-profile) in this article. These sections provide steps that are specific to HoloLens. - -> [!IMPORTANT] -> Unlike other Windows Autopilot programs, Windows Autopilot for HoloLens 2 has specific operating system requirements. - -Review the "[Requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/self-deploying#requirements)" section of the Windows Autopilot Self-Deploying mode article. Your environment has to meet these requirements as well as the standard Windows Autopilot requirements. - -> [!NOTE] -> You do not have to review the "Step by step" and "Validation" sections of the article. The procedures later in this article provide corresponding steps that are specific to HoloLens. - -Before you start the OOBE and provisioning process, make sure that the HoloLens devices meet the following requirements: - -- The devices are not already members of Azure AD, and are not enrolled in Intune (or another MDM system). The Autopilot self-deploying process completes these steps. To make sure that all the device-related information is cleaned up, check the **Devices** pages in both Azure AD and Intune. -- Every device can connect to the internet. You can use a wired or wireless connection. -- Every device can connect to a computer by using a USB-C cable, and that computer has the following available: - - Advanced Recovery Companion (ARC) - - The latest Windows update: Windows 10, version 19041.1002.200107-0909 or a later version) - -To configure and manage the Autopilot self-deploying mode profiles, make sure that you have access to [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com). - ### 3. Verify that your tenant is flighted To verify that your tenant is flighted for the Autopilot program after you submit your request, follow these steps: From 7f2e12a101ef43211deca76e35c9c986de50e867 Mon Sep 17 00:00:00 2001 From: Anya Novicheva Date: Wed, 22 Apr 2020 12:29:41 -0400 Subject: [PATCH 133/249] Update mac-install-with-intune.md A note should be added to the very beginning of this article that stands out. This document explains the legacy method for deploying and configurating the Microsoft Defender ATP application on macOS devices. The note should explain this, and point admins to the new docs and the blog post that show the native experience which is much easier. The docs to link to from the note are - Blog: https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/microsoft-endpoint-manager-simplifies-deployment-of-microsoft/ba-p/1322995 Deployment: https://docs.microsoft.com/en-us/mem/intune/apps/apps-advanced-threat-protection-macos Configuration: https://docs.microsoft.com/en-us/mem/intune/protect/antivirus-microsoft-defender-settings-macos In order of steps in the note, the blog should come first, then config, then deployment. Thank you! --- .../microsoft-defender-atp/mac-install-with-intune.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md index 1daa3a12b2..8bafdd7fd7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md @@ -19,6 +19,10 @@ ms.topic: conceptual # Intune-based deployment for Microsoft Defender ATP for Mac +Note - This documentation explains the legacy method for deploying and configuring Microsoft Defender ATP on macOS devices. The native experience is now avaliable in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and dfeploy the application and send it down to macOS devices. This blog post explains the new features: https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/microsoft-endpoint-manager-simplifies-deployment-of-microsoft/ba-p/1322995 +To configure the app go here: https://docs.microsoft.com/en-us/mem/intune/protect/antivirus-microsoft-defender-settings-macos +To deploy the app go here: https://docs.microsoft.com/en-us/mem/intune/apps/apps-advanced-threat-protection-macos + **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) From 9626d5d0213a90cac24d7b2a77a50957a7d93305 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 22 Apr 2020 09:34:31 -0700 Subject: [PATCH 134/249] Update devices/hololens/hololens2-autopilot.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- devices/hololens/hololens2-autopilot.md | 1 + 1 file changed, 1 insertion(+) diff --git a/devices/hololens/hololens2-autopilot.md b/devices/hololens/hololens2-autopilot.md index 4a84b33ae9..a807dffdde 100644 --- a/devices/hololens/hololens2-autopilot.md +++ b/devices/hololens/hololens2-autopilot.md @@ -64,6 +64,7 @@ Review the "[Requirements](https://docs.microsoft.com/windows/deployment/windows > [!NOTE] > You do not have to review the "Step by step" and "Validation" sections of the article. The procedures later in this article provide corresponding steps that are specific to HoloLens. + > [!IMPORTANT] > For information about how to register devices and configure profiles, see [4. Register devices in Windows Autopilot](#4-register-devices-in-windows-autopilot) and [6. Create a deployment profile](#6-create-a-deployment-profile) in this article. These sections provide steps that are specific to HoloLens. From 732ba8833389f28226a6a72cd805feba66d7517f Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 22 Apr 2020 10:01:36 -0700 Subject: [PATCH 135/249] pencil edits --- .../microsoft-defender-atp/mac-install-with-intune.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md index 8bafdd7fd7..08235662b7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md @@ -19,9 +19,11 @@ ms.topic: conceptual # Intune-based deployment for Microsoft Defender ATP for Mac -Note - This documentation explains the legacy method for deploying and configuring Microsoft Defender ATP on macOS devices. The native experience is now avaliable in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and dfeploy the application and send it down to macOS devices. This blog post explains the new features: https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/microsoft-endpoint-manager-simplifies-deployment-of-microsoft/ba-p/1322995 -To configure the app go here: https://docs.microsoft.com/en-us/mem/intune/protect/antivirus-microsoft-defender-settings-macos -To deploy the app go here: https://docs.microsoft.com/en-us/mem/intune/apps/apps-advanced-threat-protection-macos +> [!NOTE] +> This documentation explains the legacy method for deploying and configuring Microsoft Defender ATP on macOS devices. The native experience is now available in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and dfeploy the application and send it down to macOS devices. +> This blog post explains the new features: https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/microsoft-endpoint-manager-simplifies-deployment-of-microsoft/ba-p/1322995 +> To configure the app go here: https://docs.microsoft.com/mem/intune/protect/antivirus-microsoft-defender-settings-macos +> To deploy the app go here: https://docs.microsoft.com/mem/intune/apps/apps-advanced-threat-protection-macos **Applies to:** From 875e9e953977c66a7c941bdc2dd25ea0e4056589 Mon Sep 17 00:00:00 2001 From: Sarah Cooley Date: Wed, 22 Apr 2020 10:03:27 -0700 Subject: [PATCH 136/249] Minor HL2 AutoPilot update --- devices/hololens/hololens2-autopilot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens2-autopilot.md b/devices/hololens/hololens2-autopilot.md index 1d2c68e80e..6907e68179 100644 --- a/devices/hololens/hololens2-autopilot.md +++ b/devices/hololens/hololens2-autopilot.md @@ -108,7 +108,7 @@ To register a HoloLens device in the Windows Autopilot program, you have to obta **Retrieve a device hardware hash** -1. Start the HoloLens 2 device, and make sure that you sign in by using an account that is the device owner. +1. Start the HoloLens 2 device. 1. On the device, press the Power and Volume Down buttons at the same time and then release them. The device collects diagnostic logs and the hardware hash, and stores them in a set of .zip files. 1. Use a USB-C cable to connect the device to a computer. 1. On the computer, open File Explorer. Open **This PC\\\<*HoloLens device name*>\\Internal Storage\\Documents**, and locate the AutopilotDiagnostics.zip file. From 05d890fb8c38d6bdd3207c34285f213ca8dfafed Mon Sep 17 00:00:00 2001 From: Mike Eggers <49650192+v-miegge@users.noreply.github.com> Date: Wed, 22 Apr 2020 12:25:05 -0700 Subject: [PATCH 137/249] Updated title --- devices/surface/support-solutions-surface.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md index 543d6250ee..ab4c3a46c4 100644 --- a/devices/surface/support-solutions-surface.md +++ b/devices/surface/support-solutions-surface.md @@ -1,5 +1,5 @@ --- -title: Top support solutions for Surface devices +title: Top support solutions for Surface devices in the enterprise description: Find top solutions for common issues using Surface devices in the enterprise. ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A ms.reviewer: From 5e5d8d9c57f63f4641123a154da9d52bb60104fc Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 12:49:29 -0700 Subject: [PATCH 138/249] add note --- .../microsoft-defender-atp/configure-server-endpoints.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 9a9e8530ab..f060b6bc94 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -51,6 +51,11 @@ There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 - **Option 1**: Onboard through Microsoft Defender Security Center - **Option 2**: Onboard through Azure Security Center +> [!NOTE] +> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or +an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). + + ### Option 1: Onboard servers through Microsoft Defender Security Center You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center. @@ -124,8 +129,7 @@ Once completed, you should see onboarded servers in the portal within an hour. 4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). -> [!NOTE] -> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services) + ## Windows Server, version 1803 and Windows Server 2019 To onboard Windows Server, version 1803 or Windows Server 2019, refer to the supported methods and versions below. From d5b5a38db1fd9ecd80b199d3eb7cfb4caa31b361 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 22 Apr 2020 13:00:16 -0700 Subject: [PATCH 139/249] fix redirect --- .openpublishing.redirection.json | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index fd80622eef..f58da4ef6f 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -7832,11 +7832,6 @@ "redirect_document_id": true }, { -"source_path": "windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager", -"redirect_document_id": true -}, -{ "source_path": "windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit", "redirect_document_id": true @@ -15778,7 +15773,7 @@ }, { "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", "redirect_document_id": false }, { From 215ef53e99cdc9c1299393c2b475b6c05710670e Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 22 Apr 2020 13:15:17 -0700 Subject: [PATCH 140/249] Update defender-csp.md add more info to the description of QuickScanOverdue and FullScanOverdue --- windows/client-management/mdm/defender-csp.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 746d5b282e..593b1dd546 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -272,6 +272,8 @@ Supported operation is Get. **Health/QuickScanOverdue** Indicates whether a Windows Defender quick scan is overdue for the device. +A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and [catchup Quick scans](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupquickscan) are disabled (default) + The data type is a boolean. Supported operation is Get. @@ -279,6 +281,8 @@ Supported operation is Get. **Health/FullScanOverdue** Indicates whether a Windows Defender full scan is overdue for the device. +A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and [catchup Full scans](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupfullscan) are disabled (default) + The data type is a boolean. Supported operation is Get. @@ -422,4 +426,4 @@ Supported operations are Get and Execute. ## Related topics -[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file +[Configuration service provider reference](configuration-service-provider-reference.md) From c730491beef8f28e83cfcd514f7fe7da16277b1a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 13:19:12 -0700 Subject: [PATCH 141/249] fix line --- .../microsoft-defender-atp/configure-server-endpoints.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index f060b6bc94..a2550f9980 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -52,8 +52,7 @@ There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 - **Option 2**: Onboard through Azure Security Center > [!NOTE] -> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or -an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). +> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). ### Option 1: Onboard servers through Microsoft Defender Security Center From 632f5097285816e6bb570d9234979fab8aabe291 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 22 Apr 2020 13:32:52 -0700 Subject: [PATCH 142/249] fix redirect --- .openpublishing.redirection.json | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index f58da4ef6f..14d8d1b77c 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -7882,16 +7882,6 @@ "redirect_document_id": true }, { -"source_path": "windows/deploy/integrate-configuration-manager-with-mdt-2013.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/integrate-configuration-manager-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt", -"redirect_document_id": true -}, -{ "source_path": "windows/deploy/introduction-vamt.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/introduction-vamt", "redirect_document_id": true @@ -15787,21 +15777,11 @@ "redirect_document_id": false }, { -"source_path": "windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt", -"redirect_document_id": false -}, -{ "source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-configuration-manager.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", "redirect_document_id": false }, { -"source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/integrate-configuration-manager-with-mdt", -"redirect_document_id": false -}, -{ "source_path": "windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", "redirect_document_id": false @@ -15870,6 +15850,10 @@ "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-configuration-manager.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", "redirect_document_id": false +}, +{ +"source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", "redirect_document_id": false } ] } From 2cff2450d0658e9b848d7833836088045c4b4996 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 13:41:26 -0700 Subject: [PATCH 143/249] add data location settings --- .../data-retention-settings.md | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md index d2df7a0c6e..282546fdcc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md @@ -1,6 +1,6 @@ --- -title: Update how long data is stored by MDATP -description: Update data retention settings for Microsoft Defender Advanced Threat Protection (MDATP) by selecting between 30 days to 180 days. +title: Verify data storage location and update data retention settings +description:Verify data storage location and update data retention settings for Microsoft Defender Advanced Threat Protection keywords: data, storage, settings, retention, update search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -15,9 +15,8 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/24/2018 --- -# Update data retention settings for Microsoft Defender ATP +# Verify data storage location and update data retention settings for Microsoft Defender ATP **Applies to:** @@ -25,10 +24,18 @@ ms.date: 04/24/2018 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-gensettings-abovefoldlink) -During the onboarding process, a wizard takes you through the general settings of Microsoft Defender ATP. After onboarding, you might want to update the data retention settings. +During the onboarding process, a wizard takes you through the data storage and retention settings of Microsoft Defender ATP. + +After completing the onboarding, you can verify your selection in the data retention settings page. + +## Verify data storage location +During the [Set up phase](production-deployment.md) you would have selected the location to store your data. + +You can verify the data location by navigating to **Settings** > **Data retention**. + +## Update data retention settings 1. In the navigation pane, select **Settings** > **Data retention**. From 7bcfe8a90bca69532ba04c29e8c572cc2a86aae4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 13:42:54 -0700 Subject: [PATCH 144/249] update toc --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 44e43335b6..6d9f9f4a27 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -413,7 +413,7 @@ ### [Configure portal settings]() #### [Set up preferences](microsoft-defender-atp/preferences-setup.md) #### [General]() -##### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md) +##### [Verify data location and update data retention settings](microsoft-defender-atp/data-retention-settings.md) ##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md) ##### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md) ##### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md) From 8c91bed6da109192f0f9aec337e53bb515fae5bd Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 13:43:46 -0700 Subject: [PATCH 145/249] toc udpate --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 6d9f9f4a27..c32612f134 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -413,7 +413,7 @@ ### [Configure portal settings]() #### [Set up preferences](microsoft-defender-atp/preferences-setup.md) #### [General]() -##### [Verify data location and update data retention settings](microsoft-defender-atp/data-retention-settings.md) +##### [Verify data storage location and update data retention settings](microsoft-defender-atp/data-retention-settings.md) ##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md) ##### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md) ##### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md) From 6b43328d93bcbcb4ed1ab3d9caf9a29ffc1a2d44 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 14:00:24 -0700 Subject: [PATCH 146/249] fix meta --- .../microsoft-defender-atp/data-retention-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md index 282546fdcc..f0606f868a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md @@ -1,6 +1,6 @@ --- title: Verify data storage location and update data retention settings -description:Verify data storage location and update data retention settings for Microsoft Defender Advanced Threat Protection +description: Verify data storage location and update data retention settings for Microsoft Defender Advanced Threat Protection keywords: data, storage, settings, retention, update search.product: eADQiWindows 10XVcnh search.appverid: met150 From 365eddd68c90e08579a9b0ac87977399d1d43be7 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 22 Apr 2020 14:33:45 -0700 Subject: [PATCH 147/249] file name change --- ...gs.md => microsoft-defender-smartscreen-available-settings.md} | 0 ...een-overview.md => microsoft-defender-smartscreen-overview.md} | 0 ...md => microsoft-defender-smartscreen-set-individual-device.md} | 0 3 files changed, 0 insertions(+), 0 deletions(-) rename windows/security/threat-protection/windows-defender-smartscreen/{windows-defender-smartscreen-available-settings.md => microsoft-defender-smartscreen-available-settings.md} (100%) rename windows/security/threat-protection/windows-defender-smartscreen/{windows-defender-smartscreen-overview.md => microsoft-defender-smartscreen-overview.md} (100%) rename windows/security/threat-protection/windows-defender-smartscreen/{windows-defender-smartscreen-set-individual-device.md => microsoft-defender-smartscreen-set-individual-device.md} (100%) diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md b/windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md rename to windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-overview.md similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md rename to windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-overview.md diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md rename to windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md From 0d0668b63f9c94734fceb52b117e962a2cf94371 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 22 Apr 2020 14:44:53 -0700 Subject: [PATCH 148/249] Update shadow-protection.md --- .../windows-defender-antivirus/shadow-protection.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md index 9fc1cbc630..d0ea4ae6e7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md @@ -1,6 +1,6 @@ --- -title: Shadow protection in next-generation protection -description: Learn about shadow protection in next-generation protection +title: Shadow protection +description: Learn about shadow protection keywords: Windows Defender Antivirus, shadow protection, passive mode search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -16,7 +16,7 @@ ms.custom: next-gen ms.collection: --- -# Shadow protection in next-generation protection +# Shadow protection **Applies to:** @@ -78,7 +78,7 @@ No. Shadow protection does not affect third-party antivirus protection running o ### Why do I need to keep Windows Defender Antivirus up to date? -The [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) stack works in integration, and to get best protection value, you should keep Windows Defender Antivirus up to date. +Because Windows Defender Antivirus detects and remediates malicious items, it’s important to keep it up to date to leverage the latest machine learning models, behavioral detections, and heuristics for EDR in block mode to be most effective. The [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities work in an integrated manner, and to get best protection value, you should keep Windows Defender Antivirus up to date. ### Why do we need cloud protection on? From 2bd75bee02c83a9a3c9635aca550e002a55bcad8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 22 Apr 2020 14:46:00 -0700 Subject: [PATCH 149/249] Update shadow-protection.md --- .../windows-defender-antivirus/shadow-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md index d0ea4ae6e7..fc2adf887c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md @@ -78,7 +78,7 @@ No. Shadow protection does not affect third-party antivirus protection running o ### Why do I need to keep Windows Defender Antivirus up to date? -Because Windows Defender Antivirus detects and remediates malicious items, it’s important to keep it up to date to leverage the latest machine learning models, behavioral detections, and heuristics for EDR in block mode to be most effective. The [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities work in an integrated manner, and to get best protection value, you should keep Windows Defender Antivirus up to date. +Because Windows Defender Antivirus detects and remediates malicious items, it’s important to keep it up to date to leverage the latest machine learning models, behavioral detections, and heuristics for best results. The [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities work in an integrated manner, and to get best protection value, you should keep Windows Defender Antivirus up to date. ### Why do we need cloud protection on? From 1924063f62b904d80f3d736c685fc4882edd8ff6 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 22 Apr 2020 14:58:00 -0700 Subject: [PATCH 150/249] Update TOC.md --- windows/security/threat-protection/TOC.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 44e43335b6..908c7c4a1e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -700,9 +700,9 @@ #### [Family options](windows-defender-security-center/wdsc-family-options.md) -### [Microsoft Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) -#### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) -#### [Set up and use Microsft Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) +### [Microsoft Defender SmartScreen](microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) +#### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md) +#### [Set up and use Microsft Defender SmartScreen on individual devices](microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md) ### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md) #### [Windows Sandbox architecture](windows-sandbox/windows-sandbox-architecture.md) From 15dd5d0f68ec2703069db74a668f08c3b1e8292f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 Apr 2020 15:04:34 -0700 Subject: [PATCH 151/249] update visio --- .../downloads/mdatp-deployment-strategy.pdf | Bin 418257 -> 455024 bytes .../downloads/mdatp-deployment-strategy.vsdx | Bin 1989106 -> 1996351 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf b/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf index 551d7a42e81db46d859ec22c74b692e2c78646f5..0b904a9ae6470b613312932815d279dc4b72347e 100644 GIT binary patch literal 455024 zcma&Mb8v0T7d0B4*mibo+b6c|6WexjV%t7Bv2EM7ZQEb&y}wuWy?Xz=U0u6-_Us;W ztTB64t*&lTd0|mnMmlylXwru79~?9zfB|4@U;zis!$Ys^Zf8s{r0=9}Wot?=uWxGX z2w?hlE7D8r+n7=q+t8{gQ3B|doE)4Dos=DnjTLQeod6tc{|=FJcCs?J`JTbf@vkkT z?_eomV`BRa`%lx@2=G14n2(QM#@I>U=sO00iG`8%-=V7J#;(Q=@(#u(#tz0dhW|um zVf+`Bj}H#o*v9Bze*ZA}e-ZtcAia>SvyBsgjb6&!$WaTx{0|_2nf>32iGQS{ z7qGFhb^6wu>0e*~)4zz{Y5NBW!1OOm9l&=yBXfO0TQ{xmZUz85Cli2?iHYUgA@r@! zx3-Ree<#q3IoLYeeLu^;>+fHKUWs1WLEpyF?w=eOy3-3O(F+^9m>U`^iV1#)SJpRh z{2ub(O8hTRjsS-LJEi{s|34`eHMepycAyuv`c9d!v7xPzF}<|0jj5B_H&Z4C&VQyk zIyo5YTf;%SWuAL$CE&3;9JUeN6P%8$4H0HjYL{6U8o03j9Zc@i9ueX~ZA&H??u=8d z%eb@&UwqI1NQt-_1A{J_EO^bdxr!V#rJG2g&_)guHUSYQN#F9?dVg%{a({VW!;pDv z+hXnVy=i}WqVF=xa9L@rh?q$)#IZ6gf0(#k)0JG<<&rLah3tyMe>&LD}ie!HR z2*a5BU3`nIt*v5*Yw>KB_TQZG-|h6sc0O^leIqXqShv|*L?4#*cdu_j=4lsn2i-+E zTlA5foV>Q^U#sn(A@p6(hYu#I*OG!x6~qwrAMs#ejW>KWb8u4Ks1)IS z(zIUy_+~M?KtB^1=-`k!uF+>t52G{P9qsu8s?DDUIYw;SoKrQ|1j{3;JCu1J>B;FS z+cxR74GLJK7lHfuc2Z`0Y!K7UB|Cxc^i#pd1>^y zau`jw{&H1m9Gq~TCdie)vNF1bl==ZtNx|j*Br+0=Nb4lGu-ZQ4^Nt6Xy9zo)lK$nm z_KO%4D+_GWQkgmkg}%UO@llt9-U7IO;kf_)S55K6Py$S&qhmzNv%l90zO3qMM_B(5wRyXceA2!F2YZZe}F9RZe}s2tU$=9LVOz5^gxlF&V_YH96oN$-H^z7|$(q z1!GoX?f;@5`+vc_vJ+tJ1s;Ul=QLYG%-tKR%#zC8u#zwT^$1 zJvFYdz?!sFf^Pl}bj4Ci;JQrWVqe<(`A$TcLx$Rdl;_<7gykd~f9o6Hb22CaER*#b zQBTcSqp;U-iV{w2trM%T>O#IWI^~m;<5+V>17Fb5CNd4p0d{-GC)Y3wr>w!E>Us+e zUNZ0cYMx1bHE4wYoZPB_3-RoN!%zuSND*UZJ}13D)+t zXm5g!E`)Wn9fh~vTsidfKqwYAMvQ4iPKzN?LK}?L_{p=uR^>zJo;Kp$ccSYmeAz3P z-dPqLtAEcT;C@EDwTDTW2)q z3weWz=Z{WsgTQCE^MTA_!!kGGtC7D~7ve~9ouqnitY6lC1ql@tMUuoo#=cJtM0@Cw zoIzSuF>_XZZdzZ{NxzD{6 zg@90XnU5CwReP1fXy~0n#dvYFiI+Hs=$uP-4S0eo00?u?AZMa^NV)|Y`ODNm>V<`+ zaHpE#GxK8d)z~iqI;xGOhF7tjyQXp-)s{N#mM_&F)yn&i+KZ)S)78&SqJKi1Y(U9!G^FQE@v!5OSQLdi-GzE}FXljVk%O<3u7o#2cV#Or#h)EE znrwV3x>E-PJ&S`oLR>Uhn^fxz`}JtbfxlgPeB)Tx%M2~hzhPw_a*p!`{c`;PWq3(_ zrldVFkB`lpZ(hQ)W^dy@dBnKYY8ibSa#&Crc0VZ18n&Ctmn#gZA#b`mV3~fPy2nwJ zJEUFsOQKm-_h5Ry(w=AU*>H_6n&hZd5La$DewOw*SYcX9wj#qgco^_`9%9TA2DUN# zY^43b0mI}EaRHsxiz}HGeQ>w^3)fr%STSmt9B8~SZ$@y2E4x@S3!1QsC5;~xgSH5> zkmssVUF$M-Z$jT0qJO}6OKH}lh9n`&Jpd`@=Pwz0&L*{k7c#>*6xW=W0!9!SAN~> z*518x`auELdC-2OU-#FiSFYD_@Q?3rV{tP3b9|{?@@dtye(ty)CK4(}i9(p{q0`IQ zGYW~lkqaCTj8F=h+XgDYpBH1@eP+1$Wyu#ux>4Js&@V75dKCUZ<0ankXSv*4rW;ox z$6HqtLjz0Gq-g>S9ys5@giGC%ag|*TIG;4)L;bOA=MZ4hV%M01!@gv`Ge}AWS0bm| znB^Aars}yL?B+S{#3sOy5qPvXZeX*0)8bovxAn%8%TFJwW8EQy6U+z|&jNX!T91qm zJd}8t5R8;h(~Z?5U>rg4b_}5RhO^sj`wm#~TybhBxlF;LQl-GT57CeQjipe+VxuZ< zmkdbngmg?OpHIBJIR;{D9jdL~v#o2^fg~cI_*!Fnj{aYoxU4QQQp925XViYKSEelI9l2V0MjpW8$IP_f26o{ zHMn$Vtc#2G&_2?6?$}1?yaj;$!s+JMM3UB4Uaap}BjWkC*lT%h28`hbY}56QJs+Wt zt3SQMGkts@RNeT*`pKss$VOuMkdUMfDt_M#wBUm6hzlWrZ^%!wB6sP6pdZ}PW&F6@ zufxY%wE|v`vsKPd4lT0LKK*rj zVOr@j9~5Z>4B(Ic)|Q{!bg+dOxV&fZRXQT^Pb{|Z9cef*iwT~=ceZ>yj&MxYzlGNP zaj*t{dTI&Txm5Z%=J6zp-aJe?DU%Op$A=GzlzdqBQC4b5B8Wd$+f)!DF>Cr@ItCSA zLG%O1!dB8{JdnE z+Xq|XQ?@vn^X}0pu0;sJy6li)Kpbu*w0Yu4t%T-Cf>rbZTx=x^m8y!t6iZ0rIf%S| zZ=}bX7~YrY$jl=Kl-P#DR{pI&)RpzeJh$ckhZbieHC{r=BTS1f0%M3rA(RF6{GIB^ zO(la4K4z?+C(i<9=zN8j_Tkuvy8FPcbdn24vME=7&Wij5>5FMSf zPvP>S6=kN9SsV*CUG93nlaf9y)-IVKKBHGSEfc*0;)3oZNEH}YP^27Y&_oP{%B$v_ z?BzeU+O^t!m7a9&BJo$8EttPpxKQkPQ5dOd5(X2d&^j?ceAQr-O0p+tW-_y zILmC=woKnb1<$VE*z#B%S>v4u6F2csI-1hlRL^C@9m9p>x_0DVCHS*XF?YaU-wArV zchG&le6Ug9%Q`Un)@Y5Y0JB1ExRoMjH zOXUQhH{FN>BTkl2|111`dR3G^@0mdZBDhFMbN}`Gpma71t(36w6*wUcd1Klt%9*E#=}Oe+30W#a z#gevIkSX-sR#>6780|;9^Sym*Q24EF zs_TYHh`@MBwj2WQy5*A3Uv>z8lfJ^^SfkK}hHx;wOZTq7-qVaT;LK`S*C3(E6{@K# zR;NIE!HiQhYoB;I!Ld{~ts=xcl@S(QY$C*}M+wQ7G<6lBT|C$-Zod;Z1%n22TM*Bl zZ+Je;sYo9Y(V$5g)9dn-pO~Rr#x-`2XrXdiGwxj2kpkBdQogfGxG9x^MP##dh#J55 zQ&lH^h9b*%+UOL%##hZAALKF3HIIiqp;hR71q!*Hp$jIgqewxYV&S(3#@&ta(TDNZIgMlVsV@W*Z zDs^C|U#K0WtXG;YW?%rJGM`zZ_Q|ObZV?N{so{)jhPCQ z?->U9)2DEu)ew#(V>y6E(soQ&V;j1dMuWZ5Z#_Wu=Y~M=Fc-?IKIdN%dBxK;3<38W z^58to3l>iEhcVVb)vsI0*9XC5)>Yybgby2qN}UkZvb|ucGai*WHY3f|N}G^t@(u{p zzi1^OOn>I~MN=d>wPsD%y$rI z$0&_&(n{`4;cpWy;TeTg!0E#Ja0aH$WMlpc`C>+D#UE%3+aZ&$nu(&qy*h&s-u{I8~WQ?$qsJP+?PY`mqfFv@tQdAZSx7UAgRjCwttATG{x; z#zH!DXUwYhX0l3CGc+?{=+M+!QsaK)PCEDcnY!Plz3iaEe4nqfT+vXG$?6(ZH+85j zUWPJv0zFGZ?R!tp=DS+od5+Mg*m$E&OKXuui+k67V2s1yOyIy-!hb%y!c_{aHu)s% zteXud=PZb|OL#nTddapG;W#jjMgUyJUzax~#QJbYK`ps;3VpvLCCR>zW*i1{NKpS5 zSGqx=HY%pcYps8{4+YQUHE*ER$M&`B4-O%e>)3JP->AynF^R(lT%4nV4*54zFup_; zpB6adBJzB8JEYb{p*IWI7D~VQB21x#7}>tQK?W^N91zV%9@8eHLt$YItsj-Bp#uH@ z*UTY$iI+$qZ}`eV=pwsH#|+o|*bBTZ&1<=yVQ%hZvRKC3&fZWxCQ&dZ@RnXmo(Kgt zuX>oyn6dsNNs^%YHy=nW=-|tfg(il1#KeX&in?rhi_LHi?Sh3+EH1uea%Be47SZwN zieI9|fcP>Usnj7FYF?;yOuTow@)|q5n)9q4@Ae9ON+Eu#iOMUtlBqi?wF>5?E~`YA zy$c5CsYmOKQD@LAST3=%W`wqD#tZ#bgIc7KGC^*?f@C*gqjiDz|nTd;>OyV4lBj3;_tCSp&> zH%5(|-&w$~KOFIusdhWY{t(}khPHp%(~M1F@Ar2)Su?o+y#>5wH$+@+SyrroqxThA zgWQ%Jsd6y0TpQtfrPny-6FTOF(5KXq9M9y)1@=y3GrGZ}sf=S)e}_85lfquv9eg8w5wx)oWx_$=Il4YYq%l3q9c>Nkt9tJ zha<^|i3XEyFdMpabOj=F*(3sV8@s&`zO;p*o^|KaN3z2fR~w#h{DggL*VN1rlvjh& zRxoGMhZ7!^8hB|LiLq1>mb>LvvFx|_96aD!J2t`Sbu;K|?Iqg8Z3u;}B$-hzs4A_WgB^cqxG#Lw`b4hB;Jt;iVD72LDTKqIdY z}<+Qs{NV_0#CzlvAKay)&gLm#R>xJg0|~$X+~E;QM7C z0N%?jEN-x$?V2gC*VS)Oht;76XD;FJW3tQ#5RVBsCP$})S+0gYd7`D2;HY~&;gx&@ zI^d#DaKCfJXk`PoH`LF@W?EZ1W@t@0ACD5SSM1_;TqtmX9q$TjC46S`Cy<&<8?_th zKPeW1=a19Ak_{aTY8pS1p>4-RYBRmw=0r?b%G#7w+zq^mgHP6<`Fa$EhFqGm;;+(@ zB)Z$!O8qBAH+nm*Ag$F#WsFgpze>kzleA2Sl{o3yZa=#t6aQeAU!KU)^E=e4j$V&#AUzTDNt8qM-@?AX=}iC~Wmo_eG*P6_AaszwXUXcVlg%BSSV9fS)FgEBt=r#B8(U zNAChXlZzElkHX=9f2X$e5RZGLcffj5wrkXOygnbcp04awdE*{E+53E9 zA3Yfn@eFk2cg0fbN>$!Gk3rxMIa`n24H%iIi_V9;nN6_UsC%H;mk)t)OLSLUC7!o} z$6hJ;iwKW{k*?;p8jWWWIrckqWe$_|*3=uim79Zr=rjr-@2kGB^t2T`mDybxCJ=)0 z;DIsufusBYmJsiYEtmdD2qG!E0NKA-ekdYnV_pnHUPrsIK^<6a=!4}+%S#hgaSd*r zr6*xW5-f*G2SwcI$HkH?`n$_=J$72H_y86v%_a8SZOFk~Q!Q7yMObtJ?3Y1)B7AdE zO)>*KO!(i@)4+5km&~VhTu@_F_OFO1taCv1O#t-edCB#kLes zenbkgiRAmlH`e+0EySHadv5A({8p#YC9!96#>o7a_5JJUHdT$>0c? z980W~p$y85b8xUpq!_BtO()|LX3EsPhm?@$uGMIiVvQ`}=S7t!>Bo;M>6<^5)-hoa zDY8?YgPvDluvGMrHl@D3t2PvJ3?vdbyDcJ^YXz02%B&?G-2aFtG{CXGDJjpA++VE| zEF0u77?p!!>SU+@%WK)l6fS<88vEITjl$5(NY3H*PEJ?D*;7p|F<;|xl0vwhwh#_P zOjSPa#AMa+lj+Y4MXnG>>Mc?qaQDFt35ZT!Fu8GsbC9|awroZo3&l+0xVSisp>ns{~Da(%5HK6G(z)3PaGeJ|wsT2K<~=VCatEG5C~!at4% zQrxIqp5YFrqvG;Fo&@S2KPfnv(`dQL)i-5N%11Cqizp@cc1e490BB_~=2$%0mCui!7D9A|6@^tcViFi%^ClgGgvqmj_7 z-+}u1XE{)1KGF?<10`w_OBPA;6J%%7G_?;&hyKFF_;0EHI_GsKtQW~xgw_5q1enQa z@2tlTQ$J@@G!GO?uhBTSY^*MEBd2TuKC>Pnq_|e=NZ2vJrGTQ)ZcAz+k-KJTTmoO| z4;7yS< z?0X>?`?YfT6cW*h@UjY&xU`n2eZej% zi-EM{l~f&I+(_DXM$+=-@{lYAV7wDNP7Q9ef%DpDk|1eYS~(~H3}HQz?zwL0Ond!# z>TqW@E7r%nu`{%vizebFJMYgcr(BU-^a8XGqGd$=SdhQVLy?U>mW};sM78gr*L$JG zW5)xQAp|##U1MOLt<2337r`zeg#bf zHFF3ihoW!C1lF+(VdOna@K_;9hXrC5Aq#GVXx#fp7DN^i`y{i=BQ>DFfaB%YmAyQZ zn6%{ri(e)^dZ}ROhLxkq0=EJaj)RD$V45F;R4@-Pu?B^?YuZ?%WJME7UW3x)0q;Ki z_vsh)d*Gn__v=Gw#uS-b#p-ja#~`w2sDl_jsAe|*93RWti8_Hzz`CZnm#?G7!gts$ z@5JTNRvUbyy7Y3J#zbG{6$+$P<|U_*s>1iEDy{GWqC%yIqI}>PCtLbJsclgagZD?8 zDm5{vyi8cNfPQRH@+2Q4Pntb;2BQJ~W_Cf7z=`#sE>a_{B!Dh?6cxEnY=IA}s@U6~ zs-X(%&*S$g=9{8@!Bdi&vL}qJMjhyZJhczSnEv}XBee*vu2l&tKi~78XN6(3fhu{` zcOV&scSQ#3Pc)*dOvIPtJQ&@XK#T5Xv)>fxkf{Keo`%5TIz<_A?I^G^&Ol7_sKuf9 zYWNtH-LzDFA&|v!A6ETeO`hpViiE`FD7|~kMe!Ply@xVKl%M|ix-{3YSAP(h@7y?i z;c4Meg$ep?#p?4XPr7mB#AD$^g66E)DoMb|IC4;633_^7p=m_~tD}(jwS!SD<@tOs zQ{F8`knmDCL%jeR+~<=9zEBZV2)-;N_KTt>GSI!0#G;zeC-mpcicqmT?PzA}PxFBm z0Fa<<&EE{;3+hJc^49&eQfE*qale$C%gKH@z~{;SBxhubZ53hvaVf2wPR+3~H<_c7 z`8$!2zLJYo0@MX*luSOh0%O53752}AB-0Wtu_CPB+$xW{LKbA2K~C zGOKxTswKM+Bk^_bY4hw1%zC~!EZr5-iD_KnqEn!BmAd(6vO95&Uk!|zA7M!>rhE}s z#~2g;llgKcAiqIp{NC8{#qHXj=lS^-34#EDbAtn4|6L=7A^He)$T576bHH$lGCBmw zcOnF72qk1Mtj{;=yQ=BEQQvVZx8qTLF5^(;$i~B+g8w|r!ox*?jD`Rk0{y)Q+~Ye7 z++z{QAWfe0iA}!5WVke1N9#ly;~tc~4{Pru@Kd(SgU3GrIwI zO7s6$_wB*=q^@C&u^tGjkgRlECze~1BZ4Xz?r|a~iwJ(Uq|>>nG&lXrT+^nH{Ssh40t;!((fll^*!lI}of(R%|P(dqH!u ztC7g7BJp>%AX~@j3+3&zCD@!d-rYAg?4fL=*eI=$r?KAq_*bZg135=9zT*qvuALHi zQYM;!iz&WMz~w#dwV3?2u3o#_pjqh0NX{)W_S5@tJ&t!QVW!st1JF(Cwd&SU&22S! z8Sk8YeV73O`faudHankVVN|u5k8l3GCL*WdT-2cVe7~nRO854F?wo`Y@t-43vfSjB zC9Xp=-|2ivtyG*0CVlD+etIr_m7OiuTfv5Exa@4LqYU93HRKkYa>>o5E94*^HIc@I z(#|)EnTebc%#26jZ2$PwDR)8beCv2!NnSniVGFDUj@i|v=6APV$X?--wj)Th?|U1R zcgmam@dlD?TAb}s_4Q2(uLz@mz2xJjrnZp^;sNwEep&!R(xH;*FySSWUoJ&0_ag2o zTMM(0ITXGyvfNAEmz4|XrCvo;a+1-9;SEwa{N^O5Bn267L8gdyUQ#cYsXNq!oj~I$ zD_+stZ~W9Xaob4T5iZHwwtvZOlikvfK|?);PQGy9`zf0*!lBp!m<0Y@N~==pOS<`o z{3Lu8TVF^a#LO2H(kSUyUy^-#4E!o61N@)n_tSUvDG0|lSF;Gyek$5)RPxoLc1cZ} z`I?Nl!mvkeaz{OI^T~e@R1YsF{~dYzaT~nJ%r1?c$l{(Lpi7Xk z_j{;|Bd4VszRk+-_SX5~G%z-D*fz3WJFXtJYES!!yo&yrrGaOMH~KnRth8);RSO@e ziX$&Pi}nChM&qTVf2Oimt8PBx*2Q4JQY9~Z%crLnD*@+U*s~_)hTJ$7e>Hz_P>(<|fcZQH*E%!&f_%dYMg|_=W$HyG8 zN8Jn-j9YklwBF9}Q=On{f_#s&b@#!i2gRC*Frw7PJJzL7Sisjudn-3Z<5%m6(Mh>c zwOErk>z9xZqqql+M==V@u}P0R;&NHra%gRcgMvyA2|;9_(hG_$PuF!N`kc@HMphTjEWV zj#FyLT^yVK>Ky(PD)dCC&ad#7yrg5oi))qKyOR~_)V4^N8N=Onf za(WX{f=OE5$Ku(uf88UR)UGfPJZi`I`RII10Im7f#(-0hG`9yD3iJtO;t>+F=k%K) zB4jZM^4aUMo0XuZ73@}mBj-jbDgjSksko06E&Wo6c&B@2uovsK&(60ESh}59_RGR% zb@w>Wqhn>3vhj2SP-PRiF!i*WGL!M*qpFA+H;r)P1V|O#7~+NzDo*O4(iC!=!KNBE zO*N&yyTbM_YP?jwSp}>u1kJDzq0Oc>9*ubO79sr+XdnxJ(dlTkZZkkK>97$XP`9iq zMdD}u!|eKH9B(ntHF zqrcvGsFXXJX|Lo}4_UD;QS`#nG$IYk82M)hu_z|)OdpP$Izcm1;8^NDr~d49?hCnW z22iW%@{Q>u$rgBY);|WF^e3T{7XuG%7G4YxMnI{N5_V_rmn@aFBIDwx(OuuWmJ>hj zTK&JdeY!15+P$$v=NJBiIgC5&>koyTmkxe z?gs($_g$EX?GdpoWn$LNE)0VlTrnKu3@-#2=bMZ|8E zKx@eMotiCHHo3`L?loC6m*|NA1gZ_ULn3Y(lWE1E%$h8AKS5nJuN_#PD$sVvo-2^w z`dS`Y8mXK$lIj^un*QUIi-_BV7&HjWRk42Tx}ceBcI-kvJA9Hk%vrJ)Y0{`mqR+p< zv{g>i^;cZ4>$O(d6nuuXSGG>GqS3G~QB-N^b!8yVa5Q)6?V?|XG&~R%HoD?mX0CVT z&ERkY?S|l&u)JhLgFAy_5f{mZyXi5F5M5{J)Thy76l~l5!meXt?!VEfxh^GA27V|^s3qgwJcve;xlq$Mb6e&va zuO~jJQxpg{2}O%xfoexllbofjQ_#D-j20Q((L3b0XbM0?!pCG$C_Ob6!&{$QF`w*Mv4Uc0lkC_ zo}fX2;y~L&XsBaE+hgf_)}t;pJgO@7L&%p>mI0!kb*EJFnyOMVt|3s{=!|v0`AZR= zZ2MG`PJ{82ta!_8o&q+1)pc-9XP^YBwGMYDyyCEF9~{4fN9t3w>rt zjA}j^gOlUVIblTe)ONz7$nybd3$NJh$psOSwKBw z{fTLRlqmOgrBrBr`Zf2(F`u~&7R3y2S#K&-$gQ-W$1PL1g48NSVDT-8NnAC3`9X} z1GiEt)Zl{VYgH%-SyYOfKInP#Lr6UqM4XMgbs)$dWZxjKLJ^7FveLV1{<+-v3cU9- z6vSjz1$;m&SZ6xZNU5*-E5gJLOU$du`PaUZx%jKi%A9jrbB;|B`x$X-+ezQ5h?l+p^z}YfO*Vtx(cKx7RD?=D(6;3=+Mk z>{~u=j_%p8aTx3qhp%@;mlQD3wcEcs9Op^IF5M+%9EJxcbA%GkeevH-=Se=4%;NRi z$VM`#!1vbFY5@;+;t@^u>)cRYf1tu1RN$}Gl7WGYK8wzEG*3t0uk4w74_~$nHOy|` zhg=M!VCHz1X zK$PW+(y%y1N&R}zs%d~wDen0DGC%E-*cs(~1EhHJ(!WGSRFQznG8IZ4tHqk z6il5UE*{HAcYS`XrwpCIK0{35>o~pTSXSw0SYa<&FW_$J-VGo5>>Sg6-^XCu)?o-q z+h}Hw?&BhF&o6SvV`GHEwi++m0);<7?LNu5cJZI5}-Ph8mBFnRYoJr(Y{c<(IFu8Q z{gm|k<*k+qgEF~)Hs$TvF1613Sqr+$^g9CMXUD|!35Qv{9Vt}o0_PV%c(xVQK#7JH z$~@3ms8bR$Z^YSIv-J>R2QQ#6RuKL+vV_6_76BU=DuK>gW)ZB3c%i3v#}SH!hnz^J7`N{Tt$#FO}Qp)};tAZ=*s*@w4MDDQsm6tsDSRIztXuZe5f+s-eGIMkV#D`lKvkY^f|&aF^8@V-mI3!WxHa!WDa| za!b^UYE%r#?a<&1;v+XBW@zLh#x6RFMkd(^#~uHO(Rrch_rt7bWeHzutO~NFO(A!P zt!TY*r0R<&W5L=Q?$)vRz{)|XECp+0(J>J)WG4m7{R^J7mMV|)Hyx-HKviEPu~LQk z_hTM#5g`z6U7o4O6Yr?=!=d25+9Ea?jQq_dYYeoJD|-bH<=`@a?To(%RD3EU5t=R^ zUQQ|=ry!1tbv*ntgmJpm`mR}J$Uf@EQt-8T@LB5gyKP_37h@T@M?tWJDTZ=GKQ7Eu z$rufLzsx!aZVRfm<;~d&jJM(Uc!#@o*E<&16Ak;Q&R-`)_wn`eJ`UfK|MfLAMT7q_ z?n9c@H@b6d>T=%`H|rb4$05dF_q}u)?w-rO?={`P9=n0xV{FCjVNKsSZM%Ux;U0W9 z?P0#?tzf>sO{3heK<3=aO(>c(NKvEvtag^kq8|Q8C_;lF3k)Ys|v7Ge`#&<`69_j|XAW@c|E3uw-tauby=b;$X z(-Sllf1Gop$d$y;}<;*JK8`SoFsfgN3vrkai`f)IBScT_`#w4OzOg)D#y)i=J7FLzItTHqb zAmBk*;-C*lX-iDV@OVR4Jc(NqphPAC;SUOVl>zNU<pOH*{d}wifT?(8uzafJr(t^iH&!u*^G&Zm^o+4`2C}LA? zz75^!Jm@(lwck0cnufsBs*_ZynU(X(SGRv)I`({EHQr&IYq# zJv+lx*I`%Y1f{8ap>%ZOS#+3iTARoFO`J3cVZJA5;5W%w(;S zTLVPPqYj{$VaCmrLs^(j6*xDdFu~3Id*9Rh2w_AD#)O|1!-L29{b3)+Gp!99x*=%I zdz|F|d82SSL*>G#$rp1??P-$BPcppv_p2trRNQi`EX{KwWhkWbNkMj*-LRU7cOR?# zcCs77onv1*=jYthk54_%twm}HoBWr}?$3}rqj}&$OQEOfPOR*n?rslLm$A2fcXLxU zJ#>xBO_w*Ow==aZF~z*$$OMfeBh|K2#GgCL@ruWi3aBD+MSE@)5Mne)yL% z2`(!wz_LI6nd`kgJ_1MM)I;fAg7dHNk%*?IXi+)TNPO})a1L|uSF5=?T*$d;vR6*WfjPwd z0(^KV9BN-TnjOcGu~v>d?xc_@3gZvm7Z^2$V#gmskZPf~Rst;`F(3BZ&_DY*?0)pa zQw^dTXt~j?j7ER&;-8%1g-Z+_@N#LIa-QQt%uAM~)A%qtzZ`iIu_f5H_HNPFgS-=!on=fkVk1Bf9r~D@DRX=q~D} zlpX7}^YQl@EPzYyI8ZZoC)$ra5qT%Z6vyU34PdZx;oPdzlfyO$jaEO-P z9$pRrk!EUh`rt>pz6AIxTVS#KO$lc9^Yt%M7^ByX>4dWMh>;@jhj?nW8kO=K&HO<& zg6x~2NV?TKq zk$v0SJHdobM4;W3o`5#I zeRu=(y`SLFv<7a+_R^t_M8qheX(&Nn0=N)?Kiya~W%C+gB!mZm{kKO{z-9yZ1u7)o)PFRPT|ic$gBu!7BJQmjxy#qjJ<6`-U|8E~=bkdx z`W4o~)Tzseu|l74KEHmry^h?>D*fS3`ZQUGq$?}5@96=#yVn9wS*ku zpAwz75gDvZuvc)LUg*y5)s~2KL z89gmAMjVEP>~g^P$cUVg*K+V(1?)RtJ;VA<)*799A*xj7l3#I+hl zy7z&piI+m_v6o0hMac<;cQ98UDaacu@L>bXH9DZ_CQ5na-Q(y@qT)#=c4QsTA1Ppt z+^A>JX|&OO5I}VIsK`pBm)-dkSgO2ashb;rn;WNSS@-E(o5A;oSihLy%h>E(xtMUt$efxbGi_pDGk0&fZ^Sv|8Z4J(5N@&wBEBv_V^Y%ks zCsegaE0779+Z9~^t+#0YH9T+GC-U&ttnx5-F$q^AH16;Wt)+R2aH+Z=*W^iI)ZW?e z?|hWi9HFPezi~N)s052<`Iq}8X0)m_NB7p`quz6Op3i|P`;20?ZOt2u{QCIf)EB9$ zbhG8A)9@gYpObv@cmk`7u>a(P^q9e@u6d0~ym)ocTM{v~#Y8GdvF{QN4^XHnMNyQ-~QYnA4;Wd~Sd3C`8;K1+RBTkg~-)BtAql(tA)f~&N3J2hP3voW* zPjj}V+#HjRf-ksDaB)B?xJ@`)NI1nHcPSv{>j4bxB344%9jkyZ&9nj{!9_qCUYz)( zCi?Joj|GvPdb*&xjBvLTsU!Mj#Q|pG!hSE}Y-~P}pluO)fw%gDM!`FoQ)pbo>7K}T zgic_A-lYNLPleO6J4mz(Nikswmpc&i5nW`c8X9=DrKoWeH?8zi)I+)&a^^}XedWKw9$(Da`t1csAe`szU-n^V_}$ZY`gQ)S zkf#6phd?^Rvjul#N>Tf=hq|2oMNCzYXa=oxI)sp7Y-E-FwF!qkkmq zwfCB9)tpsx)-$VWt%p*l@Tn~}`4Xiuwzaz?qXATsY5z-<9(SuWj8jxjS)#DFjtp;H zY_#AN_EF|lb6JC*oPen=7&HW7s#H(PA`$Sfi*L)f#vA*ZmB+iMk7wP&rp$WHp!2*oc{K<(jUaZ;xF z&E~kh|3w^7t}=`8ZuC0EEsC%FJ=4XW$x~h@mKVn|O*gq6M=Hq(y@Q*^A>^K)zc^@X z-1J=TZyA5~*asBzJ9P({pR5uy%4zPoi7XM>lqWY!34Gd=O-5|*t!`Ac@;W5dTAF-M zJMeb2FKEZ{+M0wqxsC13nf@Zl9gf4@{X0&KhPMtam=aXxWx6nH%ZQFLq9e#DaJ1)_ zXvso03C_lHpFWde6T)uR*5?cI`hOiGuC0fSYkcAt7;2P?{$!J&HU*gRhg5V0R z$N3C-&E+XCFa)7N$OpwP(2Uq+qosciQ3S}yzOsF0tlIqc>FBQn0263`ZkA%BV%Zw@J=k5&^wX$%ni-~ zO9Cp0bx(5#`w52Rnc(FoM{r;Xzrw9VL`LB)9fe=OZI?y`5iRv#kW!%D<1fa@qs(fq z3RVwVC*h0)F{2KC3Ey$A9Cg)PHa`@pYcR*b(J|<9J#|@DYo|C%5{)J#)l5dBk9#e* zyx2!a7Vpesdh;zJd8a$Oyi1EKwxd8#BmJ%Orq?FJmHam^(~r*@kGQU7Ym~+bT;ttB zQrqA6$f6!2Pk+N&mdJhIFMDbyEZi5zIzDdtyR1Fh7D+cRO^ zwpQpdP+Uze4rs~SpQKF3+^*B6BV@sE%z2AaU#;-y$p>;q%+b8-+MR=W&Z}J3sBA-WXe8U3d9xUe5k`WtM88-SguJ zSlcYLtT%Yz&nY*%$@Z#@#we2qn^3#B#^HllSv$cQ9l?oSbanRj(8zQ6RUz)=G?O*n zQfRQkeifyp;c>&&ll1_L@MAagbyx~!am0kH2sc{TW68cvH#b8Wp!YOMj5D=eF$&`YyJPrqg<{skl-0zRp!I%=M}41|>+K{$iSWNU3| zCrhCljHc<>Go%)sh!bTL0C_;{yn8i6!Zuv237xqF<|~GB6TdnPy3jPjYdeq+mHPH( zA$fnIELgpao7>H6SJ^Jim(95%Fj`+S7roJ6yx-q!W+}f)YJ$@-dN@7REn%VwtP)6m z&J%Ku5kd5%Q{Dk?YJ`EQdVA4E%mJUMsMKTcxS%EB(lake2@Yu0p>7;K)2{#YV=GSQ z$)r*t!Ut)*rskIw#tR)ByWi7YY@=LXg}WFt`b7v`*np?#w)y2O$Dh8Sp89@9z!un$ z)CEB&OZzIJy&}D%;E=yyov>+NZdY;?gK-q2M*-R5WZ}+{tPNABseux{svw79+xB)w z&zouoLQ_DK6`UYB7#f_gTaoqRW|MhvNE1*E!7R)Kic&b*7AHTt+PU}_votq7ssr_B zf{4LD*jx`GV3Qdo_|7xQDsjD6oWvv?p`+R%4k3s_E5i8Ca@dLobT0$H;ZK#o6VX=7 z6(p7Fn9J>a2&hh2?r|xjg(Q3yt)l;gl3RJv3Zg4Qb7hm0SklB3$DG-CN3=G(Cj40r z3Fmh*A2%L!V_y~Fg><4dbGVQrb);JC$O&FKbKHwfe;{3`@Y95?(?OhEpHtFW3Ay+3 zAA(Y~Ll+Hw=62#*^O_l({#wFa4Jy~rwq=Vabu5Gy;t$q819sclSy2QI&Spe}wEQOmz?WXd)5)deG-m|AbTAWXVo%?Dvo z+vyo(-zk275~tV^325wHBdly^lMm|)f}PKvJb@;HXzJQtl19a=I==>#>%zuWsDFpc zpRM%ph#UNH$1o|ERHr>)opsHku!id4CFvHgok?={1-nqq=bD*yVdOk`YIIqQ(OkOn zPLiy(YkoWF&@}{cJktIIW2ShylLm+l-q-AaHnZE|PVYJ)QOS(4vEeVnrYSPw2{_=U zb-0DE)lm(|Y88NWI9ovl*L}Hw1uNkh6|3AGDqBgerQe5;-F4fSQcq8uN$0t z0+h$=9qVT9e^z*ckpA6!Nlt**9F0!9(Egt=ZA$2;Xr73`=*k!?}(Tu^}7uT7#mZ zTwlK|JSvM%DPj414W>BFJ%-=DX`BA{eH}C;A(+F1k!6cdu0;`u!!Kn*ly)FTB1X32 z@6k=<25sj+ZwW%=#*i-t)opyx40=ag=oEz0XO_#o9D?_<;CH%WitvUp zdgN^?uKbIA9D=Ll<{DtRIF7b28DqB~x9Tjr@2@ItPrDm^?&x)IbQL-|O-VQ8@wUh3 zWpHsWc{~rd*9Uj)KV&VTc-)djrFeh4_*mJM-yqeNe3razZn|-u{{3=pBt#qghzGN8 zI>nkHTS|XIiAu1ZKP9_6c2S~+LL-cPNF?2iHk=yEgwm4*BZY4eUBNQcfxT7x>x?&0 zj27}-6k4#w4#pzQQiVXi0Ppy0ZG;5yRmmpZjThxj{Ob%#S?Qf^Vhn<0PcQ?MOl1#; zIJnL#|2hQxMFoQTOv0V5maPQhmv`uUk8^07;gRgoHK}*Ve7KQ zAIHY4J39xw;6ONMfoiCU`aCK&{#;8M!3pG)M4vSXXKR7;vsPGSPLxoo6D!xAVPS8LAAIs%q|v6bsA0Ao-+6?4Pe6{f_${uXl#x|Ldx_JtL~JD`U5vMt z;r^GidGopyi|-4g51?8<<+n>dUscrI$;k>gpt@3H>_fjCnq+)G;o) zD`_`V~O&zVu4e9Tv8=jpSV66Nr6LwB1SYvjlM@BLo{_EohFw+fwDOt+Zy3xQDA(< zrhzZ*7KX6iI}V|WJEyL9&0n{8Vo*UQHcp15P;~g(qr0B^h*+$BMFG<(>x&L(0sPRs zOB*+G%( z;;cVq_Ux&Pjy%y^KB^)StuRuzwdNLRwilc(b`o%M4UJSP5Sw>}gPbZ$m@xM%#kj%t zi`%uD0Gl-BjuB6feBpGB{Jvh@2%TZ#B+Z*;v^FSOGzXTrR@DN>gJkE-`E>|hnW%|Z zmVMDi9pCGU_Qj03j}fS6!NM`XXq5AUpi?6jpDP!h8Xq&J8&*YT7=WSa(AET=s2IZ* zD%(YMc^#&vXuBviDvPrTaux3-EaKK0BUA8IeN+{C`-tysd1^uV%~k$>h`>q8G7gFj z1YhH-_4NGNPJ+x;Nf2ysTn8|A4Uyz3MD32+Jnf19gvJCVd_W~O-VFd297o5EFNv%& zPY%h#i<8MFEF?_H4kz;&$ySl>@}9+h_ZQ2<ZOAEb#9Qte`huy*tLRJ9ypS20o^D8!t`haI54O+{qpYpXqHO zR4RgGSgGv!K{pj|I?*UTGToP6lh9PTV0G%hPK!Q9ZVe5 zT+Vhc+iK>lKYtRIl8^}|={JsHu*1HMjysvIw05fhYJ6Gl(o0jm^N}KoQ2gNR(;S-$ zk8bW-ehD=@xLPr_b^&$5Iv-wG^63oVrT1>l)eXwf!5LktPk7sMVP%YzYL=_UE!w9! za+O)oL1jzX-QZXA*O|O@8f`~4R}^#Q)+JX>M&}ka9x(5AO*A`Ede(y$;>}VA;%Ikr z*7u!0uM7ASZND?Ja|&4DQ?O1x=0ieg+K6)TY~mGb$z6u+o38E@D6}1O3=ztIJ2hACLAt8SO>6)db0AqsN-N2 zZEfQ%^2)11VKfQnW0+!9$K$Z+Sh?K|G{&U}_kC$=s4wMM4<5c683Wg;>;K%+C(Fcsgsbln#}0n(V+*R&1-$$Nzk7oZ-uu!Q91#Mdk5U2CnQFvEkY3 z>_kQR2nC`2PJ;!CTm>y5j8++R)1;;8s?>!3K*qMFuYl+VWu?7@7STvAzyvY!EjhFu z59jfVExDSZG&y zl82qe-AGqtVKz~PMOjahV#(P}N}UJfO0$GC%g_6#aZtUJOY%(WM(i#^Rw@fH1F|3y zZS%YtArmEf5iETv0+ z|3vfEPJ6cXdx&yoEQv8MhIyeEL+RXa-?P~a90!Uz$5#m%I=aGvJlNr_9w*qD8)&yA zR#n)}bm@)e0QOuDCcn|C8k;!cI#ouTIprN`t(2x*NEyzj=elmR$b}!X+GM@p$=u}K z?Ko@}8g~F@AIhQHy^jgWPeL@5gWB<_Rr>&qd}N<&D(<7HL)v!Sw;s&A%KW@9|MO)N zN_pNDYvwA769XH{RhT_=Dv zp_1$X+VCwqRUz9#y-(5Y-2f!6z9X{48H9s(bqOJ+p|nx1Y&qEl(2o0++&q?0{#=2| znU|qQ0d3rHM;G7F28S^-yF`^2QXYTB{D*|9(8Gys6823WW5a>-Gf>lFjYI7^YN<_A+0Z} zb+BWF)r9_wcn2;ZnTB%lG(}hzb16mH=Y6VF6dPpGv>3j9)e#ix=p4n2%o-03iqdB( zdoXg`x7T8N)?zEmgt(n~PMgbVuZgP~l*${Pc~@ULnfI-4b!r!s!U9afx&%L#p~d9Q zMs&Zt+T;W{`d03-!AHUiyT&sPlC(-1;^v3lfCYNkAi#4$-jBW&XQ6A)dq(PyunRyZ zMlLB6P`UZMSr=_4vf1Dq9nV3mCSBV{w@GE1%rC|5CdLaVI!7KI?r72^brzX}K(Q?^ z48e`q=ZZTHhl?lxoOEsCH=_<**XP7YI?d_J?tVE*2jo?NK+o>hgLgI>n}U`L3vP>& z4n960JsIL&2?Up9LWPE)8x(Ltb8@ltK!tB;-JtNVvS9I-jyzBXhUu(K6S2Ka%md_A zif{yuDuZq0$~|8#&|u=a!i;eOgEs?rH}hpHVT9i250%qy0{C&hg|>I+9Jb6$)?{8! z%~?PW5GF<<%m9-sMirs!5@R=j(}H|l$*dQJ53NcmF- z1>62Gy7aBxc5&P85np@TnZ6}8SB}IO8Ry!uy%xTdMOIft0DI!Yj#>sK^qrXV7L6wcrv6d|7*eOb#KaJ4QYD7YAam~YP-EA2m_ zypo-Uv5A`h3Cw6hoIOD|P6rO976P2C^b0EH*TgTc;W2|;FKL8?*>}}#qBBJ1bT~dT zz4owi4FNiZ1`g$D z`%Oh<6%pctEc+_F!qOy0SqPZg#>!Lis)AW>1+aN&rP$YjIB;NBu|1!lnglWAI9h$b zL^goY!YcM|RhB7;_veNsDukFtZ9!qWNoC+98sthf;giFV#_N=Fj}K$Vw4e^1eZgUz zyw^m`(Df{4$3uvFHaS2Vk>FIh=@DQOR#!YU%dd?&EXh(3^a4@%omDOq=4&(Wz~-ln zmbS~);KRKy*U|X}x{9G4$K&*$_?nIIh&_i`!ak+=085ma8!1GS+p_r<4B5t>T*m~= zKPDX#Cg~$(doHy*DWK{2?PtuA$Xq$(i%gQ&h!8KL!6)ejF;kWUjVL>~!RygbjKd;G z_nyHXX1#^68(QUvbtoQU8c@(_!NM`3NGole#%2j(Hl)zA+0T^_S2Bp7*ospWVZ7J3 zF4M=0GUIcO9|;>9$yuWjwNdf%2pGvh5TLeQbGv7+>msuxO@WB9$JKfENguPVe+Da5 z3ZFnuh542%AgCpwz!jTL?Hg-z<)D|0H;pA~kZBrpT$69A5r=HjoxULXO!Axt*q)j^ z((_t#e6Xk46~`yVV3bu(w z1~mX+o1=7qYIrI%o+*LP&J6itscxCApM>m50nhISroy*!kVE~AIJ=+CxTJ69zCjmC z9MKqSbE5-4``iQIF3v~LDv>5az&s{RMlq>$;{k{v>zz2nnrlSt$~aW)C?Fvl3Y?Ha zLqm-SH;j&m2wy=H2*4zW-=MVCK)79gWK@G6GY-)=)z6}<9!C}G0h64XmVgA0TdB#w z&=VP3L3$S@+!3~vHw1*BcJ}LFU^R=+Q+tALOl%qjs@67fBIRTh(t+5Hz}MJLI?J`A zT&QM-MH?qIBYsLWxeD_p02LhcE*s0lrtn#9H=cfDAQBWDfda0S2}=*L=#7S;7sjA8RESyP0-|p#_HImB zHgNJYgvS{T+96V~iL~+;;l)vbQ(!{wDDym2%y7a{I6uVX6ZCPT#1D`SqxTjY1arsw z7tfmM2fPICwy;QtqM1%FSju0_FxVm?r41rrSq{-+HuX&#%I!NJX*wJfPHd)*&YGPOx z#F&k*OSf5zeIMmUV4UP@^qvx}9HWr1;2pG#%RWvCn#=xLSj1b=otLIy#X=X^IH$Xg zyEOWhm@_E{AcCI~A3^jr;aN2g^SIBwI{Vk?Iv?2e-jBg3HXi5W(35AM*f{oQk2m1X zN`gv!?pDq;YE5)#_&Kx2U!U8?_z?wZ8s1%A8t0!2c%IMZ<=wx;C1%}T7K2h+wv6&> z*Wdq+ZIbzXIS!b`p4{EvaC06f>v{%ZXxyt^@B3w^8};gX@)9b4c|VdLFOd7i?{qV z>h!tLN>awU!NlVd`Feg|!Q;!PjI8s#IqNR%T((=GC)uS*luc#%sL-WCoV{vhN^`MJ6@~vg#w}bCXo_d71C38dt^&& zL_&!FrNAOAQ{XZ5Z4Z))^^9Z7NStHx^l@D;xNbvK;BrAkhVm_PcI8d>^1xYT^?1KL z_uH)xUia2UcU6gZnZkEqVV5pBTSCb8t=g@ZJE1_{`?{+LRQs>D@xB|xob}GBY9_uJ z8Q)KwYE`R!sIDkkhez$?FyHN@kf1OZ`Let_$aC(w7^R`am(JL)OV6RTmbc#3%jnhV7+qNSCOf)wNim=PxEBkVynu z@|d{>#di|1Y>*8Si`iII;ZrZD8Ex`0JQ_n+*}{NRS7^6>Z%CC5P;nIwNlDC~KrcuL z21N=aWeH?v6z7m4M?*)V(!3-H@xg?~O0AMX4yf({&ZbJLOR_=hXZv#-_IKkNxtLJF z%sLT)C&yPq_k_6Y!Ds3O55h0vf~gAErSP^Qq2BWN69o{5!3%S5ay#6Xm%EKEKK!s7DDD})Ole?jXo=%Xuo5?$TvRs{P4Gb9Gsx{{bJ<%RA@sy`s0>MUw!wP2Pu_8~>gZA|% zGZoq(dcGQ*+{q&Aq`W3EO(S!&<1l1i1|K^_iPX~_t^dfDyVJJkLg7;R5#|1L~CY~%W$ZC{Vhc8ev4KX*2nf^ z+Wzc#j6kM%p^Jst$2VDI>pDW)YJ9xG&H8Z{Rr$9QcaQ>}Qax%8;GIqH%8XIGzwKq* z#GST_YD;%g7|PHbR(jTj<&&J=JS#vL`OB17t3t1^hMwypq6m&OZ@XwQT zHHPQmH@~IK@sn4U@~|m_$$)aWh@41bK$= zdI4r6%V$b%ncC9Q#GJDKYrRL78OCj9RyHvra?wWt(-QXdB*}!-h;9Ia8Q)zW9plEr zJ@hq$9WGHp) zi@QcgXl$b8jaQ`&f^7;srsqoNKlugHmXXC^qVUX4& zJRJ;9nSS8Bl%7U~E!U^(eSasEiV;F3KSIn7`D1pZn1~D#ypZDvd<3t?IvlcZy^Zz3 zQ8-#8e#>5FJ@Gq!hkbbOL+DRBs`Zh4+|FMURgW`!A=Pa@3z# zXpCPCwhSCyfCVkDO)PYODDj-R88`<>KMClgPYaRx?!9o6%;}VZ zk6Ry_w`Q1vLgcguC5Kj{Zfv0{gExj-dKZfzAdPdtbZ0!e&M&#_W8o}!RbAD#@x(zZ zOLu|G{6y{;_aY0q&lUKzS~R)b3JQY;iiq5Y3m#_NaE&p=9zXaM8{*el2aD;xQwH{o zspQG;9w@6CPvn&2doU%C648RVBdL~4rZkJU09r*?T=?%UIghE{ePp0Pz&Gw|)JhX- z-0?iiLcXbFp6ALKXwv$K%btGwT1>4!Z=M|;b}`5{WU;5D*4-RV?{eK!!yomsJl6AN z>Q_KL zAXXE4L48N#$1?e;*1wVu!~@yHS*(tmWh!8 zM2KT2ZftI9<^*780@4e(m_7;yVC7%{G26KPIACIBXL`J=+HYqvFwm?2){2Rh0mM{d zY^@4v@_3HmBP9wgD?2mb;RXOk4i1ioYlDbU9)<`+S7OZc(Cr5f6A&-U9~3wboGyRr z_TOoV=@%`D{-mWJ{r->j1dj8rfgcLQWX14EY4wW~ z|MILa0gR7xM;q|dZ2#GX{_G!rmgRSeg(N@)IW|rYK9%VQ>(yh2Kwm4{ib)8|=-bi% zE-k&V8ptPstRD2ElDi|wk36ud0T_Stp1->ut3?9V)8x#Dw|NqaJ z;Nv3tv+^H_&VKLm?`o7bx3L6`nxWH600)qc4a9rK1f&D9vjW&yS?NIRZmcYH%|*|}O7#mD+ppLX^SM^^)2=3tR3lpn7)Id*`I9vXD9G~NuFP=oavXT_%HA9`{aIH(tj89zigq{ zf3b2Ykd+I8_96xj=KnE-V0!dGe{0%I|AG)K41YqVk8OWf?Y}eapN0ENd;S-~V+UfsX#zIe{kLzjjWH>>y#U z-q=CN*4ob2=D|M#=_NpvmJW8d4ChKRxLgzDY@Xx0J?)#K-klzlDJrTT@uJ~ummdNg;<$TIc}1dMH(K+66EU7XJwgH$bE~)*M z+iqW%=o4fy=RGmZBtvmnvTqjxQd-EJ$dN8916$|FGSWrHv+29THeesK0f4%Vy1Y<- zGY1j$>q!x;^yznCu^wfeWJz_An{Y`^D^xA~Y|o|Oj-S^fw|IgT^0G)$j7esMXy{dvO|pGr1SRD<9BYF3)uS#wAdj2vH1`??VL{huh&3y2Y!vPD0XOy_VS!08%zGqzgxt%xq|UFwYKmH5V7IrN{57o zt1m0~ej#O+;kzJJQay$RFH!#bCjnh2iDxEvDW&Raq>K?$utt~J%MuNJ_xrJ76A~Y0 z*~_qlNO8RMUssIdXsV8G$B?_oinPcGBePdm57V9KkLtta+>ZD@OW239#8$s(r(VJf zS|EDK;C-xVBKS^V|Kgmh8(aNOezhX^`m=yK8xgb|+d4bkkXard8;P>7zGb7*sn0DA z6grgK*%fadO^A@29hP{C_n@JB8j{W|Y*S=-Ic`kdDOboS^C`OL-6%q=@y%3y9erkC z@70@5cl5cZXtdOn4MLx~X_@eb@Eu7j{lEH~#}3G`>h-T`OI&Zg-3J%i8_Cwq=}Ed- zF;soK(Y|CAy90|n3Hbref|gtd5|f3LDmL zP7%psHhq5c3kqLsGz8i*qlkItUT20qDOEn0HXs9f`}^QA32)y?bNCJxUGDlOt$=CA zkmoX$mJ}iNkjeL^-HjE(ZP}?Ze(n~FO3f?oZ^q?Nm-F+ z%$BT!cPk7i$r+{!8>uCS4u>v4;@^D{-&?Omnv|Zp9(eQQ^HP%#Q-h_~7t>di0zHt| za{_0Hv3gsT4gBYGbky_wPU|vCl~Tzs&ijJjnVLmb$F?4}e#HL7BPqH$tR_MU#MuZ&^QMzc6m$nDoShQ1t3^^Uw3qUteuDn-q{%({QXh^4da~KN<3STaL&BI5xdTZ^%fW&;=bIIE^0Pi( zr3$)O0+GZ%xL&lJ!U&sv1fnlSF?|^EhL|T&+Cq9n!~h`Nz^PMXDNi;pJ4*v}(1tE=Rhz1o6c+;6zUi>9?J1kr*mg=>*`o6x0v}Ixq9BJe1YAuy)ZXZTB({U^8yf3Z zBiXBy98#g%;L9KQnk)O{PqMy_!p}yE#&AFvk1hK{+eS9==vwf5yg3$@uZ zj`u!94Cr$eaKn4Hwwu^ymC)K%&)`ggVLi!M!L>9{a~F=G*_}9bls|n`fFGw;cI=0zFY@O~p=YPQA} zT^34T8DMInrMwg8H2kIdkguS(OX(5&E14+MHz@>u=%@vXFbl1d!Wyp+$7;g5052)S zl|R3}9!=(#J|O=>~r}8F~yu{`#RQZW*H+rh5VdyV+bl zd@_b|mOd_XUUaA}>SLk2yx?EGM%bZd4X`8|iFE=12zAGAnZ+%K&)2|ApBKZW&H38Br9+<1B&c-$!^A@Bspb6l74`PAoykojs$ z#N{QoEQ(BgdK42^EfK}msoaT*vwO1;9fdA&@XwQ+E-Mn(7^c|qiIj>El=Yblb4NKl zudB?!#J?O*ziytpf46mc5E|%RaZIW&Ge8dHWrf;yRFouov*AW{?#y*XH~2aC~%*{{~XmKA>5h)5~Du zepP}Zzi*g}mT%GgYWBIIamyk0M>w+S&8Q}x_VW)OHazn?-wFE{3%efUB)_Ab-_sk9 z9Ob{j(0@SLKcMU%Q1%Zf`v;W$1IqpZW&eP(e?Zy)aZtwmkbV1aL76D1?gW(eaI|%H zFf?`qMLYjhl>+)Kro;;PEtCvOcKk@lK3ox$7-3;&1m&gZfIwzYxK2jj$-&(1C4h;J zl?nKewE~?&2jl=nkU<|G!g+riJ7Zzt_%(F4qRM51&j^1AmC9A+(iwX73F2jQ)i-F! zO+XbKMNp-!B&jJWw%vxZh90i>>eiNNkk@i!;|WjXxISbE2J{{G@oTwME%2D;UD(Rc z{PU7*{lo1F9U0(mF|7GVm-V)M-)OVtXgjXkZ=1BxxbKZkcF!li6VhMzJ@f8n|6X|y zh-9tf4n(PnJbqzEfEe8ZXj-E*EQF65EOtttJt0Pxj_RL^sO+x7O^gLcXaX`7$|GG4 zr1T=|(++M{hUDp;Ms)t zyY{A$cZQR~NFT>fU>0@PQSfPkm7w&Z0dH#W!?zd(6C!775%z_2wKWUzS(mem9dHzZB{FCPSC(ZLun&+Q1&;Rx`5A)B3TmPyy z`d8u2f2oY(_ytAFfKarmu>+`5SN}h*jCzbA{QSHE2#5ahUU=!=h7&Ucz={eF#vzU%%EDj|DZJL$D<6tV`er6P-zsX0E&?n zRKUp2_E3HLfd7AcsDy>_Pi4)_55-cybXi{C)R9G*@-$#2uaUV9oZ*^vm z_XCB3L>U3U)u@501b^GmumK*cK|$JK0{o~|7G(zfkcnQD6(lrB7SNAC(BnBjKCuIs ze!uK*5dhGYA3;0_>p#MM#UF=EKv0b7p$#bPB=2BrsATN)l3rd|lwR4`&FRM}f`-JI7$GPMC;Cy3E#_eBYzLC?(aawYK*hbv4*E8Zb`Rre=uR)B^hX&P=>E$3 z29BUpl$;!#4V`|BIp|`)nB>o;YkwaWV`5}sWBD~O_Sx&DBf((QZVT}h-wesPa6(0^ zvdL_qq05fyt3raj{ncdr)uIZ~8`jTVlX9QGr zV#P^)Tfs&vy)C?NKk4$^ABC98T+7|h-0Uv8j{10>U+svK@OTj(4cw7G&6fV`XT|zeHO^VQ`hjY#C=cU+`yYJnp)bHn5 zh0ab#+2ypJ3TvZjyKXw7P1$W;?e0J+ZyQ2BzY_BJb}VMU5uBIMYtL!nebr=lIQe~Z zp*QbSuiaNk@14AuQ>p3nZxL=z&A_AR)%EfI^c@p>{Ae36pRSN;5pl7`EXmBX-g_IJ zyQ9|>YwtfuSJ)kA_9bPyRPgP$G-uvzZK_{AQ69(Q6&K5|^>2PUcY2oRX>*Royh1lM z$>r%r=Jljw=2LI=xA=KyF|||X=eN2yH^j3}=^G{}oD(nHFuU&8=sinE+meXKaE)zd zMu+-bInNczlq;yoL=YoBx$v6_R0Bh$G9HHAdL-Yp&4BaKGBj%5vRIBG(!eYs^|QpSb%DHb=4eX()0N{WXc81O|h8+iC$Yo>~lwpVH zXrS;7gx^si-a`ms2-t$1o1R2*(EC|&Rypm>j_*@Nlbv8=dU)Fhi3;;_j zaj(Rp@qNeZZ>?OlhfHWX>fQ_;+sAZSw)s|Ot;{FAnhDcA0(XtpUnS2?o%}UHKmqRi zygmAey~AZ3YM{nt=asm(GWzRkQ*!#JZskr#2xt`bt;tzoUc~Nqq|F`4{Y=)n^soiI zDq0$0cfwE$Z(fVggl0t588}m3>f_+hmI>29FycOUy`5}adV!=3IU>%FDHbawX31Zc&du>u{ zbf*5CFC0dLVrcd`^I%h1U3Zdw1TfG`@%u5LJ8Fn8UVwE zSXLUQfnkCb>L1qzNAHFZFMl}}5jZu)K%4PuW(9ACg8yyfRL#%{TC2b^atbPV7)nqV zt9}oryr>})D(G#82r#!0_3;9+=1`+YV9jjG;?!7UwOtwtXA)9U^VjEr_UiJ&CF$hS z93rTz*43ig8blx2vLMv1j%7XAp>6!dC6}!=uq^iPdeHoIq^FSh0a@^@VDiLWg06yH za2*XYpqEuz`3bC>Vu96bSIEcjr%9Q}gkIo?B-quJvQnUcdktm)QQJPH`zP9oE~{l= z80_BVzr6a;QoY9yD`zn`sD%4mR*;=oB|E&9Jdw^^p;Jq=bcQ=8m<@gt4em|6WIt7! zoGZMghOdc+sAPhkX9@>{x>_(3T1`a8de^o;3Sbl-x)`Y6%iw)M@s!#14F&qZw5)}m ziD~4A;m{|i8Q+KoQs1eX$e{6!TT6aO1WMshtXB?)94>}*$03A@kX101TAw+;}*wH`@2!a+&RW!-Zx z@=4M&z}NxUhBsU~bR2Alx$?F4UxOiBdWs$_sr`m|yaQ@*?f_zt|;9!a&W#K%4A z3(ovps=A`jQW1-E!e1~rRZ4{UZfTfPg$`iOjiQQc6q^uYV@16)LqCh)#XW%t$100A zMrSkepN27lA%ThI2lj(I0u}e_SG2?|m?B&HcxLV8jNFnU@!d8w)kF$nh77@+p&Urd zpwy7ZGoJGZL&a_jA21#x_`7|rPss=d6I6>Z0RPrDC;c|TW0+?tM2N3*);fe4h*M!UP&4O0N>VGL+bbmux+0ic)_kKfQ< zZgO^^Y>^gid11vA)wK5u^bAz>5D1QZ_XKr97NR&@h2h3TQ#vzOL&}M_i1M;qrX`)4 zEQ(0ty+Ufxiz*VJ7oU=(WxsuaOqxUGDrHCUnHW~m=M7weCUlXq{g*rjrAUUNoD5$( zFe^`G?!9^Gv&O`cL`_9|LRcc6o!n2Hh$f^`&ON#8d3-5lQ^sG(`}$yWi^^@2VOlMp zCu;ZN6ZiU}ae5$1ASdYSEgN`0jaNVx7lwJFf)k)9q}PwLa?qb#cPdzla_~X^)Iv}c zN+I6pxo|QVEUC6-ya4LE?0gWT{H7=;tfw}EuLcQ98KFwJegMy~LDfzxYZQf@d^Onz zI7%7$Ju@*Xk7V}&r41vPDJ?t;aCg2dbyNVR@=IuBb8Y7gyOm-U_)l60tQSNnNw9!p zIHMV8`*KP#gHB6c!ZdKPwU>68tr%D?QdzB9sL=I9q6<)R}*d z;#U7d`uY@+Z_NNFAm9KM6G0ghHp+=km&B@5)819EZ4-*bv8#?vC zl?8>liCBf1wi*Q>GCoJTLl|>Nr$|Za?TqMq;yRbG<{JBqYBmWaXL@z`1e^st2%ccD zNF^`&l}}o;-_+5ZRMzlV4qnMnUg<<&dc~yQDzD|O$e;5RcF41Ga<oGaI2+7n}GDD<&s{ApaqQZNQu@ud@DoF8-fW_C;DT+0fg31Zu{g?jKUbGr@?W)|9 zSA8!ETQG`p=lvYmRjwzJx-ZiVRU=>-Pn8e1gvu-kg9KHsAu;NaCRFMxpG7R`5}#Il zmq)~Rz(SCsgoKYEE7tUL+jl}}N`4}MEa}g{irTs(uQ_m9CdaBz@VqpVhxJqwJbBoj zLtn4*)l#A+QMPdLSs!g1QK0o}e5xBio$$bHERe78yN(I98%a|2mVz=s4%sw2~1rG8%CHh&y3^8CC#?1x}LejL< zWin6^-(=SqbAUNI?iIr9k&5>1BVf%+6R?w!dz8X8q-gWLW_d={Qd2Wz66>z?7jLhmCmhVt>AoC@s5Z=xl1zQM1&qNPr z(4`K%K&^%|el@^b%5YAH=Fp~Z?EZ3BrU$%`4xnXA8JjLw#Mbr+_5D}#g$xkbkQusc zIHD#T<3jvMu*SXKxu^XBmddgwxC8n z6#X=>2n#>E8r95q4jAJ5%Zess9g6K(fC_v+~m~TsUg+$4jYRe(v@U=5syB>D4i85J~7@Bl3se;ke27 zlk=(21=gV>4mYN(Bl?*-?(cn2lHH1z+X%(%+JSq2O3R>bp7jT5`I6pQ->I`(2RDB3 zTz7l5I3D1;uCru%SZhiaIujOB_D9VXozK33XSpUZMKfJ4;E)+E_>LMaaBf3Izp$DB zr_DEW-k0z1fzCCOxa5K^lC4||TiGiu)<$PJIsJIGpp$9WOTHx3fD1pmOpNfR3uk|C7SiF%Gf?RKBhsIul9xZ3=Uu7x)6IKu z=q0`Hz9spVn?OA`XlbebA6WSE7G*zO&ib-;D?W0gn5*=2OVhKmoY z`#Ydsb$p)05N$dS<7AunX^~jjyqg1zcjn?PMxBuZ2}E#vF8ze)UljKG03{>@4ga>~`C?B8X^#-?FkutHV>jQjen%?)fWpIfgWvMGt2dukyU7JR&-`6oNio?{gNO1 z=f!b-aT4mR67AC!$J6|?8~V>kB-Z?9^s%l)Lqo+)ZETBk_5cs)#~~d3B&sY=vd)hB zKEA;>jXEw4Y#sIGL8@Npl}bv1I<^*A00W0^+%D3@#k`IIf4(9{1^-OXRO?Qilw&7iW6zvdNGI&7uRP<$drIHi=J*AOu!h=H)64!{T4Ov@CX2#}GJ zD1Cfq>BmvU(A%;4Z55Sp3RzpFh@2ouLH3FU?`4^L#8j)|Xuq+^QYN2jgV`7i`*;Q3 zz}<1cs&E^vwQE3~R{m9$(8N@!XTrXx7KmHvJCSZi%qm@2gHox+!WdhwbS{3Ihoe8; zAoPLB(iu7xYfH?GLDsBY)Vo)~+17n4OPZ~gMtpdP6`}IbHC=XC1aG6W8zZbdrLMcN zC=`$v(M`bSi`uv~bjn{S;!1pY$Q9QQI2f4e`UCBaON&Qiu~a@^sqS_3Kz^L&gRyXm zS|}B`zNWrX3H%n}LMDMK+P**8V^nH~3soBB5H z*w)=X?vsxHGP1o*mO3LoKsBwT{+y}_F9j>)#605^E=iRljvLDEwBWou;(A$zByGsYkpXS zUei^~PqK*V9FiuSL8U(DKw^zbwE%^1bpyV>q7u1n#7>V+bJmI&<*^ZmO*C{hp> z5|tfe$OPknR~!$1KC^+sFD0Dx_VXqAziMHWPz`H&HIWs(CRJJNl}#Onhba-tE_q<^ zwidl+{#R=9!LB#;tm6@FKbKkG*w(HNO47tvg&VQpj!qMaNkM96DDH3GZyJgeJTEow z9E;;QT=p`!H{g0=5l z`{=uLGTIgE?L66-cOyCW+2cw}l;~St_2?6>b!wl}zNKh8WYaV4G; z*8qJS!FMK2OOdDC=K3?F=_h_F`vS=d{iM4oA90wXtNv~h{0fjZc*bMJQ`#voiM+32 zFf*2J$30p|ez}2}!P+O3+GcW!-4V8v6W!46lVoCHd#2qIZT3KW#!f5pm$frW;tS*= zWn>l84NBw7TB%0q(wR+SGC}lxN?MgEWAChxjS*sJz5cSe3$^w!&o)yl;)%yrYSlqb zW2jSb;wSztO1N<1TQbHP@9pkO+UJOKxi69lcS~ma@*GRpXFRcePQ}$A>elZWc<{BnR>~Yjn7R&QJOK$?%$++tc;ZoWry9^nGVfTb{`$PiU?lt%-~Ttz@<^p zI0zcfG@Kbv4o7BC-bWR0VeA%HW47U}!tfNPi`mebTP$%p8K3E%$#E_{aD&YV$_~!$ zFLOQGXCrBIk9^vtC$vX542~Dp6~+%R-9{O;LHuy9ibJ0x&8!9D;AEU~_PG4)a z)hwh|&9|zmiXJ-ds+u^?eoayB7@HZ2@3V!onc{BPrApS=1G=K3eT8m;KT^rrRt_^n-sfO9tr>%b z&~4l`Szq8<&U@^`ywx3dE=_!=X%iT$tSc(=3clml^M$vx=Y&~MhKeVixy2St;tq_< zEXAzPEM|4WPE3mS^AbPL76r5=kz{`%;}x_e*8GVr@jIJCy7pm7eb8-B-KRu)&wNi<^b)gIDnblbgf*_tT;jy8E9%~`llo8l956WOXX z8O7B#EB(wB5R1^5Rrcng*bG@8&Bn}q7!Owdf+qWO8rL?lX`5gcU)@~2sTU*kC9J#&4fnu6&FW03pJm)-4}RwFF3WmpV2xzUxaMm_)~^0b@hTl zOv@H|mn~Hr`h=@uA8ne1XtjS?=uI9e@f}c`)JqzcdS}S@2==qk&&`r=b{rpW6}ukK zqi68A+dOzQgEl9(OF2!~o)bfLG{9G_(0fYI6inYS<1@V*BIU}ibk&My`0XbeQ4Q3W zkf6F}ViCK8m153c7Dd+;;Wb0oM>AXT@?(c~nydu2E9vK;`UHD564w;ZGe#L-B3l*F zXHyk}I;j>XV>mH*t0nMd)R*hVNt)94+eOz-}a#=!}Dd)Rot9LiC`h8AoHxtXzozia2ve}xXWYP1@YIlxna@{FjG9HmMyB42R zR(H%(*`=9mrk48oVJbLup(U&Iyi|D+motQY_>N>Hti$ufZG;{7fgZXm-0yS!Z)I|~ z3EpC6P~KDW={|C~r4d50)gidf)Z|>*On!>gmp|F{C`tI^5mNrJ=&X6lMwZpqKQAJ$ z5_Wf>*8L5{ZH9gucS%FXZnylqYQhVu!qR_Qbe&n@S9X(3^z<%Xy#hhSz)%~$rQMV$PH+RNOS%-kDJeL0_@@*bwgIg|Ep z7P;OBzo;xbUd}b8<>pT?`$sd3QqN75t%%k-!av6GDQq0^V zPn~U%W24UY$i1^`Lj0*a@|*X_{a}f+d*qV+J1WLWopz1Ns+`p-!=o8KDfRW`-lliN zxO}C%5M1|9)~TEowDyXzwsfomj_Hq(SCB)85U793H+IR!P~O40EexT=Fpj+V+c1r`0{)$;sO_4rJpfiOl-^7FX?*=*(PB zK2u3uG2q8-hUF8;)n&Zq8HK|P`5x_HJ9Xh?`%&4>%?9-Lay(1?49YCAfE3z5|M5^r zX?~|eN3&CG%|ppYnK~K3o5lR$!|-UkjR_7&W|oACT;+_{;{>wnJfG}xJeZ6`6o0m$xSuE|uH-Os~`|JGIahEu=QseDsr>h$))eF$@Zb9QY}nH=rM zorJ*&4p(!pdCtHU7yN>;@<9dbviqa zk7qo#p}Jhy0}kll^pPH9rBaVa5M4>Q;8oHMu2CGl{f@;#OW$cd zeD|Rg>UF5s(PK}60zL6sUU&&`~k&Avi$ZTiYY!hu&G&a3;F zTmKony4|;$5A?&@>tKHv6NDaQSWhbiR0#BB*{e%x?=#7d4}3bI*?E1MRWVOTR(HZa zmOU~YM5#(4jUO1a7uLbY2_-!YLT}jcueq8GBH#_saGL7 z9a=UkoE3= z8`h}oXQ><~RBmz~Co~o?6$-;IdOsM2;s29>Q5bGV34>4JqFl>WC{Eaz39e8WCG$`y zjCvI^3Zqr~toXP>-$||8srzu70@U@|@CNF}S?ca{Jm%VESp}!NA|^UGc)rhbNWL6~ zr#m{wgOu5PIC)YhIp@vbD#=;3Yg3P;eI0RM}Fmi>5z z{fe7~x+_C#Z}gquv9qI;XXpIL#TH+Y9~O;)i9-gV;*P1SCsKZ@)VH zPkf)@!yT7@m-YsbkjvhHAoQrM`T=o^*oN>q8toZGB4-af4)&EyX22bsNE5)E&9qJ> zZ>Mv%S37s9wsB`+GZ~Ay5)dxK(RglYTGxcYI4X$v(9x1bkOYK5NCm=fh8PY$jh{m; z$Dhu`2_d*s%S|bPxFuGby0$MZ;e(-IC6+MUDRUlfoP@v$FJ_Uwc)6EA_v3~W9(H?n zH77Busf`g}Y`fbOw-Vv-uIwRRjwDAUQgiT^Xj%aGtZy;dOn!972Qy$ORqU1KY|A?nP6#m2W1di`StSj z-;e%rcB9ch+#i+8@czDx)24$E9>`Y5E9G#1;`9Sa#R*`r4-+RwtYNzglk$w%7ne+< zKaW@3F5l$mtGMs;Q>Rdq=8FH1&RgnOYO{-yUCvqNhT>6NL}5t;H~u?rbWZ%kq$Te# zbtFEG4s$lTXq&ifxx?dIw}%h&)p_mUP=Bs#&lgLRa+41v7iff|nf2pBmh(%S$)wYQd||dP)g@eh!?|l3k`P-Yh!a6_LNUSJ#5u?74{Z4|jMP z5Kyw8qul%u?sG)5f=Oh!iWy9ny!(ZvX|29Mm)$n$1mz5#HNdI^c=!cN2nEzK=8=Xg z!trkGp@L*248Z;RVV3v zTyZV?gf>@PzG(H$uDD9>@61`YAGO%3Z?DhqbdFT@{BDEyvCTe7?RH~z_&ZVT#z=Fc z`*15S^-d#4?Ht{?+oWy}ulnnlM8>|^jfwgZf2Cd|c?~E;eQ7yA7anf)l)2FNV@!^9 z9IF@lrAw^Gdbgn=3)fzStCx!mJp+Unc!>JBPWdHk+6U7cyC(#9OOJlyYp;TBo7^m8uBtIOEYTkzX)Z9HwBZh}$*O6oDJOv+aQg)q2q1;Wu$r@tp&cwP~x?5g(_p`YM z3}tE*dagR|EE0OIyZ5(S*BsWCKsT<-#cj)UZ{^vd!~?m89Jt`HePPrdur>xNA2sKT zq`%IP>6)3!GdNsnlc792zvZ@qm{-C}9TVR(<0ZCB=lgp9O{9&U^lE<*j(L4A>6KzF z*5Fx#0b%FyQbZ)-^_BHFDXgEcaFTv~uTgt`#&404=+ccw0di_use9jBU0-Rp`}uC~ z;WvNl5F@TrSU+|8Y>rsD>B~7P{QUgAsSNtfwX5vd=YDfLi}F6Ev0FyDgrb7;haJv@ zo@#I?C<)vjrC{QNQ=OMizuXpk$HCy^GdpNY+EluCk9o^5R#*1S@EG$_-F7;de7>v^ z_^I5jPovLCXLV_Tr!T2Gf3l|w+-pBZ?ero%=KG>1y)))0pXLa>kA>~lr$Qw%LS*i^ z9lanA9ILBSC;@ZZ{2msUaO_hXh^XSi^z2N zslbR@Bjy^Kqcql95jiW)jKU=Qt)12gao?K1i(!JOei_T$S{-w=-^c#l#@u+FynVCa zGxul7iD0sKSo0OO!A9;n-w1tP0Iq(v>vz3#U8*A6X;nW`tQY^-$8-~&m3HryW%cg1 zM#<@{RB_bnOdM8P$0;tj%`Uo+DE;^yBqjvoT`ZwJ0tq0R-Bu27_1JwIrGHzG1EGas z1b^U;gC%grlUrV?Y0C{%9TP6ZxP_sPEF6R;Wl*r=xsRsqQT`)?x$*anIqT;!Tg_KC z+-r{Jg0*WKf3j0SEIpt<-*GAOzN}YimV@{ToSQ2McZW^PJv{htBzW?CK0HV8SK5M82}(OFYlOABN4i_v_PL^}WtTA@`Rd76 z)~C(9bpKVr8ZV_Z%Sf|VL~9U=+%hcKgy<#3$d(a$b5s$zZEc2Eq9d01M28IR)O0D} zgzPm%X=lZiu%-G+_tJd%T(D)?733$p^!0UXGdtaX5wONiqNCe+(bUayR59DXGHX`D z(R^Kf+RRITJr;U8Sm=MF9o)!Sdqf`j%UbB^V4?r5_HQ$T{q0qJ%&GczAFa4ER z=;>gg|BZEPGdunDSm-s*NRDP*(v<)xAFDMQgz$KsM3GPT0XcXhb8m0@v(I?{Uo&`* ze`;|9t$OA!DS@6)t$2$^nN~S|Bd0aZPX$XYw1o4NkG_)5Z04Sa+vHg^a0e{lYAJ8! zo;1fjd&C(5oi|^TaXs#3uR0)j&I6?PxZQQCv7z+pEH4AuuQxd9yJgs|JwPZdz7aKF7ty_vSor9GuV_ z1y@Js8JjFFIAguhKgT()jJL-{F7P`&XCHSQZu|L0JyBxdFdKt5pb4KWytB7!MZ%8tVv{E$yH@#r zQXw<(*M<54H9C6YU@e_3c&`}q;I>?i;=I7!r|7l(Cwn=LmOo&A=xlhW*PbmJ$9UsO zkLbM-rg_Jf_>nkpl3E*N&dQ;F0^`0w5nx*9pIGifF93N@3FNFCE7nHejkp+f&WpQj zdg?W_I0mPS((p*E57(G{7y95qA1qQx@QQTJj?0yKlIv721k>|vrNZp-{9ZwSHr+eu z;JJ1iyUtIWecmQ)LL)g{_ie`G50vQdEOH1r8l?PWvBv#5LR@rmsq*3`pJROn_5D>(7aLz%03#D4ElR>fwo+R2_6(wctg0W1~vp zeVMPOt-j?YT}lEiKN0#`)pqUmTJ_>_QQoNkPgRkq!g^yDOp0;v!9u=A)yZQADn>UW z!qkRus}7xL^{MU;?L;ptW*_aAb)^ckezNCHZjETodk6 z&HG>4D`3znAIbV@GZW1|651mc&;~ZfGyiQ|%-ETcLav)~oIZi@&IadXp$}$lpvK1m z9Fc7LxUk)D^vWKuk=f2wwOpAJb4RbQiVJximosI%`B}ZsL)R^{I>WimDm}<&%2-v8 zCFA2OSguNqiRt!HA9i3?Jja!6kf_(6P1U_Nmp_e`>HBJPUz$UfI-_6fz1Pu*y{~a- z)q5h=*Mw&mfnt&yfI_P^(H{Rz$5Vddf{7g(2u;+r)!a?v%|fQ z#p@}{HbZvi?zDIx?EHajTMYTQJ8{jl?+k38Gw|HnX z*PXpgq7`I3qnPeQ2Dj@iQi%F#q8p~UIK6JKursUZbv(%0jov)_?xl2BF-h~7&^494 z?sOK#Vk25}081Lf}9{yt&ZJ@t3*L6C_0GvwB+{4L|eH{8) z2tTzx zBGxXDe~Ih(-+w3Cg};7JzGA-b|J!V5+^Xd3Ja}Sg2YA1|lkD3gcF3CS!(&!bWT?x> zJ%!(1p*U8tf&a9A2AdW4dAb<$ajVNZ=qt*Bd%LWwQ8Ly=Kum$tjQ)l{R2W`$#USb7 z>Pu!hpM!KQ-G&;3I}Dy4g3D)kDXv8eq!lBxB?w>0bho0I^;WHk18WkHp`rzr@Z2R1 z_K0o~R);SRj>8wdg;FWAtC#7uT^@)j@h`A&pK=0mF3k&r`|GlGbh8R)oblfo-DeEt z`4cSke`U~-AA#@x0!MNc@%_Jvwt2}Vz0YK7E>R@>p>(T$>SJoSNnP$F0-9_T$ z&uIecOo-TF?GaKyV_zr?>>QDSN5ibWi8VpHmz_F1^n^ql6e!Yb_o-#pgbl7^#E_LBw~|&;0;Moyn(CBX}}&aMn&nG5_;)JqpN2 zx^nLF6lw=8Z3!MqhD7Y>>KXpQgavz7AZCsbHT83V2m4yopt0tfka~Vj#K{K&Lr=&m z7M67ymql4N$kNp4(Mul$a_Wzsb0@=nszEHR!)af;;(b5m3QZ=ZB{=vwu#(a11lD>L zV%|(o{pEA7!|ZXc4k%?pt}ETm>Ka`KA)o=cBlSugrx3bRpdJLWvQB-&L#%lEV4&C3 zP6xpk$i_R2Uwe%YU?mM2E4Bpb2)`Oi!YF`RMR?G>GLAthGpNA9z*>hf2?B#CfEYcY zoC!=nmN)-2s+g(ES9p#%B%^Zhb)0n z99YY8g4Z0fSV}slV^`~FdQ5<{47WO~AoF{b*hLHvc#nTTx znMR16*Efrwn(IPbo_H_IpI_h`t$C*B^D!IV^rv%s#ZwEWe3@Bk_+5e2vaB^-KM5(6 z2gbb7kV1&1!0;#xDTF`-gT+$OTXJ}EQbG#BNxK_LNFjJ(cNX=AF@=z~jU}cKs&X}^ zQ0_YzeWx|15CS^Hp~Mst@}jO~jCU-;{c0$+ud|aY!PMv^-%X+_F`+9_m2wV{E*4e^ zkXK|htP))ABgm76Rm#~}pNBNft5KD5rV6vDN@zxuutile=(I*vs-GEE2^B|I0xRVd zOJ)tMWC>$nB}=ftN}2ISN?;`-X_2THSP6Iyp#)YUlvb#-lc4cH(8nd{ULjD{?&esy zsw_wr=b_8ts^~pCB!;UBcMDhLS3|3P1tQ|WwvWWNdqr6LPh#8AE6(Tg-c9T`|DyPusaQOPG`@T1-Y@whO0 z+~E+|1ZVCRW^?cGM@G#`@;)5!MBzV z)`@unC9F6s^XY1JD|4Xp`lQKwOa&}a@h0R%mKi%D2KYVVw5^T>Bk|x>OW1U~^?N$+ zdWLny&$GlYMp7rDco22g1;j7{-CDlWv;@#z7CVD02~i{ifB~A!fRs%)8Z44J4-Lxo zPF15G`&rmFJNA==p(bE_T3*0GOg7&)9jCe|Z285V>a5YB0EJjTbmLFx?2;!zlVk`n zsY$5SLeCD^?&x?y!T=6*hd9>t>%d@Ch%|uHM_gfqy4EeJE(SFzJnV)psuGh{JfN)g z5JKi|{Fb<30P7=EKMyH~s9Fpw==+?24Jn?h>>l4_x?Dcb)Vn;{Hf#pkl_c zwq)|!h9jLeTfzmAo^Zp({%oe8H>UOG_xATPa1>#B-E(1|Nv6u!Yl^Ww=E&rIfo=lxIH*YRw< zlC3W;rl)v5<5j~q=a2zI~v;lr!9=Q2s2T{WBA=?@y^F!}GSQ4Tudz$Sa?h9^2YJi0Vu{Dgh)Ci9{k1y1=^G=Pe?!Rp_ft=^mdtd#@Uc>=#I^B+5Bmu!afe6w!^0L~$?nbTx3P|ExdCJjsggh;E43V;C1q0R9S zqf}$_KlJo{wB*b@BCBBMQJ{!`29ZTT1Nj-GXUth9V2+9i2w5Pw-lTv*dhTryWkJaQ z!Ez|FAoTsEYeYflTRAXijApqwbIh4z9?UU&SB^)#x4R>eG1g&x;>v+5`m5H*M?A&5 zORbAM*4V#(eD{Gg-Q$|vXS=o3ueyQz@-pqh^z0K2^JCI$AVFU1Py{_V0S)w|FldBM zb)^oTJr7FgNYj(>k#TuS&4kodr1v#h)i*7wP_22CGa3D`7FD8Jny(rwpIPPeZ0>Se z5F>|!k;85NXYJIEn{tWe{sse=3oTx-Q57CMOmiO7Uo{^Dw>@xycM+ZY(HwcfTCAcJUE8yu=m7!76 zdS`xNFd-x8rZ_u|i4fk1&)QG)1~D^F^%Qa4Am}8bezcIgJBWcU%5#Jp=q}5H$WbJ` zmxDb*S7pcqX5oQS+_DeoC9BDRq(upj^tHQg;c;Wtj9Rkc3w2w{8=2Y3UJ^c z{h$nry-L%kBSyS*x$>`{@peF&tER_-c{3S;?rGO^Vs;R%{}SKsI@0@QRr|}PF?0aXL+`;E0?;JAhbsjJ#d3dv z-WJVg4Wapa;cl%<`PqC88bs%3J-Y`n`q`G`pN{O8jhaR`5mj6$T8JPKqPVE1bSN{( zh!*Xmo0vSw93qn!#U%}ZJslRm`_8_3b4zrIh5wlfT5ozKo z?9?3Etis+rzHJru=JAbfb;*v)W~HVA)J1q)EW!d~S1Q#=Uo>m*FrUw%bcC{(HznUs z&pDsTWKE6Aa{4vp$U@z0AZNUC9^tQcgkRQ;9pfhG8b$4o2>l38FeY23oQk>GUNrUA z1(UDI+96YswqYq>Lo0q;(Y%m?{P0+l2Yi6r*i9jMxKyJVLM%*%xNZ;~x>y-74EqoP zB&mwk??cSAR7L1b#$ggov(Zu~wI`aEN?0kPKJPUCF&lH< zX`J=Y^G@SD!sngFSy}uCQ5MfTjWhE+Wv8*nLm`#hbvOk%dk+2T>^XFTui1&0UC#V< z=C3Durk#FM`S0nOc6v8fLK=H-8*9{pP#x*EUu(f@Ao9L2S-l0~H%n%cbhW6hwNBu9r_OQvkQ|gUL>SGC z>#*VQw47zGE zk2uhZk}D15|->bnB#af&#V#8RESg@;!`dP5w8t|W6mOZJXXRw5cmb_~%+EI+9akm1LmdFDJ}qCCct z_&7D8!2smN8*r|q9)Xy-Npm=Nwr^BONx&(w(SI12he`0ztKg9 z*uWRe0|??P>zT^6w}E{a_MRlijuFWdUP@$;;V>~0up+Jn0iG8G!e~=GM!pDBp{_*P zra&CbI#CfUEp_EF&P-&V66mTDBM3;NEEW;PTM!V75c*PA15Gl+6d}Z1DZgM#`qO}^ ztO!8;umjnb8bp-ju{2}WCKWCD;~k{Mh$ZJnK0X!1wIGIQ2tcU5=Tgx?aWc{sk(Z&S z=p>NVJjr5EzdeaU-|_TC5rATEbv00&th6GyW|pE|znQnnT1tknLM^+&U#+ZQ- z@&u4Z0-rz*;Jk+QzT+yKp)e5QRO|IgSwvFqk({9N^iZ|(&%E08c&1Z?k9gen^42Mq zzs%7HDULpd(wXVWs)CzXRD*0ocTfaV!$<&4!!dXwTN zHT3#uH{c}XXTb;vIte7AV;FNT-SLv*vB$&TiEzp^M4lg@|M2EchSJFH6_uHYUV49E zGW83GDFujPu>)ny?D>4vBr(u=s*fShlNleK_*T#uj0i7}2O++D;Bi%kNPCP-=(HC^ z2qq7z5uqI!9aLNN*eKBGt#`p4xJV#xoRh`<~f(f}SVnd4m4ECn)MB)#Sb#L0~Rr zM2IZGo~6sdvOJmvc1%t^YB?hWfsbcskXC0JcKZNs1rtdZOF%*Jq?(WnY7G0vCXwqB zeHCw%2}FF1WRXNl-Clla5yv29Loh+2NBfN+CgEvE2B(OCY}@5_&l7UYquxmeiPDK( zL>>>%`+G@F;&4W^{O)E|6+=84k?ibw^#C)r2bdvuS8hrayPXfc z_}d40e^sF#Pmf}9iXST8i^Su4$)MbRj|o>0o-XJtCeG-RrKjJE-&p2>PG?q^K**?{ zvgF?G0QgNq;MFmW{4pmc6=E0<=YjZzL@Ze%!KCU zfSyr8c1)I;2)4>xK^@!ORcETS2N41U5D`87OB)1|BgC3|N8yTFz*C=e-Wu7@oo^xC z{~98}CWwmhcupQ6_;Ak#yw$Ikw~^&~<48}p+%R#I)m|s8!`WLph6^|Pz%YG<@Z^yW zCgBc3s}$_YNamkc%@;f2wUNGc$^o8^E(0#zmY~I zzqr@23vL?Nix(UfVI7%3b)xhDF7>!%iBKzRIfF{aD%_EmtYBB`lwq^ab;a#ZOSDur z#G6#1Kkv;FLI31w2WrI%5majp^3=@dkTy03Lnu?>B`uljjbPYC)cM>Z3Y5so3RUV1 zA;e>lr~S~?vfX0L;f)$l-0QB!Zkq|>xoP$|bD`He< z?^0w3;m2jY+y=Gvj%IT;#Du+0Tg?u_iZu0Nr!%Wp5KXqukM`{8!Mm0{3zM=KxTl?d9aj6*7Psg|ISq>tZxFeL;F&|jX&6k_ z2;LGM}oHk;s=!_;zX+~)}wLLM{1G0Rhj?G;wQKB@U6IX`ugEE)8ZP_ge_V> zPy?q?KkIJ;4g37T7KN=FUR-W3(u>VE8tm;t|GY)mw+e1v(VgsWoA~c~i)&En#T8x0 zUh(fe5Vs%lZ}(zzwGHvbt=xJ-fhNmqEo*h$|Ge6-r+b>jMStMwa2y*R?~mW8qg*KN zd2pt?2ty_|!=C}aVMo;T9|>=?r*b2i>ki&?cl7DI-3HusyNKP3``p~OTRy~H3cW^7 zNoLM3QVX+v#OvJx|GJRY5b$a{>Gw$r%S-lqcCI(_S8vXx$E>RRSuS)y)sxTNG?gg!TH%uNh#ryG7ZZy~$tcI!vYc+0zY@8Hjf%2?!E@;E>8u6{3b zY#iYE=rVkf*_KtYz&AktKqme^&wzoQ9j(~Nnm?H%WstAQhie_kC%Dxsn(6ezyyYMy zoErMILAY3@`>PVT~BpAUKTGdwfGmtj~x?U5VN|Bl4Ed9qs})LpX#j{3~SvTUh6EVL9P;f@~I9 z{$1t4!&PW6kIKX~H*hj7?|5&ORo2;8rVl$=rU+^NoD)CRFCpL0`D=ZXTbiZ9b8MzH zzacY^882n**2cutC|y_MDApqQ@${FmOUD+~(<71|T2$fB6Aq4Ntc&VzbDQ6DLA=FH zb6Z(2a69@Q3A)a1KC&mU8veNLwa9&zI3clz``qCnDV}SlR6^{1t~uuJjf3W0_1sL4 za&n)qr!i2mIo=g@J>{a<2>Ja}GULcuWEhbGy5_F5Xy~3UuR8ThIohIC$vHe`@4uuZ zQidO=tW$XUD_{VGG)Q)YV-rqxf=n(;ht3oI!b-_46YF@_jRSbiX&q;&tFv7uepjn za9TV{ncBHiWK#pd+YgV^EvLmhRh>NBf~8tofc^a=IfF(ExE*|AR{Q*8@-*1E98qx@t*(+f- zFq}p|8dWpC;u1$~NuLm# zX>F{3<`uD9A=7znY1678KVFgL$=d7mKgLqESBA$aUZ#g=y`N;0b`hujDlOqJAGWF8 zpUE7BkSB-S*$A5QZz`?Ihs^YK&v_9?+dP#0Us1B_&h4Epl->xvr}abmv#$!Z(0;kv zwWfjMQ3u?ga&nDIPI~c5KxTr&3hZ#Y*0xk&(}d$`zDICqTs$VbXs_RYq*38Ytr{0- z_C)nH(jMfnSVqikbf9Rf)nX*dES3D+pTFCx<|?(JqT5f#dG!~~4t;wK;Fup;vR);NoW`*xJ*V{pf5aHyalqv)h`f+U_$ERzX zc(Vddd`HKks?T*HY-~)T_B?D28lOQeCG*61c~~bc3cbuVnbE!1pQ`GczED@yyM+l% zuyu~fnqOvUquyc>R{hrXx`daFXEgIqku2ZBDk*x(JKN0qMwt+}wf{h`_yL0d`|ZrO zP;3=P6zBQIhT^v|SS^QiuaZ zdc10Ge|nMscGa}tn<2iFg$=E1bgsImVJ6WT`2oGG47d!^uDJw!QAfBeL$MB@>>=E^ zR65DZOClN;nvLVqG8}sC8`2_V6&r3-Y1NwlwB7n6JXg7bmCIZp=NLouUa<>h_u?UX z%=mPJu&@hmeH>($rCH$PDp{xRcb1#4k+(pO()FON*Z6cB={R2cl^$v)KIg+LD!q1? zQ29_sx?~Zdx0e?y@}LpsPVWAr#%3oqW25(FN;h^Ivfq1UKe3<37yr8*br!1xu(>GG zwahg6-e0ODAP0Y2?Y+%qFSsvJ+(jQ8qa zQBLp=4Y;ccnCL{%cp6=WXK2)VerD{!yJ9-Tf!gi;<}<=e)HA$~A}7MG7In8BSmqT! zbI&?&k^M&1^0n?f-J-gj0N%Sxzt$s*Q@LidUqrU>4%hU?1ig>7cO_2QOdJ%ocXjo# zO@!?YjQ4KpPDVdnG#)FmE^?nI_K1kxX~I?5hwdD?XZ(U?&PgDUvZXH@NkVs=jjwd> zoAsa=3CdPX^C0;x7x=oD|4_b%)c1gzEO(F?Qe%-k4K;h?m#|FPw|4@+GKsS^2Q*() zsbUs{H^vnawku znIo?|(?Qm$|vwVBLjlwt8e}h@qn`zsDgHGFHhlujk^L2EcxxJ3g)3LJr zs*bOUP}f$Jv7fB2dcBTa%xr3f2B*A|hs`?bH4WM;5_Z*eAO z)zy0l`#XFdSk{rBlXK>n?s#`2b#h}1PXT9E?Rq|skQgkYONf+(msck7%-vIvCSTho z`m(FKY}>YN+eVjdcG#+cbHSanP*U0ak;{DyFnTBu0U&IV@^BT~$e`mPvYDS;eHJ)j6%&hbcav$|}xi{!P65V+c# zxr45|`m~nB9YTj}-bt}Se(W^d!xwgT?+Ts67ioV5Yj7@iF*N-7Iujkr@cpZE5xBCP zV3-32V5}1<970lpAX9Ps@bxJ)6=wKNpiYXxHvb>1EIb_XM$m5joVQ3jvyc z7vE!jRS<%New%gFnK3PKb?p_}*)6v%(VPutv2sVx$tP<#XnOaw;by0Aqc5NeHoUvTb z@r)55aUX11)8$T>k0f?m8>XsW6)@G&-V(%Cft8`3;u26(5o#3C!!5<-N#UP5cd~1y z*SC_%60vQ|EWla0%vpE}%Rz;FmNggWxQ%=%aHJinj%nVPpX!#9V>Mf~62XphK3x#7 z-=Uh=gW z<}=qw>1lpONF`P&cjzO8l8r7#>Q>!-FD@@y54ROY_J%hO`?f%1H`B*<#uny}bU zD|ck~O~71(O-x1AmYRtBz28XIQ+c)wmM@)S-MUs!NfKi@IgU=9q{0Tjy(Y|_i?Szo zN_WJXSkO+4(?!}^?;~4X_#-!$y9f?UA!YtxJSrrK9MDSfj}ftmDdwJO@WT5{G-fEA z#laspZcCM_sm<_>6S$Z8zXj7=j=YDR>2ELc%L1I^=7pXSQ|l@6kXm@e4lzBh=YHp0 zM#i;qMFvZ4E>4WyQiXN$ULTF8K%<+b6uO? zy@J*<_enLMRVAxdRA*P>{aM`e0cNRm!Y66rJXhHs-UUE$-GU{3DYFI)L;B6`FulL* zY*doX(2Jz8jETP*&SbJ&h&e3bv~Xcr4E%^ur8k(KpBT~RE2m_ivISax(K2Yt0N}&3 zXV*}xBjBX%-_620ls!t(-^|;^cy}UO(;7T_=ejUI+b?l-Kk8b&T`6p+ZLiJ^eLtOv z;X1EtFnzHd9yya6Z>jo&>QtG>PO%SHxU+Mhln$qcdAjS8!R~tceo|U+>txO9c zxq`IFaFZht(A97MjHbJ;WIxOE<3dc3*^}O{^4Di!Fj#?4Ypd??YuD4-g#0PX9pze@ zQ5ie|KkepSDx-KitbdW0$pbN!_}fj5`(@!WL&krfmC5IEj^8JI!0|>QPBQ+EJpY+y zpKBuyUn>YlW)=Hz#-T#id>1oLmw)wGwb8x3B2s4mR2MHdadQ^1rLNIK%e%Gdgyb8j zx2)Q;pWqX@9zD>-2UIl1^>l|83|ecF?|`t zxd>VQpGYc(|Hcshf6?IoAc5If|GpD{FYo`OAJJq+JBvk@;@Z$U9@ne^g>vlZnScTvTV{qOv6O z6x&+PQpW0BFKZhzGL2I#0T*9c<6ngE`B(dX_$bLJsfAk&_f%y$7)aQ_t^+6TpRghO zZ92c_PC%FM=RlU&d)#;1%V*X~)c4C%mfIZtMvE(xcH;>|C*$(l(B)|>;Nz75UE{%b zEo5lLzV~%Xp!Y}AJ_IFw@ru82mgjk#vtCs?y zgm3TLU4x#_qxT=@f2XK7jRkBS9WLiXGSI(UnDDTX5#({KrqG(xD=64`S;-48TP*B6 z$i7h|R7m(*CE5|gxppR8_dog!vUYbc9K?DGSm`OG5vammmX%ypSGoG#C8Hu^%L6+0 z_J>!4tZ&e;ro%@i!9A)x2?QT)_q}V5!RDf{$ls4yxFXarS{b#lWxFEAk?eNJS_%A% z%?vU=e_n0CqUV}esZiK<$P7t$p zAGcDjdOwAGYwFdZIMEt7hw`vtz8@qa?Mf8L-WXKtpruKJODlB~^LdfzEO&8;NfC)Y zZuNp(Q0at&iTU>^RzZb+K}|kdc(i{-`^or|7qBRWCzU#t6&~iRwSA?ThaQxZc8JXhrv=a@+dQiDblZwPHkii4Z3S+uP*0JD zy?DC)_=I2cngR*al=5C61Wj|@;KWKy{16@{E$Jd2>MrJ_5$oE6&WGC&qk_|#ZXZ-g z7K=pUW=+_?9Rig%HmfE&$H2$Fy9|cSAG4TcH_nEMh?-}{+m0=vXS;$+P@^I!fNqmB zoSA{motLzPl*vOb!)LCM>RwQ=1Ilz>c@Z6z+C_`pkIowzlr%RoHV(hLVSIoDNL86e zqnH^IGCQYM8Y%B;m}?GcCu{lkGJw%3%TW8J_0a11XHa>Kc8P?I&sZ1Oz8m7@@(?O<$HeTs5Vout1y&jPxt^Cw;!GmzDfn!@t~eRBI~w}&fp%#Jmn@+mAsVu}*hZmgbY56aBF8vlrsCBMhL&(RI#wXLAtT{QxYX)6 zj6UlI*m?(tv+3$?(8Y2&>OxTW>Okz_ICYu{RExJsY6XgdB@4vd*qwfIZoaok67{;6 zt`nMavLZH*WTq3BV}u6G{JNxR2&xpcnc}3AD9#M!c3yE_>kfSzEm*a_`up=C#&N&= zsuT>$GMfLuRj4>o5KB{(`{z27J@$lVUKxbA6pyt1Fy2xRL1~xNGqW9K-X?i-@xhO+ z&;{0_pzthQTbXii0itNJ7~FcrO~yj`eX4;2bWS{Yux+iFjsKW@0|V^A)^zM(FBG@0 z04gxz8Y+R7vDr2m-90~*%HhR^H*9_O5V2-KI1O1Qcx5J=Em1T}*NK#DwrmiIZ!W7| zQZ&J|$+uKXSaOqL;KbQpdKnnERywsWi5lNyDmOy9K(RAl5vc&sF07Ap=|URWO0Q4-lXT#AV_veu_%0yqM+ zhL7`ra3NG$(6}gYQzgz})OeFe!q-Y0`|sDwGnm*mD)XX&%y*DTfr|<)8dRxL~(Qo$PXmTGj#lg`|ULZrA~7%|{1 z^@XA*nw%E8ud;!2Db<_zlxxxyPNHE@Z^sRy4uD})A@14RE)$htAr;A)0uReHp+6)Q zXqVv1is`4t8(z>-apFb5m;HSQahrI!4iy4If@$r$eOlIf=F5UxmMY=gWSQCNB$M-v zhSKVPM+{PZxgxyI)JOg5k2h_#!X1BwwaA6el!qY$C}r%)s7srDK~Zwy_K=jh&39M~)+LsOv6=ILW2i|G%g zVubZZ3JRX{d%*L$#};MM=4FZK#B{XrF9*T0L`M42?9XRd1LsQ63-Akf#WWI|9LvpG zBlQxm4!LW=Z?-Y6;omQqmT#E}c!zNAFLp=(_?KXMtKk-3ie)Jr5rRje%T6Nm`waY2aDS zGEj}V?&deJg%U+t@I#cZov7qxa|o5?nup_G7yJBVaI3Ls_4=to<5`z2BEok<(>~}P zG92f1ua!?Uxyz#tSxWn|mrU^U1HOoWDQPz}?O6^i;?s13EI~dH&@uLLg!l*&BAMbKSQ;(VCS(+Z zv^740-qkQzg$!dZX-QVN58)(V?@6dPOa!^yT!}?V%xRS4bCqvbULafNh%Ko61LR&} z&iI1)>L=5x@#a~ygb{^RRB@WfZ(^c9vB-C>qqV+{8d9L+MtFAgj~g;StMJ!1^_(l=KO_Y@JST+simSZezGh$MRFBP5e4 zF9y1|8Os0M0ym?7P|mTYiOPniw}(AB`X?w897ALieq8vV!8dJwuj=%ciO>W#RVo~= zJzh+bIA2=y59Q)hPI_j)Y{x%;szaLifz-oR4D&v97BJ;6i$7)$aYpz}Ar}RB{67HF0-tl;Wk9gi;^u z?$c|~%mTlKljr)1V&)Uq&$}iDtc4~48;9bs}*;7*jpsMXRkbzr|YO79iF zWc44QZo4RnNbz?J7H0}VJcWrq+z5Hj;*X$6WA-E$8R5n@ zVR48Mff!I19s*P#sY!sH{7HdAN}otH!&c%loGV@mr-mI1I!Sc|i<=@^MB0?R!cy<> zG>37JR=rnuIGd2qQ_Ete5z*FiwTg#uBQ*V1K&*?JcH+e}ou07d(MqjgDo09RRl$s; za-+g!B-En`sd^7H%@ARh$|NeCpNfxxf@wC(K*_G`Dn<&Dxgz?c9be2uAX=bN%WM%_ zhoW9xJe>VwUK~2;!@azlllD>}H}D2^S`(u^Y+85c*K5)XxV>a~;=ymM`VHuO@$Yc| z4JcT>R=jYh%>dLHll-`pG`wmu2?9)C{<4)%uce(Q@0CU9+7qEsIG=Tm3r8jYdPK z&@{4n(KHMRq0=<_9z3xtn<}ty;aFjI%8ZJ39uBt&n^p{lk8Xt(RDZL?*+GTI07rcmQ!dlSIL8LAo8V1GZ}rX%;vP6v3L`XKgBhvu{n?&5h-koHGa6IP)}S zzXSs0-ONKTHhlmwU^y(~`dC4T+4g`sZGE!sUv4wTXN!Uw*(M|cjjpnVef9-1*pRgJWF9(`AW$6qGXz7W@^?-`1<|fC8Au7``$Q7h`qeZ0j*8)y-p4xxyN` z-ig`!`ehWR<&!uSG zisIoJ$FI9lliGZS((y>gaaPW_AAXxUlO->9=N9Y7(TDTYy^jWJ0>N@dF(qO7)Bfwt zPp?lQ4B!TPu7SBf+5y`YhnxE+*}b)lLt+wMy$rJP=Y^4ra=x$7co-nSG{^SP*F@ zB>#TmNb+6jDdHlkg`ie<32RjWR5U_M5;}*_tWH9QIuycrx&d*0=^2=o>QhT;L)GnP_zbLX6tDUw zz1?Y)0dzS;I=iz~9kI}|Cj&}+nj!kES!p7Gilg=<9?K!Hjc9E&lni%Hf%~s|zY~(c zeGk$p1_UTe?a-ZfW!yD+b*iz~8=*H$VW$C0JH|^%X;dcwCGVwF0#>s6(u=w*3`Vf6 zTH`h9jM~mClgQ9(&o;QFm!3gu6XWXYioFYdX(_bj>0!X4LdvN6);qBJai_T&!e;qE z8wGf^#=Fc*NCLQ9S>g{pwMGY?AMh>_q+N;=K*7_z7dI|R%(858L%DbA2w%0f{(#SY zII2!V7zL>a9~%>I3-wAEJR)AOcX~9ij2C)6!OGqhu#DsLk%xk$K`Uy@xZE@tcJv_u z(F>(pv(v6M4X#`}#u_v~0T-Fp1Ov>n60Ll!&C1~G>S(=SF)m^%>=1PS>IX4(UY*h` zS6+G;h05~9sgN#il7W-LhXXZr!)IoZB=g|f*H;8EIs%rm7t@UhE|k^2MT@B6KLQ?qcL-d zQCxN1Bi@iV98MTqRl7@)k^xjHbNY<;pjT%hKBBO99OaeICQxh6w}Y?SFETn7Pfuq_ zbSXEo>?L{Q1H2(3Z$7{P8z8T?Yg(JsBLfj;ZLN~XV#JHFt(Meq&`vukZkuwah)zH~ z`Q4$_k?y4t!*AfMZ-tqX0#%v0uRN7v4zR5Z;A`uO)L*z% z>+D4>SSd&x36l3CK`)p&B7FT^u=Uh`lkW<{^Hv2#*x~cregAsMRd@Zt{AE!tt6pxu zR%F#lqyUc|Hp4CtzkB+$;$n3J!PcIt(_WE9+^e6e-pPl{9J)dfRxfpfiUMYPE3)qu zVZjDikwTZK{zP(|kKgl_(Ho1C7t28R5FSM!=WN~1uVZ>P)J`yV0!AKuxc^e!if~xP ze+oZLy!JphkD&Ip4!ypJ$eetl#Rn| zXX?7AQWrcNms5tcD4cba(~E2T6qU}{?g~zks4r78UNT+(pz$|s?l`ltoZOQnidqPI z3J!<#w?G~&dDb%=65f?v;!>gBkLBM`4H5=Bs zNS?Nye&RbqOOk3&T=Z#J;-_W7MPL!F9+nI|3eSeo#m1~Kv*xVu$Iw)5kX)onCgo76 z)M9M=b_e1faA}lICpNjvOZb*6tjH;YBOkry5THt9+217v>>SKUz~_p}(id47xtDHP zyjN1pW0zLZB9s!(u?&3aZ3||fAct+>ZLIloN{rmwo`vUZV{x-{zLVp3j?Y(KaJ$5< z`Z?FmAX3OXzx|-U^~3a>pqM+~JlH)&pMl`;?2LxBe!(3`Vh>@|OKkEzpd*?mr*O7a z7>4JVZoX^FC%9gXwSG018*i>&9il@Y878pTVDO4-oXcu~225xUH5#O6uF3w~85qne z;i^vc1*Gm!`0!1|c}C7$*q?0)Ri^7Fx6O;I4be!tMbqNxF|%H%ekb?v z$rAgp|>J-zwn_Wh)6Ruo{)HsDPab(c$vuCJYcnVeVEmIu*GSdg=bWQDKK zDXlzYe4@D@blewFS~3`ii20er@zKT3j~4eE5xyh;2Z4p#h~B1!^?UerpWPKnv-~Z7 zQ$wNhsrz1}CQFQ5>HNI851(b?p4^cZ#@Tj~onfq+&aa4tiZ55^*xD|0kJhLkR(RJP zz^V7-+ui2gs_70>K?D*NAzI>oFHy&wQSIxXvj$6+6!DHNtug6JI zam%_nW?>4G8&jk*I89P!VCA1|NFL^oD{tKkl&)%eWG!-LiU9>Uw$lj-W5q(M}N{3+!yg*e1L-;;@Ac)Lw6xqvL+u z5Dm-T(O||tjfoQkD;NbEt4JY3LpfRQZ6l=< zrejZQC6>*W&9y>UqQdOULbm8L_ZD# ziYw^cETz1Hq;T$m6$Vv0-PJGj$4w7-7(T^wQ*L3_rR^$75a4BI(NnSG#DH2$8@b|Zbj&+QGGWE(md&E<%a`JPid#LXgc~kQq|)QHGHiGkK3!g zfh?ASpP-8g(@gfVvhdCJCc7g-fo@<3{?$^NZf7PF3Z)eqs6W?(HJP^R-JvZ!$$Sz^ z@0+q^CxDUO=FYyMllIJ-m5-fF2Tp$Tn0(&Hj0~FI%c2WR{2W)-C(n)mp~6$CW0c@~ z4+P;Kcs$1GNZk!@aq^X4cxEu)#cCB>_~z-j5425`HeizIT?kq@$7s@-%q*)lKjw2` z$@apkt8##S3EFTA$@Y+#G3ylIGANtYbWA-n4*?U{wRUXo5yQl?{OK}_e=C^H3;M-3 zFxp|?aggP@_puxEe)33R$)&E}4Y8XecK5tmr4Ct3z!joIl{Qf{CUv*sRXhY?JJP+X zOoTR8Lcr$KGVGzswZX!02p$`BIPsO$A=c_xKj)e>xo!igPHnn%rArpO#t}rYuh%x- zH0doe6gqeis9We;sq%+~){82N+sy~^qt{fxdC6$_e)|#cy7V5JN+p9EaJ;VR$~a(U zmXyTjhAg!}(KMF)fCl*dEDp}7^`Oe5wiey`FV(n<)pUyHiku`nsYN1mwps2QC z&m6_Lw7|Y6srZGH%{yY*RyDlWAZK_4i3@?_GJv!Z-$3Fyw=)^9OF!gk%avj37))M& z1k2eGS@e`F*TPbQ>ywmMei=NK)>JkYLNwyd*Rva={xG|f-zZsoul>g0b>|yqg=`h!HNs2JTF#c8S+izVKdHx!l>qZOq94Jks7`c}w`lKr%s9ACF%2B1ISq;b zU@VeoGv?sY`%dy05j#g3=nAZje&f~97~#^dqNW@XQ&zmz3~fOUtE{h#c$_ycX=mxa zb4l_I%G|Mj&k7-+;HCdFUM%`JD=I0yxcAiI+>HELfRr6rt(lLERLk0wTz;%pqq{;t zr91|US6RW?M{BSD=MV?PK4qHGVh_Yr2VQ4j44PBqC`zlkWq)Cbr)n;Z8Fm0j^f>2K zk{u~;^AkOOD=kmh*yhn8|IDxw>Z)TAK^T!Eu-i!;SvzGCJWMYq>7O& z0uao^zK1Fs-JT&Kv0ue@T=}-q(N#u0^M4VNn3*&tEINX-odCgc&w)`vRHE=SQ3%jG z&L4wxp&D1>5x)*5!C5$Kjd0x^0(S$~g{Z~CQCbt~{v6Jv-qN+3h5aqVH-}}B+qi0f4cy!uGQ=&~dRhKk zCn~4ZuIM}#X1^-tapKi8OJ2@q^rYBjd08hxbOHWI2Ih(pcHtkAzkEFq{o{TFzrOgR zdhD2bk-<`HhOlz52xw<^^hZQ6DmS_f&QXFWSOXDj-dC{0xxGXYQOR?3UuskmB1T#B z>9Hu36FPRQlRw6Q&E)6Lmp}e97#Mxtn-h$up|7}UNkXY7CBFo9Ygesq#YL^C;?^c1 z!KiDAX*ZK}?{p$3qf7eGe2=QT+~TE^6^FDwv%{0BNt9ci+%Z;Gw6Bz>yfB*0>vGKO z1tiUuWUmwb*vWKdKBYuArD*mf=xO7H1{D_v-&g_id zd+|IS8*HnF~lO;pK@*R)gdx2 zT;2~dEJ`2RZO5&TW?Mt|2C~?9rFim(q_>9WcYoDKc@~@j>_c5UCNw>i(8f=FrTeRcl(+4#%rH7igs(fZ+i*-zWgsV<_qQ&`~g9nD=|T z`qF{b3+K4pS?BF>_XU99$8${2c=YNnWed1V)=X+TYsEAekHG?rmeLjaIA#XD^tJj= zfN#0X0*@w6FRs*;N%FiNJ?U=b`TMI4wlQ$5t#EyZPASSBN;|Xzv;){(L>9o?`?}DS zBxl9c?MbsPUghXFVR*%#UnFh}$l8I5LX1SgR4ReZ`TnG3Y z$s>pqt4L^I(*x{nh6HF(I;7LMcJfh**&cjoP)j#|@suk4QjmPnmm$0-P#bIG~y!eEueo$wy))+h*1jvH>l<0JrXP^)#vKe zZACz$>Z~kcBn(PLfPT#{iV8uZiF(R?GSJ$H7BJR9y*UABc+x(x=`*m-D54(yK+Ggx z7KxIx%~!C^co@^7lM^cydw4rZ=`Msu6F8B( zM-`Sp?$@Tk1m=Dj93?eiYt?v0Y60h*HxNW#zFumMg)(PI@EBkIQ27hcUiJE%__#IF zHkzI0NHTVby(pqCPJOut9Lq_Fi4%T!cPF8ZjDV-npY%XnmXj*uy|_0p7Zl}t0Ovpr zMAy`@Ue*swxJmVT`Np{nqMyD>Vu6dynKU$}d0AjprB0esPh#`delV~Ur%G7WYk?*~ zy#ChnLjrb{%T_4*36$JC{ryvG#oRSitJo>x)O-x7kQk(r?0L#lFu%tZf1)`jHY|V` zA2M1bqWi_zG&XG>f~Kx~zyR$B{D8*MGZJKSR%P@Cik}yCisJWg>mS`gRvFQhaxbAl zrg3z_M72^@k@~{9;_A*|$T~M>I0bY0K~Lrha=Q0wlWXM$a$VX=X`S)=LNx z??;hf03%xB@OUnqx?%;^kTb=%tF%t{fj;W-%vrU;zjdZBv>0NaM^gs)!W8FakQZA*(ZcID)vB4ld%iSUW8c!%4A1#t+52}wXN#x{s z66M`}G|Fbxz-)aD1;gB^8WP=`w84X<+7@{$rJ2VgFh0P&5^D#7?_fR#r{rCX*0ZQT zfq#n8Bh1|-z0bN7){I%8wPo$uX-g0SVMuOW#6s_shs?%pfHzQ#=(xyx>=!A3ZV@Aw zm|r+Ge>>I?m;j-W6@6#*c$g$N&uRyMNxIh5mLiiWEfbncio#GYlT!Z%rwwS_TUnRUfFE80V5UjWNMmrV80OFavJVRzZQbQxn>Pa8y z>`IMUUgL_r+#Xe}iJQ?GwhgUN0x6l;)GnO|F07rW9gdT56TNuM)o=%kd6(+0k?FL{ zIk!$=`U`milkhUbi=mw*nG- z%lX7gAI7Nae9$psE)ez^gK#^_dXHQ4#V3E`dN*(m^NHU|K~z{>(HE?pPUW+GGu+hk z9V2(Uj-YS4YqsEzd54_DLGrN});yj0^Nwndj(c0(tWGkSQzUuD__X?fxITZa4H@G8_ zo=1ASvfAVi3vTI*J4n z2Z1IlKUIT%ZD>g03VM{zDXYwoZ<{PcW zRkT`YUaTqiGBcmd8~q47d-T1XWB@zb<)cq*XBg(Rv+AW2y}Pg);O_P5QFQA0#14He z9ms~bnqsH&*SpMdE9bW#*2nck@9% zzPoeT?A^R3&7@I#bp-|rJb!PUiX~8y1z2Yl95iOX%SyPMqcnL4PGIuMM1i(6;y@VP z>mitU@NulBYJBH8uk!Q^8fWjS?E)DgWC!}s7tXlw`HzGZ%#6L3B@bFs1}6y8#vk~O zSTHn`LOXC*hzb^wfq>PVJ58` z&9h{F0mUg0n2lRmRrwUTPlpe!pXk{OHaveh`4Hq)&OaVe{D?%`Re;AQJ(hbDVC4({ z{zLruY0Zp%bFQG6BKiF3pJgk{p%(Z{HQ>P*hoAx?kDsWzyiX8?%sKeY;r`t^P9=zk z&VypnC6$kKqk_w$O2^D;L6BXz2H??pkjgZ%R5Y*-v3>!}@Xdv`7}25wt= zYM2HdsNYfK?x=DsX5VYOwtX(YD!klXX8I5*LPF1Cv`(+u%3$U>s2m!UW7iqs-iTBr zDAb-aJ~8FKxC!@2N?+LLc=Rco+V?5pd#;*_6x`W3Vuwgd%t~FUUE5)KM7t(9gm8+z z&@GF9d-oBJ<5FJ$6H8#MN9L@C;uWCF?#OCc<^RaerC&@i}LT=-X{{Q11}+bN%G@ad!IQ z8ICNRzfjCa&&MM%F))E_{;^Ci<`D-)Up2D2LsN=QwAt_G!}sDLeP`BA`AK6X4d~Y{ z3Pyk+kpOG2JNLkZYxALVb%I)Pr^5(TCJU5=a{_ccJEig5!8^zNNjZ-_6`~{_#Hg2% zq|a4H%F#M#a0tl~2?}Plm3yh{5W*ucyHv3rMQw!g^s56Q(0t+y#(5PwMgicoo7ykv zc|;lp0FCgYAc%fhIkff$`=l|GfFv<#a*oP~;LDO+77;PlfaVIm;jSIYYpGDCWfRj1 z!ctn(u!;r6x9<2+W8Dg(Azrx)dWdFGwI{s4<<5}2$0lp$31@R57?%6R3byUW+K52A z%7Cj&B7HWHRH`fkO9EAx1`DPl)q{T86ekgB<h2*xlpfo4p(40|5*IRtP@ z<0FfZ*qR4~@l%U~=OcUNvakhA@--6sFCm5UP2*CNn8)MCF?YQYUwUGOSM*Q0Lr|hC z?NCb(?u5*No(sq38NkEQRS1Pa@&l%R%G zeo}77?R`>yJx1>}OSl_9X9?izr+ddk01;QR?uT+ATrq7m1w@O^^=w%NZJV=JmhT@3BlTK zYz1D`KMdrNLb7ev!&|3vMPnhCh-rSYc!xc1?KXTJNm+Afli_PF0+MYF?@g z{<9KvU4znOgR1w9H(8pn5e!bb_E+E9k>uzj21@LukV!2Afcy+wO&TY&U-s7M9{h@e zMB4Iwl%^LrE{9l|jR%jNQ9F9pmH&Otj9PrG>vQiKCa07K?qkfQ2JR~`^M_r*vB7u} zad!`7lD&BznM-^vbe@fRTMW-|GjjIj_^Qb^#l8Mr#K+RIL8e(O&d`U!A1g z;2MOjT!6A^Mo929Q$3`|pW~FUCAwItODR{;Qt=WBY@!6fVTuKeqkNB$bkBss>)hhlmmvGeouejCLd13Y3`Vj8`*!fK$?TWxQ}PQWpu~=oNeY^1u95_ga#v=p230Q z;k|B{Pvxu!buFc9L~dQ6p+}MCwh5S0bXxes;QZ5s&g_le485(>g@toKaj!s>$IJdy zIi5_-!91?%>OpW)mBNVW)y7-^p!4UAds;aWOap>gF=qj3g%`EAGU40{t3<$n-HQl7 zCMkk*%zaRmOG!{#x!0(l38XA@_3%JkA2lB#OybMeslK0g=fACdh#O=8#H8aY3M+b_ z;}YznTP8R|e;CPW!}ALYPH1UN%+D4#AyFpz;KFGCV_8ZSG4l`NZCps!#x8VX^Uv~F zRH0QHg*A|{w=49CO*kkD!ZN3b96Z!e`!El~)p$12ClyB{QkO*-C|9(yY0$FRm(jEn zWXZG7AYJPlniSx%d;vp69*rGx)FFCcyq6EwWkSDH^z!ap^prHYGSM~{oNsEKNDPoU zWOITbCZ6to<|~+yG!S#1A`eLzY_r2BM1kR=Z9?XO`y6g!{y9|1P&pa;BnJX44eBCP zcxY3G-77LfN*aXhaXOOU9h<+-L-G=Fik`aFR8!*_Pg{0EVelNJIqRxc8w1r#t9IE& zlTI_}(euokwrlbQsIDMs(V3%(dEiEoz5!GYetijBwE~YCc;~I%hF@$MHWR$YjxI(ZnZnjBY)LBHTDkf?O=PW$#$FW6Ml1ayEdO@zbs?Ii68B!vO zq|+}$BZjk7%eCpo#!5fapq*^jW~xnXCb*3*Nfnih_2_@fGrMWaRPTs}yEJ{a&}A$5 zG{SHq8O#%AwCdV)CY5vw?+{wwVIeoJ(IeKD?a3j}C#gnl8rcI5Zc%pxZbf*z=p^_xU{p924?u{{;O5vt?&jhMYngE~b0|zXDhaM=_ z-!D!sTPEN+GsBb|438b;at}XgPhjiiRu`pY4|^1jZy#~WV~$5+`xn|pEZ1ie(bT6; z(tYD8^$tXK;oUFg{p~lQAaV$#`Ih}N;a{`r*}#oFyz@~faF?p>#iYXeqT8G+q}0^}&^6i(Z%{DB&u>JWr9 zO%I&zj1E!SQa&){{0-^5cZQAaNnu4`8h?N^aS$|kdt#ZcFT0?-H&n!`fb=d>e{8%4 zz+0mbw3^tud-GYq8}R|+aFJR%YzA;i@~_JpdJCMRCtJY(=p7U3mEUF4X(TQ1s+B5c zC^Ll^+a*!4b*Cqp?{ByWti>@Mu&HG1k|{qr)zZuLoITu9t>D@ljI!9g6s%4~?Ur>~ zSKyJfTKVZ6T3v|OE-PB=mD3!3;)>*c*Z%-DU$x668@Am-)!I6acXi)(smQyw47AXI zxn;L?kMF+m-+1pZ=d#P1dRM*lPp_hrQ;ThRUE8|OnUJ^jtkU)5khY~y?5>X`)wz|F zz>#{&`gl9M2QqB*_9}Hf!lh_oj&9JY*K8|jY>+%;`%X5Mm&7GMgyfu!%vY!Zy@2zQAd*GVeBuLXfq+MPgCk_ksi zrrpAWVb1W?)B|i;Bx>>n&>#32W-b|F51=*m1Xr|0S!}Csg<(|?Si_4oKQd)2%Mcot zW8CCg`pKhAlk%&*PB`XYlcMu5OwqV@i!Ou(UdwU)-?|%$$-W0m!#u`%TUpM3deUiR z2M?8|k(#RB2R2t*HhlkG^YCJ8!ub?0$$S<6u0_3_HRqoC(7czaF_p8$9eLyjn#i@J zl^Zj`B4yjK(w}dk;A#wsz3;*fj}dCQHhGCcZm5o9caqFCe;CGZlrJTV5F5*i9kBPA z@;92uhO1O*+2X*C z(fHiOpxA7j?3gl(Eh34>lG)Z$9$C!J9Ho#E@T<3D7w<8ToJ-+&W~^Kt$H^__&(-o| z73-?O4{-*r!W)AN_A|Rl(Q(M0CRTEtC3Rd>f&D<<%c;X z-!GOl9UqVLp7_%yo1!Vu)~y-5Fux)md;L6MNxE` z&?upj@I|f^yfQ-ZI)+lyV@kZ;6xf|-qsr|YT5>O)B<9Q=RM%4R^^?=@D7oXmF!z?h zaRlkQrkI&oEoQZtnZaVTSQaxgGh0lSg%-0cX31h^S zRhgCWewo!BUsiVJvp?5EQ*g$8YQOxTg5Ei(yfjc`vTP$uvmN^2BzySUh)0z&?T|(< zIY4KTwT?XlKMTBb*(B?}eXF;&(I-{UH)(5dxnK3w@>`BF^$VhTt2Ud5+1Y(*dJq1z z^OlD|HK09EcY8Y{Q8twE<~@udD2vp7M4B@qaoeRexL}$so^~?l9$L@6TK3x*b79(U z8(~FiR4!-{^0R!3ZNTTPrSAosROw)hGA=*6Oq`ploqYK+5{Dkq$R$BAKF!9rYPrB) zOSXRJy-D14<|n%rDbr7Goyi;PS&^{6c34|)%B?sIYhb=LH6}VRxLz z&{J<B3>rkDur%PQ{XG?T)D_uQN!nH zhnjCMcQDK*axI4LN8YC@!db&3vK1nIir+Y46eLfxd)&$?u&%N5$v#tJi5j4i^7I!K zT}L*{buc4xw33=QQPc;>R7Tf@)+n>M^~~fJIG^Ek*D8DF8%akW=7;trJ-3jW8VtZwEp=Ff2exsOa`<>^_4}bGPnKnhmq~kwONa_{ZRy!#W)+SzkhlR~n@Y~J3Ktfn(|SFAC|9#>0e~(|{7~Qj2-7{}xDY+{70dqH z`gR?Oqkbo%y}o$@k=RsTY+DC*1nLuzHc0A*1RLV1fTq|N2iCmnXbx8_yvIn=Eu{a3 zt{Q=ZkcYOZG(yD7)1j>rw7^Oy8_@O)pp`05;|?>g!#uwGLFrrOBR0083Xg{N1xFz3 z$nli?W6JOu&#SyHt`MqbKa>S>wWcbVda&VuTfC}6lSn~7vXJ$AhTS0#ecDEk{MnsF zfGQswBrXl5qu~$KR|M5>d_akhXD;Dnxk4}&W0Bw}Z-msL z3TtC$KH3X~S1v0@Rg~MHeWM!ni`UswbCI7~DJ98>0&Gl)QEXM*jFVVYRZ@C!Stya~ zNhFi zryErVxEFvS4%*PPvk7Q#Z`C9O^iw&QBpl?aR za*fb&`a(E=a#|0u6bLCN+4E3MKw>BbL0uFm7}$$Z1InFVw?W`cm+W)BV6?>wEm5p^ zM9(W;5}i!SZSJ(6{st~E)~CmtLCiM+Y)2uy)oHTL@vBRyv6Li?fIi78 zTWGETQi8cL;`DHP2GPj=pcUTWA%b1UT{)Zg_p&yc7%4|mJKf)#?yfE$}VH*7dCRz#2@|J+aIAtVd1umMG35YWd&N}o7f(k%m zLZs;-BWRW>*CRC$iIYALU&>R+h(${4Qcsg;RgxXdZ21ME@>Dd$JL_dc&y#!=LcUPVG(D03_1RncO4F>mu9lqD6Zot>-=Of$3w=8Gfuaya# zQz<`=!JJHfWSayuzY{&{S9h(v_y6v+55OgI2#~(K0WQ=G!yEL~}SXHdUeQoo>T~l{(FYPJ~5GF2x8p0=}kw zk}`Q?wqu1)xaPA$Pd89ZhOPH!$^GaSl6cr53Zjk~?EQIls~v$thy6-E8MH1BacCtnR`A*o(S5gsP!N5{lBSXx#wJN)hH z#hT*?5;+>ALX5`eNu zFRJNn%0jLD3YZnX0Xn5VxV;*yGA2ciu66TTC@bSnA{`G7W>siXLkKk=YfL{2<8V`R zqd8`wxWR>#FKRgfm6C1=zY-^q#W5MD)0PXB)8RE@5PSop?IhPqsu=j06Ya|h1Z;^8UVH4{*CH z4(96?kjm}EF*UEzsqI%kv7C=|G?ln%4H8XRudGC$7C+I*cC)3-Y73u;=h|1k&AtZ7 z$6-Whp+Sbc=*(d{nD>Q=2rU^sT3eI|ovJQiL9PyF^+zrdOf9DzbZ!CNIWj<2=c8ex zaAz16&QU#;qYZfIPlruUY9)CjfoHgMn_S0f@%4{GiI~k~bNSjF^ z;Jh_|*|P>`>apgCgO_jqdSS-%Yr<5!X~Tvj&y};-%_(V(n+IHcCI`)y@?BLil5ba( z3{p3rmJN1J3jo%b+$;My&=`8?@R<%4!9wHmGv53i1yAXnVxGuF5UVccnaM_y#yYE zPTf9icnUcaZhoB3b-j-;UFai+SH4_7K#SS*hJ0S>Ud?{iU3y*DZCq|&c%^KPk7uj) zN>Z$fuBW>Q$b7d;3#70NnUe{BKROGL%V9 zzOLE4&uG6_7*))qD9s8U^XgOxdh@Oa`U#w*Ro)*rhMPTr=E7eW;YAP={a}j7)pZ=8 z@63((8SWk#ID0BU3bzq+e7XpgvfZyCC#hHkO|9 z(l{8ItsB0|hG#SFM^ zb+oK}75ccW-yt5HKBmcH#D&|$<02o(uDxMN7uPhopR-)}GdSstN8)2$aXQaeGP068 ztR}pDHx-@Zw4mN46YC@HUU2aVYPq`wewRBua0J+pU3htLKIGGy@0M}qLIM?{TDXvC z`aFf8q;>SaxkSa?X<(%?Te`YB!cE(s5?#`Kg^9=!IYXotz&<(r6dvO+z4f+7nk(gO zqBLbM&+6Wo@h^SczKMe##;aP)!5hc5`O#?bq03{J-gIG2dXPmhWbv`YKr>T(bPKdvz@Sx8HkjUE9$6A(0br}y$pU6Iz!?}j&8 zT}KBjpAUY9&vl9y8>RRLD9*?&SgODm(*UL#It zvjRAN+U+X~_A2|x9u?lA?~zK!{mwhtqrisx!bKL?gfWSmPh}OUdY+RfvtQ8MO# zIUj2ScL8d43&SNef(ff)*I1hgYu!nkF*Un(JWqUuZvSNonQoR{0u zAfagneM|LsR%Vky???kM5pAe&II@lOxrA()&J6ANVpOq|?bG0%#$5xKc8YU2xEUO; z)H0h(Sv6etO2=Oijz(X5Y~NaoS$qB!dpVbWIdd{Tm=`SO{>kw{V(W8H;BioI@>j0U z7pUlkFzOKbcQ-ixHjUB5NFpM};{qXHFl;0N(z#AncgH&9nv=h!C0N@e(cls?Yww># zj0ctc7cVqt&OJHjlLBn?;g?y!9D1-j%rQH{)I6NE`*$b#SGFP+28E_sUGGaBnroD0 zIx_6;7X`T$cZSzH?O?_}61c;j!r5+e0l4&JdT1~JJR(s?! zxE)t?HMRH7vi;5BH)RtT=~4Qnp~#}J=XE%pJJpJkRa;JW3=cxgvd&Vz$T`yIax4w;{jGnLF3#%zG!vl&X1GDht%<3i9yf68i%Ce zX_PHR?3b58X8$y_U^Wnq3bLmsR`Ah)@d;HT_DzB&aPX3uuV1-I&sC4*q&6+F~E zOq5rwpr;kl z`@UZ2Nj!NRz3_7la;)4g_M6Ne*K z&{NJKqlXESc2|S)s(L^!NDkN(s#d6kMMTV5`)=37l)EpFDyxrF}ssb z5r>g&z;bfoSL;J^>HWSau9#j-vCsxylQkE+1SSd z1}Q|MBncT|yY#Z(H6v;i#*!O?RCqqtym;kgbm8?v8NGXIbmz_Q zYc6~&l{ZQE;W5={Y9Lfd`rT5u;<%YNJF$w#jmlAwZhnH(WOaG;P2%L`3&mjVIPkO+ z_nh&zF{oi=3o=|p)k(iny|5eZ=g;1>M~&bp`7gNkY!bevy)+RUa*kvMn;R?^77V)y zQl-TlNz1_|EQG!p%Rmjs5$M7uYar$}ErztTB(U9%9iJt6eCSWyAr&8{(6VYLr zF9O`X`bQ6d4r4f`(=^elV`1T|V7=&L*7CiH%NRn1kzKb@Ff+@0F%N;c01I>40?RL| z&1AsBZV?k;W3Ra6evDgNqJA24he;<2ouV;Z!#kZrH(UNd38K#Y z?JU5xcq8tO?lYh-dCPOsd-_jlkae^F^ZO%j9729EfX~z_1oU4%C!| zsed2D73Md^^shrsp!u0WByWK3FoR?=W8Xqg)h8ME(Sv9w?}>!9l%|OX^suLh3q26i zp&<@?|5#jjKt}T}e%=o%D+Op$YUFQ~9Yw1skOJtb%J7lOOmy}toXE->eNf9ivoLsF zAYYyCrU2@9lZL0v9bv;u)TSbFACu+U^I##>(u4`msNYmZ(}rQZqE5hd^X7>f?hO$<&VpQaIuP7mmweV!;&a|@thxg&qehvpsZ zEZV;B3mv&P+MLxj*#l?|_u?n~x5*s3yJy42aG<@yFUe5G+dV_^Bz6t=n(0<;a6rHC zSwMh=`6tA<9aq7u6sR zWWJl0Hv&AXfG(nc=awCFyOx}D^``c1&~oc?>vNoiWG-fWXqny$7YMVSL~yofZ$vv8 zM(+~H1e7-g6)YooO!3KS#sFX0inQ>SO$Au@J&49HIEqJ^0sYi7uUqKc*iA}#9*vi$)Ms)zJC?Q1=##Dv;3*xqF#${1F}3^!EtQ) z5S%v&&l~S~bj>r+p%aHw(jJn|OaLoR&bL(|)AfZ=B>D6}m!h+Q+V_2i$1QLxz(ZeN z>E+%_C-gGw3>l#)6rY8YIYnVG;tjcp9wl#fsm(a$?A+eDm)0jvbgeerF7YDaM>7TG z&Hi$iSekKWN!opZMq$_F_Pa4f337)}NT}Lm->QPw6-Ft6;`5nyb6-~dbmOy4Tc&SbSgO0V!-Mks&T2<$SmU!uKCye%d#lJLHTy^t zSHYR0@Fd+MX zf>$8RkX*8n{-|b3YmATE7#d!4b73Qu6xCFJK<@0&j_*K>dK>f-th(o?_DqDnN$s9( z>Sr_BWx&(Tv#*#bK0f6-%dT;LwOt=hatmQU(;JB~$oPd{S1~dvud^iKDpoTI0}#M4 zo~M8aubM8IH*WOSONkWtH21MPRf5q0de2n1h>s;#slT^U#3k8THfOI!^sz?fmy7So z2(nNUKal7o_x-1)&WtSQAkxXs#ntN*{4$jqq}=_07X_9mkyub=FCJ*VwXtb|lR38R z-ZJv+Qsuo&ghG`dNL>ZLY*x;zhO-o{;^?Y)`SGK+_U%hJdBo!c9gcrvenqKZ;Caj= z6kTFbA0>XT#Yl9xO6=ql9?HIxwh(#^v-wyLZ`kdwF#g3StmgD0%pfR0^~q2HQz)oA z&?3kF)udCpHjHkagvGHBYOF!>91Z&?1!XkwXTT6|d{h-qM3_^k%;ZQrei8Sz+tp4h zOWdQ1=@{8T!LWxYPop|kgK#k*976ot7e`h8YDUNvrWGG1H8T2;09bsisKKV?mHvIn zNsrCvc{`uoJ>9oA(gKHoAwcft#Fwig{ulyM4fxhJ>K0b0jaNPCr!9(4q=GEXxzg_k z!ReM1x>L4}-dFDeM__;!$#eXUXZ6`n=MA`(er&tZG?nt`IiFRmp+VNTXDytRf#9)Q zx%7VG_hX4#t_k>dI0B2vW2NegH;)2`TH2|4(NJ@dZ3{yyH#~%Tn#USgKgvG&KrJSu zuDbc05X)@`CGSP|-^ZNFIrnjzAknKBYm6iIb^Jnl`cC+zvZ90#Eab#<2FbxStg*fS zCblr;wnR|6S`h3v?`PYRX!h)}3D1xmh&$bxh5eO-^kW_sn#A^i3n!9vK3hs?tB%x6 z%~>QW@dkMq+`iW_0E>4XX>%h<%Q*Q(+Xb7I+>g(Xp336|=2rBKu&`|cSPtGi-w9$4 zm!l}BQwh~+4z!=e##dnPV?Gw;GpTKvJ_G8k>ul__1BbiHuFOhV6G=yCM*$8!{lt>}ff`-jX16Y|R>_Ud{JR9z+LNGr-^sa}=bFQkKy}Tg`Saf8l*s zfHjO$spu}^n2KRm+#i6|HmEh@`z6P-l(*j#GeA;G^~CKd&~V!1*YuSr4vgD+;}!OJ zQ!}>5KAe4Wt{gdkD5FpaJ(opLA%q1Tam!bk*dqaNhwpbzv4Ewzzq{WeS_+9-+wak; zaQrDRIea=0QK=dRLrxjZ)h-Mk+pf=)EqxIcLXBvv9Agtq#vQiJDK4Nrxe`oDws{i#O@Tpp z+isAURY*TcW1OB*4Omtyb4J4Ug|j1~8Q#v_7eo6Cz1mKt>oS&UTyP5*S?ak0A!t@J zx-R#auSwl%^{__?h*a<`MQGwN+w5B#wMhHs136EYG+a``#clrd_0uZh=&Jf`QiEs^ zJ)^ufCG;H6`Fr{6gBY8xcZD=kT%RBy)&oRTj2H2D^7R4jbs;ZGcWFeW=6EX*%o|Zx z@bJH8)3-qNRbIB)Y!wqxUp9Nwe3!x+osK8t+OAl&@U)1Bfjt-5wCA-&@Q8P|{@5*sQ> z$oahShcfGq;k|!;ycG=XZCA`2Ktm3U2X%z!(cFlHpon%uuLtX00HnRHyHi24M1byk zss^lY!^#vEAdqGBHJIg9c%I#QCb2UZp1Hyo-@(@}F0@axV2B2E%`3r?GdP!^Yom=Y zgA(&}$olYy8EQ%TF^>*lh6G31Co zN*j{cO`C;^o56NakxxwDZ@MkVe=0~#d#7_-<`0w(>doM+4D)Q%W!yGj0SUqZ5dvPA zTZ62eq;EkTBxgU3N^62zQ2Iwpgy1YoX~UNM96x7f`yFzUo@+u9k1$v$-snAt%nFM3U> z5!mk9ULSW&tO=0JrW;pz9_!jOCMt$$%qZvTz)^p?r!gOS3FMdWFeA_cb4L&9^l_0w zZC+M$=-}0w8be#P3sxsJTjX+PI9U|uJ=?YJ6ZvXB!;*QM6AJwdrSm7hXve>mQ)|WX zE|rR*UC~xZ$bF!gb}A;wHzFHUq*^kAfns0{1WRm>Mbe(TRnj*{=%S3@_#H%U2|oUR z#^_D&K~YY9HK-$`r#+2gnCQB;K*D0~-?C120xRm9&zk#zjHx2B2uO|6ixh+624u(?@Zy@5|%hso65)cP#si3Tom&-bVi||`UXD)qj$}+N(D_)$;klkr;GAXL5GIKDO6w z;!}KhZjd&AMaqx2itZ-r^h5953xq(|tc3Smi)MSq+K_1qtKVP+c|A{$8$`r3D^u+| z4Dua%r{KupV9Gy({T(74T&HzV-e=xS%ehD04JCh0B+2`F#yXMDJLY>84cKdEdk)bo z@epsf%%_9P8gTReyx~f9w%=%n<=TdmzW6<}ywLbYwuNYd#7QD=64t)cPy@YHtM$74 z`Fw<5VLzSEr?}(WH!_d`)1G)%M=3|P+Z4U!f>^r)QZfObAkWcxI~KnkK(@1iSBG$% zNFp)|`ypl$AClzArxx_EXMBl-n^OZn{f|Eg@`Y)`n`&#IPkK;vVLwdzg~xiGq`q81 zwwre>?F2+!oij{3Bg75tdl<~TTD9#^+cBW#Fd1ubOjE@_(ouUzemjoN>xHvt_(pO0 z!|7dnm`A`cchhm>0QP$h;F2)GB*@A^Uwz^W-pY{ci5@hVWod3)c#r7yJIzD zw6MGkCZYaQS33C%MoAfx&u#5&kMVh!MCEYgg`0b7RK99zWC0(<-i#ajNZ|ylXc1H=$yuSSaQWeu81ZeomN?86>HSS~Bpz^Zr9oB6;o50Gj0S$KC6so_NS|#s z;}`tIU6Nu`1q20VV*#9G8)oBP9@SfK-(_R@v!}vDdEP{+3^!cy$Kyt)p^DH)DxM}Q zTc7QQgQlIxUuf|V@TX88y8}y{+>?SHjj>$bEAjKu-&{16gbl#6G&4~7BO6Aggdczp zxocxwopL|g_w_>Sy=HCJ?IE6;#Axu>IfNmVFdkBV$~1RT;}RK$wDKz-pm9figih1XUjB+$8&SRSs;W{nXInTGClTM;NQssDt41P|!2n2PvgVH4V`9xZmg1j#@wlB0H5{I8}rb_pH<&GD$=|-|zDYLAdTI)1j}NUu06!vt7OPHbE-Z zhS^CHwHqMs$4KX_6^bzPD}gZ=TW%b5i}2cuKWqc(pzMy(*iYX&*=Fnrjf6Y_1 zH{a1}0j|LrWBKA8)@`?exygJ=VlzH`HeK@B{?5^>VzgNUGbLmFx|xSnmBX!59<&`oUf2D`iZ4rRQB5 zPc*x#5FITBYKp$L_<;TEQi)Lchz6Wayl@ZH1Z$Yxlpx=dE?!?feQ14?qG8lLyIE4m z0C06E-hly!oR|ds7r7o$|#F)uxGwBK7nJ){)Qo4`}J zYOsAGP`KB(gD;Wp4aVH-o}qRValso%JbVYxN0D2rN<2IJY7W9;sVzTAwsL-h`Nm$F z#n|m#I<`agy>cygpZKmi(@f`8l%KC4U{^4Fi*lFP*Wdtk!7Iu#rguiACtYriy=<*6 zv@QD#iI_4|Q@yT5lbvqbYdO2@Ym2L%M(Q-fFTMmcG@d7X}SA zL1)&A&E(I1uLj9NQt-six ze-V-X=dic_P>B9VsQOQs6z6|%iT*H>{u`11pR>3Az?%Ml*7Kju#q}S}^#^G6FL{62 zTM~A*&cJ`&bAMu(fFg!YCV!(vM8)LA#pzT`KIX*Kq!~o)tc`)49(Ei`A;?{06Wu1Ey_SuJ2hL2kJKgr7B*&J@{`IpfDR?xq+i%N_Asr`=$EWrP5+DEjiousswoT2^yk_;5n05CH# zF#$g=s(3g#o7hO(n%V)_|7ryODdmqvju!ULc8&n{Ke#gG54hcj5&uMc{hQ1`S^gzc z!O_^n@uO*||J5`!fDd?{nT3JHPX!+WMD48Y998TMjZ8j_bG0xsQI-?|idZ;1DVjKn+S%CK z+5Rz}3n*>tY~pBdXKm10%d3lB9rH z5^@~uz<_Fu-=!OJ(}E`i^_dfk?sBMBo!&MXW|W707&UrM~nnxoRT zo}Rh@J_%>-MOpn8s7;vI>^>zWCClBumx9O}w8 z=E~tak4P}r0~SfUJ`?6{-4eKi_fOOA&5TqgQA@cNz;@MfR8%#|f9qLqOnGdy-Fccq zAh}F3+{u!WkT8s*Yq;JMf&ha!?-^2El^)Rls$!P`zq~PP^|#aMuA*?K4x$7UgPJQ8S#C33gLO%eB+&#{Dk-?#PeBYuI30u5s4J_a zUQQyR0YfytO5CePu%ocm=Crr34By*=gBFsB8ew4&VCRLbJ%Uto9FZSpM9-(d$E(F^ z3)c)2(pJchaWuH@AW1;c-@JQ2NsUyz%z_+30W)(KIM?<;jX{&KF`*Py;oA7@;%ow z6=@MZyu0P?!O?tET&v7`J`vXBAc0Zf*x-a8Hvb{WL8j_&Xw|54<@bsUjREa`{Uq>% zK1|fz9$PBacgV;i9a(PaQ0x!1iiZ^VG^$NrLZ45Ea(coS$5H>kjFFtDa8{k&ar2qtNjhj3)6wDx*%*j7ZXNDXXv=Jum6+tYC#To&k*U#8x_+L}UpdLKJWLPnz<)PK8 z7>WU_hBmym9u^R68;UGGIzol&izkr-9HHoq`SovI-c~J}ZLOst5Unj*GY*#f1 z-Oe-8{uXlHkW;CWO`*H(4{b3skFJSpJ8j#?Ip&vHb?~Hbg>irOjv8P0YHi!I$ZmU5p#c3**>+%mgE>%NSiz0}@gI7yRIrb7L8QjsPcH15DGgtD2r$fYZVzN)C^R z7tH%&Pr044;z1h)z@haJjGR7DE+u|XLeNB>NE8?VuvwJC1d@Ex$_ z6~X4Je#Oh|n=ypBXo*;EnBwu}K!}$cC5LRCt3VC#h?`pNg;rW~NbXKQ5+;oKO8Aij zJG(6$^C}qKYDjp~P&jW2b}*gKXn70gFr3ajdaB3!N(e($79`~SBJiW$p0$-NJx~Eb z!_l&sN=UUr^|ce3718PCXOj74M?N(_x9@;za&+bJBZrMhX*r*_8M9IQ%K_7qtrgw4 zSCQJ9!~P<^u4QMOUUD&JnW=;U7-$8`unTQdVxKck$A3or0%%i5s-9##kEIBGI-KcS6mv|54rS}v z#9XcyGq^Cy)0MATUmA45dnH|jM6hDg^ZE65d+#9~8D~8wL)z@Glh1bVMOB3mv^GhM zobKz^b+sfoCirZQlA@(p8XsH8z42YrLj8<`-YqLF41()Dq0dY-eXdC5JSDvJP!YU-vV zuG}`AH(7c8ZXTwm^h*ltWQxaiRr(pz3@0IpS{Z`6K5JqAEO$4f+8k8s;(R8fdH%g+ z`{5`&*thbW+)!?il8c95Q`D?E;8Xos!|HGmEms|VSDf^#<=>0b^FDHQI zFDv)|4ACoR;%vyl4ET8c@#z1CSO6UV9GL(W9qo)%Oq{iWieeH#RTFpTe;|ED{&5if z$3a>b@WHqiwzai$cKR5%{DaWT{+H1E;R^pL7r^m%^z(nj>t+9k`2Tl!z1;udR{#6p z{r}nBW#;B&`#V7V-~R52&!Qv6K+OU#*#q*c`xBJIY`xpM;vmtOVv?=-D6^SyNY4#8 z)Ur^oYmGhI3)y>tQ(3|D4Hz3hTR0PYL)FE_MO|Ip^w0Y?!)?ya?>VEf>iwqB@`KuY zbZ@7p@&0(LAvb58QOLYzr4}NuA!DVzn&tgEr~h8j61cy-Q97aTcbjp()_Qb;r2lYs zTt%z)DhcWLrfvxRdcWrPI_DRLwcg>QtJcSv?2XQIwKCOEtLt)itI^<)Tw`cO2d=9r z+5Y`)S&F#DA3xVN$r7I*!XNbg6&mCTxl~#1cJt=AN;Sm4beOhrE|-PGdb5_8v4+Y9 z{8zW2f%ChS(J{CU=dxCroSIdqhXyfDV>5pVvTAK}iAybaa5kLPCuljOy2bCJG0Qr0 zwoY33watB4rcN5f&KX{w=Xbdr89$cTlzod!M&5OO9%8FHpYD3NmPQl9tiwcI3m5Sk z*>?P@)NMmH15T7q!pzguL;V-xkPNIk1W>W;5VF;6m1xl0GbkM&XhNyr{i$bf9v?4>?+Sq76 zjx(!iz-u;43^b2raMeP>&1+?NuNWGe0oYWXS#S)~k& z4gh<%lfMwJOo>oMMT}0+KG3q$>+ZD?FwiDH``YQ2y8nJ>_E3S_h|mQa6vFVPEczHG zDC*LaI6No#%Pkol5Mdb^>x6z3YY`>+00rUz0wdt9p~72iN}IIv)e1u-$@-na97bfszP!CFb?+*`I#L^tA0y4sgBs#S$cv#w^Sfj z$=LdikDzJkf!?o)WbQHQoED>pjie9#G$6&sVGl-!l^4$V4 z=W?r$@h33TQF43OG9kwCO^?SxCFSC?Ki$J8!UQ_`N25pqx9R%29)hw_4IwQ{Cbk}Z zpo$~OXf87MSrlHy0}n_xzfvao>9Ja0kJNkJ;n~|n9XlE#PF}px*;~Pzhki!kF^d=K z+8VS7e4s*UK@urt6V;Ie+DSs+zU^Jm(pirAI-FzQckXPRRe|3gf8OZhpg+q60g<#6 zHOHG}wyw1?90QB)IBo#tFj}3b)z_5@AyRb@!t4%)lWpija-LC!ZFHE_MK2|@K50aH zLe_?M|Is+saOz4I9i~B`!FA-PX*f2&q-BpzIN6igKbY{8*{3LBN7UUP!x&4kOJn5U>fL~ zT5Tw{I!X!5^#-5^TqzuagJ)D>d9#qKRi70C4Mt4=WK{u)PSxFgA)%%;GtlCO_ zD5Z5w8-oC|r19LV5?OTI0kNm7VV zBD$!8{t(rxYCcixQA~BB?J^>2t%59mrT`9(J2vzRM>PmI>K_*9qdIy0r}MW&jkKLh zsG(6=9+$nyZcPpfLVe1C>2zCh4{H7drXN5NgCN1^K`Lr@X%-?`HsY~QRx4_d3wYgB z@fT`25#8+x5p*QfvhW1q1b|;?oc(BldHxu3zU7UC?5^@ELnv}|2LX6=Bs*B95VGIq z+nJe)swEE%KH+Il*V`P(dM<+q{z?ep+(aZtrs>wVGcqb8L;j(`OV3W?V!c#>$RPr{ z4q0D_hyXb%m_*;5FTDr~W|?0j(EuVwtaSpf&d0!4#YPfT4x!5PWt1k77~C-Ug?60p zw%h})hEx&qrF9UKt5HB51euN6&AD8W4P(P;mOoZjsasiPY$Zx4cU*PD!m7EK^(Yy` z7>+lYXv^84yZ4bCMC4Z}#i*qX+E1P|c|utx8oh#k&D;ho*hKxl$Jqeh22GJ68X=r- zXX9=VkQc@P#8svnfn;O*7I%bj0FR|PNHAOekA6(|P&hNS05gE>Dg~eR*0w}JI^fL8 z;T&nzP1W&(JT|{2%-#$L5UTE@H$FXh0Nr2 zQegf@{In*X&Z$2{ri^4XX4%LF`_IYp85@zJJ7dB85B1Xs<@2} zf~63y4_=Cv1+F@9xVxW4E{v1Gk261=w$Qs4kcuJyTbqe(ohMBbP4n!q# zOJrIwB6E+rK^_z-Eh&adFB%fBS&O7P1Vk2HUrcQKWygtL7jL?l0DN@8W3anju>q1$ zNR*6(Op7=!4ndocdly1_gVjw4k%4ZwN?ri?7s+bJAVb{}@c4o+u!nAQ9rz- z^%{82B@p<3<;6xlM5CHbQ6x&TU{5^G5A2ONv+}b-IFu%1p-<4YtAy zK?fs%XAvAFdawZ8a(3W`TL}+TM1;@wVkbMXrKd;@qheH0zmjl-{9gctKzhF+<7lj{ zZCh~2x10L!)tk z&0s_8RwN#j4YMtvUM%?n1V?%lgC~u-%MOeL9+VoA8jWxeqmU0oF$5)T^N_iuamJ-Bmm5?8 zpv23-w~k6yMfD(dOiV$caDh^wMbzRp14@V+SW-b|MH4dxy|48IB+3ie(gYz5BIm}n zX|{QJwoFH@O3EU$DQ_ayNR4#3sF84KiJMMPNN?#j#J2QQwe--@iw&WSOQ6WPL_%Ca ztb_>+N=@4_Y3f*tbgc7ZP3kG|Bxk5(RH^16UR+cH5rNd!wOrC|$+55^LUobKz(ZP- z%3R@ftgxgYbcUy(W$l1SpYV^$tuQX00u&a3C!}LpLa!PU7F^1Bj!!M>f~jM-CAp$I zL9@qYErJG1#wPVtN`Q8!V`C9Jo*OHoiblD#08uIF;sW$ULP7I#YKSW}Ru7og9Gi=l zMU?maYLxfbvo7U5e%B;< zk4vCS5*-KI+rL;XJA8gjEH4UtUVQAyx)sSx;5Ap+kra}t?Pyrq=+ zXc~&BLVYr!wU1;G`MhN;L_UtfrPYRLv`MHVcL}A;N4%=^nCC1l)J`@^X$7&;BSN3( zE(v`u6+&MsSm^VcQR;KYh13^X5!uZ!MY)b3yHf05sbaUByRde;i$scSfQ|NaBqcQ@>D|22ui?Kr6f=z z=HugbOHVZsM4&BBi))*j2DHkeWeGP_@Sn^~mKLq2rXU`S(4i+i0sf+PMp(j*zz?}*vn2Y?%u%a-)(vWs5idTRhn78yRaBX(3tiVCy%plWElF5-#qL5q8 zh%Gxl7H*2Dba7`DL?Lx(KuGo<$5t1Sa<~{+=B2iQw`HOXN(Bk_SSH5gLo7R5kf!0z z#ry-bj3pM5s`IgT)g>hYN=@G8I3p}CaztmMc}N~JGu0|kNwor%v~8%ZCn!+W#ZrfA zq?A~FI+Ep`w)k;O-FOAh)+Cov$*R0R@7SMreEp2`j>nv8?9VR#zn)#}Pbl^$6#Em3 z=bljP&mn%z=MekThW%;7zs_mH{!C$irm#O#*q`9vOi|oAG7R_ zS@y>)`(u{Uf6TH!X4xOJ?2lRY$1Gp( zk6Hdjj#*Y8rmQb-62~9m$+5!xAXXSEKAK{MxtUmDf57N&C-s5F=x(OL$Z5u7 zoHLBbc3>1#XooR(DJCoY)U`632LEVytA(HQ@xgSP4su!!c4~kVD%26_hn@-Cq`TsL z$~Z%P@QlOK=02>R@54Mj`XE%RLF878f>|{k+5Q-phJ#J>55gtJoK>4obtj>l?|oTul+ys@Q~r8Qc1x-BcLnR&P!*vRvh__0}L=2HrE);x`QELgg_1x zy}7@xaENc=3C8Y2M0pxyx4FJUq+FjOQtmO1-{y_P{Ud}Oc>YD*A46Xam$7^5`W4lE zcvn4OKX)=08sC8O89k+juPGk%6@G`hMKI0)zy~Z~cL+DYa9&$!Mz6iCm68~}2VUCX zYXSuhf!bZ))*PpK^Bu;jl)*h1riPmjKBDs6YLVL-8S9qNBi zz{I=Tlbb`PmIEZvh0(j7lK_efwpn)#o^`-B81x8>8cI9E;{1x)?|MT8q1IMT)A{sN zWNP627!DGKR=q}g|Ab_F4NLRD3je8&hyz|n1W1YvBcBc6&-su1PFIR~-G_Y~E8v3=wOa&CfA> zEV3csI9ndi0&>?x;~t|YJm{N5?YFgOtS}}Bl?3C7gv~v`(6AU5SK^=F*M3mTEmJ}O z#+>va0bh|TY0WslhrxIJCOx`CgrhLl!D-5tKy??YnhoCVwED+ zn>a9@q*MG>8o?WpQPA@#HHv}tBaIYONH4s?><1r6A$wQbl1$PoGYDf~38n|4o?DKT zyg&wP0#c8WL1QP0AZCWJmY|hkD<^Y7KhGs5GEwqE+J&bpdu{--!Z`JM4(Q)D&F{nS z764fj>vsrsSWb%O}x6*)UCeg+i6;b2Nh49x|{=j5c z_=BmPK71j%R)q1WR-`{!S@%>)&=w5pRMt#fgDeiHDOEB=AMq{zR9f;gY!~;Z5qhy*QP^QUmMh3z>J}q_uRvQtui?sW6MR#Xm3i*MW z?WQL|kdQ`HV3i)FQU6TDNk4fAUuxS7xnad*+n4Z#vQemY_!3FFjJ-l3;CC)Ey6J1o zB6I%{mwm<;6-jQL9x!iDU+DD}0V;-L;+G5NoAbI;()TC#(T=f{ zh{Se-ExEI>8KsRkNHo{ml8-zZ+mgGdD`pd0a?B#6Rlt+#r3E-#h@>i3kBNP<48H5_D+^gsNTwp&T2#ju2K;<;UUG8-Mx$`cXAjp& zG$n=J=IysF1PwiZs9SnBiJpW48 z7+M>6%6Oa84lNdK(Xaq>e5SJIG~7ZlnlAAa0mL=!>3K9o7d_SNiXc5hO>lAMpRZxX znGZf0e|Bg7^Ld<+PXycqmfof*qmd`IHSiSh&(ow zg?PH6^^X0lfFOhRXfhcuyId2r3#RB8pKa%C#>yDX;6CRMdun>1Z)8qH72GjW-SFD75{P-@Y0#)^b$W zSz|ZzePxwWM7EZEtfx@M22>QhcdXfAQq_VTabB(vU`=@+6I+E4pRgSFMeAc`gsua! z_qt3QC96=)&&zZLPS$_E>rDhwz#|@WA)vw7k zH;Q@VQCv@9o{@5Wi9(C^0*w4CIk_aX+0uYR`DhO)A+0ZG=DNa@lCimXO@uATJgvQn ziQ;@Y)4eZ9W6pvqI$I~-ZDu1LF> z#=zi@%|J0}2`%&^WvA|QALfP+h;{rHcl^0_^42ee#$sczfTA_qmoXHDj&2rD`}-hc zL||zX?K_rwM4Sb%J|>!sqIygoB!2I^w8?uBejjP=n>r;U#RmemfZ}~InG-^30q1Kr z4x>14=>p{x&Ue=~D#M@$2aRjn`=|oLU}S9%4_V_%+g;m6N#%3b_5!Y+u2H)Iu0WOE z>IGaq=A6>6IqDyRLdLjRSgHdww^%Z_+%1yQ)AeUHgemZSuz6bgp7za}j`XeU^bh5H z+>`ym;$o$J6SO*$o$5UF;rTkKM$Wthd^`aBxCGA{pT7Y-3e}b+fEE$6N?#fPLO~Fo z3&=~UG$FKeDowd5I3CFTB>a%u;8c$66R^QIWK1P)hFx5POpGj^vl7!5>o~DIHiJcG z_C`=cFFdv$0{eU(cqi5AuN}I+m%ZP!Sp1PU$!!am(pYcto9jAW?44!P*L;X zwAaA=e>$vvv12Ocfjc7oFzu$(^d?Q|`U^SpW^E{or7UC9Y~gFgUO07EXaZMR7C%N! z46AgYiH%tBbmMbQRdl1f3)+g@v&!RTPqF~_i|G-zo3TH>r0RB7%PP3$-6(6YoUc5< zz5|fbmYZr`l?6qeC4v~;?ChvxNRYjaPH;Wnv)zr(0?yZ1_{MRrXRQ5GTdfKH*xPF1 z;And=u8t*6wMHEaPuGEV)G@keIY0i#sAJ*zrbC4{^~@|Nq>ZWWaoSk>bbV$=8^fqk z^C10$l(BY|IjRqQOP(V0z&}(Xa_T%hi+Fjy3WUx~?b4(!!ts0+Ky{k# z&d$Oyr;05=_+qvMjJGfeU||XIVhtg-KGX)&9$vJ;gT(H3)Il+^Gjsf|R^7OeddGf9 z7kIXsx7Ecym(?QF?}myIe7k_CkU;b(A2?*Y(BUKQva~Oz0bqQQS&TEtbUebs=s2mh z7l{2_IcbUPQ+ZaLkRb0%7QqL5dHcA4xR*NK#JFnH8ai)@a2cJ|ZMn-_@*nC} z8DJ)MJ`^)_ZWqD38a`pL()`X96JM;-psBk!nigawl^*FaDbU{@7 zJK`x1ZKe2mao|Hu@0iG(^hn>%ecaR`9&O>0zhOz^xQ_N}#YtE`Hu@;1X7q7tdrYnw zID}(5ThsE8+jHH*)I47ui_@Y}37VRhEQDkWc3Z1Znpiw85yXbDMs3F!2rUmJx&9tM z+fov5+OfyyHj$;3hvSpdBX08XMLPZD6D#s)bp2z9CL#p|uzYjl0*a_?sd;vAD(0#1K|nqxw@4mPB$h{Oqe48nNQ~^PhsO+0+gNum zWoh&Qqj3Ba?yT7>qkoh)Y0NBaDLb$|#=WCkbNgg;H@AS#C+|fU;C}udLMsXZHVZe# z!)ROD)&E#8;&PRiJtZX#1>#-13+!G>%k+)Q&iyOkNTDh)>NxaD;X4e4`)pN*agQ+U zI0k<7P|XkC zu!6qlEk&8bLwf9(qCmlC=$SM&@E9~u6}T^SB55$%Paoo==?L{*)Z~7}V^mF42R(&K zBhVTi}yVUAFUKH-n*r6nOw#K2CVBa zK(fd9RoqD{?~yk=!s7|co`LhOkCRy}sy!B80E=rhuYULyuN8hW1dp+c`34MKdLa(? z3Vmgd={V++l=}19EuXol#{B9S!JbZ^L#J!Zvi~pW)D;4{f9uP)6ebhXY+M#4oLG-R zJww$x#e@lS>tgAM1Fm=zD_o1-nDn0fq*<2Vc%M7AM}jh`J1${&@-=xJ0iicDjI-EZ zqnZt{uh4P4#n_pIdvbJF@oM!FmZLfr;f2KyST4}2DQ7_(sm62xE zxyyuDtCL$Iy++>oKQbufi%z((78OAxJsx>yZF{Jtq;|uQ~ z)h;1bt+6brX5cgyFw$o0LImNlmrLo=o~Hm<7~TgN8aWXhXCIJDju3_yT8_|e^Ql&8 zkIW_?jhke?El$=z4DNO?I@PZ7s6v*p3N6R>;!@YKs!eSH=ytr8f+vY5jN#AT?>wvSj!8b;~~Kg zw9WTc9~%-Z1$!F~JG!gKm?TADmhmf-DP%>85i+<6`@}FwO1(f-4x)nDtHLxGj!SZr z!#+uXHXljg!1Rh`z?mWlOD_;wj5jAYtLeH+qKw|6L2NuC?#&}&XXOvBjWn_}CsDoS za1{pA66h4KLQz(y8S%8n^?vlOuL*iCz)lgd;{6Ft%DqHE^(bN5LPDTG!3!Qf#eaPx z(RfJpIB@clf>j*TIgnK}Q;s^fS~{W++|tVQ8w_57x2<1`;F9<6<>dt|>oxjrA5X3e zxHVtEQ;r5zgd`%OC}IKSa8JWP1Sx9KU|Hn#avs?ub4v=@bC>xK^9hNONc}8f=J|o| zA_c*YU?x%zM-bS#8OBT9X&GWK$OFd~I50LcX&;%iikHnv1kT;6M~ACjCOx=SpTaf@ zk1h_{+A^jgv*_5EFSW;O`Z+2^<{6(qWsuo(sqM{d+m961gQ|!wPy`SV`dOOP=Lf{| zEoM1enA3wrKwcm=OzSXu{yZQblS*)x1E@+2ttAkjuc^ib;2JdgO~IHHmYwh}1anWS ziC)L6S*9QA;+p4h7CN;ZJ_4+vs^{yZBWaeqmNPG|~dla-jWs6q;EFY+YG zXu7e<8xQ-|mRphCP%hU|gKKto9PG;Nw9J}>+*v~3^YnD@RtYp@r>D9iw>N zplWtOQ}#t7h;b;efT6%V|2oD-H`FM4qv1M-**`wHuQ@b7y6QNpJg0_NXuw(?>$(tm zlcDStW|s^*<2_`k(Q&Q1jSloMKEjvNLW)?&DHxc8Y0k>Q zKTom2y_h5ws&||Wh3`5_*D&m<(+%!V+r?bRNg7#*0XL&pZQ*4C-nPCEK7>b6=8&K06*{LlBHsY$oO2lvMVAx z?&^DD>(NAeK#^Yq3CG!?a5_d>9Wf6waw2gn zI|Y3I7AcK?--(h-=OU?HHhxQs>Y^6cZut9?9EM=PK9rxINP{?!F?2~uMdWkgM6@{d zh~3GG)F`6}N9PaBytIJuLmtWD77t=Bqt2~2zoCgZl0AqbqaIl>K^zP2=?n*+f1hOu*cI_wIEbn&<8iI^A(2{4pwb_;|IvbC;_Ld!l4hkj=g!B6PL9zS(qt4E&u&1gC1B<7sa37VOVA(e=4s zdy~Q+e`#)w8b5_W{CNu>mYno|{ONaqA0GdZ2?z18$x7`0&erbPK)II8j(V0WqL?Q_ z>hbU8-n+#d8S$DDMsyz35$It$Z9uQCFcY(dd0i?vK(Az2x-*nQ*9Z`gBBLggMx$`%>5Q;l5Svugy ze_Oj}v;A*L6{%;5CU{{ca)gQ7l3Go1(_VaFxG3*ZzrnJ!Ah4Z4@^lNiBy8E2EDc5- z#Y9;LH`FZOvJNN8<(EU#%!zWf;N?OBt5ALsS*eYzNE6Qll5BpzeH)Ibq&%8O52)sl zv*ElR-KR#J^IyoCnAup!!pV#q>-+03f6Mu^^loW-G~w5h3f$_+k0*kwYw*w(v33t# zxmXYPT+oo!l1Wp~a&$O<->#zG2MX?4!y>VO1iy|Jn_ja@q}zynYel-$%kV=D00f@L zif8C>C-y0MHp*SX{sBmZdRUq!9}-GwmZ@t)i~pEI7J;3hqY9MLO+(ieoBvSdfACW2 zCBWKsv`O4yWX;x0SvGM8u_&R%6K{*;+Z|<%5Xv1Fs)p=4 zSi5Hf8F(_G+Dx5#mIK7Oxmhj0Vq4efEKyIfZ%8ogU?>3+2t3oKnpp-6C2F7|`SuW= z5t?PGisG7`xRMl37=}{mS+LZ=}$JnMKYGqPh4^d^~s7B;G zyy-g-Ru6x;^2i_WVV{klZ^_@On`z9;yPIgmifN7Jz4OJI=?I#I{&wnp0{~>_+!_ND znw}K|Fvlp^8A~Xk6-bsHc+wDfKpwh&;F!uG0f1&|sN1c@W)r17;<$}ie*gdh0GyDj zVtK4I7JGS*ORByp%4{XV?8g&g$&)|+{l{CoX9ECQvVD@SI1YOK>CEpT@O0Fh%+`O9 zdqmuIdR*7DN5_dSr7~sB4Te7A9Td$)bgL2=k~{PqN%Lf9sLASZ7}y7u?6P5GUXW1W z^Gut0J$_Z`uhRs;|>sHfVWlUmv$0mGAh+ACd`T?BkK>IrZ`y~rO!$_ZqUD+2cJ%bZfWIE!h# zFooP9^oe|=HG6;~ra%UdmT4J-A5Xev&;Ho6A8+lR4Kip+F={}=nrI4UtIaLU1lObS z)oekT!;?aI3 z7Xw`RkSvz-Nb&OHNtZ`1SZ=sjyWC>zc*@r9*$DcUJeWq72h$sUnMXZ%ns1gjy-z>& zzAXQ0)&y)N-nT-aOQlas_Z3@4UL{v{kaQgG@{;W#N?=HvYZUMfgQ0dvyTO0fLZ7N4 zBj1y00MH->`H7e|o7Z~+KJYK0xY@kOqt zofj-O;K#!n&juW{WL7k?%!)iTaDDq_JzmXjHnZiT_pkM4H2#A?LyN_rZd|RIVSjkR z@F~|)molQEqd1mr4kgo*4J3b89O{yz%btV;i-8kbvg-S-S+t=v*<%)M`6avzbT!G* zpj&n~KZCq;f{Jum%w}KS+8#K@Fh3pPXTXgpLdgIubAj(!`cLYFJE#_L2qi;K@a}y2 z<4NkBm#A^TKGyEp;E0wajYgKF(VhMMX*B<%_c2<1osFY)vxcFaa^HV&0hnQXzyYdo z*xoRZOuz;Sb_P{)OypvAeA5qz3(MX2f(+G>T!0!0hSuTm~VxWV*xVgwy#UJY=;uI-G-0!&*(Z}0d)0c zTefHIrK~EZA}d4HQmGF5KLP@O@;7O;3DgmZ$iw-Z>S_}D67dBO`8pOt>>;bh$B4Ci z&%Ww`7No20Y;ThHvPWV;wX)QAaugvk);rd-KwN_TNwy3+{;Q zPzsPC+v+Dag3?YuBiKzBP$%IlfrfQN0tN^e@bIr<8Yx8C!`Dx&-6PlT*}#C7jD!YU z*y1q5H*jKJ_dY~_-p*F6PC<)nz&6@_i~BBh8)d~)eQl^o9^(Ba-Bpl`z))mt`a|8- zJ=YDxgZdJti3pi{fLTa?Fi;WvaDB{GhSCbenOuKj!7q#e2Q~tTVo#qJv#%@^R1|x9 zfHV^j-~o#k4-sqk$hCVm@Tn!A<1mZQxLD1uM^K)eMWacy>i5FIYh-Fj2u_ci`}dNq zf!Rg;E@c}u-G}3(149TBBTKqrz(2wdG%0jLTcf-UZg9XDP35J3J%qx81x;Lh%4-=a z7zqKI%FsY2M-!S9)kdyu1X>iw)IcT0Qcyu#8>*_Tn<~!*v9*?yvVD~BtN12MIqeFm zK1F|Rq}QV_(R?j=qxpP!yIJRd3z-#^Aruuh)x2xYX0*A*77CG~g*cL*D8)sZr7Jf8 zUl0p;S|yRCNtCgFGu}WeTjfJ;uhrI%i_uM$$E*1*=TNX4vVC8Iuh?@oKA|Q_4K&ZnBXb6EKGZ_Z7qA7 zs|fxq)2L5pi{9-zVomqh-Y@TZ>pyQtt7zQ=;q`JdyS!(Ao$IU7P4p7(FNo^@2ulW2 zX*u)RbV1*nr^i5kZ$_K(m3z;x5qe6bpKp-Vn-gR2iqwPW{^{|5<)N)vlm|<;{4SL= z6vVYSL8wcfud47>!I`6l1|VAC4^`JiW=;2Sc{4ajYE76`M^Xd6{=o!UdD)yev*Zm_ z1tFafkeRE0-uv@>afM7(n^fKwh7~M_;wTZFYY&2qv>)Ljfi7}lk5IwHNy>m`0eOJ7l}GsWXP^vLSFB>Vj2C9 zw|374oUonUpvI9#gCj-?PL!c^vBV~>_i;07ahz=-E7;AxN&MovUFwBswv5;sB|su@ zlnB>t8I{01H;_EbRl;H5TCQaY{F0RKsDmauJJ=Keh`=vAJy!xw;`R6tt@Dttpbcrq zFUYiivr4hcdiK{QiWbrh{joCX4W(lc5UWMT|9En}WifW_5^J~P zg5}8B+C3YH)tD_77%B@2tMyt|hOy17!K<0|KQYWgsTkJ+MuGJ z<{!riN1&{KC#F8()hr7C<%D*(Qvr(|x~)?k)jrnl*`Tb(gu9xoWR631C@UkVM_Ii8 ziIcJ8Cn@bic;?tY@>I<3;S2a3tlcv~Sx{Ip7t9*>Y($B{b%$*UPmlfk#prsI0pt`I zHCtyxd!yUU5^0iW@Y9{&_f`lCMg-XxlP%;=S9-RHK5p*k2ztXj!`XbEU6BM#uQCZq zgMXe)Hdjnc7AhK)tc-=ey?I=TL`R29bj1F4chz4Z^(g-newKb$jSnZxf-Um+I}o@n zv){2xJnW7OmLuQClhfoU0e6%8W{a+KNH0OBI+A(>)mD(YkSe-L$Y5Y4R!!ik z!{MnyP#eoBM4!>S)eI@#v0qs(s!4+`5V^nlzu96^?W#t_-6Vhd{g3|Z{`sfR{Yxa# z7+;N68+O)brw?)c3KKrh5!5w5TprZ*!qelo%U*~QJaB4dyISF0zh}{%WB-51(|rJo zM@}g>T+A-F7(1S_wR<)guO%P&F!QdbBnF#id{@(bSZp`+SvAlu&S9!;YoVtB3%aT= z>8k5X*3ecZ&-OzU5ch0HK45C_I^ZU-o$#oSJ?axjr#)ah%5ty~xGuHicF3D4a2-Uc zf19$#_ng(|-j&OD{z!f`M1 z%UYMGwR0b9_iWU6jhWIB5|HHy^Jc3tm6SFJMo~IDJ+AAo!n;EH^rw^T z=1hN{O*GAhKE@v@%U%NqQkY-A|7_(18=4PSn=q`Aqd5DW34#;e^x}xWpQX|vN6#sF zPr`vMYS5SjrKCv!C*?Xm4id5d^4LJ zION;-Ir!Fa7&8!7qSn&!$-^=N0&^uwTvmVQfX0SrppT-$0e5rG%dJeXmhVQCj+eE@ zv%}gH+rcdU?DN!v0s9=vw0tzRVs_~~vR3Me*geN|+Wla^ck%Di$@>MH(dZW!X(}(cl2<`ElG7x@udiw7H`8)mR-yfoRZ}tCXlhfnX`9zajvXv{Dea{_H z0jVZ&-CPC&Lhq>-#!#h{FH9i^ce8uMZ$4wWjZbE=x$F-R7UC=4ZDx7^3n0bsmcE|>uj z=q_1z_zppZmj86B-djJTw)f=<8-V`j^FHdRtooF~e04b*NBx`CaFZeU=ucFQEYSAC9R?EBoJi6TUKL@|`C&;ZnUG!gp?|ON; zxkE`Mn#%5;{nyva1@q&4mUZ^LWy|w@de)g$A_ zHN&E8hwvBC==cvHY*8})9=MlEFWLL6OIg}I=_}x{ZrZRWImX?Cr#ZMYx`K0#798Rf&lf{yL z0zslm;C!~ZuSbFP+O&TLK~}*b190p6>o3bWYTYnk*hfwCKNw1!5E5Lj`s3Tx8gCN- zNmM2VGGsXL3RTaaz50J@t62LE1liVS-~>!FQKn54HM~7}*s5r3QeWlNL5ZXSMDZ?8 z&S&Sd7f19O|6D=g;hmT7&#p;D(&0#E*MYPP$#=l6`Z*+vy#4(vk^D_Bq_@JuGKBhy zR>oxu9?|I;ow_GPHee&z+18g`AxcZ~cg0HGnBFWW(Q2^`qBMU~JqL&auO_I!Iz=-Y zvTv(?C|Rxxh+^uRoaJ#hvIflrv~MidloS6)35pY+%B*|h*E z4-#b_egBt_3jzdHcH}5jJ|LW`f*af3G99sd)cDfqWOgJRiy9J0IJWIBim!3e3dK7a zNMUnL*rn43q+x%Sp0t6TbZzDAx>6JCMp|0kn%S}GJn*H$?ty&bVT@fXNP*oAzb5pe zlL6SGmlHO^rN$|}++E^DMO8b+e;x6WS@MOW2=(4S+U|IPO2 z%PD1e>o1VlZMpiRzrJ5@qU-)T9mBEgu1!-?Z+&e`nDg-dff1ANz?oUyUG2fUDQz?sf4f%YcHVKA_{>|owE$qWXA zF-a$QX)sBYJ%u)=8Q+n>O6C9#`UKbGyD7%xI5>afv+!t= z)W0&(n=(mg@~tsfbdiI3dc-rJ5m{?8zSDaSW6(WfFB(Ela76j>yyV z8Q_1Rd@}anGkS3}B|jdt<71m*HtcA&)wCoJSF_~d+>!Ss+*{(d#J4wYx>zl*Z#K+p z@gGdKWO}ZqGw&Rxqu5fd#gW~>F=hDm!XF3f2^GLW9r}_DV~Xa>hU=U1;eZ32s<-*( z)RAP?kzcs>|D_Ta)+@UCWOSKRPAy@*F-3nQTlz+lE&cN0b{?(#Xt7T0J@B^6;ly9J z^#Af|HJjvzGe`dfsQlX6yN6@|U*-UKeezJANBtkyKbe~($RL4(;~EH(#85FiW9{rE zZG#abY4uW*2KC0RY1@kDn>c^f_X_M2aJMI^N3L3Ovq%QsV=&OJ~7(CO!OFGRmaA^*x7c1_l3Q zpb89pfPeC@biWIF;XWwr`dxO-Cdhw&*`C}#8HG>qtvIMj*9{B9J&ifZeNqhDXqY-`3>T8WMXc9FKw`r;_PD{D`$ zl2Ns-oJGy+Ke2W-x9!-pkJ)9Kr&KT1_2lGF9D|>5{4&JZi=&lI=L4Lt1`19uiDJbl zE{Wo6SI$JYqlF65Ld_^EivoY6ujAf_Xv(5cV~j|=&3 zDtwE&NFkpU*M^A+VOx@}Tdw2+q)Dg`Y$z}?IdXWw{Eg~MMVE)M2B!#@2*aF3v+30) z)(FAvM!~=2fCsjKSc%3%Wx;2+v>kdDkNkGnQ6Nvzki`vs zwBjrdD>Yk@nG05+!gXT$@-xF((vR`6xvXI51BZ*aJ)vYKJ-#maS5Vd--_F|AO>ZBw zdk{Wix+If;%gKKweV8m*3$wFm*4)r{N2hF=*)=olk)s+$&}+tluIi3m@lj(!YE9N) zf@7Px(_?q}S96ScrL*c3y(JCNlcFD_5bBz7$kCM0v*8SFA$g&s2Z}1$o`A?4+)Hi9cNjz)r+I#yb3)44Kfd*3?Pu_Qtm1N5X{4<054e2t{e)SnU~Wx4rgyu zz>|47C9^6#Lt%C;Pf?gdfkUq63JJIy*C9vOc@@&xHG!?&KI}t)AC`oG2LP~#z()s@ zXa;SvYs`Oc3q@N$VJPy`PLEx|5A)uv_j1ypSct*T2TJ@JO<;nHzmJ-s&=%4vFlx)W za}NOn9TETXW9fFTmlMj=n4+nt!cCOz*>>#^xJh9S;ajvufh{Y(p(&E>zztkiErhB& zF!L#fIy78GQG;hwoGs@Z+@LPXQPd-)yk8X*haxiD^Kl_{HCxubCu6Jzks(|Rsuko! z>`#`rUw|^kw;S$6O$l_qMw9;SVs?o#uR_)GB$LteBLSn6_46lxJ;CuLzbM%}7`vL^ zklgd&l<0ki1-4)bu-igW>1RIIujmdOzvS$j}pTeT`^T#8S=yImeE<(Y|Vtp%`$aaF-#pvkh=I( zcNz8wP*Ja=$rq6*#4qK+NqyQo;qMds`v~m=eJ4KAu@9-S+tk?Cd^Y5jd(F!MxYzD9 zKfB)`X5gg@%3pc80CtuQ>~NN6mm_ztf4eTt0^Z5L)wI%o9C%6<8lJLyMWbon`QtZs z%|_&!Ifv5S_;?oooFi?R1I@O~mF`}ChIDoXmJhyQ?6%^8qCBpS3J;?=U2<}{Q4sxfzdkZO`}D$ znvI*45ABqH1>M6F!3Ej271<9d0dJ?0pMh%yq2eo&rC5j|M}>D(iNcE-=%x$@Tg~zh z=oAdmFWah|;sv!s&O7;~F6+55vEXlt9#12%;AWE38|+oHAV9!;_UCQ1he8hm1U&eg zygKkHMTP6Ue{mGxweTMTs?>sOIKgyjeQ`v*p6tMX>^|V9%#Yg2tuAZ(P$K1&@8i~V z?Ko|TZx;?RBR(FpE8eb&!+X#tb4WPQH8O?d4n8}YG4(zAcmxQb0H2>CMD_gnmCkOYI8f9 z_pV2O<11vdf}lz|Pmk;So>(y;%bMw$rZ345_#G4jiYA*{pjwFh86pNqN1_;)veXUD zP*F91Xvz96$!woE%^ak*p`lV`vdOnPNqP+dLz!lP@9>47{}A2GQJN@Do=;j2_uaeK zd2~YxjPE-Woe=bo{?^VIq{1p|dd%5Vu){uo8&hCA;0im|irqd_0`EA{SHHbDqMdSS zuS_kDQ)*>YV!D(>3eABTTUCZoefPt(FC%I4mqg=}EmW^ILqWHr0M?qua+$UvV_UQHRX4 zvWsEBPy!>6eM@o?M*`1Ed5G{|!;n-Y5m60K^GwCsAzR!N$CYrMerw!s9Z9xLPxtZL zbE0H}vLKV~qw1CZ^;>ylKjq>#F;&!mlL@u|JT3nC(9({(hWWmx)Uy)%V_i!gFP61j zRRduedQy#|QV5}Ax9b>J<&;G%!%X^#=Q@}(CZlH|$w_pKgBn0z6MU8h4J~>J^qu(>@-`RqA-VywmgIU>@unclg0Qk0X~!W z_$dJglOg#v89oHWgT+fc(4F$^YB{e3)&q?Pv@7r@c!-m4`ARd0bH=Vl^piy1^*GT? zCab@WS(IyW_#L@RSj^$qM*)e!9ThgPexs5HuYSeLUsPDxI-`^9`4|fell$0RH46TE zl0B0T`YHlt50g9kBm&=ulVSQ(fA|Gs_eA1;u=vX4v++0Ex z(iON+o?MU%@%sDDb9mtDnuO9E9r%UJ67ECn zD~@hzM#!>siHxcuX+5`2hzN_=$gr!aMI@~kN$ar63KJxiD9)NEAhf8Nq%SiOHs-fJ`;j2b&6@aGiXEh3%;U;hK7LhxA#9#0}+ zl|;hMmmOqCalg;*0F42Tk|uzfn%UKGp#kj&vE%nD(2*el+7#$0DD*SaQt*m#FkV2* zP`V%E(mcBY`>q!av#S}-?p~S^&7br%m@7ZB*>NLI(w@9?JxOvEf4{TOprpMaJ(Ke* z3hrdQIW-(*@l&1$&7sVJ3^hePO*}hlPiLIXrLHaOtvO@tn$Q9By)Xw^L`gAJm6=%< z@6<6ejtsP~00WoxDipv5ewf7Iga@sX#$_<2TN@TmPbN^t4DLVR#R{m43^rh=Q}cjg zU(=&8o<(iRC#oaLeHTYYGeTtE{}gpCFc!p?8dOPcq1%T}#?&=mkyVI( zrBnKJ({k)kM%_V8(U1tsb$!W#Ek+7dP4g@}F!dlfBvdd|IZJ+_4jFVyy!Wa$7*(T$ z@$ms$OwL&_6Z47BMHeZbjd}ubP%rm|^K1E2+FL3u5d~B8f9?IyrcA^=fCCaJj**av zrzB$ITi6jLXjsz4uJ>wT*UBQxxA{BWlO0#u+FC9so6;!6^f=FDID8 z1?AE@8{n~BYD8=dUM>+DLuQ;Q1;}vM44sg{fLu8U9fg_>-*l&Hc* zUXFAB^!UFhx?(z7pi6ET7?M6TQ9(s^ZOK<$CkT8;GZpQiIKVQXxX^8WbalxvEnPK- zmZs`MB(W&eY+kHmAVc51-piY>CpTg ztljRIe;_ZSvvbX6m|!wE$=YzHQ)F!Ht~sTiKY#%)hjiB~x@OriE~n5F805IgOOx1N zaaMvDXrZGS6SU;T)U&*p(`d9>cTgF$(d|WLfNHj`5x{X%k-Oy1Rvg1oG}l2TTuVn} zEHYy_s$ok*U-t~p2o&G84+#~hF0N{8ko*b~e_p^+klSBYRR)OE&=fqmWm>9k6tYQv z1K>cY3=UkQM5qk5${Me_Nu*6>aq9^#Q*3)(Ekb3mJWI4-dmNqTHoNFfw#NC*F5jrq zW;Grki#Xa|vyE{6j^|g{(hdgToVyu~#TU7b_iSrTn{zatoKaHmgnH@_SK@$~uq`{- zf1F|Cj7{++Xp=e2aG%-vlz7l4n%|3Gy*Sd7r{F3Bt_B##w28{#O8fl|JkIC|l2yPs zHcO04*98xoySI0is3B;re#f0Kx45<)n*?a_lV1@ubCm^~WdR=Wr{I&%zb31ZZ>uY_ zmnbv}bdR}UvulJ0f0H!U>E-qnr1u?df8(*)$90z60-rByL>HSKr47fPAG(W63y*L{ zdI5KEhm2?!Rsj2(<+%DK8u5`^&INu;NMQihcwsnUVBsu|@Z1$1w4}+@vox9O2r2s! z%{ii=_NJhYMxuQH16fsFS@VGjRPrU*szdNSID@)We?!#}&8cgiWI1pT9fk;ufABqD zcV+*ez(CVTiBK>LQ~&{{ZR<(MCrf#fm>a5a0Es~I;36YPjRhqNx|=9OHv2N0&o=k< zJN^2!-E3)v4uHN>58*bj%XfJ}vg|Ujp7tAI$3$mIoH}RRE|7_0{s@U>p#Fi1tt6(i z@yWw-4n<1GVIsXE)XP-tnt_a}e+Ne$D8N%N@RH4H%$9d_Q;P|B))?o?q;qB=V2veqtgTH4(2@pIw^F-6Im31DU+WD7 zK2^$SaU!UWs`WeA3kE=*&d_Hu9!i&T?3ST;isPWL7D}-L0~oRd*l9=>fAj=F;HtV3 z95kbYNRWMcoVPO6i(3)HL4QjWh|Lh2sL{FOS9?AAQ_2sdy#8hqWJ8>kk%8mCIFc!0 zG#R0D#|5>OTV2-np=4L*l%HbG>DqDH65lQy;#u(VSi9oPnmByIQzUapIDCRIv_xqs&8kSf7bIYM%Fxw@ zqzIroo7+4JLg?T~wX7Kv<#Zfxbm@nqQX!U`4tJ631 z3HX5n=X!Bs-mC)XAq?hA3pdNS$aOVQ< zK9~T3W*pFx)X~V2I-V~!(P|NGx@iV7>VHflfCvNE_D~Z;mfk32N?0^1=SE_zW%a-+yJ4D zumDBv5*rX&wrz!;E)4^0;&mUcf|e{>(oohECsbS&_Wnak@Is6rq6KSq<&~YhhB(hI zoA-Y_NU%1NTc8m4Lfr54En6XeN(l(&fBRs^f&tGeLcH=QOr$eWKd$McrYD>o z3CUcDU~)q)e3RF>wIJ9NahcHY_jGmz+JtN3UchKmahq?=o;Yn~vr9PO{VeTCIZ$uX znxn*NJi8nvU%PC!d3xfJzwU6(*ga6(+uD~z4r`a>y4@!R5+dkKu4jwcdV?fG%aZyYO64?x zKnvM^wEU=dFbtTMzl+bG68hdS^kvC#01))hQYD+pIGFBGF&xcPJolix`z(0?o$=I9 z$%efO3X0S)&ft^yhe|ipi*zCRbHN+Je+dv@Q?W|&0J(!Ye2=FjPbgc7r(l<^?9M0O z!P*t%Y9h=Z^q$-3Q(zxIcvv96CV;^53Q+Batw)Ysj<#9yw`3MHvdn^?;l+=P07=W~ zajqfR>chf2?Tr?b-ek4B=`9zVWp8s8;c9d@TTFX5a3p`(`+2sx>aFjuzbxmye|0pE z#+zu;?``gHq8{i+lL>bdc==R%1H~Ac*ld&1U+bXxcOBJIwJ?yJp@VpUz*XP|Xoiv- zm_u-|WWzaVnTM==_7I0zQ05D4@D|W#aRp!fO9O+YiOMyJ^4afSzo&0ye~Az` zC&YhI>4Dax>G%!=Qq$CTZx;`{fBTvxBiP#Q1sgD79xDszy!IwsmynbD#nWA}K}%ji zgq46dmX3M3mioBS^c0D^g7tLvDY!o2#b8!={%wdlN%WvwvUY}+u%xv9zb)r(}X?mBtU1HDI`<&R^73(^+ z61H_Ine~or>k4gR?gn}hf0}bzaUFdaXX?@h)C+mHw32&~m69{kpj9U7P_I=#w7}|0 zmt=hfE-e*T?ec}18YkiYl<7aEbO0}=T0V}bvQ3rkTe1{*+#f1K9hd_0N3~603t?a< z%l@Zze-Cb;En-jM4NzbL68Uz=`bCasIzgw~0=0h^-hcowA?TT{e}V0HA_IF8fKuSu zVM2$-fy3--Y(K>(e%CYnuGb;PL<^aWs%Jh6;+IkWe>gO#9R@WuPymZVkE{;Cbl3}m z(M|x^A}-2qlQ_dw3L#!pMST{N zr^fJQt=Yv+&UjGvf2guddE^k?kSZGlvmvcCct5oxf?U=*>m9}AW%WrDj_cDGY}q&Z zqmG2 z#)tykAUgmyfK_j^S}(2=w&65bV5{Jh0ECV;7<30d>OXEDSYdxNIN_g5HU8nxr}) z@%iivdo3rK&{Hfdnf7lzd(__b--F$!qDLk5??_ay@4wT^vUg!0bh(A&eekYO7vwYu zfv_JCfBO)6r?+^o-7Qf@l106!(c22R1=%tkrR{fA@?akUG9*iV=^8K8GpM+s-@NtE z9kuY-eZl2>GBwbyhA=wNFW#R3oC76&tA-3)SP8M0o(wurV8H)0qImURSR3{N4HeQF zZ1__~G8#_bjXYow!?yOoAhy*Z{{>k%9ArScf99a&nYM>r62Tti8C?W8J}U;%ED*c0 z95n1vnk`wx9*@LfRBm6WlN|oAB!>@(5vB(Nz?vUNcQ7UX@UQoa+s5#>H?Itw%h*n` zD>AQ?2rgc!NU*oKqA2k7EW zf5|>j6l_}5o(89Cs*k~@R@BVq()sL$uT%}~=jCXwjG~SC0S{y{aWy04j^*>P%Mw`} z)~ZsvR#!PSJ1_hN=B@Yh>fZlfUyH8yNw7A$;zebs`rbs zw=hC>vosNWJzkBLca6`Buhn2o5rTh+f4`Yk=a7cPpyg5MBYGi1JOW~l0I@R}J$4vy zJlp8oAdT>Q*jU=>8Gg%iJ7z0zT?ZRUbrDDUj6{&;>#n|wL&3k}Re~QG`%x)SGd#ks z6~2A@qY5DYGh{?i?*Y-{FXbt=Lt;NXzy3+1Id(1|y1)Y$laiD?rr0a_e&rPXf9xAr zoZYf_K36M9`qWCHu3E$Nx9P8guf1?|avXj}!=eV#mbTY>w`U(T4OEZ^5_|U>1vSuT zy|nbex1v-RDxX5#!RtD8PQ<`+s0sVxxQyQAYIc@+eV3D;d)41rd9m8svW4NXo9zP` z5$VJ1^M)V9t{40aq^{Zc%1i?~e|E_}#rkdreb_d@)Qpv#c_4PI?`{NIWXJMb1J@d~ z93*120l^<2YF|9RR&Wzj71hevVL z29!GJlil4O(ZyC(UDL&|eC*1h7~~7~0LU1Ij~%b+ABZDV;Tj^O_IS+) zK$BRLMFdFFsFOz3FZP}1a+%vHxSznESY0nVMPA617JhAsy>Mnje_G(RB^EXD335QR z1-6Gxq^I`j{Wxha2Me9f?BqgQ_5;?LUv$xj+}&wfsZS*k;cyMwdxYK%-wtQdetpoI zmKAugPYV%{7XoX+lu|yNgch3100RyIfFp(kQ-TQjGIDA%30xOPHAL7#AxXOqC3zno z?pEvgs?h^RK=$Z}e+VTTu<)-IUf zsD;lp0xt%L+vvEy*EfvLpl3WQZ~$2*z)W&%-#Wsz9K)6WJX6CMHEgJ1!{2U;DeYTa zu2ov)!wY{ub)34XEb*KQ%9a7Ph^JF|dVfI>!%i!3f@Qxwf4!e15JSuz=aC>yb#_Ml z$nucZ@~LVYpaqW(O)EbUqtbu*;{GS4Us8jX=qfd|XYxjPl^WWP3K3qukQ$EQFiQ_k zQ7xpYCL3_fRLQgnpZo!^0gwUXmOQ&FF*Xf4LeqRPs++mI51ooy{kUTf{h3L4;C)CxHXL;|6vJ8Y%;v(YxV*=OYs& zu&{$v)P<|TH0@UCI{lVyA|u4b&eP8G?k?Tw+8q;HV9S51X`o<7=y)CF=<2a_$T@g> ze!hy=GRB~GHBiuEZAU-|e!sRO=wIS{l%5|DyxY>tf2ZhOc>7h)vp9+RA9(j?wIj6e z^F<-o0{Ij}%Bc{2PJ4%%eKkn-40Y+I><_d@{)e8eu}>e8K9}@>dv{tk3TiXP6)}oL z!>$)r_Xu``8(OK$x1wmb4Xo{5m1+WIXP+`W7b5OtA>9mglWIUvNjeEYknKJF9#P?= z`Sdb=f1Opod6lm{OLn2+gpQPv`kI)iA1kuZ13$E9vqxc{v0;ho%D>F!ayGqKH~Fu$dA`^z zTdUb5o{;L=aIot;eb@E$;cHUlF;;^PtG_Y1RkjO0EZK@5Z~{zrC)fC}uC|okDxz1U8+N ze?}_i;}W5chndAP9#UqMCG8?Kqv_l!)4L5PRFYI$$QDff4Kmr_BpyxTWwSA8{|Lk& z1@Ls1WGob~OYHDiK*4Y z`_D)_WxfW@WWpPD_OrTLSZ4Kz8kVmM@4S^fo2+dq- zlgC*(z&h`9%bNETi|3Zx9eAmPm3925SI)K!U%v6pnt!(f$R;Z(W?de6jTD zyp8i^+r;TPNi137oFo#n%@&o)r9)9xCEF)JR7T)chN2LX$Uz_F7>lkx3Bn4H|KUaZ z>;qaOtQukceL_5Igr!l1{6}(X)CgvUa7xA3-ZJqK4 zt}(WBU7Yjjw=Z2oV|){SL+9xqp<;~&#yjFyPinT<#5ctw%Db3xzq&wqzI z++fVZxApIvco@BT^?xR~+mWx!zP5c*eFJ0A3q#XuS>QlJOs*HT0uyZR9XGPf?!XGe zz&XI-hA3DUtW#`8x`^X-<3~)%hxOfMOmtL@!R+!fE797LmNKd;YW(YLvc6zaC$Og= zeOlkLJ!eEK6Uoe9GTerIZbem@Tz_UJD;2CQV}DAL4~=<@-lMlmB1mSk1XBu89Yrc^Oaf z)d0`lV$Byn)7KN~KW{!0cN*M$hhokk?aX&+%-c3R)s)v5ym|H0qA^%3uYWd|Blefp zjBX0-*a|1gJ#X7;i|V#XEB)Zpf^4F$P+u-xQHxOKTjA9u?{5B{R8}_B%i?Nov%6;a z$Ww^_RWF;W;T+y$zwO)SJ2m)_gfvV_)IOcN@;;DO{7h`E52-my?EzN`>(tIZl+8z3 zUD~^{i-*^-x@=z4VbBR1;eR?@#Z$5C6mHg+FQ5y(py+Dw=XltT`ypi+bAG60Zwt?^ zV%h6|y&lacBYdHQnSZgtx>6N^y}x_`cD!>y{iM02pw zc-=LUy@H8t*Xn4(88DOpvX0mOyTxlua9PBLg}>%HYU?R&A|W!Sl^+pOqb)EfAg6}+ zZqw^g+dEU&_2e?BSad-uVUa0TwogfecFu*Y!k4j*5kAF;e|NZF=wQN`%u?T~_@qXHTK7 z0(E55!e=zThzEI21BiG684|vwGQ%zOj;H3Fru>9XL*#VPdx~FY^cl;Nya-yL4xc>E zc2nM(^v23No7QcM+SuuSzdHvM15*VxOOG zpHjYEO7z-A7mFOe%<(hB za)*V@Ni`5}3}h}Kdqjvq97t8i$?)9%l4?MiQ_6e8>HRsk4~0&ol&9KRL#!e$`|TO` z;Y7t-M_7%i2ce^^tVs`OutLK{dNtEnQ34uK7Y{*wkUCX2cspTKSrNClSv;$ zPZ&4k`;aEmt7Gth9QZhihc92qyU&KHhIITi56OEL^isXFCi2BdDy>gi?CFhta6RFKDMH5PG zZh2LkTWTP*Wzjm|(o-y#2i(3?6b6}FGR0`t8$3f#>@k^W@Hm|vGFXKD8EJJ=(jnG~ zG=B!kHbPvM_R_#jWD7ZWvV6D(tp`x|jT*G})VuO|pqb6jV>)$JCp_3k078U|yyJ*H zMByz8Hbu$!43N%`9$J3+LTHFcV|rAYTRK~4iRoEA0YcGeJp!vq-1rbLZ{j7HTat@! zUX@>y=9b6AK&}CL0JF0X%P_)PtT3{Bt$)Z3{gx9VqS<$Wo)8<|u?B;_;Tu-%azch; zA+{R!F$yv&k^rcN3n`@L_SZZ@qsw?O8n2VRlr@r|WWwIZD|O0Pq;@$a+c(!Pr>Z5V zvR*E{l>&!d_$#S<2iD925nvzdd5($@HJAiYALgclNDJSUXn5Z*(NJhj%5Zn3eSbQ4 zh5M5%>3l~g+JRo7$GJn)r0V3=at+14N_qXYpiaMhXo=Mwj)8a+<`k4?#svp|B5*R{vFI7iys(8FBRuMpB;3J`zR2P;&A%BKw#d-jw zV&4e#K&Mof-kD?z{V3OfHu-UoI%>V21_*9HxOay`B#B}2uQ^QPrC)le9paACQ|NRD_Vy#xjJ1QpT)mie6vJyza1}UlMmOU zF-(2RAoM8skNXIL+ibq3PuL?S-ixo1CS^F>j+SxrdbyY`M_0|&dVjeYuMu&LB>eew zgPS7D{wBVxqk;-+VaehYrSZBY7xk)gb*1e&T32t4lIEJqR_X_9NNyn7m-nvFhq8*Y z-jceq`ur%gKID`u?X}+N^RTA|MfYtscS>zV&w_hRrnI2-u2kZnN>*2iayW*2P5^^J z3MYLZG2-CLVwq76`G3CJZ5CV7nZKH3{k;Ca24?b&8%7~QVnN6%+9GG042Jd=vaB8Ppzx9ywQ;eR_lv}f%M-N>BpN6P8? z-+|gE={*CZjC|l1NUK~-^%(IdR4(GGo^rEH9bimr3)sf*{1rS?eV_ME9rg5jqt{?Twl@0jXdzW8*dhs9jXDUax4 zp3^W#*pT(9M1OB*%(199-C*MH)J^jYu)u`O&mh;{ARXX%!$M9 zHKr{SQ7)_+c=*OWH(;*2Yh1**%L1Hs@nS>Nm6w--x^hJml5_@xqe;MXJ9sXan>jkS zK>yx0Uhek!H|iLkn|1qz<*kd@;l4nM^2+ zfBgFPL+}l}qvRRQct^Xo-8Uk3JX`)AR#Z@q4!U;OZS^}YQWMnv#*#+m<6(_3e); zPN%8;Ycom6hqU4oNB*0J#$E6DR{?m)r>FjqSg2;j(>aGs_0D8gz09w_V4e5Cai5&o z@o0Eq&4ynraie(n<@nR$>($-K*Hy}q&_4pwzB~Q20|;MxHMVxjm7}oM!Qim?`Afo71a_M&cK&i1fsCn<$JqRWPvPJdRtd8O8z!7y~a zMsgvsHE9sz5fOtOc0h}OfUkWv91ai?KQKeD)$!e4%NZbG%!_(xIS3>j4;7p^n)akEu(7kAcllCtT(agP^u1VPW8Ce|<+E1k4+5adfOry!OtfU8-LDxA0ec z*=}uv4Yov2V!>ON@%fgBaZPkdwhP^AQ8Y-9;bC8HM?6IbmvGh*CVBG;9XuVa#~0z9 zD8pz%{Br-fo`1lV!#7eK9+u<5cF+SWlVR@T@Gwo&HzGf5nGW_?!)9y!R$zDft;jQB zatIMZ?)V4bhsWP&&3N7EV&^ku{mPjfa)C6`lu(CC<>%~sbzGGEE#lL1XqeOhCc*Iq z9O>$`eJ?yt)q{I@sMNcD@b1TV{QbS?O@m;7{{fvODSu3KhFmKpp=rT2+OOQI)x$;l z9|TjF{#gUR_V|1{#I@5%L~);CVW9s60bsnQHtk#5oQVwGT${iVy7Isy*SiO5Nt@N` z(y2K3q@KHjrz~wy&s{nd2cOh)ckq;@4eGf|r{ds~dhQOMva~@xcj;6dd{WQd!Bdtt zc>cNDW`D3Lx0$5IlS5CQL*4$4C-m-!olF(ODrjO?QiX65^Kwp?+03Wf`YPMtf=C%G zN+@%8BX8_h31`i@16eUWOVu4o%V&D&At$N2hcqs>*;`$;`EJYRD;{VAr0Z@mA0yV7 zav$k6Ug{<}1idD1KKS&uix#bSny-%{=*LTVD}O{d(K%w`DZ+bnhbZ`eh+F@YBAzJ# zI_uJGIYwyqMDSQX++7IkpK9*&+#X_*$A} z_Xb|jF(b=<#y#((n{I17bGcA?kWn4K{Jq96KLNi(_NCAq^B*hd9PlUIoGj*>HGXfV z7k_jznmh>BS5jUGccK-d4Aiz!9U;b9Jxn+XMS_O@qdqe z+ub;Dj!%4hGjMMvcDQjtWdC`C^2EK_xb2DU-kje|L<{?T?%w!r8~<3N>vG)uElbCOy(!BI+|QO4JqF98kgP zG^iv2$%9_=MjfKHYWrkW^FHF206yclIK7Whd-REzwZ7idrBC?Pw&)kOO2$D~^6IF5 zODuPnzwFwlBTAwF;a}plF@KESyh7l1#`}4;z;^F<)zGNy`cpt5+9@w`VVW@vZ=WnM z*D`wEz(o)@C_s?~hW%oKt`#6A%W?x8LC%n$brOp(xL@A9 zDibL;&?rk;CQxUAVS>ZAy6NUWLk0n}%h?(qX-u+~xJHxr95LNB6o0CBi8){u(nOzP zh0|{EO@*r74MDVopV^6uIKul=`f*M*s>?CgzKu>1->j$`UI-02;!~k_tZ4`$)_Z?? ztBvJ8Mtc2hh-+H)DeKK^_=#%^8i=4E?SbrFa<^O`eqze0yoN+J*8?IufWo;Q6^Ud zq2g5y21!QIDU>vb_=ytfnJ{RHG z1?ir}lzQFsR%ux(7gN*fnVDaj9aKH#DCKX!2-+CDdG*txF#svs=5nM)nJ3fpzGN3Z zIfK8w-(1GaD1U~-DS>|`^J>WJA9q}5Vs*8-#@Nb?>Xlb3NZC(M)iG3%vg<;XPCNb* zlVdp>fi3ReprT`#D}4X_X}yT!^$-7|+?OBtI~-eO^aI3%Ct>K(f_xHL7`pIKyyImc z3qzj@?}olO$n`I&CFc+Q55A)?^xp5k|1SQ&d?C(wfPVq1r|N%ETlPECptUD;-=;xp z4|Q8s^NK!b8npJgcNXt!IuF_?sx@d+LF&FugVr8{C2iss>bpSa+Ku-r6b8Fjt4bkO zw*@G1Mjxklo)Icb()Os|rDY^%9N3~lUZA2wZAM%6it#fZq7UF#98FgARa1?ZDup!I zgs=4+Nq+!iB_smQ8|%Ak-a%$G0Uu}lb^Y*oAo2)he1{e`5Oxilc8x)3&u*|3VEf^o z7uhY#?AX{fCLFZZR-dfklI9&PBn3on&9#WEc9q;FXZ z7SiiDkwWl?@*|tdx`g3SRx6TOun>6t*ciY@l%W)z4Z$u5GXwvYm1N{VFThU7zvY4m z4GXG){Bag)G#i3RF|R?iJUco$f|i#r6b(+I0ea-^z{hA$z*3IiiVbpM7|{n^ zgMVP$z5*knrU5eqxltP8Qk(^`c0(>nbO#T6rU5hg#hEdaWHtsl>tHpwm7=l^y&IAZ zAvv;lf>S0%ZT4P%N!ufN)8ZMJPZCB-A^V3Q3(DpsQwVG!7-hm}xK9~x#epqYJ|g~y zknhMW73WmO^dE{W_}e@6MkOb!AO0Tz0G9)G0uqN{E&+#NE&_*OE(3>PE(C{QE(M2R zE(V8SE(eETE(nKUE(wQVE((WWE(?cXE)0iYE)9oZE)IuaE)R!bE)a)cE)j=dE)s`e zE)%z4E)*_L3T`fGktiDh0NQ_-n0*u-f7x=}NS5XEv|0ZHEX%A&RZ}7COI0dsC@vCh zL`f}DnORR|AqGfBD;S85MJiQWo6T2@**wnU{KkArf5{wo$8s;+fdI%LrDO$ZnUW#^ zcZcKpUC!Np{PW*#Cf4V4z8GiI=R3~8-m%i@MK&5wub%I$mX}ZC9qZ3O{qsNlfB0^A zl^$f%Wjb9hEZj6*Jm0xqE@yvy_H1!+o!$%=gPZZiJX>U!%fUr<^DMi(9ABi*K94c< zGuL+9XE(#~bVuF$$GLWQHcO`%_cEK`43~>RHowY;ILt0qH<%WK*x|EzIvFmp*v0jD zwveO!aWNZSq|bL|^K_BUKc_oCfBkrNJ)EVB{7>uT@cEACJ9xD7uQOaIzumE3kEiL` z^6LbjcsthdcrvN}b)NohS^n#%9}m*W#Cr35=iPYv>yGvF^POPehjHX5`A?keJY!e= zMP3yRBF9d=C=6rI3A{L`EwANe$)FfV{u!~sUZvx!>!rNT@dtJke><)phMpHD zu1AM^on4fx^Z9^Sopt^%*hJYg%tcrQLxqXn1vt&ev0YX9(PSCB$J_1^0b zr-vuU$GdXM-5|L|n5{*n8`6a3IQ1%^F z?*?}4@t+;*14!L+`uJvsv$ZUS!K%pUK{oquKVf7XZav(w1aC5 zcY&>M7)`!KMOi^2e(SVADa+o&?~^?*r>T}{U#8hjx}1OA(U$)v6U3v_!JABwiRtsR z>+Fm1^XYJA`uty4f8&c!huFmGORQ)^@i~2MZU~o(#p-)_hq;2jbE&21 z@2ff{Lc0C*jP3KMY)-ZX0BoqKIS= z`mygtejK`q?fQ&ps0>xYI7)m-T-%T7U_^$x1ILGm3v4&?og{D~dL5UcO1xLABQLmF zhC+jiY|n86$BXPF%GpZsGWdPpK!#q5pE{?j%T6Z41k<8&(>TIC$W6kZZ95o_BGanv zy~N&gotmiMe@a$C)b}P?w<4~PSxS5+gF5S}I0fTY8xe86=F+*{{fW3c%yn-fuA^A< z;zF#wT#bb>LQF#+dJ1% zK$KKu)?(CgZJ>P_JcN3DGQAv6$IDbH;==B@ zqmo?PW~qjSvEzmLZ@^55l8M(?ZAIoD zvtPRKe{dKd8)V^3RBV}c!8_Zm@>ba>2f#}u-1otlHq6(}(RGbtOG@_Kfe(v5b|P5A zp&y0R6#jnbdaIh;yK3@{s62p1v@!1OG?BR*4qSIj<^{_B53GTID>8@EYGY*HO-XS= zZh?G1+@~Qq@F1To4ps|z z67vhe^2Oh}-XSdU{P5^rdwfNp8F69dwTIPvI$Xg0_k70%)=zA)5~v9V@B>htr__w# zt>I>Fb$*iCH&o9b1dijtl^6%E=eoiNA=LYm={22%`xpdN)Ob;j7j_$V_%)rMrZ*qq zfAG{?&0?4C)0b}a%x~ByaCSZV!k!_36Gvze*y7w14+z;Xt6Y4|+z&Q>=tSiOKRjujrsm=A;?Fl+qj~Rx+K=HLllQ)M7YI)a zFE~suhpWl*eE9Kfnava-<)9@2@z%N4e~%F+B=0>-ud>woa6;*yZEQckj>KT)z}#(j zh9HuBtvrCjLtKycj0f4xY?A)%>|#EiEsaa9!)oNwKOn*gyhOOZ5e{^-_u!@S8X9Daas8W0``Y@+b{;)(eL`C@ldz7Ni7_jN*KfU zTM#!3aHy!;uPf_Y($4dg7%Ki~0x`b{dLn@7LOantS-ta5qsBl?N4T{_ka!%&f$t}- znQ4cA0|)u5fny`<&`Ip1Nhx;*Dh(!zB0ElEuE|g(-5ZEZSEOG;n7{`nBJ--yEAEX} zw-s=%N~6tJ>qKyt<31keS{MrtpD;6u#jjkF^e3%LI<2Ro)Usz%SNzt8+pwohc&D1P zPHTQbDbxF+s!ZZO1Yh`e`HT8FsmPkK$DEvh8TE>z*XY{NJt#fr(vK!NIdW}{b5pm< zugY~M7cM2=AK2?v&vl2n?jgBDk8=lig`Z9NU^c*B-Nqb_j_efy1c@vV5PLxYRD`J> z1oNovEBx668=>sg9e9aMgG`(#ijfjY-&be$3iiwhl;8O9?6q%ZUyYq2$1>8>86Sdw zoo+d1o=vW2eCwote;l*tT>5EyFpil=s^of2J9mB{j_E@YX$#+yEVWnomUhP`!nZuz zPKb{HcAJt|;UICLlNJ#l4JBB>ue~I4{V4M6*hgd*Ww4c@2lg72APAt4CUw{zxCxZ% z0M$`Kk+vQq1PEzF^T?i0vC2_`2!tk8~v3R(diWZrE@{T+!~Du-H>S=r+A%({olst8t0@2 zO!t9W;=<0a$08PNHoma%7stvjtfr*0I(2fM=nZ546^k;y+Vk8ULFVS z33R0~4m!V7#xAS4Y5jU#jFL!aQP->rb%s!{oU5g*beaPa90#J$c4Cw(fi~{Otf&|j zkRn{M`e`y~ARx>0C;y@hl{Nv{)spEna6f@qD`vv#dr?K9W_QTjNEsD!ABup{8~a8r z(|b)(%H%v2=co)umUjH_)GLyIdzyzumlyD*)vKf!n59;2%y7+j5S=Wz{K*@!b;K;& zRFJZFDSoT{)DghEIG9_jLPO<}2Y9pkNetV#zZegvWi;~sd_0^`TDVit^1C&K)y`%w z(o2-uD}W$PXr9gXFGVG_?se*3tR|CGMpx5q$eoP&AK;nVOoFey%NBBfIyHuz^r<~i zq1@^ZKm;?nWAA@2&9a4{=8gv+TD{|#gszk)@4>gfX z_)~AOgjz(R{wslnNd`?_5mCaawVqpLMKQ2|u;~I(DgHFD>2`5cE&1LU^#f+ote2il zI8qcz2s*NRExYkjD;wI$U{gGSob^U-tV;mxUe5Jf&wk@HI@9leFiuCFf0)iD*;i{g zMTP3oEE`Xk)+k-(^<#(Ak%jutGZcnSt=*%;_fM=vHd)E6_b=n+b(P@LZpp>4SDGz3 zRH1AZ9R^EIyIvO@4VIjTk{l*W4uz*7M+Cz`k;^CnoJcrBB~mnDQCV^caGFcgl93K$%=X1M@9OQ%H z!tf~!BmGjbtTPncR@XECG2N8)$mrq6$p?}5I6?S`KFwQy^awD2bGDq1Kc&m-`AWa* zFk5|`pvZoHMYg)S)-QUUiVEqnh`;`&+}QK^aB6t;JKM~~$zo(t?%GqfnXiY_tCK^y zz;ycb!&yZvmG~lh-eb2zbtyumLv@HydtB(kMSXBx3uzsvct6SxZ50%aQ#NTN4FX4v zQ@v8n3NvS@MIs^Kj&BxGOrs?uaHvhD+(9Gg9KHtk#oIPOCpVP&1d^KFAd(eRjZAXqWEEa%M zhy^SL7RV22&6xK}6f_kxEz${8C7J6yoXzGL=EG2bm0HB}o`-X!M~jD8%~R_mxY5W$ zk^ZmQYHp!1$8b9SyKKTSoM6T22#<#aA&nY%`C>6%EY+1b4y*Zi`PF(mOXsR-hjkzy z*4jOLdw_kJVpN%rjdmkdO12nmA@9Yfg|3H(k{G>upf9Lsfj!DTi>JGWh4gfS{hDAz zvBh$KF0o+j;ynHL6=>xbhB z9-WRl{Ftql;&l#1qXU8R=Wc`DbZ|A;6N~!WS1fA6Kcfn4l_zY(>&ul^rmHj73d6KZ(MKd*6w!X%E6k01`!2_Jp%u z0$iZJx(aU%pz(dV1qDDTD-+`$< zMisX%5y`WzgGNrKBeC;}!fVB^`*m|m(eaT&Hy}B~4A6SqVaYmU6%0YKL3U6SyH>}e z;C7YjY5HFdyv>rn8c7!-hdJ~azy=8jk0V#H#NcQ$dc6rdoi{Ztmt9iDXj^v$aH&<_He^)tj z8mpm+3Ol-wy*L16zf{ms z+urdP++p4dMI*da*W`2l(Iv<4u1D!;g8rncKjr+Q044QvyD>U1wroE)fpo0{5l}@( z7+xp#MT4#+_&L9Wy=3DP8aPJV0n%5gAGTXR5%^ET6IA4)snNf@Iyrb{f9=0Ncy)4q zba4LR{n4M-sJ{Z~YH0Q=bdX+<7`om-l7joJg~X^PTPZ=h0YzLrO!L{IV4$=u3P#9d zi-J8w^liIJT;U}Ziy{*3UQjS06zd*nz-hDD6eS)+VGu><5nVw-gPz;xU&5G zDQe5|uUJShAxIVrOm8s&e|m-ZBayreqf?*5JuKHi2dmsgS8%WQ3YqHS+5mLzUmxDOS^& z>d<55xIURKSJM)Hq;AktiA2t!TjiZI#S0Y(a)DKs~RNK)L=lTmeRamzs9QXO#1=Id&p zmGGg$vQ)0tPPk=v=F~S(T+2ph>t+a{b246>_*9TAWbz{L4ZvL?2xr+hCzYe$&j2i;-o-H+pcY$Scl6Pq+Gm? zJI`YPtiZpcgwY{e=ksnx$Qv`qnru)DJhs+ z^o-Uazv7LyEwXiD9p~;haoZwWCpIG8E!$Ur$LlBVXgO{G>TWp!Y!8e;uzq%18Bl#6 zx*Wd}7}gf5!M?@tCDdI%b=n>4pU}WH+GzP+pXioQ_x`zcc=Yb|+rOM58qhjDI)C-{ z@Xwv2L1WRXe=Ik*OkMdrKSU~ZlkL^*4&4wFK$3Jw%dZ;Yb?}wSWP@|sP^uyrAdMBO zFm&(Gf%BggnkY>+bbF1!tfC}JT$EyBxI?AICj*t}lq8`W`4PK{;qLt#_vI;6=$?#} z-Mp$^%{#?I4LVKHFU!f;cJK7;?fJ=@^WAz9s1`pUe_qmyPgm2CMA&|3j!M{YOlRM6 z7_Hs)KyuqAeunstdurm>YE1QwjH-fHn9g6S?IK>A{}>*$tA(JXhEYV{EluY;%0lMo zyX15&kF8_cxn@F>b#!Gx-3Q)OKPk(!+4DKKvjTEWrS1~|GgM>S+8b)ryd38fuKmY<+yY7#Znc#?i@ zSvnjg^Ib?*IvA6ee&Rd6jRNDb2tMI5nj)OOG;hU_egH{{GPsqmpq6yOr6r<5ZIoB^ z-2`xJ>_TIKJyO8m{3(C)*&5$jE<G=P&s%BV>?q~kSW7$6Aq6wf^*JKm%t zf0=bEGCWn*LzUktF742X_aeJN*IxAbp2{1(WY+jbq*o4QIgksadZGl#AFVIf*KumAbKEu_BA#eEkn&$LSQe~`0~@t0XPL5^#?wh+Y4+JcagRahJTCA65_ zCa1(+CIFz62m~{J;OPo{m-j#~b%$UesXTOo7;*Ww-=I67?xP$HIHK^Ec}`4;m?#gT zeV~Ab+#rb&tnV?6h3XDA&mBcm5qdXh)P&_^T2PUI|xOXf9ENZ zP@3PApZ2>KQt#8rx)5Tr_l3NuiwKNDjThYpGD@8_qtN50IIv+9U1HSMViFqK6RjP^ zBn`AtjB1MBb;C_OfQ?P&OK*nMQX?-ML^gtOkwxyp=I~>-e-+@Tl|3Si2fgkZc?}|T zi*k5*2u?G9ab&wNBI;{~%)Q$qe;V7kMHRR@_*W~0tMbD)4E~98MU?x#kdcQ+P^ zX{bbwLf(v$W|J8mEs`c4I6hKILzF^yLJx)AiE!*DXnCt@!ud8V6z?+Gy@|++S)Nh<>?c}4gu`3AOWD1|ebNdc ziHfm}7F+MkNc2gRT?rxO5;WK1U=D$hYNgMq990zu%U6pmzXqz<|PaS1;jj2}Z!RD>lUQ_98 z{5~bQCNnxu_7IZ1NU;-!?=PYfC_G#6G>Jm1MM>1X(t8AVT2b{?`OsRTPs)m^*5y3A zkv_ExQFhGYb?_~fe+FowU@G-p;d+#?9c5EEv6j~L@N)`J71mUiBrDgXs;m-^)}ko5 zj}gCIW9lJ_s4nMU#aiLqo2R4Ig(yp#j_0L&j1G)4tMehea4S`I_A<+s@TZBYXg@w{ z0S1JttD)3GZwNZh%ZtY7*@-Yzm+2X$LQ|m85nuvQe1)AVf2!Q5O8fAxIimY0!xD&g zvlf|#XRTULb(m|wGj)P(LF(h(ypooH5~S^k8d~*_(5($W)Jolg)CO6<1*v!5WdFKC zvEIY^@T!W1%BAtQwa$gxz2YzxcVJ9uLx6RUx%#2Yj~%>5;jktd)!XPUWfZC;#y&5V zU5cmz#)i|>e@5gdlViGsLa;;-Cb7$ChDay_Dnej!Zhymy7V@fCTt$#A;%WO$Dv?^=ogz?d)^eAjD9-Qyz=^GL)5qUa`N5TQOF+LGjsjF5QVJ)|MlZ za&e8Jt-Xb*fxUO0>>*6$16m{7h-!i*p8#pZb zy6Y-ME&SLd=!x7bR3v<)6q9=y(TI}`z!>FJAeXM)Ho5F2C$}8Zem0PjH6gmo(Y-nI*)0izT+(zzXjt_dF|af zrRLkDMBTw{yiUexrC#Y;i2&S!@w3WZUC6KR*Ox7ttW^B3k`c@XDJ)GQe@MQne<4Dy zLALgoYYWC#5$JD8C>S%<^8j?e6^chf6ttoyU-<3gwNNS0P7=gz6IobF;L=z{dqAXP zq2>~~ic4T&_@aFvF!tDKlE9_fg|3D^NS0lv8Lq+^Uaqbp>6$G{1u%lQlnq-hmy$Xc z-1iQ|Z*5qCj@g}(dAHfdtW?z2f0)d^ly$?Y@nz07=B%gU6!#(gdd#JBJHn0b%g8J_ zYv;M{&B*MOpA50K$^7IZ#4AE=JrvnU+6_w>i^2^ZGmo$?)&e&{@r)>DQ0?svOOQ~t zyoy>|@~Jd?e|q?0!Ne>|M5RDO}k z#0*+ZOgBcQ_o4*8^YqYKAOUHTA{?vu9NzBw$I2p=ZO&MY`ovtLUPel(0ur^V@5Ja7 zJ;h`URqc{WG(%X5*0QFHs2z#odNQZkbX{ctdZKbkfO`1I!;VoHUl`NRcWQILNKv0i zIWSQFPXw`1TUdUp@D*<$f0s`T<)i7S@O+43S^S%(n=s<}e0+74&Ls||f}H>Q>+$*f zlb0`#-tWFYI^N|OIGCpA9j|L;^Vy-+?AN}KpcsHSU{UWsy1bNIOJa;Rwq_rsgnpQhINa6F+ey~O~-e_R*=2o_&uJ( z)GVs^Acn?I`X*M+T|@aVROYCm#*DMjRc<+pQUJhNK(2>JFX>i4J`Phpk*U%yk*A&5 z4@wS08EZJ@6@ijr8#z%s-ggUTu;nOt!{?b|`G$^eCNj@me}x@itC8>2<3$+Xq04wY zLYp2bvoAdtp{?hj80AfNhC=X#LRncP)p08JUHu7_viN|hmN=MsTQhFF<)7DWI(*#I zrb8Rv27~RPZMx&hc&12~nKI0FQ;Q`=SU1}(lxKn526Jm`yB!|w5<7A4^@r2LljEKh zB*x}B*@CTEU480(TfraYB{3xlI9_6Lh8FZ)X0jckBpdS`h#+NOdURd(Bx%n zy?^U)dv$brwEKgw=j1_aE&E58pr8~Lf0_)QIda&H$KULvTR%?|6M*E>ImY9WQsg-N z=1oLS8V#7fL6>U6*>5{uli|q6tEj5CKaUU8{Xv_Q#@mj!0WY5xM9bJ2U2q+PT63hg z>}--s2%ZNCft_uAgjHBUC!Y7f_Uvs>F{vG=rsUu@X@xCGu`&a9}&O8+l0(2UuODOqBbb zUDPFJfZ~8&h&WLfX1#t#S05zdPj@nRn;nx|bN6s}8(%8pOG79u&B$S^kFuTG>-yp5 z&y&I2U2_5r=I**>na$lb^E@8ufAW~jSN^KIt1nG@-)+ZhGGF<4mHg;!zVd;(KPa^Z zb3ILk=`vB+eY{PWuO&b(BbSOql05vKF1V*K-m<6k=3|~h!a|}*)Q&W7fA>9Sca+N5 zZ_%xK%Tu*wN4MNKYX9A<85-5=u`tYyF5~ei3iKp?CuXRJ+V3^xRv5`=f6K3v^!bi( zZor{c{Y&&iEB{s1Q7+|*J3y(qC_)EvbbLiKb5`=Ev^Bkf?T2tP+L7l3j?>ibTt%yk znh_4_$wwhzTH>)}B?LsJR#8|<{Wvkbu;z=kk@|=+gCIfMRZsb1rJ(ymYYhQW8i!0F zb`9ExT15TM%8er{L=~@Hf7rIgnIaETnY`@k_vr$iF;BCRLQvUvn*5RFS+(@Qd#~{N z^Zsjt%aeb)w%J*9DSqX4lGH}phQ{8*?~}d2<|&)TIH6**U#FML-hEuQm2|e1bkgzF z_3{txrQMox^%$=b{6R4m#<%_=HAV&Q7VJZ?t40f^Ntfv{*+Aoue}s9-)ius;FvR3h z%~>X8wE2_WVKNG(6r8f!M#ci$x3S9dP#rwGRnzfphyw=n+(i~5(H)`-W!TWy8ztf# zvn=EvR~A>2gq>4xpv@npW83;-+t$RkIk7b{-`KWo+n7vjO>8@v*vV%9wf9@qS6zM8 zU5)DV{La~qFAk)P4#3*m-l4xP<&1j*nj5-BF@NVK&L_9iLm zx6nEg#Hb3fvyj9Aq-tCbB%rHmYDyj8*q0)Aog6$3ToV8lj&Zb`v)MGYJ#YTSC?HyT*s1qxnI9-&C?#1W-qZCyo}%eLFsfhgn8Nb zHT34};abW-lLbr8lSGHt1fB2tcr-w`RG*z-9E!m0-?ynt>WR@sQstZZcM1l4D}aYL zD0TMG8az)!&CSF%;}nA>FP!`G?!n+>lP?1Ex(B}oTC(w?|U-bSiVt> zxn=MXdw;jtM|{%$+f&Cp>E0on2Y)8@kiz0rJr&R)QaB;L7;n_SP;E{4e*%#I{{)~C ze>E%|9&Ae2Se3;w7Z?6qrqoyTUHk$9{J!||n9r$IIcA-g7gdYj)pbp)Q5X!p2wh&B z>wOr<8te0#tMAuu=umMOWiLb4tkQ_Gs(JhWP0XDvRXU7sS}>Kr)*8)(ctH100IrTy44NTYYwjlvY1Hbch$R@$6rqR%-VL~@3$ zY#7ygFGS(5J$|%T!*NwYdDCGeiw^OgyKw(kxUn7g5@Q@S+rv2GJJ=VUrrTwf)l0R6 zgZOXO5}>txK$2Z*w5Ok|7L@{e*sYVAY0e8kF2T}1%UYe1+5GM-0% z^J?p0Tb4etv{2G84vtF{D&|>FTg)wadoPi8>G|On3T<0+;xR7xl-q``r&5zxG4wK~ zo=*M2Q*7uCu|A}t)D>=x_$)F`Sa1=n*Xerr{uGI}d*CENnYjc@hBMJU0k#`vrlmGR z^Rwf$ks9DF5a>~e04UI&YJ1Uort{Ds6TTlPJgA@1#ue5s&BTE~m|1h~4 z8dH%FDo7fpKJh9e33J`1g3?-f))K4xSP2?T#AKN#tEo(iu8zR}s50^(gW&zQLbvTBW>op^F2$ zAN5zq06A^R%&kGE7~TcC&Au_tr2Mc*%@6*P;H;0G#7z-dF%OUuCFu*s0sH%RMPO6N zm$lw60MpoaN&^e3by)U%0%voi%FNTKo~jQkRf0FA6r?s+w-A;m8l$06E}i%UNl>RC zoaF+y+MYY(Th#N&WkPuzPP1v)Qncble+(rE;uQM&a7<gGv)Hw&CUubu~J8u(Ag#cXqR9IQ`bSu)ZVqA1&PX0L|+ zZ25_jAH>ZhZn(+_qk_I^XWPt-DOBw%Z#G0;e$7ruMq;yYhg{S?%Zqcu|^NtylfLSGJ|jD;F*gh6Eht@N=L~8nIz2M>lD@got7M zl6@1jPLUNq#YJYXNGVZXWzYUhD{CVw zs1F@@5jMS|2XS>VosVtDnJC+iNqY}DJ=dVutlidu`(N#u^fO^ZGyZl5Sw+;j#9ciC zgiAK47JztLx}5_vK}EF49tX;9^rM0Cb%(+fr=24fN*5G77SFLSeTH=i!@pB#n1GEj z@SH>Qo0oUIZUe#bz<=3!b6Vsn-p5eCjfC_5|7_DY+SEJX?!2Q4XOsGW*`{p&tVO_- zy0y`)fbt~g(O~D-op=p&w3QEgR4LacNE1KbmgI@JMI)!QSny}kdc(N;PHVbTYi14a2Cmkb!Ihe z)P4LxrJ#WGg4LL~lkndS=sQhfTgiYIOd&3*b}l_~;IZ#LtvGq01o1ux3S&4v+R?Q! zZA5x94ZRxZjhZb?<|63XjIt2P?qUS-o74KV{7A3u?KF&@YCSLwQU}bPF-}rbGxgZ9G zD*Zd#dh?p-({(x&BZPk&Y4-9&=2MUkh)-~NY9(8h}n#o#|*30Hf~ zhdudFsQyFHL|(C*F46QUCt&RXUmnL&iR^Rxt3@wdBJdA^>790|&ny6LL$m_7Hm%Qu zjTPJV4>b;I$rGxM;k_lziuaYf``Hvx$h?Yz8Rt1mQaA>Jo%~0N0DQvt7HjOC9Fc|H zs@_R3(18wAy*SS<#PkYi1QR6-GoZaZc6Ce9R;;OdK?zg$dGjgTl{KlsT^8?A1y4>y zh&T3MdT{JtOK==f(E!9%r`4482%|s94vam~HW2GpB`*sttsW%I00O7q3Lgjly^Y2d!xEp<$KxqBU~0BPgL3 zn(7PPPHJj;n;{z$30@CI!A;k@AA+D96H~l z@AGR+m8LsJXD1?<6dISrg4BJ9ga>2JV0+apBW~-+FMlgD2wPRZ?tpO~1^?zn?qRUa z!Dqj*+BId2!2+8wCp0K(0n_f>t19$8E79(bS!Bns8?W9550zz5`?M88<8);Mo6V(L z$#5MRsuW##HlV*D;Pov4{VkU|LQh@{!h*iUp9jzuhgj2LL zKv`#lQIG;$f0B_ZLY*;cgKa6iw2$tG3JRnxPcF1f*)qUfH2iN3zg=9m_PqJ*;$5y;FF}@Qwyoz2_ zH?Z_MSFtWn>{7er*|ecjv+K=*d>xJks%Vc9@nSWC=Z1ueWc*_#)@xn{#3G6XUMHMk z`<*{&0RWdGQNd?-Jf8vvIm=EE$e*_L42ehM62y2bZ+^RFs~1N6I1ZV)mv63C1+*dP z7W@LWc|=^pY!8x@Z6So)NOxeXwq77o^inCj(npWQAHPuM2hNZC)y?Nb6aEUPUXPi8 zTa?!+ro5U+!aig5co#PusGmvF@enYxWMHD}@POJ)&=Le#e+VbjIm_CzF#N1LKr!Y`sF+|$m^~epY@b}fg+*3*OG40+)}9A zi<~tvY5p1ineGNYcnc$q!W(7Dc9#~VgjWCX<>AXZ9wH`IJ(lSgHyG< zL-zS+VKCwa%?gPVK|ooOsD5>LmO5v7C19+cUwx!IUW7sXS2R;C0eMqsCUJ7{l5t#U zpPDk!#`{VF%ZQgX$F1IjQ5Z5NYnhu)fOQjEM>LvyZE8@8M~F(IauPoUQ6yTJz1X)L z!-=hgStl6oC|@w4(Y0VM{Umsf^tnb<&d0-_7sUi5U0iG?j3hWwo2dr(C6+l#7GT@9 znAr@$Sr)De?;15rQPEFev-ODHn`#qeD8avuYS1?H06;onn4c&dD4UmA;eOdAns7Lb?IE`(r|FzbtS(@Yx?_hMDHjdZC z(7o%qT8izMhZKiE-izI~{91D!_;628Waj+q`2%wP`vr%6U zd7(SAlHzigU`1&Q&e#yyraiURJrg~>+MHaMc05s2|1}GByY*WChr6mCPr`9(A=6A4 z#~bws9^G`Y-`;A|6!HpuQ&Xwvghgq0dLO&MKY+*-OlUTJz=zue!)Iu@{BtA z2QDdyxWUN~Ob#MQ7#pqGOnq*HyOA|Tiz7Y3Z;yTSrU?0Zh;R=9E(R)dm0r)h)oKY} z)M+Y3_QvqytZ1_EH9=K+2oy(26{qNE$d-*_?9s;_2m=VtR6!OaIw0_v)1J-5(mWsC zimD(@EEbtJK-F<-&_7$2DT*$8PMH`9DgU~H!Wi;ID2K=gi zY=2hXfTed)LSoRv%Cb$!iGJ1?^4Fk$KHpVy2C_OM755{z?1E)gGeL>1-4Co6@T?Av zyaf#K(R+QO8aw|4Z@|_W&odQO=5mBr$+j|k5%O%IeJG1CI+xd*mLj*Cfp@S82IlxLRYSvv#?)PQ%ydnX& zBNiJPlYRLrF5x>W(zqXZrpu0v@fmhsNpioxfN}tSgP1bN*vxC05 zQ8W{}h94x&H-Z;BPSw0q(5E2ZOtafpBCU1KoNaEP8?0jB0+cr2S00V=TONJbTD9ch z|MM5KCudp5dj#6=eQ@KjMPqikY}XIg6TKQgTxAX!x9^H*AR5lxfp?YfrQ zza$b?IaPAjE`B2?F-M|5qy5~yt*7B+Amf6HPj>JhUMArSu+mx^r2ibZV_|+COg2eH zCxa=5lMaF|&)KUiXYx4l9Mzpb$3LW0z5Ly@M#TtTga!<54BfA#dd5)UD_LTmrKShr z!lQ+>N;KaUQkP196;rKOpSmaDFLtYaK%C4y|F$*QU%g_xu8A!cMRu3gEI99?HYsKf za}yFYhs+Er+>%=T@tud-W}|j{EiTg_&-p8VN})@FDX?{|5PNPw;+|AUxE*56Ww21w z^Z-{Kt`xw2aJlD2V(pq(2qY7>T?h58mG6r;@N|;Oxay}~S zn1j}g;xba}Qa*=ectM`TXfa`Rv>8*;p?NsiZ;7L|`xXvlOoW|b)8JBn1F4sdm2l7_ z4HdwUQ?f}SWsZ}A$nBVw14%wl-iS3y+321xeXyNzRg##C;txiXh?dGK5Q*lyY; z#JG+FQgt7~K4WvBr+3BA|*EIy7y8LbMGTI=$5rKIGO); zXw(}h5ZFIk(A*~bAB3X`YwUXWgoJ(Qzb8P3eu?yVv*#}3RFkGyy2AX8XUxWhpTd=w zTkEbTou7H6I0m(QRIH35&zv&&!I)IHxHXQRGK~T3vhu`a9J82OK*TrRJi_nnmnK&H zDO2fKqdCi}nGhM~@slFuM-UR(ma%wAFA5Y4ipalSF!Ih$ujocFKbtyUQ_r&E4G&=H zNc>rT*H;(~&!TmTDho}8hOs?t%r-K4#+yzuPFpWN-?40SuSHu$gn_u~#VTeVtihFB zJ5Vy)sw-Q~o8CJNg{;O?r>Qw#64R~s^dcoo?hm_DFDQ;n<}x)Sid!DlARHH5nc}5W zl@D)0m)qnMs|@_}%^d-oBVICkks^?dCFZYGYlng5TM8Ln$m(FaCl_@jYQa&I zK#qrLAHEbuL6aQ*`2KZ~bDoGH*?8PHA$P4*#G?BX8`HHfn`{_i4sn2yI8}mdg~RL+H%^zGYR-c*6ps`Z3h} zGE#2w+DdB$BjCAI%By@zGMJ`J%CmW3hB*g1SFvd{3yS^42%0hoa$BQk&v<1Up~i?o zQ_qQe_IJ_oBJ#)d;G&-vVK3m+JQ?!QaU6mp5-KdpkWfz?*7VB_OPumDR}Zr8w;B*hRPClIS|3$M zj))qh?;yfWkBZ?pujH1F_x+$~F`aM!TcqY8w^^GZY4tZ*Ad-&%NfG74Y`R1n<&Ivn z6=VL^tvW2F=WpgL^x&keZ8A@V_k$%>KL_rkv26PgS{qUq!JF=cz?*>KAS<6Q?;GC?=F(b&8BVdl&#*Q~3BEw;ewS`(%dPko7Ji44v#+WDZ@m0U2Mb8Gip-QOeDmH9U2ygN?SJwe zYvK|KWjKkVz3mPhjogbk!ymA4bC<)FnnsWG9;1N)?9TErF-Fz5e^7GjjQGXT8`(fJ zal9mw%?BR?*76lY=6pE@JeS3@v?F4oL&$FEaftPK$}E7MhEOG-kF?}%vf`l%hE{hf zVlJ`0vc3IIBC2XeM$k$l7UkHtXNXJMB$ngVmj2h_S!Zj0b*||sc{LZ*nwK%>QP(ex zWdze$$(|zDI%)mxb@O?F^kojr1kJ3HFqQWqM@dx2i-8`&zjho|jIJ{EQWRf!%%^Vy za1Adl%YuLzCX5GOS?YV~ja#qKq(@l!?=maunqSOdChQr%h*Xv};yC1NPank48Szp= z_-YkHDbSQVxNIT8*y^zU^zuz+g1Qg>8wMFgkr80VR(@#C^&t&VEQv57S)kL@G5hsy zT%xm4y;x;i?n;3n;Ja|bogP9^_-Z9T1alV|s?!B@)J8Y{i`P)1h02$!eQaHqtu!~# zl*B>KUa4y4UJyjvB3~GWF6r$;a7|aQGJr)s*J7H8MO<+< z(98y!R|EK2`6_bP<#JKnt~)U#dh}8=Qs@ZJ1J zXdxo@CZ;T(lo5+u`lew>j2Cg)X(O;TU_}763-E^uk*70MMI_&b#Q$kfdW6&FZG$c) z=?c_Q`Rh#aNjd4Nycd*C$B`^23H_D+J6rzfRkl&iC}ba(P_T5HLIuFgs<#L+5YsWR zMSQ+sA=mJIPoW~nVaW(=&EIXZKKp|Si|Yq|2BJA@}~_Lh^(!upJ#7V=;Dy|sP!#UwBLV+=<2|0NQv5B zaLg-hPesD7%ZT#z5=-s9@P~`iWmIESVaNj*PT}-bMq-Fd7-X&JVbGlK9jd@dvqyVM zkzRFR)J}0TuJL?(mvd|9h8sRl>`A?=2^$-R zD=))!_CI!yOOK1(NRkt5p5mi31$Ap-7PjCYqC(wuD`Aq@Wyl&?vf_Zx28p0&x6iqc z3`k39XciQ9o=7LUVJ-sUI3By+4rL<7>D(LWhYSH+P<$fY2D7d2c zeJ_h|j7y-!PvO5QH3UFty?Xi(6wqf>NXuH!fp#Z!e=9&XPU*IPjA`6RMHEO#A`(ob z{QJ^(puPY&g^(l4TyOpMy%5R3os9ZNKm}&-eNv!|iTMEY9EiW13k1*RU%|YaUQsXD5u{bKnY7ANQ~G z2n4+T?U<+E9%ncIv+`?o{c%pHT340lAS&&`hCB)#w#JNG7b`+W3?{DAA1Ir*tzfQAq!7QQ-uH()#}MN9Kzf7T1| zRWP|WRM@iBAZop$J0|T6N7~qRk`*Egc{&v}=+)1wVVdYeNW07ukIX{wKIdDhMMtX` zERd|5>FpE#o99G5zToqux=2N}K6N&7`1o;D`Ce1>uz1cE?9FTJ`*7v!IlF&|b?@|I zbTga*aM9mJP3`?5*#z}^*}7PBaW`!>Hp~j~>2CLUI-%}j#DR-Cc*runR$*6S~xExvg^n5`Xa)vZK)+rC=2G|2528-}cI3mu-fn;*J4SUU`h*@vclJ277A zqdS~CHSaMquv?}2{RT8HN&Hs6SqD3I2*aWU!%Pr(DZkp_s;$V&7M*D}t3q+*BxU?Q z+0W!c(bc44+R~BeL~3&t(H$2-HaIeY6OgM<_22sF>5p}RSD{B9=4p;~bTX;0{hj)O z41MSx7Si2*K5gCwe%H@eTjnj?3&tDUo<%h2B)EngknV{nQnvP~@7J5YzPT+w^;G<8#LXgcv)I z)7-bRYw8rRg{=kN56)UXLqAWR(=N?#PWCQ4*++t=_W0+r2<)gT(G=5!zUn)F%cw1J zsqRa@1W95G)i7#OS0BbHEM;8+x`ot6q-kx{bDxhIm674Dh7XlTJWj5Kh3a9_x->dn zL~2Er1=ViT4LWYY0)fM>Lqa4+d2LT#LDXGo*6Mk#Uxy`Gcx9p>b*2mz z$~v9}d%52adOE4G@5qk|BMDFGdz5jo#Bx!;3S7&SR8X4LXO1z1GA27f=TBwCeBvbY zU?Dg05WTWnq9%1_XVOW$Lq-L*y~@Opb?=0>>%T- zyqc}|bV6kwvTXrAzt_Fz!zdy`fgY<1(#C=rEMvX#i$(-ZH%A+K4XlfQ_vf6saoe|s zDB5S3wW}VC?9Ig5wwDY*Xw=*6O6Hp=tmTwnJyY^O&$;r=BIEiOr(V@Z3H+^>s|R4T zA2G}H(#7_9U~10=vWUQtKK`IAQt@x4Q2W#K!OFi#dcBD{+Nf=zZI$T?X{k$@WAl&w z>big-#=@G8Z8x6$ugG;bmFr^Yrz= zIN_DMx!kk!^I8)ok!<7iWndl;WG2l*aY=~55JWJN5mYjjhR2*yK9{r(FRySh{D3CZ z6JJo=P$)$a7P;0N+m61b*z#C4`v9ru4@IOk^KUL9!D5LMKH%jC;}_TYowHoc?pE7x z;mO*5kyoRpP6$H4cAKfbe4J>VLt@!bo#o>nXQ~g+}LQz#o2o-$#iXV_UuHv26sK zX+Ya`&g4Ao=;QfvyR8Br(UQ;v__juRbQd2n>?-myl(ZudicHg!vH8*~;5wT^f;JL- z?oB$xu&BHcAFSXEm#7xTCw?E1lKfqTC|7=rNgSaDHD%y{Wj_oRPo8PG@FY(#04>${ zy(>VZMFtl@6Mc}5KR^>f1d!qnB*4Jk0wcEh$oqA(j1wT2qM9CFM?g@Pat;-_Ux#ks zr&sj!U9i4uAoA~wTwAxcuDW~I+_spM+`hKIYe3d9`au|k$&NwmVKNgeau|iOYlK1p zyXEty3HxJ6PPC|$X>20CsHO?m5E+9^8pauH;%ti4`l(mae)+v> zgF6N5$Hk%bsl8ua9bQeCs#8;DPx{zg?#Cx%U+utR#Q?X9J&83VA`AbkM+3KE&uO=| zp&rD_Vu>L%(h4n+YtoGwvMU1KAXuUHg*N-hbYcp039=W%mNRHoOVO?z3%DrKY0TEv#^P%#r&Li#VW5P_~#Cw2`@im}Y1x*#N{~ zdlT|TdLdxY?ZlUOYV0b=uNyeGm8j~M|1*{^m?e1~#(`=>yx0TX<9l5}J>>fxC`*K@ zmc9DhK|j%#DlsTH-;ytZ>F-=-JlkGRHVy_HYK=I4wnjTn%^wU{lB{k|bi%4=BQ(g3 zF8Lb&_2ihwYMti%P+?A6>vUy!5>{YlSrfZV&m$nKGOVBdi8JeACWEQf%aZ%a$kC&; z!ER(ESTWj;`AZ{+Cb(O~-{|2jd2*meQ#Cigu);fhwap=_t6_lnz0Er=$KU#GeUoKz zQ4NdXk1H8AQ7S9{K>KhGiOm~x%aF0gYCpD@%av4lu3nanyO4gI{q6nnIRoIq(EEYB zLqs~Q8sz-Ihx+*9*wp)q(x>^OkrO|Ox=B0luvWu~4fU`qkxxZDl5#nbigZysPGt~I z+|JJv)*p`PP+*K_p>FTlU|H~QS~F9}_5yeXp@xa{mKnzkh2}${MOpS>Nh03N*ee-g!(_bb7+8G>n^94B`N~aowPN5)i%X$`RLJlV6*ev@g-9qOhN^I zV3MLH$)gLj%ZP*~;$}yL?vJPW=f_#!m7KlBY$t7%S(W$9ttp5>so2n;?r84*t>}%x zA7;uM+IFh!)|aNw;(rP1nb0n8RCCqh>=y)Ze#(gPgy^oZcKwm zJcQS|jGe5;4|*Dguj=Q53ol)Cz#8N%v8-gh#GBC=$HdB`rT(P+I_LM3K;3BmRDcaa zqHU=CC=PcWkQ=+jp0fvYsI{Xc{vk3KZ-zYTOS@PRaBVafd518pj)5siqcX^!kW=pv z1Ot75-!yMEGHR1`tTPL|c_@YSkQAYMS#V?)xRbU<04Ip0MYvInga&ci{oSjc!P;R- zt8$5_F!E*pn(DG{Q{I&dr&AkMCw?Z^;Xo+91q;$h{lZwSQT`PV55g(B4~zYmRFz+snv;!e_Nu*^T2p%jX?2(1;>HiNP9Ex*aqL~R8DW13XJub+p z4U|FZ0siI#s(k8LY+4_L{gY%fUsspw6Nj7ufid4UYJI@izh#T6FV7ZRXC8ksV7egSd5re#ag$`GBHhmRK4K$ z-?L(eP*efSma46(@%hj2pPpWb3v7e}vrDkG;L3^dg*M!)kZM_42CNT8q3)*QzH@n? z1kL?;9fl?*8)kcxfezP9(;9VLbiS$wM>9fH+HT1FpCXQm8u?6OOJ9nuG-|?w8Q8-XTaR2E&)56Zkk*8c4X8OL&KEpav_4v1}AFRSV_!qJ#2tVIj|1if)wNs!7PG60j*jW4N z#AS<_Ou_n2QH^So)-ad)dB={fD4S!F85iGvMmfdud$vXJm=+Qquc`Q}|7}C~A{tj* zNP;B_gk4bxjQJDa#pN<@TDn>PaG(s^Cw~I`6t|7-^3RwDpW2AqsBtkyG-S=fUe?`y ziLg$r=BA*Z3LLq4{6n-iGrm1iZ~PwEbE#Z{W*`DBg7eBS4)5*@PK)HV5EHa@aI&z= z4Ow%+Rm5c#bCmz(gFZA!NP@yQJ|2p(5h)ePZ3D%PlG@dfQG-{iWZi$YKahL-jCT(h z;u_VHbyTlQ{Wez;$()F6V(UKHVsE5_>F$;_7!=iT+of^|79_d#S+mV(1PN zh~~@qe(!)z`GcKFq7fFGkkL_ze}9z}Zu00yHmfbSSWeFTizPo{tm#Tkd=t*m?8zS# zRZK-xtAdI%`utc&RYYsv?sT&oCCMUSvs@3GIyp2tSs^FVPmbMDFQVU{d9dC1W8HA3 z6P-73`ppzTKEB(%S@u=-#j6P|_@S%Lc7TD9`cR%fH$Nn*DeZtgOOhHb<7Mw2%%g=K z|D9^mqu5b&*=pm{f}GQgTLmE)x;%MymP_iiBtd|dhK;Ro=(*X`spWk8y3+*QKSvKe zv!b!NA21N`zmQ~2)Xy8)c5QT)zqX*;FX`sl>7P8YO=X_v9cGUHeAoVOczL5Y3h@rpbo{XWR%;1_f| zYRt|K-i-&1D!gEv%>l^Grf@U>KFGz<_!RmqKgo{D5^g#bBk>nvex!dR8>+%Gyl;8Y z$^lWhJC|zkGgj5(JIX$oEcP*zfr%s*zbxgqY-mhy8@xz-@ zo4|@mLSHOja4;=dfKr!Z7Btg$tl4k7Kfa+AYN-J}Kuk>r0`87q`PRzAs5*%|6o zTv@I<*@y>koi_CaNb4Q%&#Jjzu-0Vch2ifIECbxSA!0=c1!G3S2Yr)fsMb-=n(|JZ zd7L_mUMe<;J9R}7ZPWE&FqS5% zkuPUs_vWbApIsU^S*!m6p)qV+66>LtH-T}&@}@WGV$YRS?;p3X+544Z1x?6|FfdppkTyd2x-T6de9`Oi8dz*brAh-(+q~ zIH^`}&Y|}?HvVy5HqtL)kM9ee(xp|39-C483I}nM5MU83{v(DA03+n@pkTJ*A?bW8^ zRq<*tsRT$YMxAs30}_Tb(UYi`KqW%+RzpFGWY==UJeM<1nSh8lwN^m#ZrmI(;a|s4 zZMH9d5rxZhksbn_-nNe{swj4Ax=Ue@JtRV=Dm9P_8HbL`UcsK zVk#-2w$*Z36n~% z>HJi5Y(-lEx-6z}1$fJnzTEk0kR|7(nIoj+n=ZxhihU7+`~OiMeXT7n=IarN93q=) z^ja++Z67}JkK3V!GuZuwzIRHD)Hr(^jt=|Ea#4#wD8vHs5J7G}>JqVP4W=4M9twq6 z3a85WQVC@mT>dAx+bFeF@I17EVidShSC{mInxC*0*mZ#K#0#+&n%5r0P@3=1?3X8e z&j|rBg(Xm2;D`fWg!6vTc;%@TmmV3s-(STAdWZJe;>_=%BAO!j-}_?B(vJp?IATw}W(fYu?#x;bgUvQFS@#MDewHY>$c$eysL zm92rTGt+)HPfI%I@3Xz9y@YK}p63 zxcoF3v!;3^cD#$A5NeIfh(;5AZt2Guh-gS%RJa5+Lg1yoSHTJoBcT$SF!ui0&NEel zzo17rM5ZfaIlhJkyo6lo>gCOoWB%4DW9J~Lz=OuA+-sP=&SZ^ri4EznfU}$zkbF$E z67labI-52uE;zmX=m@rpnYE?SieS_Lgi5a_>!`JA{Fq8(LSK6@$VJT)kc5hIs$8K(ZU=2scCVHiN_Ww$_*8~22mp9Ifs;t*OF$W?=BlqNTyFU zWV5<0I8RiAJf)ZgLYCjuv{~Ea@MWrA`q}XFT@y=y5v z6pMc)a-8t;4kDF*lfL%H&(2AFR*D+Avt@tGI60E1(j>l<4;ee&JfK{yW{+T45PyZe zV*e!{$9ThhIMp&V%hz%wNfAmQR+ zZm)2s)(IXDO9|4Js`3b>MR~M{Dzd~hp)6l1v8cSjFC5WK^ zdD06lFU^)=DNc*$7(Jx%yJQvr6%Ff7ycdW_=%gBzp5(D|n$GhEj%M^owxMdIgBlx+ zKh-hB9X3zjx|y0LC3EdzPZO)PW1RM@gGrf2_4cVq@7tjdfg|t`a2n}QrGfa7WBwY9 z0?O|o{oKq|V!P|#&0`AYEzLtVmR#&p{WCv!IRsNnb-GOr{f|oX_J4=Gz@bd)pC-#Z zsnlF=HL{A|gmY9Zy|E}pY=0cqQ0Ua|QAzvZghNK8kJP9l{lqfq6-_~d?)3N4i{CkD zH23S@+VJx8EY6$a0Effx` zD@uAuyGm~!XV1Y;v2pVg>VKW^pM@QxDPOD9R^jcWQsBiD^sc~m4aXr1k=r=Ef|SsB zY7vGa3UK!cDTjHCA^ZQ-6e0S^Y*Lg%EQ7Z(&qnmAY3KYf1}>NnwSzrhV*PY#5lxC~ zeDDdVx~1EFiVIU3{cs<+O9`kl)@XjK50+>+#-g{uFO~B!#StvdG_5)7<=d){i|(I} z-sU9H-yGPQqG!5)Uf8Eg9$&lU^fkjRzH}uc$cu5Zmyqqw-MQaP!JFh<$`D#dzwx^~ z^%k?GGtGm(0Rzx*uM3?ozT6>Pyd&-o?=Po0-me1HO!;nc(b&YZN2tT)=D{pV=o(ML zc?o-R;xhz&TpH>B4s1CsTp*Fv+0*Tf!sawAMz~dyb!(vDNCKXL;7C1D5 z3$SNVQL$zt7dc_)?yaytdPF*Fr{D`YR_~GxK|a@^Z&lb znvt-nf#0b&RH5+EUk477e&R29GEgpi@aa|R+q#>9t0f>Cjo8e{_1J62H+1hv1CUYx z&R)ZSO&FFGf-qP<ry+E6k8gYC$5h{7oR zQ=^6K60b6t2HN*%R;7Rd6OnvlYE08#&7qBf}`N-j#k9#Mq(c5Y}+&(Zj@7L8dTo&q-cuq7OR;7v!nnGjHO0&MmSrj2}Fv$#5ma$nE z-aUMDT+$K_ssMA$?S><{!QzjK4-LGJgJ$i7PhYHJbzT~?5rCNW8u;L((0DC5&Fkom zHf@$B%6Z({i8Sw3p%Plx)vl2dz1byHb+K)Kne{hL~c8`Kuw_Yn}vJYG;w^N^;Ze+F0K+98*adukspYr)tvo1ympL z7uBm1&rR*v8-~iPs-uo)3dKz>_e4WTEv0gpd8#bZhy~a@PT+2Q4$U;Y7sWV(%0#8F zTUWT_kX$oLhryYY=xrdu5MJH}_3vU*fGGnK90Tz_FHT)Ht{}AwRO~kOhRM8_Gb=?& zVl$`m`8amsB1-tareQvB_FIamx2ra8#E2|U=ofv?2Ba^6 zi@%{bbbN^*2(aP?^5_m2E$1in1R;{A(RVeGSLse5f@{gg)=0#oO07ytS8yCdRkvo{ zk?!cjK|EE|($iR|fl{hQy)#G`Q;^7`nIB8DuGK(kn;-cK;8<_B343+#vF)+@l>Y%w z8T=9a*M}Hf3(d5`Fdj{lyv7MGhh!SO2db}~FG1Oy8_0iX#XNz-AiuMSvkOA=M_q+9f=wd02N7?TWTXQ$^ko*oppPyrMMbOChp+A7Gr{`~B--;RD*Y&*h zZoOZ#?Rn0P{FEqXZv_hF(cc4psT-l^(=B=rdT`xSrg6ioYsGx@D{S%6xAJLujTYbS zW@6gKX7KHetAh}wO7$x;lA{S!9h+KD0HnUt4M+{Qqox)sK%~|8?*K_z+|k%x$6Gh& zqK=7yPQJlW`VmS{c%Jtcyj%^*O7K(;RmO-Zrl-oNJB;8>rH`_yIs3=<%z z?esr`n_8>57u_r&93nqh3>X!go+RI;eThKvl!1)0#hnl2ZNu9EdP*2$A?(W~ujMTt zfNw`koV04gCPgRDs}^&qIPhbD^J zqL$2#jWtD#hX_{Mf8jP_GnAC5q2rQdz!|Ixg}LQA&xM|8WU@SscBVaztb%V94byGwppe>Fa6zxhikzazI~n%B4jkK;74G&|1f)jr z{v{btTsUbn$VsWE$rnx^DVCSV1MAg8&b5L+Lj5u;=;b!wrjKXk92aJk4_8H4K$40Y z9UzKSxD|IMy?Jhlmcyw+t0_cf{~cNTCV#exn4YhqI5#a_lW3DMrev+HwT*~7njfx0 zc~|bSkE%PB<~78UXGAsDo_HInQp<8v8*yoc%oDa-u#r%X6t#$Qt&c3&vAVUy;A|Rv z){>#xL@OCH21YJX>5^jK0)g=ioMkUMy3;5652$RHlgN^sgCLd2R> zVJXlCD1))YosC_j4ndYQ|Ch3}r--xUCJk)>G3ctCN$+?yqme+ki z1^eT<(p_txP|1z)&&F+xYSR-^oU{enC1qXC;{xMz!_P?%N3lX->s>~4K$V7q{%&QB z8G$%yg5Rs{n|J*SzgYEiekv9v5MygLVner-wzjO*kdZEaRK(LQ4ZB90TpFSw80*)aF0s**veC@*GdjKXUfM zUTMkQ)$49g^-iCyFhG|B%-kJL=x*+Gu4qUz&M!Y}Y%ZRI*{q*`=IeC}N4mY|2D12# zxZ3XeAEWBU-Ro{u|MR>O2qAKzfaNg+waY z0QmdEl)F;`4$?T&Lk#RJ4#r)Q@~wE|`~Z zs=IWmvOZvH(K7g7-RLRC~t*0LRv>8LLW-!GRhNVb?FaS~efd zAp&e!4(8rz`byXFtI`i!B;l>zcj!!LS)lw4|M|H8$e%TP&kODsyrhWT>*Kmt((r4d z>RVlU%O^twYi>1QGCuV5w~Z5<*=@g9F2yoa@MzF62rinem~nl9H<|f^wBl^-X8T46 zTS3+VAluGs|IgmwWD#(9>l8mK2E)}%l16|wUC$o2d=KncbbSzcd_Gb_3gxVG;`(i# zp6^2&;;m{+tC?0)*@jZ8lHwS?(r4{XDUqM_nHlyQ<9Q9@pK}LnfkfZ~eOT``w=|u; zwEK1RfdWk+xQ&)LYP;uCE@>|{+lqJDrWKxR0F-R`(6d%QrcazPufAy>5n3-rrc9U% z78A;=(2Iwy)kN9f;>njc&Xm_AzNQWE81>h}$ z509`!SzBply#5{(A_)?=Lt~a&+8|rl_C1VnrNoC?Im}KwRs3jfo!Mav%432sS#!++C zZwx*mCcQoS_4G3nX>d|u^fTz4w7ua_07G3vJ4UPe`}Kt9WB8AV(pbw=!82Vh?}H|7($RDFsYsjy%j`lnJ2Bf8RDZ1ph{ytmLrGEO7yW-v3k}qSm zk*29CTSYh3is)g86_}RzDJKME?X6;KpL%fP$%(6Mh%2G}GCuX06aZ>Bj{T`m$FQb& zv6n`B##xAo{)dB5Ro3u7N28x=u9=;bT z1)vmnGAtW>i^wu&&U!ATr9czK<^gFAmAO{$2oA5s4cXzU<&$(RUZHKENVc^kpkjW{ zUy`HP)WTa8UIhU>gQ+$VAHQ>Uu)gdCODiU6UCmR%DC5kE8xylj1PySi23;r8m#y&H z$Xbg(+J$mY&JbtzIFIzudj<XtNe-g+5@Aay33E^&(HGUyPw6_?6=B{23^4 z;J*q$9IDUE_K&dp|);dS$dVhn(tg`bg;|`PTl?tOsJvK=au-3)mF;SplrSKkT&h( zA`f`=TMqIio4ZZ9X_|3Y!XS1*G9@d}CFVy%5q6ItRPyE=d(}f3SS_JjFyJkt<(W@i z>`C6$#l9f?msz*+X8S58;#!itUb1s=JPjzPP&dwB>P#(Lf1;F4#~8m_hROIW zeXIe5)SR?bIIsLt=@=i?O4p=%7=0-0dQ}QcD1f2zmOEWG>-#(@fm6}j07&{*qGN{| zkW`gZ{?(X05m|2Y?>u_bRI;t&PwOxc`zy15jgOXa0&1iB5545x0#))5X+3d~s@05{ zQw-<|N$f)FOO{M}aQ5+Hl{SQ;?Y(RH+~xvc-DdFIIFrP~+@aQl=pK>mwsNDU{oX}U zsg0=azP&~}f1 z>2BJeRT0a^{*K@0TGaGe$Qw-^{3MR1hxCem)fEo&)(6lnegbrAiKrsA&$HJYH5Bsz zEjer3dliyT*g9(?Ht`tbtyHSrhEeaC^T_HyeNDBD9VeE~ZgC-jiQi?ch7bB+ILaH> z3bhSoQ4hz@?)JQTK5MlCE<1Do{#kWx%^i^XX*^~a-}ZP1NiS!vGh5$8BVTiBj~@M= zemkOxaXIaz?Q~o?ZbHJ?Q^js}#{WkNu-zbAH`$_~${Xw*`Wl91A=gEu8|jpi{iz7p zsy0)zp2RCmJX>|(j?BK)Gc zk;?fG{iFI(Tjk^ld=vYcz`XXI8y+7f)`0i^Zi_Q>+glif^kP zdq2bS&$AL=vH-GAH#|9(D%svflR+#ue~RPj|$Onw{}-N?X`-2R73rtt}Ly@@SD%oepg@LhU0>z zzfIKzA?DlftBW3hc!L=C4GIGoI%Ay*SoCfx8hbOHgxrq}e32kvSU4w!3+}J-amfKI zAE21?Ojv4?k@9tX4t>)-ouBIBD6Z8F#!aw!6AWJx*%mIG7arxAM#}xGj)GJ^migYv z+0eGL6wq%V+4ozNGKO4-3YlWGh(8CZF0==nMkFeN&m@==D>BR>nuP$M-%~(bE1&IQ zANlBtme$ENQlBl!e`#!dkob0p<(BMuxct*Pc7GsK&djW$<)@~~M34}m z!*i2!m4~%%_uDxpKti~Ks*J3RvpWd+M#@z`*+_f++2s9>w!^sUc%^4*`QQK;nLPX7 zeS79=Z8c{HO}~q9-Ov|6u-PXT%-wi9(JANAlu80MJh%Vate&f3RBb;u6MZq%S$Y>O zaOZCbWW1BxCnv3Ddh47~!f*-~7A1*n7^B}DT}0Q!X3Da!UsXV>o#f*zmFG>clHAz8 zL(paq1_DjBN{7bY;-9p=KlU=lR)o^bsX(>8nPPpGDB7AG5~cv4KCiC0(H_q!Co_aT zQU}|UYlEoDJ`~M|8;clL{N-(OM2b;wU)59cj98!~iDvMWFDc7N4EiY1@2P_u-%*A$ zgd$421LeMDGzCc#kvuX8nP}so5|q6z zt-xU;W?JJC&S3~(drzI%S6hZ`aTB~qI@fHc%vdQhMm}&r-Zp308L;yVV0oXD~JDpCy%J zH%AFLkZ4Ri^~VuEEw{MQZ!E3;);b6y!~*4IMAgvrrn*EMbUMs zm?Y;|@Chs9zVTt>CrnTfOgSInu+WTE6Yb<-vvb!C`#_8mOTUhsPuz~>i2O@>IKk6K zmrOHTl2g-}3tABbN7OVWc&36163Ndw>q>5^F*M@<)@=03Dgnk8&$EL-Dc~h}pZ=id z0p#Smx7dnl(ZGQeAA&obws{Jrm~49&>!LnInAnW`R*_)#Mw8oY)sLm#w`XQX;#N0ccP)nzKDRn|yp%q9P>)vDUtM;FN zp50J@G^#E*1dwEYlKnXnDmBV%AdLMdW~s(wxX_jzCxmQxPdF1;+n^H>=BTZrEZy3? z(MuaraaL8F6YPoCntUG+1Z2rjA!vXkrrJ^TO0qX4+V!yyN(4|Z4l={&Hcg%khK z{2LTmQr&1FD@O09tZAzbzqT-p>P~~z4uTvQ~TM20(sQUKQX7UKzU zuq8c~q@Dh8v&sD)l?SLZ1L72;N{}2~B8dGj+Hs?aw+%rIT8|3L zR<;6sSz$9c=pYd!v$T3(KXz_tHc~ABn$2=hw}FZLMEqwm`g$|+L1VFNLArCh;vh(K z>AZ-jIO}CQo^T+(K zjK__m+T7)?e*)jtwU+1V=__3xb)Fj^2fhs-rtfL?J3f**%kE$IL+6EyH?CiR#e|^FA-Q}hxj@XMCG@;ZJghE zoraP}PS$7H;D2B_d9#-$WKr>SFzEMY1`|qy|9CsejZH~zP|WvWN`#ln%2e@weC<3G zWsPB!G4y@8z1q3n-KWBfGXhHkEW`dC;pp@n7LA$J!?g_Li#VetvPvqJFHG7dBR>a7 z2;FN9G^~zga*@!0Q0zpH(p98=uJ@dB7@8sPp225Q~&Ho2}(Kc#B zGxS0-8jrhM!={kKBoMkT$;koHjp^2uz$oGLGc5I@|D1_0DeB%Es~3=zBIdTEEy7`hANc=y#G@|<`%C2?epxc&H9XnnRn|N zaz(~4eMWrq=|xr4;_^sWKkKnZm?U|(qkWU+w@>5SnA6ytL*&pNqeFEY4}a;0)K?9J z3X~WT$kB+IqhrURZ??x^DvU-n#Rpw$P-?zN&jesuJA*9r`_2gUf*8IE;|O~Y0lbM< zTfesWp&BJtJu#TNm~j%W!*{t(|D++P#NK;$(#K1QX)k)H%B>d* z@*L`e$yeXL|D>lIlne!}iVBL@;stO~V)gr_09~p>JXlOmAJWXmj!aPQf|c*};UW#J zXI+BKG>W1+6&zqmm9i?!#%m(k%b%j#!!vhlz8o$0AIO1cQUtRa^Pw*VasVO3MA^Xn z@m}{Jr@sLcf)P6#MV&~8rNbJEjvl0_3r&T^&&_VO#Gol7rQOp`@)zPv)CF|6de(xA zGzFtUVKQSITBsErKtmJDqib;@=fRh(ov;{k>VTjbaPSy?=k>7I#vV#8{BzGZ6UbjS zgK3NrUiF=3AB!dygg2*3kW;ogSHS^8m8u3pZ3S|ZdANAK8;_QJrj4tX#Vw2tG|MEV zrXfDO_t^e)ecs760ZFN(;RO7e1BQH<=BP9t?ZApCgo1;9I9RLuGhmImCciBz@Wp=EA0P80nDCZ%fhA9lOoZk8nO%^f-?>2@G z^)mf&TbUR5$Q)B-*~a10rt>><$NDddb-6wFWMLvu^*KqSVSs07b-z3KM+UWosFOi& zCodq#}YLY9IG@>QqiiUSrY4hAyIhPDyd$ znxQ;XphvKgF4bvxzfOZq+%JdDH7;&lKVI}At|A||*O$ZN<@;)%Up}M&@Al0D$9bNs z*|)b_YYG+-3(yzpYQ=WI}^2T%5tJGra39KUwC(?8!_XEkVm7GLp{ovK&S?vBsu0d@|; z8RFiGjPw+(8N{O`o==keDyeHl6{wm^6f0VZO%b%Q5)hH&I4;WF=!j|t}Cp35en`2ODPXv6@2p(zZC)2Deg9WCuShgdAV08|s zdsjvN{syq~v(_MjSqjdjRUAk9BQ^-Z;kHxSK-#3ycufId+O>~Lyvb|1DQa;A0efKSs=Aj8^hCWSpnw<{5=|eyQjF?$XBucv}1dzv8IA6 z*}X;D6S!Wf-`H^I%3?M3iC3#2k1Syd^r_41(I2bzJ7u(%??7XQN!K7Wv*~U$sm2pz zHRE!oYHQTt<-t*zI|PGyaKjY3Pb#d<(GRsPX9 z{)K^3gU8$BAR#H=%miJO(WtqsBx94aS(@LzX%q60T2j;p!lW4ZOBR-CUNWE7p6xpC z3xI0?Bq13oDhSV>=C~yQDRduFYBg|&7(H4q7~zWx7jaD_TLh&a*bj+-|G*H!2gQUR z`uFZ#w`iZQLJU=4nw*m{9tzqm&$@wNmm?NV7f%5);QWPY*yDmP3lB$xP&!a(z#!Ct z#O8~bxr)P76wH1g{5-^p%X{S1q(6ml4$yyR&!XBhivOCtq{vxX&mFD+#vJziWGkMz zi=Y)bO7|-dU4;Abuh1eECmv78UxC5A;80ku)QVd@MxGu*`CASlEKITbO2$o;b4@6L zoPxoR$R;`<(L`-S!2y{uV-;eJ@V|r-vIK|zyenpnGhDYX1#8b47Rhdd(Mgch&H%Vw zn?2F2gkCk_eW(xg!ne2Z;K!;~%&s-x>W6;aNNV8T7X>J(;S3PtaqW@z12&jQZ@y!7 zUO262YG&dI^LdH}5SS=a@>SJYpn1}q1p9sC)wy6<(Ug5+j@?8B-3Iwa zbyI4DNMAK+KNQn-%X;Qt zfo%T48o;E5^wGpN78=xZN|p)Gu#P_QT2f5(j_Rb4);w!zQ;T^DcSPNqM*QShxJ=_I zWrTqVNc61n20;2GsQh{CGt5qkw)#W;<|y?5u?( zZG&>@u^7_tmZf4L0XR2j)Ym~n;@pj-XT`PTDbePSNmJrDHF^}^_7*!DLxugE2?Ggz&~s2W_dMxcFtmRTtXFmcC$Tcte-i6r=|`y zl2GMad|S6~rqOP&-~g%5L6bO%-k(p8xEAJSO-dT>P@oAvpwtGJb#qbObllA(c=zTk`mStH&S`>Zze1I4IdmgVxpKo!BQTvC> z9N0nwpfibi13*k`LcTN3(q7_clR+lXBj|9pBWSZVkeKnXs)g?S=}LfVHnXaJF4ZaS ztrN?=fD%+r`AuZtYg;PtCmk$8?NfVB$=2B{TD$pZlw&taaGpE>deOWQNGK5P1**8L zDR?$qp4~cF#cg1ZP9{3pxxH>X(l8_US0}k1^$-rL;g-2JyU^{0 z6|I3u>fM_ci1ie?!zIKp(}^d_>+5zSH2!reK%6=dw#_DxF3W%eWQs1U|7eyAO589` zq16<{W*tnMeIQk?-V{YKwgEjPj9oW#`XWQ)$>647??m>54&RIJIUfH0#vv^oXcHzpx}r<9HaxG>d(7fGZR5wr0I z0NPEG!I@B@3SJKjZLJ))bDar2e7;4CkID;WF&rTT!{Ai|IJ`X_IlmZL|M}MARe@F8 zYB_NB2KeF9uLukwXX4_8wCU5(LY`d%PZMP+3Tn-{N&sR!2bU-}$rWHktRCv6%jd4| z8Z|1@lLwPeV`>L>NUyA8B`(HbfYwg{cLeeZU%O*sVyqT-Ijf2Y=nC+0wW(FDK`-b3 zj4#YlX!=EQql~|v)udMD@J;eYfzO?qP6~Ktp3&i48I_aUXU7W<3XJlkN&~(A78=u^ z(r8^0v&_V`j+U!4T{9CuKK`M7z@w2vN_r~0(^h)6VkxXnQg*w5yVrH2{if{!oT-M7 zYHl)<#Wmlx7jGY#3VK+1cIvbsxgT&OnqItwcP{ zF0S9IPFYdx9f)%6ayeqgVK_rtDr}*hRif$@lADeDD;(^tUdDP`Hg=an)nR+rt~x5S zD#rRhqH0miEOV+h^Q66@%GC?-+fQn$*T7*=g$!Q4@g%D4D|Dv{uBqMAqSh0TbVE}7 zcg^K{^r$7*|0|W$*`AfW_eye{ayXA5w-3-tpy%rNb=+20^5<;=5x;37W9M%Q$w6V0 zx;%An0mILrn&9FidOi7Qh73j{Jj!U9zm%@CZ}bzw`sS#esgMyixba_r^)91nIWzpS z-1Gz-%ac@zbMnwmg(E^THOf&@UAj7$Dxx(8MUv^yNj0&xN+@`(D%5!Wm`K9EB*I6Z zNpinJ{5oU&ihy5ERvs5^wN~wuLY_P4FGc#o;R)-y!0WexE+HBR>%IqT^(TMT>Sfsw z-kF`vCIVUbLSmViXJ2Cjgv9?^XHA-j&%B3wAjM<5_WqRXng&PK^L(u(8E99iNGZ~x zwQq_SW;{O{l>6>(%pIcTL6q%_z$2JIjuDbFfGG_oI{D*59`ButSmT+QL!2@Z!umPx z%VTG(1LvgGu-7tzL@Ymu`}A3tLQxO~+R(xAu+wY1kv;imh*HV`Vucsr+OuSYp{$F3 zWi`xfM(M;B#Nj&@-W^|@@`#g!R`HWxfrg(nw9NYF$6JbnE?9I5{fxA)oNun9!v>pi zoV6-zkg|rF>@EeLkvrG2azimw6Tfrcr;y|`RRw(N$2}ojQ|-O(y|(G!2zcKg>3RI^ zlK6AuOOzKnZLGfq0PKA{k-z%>9x&O>Jslg+*XoXlo`I!@IO!G=}>iJ z8)IAKnk-5XeDC0mvLp#Rf8~A-ydyFQoCo|5sCGka7?1LE-j$^efY1n z;{YMhaGoS20S=1YG%gtB{#=mhS5#FdFA}j#O$6(+=|WDe;`B&DKiu-a7RbyzT{xh_ zw+tO!ceJY43TDvvn`LCy zXl9-fhX85>pfLKE_b^*wS!@I>8P7s^c92P8L1RxUR@O7IW~k)14t)isGO5KNh~C#Q z6$N@Dha`nAKFKW8XYdxc?Ni0P`!<*oDL}s3E7My<>af&bj>_f8sGiD9!!RY z%0iMoB{3W6TJvi2mWb=D3qjqUQ3vM&%cUF_P7~T2SJnu5oQj9a%?O#4l}E1}FLzM#@&%RV29>I#jTsYhtG4=|U$o*aTP}sg0CkgXHAc5O+Bn1v(b>47`H6u$NIejcUW&oyR={jvCuV z*0GrQyeuxy8tNqtSwX{MYV$Kcn5pCpIE70N1mLieUKu&H&JP_p)`|R?=CO%zmQ}ET z!={c16dHU>WEwSvM(q^}RBDP3!1W6X{snglXdLi-^T5Go8j#phy2h6PoVy*k$*aP<78f3~>IB}B4D-_BM2w1?#6{3qWZOI4G* zFa4jTVmCDGU`Qg$n0|hf?$(~-iy)`z+3stM#_LlU6ay!K{TbQNZZ}5JXK<|O(4(+Y zzMG}4MTZSx$|122ZpY)fnP3qa_oNT?$6!fPb|-fh(HSA}^K zQSJZ${6Y{!ua}&MrVo8_;JxWMqE~j8d}W|gn5E-%x5~Fp_^7GSUi4*kSn`@HKTnWP z*+V9nDWbTVar)@PI{Zp%4W*pWuFsdqIyc_a%vv^!%n1P*J&j4B!ux?Q%D3ua;yiNt z>qlz4;#JGCOPes9?o&1ldspDH%9g@>UJ^&Iq^2E4yWL)I%Y3rQ$pJ#I^+Yv+@~yGH zmHHQ`^VS2t?)W?l8@c2sQwzDJw(zwIMKjxL=Yx}(c+I+0ElVx~D`RI=PbyFLx&NPs z0#K8CT1AFpW0p|wfR1!@pRz5@nQ;kM=xiy9V7CJ&)haOkstdzjPz1hKUAmugTUPx{ z6jA!0hf-VKMfRwfnz7YtBdZwZalF(Ub>r7-%gx=BNW+ij0!)f0;1D;Dai5c5-cIaxF!) zG5MC>!`3u?vLYYJ%6F_wR!cHOxywXoosn@zfRR4TmHG?n4nKzDrkWrT01Gg7vo*nQ zo$D?x=}vXqimoEPEIjwb&I;gN>y5yHXU@?o%_olH!RPu8){?34jP^Lz?yzXG?30Dp z%OMMxn=6b-Rt>hG-*7uBahxGXN#R6wh^k`)K0_%E+75l-&pYxPf$yWt2-*&H(gG9U z4dBn(4mXTPlq+^VHlrz~fch90 z$zh}ORPG7FMI(+@PtTYUz74&@E{s!K&|U~K_C0G~Mzr29Hm`GSi%VC3UpR%H2;hf+ zZ*(JjqE>fxTcRg)qrC2K2Q*t(Ybn(>#4IdD&lLP`BBIvb`^U$uJ!uXF-=PrG+xBa< zq0Qj)Oxc4PKs-eEJw$QAyQ*Xml#*OVUgwdE?Zl$ZQwBj(Ih|(%*JK0YM6m^ z`;Jtuvo>nz1;d0J> z)a6o1Vh2q>5xazGt{c`ZA1SOUx~=RB+BQ%J*E)OW!krminjAw+gE~6>lU&$;}(pVVK#H#!BZ7n z2r!GDMP3{ti{mq-nJqs~O1ghhg3uBx-F_lvAC7K>FB@KK(JI}pCfc#YL!T@KU^H}r zRQ>3k**VV77hjdtsL6Vtph{+z*rQLZA!cioTv9`+Sz_RN#)IMQr*Rlx5 z&kk=HbSx7^Z2Ed2PZx<1YLF6x%0Bs2j2*Q#{scDsX-uon^s2LG)VVpM)hk<@aJIFX z$2PTEJ-NX}a=S8OFrvN?z+99LSXa$-MAe>JUAaHL>a97pwtn5v>TOM}JAR!3QLS!V zg&KPo$x-w$$(=bwQh1*02r0u!v~9g!&X-s3y0G3HuvjU-|EEpp-+d0O8*@NJ*^i0t zU5@SjFoDaCN*P={?Yz(e;kTnlu(0F6oe%cUfj76U4KKaGN)oL=ETw@BAPV84n(bxc zO;)A*YL}2g?jr1jsa|AJ6P>y0nldO)Ln3yQyg%KA*F-afNr|;X(!h2Wby~jbNM&Ul zI>L^xFmcH-M#|Wy_hg_C&H6t1yslPNj)K$~&dj6uw4z}vJlezl!=)4}t6Ea2*^FQt!K@jPZg2S`P~N*DJ)rTG8AzrtD{}S#OsaaGZ9GidMQ)i#Fb*dasvb^VeVR4$GP~_yS!K3*TL~jAnUvRq$!;e%e(L`zDIVC` zvrgM|WqsvJoxYakh$ht2W@zjYb7veSv)KA=CM6f+%g0Yk5VFUN9TK4zwpw92%J*KM z-kbz<6dlbHR6xb-sIB`%yN$BNpOd%f;f$CnLA$TkL9ss(6iaWP%$iaOupR3>-aU4F z5i1qi*5J9=XXa0x_|>E3N`afK$2cc1T0Nb_7uV`5Xyk2Mwk_Mnh4}{x$|$YhV)aBR z$6v#LzGn8<1B2z?1%3`~Ik;E2bbm^iKb^!9l3pCYQ~+at-yPI{Sy6*CYWkR~E|dTD zfqjglLD=ka??+yA?Bpo%LuflhG>|qDR?n%J?(uaRUSxVnvv`u4p7{K?DN*-ygO^Rv z_jzA6@}Bh2_Ut<0Z2U>*jE1p`D6#$J{7~QWF+19RQ_dUc#9Qh8$xvm76>VY#?Aqv@Vt4r&HzZZW!G^@~qB;oO_EF ztuG$3(8hdVuukYuMePfxx zS9FVttaaeVL02FPfUi@tmLC1C?iDXj-6xt+_F+Flb}u ztUm`h5_OKq!w9uZLG{e;fi^!EUk7E0@aO8W-&~(xOS?%|(8eTPoxp#Y9^fa`Lj}0E zb92EannMz_U|mEJeAUrvaxxZFN@~n$@p~3zC0DLJ3`JEPgJ-U-kBn7`DGpB}5M00I zby#7F1vT&Fso@!NlxSQ*9fN;SKWYsQOVAmyf2n8%DFVgw-jjy6X%pI_{v)+#Q#Jk? z{L2UCfjU5CXgl;(Jm;kf3b?bqt&sAhY|vHu5MvNtETwU%u&VVTASt{u12YC80Cr%3 zAD9Mjjlo$6Y4Jix?sTqol1vH+Q(wq6h#AYuZgp1X*5MzJ`qX*Ejsg0t7Jr zoNCssfl+p5#z{cNq=04=c<9dQSdV^7_NAQXn}7NkOrXBA!E}Dc1#B+}Q%Vr@3EcF( z6LseaAJlzc%zq8=Ew2Zi?)vq7Urr=>?-$(Q^YuN4_+Z<0F0P@C$eqeZ~r9 z>5w2foHx>X!p?y`L^ppvC8nkkFc>`;uCHv`3cGDRd@n`Z5*I%_0oDdDUDg9Wrl0aI z$Y_tc_@U1A6cuYi0Emi`HRND1U=~0^DMV#p4fgogmAfhVg`I5&^%YQ*%qU|xt285` zJwuv$CgS{4zSVhbsheJ7J3dKBi06`ZacRLBj~!7B#_h{%P~;-KH!oQ{E|=@$jtU4N zG~A&paMqjA#F3+G4SLb?Br9#E+2>CrW(xa<=%vHyP$~S^fFrGy$I_0jD zg{p{d4Da>p0FhDatK3ZZ?NH~)^T>|q%D-f=RfZ8kjHU&f-o@BBgJe`+_Hn2X&Q3_t zjF$~}L1_t4(UlIai>J@pFSav^Jh1Xgx zSd_t3Se9$0iOH zGMm_RNb@U^N=PapR`D-FUqu4he3Syq=>DnrZOjukXxm&uqkD0nE#QqY*)L~(-r9>9 zc85GIZ3Bx=oI*A7r_J2qP(#$y`vG103rL(=joa2G*rw#%wE9I#oDz|(^Vb#~0{FH{ z{_+?Af(w5I{%XL{I_6|J7;zQBS7?JP`54jg?_)zlsaXd(LJK>|*J96n7>F}igTvna0*c4B?ttUwq*ype`p>>R4e!OD;vhaAVY_SJSv6QGOAcQ#$=7+cF}6(%@#zl%b7+&O!{YdS|;QF^y8ty z?=Cc2!_FClh_34&`FI1tl`;P#AL-n+v7%FcF7h%4#Q`$jGa_Y%i;Sf=0)X+! zupgx)AEB*Zr(k=IbitGr!2xs(%rGSv(PG&)`A)MTh8whANQ>lI2%k8sz_orqsCx(- zi%c@>lv@VX9_QfbdZ@?XC7Wxf#`E%_fm2MfhlgCG?hl+LCeI1WH8&7-=tF4(3*X=-VIj2>2g*d^CV$1(mZY-DAtAk9D`8<$umM{OjWysTAbP zmjxw*E&_@l+J3oQY4210Q1~BtgnFmw&&9@;+;TiDbe0%WJ17Sx2@~nt(Mn4QnyT+g z6;U7=V}vUS>URZMGxe)KQIqkjL3>7|@_^n4X^8MfodcwSn)4>wfC55L_K3TDeI*Nx znmwu?6213a#;plW2+L=}j?x_h+$j9BC4DA90n_U?TI~Zs3xNwB42RD>&z=)iHxm!nk96bZ(`2IEjRI@f=?XXA zwrLBaL#EMMk`l|uiTy94zyEB6&m>QFFC*E~NMvWOcl zB^=Kp`v0&;`V%WmOJCaYR*L`_@v6{2JaIqh@uf-R(d}=tORXw2;noeU%0KLX-`+i*rI&XTggrB4!Y9wQh0jN!&6bCkikohoOV2u|n z17^k)z;N74+0#H$Nt0ft{lI7z3FBYO=wBjY5^VOZSdPuMCaM#)*$7l~nBVIMoP&f+ z%!*BL?gGiqSVdZY*|XH9%n`m^u*fCbO2C$Syyk}fd09KDKcDNqx$jn4XTE`VKGN@K zU$=I8tYSKRb8_vT9sV?-^y}8j#T8idd^&gx0_1$Vdbr*7xzEDK>2>c2It;C<-{X)SgoUL-8JTq;nM%Ti63m0y;-Vl+Fx-{@AnvkW zP&pc@!k{f%`cLPD<0BYKH6c)Y!8z#vB(`1WwV7r>@N1-C=#pz2e!W8Zzb6|b*O2!S>Cd1LGxUQY;(egCA%uAxyZldVgy z{q8?O7~>qz(xZHIsi@*~pPSdyNSAvWAgW3@$>P%^z-5ECx2ESx z%6;h{e2Xe_imjOQ*v6_I@OxJ4b78nbwaYFT5-OaIbb2z5M;mNhqIEQYQm+KD)QX>YJSs!(ZHJ?yhYj-VSm)2i3VYol@ z?!b&xTRQetgcXtZAMo`6-os^fhL=~ZZhN3_q_tiPph;%wzGX+5SwX6krmdVBTe z*5G*qnaa=^+A+sAm5+E2#STSHb|+YnSZj(b$EOp^LZZwBwX~8U53~h80bZHsJcW<4 zfARLI_I0^aipy+M=cAVv2eMA8`4_COeAU7Gw)JR!Yv|6YVY}R38E**hmiSc-pVW8g zsu=J>1R+(TKM{r(#^YZRv1`jS^iseZWEZl|PVo3|BYrkmjcp0j=;vbHVjDCg~gHc@Vd7sQvy+pNL4UBX3k zQKgt*d*=Pp=HP+L)`wZPWO1lL8{Io55%jJSyP4hxd3H4%pTDGD0HKmVHjPr|38vfN zaR@T)Jp>z=D&dU%OuwF{ZQE|fy9kGDpim`{$$t!4{mJg_JT+D)gH}Kj zM<~G%M*m9QwkJZIa;TnW-O2`pUoU$TdYXKvdRjR*8*8-RVjBJ!-HP%YR{G0tbt7Zu zhb+UBAXury;F_^_0eY3Un&^DAP=#x)7pNM79*>(_foqp*yqmjRWS}$*+8l< z5Fz)BG*;|*H;FVA0<6rvx4=1D+FeG>l&OawMYV?_` zf;2=?%szY;0Gbh#9W8}oa%yo_3Mt?_m42vFJnEp`KgFpF*6HG^??>+icu1eacm16S zKwf9zK&>DLt79tGSGE^^c4V%YRY_7GBaC)zu9#2O2bkfPrn5q};(BAY>MXO*!N9+5 zA-`Eysvm$vJ~BwAYZ0-;(Qhm4qFukVI)>&vfVM{Ph$KDAQ#CF_ur)Qzb=%gCY1N-1TkfKekcVPVXn{TjZa18OKd3&dM&DbSx1kR> zC;Xs>y~ZCv_x;s~G!EK;GH!kF0b0g7+%7|E3;2Ms9Of-GE#=#Pejvbd8`6IxTGPr* zET33Y_C07}hefwZi@Lh~INU!w`;!N7yImY{5;JSTpnAscSd*8>NW*EjAbcdJEC1ju z0>87QpbM|==8H#_4rCl0PpoV?_K+c^vuKpCqi!_Y2OG+OIeE^lZO;F~e?ezvlY-UM z21w0qDM2R!=`CdDj~{*#i4?wi!Qh44MHG&$Ae3bhnqp{a;Xxtez}w%`{&7S#8LUf& z57v^zg$7Re8z0#Our+qZUeJwT7&guJjw567A=fQjuIVMC0cUbam!`Tj}^9pWZTQT z{j&*#DwLSfDwip7|KRM#i~onLa}3ff*t&F=ZQHhuF59+k`z^b=Y^%$*%`V%vZA{(! zO~lN^{5}yG8F5Z#p4@9cYpwVucB6{hBxa?jNOF2Pw!fS{&Ym6YQFm#26e+oqX4jd~ z|2jZIqbkjIPiUia+mXZf&nNdMipfuw39kY!>vrgGhm!22BUX>Nn`b$7Y;D< zWhqvz$(?;6lx*h^FsPO2_?_c*zNlX%E~{505@4tks1YppH1&ME3{bg+-$fjbJQFMt zcy+fDBitMg?Z(gBr%h0^_Et7+g3~Qctz&O?r;y)Evy4n5Om7R&uuc!XrUJIRt69&t zqn)lR6yVysN|@P7pR}kq637LB)8!=G#ULZtASmlyqh^o`9L z)03!3->TQrmE{b|3s6LB+gQ_oE%_(vR-YjCX1V|ExJGkw6d>&4mRxdIi)t8hjL+dA zw@%$``~5DCFmCl7!u@msxVs(sS8=HMiut1Tb+ihyl#2nhJ}Jn!9mK^dGT(~@1?asq zFFa5O2Tov(;|RK_P)=J&A;rn9h6Oc>Rg~)bXi)nlX-V?Q2Yl-AzOp8xt5eYWz-v0F z^~=Lv=w$ELM?LE}Fyr=sdgL1cc6Hept1;U5!AB)vZs$Yfc6tR3a2C^PyXiCcbSy$E zox&*uR5uqlvyKBEEYAb0`ZeaK#PBU55HeY3dP}jMLC<0;Q1=jQhXP0?as31H##LvXz`eMDuTx-+2!BPK!I72 zey}v*GgAH@l!4R*xRoAq6QmbzBdN}sV3>Kd!s;)`dTD&?{*CNjy@vxjR5#`!)bce| z)#F^1^;n}cG@|-?a8NRIyRXqty1=1S-B{f{!Iod9a!;wcG+5*%R(5SI%k|c(w7sn5 zir?e<*rjBdOs&#zN!oOr>TIF}f&~#rx>_>B)!C@1u_P4+C`t2w%JAHhx|mkpyD*4D zb_fR3t{^-VQj63Y3thDJ0-c?-tu7oPC+jT?65oJVVU1PTq!-pO> znTgJZ_-S;j$9oL--l+juju?ko{3{ZktvM2-DkZ@pA~Zo{5kCs#a|2*Ust z6_o)fj@}cB>iGxif9!7E*}Ej4)NUP}RQ3E9u4J|%jR&W!Ib%On1&BgSaR2;z!5|U36h1fD34}$-{&efJ}|s{+y2A)zFCkr`HhP zWZXvXg@oxl*x&oUY==0VHtN?b5=Pmi7_xa!zdWPhKUqx;i-Df|VO^;bBzQ^Cw{T>? zgKF9akCv9JIlm)R4bqU&5VHaPB+$o$w};`%iH-(7CWw+d4DRnSnVgI1JH6K~jwM`8o+V{su;qmwJ>AgL|)vY4d^sRruNYB^)&BI7) z#ZbqPm7`xHBm9iXVsR1;n$qZnR29Kkl}_h9oK`m+PxXZ7Ftm0I>uCEP_vi6Cg}ol1 z_uIqHVpkeu4W6|$=M?i5|9eV1U=Tyiryfs^^Sc;QPiWtoX2- z0Bj$>KO@2E)Hwj)N$FE}Wv4e=NSzFUcT$))f*M0FZb9>_);z z`QS*)5(;7^BguF;r&AW!U!0?;3j5nKJVm4K1%WaarG!7MMX(hM2SO(C-Tq(wGRq^* zmwtA_#tDmU>BFQA@s{~Beg&r~e0*YKglEY7|4O$5Uxk|5sLX)sR21~*jt-*LAl^#h z*V(5`om^1a)1~;UeF(c00SyQy6|`08*VC~?u z`ti5;dj72Eed|-7d@o5dTHh&Ka?aj$kuxo_NWvf|)oP+r;FY$tER`z-6ySah#2KXV zSVR%QYZaJuI2$mk?#K7LNinn6d0C?sX^e2g!p3f3I=B;6*%KB!0NgqH?(gb;_J?0jDurp~ZKd8ybIk z#!bL%DUim-!GpaV;8V+Co43ELRaP*@(FDMu%*3_fiq@f1DAX6)s>d4_bB`o~Vxw@G z#3C~3w#wGdJ3r?k`N8aKMt%EQQ@1dOt`A`L!DIemw0*kF zCPRZYKb4%QM|E@}jL@q7Nj=65FM94~?ldm15#Y#k46Ne?021m9hnK0N9=NS1C8<-Q%%qX#6a&h+ac=6lMi$08PZ*GTMXb}f)E*aD^ue9)mT z{;b5AxTL5|m;{FYDI_oKZ!JYarAbFN6%94w+zo}clbAqpYDx@_0+mP##?zQ;HHFH% zk=UBU!UeYg9GR+>%#ckH6^?71#SA7HIwnWgMMLlP*u2g$D8Cyem-V-f<@Scr$VPaz z-klqLPR`e$r&4@3yl{i(rA>c*-5#8b)Ix6KRYwwTB72uvF2L@zxnO4HnlP|u(b0|+ z6N?Np00R&rsY&3{zimGpe$#rpNvQR4L*w;SHR7?wC!f>Kk+1~{ zZl_6ZM!RCMPhWWcM6+IVs-G$k*aMrWwp)t;D--)~|GD5kyek)bjQ70j$;qVwH$}(L z>fQ&nP2O997jNe0ORf1?Xg};YIVa@tPkPYj|$6$E|mxD@DcnlSVGFedI$W?|`2|*M-3)db4t-8N7Bk;Rc491AveRQqDP6Atrf1A}%wN;F| zT>+sy4m9_6agRR1Nc2Lho@hr9*Ia60I7T_K*sKhWy6pMlN}p!s(-wUR$eHfZoii?> z3PtbIry9Z0cm#jJs;Ng9Fp@)~Jc%J;0jX!x`EP_z$VYj@ZEswGJ-6 zxj1clRvK#V-+GvSt!yXxiAnke1HDudb-21`^~lnj8mxEeOnN=}_k^zje|IS%YKgfp zW@1i-L|#u3(OjhH;HN~g6FZq=h|Qdy-1HJbTr2>A87G1sFV@9F;Di@^$}or0w-I;+ zHY@!lAMRvf?+gim1>Jo*GCeZnA9yFvf&Rb(C58>N>n3pyN+t^Z@rx`IHDLq8&3}{# z;YX#T^WOK1HBKC-Kz?RQ@vup|*lJj#f-c!zU#&rnC>7qr`t5tbXxEuw=>UDUe@+N%3*O#K23tlDd7?WD{4A4Pp+y? zg&$ay(G3IW-3ZQk9T;j6GjLZ+%8C-UK;dO=xA&fZ?MYu0Q=bC*c=y00$HwbQJx@~9-H-c;lJycS!)rekoi;B>_{UqG3s8_UlLQa;VDI?S>L=U2W86 z{6F6aDNXoqFX?I`8AsEmz(dEOHf16<`5kr=JtUURKaW1t8!(bN0^;PgDGLI|$ikDq z85Qc5O=%cQvg{qCBnG^NXCD`LEA=3-cENU2H^6w zC*QNCzo1WMI5y_3vp;T3Oi_K8cEfPUG#jRU-b|R}=s{shNe??|ghb(v|9_0C!9;em zchJGPZ&QI4%7>*YSe8*~WDx6Y^tubRD;jr2=#=0FTl!l1GlTz$&-G9y7AVF-DX0mM z^{P%5Kks@$wQ+fR9+U#?rmdzO1NXess;kx}3d^tWY>MC~F|Ie1?=LPsquj6QG1SSx z8Q8a0-<>eMI!|Zsl19Y$GnaE*Qz|SLFrO`5?%R|2(ir%MXhd7M{LkRcOw}@3Y~Zl zbBKh#eK=l6p)M*LCxl$vRTThtLl z)k}!&gRiq2-$%o;?;fozzpf8;SDMPql1H2&<=!kTx>U7Bw<AEn%UhL1MwKui1oVO>SzD`5jsq95}=IYIsjQJ&w&_X7=yh1rGu-gP>c@&0)q zD~D^L@^}E{+ks6TtvH|z3T%cHJR>{*qiO~Q-K-fzk<7E86yd`ZPa>CTffKA6P$hz3 zkr6`Hmrl&!$YGSICtJnkr>ZfI{J|PT^GNIN7pWI_x|Ats8bY?Q!~<^ObC5F6nv!BP zIx!-hppQtGf0Uq=5UCWU-6|>ef^n(`>x}t>ElL26vj~6b&U}kbg*|;S87BYE;aj{iR3G5ZT0{VRz>Cf)|?Y+x?@oLrl($hKhEa z3HAYldC>r!?>~I9AQmst!MedI%k9l{+E{cj9b{fakI9=Pqnod%Ry^s0$=cXgDWTTv z!T!Z16$ASyoc!+;6%KxP@LZoRU^e&DFc~)6?SAdD=k8illDnoaFzOYDWrR70JzyCe z$hONv1#^KgEA8}+any_YLZ1r;q~*=7QJp&;ml53O zleJP$WH4b{K+ET*x)fj=E$5~-L>jswOKQ|;9UjfnOkPT>!zri>{$dgd_2cm05< z`p%nrJ-t@fIwI(EF`5gy+9gFC;hA)7E1@Qok5!MSJjFcE9T^sO4LFnC3heU&rBBj3 z*eaNX$R5a8$}RWBaqrRQKdYrU!&i9*xKyVVMu2BQH#yp5w z4*rZh;G|)jX2T^cPqPydadFfA3BtS2S2zMpoTwNqPg4n-k6ucD0n0@eJuQt-XM zeQ@LtM6g7NzqGFZ0V|dsjXyJ~XKdC84`zdk#W6;1eF=CUui>`1KD<7c-MIq{63Qi{ z#wIoxGGEFH=*DNONv-L|QuK-~oJ5>u9a~WkSKd#bmmxR>Ic9osCt!WYK)CD3;K7fV zN@~8Z+*A|PGLroz;h=Ls)oZevpK~U7V<4bXlBx>L8rIs|7d5if{yKo!%MWz?bIvD4 zXeRURuan?F8;+eP3YCCNr!)poE(tjJsur+B&C9AjrXk3&ELQ80fGtcoaMeSadj?H$ zlLj4bx*PJHy)%4!KAgOCV_)pfFHht1d49b35q150!#h>wb3jP-nFltxn_PfMR{pI>|WZBd#$z$2f-&6QLGeXngpGkhgTKNf-|KFpmOdi z5`%77mT^_Hrqvb1*rnOLliq<6%Xiu}KZtt4>Xh zti(d~uLqMLy{(2xqVT7nvY$SLeV_I0!ne<}A?Q^A!b3_=i&x#~HZiVfqqe>56>Su_G1IFM~{#=|GS;QnGH+b^HU_lgdm1PPM*Vu=vHi{-hcw09#hICTkm zC5lsz-a`hD3PLPJezg7lXaN83>>fm3G&Wt;i}6XW!sZY@bF8Hsx2U|kvN zKcOI9n=mFFX!Xj5n&H%d0)8jhQXm)k>|?v*qC^Mq-$EOJQfJOtAaQv>Zalo87QR?i zkr=1En_g|0R_X)775^Es={jj)&pfh7S?Oew(?42j72LcdL6iCeAw)fbn9-+RIdr|m zv@Ju4g^)s&R}rs#lz}0^Yd38meZ+d;MmkA~)y6;t2fuC45nY+KW2Ms3`cZZ_5=JHB z-)%zEJCQ&Dw&5lyQZyv|w=YReNI#`%As&|eC$Djuc2FiG$)2K}+btI;7Mmb?$K?Sp zr%yXpiUuwD&MVKAxv1>STD?&M9aL9l_Y`y+P$A-C_wUTML8_IVdm-jo9pzs0WyiuQo%F$YJv@=y0{!UJL)Ha5kPVu?lzctBD={Ey6EZQDe?VR6IdBW@i%vb->OJn9y?j;H;*C<8 z$R$Q?Z4fh83G99ycP{bN?YD9f5nq#|Cwj?#_Y}Y&T}?+H zF1yd}4Z)E}V5=HlH+7my{8-iM^%5n`fM-7}5pu2E%u$Lu&J`!*YF3tmy=Ym6I$n5D zxA0RN%B>FjfoV#sz_!r&9QrI(bt?dGo%dRNO%WdKL+%RN#X;ohHdi0pM}97M$W*2= zSN=)7!DIii2AV1+Rm2>Au=@4PjSjl{?q z-DCJnMZ(pg3q%cn(?6$~C+R^uShP1aySO^}ws*1Hmsq36&-?Ok?ESolpi_YB^UPFJhUQ2cY-g@7 zQ505aZ&1*lF2536{sj9$1+6J(yhus(S#Ig-ao>zOJTm=gdhYjQi1fe zTXYy~))rfh4Y&|`CE80kB9u56G6qLkUy7ItRw$yk4;>jr0lBycbe{B?yR>EKRRV>7 zwlZ8fJiUA?B?cp?$%RGmU$0+M@C)ywa94HO&z&n6BNphZzpH4=JYETq40mtsu2G4a zOj>IkY)eEXnBv)AkfCDo22Cv?udxI$QzvX1SLdKmC+JsNpGOBKr9LzSVmySbY#ec( zNj#wY$+Kx4z4OZ^-Qv9*-%n47yL)j@#rS^SF9-D}_c=a19XmX`9Xq{zBX>p0)%V+Y zsDw-pw|?vT-5orTuP2OIi#gERuHc#tCx7m|6M#hvWanqzsnf7!+sCiI7B6a;^M8d=9bC5qd+Afeg! zf07eo0G|QBEK9S6m6y~Yuy#X~0*T@%I+q>F39laU7@8fta%gcBILhT<%*`?3OYHnUUtU+~DjMU-Z&_%V?|_xEAvwjIl;Q)hblFaq)5!i6>QY*k+P*G@ z+Q<`rA-Klq#j;d^T*BCM>k7HWjwVmjYK<=9&Jc-X&Bsib*WRlG5iG-uQ7Icbr<+uG zh_X74<1Xd$l_w9c$<#6oE*`E8k}aGoiWRaqFl&2nhX1Qsj-`74hZ2^%D%k)_m*QB( zrq<9^8F+g$)NaD<@gpAF$VF(|j!<+btb0tSy zwsqMl8F@f{VGES`Hz(8$B%z=xl&j`A z*R#zOsqq)HcvDKdW;pRnyM2H39iBYC8F{piG$J=TrHu}{IBi&=LD$l*ZMk3CaOZlL z^aBY1GW1`J5+0Fo(b3HFts2)x`@r&BdsX1B*REl|$8uKobT+-awiTt7QVrm@zA#fQ zX|SZ^9@MNU+a0#2(@x9#x755L?XE!*;2 zgM$c!AxvrPVzw=kbB|u;!;p=ZGX%I7&@NV7rquDhA zo@8uNbT;k!(W@Q$wx6+%A3GcRY1KO0r#Zy|J634rj%;hYWr|cBB+p$fV?*ry*DO=k zY?j2Y%|}TY4Xo%T=8i67nQL^07!R7cj@8Io@6q?wrl7oH3se~19KcsBQw_AS{QJB~ ze@1KWf~r+6+WOz3ohcf0ZszsKy^iq!?jWJ6u>r=b=zDG@3E;lNZElyS-WfWq;_otH zInVV`(23Pt>4tpIhdE)cRRS=Ar-)8l&TDE{tlOosPguvk!=Aa0Tc{|PEK@B~P4W_C zKlA&U!tlhy)LTKA)q192OwP{!4n7QWlTt>_H0QQ?T^49pImm(ew5Dg7mnxuy^+FBL zo#pir>zGNnjgF*?Mfp}HoPS?uXtThyRoTq^xy zJR{Ap3-&J`f;RM4X!JerP}akJ!()#CZl})XM{B#~BpXDNu3%cx*oiv@f!gbHQM~yV zQ4H_qbUk~HXASzIvv3$%B;dfQok{^V7`Z*~7=rbUolhOwC*i>=$?kB$S$hioVRWII zK1Lq6wo0Hrt%&TCG}Qz=PM42_N=LvVo=r5+YpB2SSA2ic$rwB-R(LB=tN87@XEF5q&fK#!eZ8XtNZoGd4TSAwW9{O;v#sL z6}S!AUM+Fq=v;FHFAk7QJd?0pA&lJw{^SDZ*mDtWvI@_`-5=Ot2M5kn_yHG=Vi(Fw zf7>x-HlzVIs<0+PWd|UCn9)Z4?mBSUqO9+vyYP=N+JJ~jCKV7(KdE7AO_haRV#io& zOzAGds0FEjic{H2OF)m;`a&3V!V)PkEBuc&&h@WWPtW)JLuyXCjEIVp0t(M#6<%t< zO4D*9lV5Sj`rl#rTM?PU?vcifRmP|i3iV@o{E#p;_1tbhD&uB4pNhZqPAY_2l(n)_ z+a|x+XnO2ySgl*3m1>Z(f%yWQk~1P6VNu>oPypR|d(DDIPZn6<`t zz4$t%@gMzmh3!tFC!MmlI132lm!t?sU{6AH*}O|~NM7pkV`@}kL}f-MVy0TCPywO0 zjaRki8TMKhf1h8a)RLF1-WbF`uJ%4w+vePYk_rQSU+mR1BL)*!3>ZJy*&}}-r;D5^ z7Rm*+Gmw7t5WuimV`KhGV~1tP*Em~oAVWk!5*?&IGXy%7Bu#y~TKXk3-T5T>$T3~+ zaE|&t(*Z`0L6c77PPCtbz9Df!vx2yjnube1wO4YBx+kC1kB*!q_%>PEsfD#!sdHA+ zL7kep{q?S_+a%WvB=WJoY*}6}LN^sC%&kHpX;d5X24F054>0*<3OsaUPoj#`M>Ld) zO#0hdMaHTuPuNsouG%=_Ed&sBmLGMifbALFt*Rm*?sBZU(okMtoDg?RsQecdL$WHL z+Wl-XgF4in(otf`B1y%OPHCFY0{gd;;;@i&%8~6YYfRC+#Rdkuk)SA&Qp0gVnJB;X z22^=YXhu=;o3+G<5_1VL8(G$0{e%JTQdHpnQwG?G2eA*SS-(rwp$%p`ePLH{+;^8Bre^)I-(w$tq^?+I_>`64TX_id9IH2hN`(7TYE)T(;^v{Sl>LsR4EZ zXH(`*(d-YBK~`)HaZ9@3#jnyyyd-P64aUA-M?b|t3BtiYO#o0m(Aaw1cS zQ}^?g^mDDo74_&h{aq7h89B3d@4@vu;;w$Z_7nh1Pnw?AaDYUKbOy-@e89ln>^cxY z>!+eAk?F@}wsqLqO%xpYKBDpi83AU#IESBfU8%3EBg^L-YYHfpCEHf!91Wu#zl%72 ze+3oS4*6N>GU>rvfm^BCS+P@DMN&yyZz)`2({C*}u{tjNl_geS$zO8ah&m)*kC|Ai zxYkoIch;U(w(snm1f9Ts4QwkI(DlrV`J*_l65HXK+xv_DFh_|3K)XmZ&;uZET>3{l z=@3RG(wWz=Mf$D|DdVzLr`uM&CoB}RL}3dl4TE_@Ysy=fXO4}JN{9=Z(qSAA-GaNk z-`Qwz!C0LP*SzX<@1+aU8k9xkp^aR(bHT>OhH%a_NWV9!QDCxI6m!O0A(yFxoka|c z9JV-NMUxS^COoWa8x=UrHw+lANpwo(+p<$ZKw5QOaOnl>KKsHVV3t5Th$kLI%`w2k*2nmepHQ-VMQ{uTHq^}($JBCNc|kx1{tt|x z4?#=m;`@_~4>l2EETik5p-kVAXo}x@opPF{)`INBZDMV`<3|dgMo=p(ZFsQ^4Asv3 z)nW1a$3Z9hfUY+|P{8@>n@zH2_glmF=k4A@m;>x~)`m{jhF)dElC2rRA*O!T##Xi6 zUANsE9QVL5>JELUJUfec-2?;s?zPGeTzJGAR7a*`K!VtSKU!SlLBYYLc>`>J7=(Ux zwHgOT2}CZwkNa!9Un6Na>vN&(SAvy-_B7FgQ4irw9B6<6F~HXZR47obEg*dayt;6g zfP^k)GIr}@4<9jd)D}Wm^~{t%;FN}WuX)TzOj*UsqQR2erIilAtwV~W`UnO0=yd@` zvR3{yGCfk}^^XN)+(w8E@9yAuak63Y{aTG_7i z;1>Jc>dUPh&SQL(fRZ8z&J9PqyO)+!d!(&wT(5a7tC=n(YE=n;neofmKx+;RmV=T| zci%1i0n3yurx^?@q>+W#9?V)#pScjMd<;~h+8T@$0YHl-ygJGPof1H)I~Ud=xmXQ< z`6@nqKr{t@5H)S-xVjZQZ+f7YSa8n9G(l?9843isMxTxB<1bvBq?D=7(+KSksSBz`Q3Kq1um`Rr=MABvshoEsfuxd#AOLwS?7r9)cm#w#bW+7z-6+%W@q>?p zdetymlEB`}Q#oY7Vow{vYU!*^Q8!maRG2CyqkX`uEC-{>c81zgWW-|U#M7+1RW9Sz zCxOM{+XtWG6m;;P6K~P&*#aMb#hE3s_R7=0+fJHtd|zTPzuz$HWJ9zmYXGh4{NjtDwC1#CS(i@6Y;iUj4VbJw*_XeXCk|3~tlu0bLBp>d8=WCgY~7=WGjt5) zm%?Wkll&I8ymsH&xozlh?kuIu3K=dL@PK^ljD4i;U&-)Sf!zyLse~Q$E;4_q_`u?A z4r_)7-0cI}6H5fS>!bu&ZZ@_#!Bh(J;(ZAebnIX2~NEn3F5U@vx* zWsAW@*Pf4gEqhHDk|TD^sOy<|ql{cLx9u{{hgkIU;{>QnbAM)A`c^2qlRp|lVgvSU z@g~ez_vEzBs)M^H(>fAf)jB$8lI`(X14a+Sul+~w3FkfdF`|f({&lm&+q0cbiSXyA z;MbkJCJ6W=e4DPkss&w19cf=)SDSQu&Lm6}4(SFFFZwC29h5?HK_8qvJnfAv0wq_? z0G2oef--joC%z?+K%nq<-}l*SlYx-*LcZEl)N_Jq9dz5qV^_zOMt zp83hwC%;sZ8yh#G$tSLE;<=Iq7v%>C&4`Rc8untzud2w^Ru6&$1~u>LI1b*|!AnGa zI(Rk2g1==hr&dob)7~lo_yRm%caO8nu~&f4!{g_G4+Jp;@u0CFh_(0c$G82()uBbt zaYl+|DtSqdx5de^#V|MoX#kxTmQE)CF4k&#V$(nr`HzuzW%xfEC+6vkj0ENL;wPYf zEC1TDFSX(~y-Ef^w@o+=F4&vb?c#ikd@ip*3b|r_zb?II@OHwcuoA4TQdJ|7>oDUX z?a=7Q*>AN!T!0oc>_rkg)ZyX_JY#(Hz30=h$IG|3oh0u&Bwi|CEWln^?&iIKGwx|# zL>c%WB^)dLWT=CdH*A;#E{Jx(T zvxy_I*I~cAxxBo-Z7>h0I{m z5&(_qB%cM!LgH+|1nUg=jjXdFgjjrGAsFl|$|fsoF`z4a+=Ca)hyT}EB$9BkQVsTGss17<1JTyOdVm|l-jubPU2 znwT4o(v0EyIFWX0?`c{XD;rfz7vL`!l-fqqwV2)nS%BXupF8$6UI;nn(H6E*z`|s& z(J?u3!XsKEDQHKMH*{!*(b+s#Y= z5T1P)MF8kU{0#-6DT+~x;_#va3PvIpQ6{|jwg|OW1BH5wb$}iaEK`BlHr2tlNbp!0 zu=E#_y7?CZ{O{E;NTTox&Vsbl5lv0fPsxZUi21}wUu!5^4Yp=!ULhC=wTwb2_uH<- zdW9ns3x!!WFzLD}F9a>^rqFYj!>v3^`<#+q0|54}NjWIZ^VE_fy`2~)eH!I0FYfKH zwCDeRm!Czgy$K#?o{64N9mB~P!q%iCc^Nxvhj1YXd)}aHz#L(+G2NfN=D zI02w8%vwgZg~2!HwyiO4Vd8Wa;Pl8$frhXc+HyKyYaWmrn8;p+VJo+Y+U#_@I9t~| z*Do{5aTRhvVP?eZD>1#48NzN!J9hqR6U7#Cl#axQF0Do7{oJ5SUGVYRNZ`7GS>8V9 z8~Ak%d{)%x%fochdX!K4!Ncu~#{ba~0BwF88Ht)z6nf9RmFMBJMuaVeTX`1W0CXQ`F3)afgXEZ+FAsOaIwvPeGu|NOFGV2R4<>fER^Z8L#(+ zdY5i!g@84Lh9R5b1P9g~pJ=p}apmn7jbq{G1^G%MD}lTf>8|65YZf|qJS9!{>#33r~wN=w2MKu_gLv9)nG+QRK9Pa=9)9E!gw5MN07sccW@t<|b> zo6aC;O3BQesbc_DU?eG zolwHN?0K2v)xiZDP~nliG< z6Ra4UI!w>zZFEpkq7Hy7%?oTD5YgJ(GW&qrzcTtpune3SEPIfAHq96K7%EQv!(sg6 zu6L}ES4(<`E0NFLpduf0*0^w+)$F<_A4avWe^x5JutZEowJ2--{y$>cS&*>JZC~_V z*_`KE_V@aZ;?O(wW$O%w!%3bImeJaTvXyiIyC@yxme?+UdiXa6uSc78^SuxsTLk8< z2k0u{C`EX^n){U8c@b~bLxo0tNi?Js?!uZmb;y}0Ij@5R8B^#d#M05-eC z$mR(;vtU#bP55$YvqToG3K#i?yuRJ)um4L-Q-&TWaunn%FY!uKd>(dxEX|qec~{g0 zEH5xHR#JF8^V*!wlr{~2J?)(taB}`{{p=?7zXeT`!&d&+0fDa+J_065@IVngA^0ob zhx^4b@3Wq4vzX0gpx`9H$7!*mm6WFq8I@09qx5z0C8;1)RxcN>)FTNSqxArW+Sp6N~HmJenAvs zB4i<&J|NTgv+A{7bWetb-xaJB&<6xHHpWt)Y0LOk9Ty7`cx}Y8AsV#tCsmZ6v!}*y# z0aqN;oLB)$hQHlj%E2h^vbU$3&+DzH+vn}=g&(22y^T{qf0Nh5?KXBhN9XHi&+O68 zwV|C`Hyvdc#t}^V7Jk1jY{sIk@jkO+(nQ9$+sVmLGd=RNh9g$r_w(Q%Lu}8Ix%0>V z+1b;i@wl8CMGiyFBOGAnkN{`PK+!7irPh?)k2mR%>3BHdXsV)MHqb0&;7xmie8GR8v^P1_B8b&sVk$#-kWmzDQ{brN91DD3xYkoS6?Vang?`9;Zt z#fy>`^-B$D0m#+_|CN{5$nR0qFDEh_e=&Csi7>;zz#jxU9R?WUVx5&$aINx=<7GbO8z3DlECmk^E4h1fvKh&)PXs$%V~#SMNbx?kTZV05BMxJ zd*S72djohldA{CL05m>by1Lsw4-k$y&SRG$me2o1&F3O4ZGRHfb`$(8K5!a~RXeal z0uGJeK5Mhk!0b|Y{vLZwoIWBo^?@^WoP|h#=r&rHPO-2I%M$y*6+B5P1a}COkcgGN zp@q#F@K}ipfzNPuX(0p?-e)4O?OB7i>+~izKa43p3R1CCq>D}16RI@N9RYzyidhV_z31Szb2(Ifj z-_Mh7jxmz_5K|g#ym6tMAdqvCrLKu5o5Ug2KP>fX`mUnm^m{g%Q~vb5BD_x1yIaGn zfT-j_JN6Y$T9P5DjCve6`%#-5%Bng|hlxZo-oZrZQHR}7-G*zE2STHiUv$a3{%SyV zBa1ufXgeUj}9(?8RS=si!|B3CRZfA0WHDhoyk`kQo^=Jf6s_aVN|z|oX?2)Y(O&Y zm^i(>#XYZBxK@jln>Bc=;aAP>AVpRH3&UuTwvWR<$PE;)fi9655`!N;oOmEmmB zCq~$MxNy5(TF1ubbn{lrR_?1e#X1B<+0i`lTo9dnz>8Hzx=+Wvcyd=Z&^S>g1Mrc?13K&^ z`zW`i=l058kIWD@abA5vhiFv>NUuDU^DEsu?>70mJAPe!93=|u+;Ma1XE%8_lCCsy zY;|xB!Ubm)w6z?dC{C+n+x2;yhZ*db2}F^m`tw0&c$FV_R1)Yei}bY0YG036HW!V4g^skL>h{k%NAoE?3&U0mMw4(|3kGGRPxO<3f& z!UZ~Du{`C)uk_^B84vS_k}q04-VTBWZX=Wy36g*7=j7;^P2+5}O3Dn)Dj@3VXII(L z>vG*M#>(b)c6PPB7`ncHPL8}a;#Udyxkosq3DkXgeEELnm(ZLx0bY0C4i+?RSL&D{ zZJQ@k2p9=okC#6r>LhbBy1c!dT)#-8+AFJn?sN6Lugo6#rOo(@k(ujJu4^FO1$=p` z@L%&oZvt{P_fI~6_Zk%>gmDXdVm)B$K0hKPxg90&G^KEl37UFJ#5-Xr1jM2X(T_fk z+)b8=f~qnHhP`VMz#s;#C&5Wz4gyWgVGkSud{vpiD~K!EZ@8j6eI2&Y@07!sTb^Vq z{0$ZsB8spg6sfo1B?2^ivMJp1FRDwWOxXl%%N}c7)yLQ>??}eZg#!m;@AG*h?2Y^* z2%5fmS%f3<_fU>CHh2hw032z8H8c=dd(Y-}AF7?^x^g2XfawfJj6BCuGOBy%qkUO} zP1FM>lG1a+EqXEU9?VL0pzggV+P^6ancWGgdoZ&+F*_Ub4I%y^%EyRCc;#nUQ#Bp1 z?~cp!N7Kn{K3mdEghB?T^9wxvgvRoU2cAeL^L0_qZu0V#aOKsmyCKF$aV?DfLrY0V zSLE%7&;_-5fFmY@Jhf@sn~awFKABjtjn+J4M6;fjmCcWTMeFa8)YMiI`r7-SPx;4c zm+{>ek}2m((X1df^^gs+tz@gS0aA}k=km9+%+*D<_F2r2YnpFZbBB&B zSQT+JCR%Ww-Ubiit-@fd%Lh#D^4}K>{*^WpL*U9nzy)dXgf5v8Czz9DIq@*oBd7#m zRz5k+>|RKW7l66Sm>yquU=_c{WNhJdTx^quY@yW)9|D<%Z(m3WQ9A6vZaCPZ zR-m!EyvGFxbu1~$M=tH!+iCZ&2K5Wt;f@Afe8G|uZt8-nO?9y)d7TD+_QiNhZ4R1nOVH!i zWTa_%=zjr^KybgwQG|tJvEu!wVTGa3c9IfpL#;KRotcg%wc2iNM`}5cw%iN7nRgy( zt>PrB7wdBR@ywY3swKT5S@XV|AwSEF#0c=wJK<~Bpe!jk?@r?eO^N^^@Iw|MR@4`=@ zh>DM&WUz<%|Lq#(9jdgs|Aq}IMNVCF^{Wyjr?vPELE|Di@N#v&ULCxCLO$>Ni|^K# zXL|Q{Ib46`Hwo%n?Ff9|xI3S!JX8yPaY6|B=H&W&Y+})TBn+afqrAKpDh>3N`P5t9 zr3{dw!if4^?cGtGC$&-W*J%Zu5jmjz*Ic$Jq$rz78Smj}PI4e+JTh!{4+Kkl!(Ne~&)iuD^d=#mlEYcyUAADPs?T*q^TtxCie) zUY^KHjW$)?A02|)%l?2j8c;z4F!_`!qXC$oZE(Ir^10rkp@|>=HaE#JIS)rm5-U)? zNZLSU0iq^?D-(XGKe%?Nq(-a|NVq=ONJB;_&s(L>Z*xoP3V1kpcsa@;MR_C_BX4e< zZAyPQca%b@Nw=8b`!YJg?{8m9ZC`P>-)1B)SWprZuEw1G3!gExsK*)qx#*WhLpBFkz1=k7Pt$ zZ$8|9-^EgGW#Ipz=EKQU{;4Y0&t87@>IwBn#Ej5N_QOxdzY}XhvGYyn|IS+Zu6x!i z>1Wx+?3HvY-#QvGy^{XdUP=q4%8|{MfI(Nxkp929)c4 z=Q%SsK*rv8ep_`p_P%o%`?y^#pMd_{qgswpJXwH+8c?&D#MR*5bky=Woe-(I44`s= z>qUoRFRt7mNe{enx1~Mw*?Z1`;PiiboJ?Hm&6}?x{t8lRr z*q|IQy^7we=vmAJjaR{2CL2`rmhv#_ipswjef63xAYKnsYCT^dx(1odIC~9rs66*s5>UYw>$;Z7|Uy1(I>(RX) z-RseWL;Fye>?8Ct2qA}WPHrwvLi1Ls-D*k>;p&6a%k{^z!|_B~+CTa5#m5iSF3F!FTp@o-dRz*G=h&v4n98D(bL};Q6k;m3 zdptRS3F0hj2bq&9NQr-DjovY-@B1g#Msg}VQ%=Be2xGEUC^4%YQJ;W$K`Vu3DXNv~ zfUUGCF{#h)RlcFg!3<7al=oD!4ZN{R1Kx{l*-V-fav3P%lwVM1WZiI({B$ahz!0)~ zSD9m_&mi?JhqP&+6FY^P2ea(T)xTo4U*aN*$#^=5)k*yc*&TnM3@CLW#{F_k5i!5D zI&-s|PP^0DlJ-v15iRB^favX2g7HNK`T?JDcOgq7N)J&z<`b z38%tK%~5wQ%9BK9xq?RbG}`AD*N`f`6$YQ)nG+g0&z1wJLpIB5kLILkI8f-h7~iDXPh=^> zC5i!kpkZlaN^u%t98c*uu-vSDBmE=Cc?-#dP~~h&p*Z?OPbdes%v;`v_L4*Nt2wop zsoV-kN!m+32&vEEHH`~5^YyqEl{Tpe3hHT00t0`BmVQ&5Z(Q3L6>>2epyu(dL7wPP zxv-6EqopO4f>{&^5Y%{^O|lM|vSwB^pkXI=-fYa853|oDrGkwZr!G~Wu~*A_IA78o zbh%j0mK2(k@~fqQ>$1{jdeB@ns*n_On^Np;GC`YeP^aVeO4y0=cUZ_1Bv@V}Fm-#; z@zH<3mmJ}cG!!=NkdnJt&yXOcng)xw+oFKLMtnT)13nxUlWTnXb$#e--IV<9V9V!xoirvRLUnsBoHys5= zQ z8FMJr>$Y3CXTo$^I6RK(dGLC=PtSiRuG6G>;k6~@G9D?#6)T9{c?^;)mcQM~wF;9R zdENipA}5ilGj8-`PSMgaY{rwREeoFy=A=T7rtqwRT;Iuz+OKePD%7I`Wwb7&z@Boy z(Nnltgn63Po5v&M?aMo=Z6a}HPHY{7o$MQEGyd)o-yh;PMgiCWM_@Z2nA zSE_YioKw+Q6uw~ah!b9C1n_@1l@XvXx3+E3P-(%rj5gdd zW4BkD!#cuJU%AK~2CBh;@q}5|AkY4kFO{Db1A$z6zFW zu*9J^w7k|ZE;XuU%JlLI*sTf11}=ZGpwm^n*+%KZgN-kbzzJ?_ z+-GC4>9#}ERCd>U56WdB-!Q$h79)79v&B0DXJ5z^0bKM)MO@J{dv1{xH<50;RwMMg6B~Lc5NeSeXH;x3{D#W7(*QU!{x|=Fe+WE@S+dj zeHVsO0FHkRU8}x1daAlq{prEO@KyWUvUgSFZ$T%ir$@w(#jgMI=H%=Gi2%wsu)yY! zr+&JW(#_AyveVzLpH6wZp3U)<0Q=51%s;uQ@9Pij%KGDVoP5K3l}SS1rZk+BNB@C@ zp>&}@eq5ZBz6gpBD4Tj5nut0q$ zjb)M2EK7nEbE2C=Sm1V+CXwR*cn?$rYqeb$# zjsbspXvXygptsjm(bq=!8&D;8iO<`F4{4cp-Bpr^_dtkFi7V6PR00m|*e=A`P__~z z1=pLtsEuc7V%hGk=`d`#rA~-|^ zAbwxOa@#(CkPsy>OZD#QlrY2$=l2*yjU|8oIQdAj!2SUn5PC+lgo~Q(jn8&jD6vCX zY49Q!F|WmPPDBxO4$+1X-=#A#mow}~=kb|kjy`>E*=-T8v%by z^(1s?iOQqJmyvqnA4F3|2p{6qa(;yBvjg8MZs{RyI<2ymJ8UN3`f`w}`l7Zz(3x^Q zfXx6zg1{RwT1Eh9q_eg|j`37^7|MgUfRVu*%PU}243S3Km3SXDvEuav+mgj*gQzA# zh8YTS7^6kdTh5c67wiFR1fj;=M_qrK0cs-Y$XjpY5=5z}&2$WYgvkfrCe#Y1PVOOa zEfSSRBLHa_&%$fA0o%EV8IXZUFAQV27yyHAE8q)4R^Unm7ne;-=Ii~w^Nzc)m#S0X z&Ik8b!sWc3@Y;smET$$yL1Yk)U%>qZEQMY>;)GKilz0?k z*L>-6mSN>Mrm4a|A56$wl>GssQ6BkLC+=ya=t~0H7qAV&ZE}|jXFY)MU}y^z7oqn0 zl4Ritk99tBPdObk4TLqYsO1=ZpnG+Td%hd7bC5XEFl`tspr9L8K7$6quHjH39uhXF zN*SG3?rEt|FZWvzuo!>t1j0S~Emn?-xdVqIQvk6Qz}+|!S(2bBi5TR>4i#k7p7LDh zwR`IA-URAq$tG)>LO5digr!R`D)S2jI>%$cRe;$5*A#2h5qv32HVTdh4By+5jSgXk z^-$S+9yUR*5=|yiuYv|ABU*?{@(FUts7moX9m0BK4$ytE=!5c=d&egKg>RRA!(E}$pt+rP6dFQoyY7-G@@`F)Zhf6pr z9>+G03Uqow@-lx(#5kJ#ngSh`3T=v75WJ0Ht=d5sJa|a>t+WMCO`4(`0)@vA=9KUO z-q|`AAOhGTF!wAkIGOWh$QnsE8H0yMSdwTc?i>k0Z?#5GBQmUEgLK@DZXpA-NV$S| zjcSX;$w0az;eHZrWR2>eQ;1gcXHWgt{&AB`gcF7>zeun zhV=yRo`)?3Zw+?z?Zwr>aPaWp=<4ideR1~i;K^4nA0GVWP2EfwDqX8gY!wuQTg$G2~iAJ^5zV`U& z>C0m?k_ONuepMqoHUzj8Tpzv9{>XYe1)-zb*W>lq|2}v{RixFWX8v_W)Ihg0jeaB2 z-cj*1VJ5!C(VyyX2}v$h3aIhf*H`aPu1?NZXB&U`Ddt2D?0od|)yeydQ;?lk0y|m< zXlMR0oe>&7b-|sI&aCqE3P|Go5Z4i)pCu1q*7{0s!Gp(#n8A2c7r2uJPvklsN?r`k zCC~Bs^7Rp{A^iQ(Q*&(J7As39FL3m?y~1!9DRNN#q(G9W7^wf^v4pA z_2KZ%@L|IzZ-*8gnJp@eRKd_LvbFqw_O7kDZ6jH~rz-z}l|0zlvKjFz@>G&4+manu zS+>_wvfigHnuH{tP=t!2;yAy4zn;MidIo=u!2krE%aT549TVVOdV2bPX>BIJ(Ci2m znBW?K9}E_96Mo^(Gnkg`$a~`Nh|WswN7a6$Gi+_>SF=ya<}A7SkZjZp4q*T!FE-1o ztL&LZ&i}lBe(~<*ix;Qw_))1Oi1*LW(uIRfSb5Y406@tIJlq%fhzn&e7p!HXs>Oc; zexVk@W07A0xvGN`_lrrOYvV#9XO>*!gR)83O~Y>x!kRWV=AW8gK-uCvhbTv zRMal{k{@-jStMAI6B5OU;0w@hH~-siW<~bC7lS+%bRVJ+i!{Ty_(F_^zNdoz2$wv(@U;mtQ2m-KHBJ)$kKM}lU$kd=JFTj6<2n}Iq)hS>3@Ps=hH|fhAt$sug4slIuP!lM^pgBEKp5TSg zOohIh3P!77)siwaH<@BIiT_-n`%UZnJ zgx1D65R)RyJp$F~z5MN%(f_Wxl|W_-Lc2s**-KWt62=nF)hbugu)_QQL)sN$QK&2? z*{ablBWpuplq-K|KB%{f9DWpi1Iu9tpoIsmeD0uHQ7awFlpu5e1ZCXRr8KjnOe)GK zlNAx6j*baU&t4*c26ZdM;X+$Ot^|@ZkZ#1c)Ru0A{3T>29UUQmDGYk57z*Tm(tp`o3gysOZ` zfH#>A_Dr`PLR66c3hgP`H=?eEvg}U#uY>+W_5}FvLa8b4% zoCf)eV-zRg?*=Cpoa9|ZP*R{YV$@NeT2#9Xpy7fAS|LIX4c>^|L{BTl{UN&wb~B1k zNAf9(hV#Mv6UKZ1Fok?liYrt&{&H}`QYapw6%yJJ@(33(`W*1V3Ns@^1^f*v9I{pL zf3ANIIykiyk4H(Qr~-hrB2*U(K~3Q z_x6IgM_`5*O?!+013?`4K76zR@x`smqTqkrj3ozWPFJY!s_T<(=EmYG(L-c9l*%@gT~+d9~Jj!iV^e)lf1roji=@2$$xrnA4|vf{Kck z?!)jqDC|stqWXiSKVis^B;$afC(8A%)J;Z*s0bDWu)qs9B)!r4(is z&R|6rr73B6PjHq5N~j5_eG*1%Vio!NvIsfJ<|69tpF@(P#*LBk40?Z}vCTwEa$$ll zptK~xp-?p}5e}C67>!^*n70h9U9)2~MvJ0T>l(vRq`rU#fOaQ{liCwbi^3A@P%zMk zK@D@MfiwQDNvV4hPi)&D12c9|;4tKaDn;g7AtO&I#bGQlD4ymbN+F;TMgEZsnIMqy zyKnVFDXDe@->v5}Ghct@J~R5Jmd|X0WH0XfvW}`g9*~~dLk$E~OP{~xc+YY`;lJGI z*QTDd9Loujz$9}nWbU^Y0>!!NRQBThkxn&KN1}>g@MFWohWsjNM@F=4)vtztGWb%C z$JBfn^?rh+5-CIN`PGn3Moa--M3lop-Phobao(-@)yU*ZCB}azs3w70m5yX?kjH`= z;S%ln)v!xQ8VD|@mU(gqQZsS8el>ab31`UvR%Lm#7;3>ZoH144k3Rq9_Xr(qrSgxCvZqc71%=a zL!5@GM-9&%s^)QML|qli6u0*)%7eEPG$exymcYPKA$Zksk8RV8vXaOnXY zj&NK}J|*+dkgB`ePZ%TWdGtuo$_I`DLT%4peHcjAAY_j*-WMhkh#kpyRq5N~9(q+Z zyAlza`1pV7LqRl8A?%9bLKYxi63{_XP=0-@JbZ{7w3vWU#EAO<0|KMl_;Hl0uK^%L z5sxaY=L-(%MYZq&v2u(#M~PU7vg7`uAmcSAr3PS-jA(61x<+|^lBGQ()Q>|U4h;33 ze}F<*(#$PuEd05-^A8pI8PcFcQb6+BhZnFNwWNP=SctV?+d2-#92mi`iD$6#v;@n( zs1BeeetvZ;h}a%{g!`hQbf@!k2!=V@V`$(rY;p{u+>IVv`En~*YU{qk{W0_b(xmK% zwpGp08+a6(oPsFeBH4?bLQolO-?O+s(NZ<*GRHtNYvn1_cQrOS14+0XqHmH}D&)mr z7Quf$e2#n5ahOO)-kXRssPBesatN{;64s0SCWP6-9^8?8vQfdn$H)<>gOwMdfrk=@ zASjx-^wiWZ*)RGfv#*$665rJFOG2|@$*a~YIqs^!EcVE8Me=}B@*A@Enz|w}Uyg9H zx&N=_isboyFjqJzVWdXmMQGI(>81DuxmbUzu1Gh-i#s(Zo+PLsA3xqnrBY*l4Ql=c0eT zL8ty1AUGoyxMKYjKr?PA!^wc7zV~q_Xo%iNl?rGUElWKHBkFh`RZgHCmf|+51>O4I z$DP0-T0wMnV772qiY_2W{VYKszyil6vOnQhW9bc8#K^}G0GsV zzOMIiCuoSq8I?b1z%dEOk<{@%>O_A+0}e-ALpu=c#x=qK1dYpOCvZq+BLt^0CrOxeU~&UD0$)_Vp#ewCZE50@ z+zBAEdr~JJnwn_T@@pqN#XwE=ov{ZkJf2cywWQ`_Ck8!6UNx@mtqdA43DXM)J<=%wOEDO?X z3-GBth59Z^Fm#p;8FvPftf{jh4bD_(BKt~B{~kN!G`ESu}(>qDk)pvxpxvxui!tnRoX>)LAw(5%&1L? z?6m0wO+}z6kB~7gNf@fRfmtegC!2I=zwyB6*lpdGH#qQ~{JXq+0&P^Sp|!zn_k;}0 z%wfwK9#D#zlcnl6DHwlnPcI-6)nWkqE@?6FEWNo&)?0P{&+k{O&eP3o{!6lbj8<~j z__~;i@p;PYGvxub7`K~rl@&F4jfR=&$NzBEQj?gT_LmdaIy+Mf&x$Qmj}C+#n2&0f z6wpHs4*aoihV?!YheYWh?Y z9R0#ko^=3ys;7UX*5dtQR4$GzTEarFkC7@G2Am}}0GvUw@@;z^CmrhZSD+nxzszp* zHC<#ur{)*QaJ&fQ^DmfKD*TNB)4(ICj8r55aYl6 z;_T$f#oI5xc(eYH&Nd6`jeU~*x|}CsXE%NO!Cyr(0I!HZ21wXPb?98WutZ?k9q1yC zOb)d?wb!M_$XwFoY*Q7-VLx-OkpIwQoMm+w-M~WCPLYcm1|jqnHzc&;HFM~p*PMN! zs$)qpE1!Q*!2VSJrnlw(F{)(9HL?n{1VK~&yZll&ZFEoubqgV{+>vvq{95P|Gb;tL zoxxv1a0;%TW``|dL$ks8b*RLoYzjVmaOD!Ms46B^0A6qg$uJB(!0jAh?u&(x|3YvI zE|yyejgX?k!LZvDTri2B!e2vh7m~}q8c^~SxiNo+UB{-PUl5AHdm@&|6D~`)Hp-dP zG`eDjlTZx8we0moh1Z;e5mznT!dh@?xM0Des@IyIu*hB!%~rx*VWkz>E6l#C-ZW#B zmcJ_N5_{lqA{NLd<7`BMnc;}~q<$jNO;BQ)>36t*9;KmQI{EV^_$wDo)WselTM&os}6Atmm11r!>}LbO~fyqZk(9Yi?uF$Kl*Te-_a#a4=)6 zllgX;uC?vpV8-Yme(O(b#u&m*QAQv+dRq}|*d@mqqj8ov4nj@XO$e6y`_O+zLZnZJ zHWHGKZ)h`V_^s7$Ikb@of%?!!!i@iYcj3@R z0+2J%IJA*a_sW9f&_?2@J3N21kw9!Q%VP~E$y;kcgI4i!o!2ZDTof(jIxYJufljq4 zb7lX~M#8`XR_xM%6pIgsHWEk-L~dK{9`cnXs3W4E$lMi~$b|lThc*(OpVeVCsL@h+ zTEa01(RPS-I<%26v1|=$v@|&eDHMNjXd_`xp+Sw7Ca1uIAB=81M0S5=9t0KcjN5*V zmO~o}B8G=H5=NBi)vwXgkvo10{@43fdwZ=Z3=~qem!T?EM_U z`)9Mw)e^xATDlFyK^rsSJ1QGf`&Sp~ZSCJYO}E?hruNT%PBz=+e71VBT3%%v<1j0v zJ~7|S+u3GzwV8k2mQ`-~G2Q&`4eL`3Hd-;F)WGm{O6RPB&e!%jr4yCDKfg{tir=qi zsQW~R=Z^Ew`{n$X6YM5`C}Xrz~nuk6ola`CJZB zt36jyTdF%(M#QE$xnmnui!0rz5c0!mpa8@jCKD8riphV}x`G-Usar~-&F+)j!^n`IvNa7DVXsX8)(z(4#0y3J&GO0 zUvPu5w{p&gatA6cg6i)~2Sx`cqIj=KbrbhqzvQK~fADx}Qxp?{dqQF8QJ@$AKjmO#O=n{YY(OPDs z=husmHMac9XPZDz{+Y7uAw%(-@V^}x*|UlugXe#!xTcQlJh@7f&QCA-Wl{2nKFp(| zdJ+Xo!-xP13IN@%lHZUOSe*rgz)NsV+veTwiq_Zqr+& z7mRNL=DNdW1jUz;5B{|4LF799oo*^G)k{OqaCZ_~Ttm$bxlm=pB-j-FZ%P7uO>S}&5#N>uUR{95+p92sD! z*L%IWFD~vRz5lR+Wifjry}!CHzVs^DB6;lYb~YFGtbly6nXQGbKe=1Z*7k^809JpB zZuu!PA;6gv-Q=>6SeYW{rIPILdJvWXX_k(ZZnOkWvAJqb5gCCW~#^U7MS=x zMZD&deQpu&JlRn7$j*~RdP_-Xoi`{dx%t1&cbP~?XLYumZ_>N;a@$!XmkCjv4r)+# z=IKpx*ZH{IUU%*i5S!VmbCWLaSNMN&wqD>nH8MoU>)Ez5pRGF|l1{RofxIlbor~+` z9bQq1ZWse$%8O(>Tdq1Eua|QgF#GYR^uBXzT%$KY4Y2S}>2*{3-Jw zRGD!sJC#bd`jS)G5S!T!Sh+8JhKcbd64Fbd(1R3=z^BAm+`IZDyTAdI5E zay$jzS|n!ylf3m>Do2snPGJ-!ulZ7xw(K(l!n5@8&1^lpqSC}c69D{*Et&vE<)ssQ z{jOhD(NX<<>w!Z%hZFy?r}7{7>M8y9^}jLYbP7Hm?Dtba$^FaP?YZc~ zaCjBtCK1MxShYWQG&06^Fy8Oecn|xituekg9WG)9XmR$fjC>YZ8|Ty#cg+0`jsYU$ z+O?;USZ8<&b$bl;mn;(np86d#%IDe`>b2db%k>srx`^LyI#8)*o%{9jatWmeikg0^ zxiRTDnO-)(hZ^;%bGv_ALvtY^wC9oeki1<|4N{n{255DNKeX=acm#C#%{T;_7zW8u=Guw^lkCgf0m2 z(V47jYo&mUoUISgL~o7S#EB@PzBeeM1#xL>?qpS4>nX$&a3pp%AauU9s@Y2S7KxDv z24=H`(SJB4Q;2_b*WykMl}O?z8;!~?cI;#h842%fM8z@1ovFh#C{jvAU`gRSt30$a zIL4vKQ1t+}7rSCM6xAr%TjXpixY^DY2INo`pp;M~5|Hj>6-I{aPDz-K# zgJUE@QYXFWi#(u%? z;)pw2#i@-T{)^Zjd20O$N0F*i8>!O~_*$dcDz*me^-fzO=8IGTPr0ak$26Vtzv6qg$m74#J$*6r&c;!+^LOf-8E`vZ0;HyHBb_aP+Te$ zAb+ODNjW7VNaPHjKve~>27B;Cjf(TfI0jm*JfW6@N62 zNtNVewxj_5sLsw1xC z9+}4bQMX)oWJz`@#;E3F2^*G+M z{_W>K|LLc<M$4~d%I1Kl!^DlE; zD8JpaUQTA|+49R2zj5}g=acDF|LZ*ceOdm?!+1yObZWhRy7zW6`)$wq+ta;h6i0rN zB(WDI_|x_Gp0KO_F0Tqkwto|Zt{(-qZwEmT(W`!)TrO|qW&TJEl_X&l#2C^~=w-j8 zlk1zMyv`nBEOB8R+fiaiwo5O3nO#(m=Z?w?tH-mRKi!iQ|7wqd=559E+9S^?ZuD(0 z3A{ke%hSE$5$ZP{&aS6v@mzGg=hMl&m?OLX>yill^}BR2`6GRmU4I%zI{Ab}KmIU1 znocf0mW0IPym@=_`uya#^IuP2??0l0i3NQ-UM|xdY=%VwFXQs_Urt_~ym){3?s(s3 zmx~pDp5^KF>{4F-mn&EN)Nguq_U8Qb_4)q07ti+HAUG)hdvx$Pc+?p0*+)HEaD|`x zXlK719-r(J(g!c!zkfPDeg1r3KIi@q;;W-_kFeN$zNJhk9*u40GjOr|HD=AlqBkb$D7&3c)8Ef7 z^2vN@e9R|!A^ld)*Lf?pXOG5<@}=lBzRe(Zljv%?^JRi>t zZ+p0yjAzv%vN6}MvzixnWi?5U*$#d=o?V|F%ZE#6kKdn(b>MvB4t!Fm=7CR)eDb7} zp0I_q7<~&VdYzBwH((x<82u&7|ENjlg6oW;+d#0RkjH+h^TZ^HVUX;D*jJ6cT(lDw#VI4xdkFX|IX({B>*KrGmpm{jJB?vJduc{(5GsWq8h<>SRNUtKI$d8%#@bMqryqXm9vEpNt4 zYo2Gnf3X(OA@G$JmbmpIn_W$=amA&z%&hTr3RZljoFeNuy-J0ivkuSS;=cS7+#~D# zyO#@V|0-L}EBt z4^xEgSh+RUIwvP6{Sx7F;1efeT9x{OuTk)CIEqWBA#@`@VjQl0oMcoCQvN?;V-X+6 z@q__oi%;YSb`VpV)Wz}nfOt5)%Q{?~a0G`;j_*Zo;1+i&w&9-9y*oH!HNJNTM2JG} zV}B4HX?PTU+=F+*-`&`$*v1igmMxdr?Z%|;;J*xtx9~wrB!cekjg?_j@it|Q770u& zZA`1FcsHcg6l?dVcke*!-qbEpwH@lq_kg~%VRT!ouQ-WpKMYziIxk{?7}Z$?E(eIu zPCVOZx`^m3plxgfuBIeT2<53BLi1#YntyT%7yv3D-}Dt*E^niTYEG^M&alQJWO4jbuG{JJ zeYyPqa=rXl`#}Enz&U=&bo;XsaDOAW@pY_=gX=8IY9J%hm<|@7CpV$KbT5Mhct~;>6`xz+?LU7-vG-nR&;94pV z4FR6%>fvi+p@JLH6>=Y>YI-OR|&5Lp(oxd3GW} z72?mV1IVka!!;SM(Utg-i%dw;4A)vNv(4imRYD>XT5F#>WVh;U9Dnl4n+3(?T-U)R zGTJZ59To|rAIsb}WDO%D?7w+5gnOJWWF9WEisjN!xpsJYi8_KJ=@SJD(`EMK#WY)8 zjxV$M^1rYW2YTDt>I1!#es%KuG9LrRLoyn?Hu}x;e0*D^!O4Ysomof+xm``i^rF}4 z=U*qYOH*DPGK$8l>3_0hFOqn1Ium6VV7=y7XIZ}duj!ZSSvsb&mpR6i=KTSpVgvK} z`RaLoO*yUwFhkNzs#2_QG4(Ox%ja1xi-$(mA&|aYWEw53vTW#bWPhD!$jd__-c_1jei&bT zw8kH@)e`A`lZACzRw2pz4=g0}BRk&uoCBH{$$l$j04}W~At?@+Zkh1|sy)m5(RQ#OK?Qmkt-LMlS+z>aYc z8+QU`Ur<}7uzxP7B+|GG(i0*(^f14!gHj<5vPc(D`4u^$#SRkhb-bLNDelYhiPgkr476=^Rmvr=x~7l&;|RWQlK?fb z?Gb;4sDA*(Yin1VTDS?09m6OOoY?mQY;8@1*eOlr+E1b3kzzN-R3RD~cqq3rzILf{ zMyNWBW9&2AiDEp9T{sEl3$$v3X68V@nW(6Gp&N#tp9HZd9+vTND^)746l>eD9S5P~ zdZAcrKQ=De=44;LfA{Q6X$-@GBr)KF0Lr)Do_36z8q3uGZTphtvuxbf zi2eJqCs7gyc^&K(8ncY#%ft&r#j^`_!ls6;E;XSY^RC7KZkRxOM^JrsKe^->cWPWd zyyw7p2$7aT_@w=*==M`A2Tf;(VE{3i1WDjC>Cu0f3&)182NVT$hrhN{tHOUi%&VApH>^O`e(&Lz} zR-LSkMZo(yNEwFcM>#XSxOHh=lQh|gEQDqfxnbahcHnwYd2C7A37h0eAJgdX1voH5 zsm*_OgiR7<6T(~R9T>z-sSPwE#6L*G$raLj^W0 z94eFPPxm-+sGy8(C$Z5?0$nOXv-w0#fA}F%kS0#z_%IylmQ(wan*KHvrL=$5wl>|s zZGXG)r{IUgaRix84gE>+~i_6K-RsPr-Zsr)o;ug>>w z6%nQ_(>aow5cOVw3Zye?n!Hx3bj$P~Xbm%B5!#uNN`B6a)R;FK8-y8wXh{FCFvQKA z!gvuTm=k-YuZy@3U34{*j29tq9pd660z}wE-BD-805A*SnkWpRl+1Q%%@cKmTU>v+ z`96E^KFqkLgjzJWDRfm~y1Jc~OXoW?9%9 zyGFFb)ovH<>;Z{vccIDyCvtr_7NSOvZVWXwM7G--8ydg?z}>#>yD^v!j4A+V{RZ#g zQh;A1$dJ9!PS~gd*igXS=}>=lRzcrD`jiMp(5u@C8+8DmJQ2Fn0Ac%3M!8;~;|j{> zrb+W1A^=6m|BnM?ZU7EvT*?Tq7wmn6TE#6K3kNXX`o@f~36=m8ua~A3VW#EV=b2G8 z+KUK2c_EUwA{i#*2x4QNDHZ|2fsNH9OvHbRkh!hX%mkVl z=nP``u1Vzh;1dJ|*AS*r7W8oGNtlY3N|bs&f;3ee&+jJe$vA-mpu@g|je=++dB6iU zWt&S=RE$rxQ4ld%8lopBkq3=6MnMDW8YIXO1A?a4vMtQ%n&prVIU%seMOuSy}PWcq)u?LQBXkM5mCmVKZ=-yRO5} zpgchQ3@Ba_rE!_bq;?zgGa~ets-kq}!~q5(fn!h#BCtug(#U@np=+oJa6hAp69*20 z#f-((4K+W*Lp;LqB{bxc)j?PW9wgz4tTwinyzj^LZIMMV}i0Lk1) zVm3AGb?N>xZZCg^mLqQ1HObqNH5vn(klhMmrj~%3wyg#-YS^yFZ=HXm%Iq4c&TV$! zhiC;JqyM(ZqTy*%j4Wd}29RiT3=mG4=m+&+Mvc|P@%$^d!@=N$sl==ZBMC&Oq#**- z&2c*GOEl$UvajQfjT@Vpc92=!gsa3Tw3l#VdTj??b(xIEX;wyB(cLU|kcgOKT6=)8c<)dT=sV03_ z*J$M5i>~8&L`{_I$4J-&_GdIHm|e7Cpx1HG1GMsG zu?2_&p(KANH;Vu;=+r|FF{vABW>J7XpjA8$Nk%3bwb0sq!>^*_O_fIqgV6LyYFBpw z&h1i+u4lEoIN-m=JVCOGT|Fnl!}J;3=~CgT-T*2O)=;VVkTuY5=`hV>G<9GLqf<~2 z7r`l>9H-X5qRTIK8TYoof>9naL)qc-zkMj9jH7?~M?i%;7auX$C_taw5{2N|BPU`q2G40MjN1p9TfnQg=|_ny^Xcl4!$!A9^`me85B%WH;5uJ zk7$1cUb)cD095K!(vD%3+`Vd$^=wgE;)h=3A(asQNQfS4Cu@{YJaNhHeqA;(09O0a zHA<*WURSGJz{hY$`jItCGnyM8tZ@Vqk#n7RerP)~Beow|lQ4trSEl(2@dyD!hia@Y z4GKdgP(%-dOtYv^T=ptNNRS`B186G?HYaA`HPC#`?>W z5=x{>+C4QR`j|G010eND3{~nMK|$Ah&bk%~=Q7 zfpH{q++!rH+8&#`<~&ogu&)JTh9Ye{NPMIzmzJ`>CeDDCzJlk=#J9c)O#pu-3{%Z2 zSPRt^#&iPT7t2t-*qbXD?%Ud%aT=t^Z1l=HvGQ&{eNaz`j6jq}SJ`~s8y5^mO2}~vbHCa1j0j&Jcd+6Z z_(Y<4TM2>ojX`=wk+G2xi%Rpdd5e%4eKkK)xD5P44J_30(aCG*gx;PY-65=fSH-5g zCA$WC08ZBdJy5|ypa*|ZWnRd$$PW?BH_Z%(9yY6kWMC+k(=`4+cz6tHwVe#Non>ug z^C3LelD)}P3RR5NR%Jfe5FV={GHm9IDzVZHUokwkvpq&-x)~#&QMtR5)iQlI;jvAE z3cW2<#sfydvq=nPrvWk&kAe4U(k|MNQGWj}B4ng;8U4{a>281LRU3sADp_^>Y2Ewo zG(<-FN1;z#=lkw7Muzl4Rc(jry-vD2jgb)`6CF=F>FzQ{b}!p^y-eFE7P($*XrX3| zkzu=Z7^;-e zk*aYdA`8rrZl!5LZ#WQYW(f7B+t8%`m0IzQXrj^;c~xq1nM!GWQMy+&(W)IGg7@8s zZ&Ajqdi3#JRrYuqYhwf!@XuxcO$B_)hUuiT7?5MCe87%T5f))+DBUjBs>LW^NzmxcIJ2( ziw>a!AAN_$EK3j=ph*OMh`zS;TE@iueNCbXAsSMJ8*~@L0{Ij*@nv{}cOYPNsSq}Y z!#E7MCWn7lB|yqlYL_XZcCseL`S=KDTmUNBcWRn%pnb}46+oOlTV; zWPpF1Jd?-`Q3$4LL*W9wdKF^PC@(GJDqe8LgJD8m;-J>535jyo<(HKc* zZ}PSnZ1Si`GzPuk+=*uTN$7hnoN%@b%@_9I%4;3KBf0H#O#)~mx^8K=70n-b5mq}{ zll(zl7B!7J)jK-<(e~qf8!@t+uT1g>3A%rz_a`^V8qHtDj)EgU!Oplgyq2qco&JI@|y((Svve4b4rh)}4Ad=`dObh3kPEnULM3N>OwG^&$M3UXWREHYBURO%9AzR*{ z21qg&xz^RJ4kcwG)m)SEfz)&;mg3j4nQNsx;kF`XUrsljpB~dJ2lz?{l*278#qSQ-+#5M) z*F~74;`6xvjpl6x2gx0Mcsl?)li41aTUk=Cv$NTFUh*TE)YsX+uO=5CkMr@h{<6#+ z!HLk58BUKC%3;qE7PJ8|pwoX%SF0~`V~s7GDtr90@SdOV%jN%<>*c@N2lB56&hblm z2Dy5bXKGjJ+qjS_?4mAL3oV2zS8E5%?T$pVYci{Zxw&*7c$;8OuQPEHyV{;O=`czQ2;>Ms4u!xElrvPNhbF)RMVFGk5!S8+~Bye`wqLYq2(hC$Go1DSXps ztLZddTGPp5Il|#t6HeOPaq*Z$G4Yso}{J|1HgzlZ)~6a5}l3X~%z(#HEjJ#`*YSiJJ>o zP{jq+107}4tQhz&(Utg-?|J^q$*YqW?+@P{@4q^GbAI~zeE;2xXZ!X6ejXhJ_9F&R zoGrgh0hs*l=^ncLkf%GF{89Yc9*G0#=tp88Z_nw~hl|O0_B@*{^=s;YPaTZe?PD`t z+wZCQqk-3t)2V;Ji}3myh#~9n7Rzv*kLNcn>u@@|d_Kt+iJb9irgEppS0`*n_^UblqmI=6T$O;Z{~*FLV#)p>vV`|{_XF6I(nl#Dmme}A5S z$XDb1i-k@gwz^0#)t~?L)05&(Lp~3Lt+Fr51HlD?DR(8ZEU=-0I_ZCjVXA-Wgs4j1 zMk6Y2k%LAzskWX2*cVcgqLc$IU05JQ%Uc*LTHNB;8jlV}@q%U_EBTWo;px(O5pl061z}$~lgsD*n*H9wr#>?qVteVnLo~d3rs& zl$-G{m$CS16TMOz@Bi>@eDU!*&sMWbDgAzUbnw^-xFi+>Kl@k>o4VqsKJ3{qhsP)T z+}6k`)?^&H2lk_LF?kDQ?sp6BLS#_z+<0nq#`<bHC~6 z5Yx>Y(`w4v4QVyExOlX32NsGGSak(h(+EA4xrI?!Fj(sx-hq}O<$1gH(q@2BWcxc5 z*)D%Xb|DmT>TismQB?hY zHWu0C*%#l6$VO|;@nun+-H>yMeSqd=T+G!(GpabFtA?@tJ&5K(`euc3+myb|t#g0U zcSBlriCARnKaBLx{)nb|5 zmKOrU6MutG)$0!74DxI~VwB@6ArDG3TwJJ)@?_6?HD16Rg6%F2J}{W*;RqepY&36o zLeZZSm5xM2Q+bc3k**)1U^~WfP%ZM_MI@*~%Hiv^=2wl-|I|mv2EZ!`3b=UX_dpMkbMXgp~iid zEwNQMzU?@@8n33y^YMqXWmcvOl?ebu&#eQ|D%9#Mz0OkW{VAPXGO;L&#E+iXR)o!~ z@t+hFl9Smcrf5yz;^30%17EU2Yt$4SWw-Nb`uo{MKAA6#k6gzp$P~O^R1kmS>!*9S zi%;h_>21L@3nHTaHlD5u%nzrW%NKorcC!CJ9Ph+Cj_s4jw*BlF|FiAK@riHaZ)kUL z^c;O|p1J>%aqQb1Pg`)S9OiXqVKdyWreiU;9S^!C0M(R&LUo%CAg7K=(<$m4N3BHZ ze02)cR;Q0TL;VNR-be$0I=_FJEG%&ULTfU!#unCmk}f*2Cy9)As8SEj zRyR|n%{z9ZN&)#8RH=ZmbZ`OXxI`>!O$uX+AyV2~O7M-~=kkN*9%KOGEg|n1_&2sc z^e_sapgtvA*SdI9?djKWxc2K67xbbqsLdY+wfU2hMBjzl+|^2nw6fNYzL{FQ5+6yw^u$QWgib&W^pm%l??YUL-ngmrNAIniwZio+ zEED>$)difUh%!?L${-WJ6YovMAbtEYe>pe7{0&$p6 z##6emcXHs?B_PzY37Ef)e;Aly)2sm{&V}%Kn=NGW0?9~tj4Y9@QV#Csn%ajrgYYO4 zUg_cUZ_+hQWG3IX`c=qXa<5thrBk~^??yUx{XiWq=uadEq9f74NAIduOm*W#hhS91 z%n&<6)9natS&4tGSSh$@g!9mB7wN?4P>5sP=tWe&6=R_!6dCivyCY)}UFQOMvqi>) z1Be;jMmY?ZT~sPp!TUIZ7H1p>W&YV(?9>^-Sf)=amcB&!YfAFrvmEN`PfJb;zB2i_ zMu8S1>=<~h)T7d$n>6sFWsx?RdZJy4@c_*Ta zP&^deHhPgxR;3BiO9q{9ajY+TQNn5T&FMZ7t_slJH}Y_-ib(sR%1(Q#s0*|sAN_G% z&qsgrR`gCKJDPZ^=yrgkz;W_=6eQ?ck5VXlAq`X_SFB>#Eu# z59d|W=OyOaL;I>HpVHa#_`~#QismrVi7BkEH*Zf~pP&48{_E-Medd^ojl#3m#nY2a zP@aGz3?Y`xV@@I3Iw2{z!jHyy@5L_`??8WFnVI_nu%=%Y)7Ls5b*ve@E1K(8A8emS z{>nDa?j5|=b$+HXgGPxjq8hy`@l#(Ly3%D?o!gr9(;CKXk0 z&3`mr6yO2-EnwnuGZG;s9`OuCj|6N`(@yLM^VDFAzZappDYkEOf#_AEt16$}6(f^-c4lm#L_5SM^@$Aw%oL%PGEIXC)2a}izpTQ(fr&9}s3Cz%4!;YjHVlas*H+A*M{d%SC z!c66A`hHE~O=yi8mcf0R#M={lXp`6(S%-^7x>#7!{G80La+EgatBZdnOxiY!c$O|d zXZc5Ko@c**fh~=$%-5@2nwpCPSk5qEaf$e1mR>9;pC-#MuvcN*Ud}Uoi)+@{wS|Fw zlP#9QnoVb)CV4g!X76IuX~X({Q03{G!=>tiws5KVej8XAaG0(MZ7XC^pn4H5W%Vjm zxHKGjqF@xDE{=pnS|5Kyf3-_dQ&9<9)mbS!Vu+kJx~y!P5Zqa& z3Gi!(oEi}3A#y6KSBJ={Y(%4BpWR1Ji&FH>%S)Sr*&sekOt7=!@ax1*&(h^;zDCCa z^w>s48Y8Cy0TOmxjCL#%-=Su1r4*5C3pfWIba3)Ijw|I!xmtfI3Io(ZA&eKG|7u)o zjK-8=gpQSdB9I@zIY59Y)jCcDg21M5I zbmFzW9EQ*-QiTo5a0s0m@dGV5htMg3zlYGNF?6az?6iW`$X3er*=^zg4;K$1_HQ=C zuK0vnF$13%lQe&-M2jI6Lj+#|dJm}>YpONcDkuyY3RF-RNdrx@|9)|2?qYP)8Z|r( zaeWyu-hC=Y-L2_O?4faIAE_7xJZu&H7i7+Yp<@F)`&BLg{T*5l)uV@JZOvJAuqF~?|9P~5YkJF zpj~HTt{uG+kwmWTSj}%v;-Qs$SA&QUimR&|p|37zi_nViw}GEGh|s#ggwb%9H&(CI zCyrbM0<9YbGIdDRs5%7$0J9%4P9!>YtIF1LJw*BxJLaT2Zl^E zRpn6HIs|A9nDh{!9Rjq%d)UZg>E-3CUK4OZ3VA9t>^AY)nph^oC{fr)Z0aaO?Z_)y zLD7F89m?)3Z7o|Hb_HlfhI+e(+{THNO&%QE#ofF%Jb@w#cTpW1gYk z)QNw(Hwp1iiBj}rJ3};w0X-)Q`Po%9k5ew^#!Z+I)74Ll%2{Hr4Q^oRAAtRVDNNIazB zI&Mn_E=Ir!3TUkxqDf#F#jN`R(PcRB(vb%uMh>dsJeOTZb(uX9mW_?XAqOhdLnjFW zWYm-r$5Lx2>!OZN#~5li-aDu|6s4`#oI@*yQ))#LBVzmWS9BZSK6b?VDkN>+Z<~Kb zwEeqOr#15$x}A4m=rdD8KZdzJbGdIn29+#A;px7~B0FFk2Hg!@Q=O&pjd$@-Ttf|( z2jrST*nFSOUliL=;OPO`W)L>tWy>JNHPownK&}~t&G#*ALUL5w1G3E^Y`$w@6MY@7 z8HCOEEo|bi!#0Dk`L2ZxJ(&9eRn&hVY`$+{gX8w}DYOsBH-ohKuBDCRd>ytK#Lagu zZU&6lSVTCKD;vv|b)Fb$c`}q2-e-AXGths3nIjw0YUUP@$p4NrNA5t2VvI$G%$Dn= zxxX_@@@#Tll=Ee>qVMnz(VqD&8ZnQjvUX2(tV^x&YMI@laoq))%;nj1DqDXmi|W0y zZV+vo)y1N~Pt*sh0zxspuZ~|?;(!|K>>`_2?eatgqJ?V0g6^T{fR|dwlN`P9vi!@R z|McfSq2-=<#F7Y3v_K&v$_CLRZ-vno?KjKEuc{u?Nsdl>vaC?{oG#uWy%Z#BbD%3C ztLD?Dsz%WldzvmqGwT#jFJ4c@mF*+LzLS zEDjZ=p>*9vxrd(3Mty1ZS|U*vGbcJ2sz(-?L`dDen9D;Q#0jK^r|Ey3!~^RhPsRL= z%Z0DlvuN}^&%jJyz(sX#6@!r7u1%v-u@*~!A1*gJakzX#qhB4MTsnC6gS?k7E9|x zYN=XU)Zt#`*=^f8));^Gkyy<0%)*fnlPffsEZeV(9_=?UDHd`|;L*_^efmX}>4HSj z99{Hf$0QwC`D!L-b17O?inUJhQ01D>($DNxwb}NuPtc3~vS`4LH@M1HXu00Mg1BUi zg@xO&HLB?rLZ!^{CVb-viGtTf1NY)b{-wRj3b}Gv4;x# zFbZAs!N@wD948=!5i<19^((>oz&PSaX1>)%=Q(y>j6;pYfx!vde}!?8D_6TiC&{5y z+DECE8wOs09P@v~NZ?s|tzOq3d9H&~o+2m08BRE8SU%9(!*}~{U!U)v-K6Pqgj1cI z|8!LLM$Kl6(QnQ{%Qt^_9zDX+R|yP~QrA@Nj1r_!p{bEDinM?9FmnPsN>sHOrvrYA z`5U?A8#TW9yUX7Qbo#$fW3=CT)2Uatv3{w-n9xPs>??nfhJiy#D}=kVM^7gI3d3FG1Q3lO}^9C z9(m4YUb~27*J^O6PhA?EouZ;%t@PyVW;{=S{z?8}ogP2k6RcN>RAKUsqVnHQ_o{yu zWvMUnY&CzU?SKQCnL#9DM*=d=ehYAzRI3U|tcz(HJAv(2wb3|J_q#i zKifqnbj12*s*;07`KXPv+OHZ%Zi!9{_5mu54$yyZfy;?np9SwC9yjmbQJ)3EZFkxg zB(JqNCs!(iT4#ykXfZa$_r04MzSE&F({)Xmp z-SK|G+gNSR*Y~~FrnOAqeX|Ps!iX!^lEvtUwG=z|8`-x?D;0lYgQ{Q1l`GYhFi{P9 zs9b+s7D*o#_ZwPV<3@!tZQrQW-x?IG)Ue{m;&SbZddz=X%^ELu!;PLe9|NbmMFCvtui9F>?p88m z8_)gma4`q2Bt0^T$197t=~ue7Y8*Co-~?t(M)pOER&pHoz)5OewxGt({-x`ZUM*jZ zb6^;S-)ZpJ-id?d*Id&${1<0z(+{}2aSm>?)tBL-HEpg9qAwU<7F^M=wP{l=wG@9f z*8)9tqVLJIFt?oRY+85kMrR47_UL?iHW$1p8Lud=s=MOU8LKceAdRKhuW>Y>n!i0| zhu!^F@bid^nkcD>8mT$T|FJz<08( zK{QQeHxmSy!FC)>gNJh*LUHH;YMjXwiSOwgIU*KOL7Ly@ESUf#2MRKQkVf+_0HVnE zAz@&&1Pc-;3GuZZFuDp%&s$$!T9as>UA~Gv-;k|z(!SSv* zXamQ4Fud|RoS2?~q*5$jv(d)MbUK-f1KaD>%jP}bX@70AQirANts9QQ1~`66n1o5( zXIf&{Z9IKniEh@6#3Oxc-LBNP8qLch&&FW8l4mVx%7?9Ms0N(&6KQDSXjskQt;Yge z*qP0b1`>(m*&&)HiHKF`i3oplC1|zL??PS&m6^^KV6gd%Q%c{Z3p5mXm0cRN@?i5< zJT=(-Q|Xp<_RFFc?9DhIUmzK#G+^r%Yu|M9!R9YKjKSs~Y<{?WRLgDe84Wgn(_0*D z{=w$2TjCo0sF~n{%`fn$CqJ*V`Kt(>jQQ;0FxTyIeqr;wIA+oganOGZyzr1g_}b=o zaMtKx^B2bbbGXK(PfJzDVDs+{IRCesLNwU?gUvtS{5y_@3^xB@^EX3hgUvtK{3?v9 zd7%^Mch}(jh>PtM=XX)ZQ$?LyY<_zbCpsNx!1)K8AJL{p4$ffn4>teVMLwA?jnRjC zw39?L*0miNa(kxY@aKOaw}(UY$Zj!6;)k21!R8-q{=w!?3oLZV?J*q2-qYsy*Vz0> z+HbS@Me-oZZ_4a`5fDI~WtHpCl6H!OEu7_TBbz@C0w+YO9q;<3VSabyI+5=rc3{Ve zZ?gm-o!cYMCqhkt8z-SC*$i3MI?Lzx>?HOgRPf>G8YC;R%uRoq&ySP8eK;hJ@1uAh zDUwCqyD{C0XY)IOpEz-V^x7!&QNSuQ!^|08x+!JmbAT}yM`%!#-ImutON+lf-K%xUXt>)4A1_|}3w?GM;XaFJiO09p1jaK(a)3DL(CXON(-5${X zCNW)4)j9e~ptKInC*lyrcKFkDgVx6=HUu1LhcR04;P_Xs(Bie{VO?_U5DjILAcS#& zl9A$Vc~2SizX*6wnW{@p{hO{XIbx>7Nw4Kevax)Tol)ATOAh+}v~D!4qbBYkibhd{j=LCEJv)USqbhV&^>F-AGAox{8y(DDUWJ~lKQzy0RYE3ewSMUE- zI%25H!m$22cb^~Ui+}G=QP-g2`nJY^wf1RpoIlPc;h_GB4sHIVRu{^wlK;hhGTY}t5F&dsV*f;*y-MW;{TVWSSXqC> z1=~YX9w_Xgu?M?FXN~s#2$muwaiZ~5r_u`ll!pBXDMZytXS{;C72 z?NvNk(ixp~(>(KhG`l$Ro)fM>D@SxZzL<}DZ;!Zm%>=X^oD)eUJA(4*9~AD5^gA9D zc{w`9^T`twF0!>fCmld3Q}7+kZ{AOlCVnybWxTpX>7k3uI`(;vI)tbz`B@g&uAK3i z_NdcEX&J20J9ECfv3iIjKW%@-tn>zzurHwa#(i+quvs7dnu>yH64an79BWkp;~dDC zXR8SbMo~=Y7M*c2)~+*!n~naz0_4?s_XeDY{ho1;y`D_xD^m!zEG3B+|5_H7BuBnh zl|xa&(srVCR1+nAQ}tNuYND!SD=#K$21{BlpRX=Tlfg%HXTdbXJ|cfkU=vECJR6{_ zqua=Ykeet)eYIGnuSVK;X4;oJHdHioth)R{0Iy3NAU~pxl5~FzE^g-UY7Rpew}9TCm_Q;qCUF z{oe34?)Q$ztD9?vMoXB9Yjd-htUmUhjAsyQ4Tz+j{A&-D*`eiBrRm4L$!xNkjHW%5 zTSrqLCjTBSHmTD7;c{|%iAGMRH)p6PznD+QkKRM2gc|avr{jMms=vcpflqsTZ+_T+ z^59|bY_uBn7U+GZi`~zslhes~`LH)%T#RPuo<64Wz?AW@cQKw{EJoMpgg#o$7o&@D zZ#q9!PvIphRKL0$_vY8SF#Q}zeB8TUjDMYsKlIMWqt(pmga!8U*k#6nY@P)e}WZV(W9wBS3`pL2^LV=fo)fF9oqRCX= zi8aO`c-T+S2tYat(Zo>{qzWNhQEC#2Q%z<3P~Ry3t|7Ja1uZ|e>tXb9ym&FbdXFjq zy`OZ(;BxK+L{Z6Ud@(b|U*%S%MrsFV-xEex8^Sif2jeeaAu{fYE+O>v%uKYF3i_9nF-z9Obq zX3c4pLx;|9l)%3nDRMZIs6aX!mg2xwA)j$CTg7|ft(d-VgK^C-xpT(rRP z1(N1y4AMfoS0IrfMU6oU`&akVD39e>?p(W92Px4x{!|S8*;}fAc+b6{P&@cx@&5-8 zAAN$_H^JOXIHD-cx1E2v!l|8qxy)nua(+A;UDq-E%lY4LCa1p~K%A?-EO^Wx=U+|) z>+ZB3>szl=#k*8=)JSma&hAXn(b9uF&Ajq@ILINIZ6dGN->A#$MDPkeN`ha-Rq-3k zOb1)ki_sDY3w`U2u>!K>YsF*-l4VtVHR-3se>rOwycNc}EDBL& zI2uH--)TPR6v_2?kPt7Y@vyURxu0u}tdSC`>9lEoGYNjT%+cA}j-A0bRSEnzr6+iE zczp8e&EcNq4DL`7F#U|hYBh4Iki_1-@_~B~yxmwn=S&uVFra#yMAtxp;>XdfD-bKS zejKksn>o6fu1-epk5}`8iy-R~9sJv^ z)`GU{8SY&1VXYG=(wD6GkmvNvRe5Z$jZkcIYaN9Bwjq*j_+WKeEp10#_26fyx*?D5 zVSjOYIU)UjLZv(Cm1dy*lh?iT`J(r6ezOn;7MNRR@8@Ldxfn zcpDbF56y*xhTy|61;$H~JWU3`mP4sW;YcnXQs{ku@skKOh`@AEkyNcA?Vw`+UQ9>% z?@Yt_P-`CAC{fyU)PcKu!rtRWU7t0$3oMl8V#!|$x+0@76EW=Wf{AU%;7ypA+}a3rRsdQl6_#qt3WXkJAOu;FsOXJl&D`^Ms6iHdfFd zKLUq;PA9WpDw{2|$NwBKb=$#ssVX)Bt11;UzmxlCXRyNQAkxd#>iVzWeK-1L)W2GO zcRHQloQ(jf`Qyho@A(`2tHa+`i_y{S968$Ir^3H^x{xO-s zair3Mo39GxNBxVV*{_r31OZL;ua4)7)&CfOf7HE}DuYURU|N%{g(@4dZYy4S+A&LD z1T7!<-AK?{-%zzyH6t$^fO=Q(JL=K#P!bnh%gCAw*$SR+y(yy0;EOhaB()rmg+yc@ zuD-GEk{^~&TtfPCKz(i9eTKj_D8ZN>dSmNu*3aTWf`W&rgFZkaa(-Sb#d8XeH#jbT zBssix5;!pMrz+Vcf`l{7vmj4W{38lQeibRZ43iXImBSdB+R_x6%o&Q}w%)KGL~))| zYw$iB1X{>xA+v<>5V_Uk7?KtexM#p$xNv`v;TLkj^_Y~y$Ct&e7QS|+s#e|6Z$~Np zsdTyPtimQqfa+xlH7NDgJ34@|0Sjz@PKx^Ub|)o3LXrUzxM3e61k40Q7WL!H@p#pz zQ~8bAmjJ2d@(79f(<~c=!d19DQq&sTqAb)?X027bRS4GFJ%AsT>gXZ$J`PiLP~uv1 zW^iGQ%-iqZ5v-CFGM~+g+V+3@zHk&^ zpVcZ7Y0IX4FH>y`EiYyxt*MZI#{h-GP*e<|hN!|p47cPgU{_!_Wr1P7SIFR748Z!d zXqSIl<`NVl;r`8P{%psE+(U+rcd|Z|78r(R_@<|DaU4W3DwOdRqVM?kFzWeWRR>mLmSZePjgA?4w`Cz<0+gM(Y(MN zA>t4CqNsfbgHBacFvSw^egFK{r4kAlb*l?dhP-~#>7XrG$Bwe)^RdM??JHVtqciPu zeDIugCE&vk#as1z0xfFsS_KdJNqSPgDWIz2!lFNGYC7bQ#>oW}D#%#tQH|8*OEuB( zd*-+lu94@mouc$KgPazBWoZ)UD2)XJl7(CitBW$q50GGu^91>r85!oS&<+#j;21tkGc*k=wE^dtyl7r;5tW`0DQ2RxFqn#Jy2Z)J9e7>sxo+ z)Q-H)7~k2sG_mpKcH+aCCK;XhAkoBz;#DU;{G}5gI`M(LIRhqtns?%ZQ0{(V;)A!2 z41{gS**gpNa~oWk-rGnILWA8244uHB;`zB0*=hA{GG24R5o&WIh%h0m)9Qcd!CAV~ z>chk!y+wqNgS|eTR)0DoO5|OnPOD$LSDjYBP^ySvvQDeNvX!BoRv+Xg_G|TrND#I| zSPr2$$>3TQ3}9M+rFaFob7IoKg`;s9rjqKHQX;k*U+^BhMB)6dgqGAo^4# z6a77EvENEF4AU%9ba#$7btgz|mG3m?o#woAys0_;b(-@pS#zGOf#{T{2Vq0x*bS%o z+quVw{X7ivEFA_J{L7Iuw+W&nh9X3`#Sj^M!&taKc53v0PL1BF(eLlvouyNwcWU&X z5Q<4UlTMAUV_!vRL7UXW4G|Wd8og7a&lguW+~U$X$Cr_({`kGlIsUu9rFD${or2?t zW!3+XF|CxhXm_9;;a~_rMq;LPkOZL&L@wbtQa2%QW`v@5(5r_TqH38ARcYRx8;KZH z_MAVuls(vgMUfg$2vSeWIvHIQX<73`-I01!`CYn&cR0Gk(H)L{eE%*YaXTE{;ph%W zqtH$lWQsyuf7v|9bWq393L+G#V21F6C~~Y)tZMJg_yRIpQO+(-%-4_a7hk9Z_PW@e z{#Iaamfb#tpG%eAKH~Yd0HAfeJZeG@n$n^s$Q^@!M5b99#z{(POc@leuyx+I8W3J>N41~RqLDOKea*&_wG^TpmO|`Rp!OJ{qnC6NZv&_KN%pK~6;~QO#2*1c(l=vPaX^86H~+TM?;PAz2^ zLgCugT$PlqnilEQQ7G`&$tg1Z&3j|ixixvzC$oz_%fMcYhT0xYmvgj^7a=RVH4imM+KB>)vR&q=LDN$?})pbo}dhO2eQsau_Q*Jf*6=xbpbtbx}08-}?tW zfs(gpI$1j=afWifs(@}$f7d+wkRDs09ZI1UAy%z^B$|`qAj`$vPuhw>c zevbOTqv`ac*|8;-6u;>eeAs*SV*k9`w7ykMU;?>Bk1BM+(C`HSdHRI~u=QvYG zEQ>C=TXY+1uI|)&n0;^aMvV^!K{`4ET9V9DXL`zmho~ngX{p8c03L?*L{U5Ddv#vV zR`&$rqR~XPTQ&X0CaZ=w_+AGw0=19=3we-{4pF;;T04U`*tQ4#OuZ2#e;F`eLIsp* z!Rzl>M*zStMlMnaPk1fRyVUfOnGcNJcqfgLIE&$jDqgw`Q+8ElpUxMGlYL92j+=`e z7mB4HMyJ1AAgB54OfmI)^`gfLp{o`{af7%9VVnH5&nM8jRy4j6HTi;UnQ*qvtAtN@1__; zb?f;#7%N;;;*3i2l5m#d#6^T^p=0RqkmbF|Ala~?TlYI; zEO+C6y+ia)H>-6^Ez{>K{lo9|GkmGx0jnruG>z7&F}&}pec(F|`@K&UPSvBw1Z zsYxX4K@NF3RTdQ$e_ErtsX_Qom36)ndZ|v8HP&(8ohqwXh?n!@+332^D>LHra{l)l zD4Y)#ql@ax4VZVc7Dh3nLc^n?F$7EF=CV4*t`k;*hPtm#mDNsf=0MzPOE%sy4-2a0EtGAL}+R0>&Zxf~DGs~@k^eGMT4e<V2~!W^@*-LWcf_a%nc zyA*xyC5A;be`nkCP;D)|NXEY%tJou@G6Sas4J*+cok zFExp+`}MOPZ^v~Qr{y?H2U4mMJ!A6r<4}CG;+I9oTuI{X$Ehl{7&zM$bKGt{KL>Dw z=O2pQKwZ&FRqA=xJK?&jH0b9UN{psPRf>Ebo*DZFf9dVGt}ETFW8WaX9Xqw9p5?Rm zczwrC@^L5X(ze&hsZ6ZjT`vK$*P#tuEtQM4f!0)qrukA`YTvrr8)BE8Gjvc5-&wxX z8G$Y~%%D0h4t44NN$=qB_48Lhzko|v@5SNCkFO5?!_-wKv3QNR1v{;F5Gd*@S3(lP z5*!W!e@P!k)M!A-e1c&TxO4f0VSkWkSqu?qFhmrw(4*P~Rz+cDjl>O$g3|!%tPnr-K^}-f40S$JnrITw zM!>#%2h*j}qzH4CKA+X@nh0E3|#3=?f0Hm9)8KAgjb5}YD=5Zrs)|xgO z2kzg1tW=|rt3Tq6s2;d>3}PQRCW{){0X#9PQI&oqF8}8hAqb*U6hXVf9-RER zcXBx<8Yz5Y(Sp>YV1Vc!e+AJ1|HTcfQx%6+WW(BTmP=54nvL$vC5ThFO{*;P#byF8 zS-}F0)tURS_JHz6?0^9CABV%NUsj{>f7q0<#`pHmt|qgJvpMe_c!1-07i5l8&Tg+i zrM-6TWsZZ`OhY-#>h|(e+RH}Xr8c>U(xr4k%@>tpg>G{{rOkC-)Do_$Z%vf6`sML` z4$`{4{FL^x@uK=bW(w)g*y;{G&PG?0QxiToU-ZKu1e$I#+qHSV*@72E11CaFfBV3N z6ttB>>O`tphzxaTSEAOupC$AMKysK3U|4ZIU4c)4)0{eni!=Pc(<~ce`eA^rPn!Vs}uNa4_=azriYR>d^u_#495c+KRSOt@LknDSqizbFoAV9Kc*Fm*}!4!8F=X-#%_o(~sHi+XDb_KCV5KdCae~5;qV(~&DV^oZI zhu=FY!+=YNP7s}n9S$K$f7i)M`I0^kcnJ#fVHQCHhKPfF;1n~-<3(nBt9fZLS(u&{ zBHCbZdaA}!6VX&T@*t6C)s7f}w0t!_b4}(A#UmheS)Hfm$8c=+7mN9a(ty_dsJi*; zVNGYa*lC(k-w3l_^;U~6%H=s(jAqL_-2R+$Xf587~|2fNNg4hqW zk@8byIl&KKFA8dXI$w-0X4t%+5Z~Llk9PR0?@45Xucy{CSAy2|*E`EYDciTspKjCooB0Zn{HFbXOjef#IQ1?av}8&pZr*EHX|8%fRu7?ECbb2U zcBo7QOrfUvl8Z>Pf4gp|h$M?Bg2kSB2Nb1-@csZQTrCfHk_O zigpz(KHYo%_QhU#<{v!xuNSNT4!Vh)Fy)8$Xcg6)_iBk^Rv#(c5!)z;MoB6HZ!ESs z+A@KRXvwXqQjb)|rAEgRcHYa`h}Y=O&L!)YlhTkF2a?j4XtUSK#k`f@Nu%MIsBm-Wi=r7qoZ+OU zAV2g`b<*Kj!rQD{PusL-@=94AQcaz44ZL4Fpbc=`G( zmD=TFYnx|Ef7#m#7gL8A3gg~JVr%XB&BfM1e+XO|4{~H^iF0@ax*(YlTVq%t5v3Mn zh_=;|hUHMh#8xbLq}(+U7efrKbDh-sC zGz`-y53}42h3BW`6mgCQK^)|eT2a<9&%#1Fv?i(0f1&24!+wl0hEWvaC1k7CldMU3 zQKOV6zpz<{pzvsvA)|fb zyj_s>fB0FAkt7{H5jfi@hXlK#>-yrA>Q0gvDjhT%UJ;^eM51dBJrzzy6eM}WJC^7g zWU9Q5`OEuKLG_`#gXo$M>HZCH_?$vAae_{C?L=3T!jmC(63`U3?L=3LV|`Mhs}X>p z%6&TdZH)XAXJaJ{s3dJ%uG>_wbx=_z8)zy6e;zOCCUnj0AuiiGn)6AwwU*r!`3}Wf zCI(mspoIJ`+0+4q*)D91^NV%1@LQyub2b6>Hh>iSw7wG$sy{qy%0OtU-$-aEe{=XR*%(py8I}ATdVKAS>hfi(SU7^R;XMRzC%88b ze}_pf5*rG(JxG!OGDi|-00=-A{FF;xjdaiyM3kXMVm3@*;-XWoy0nYYOB)Zt0kTR3 zd5D@Wk%rfL4EBqazDy`Oo+4X<#+|i~3rxUA{bszJ{Cf-=f+iQ@6%{$EcHyVdVxlB8 zMN=Z)z^nKFB8$KJLLEo7=O}(7_8#*nf5f!I->yfqv(fu0(tlE7EV#2FMP#FKvBl#| zNUJ%%!bIdaJ?UVv*Fvka2u_T6RZ>-CE@x@B;x5i# zyK&AHV@hr7f;rDx$@Rr9-$JSFf71O~Oy8sD)oPSYw7XW@3{dz?hf>Mij8EJe@A~t; z1=})ZSODgSFdG=qhwvp1-Js2!aNkx7Y*YCufL~Z4pe3P@gx!726cK`63Px>QNT}VA ze9ow4iaqgmT#u${dA?Q0xJe*R5h^WXfyl`kj?0`Bc)PAEYT?QPolg$`e~uKn_uz8v zBw)8*Z0@A9&0??LWe>P4^A3Fd70+B=0Zu3A0MTgnH055yVC)+a?KXcj!if3hJg3}Sl);o#OC7rhFBMBvsp$RUxF0<)0SC$n-gclU+!kKTshEs+o4^#*(1zTAFiVi*e`6iSnz_Y*kXZ!J zwhV6tFxfkvZJZmXkPKki0bw4%fohNxQ^TAwqX5b2A?FQZ%o!#U`W}HjDB_vKZKulj z*cnwk%#n66&tQ>)!(1%5jMl5!7*4VCu?L%8 zDDJ~=CZ56;2$xK9^@GQ$+dIGT;#8WE;}KJ>1Pqahr!Yrs$38=oSSfEdFg~ioF3Wqv%q&lHy9ZjzjZI$ruco z55%7Ql=T#7Y6Dy>wg_w-t2e?{|?;f1Wx~8Cq>+VMFKn%N2EQ%8ln_5E1>I} z3vJp$mZeHsAFV{ zrucGc3{}av#zf+Y$|(&dip6l1<~ ze@o5L)y1px^W}I|kaB(St}cpc@JW=97V|KVnvq-2I<`wUDwO+Zbp5^*J%|@k4eRLA0_{kTL+W8l(QHyr| z1*j3tRA~a#+RhvfRBL^meWVd~c29elchEr)uX~(76^o zzF(4Nj}wJBSi;2KxfVRWU#N5YP~3N}1)Xbwxlo;Jfe@Y#8=cEK*MiQqpmQzgTnjqa z0%QcULh_)}EmY>EcYROGf4;~WK#n0zD)SbPdsXJ#mR1^E;DAu~PB3cfw%!Tw1w=y4 z433D1|uz{ayYwv_=G;O^T;I)N3EAWcb&J0Rkc8v!!kD!Ew zBM^MvJSuf#`L0n}=Cazjluo`T9tuq_B)9l;N^?miv3Oep~~{HjlrbPX6c3xH18@ zc;}eXj6EHluI7ujllWnJ)B4%t%lQY@t_VLSU4%*N_qioAi$pua;1srLM60MAggo994DBJ(Wy##4)EgYDR^x?EEh#ul z%e1i6#*?D3bTbW5PtB+EMH_NQb|cD3>!Ef`o!L5ax#2)=e{>YfOeHvmg;SWtYgveL z8%A525VZllXiO`;oZ4Gv7SV;R92FpW?V|EndbqyOv9S&sgJ_%PuBj8n*4J^3m|CH6 zw)^79Nm3UdT$ps#F-(ziLt zRVofgSPZDV(;Fk+&tK)*Ay!8w0i?J=1vpe5gklhY)v0GO*ajJhkeLIiF@U)M ze=3{7E$7=D+m9#) zaU|ddYkKR6Hm@!RfM&^%jJi6I);^i#e{Ehe{KM(wOw!IM#0^tR94D`B5*2$8I5#!2N_Dge=?B&CAA`f9( z(UKo6S9&VGYM6t2_~jD&=GuI?oXMh)1<24Sbw-@)R(6cYP^3yq5G8=LGN|>#fA@C% zSwzYqQz_@2 zlthOZLs16EvM)9sF3huFJ#;)N9}O~3QFT3)s|Mko)wxw)B0+sQFW+p%@e-Z7_|XQPe(s>? zpn@taMQb~iCRllx#7yN8=DeW<8OXX+(mbTdaZR@QT=Er%k_>v1@>Ei}T;zAu)-}>S zZK2HwIeRc8_F*y47C|eambPLi5_7?h}D~{%K0F$dA4ccNQ;M@iIrDRskgKj6uI!=-)(->W1B8% z#7ji%dZv1TorZj=I;TOjjMGD2Lb4?jg@F62>#~|XK%P1SbL$+(v-b|^hpL@$Gr70h z+cEf*Fs8XUL{TtRiLR1tbA+LV}KIXPg`0e$fJwMU_aG7ZUH&$^JIEPo)slzE2ke+vy#y$csyJ4@xfcBE1+bf8i3SG?b6;bC!6w zntNoOtmJk#%MyBgxHEG2AfTLKAhsSK^_D7wg46mWmHGi{pc<(b6eo4RvQDetIm=r@ zOlKDuUy(0&J+FLc7r1O%8Y0uii>J}iole%;hkh4tcp7f!3G=0U!ca7hRqGD&gvSe& z%WsU|A`>%HN~ccTf5^<{0m>?A{7)*b%~s0wWn*u}8(T4~MpXybE0rzz7_6-~bPD!hf62|^F2YX7kcQy5R6fZ? zIylsTQmWKoC#clrdY(fKu9ib6l@m8uNCRfTQr1Uh3Re#n(qIAZD6i$N;bn>Xg%3qx z!*(l9yP%gY=*4yVO0m5|8m{H(kOs>RPwYli3H~CZw!cWEu`a`A8`fCD18I34H2V+= z3zie$FlQ=Me-ewGEV=BLoO0H2<7N}q0Oc2Rl;2Z-D-%}b4FCtU@=G%Dq8_^T6?m|r z6`aE?t>tl{4@i52H9~-X>Hz zfDZ-Mi3&IJtsu*4jB;K2EBc%4i)s%y-6f~pi`i^#e{d)kfP;2!qcYolH&==G$~AR& z)ax3<9js9ve9zq$1ipu1yjo@Vfn@j|-dxQCNA&1KC!p0^{ zSpwS#e{jbEdj;-zQ%GLwB3sSi4v8O889YKb`ykB_YfP?iz;y)VB6!`C8xDNzC<^&u z*ap;z@j9`$Z|Vj_l#^?N2O1}bNuWq+h+t~e@l1-ad;+avYDI*~#*=d*d^ujHX||l3 zScr``PRuMcQ8t9n#W#TDTWlPcA`G7Oo>{YTe~o*An0B`6biCNXQ>TkIW;hrk0}@;o zQ7tDV=fswS=UCk3w&xwYzHe*rHE^W|U-OH}@b#x?sc#{%Tl({DEcGG=%nkfIh}}VK z7q99db_cO17niFdt0Q!fRmws9E9a#UJN-F|I6e6yAvS0Eoc)$?rHvO`iN$;dUxCMY zf43aomM!^I;;oQI>O~s7PlhxQASv&1h* zy5piWCA*5bTfKB&Z^RfbXw!ljmwlqje|M3tTID(rxS+994l+tSWg=AzfFoKm>Yv+n z>(r=i(kB}w(~~W%eV0|aXM;-Yo$DpB8O+{PV%_Pk_R46uy&nD zcb-NNe6j@26@xG)B{>}@YyHT~e=*4N0CG``3?i)!0bIgG?APDEHzO)f7jqGV+?jeW zl5eV>C3X>Inc4@rUL0XQ<<@e)7E~>8-hk$#2$d6VE((0$hLTegTkRw%oz&tiNrPdK zL{X};LH7|Z$JShJ%*F@R#Tk4v7mFzN&Pnch$|DdYzJ|>$Icd13C39k0f9;0oR?-+J z6%ScbDG&@kgId40xo7>fJOUunbP62XOZN`x#SqPi>!=Qc^R#Sw3Y-~rHi3PfiHr5- z2gaG)W~ZI5v9Upa%xYzJ!OqWaAbJ{%=rYc zo78-XTqDEWbv`Z4S5{^1f6Neg>%?G|3!9ilCR1seS#+AOPV?nDeVyj3(|mQBuTJwd zpHX6TnOcrA`E8S04nAluQeyyM81sa}iFmddkGNzHo?CdhCfR1|UIprON_QdG9VD4o zs4KOf}qh5`yfQsx}#TD7nj!f7uae?}+)9j9sDUUwj- z${|&`Rb|Fj6&bLh;1nR+E3(=ZW7ER|My6>%Z&=QvwJ<7%>l6w%+8HW(#}sF-Bipz$ zm;*|N2S@>i^u;;EZ?hHFoZ-cmrbA@*%b^m;Tc^_%Gj$7r;#|3Hw$(23M1)R6**MWY zJU-bW#Jp=0BC!WTe|5FjRHX)Gk)kw5T6TC_4!071*Ga6Asx|-g@qH_YSc_RVQkiwK z?Yce@f5LJtryd0*m$h7yZGgmtRf62WPh__1)~zkvs9za6C$%t*i!8K-r5=d~;U&4- zOVDhs6|&d1U#|Asu3wa4s#5#Ma8Tt$LrhrQ;LyoN@|e{ve?VSx-j)&Dn(t*rSV8nD zad&`>NO=Su6>5tj^Qa+6X@Y3U;SjoJL~s%T+QN(0sreI`C@q%nSqc~34%ds-<<@(* zVEwY?nn!B3TDrKCr?g}J9&DIJT}QY>yo!s1ObE{hb}a98wc zsl6v#Y(HNU7f}ntB3X$}hU~Y_Zr81gqHWZz)X5J8^=q6g$Eb#a%QWR{)_AL4oh0k- zch*TvcHC`s+)bh&{a>UeZ2y7MA@z<99^Z%M11$07f9Pub_VN9LkF(L$pUuXn ztN8*&PAEsu(ela7ay7py9)sC|{?+dJ$M^BLLofXJK9xmeGGeI|P9bch;CvxsNECZ? z-NDisG9=`Rx-STWLdpTywp>qF8sV@{I$E$|C~EO^;T!Pm?f#pCy~EkryGK8aFDA2h z54fAMe^3w?>5TOoWXn5vE*_T3VIT$!3lbHii3}wlT!WLk;f4x@dRWS-I_(FT0W1~> ziOL{8YAev|{Wp8BU!Lq8UyjGCK72OQZ=UFFoXls-{=4L1!#6)C55xpiPnyxV*LG(; z(R!;H4f+`>#N;T5L68S!Gu1NH`ibO>!fHnHf195}IV1G5(R^fU?^^d`YwSaQh_I|D zi^;`BQ7=+Y@t^OWp1e7F_U!Nt-?zhG$FtSDr!VGbVq-9kb}dBTG_-K?+p4@}5QlT5 z2h9^?|3qepVeDje`VGB$kQv>%yzx+V!O$+MISfdU41i!!ddqd@@rt-rl*j;qim-O$ ze? z7Hc+}KiwuVD9-?}zIFa|o7V3%TQ@`hV0^2^d|D{Op(Q^VgYwOnlNER&gB%8s)+ixM z1Hfq?`}iHOl3M$AboA%y@dhIL4ujSWa@yw+ah|Mk=&cfydCr<47Z9ddT|`wNf05{d zr+X=3wJ6^G?--_yzX+xMr}y`y)J?+5tq z#pHA`U(U~0y`$OcW;Xu%s{#$<=zRUv`Fzov&)&~R3nI$B(d?}E^;e6@@|WIdxg0N- zSK!=VfA#%$x>*Cr1>6Qe)o}RPe`0=feZNOn^mz4g3Or4$5?Sx7->8}Lx5|~PWa25% zEVyP6L$iv)e5gLkj%W#y^FBNjAaVm7L(K#n%AXRPo6aU{L9l2jhEekd@!erQpmbjR zL7OiF@v2j-8vhG?Z0Zl2eS;1xg>EN8e$otv6Afl{$M%aAiJ^@u9owExe<#<)O}0NS zI^iF`8830@fvq&36fOPzW^($ATJN7mi^)h)iyo}aVy>^=|BLod-BnffTkWo$89pzC zs^_EY)%+SV)z$S4im~*8Z?Vr!BGvk*n*}OV2;xG1c}kFeZHUUW$uLjRH;S{Uy)oiI zlzmffldASdsE{(X^HnR)e-b1f*M_mi+G>wHgMnuHIj>=63gcISb#3OW7m2k{U3q?ppya1 zhr-E86iml(q#kAnQ-YZt#^nt&s(oHSAAA}Ge$&Uu)$Q0o~gtdStAD#SUM_L^M}2=>{5-l zIs57o*SLS{gWpVnlaBiS4=9ug+C!^U@h=dK#dG71RLXO!< zD8AA#BJDMJS_H7n5dn%W`l0kJw>@qXu(hd-K{r2 zR7}Lg^^ZF)pbvi?hMg0!xUxM zhw}KFeK+KRiZ5V&k+CgLKt;v!nrAneD7>R+rs|kdf08Q|y_4mrU_NoZ8t=t?U9^Gh2N}GV;y3|0M8-GYk+NhpC!}qjGD(T?|7Y)9m)tgzJ^w1)nTVA% zA#-@YoV6xG*2SX;>#|aN?D=$p>PD-%rpR8BZCmqcU*o*qd6NBQ0R?0N1rWT+vIi|& z7ZO0Bf2y*w{+0R9OnwPS@8vt=xI>&Y2H<6Eu5|N2_F700F?a(2ZjaN)M1BQd+|TQA z0^Fsr78si5`kXvds+%C%F-~tbAAI97e|V$f2|s8mLoUI+dReI*c8hPZJM5}@p;lh7 z_eu>B8^k<8pH%CWelKd1gOLgZ$4q_Lp82bl_c3_DKVuaEk;Ptie zz|Te6x!PF5G+Tlt&fRQiUq26WGQACLuP1IcGcc=Du0@l3kdi31IKt@KABsn{B)3v3 z0X>X;81Up!&>eL!2`lKiADTqFh*KW8e*sy77)t%5g5Xs(>n|?Xc>~heW5kAgjP{3o z+{PS?s3!_ z5j1^fjvssSuOsmJE`iG+0VZ8fMBC?4yAG zVWqSm*KztInKd|Y0$fDei(Qf_f3I=b-cud|r+r?7&AQv^P5UI22rk`p%8wIvCK4kW zM;qE2$oehmIbJ%9Xar|q{BmoeAQ^l2JcLq_Ue-4RbnsojgmRPi9Ef>@h8sd|6(XFR z*heD92sAM&Uf5l*iJSBq*X`Z+5WGFvhPr#9OW&b1L1`QhUDuuSG$Z?Ce=%SwpltBa z$!RmN@zv?F0XX7~_iyGcQYY)O!4Rg|paJ=`(4_{h5-eLY1`-(@^tyywP|1o7#y}-M ze(4h6G&=482{@7>%{KFZ856U=hLClKkR!G`j!2N*FhT5Ux7<4DU$T6MCFv7B*0BV4 zVdz7?uoq`mI-blS6}>-3e*#4%DdRvLsWV*-!Kl5uN_Y;LmN;;tl(8=bF;_)T^L;_L zc?+B~T2*|%cV9!W34gXL)lO0om6|)|42i85hiflUntA`C; zZJ=`&Ja+hl&_W0%;gRnX{lr0-St{XO`ek!eKZ!6SND*w+p?l8Af1Gqf=94l5eJaSZ zS@sx6WS0%)us((mkx>mhcE{u77BP@uPnIB7qe3S!GEkrmcR#tarH^W&>jakJURTVTxnFkfD+e%Z9T_=aA* ze)q8Tads(x2s!TYfAVU*nqO5@;`(^|lF*VjH>+hN6sd}+ld@|niBVc%D?SZjx}r8v zW0EtB07<8_6?@2&kudqOJ8?3`=hP{sM#aj6kO2IZfG8D#)gTt9X4uPlx zV588}<2@wsJ|x>43Z%nRAqQ2(X)xrd9$a^D1}8||Wo+@Ke=jG*AA&Ey2_zgfd^b(_ z0iN0c8^ztt?Oc{EMT{gT8Btv96>!T!+hRU+!V&8{x>2Ma=a0liyeGvz&mbbi{rcLy zhjKBWi9vMri)KF+X)u9a)}_rmQdFIbg?*m9MZL>sw~^eF5*^E5JEcgyzP{c>+xWOq z`|=nj)Vciqe`5ZB@1l$XTH~H~m$OCmd?tZxC9Z!z_Gu@+S={ZqR<;?>Y}!qc*H_nh zd6CrmPuExP`*cnEGW4w~o>%#(*Cc)U5sz7l{%~4LtK^A|cop?eNUd;-QLZqP^iRnx zR)dc89btDQ&E&MCelhubNlQ6JS))e~~>FHIrN)p#vMq^tLE z9S^a4dq{&L;{7?2eA^+!#=uDe5l%Wd%Q5;^o*$i02KtNO0FFP#H&fYi$RNSl184$+ zMH-%re}X&o(OnLk2WofO%?(Z_95ek1E^nd*Y?+kGUTgTbm(mG#I|pJaO!aPd9Q^<}`HIL>& z=AA-EbvYT3sFuS6aWbHOJxuwzsXY?<^+PB1eHxWCsCA~%^fYu(uNt#_Pisq|?rHFx ze%e-pyOPxgdk_Gye?h6CqN@b(AlyNFpf3$#io1-$ zwBx=+xnrNxE3tHdgKB24X|3C;>1#+Qp(7b$%O$)p-Xknx$w`9s9!A-Tnl*A4 zTG?1_aI_D>nDAU!+-BkA6+7CFH>3)k7<*t<8zD8T%(NR?+xztwx;|l$Bfv0+02|U~ zn$_Afw7B=0+q#XKzJ}H|NjHeS0VI=Q5Uxn&>E*y74z2CIItwp!e?bnd?Gv|Je`9Tn zSl3>q1x1ixy*U-u*g?$( zm-ar*5+~*;FzoQ8$)#>V8ADMovCzWC1YUcH4{9{HuJ>q^_=yANHMp)%+iE82;?BW) z;8PV8l8HIfXp$;S{M06umrPKSf1f~R5!+?r;XnO|KHpo{i8O>ypltb^;O2#4dd72@}NYAU)yXEXQbiK=O@pL`= zkbRkKW^bd#j#7zQY?HG=f7a9NDe|g5nxVKqnN?ZyDaGw3@D%rv*(m9eewV=ZQS8yq zrv&zc;#1sYLDMuC9Ol2V5YCTtCh4)!AR8{CBE7LBY|1^yP#qQ1@S|an0iP~e=(N!m<9heW{*?|wCtHD*PY#7%0RIa1C&B)7MruTwMBa3n|711)2^_g==1U`jah` z@KUs@L>1TqC^663jN{Bv}}0@(EG}4)=l#j-8guh64(wjdg{* zpU_4Kr5Mo@J$(6wy8;zBkxPMt5t04++RBClI;jo)P$I=3cykOi2K7R-9T6+&Wu$?W zsJ7b8hCnKzNf4cd+zkX9TX$H#VM#j~^Cd;Q;Kr)ma_Iaie_|!sUt#i4X(P<1O!ga+ zHW1w_+116az<(76y!?6!9zu!0B!r%r98z=aFs1N{TnY12$lkU>K;;~VtmGuW1VAHP zoG{6gTP@Zufrx~n!U84+b`QBWwsJp&bQytxJS}ml7;}nq7sNhKj)7Gz5){9=kWC>T zs$dI6bXD`Te~tvA9CSbO0*mrxRk^K1e$$tlxqG%CAK7*e_vG>VvK$J590@XFkybZ~ zm}ZTJlIw_Ug6!pgglQ+KpM$qNb+?e_38`i0k@z5S z1?Z>m?t4fjBfBnZvwo6)PcLLbm-8Va{LPHGzc%eVf9s0m2z9y-0p9nWKk3VPdmq{t zq{^sg3g!?@+Ic+k*(6yNmG8W$o_bwpJI|y^9(vxshqfj>yu^N0Yb!F_)b2c+C21UF z6_xhI3qD;>1MCo}vkQK3ixl2}<&sAcS@|qx0rFDMeoK&V&AwxeNCoQreGhHY5=blu zfPilDe_{_yRO_bTwZ8X=GCNu=!6$xHqWqE{jymPSqEsHWgOVR^$Yx=;#tXp&mYzhT z=m+_A>^t8ft|C)-QyaSNFHU<8O{i|~31C*wJ#*(nSOq__!3e%HY0t?*?q`QTEp@|R z?0ZheABhcTD0i-SD93>6^haWuOYb?w#2c{mf1}@TQTDNh%4Ep*DIEatV75G+ZYo~v z2LSarsM&u2uIfMTg_=75V9^g|umELqmaAU*Kn(q+)gk~hfum$C2_U*k4Xj}9^GZPI z8~d8l(f1^#w)>k?Fk8-Z-RiE<+5V|lIbJWl;~hIMW%vw4|E9ULMA<} z=EJPuk~>vMaw`0gVpV@6d&%+A9~kTq#>KiI<`))RHiCW`d$A_gPmi~`cK2w9pyf$7 zS^SnxUP{L-9cQ*8B{otNuk@Z{ggOK$e>o<=hO8EA*($R4v&E)%kMrk1a#SK=o36E+ zL3mJ|nVxB=LkJEZEtUu)rFn_&Vjsw0rZqe69_b)-I{AsAQ}et4Nhwnv(v`EwbPz0I zhr&Q#J=8$|Or|Y4yv9g}_QX>gWH4h_0uHY}B+X*h6*2PE8R<%Rnn9G1(=A#rf1@2G z8sw}}Mstv3Oh$8%3wM-g=u>HzC=EaY1A^%_96L&-Es;#+@zQRyF4&kvK$wJBV=!XX zWyXWXbtFF|$`WF#WY^ahS`QjFdi74;{Zxb8z>P5LDG&_nR$>KWKgDmvZpcTC=3RzA zJ>J|B1r!@G&0yg5vjv`dIX`~>e`@0++%tc@_!uooLQUXz(e?J_Y)#R*__*j6Ky2ss z3ij>%!_BU1E>^etDbz;A(64^tbDw?gH>)j0{q${t#{UtmV`KJW{=vVZdVN_8I=&ST z>Tq@yONAn6#Oa%-orhSrYzAj}fJ*L9z}0x~(A+>~fAvw8)?YhqceoRmS! zj}Z=kwS2$KQ3?VSv5%poCuG1RX;W+lh^0u%kdQ!;+zOJo&}^{De`HI-vD(|#mpLZI zL%o}MES#8)@c_Xg@pOfFRNTaqJ4doIVtbz0tPa1!feC7*qQlqkn!hET&iQ~hC{|Ip zyVrar{yJo)ysa<~92K}umX1~i9+L+aO9slrQ13}%>$bYg^((tI)%m*7*d~CQ&tq5h zu3p<`>NS&v0>=OPe>N-THrSDPX5fK-Qj6{7Y(t4I3bAoc4AJ2R?V-e`p>848P~5>F z?34}%n0KVPtR%70xNZ=V(ZUT3T?M}o7636*=y8erT;oCu>`{&o26`l_;Rrxd7q=DU ze9Sqza-BP7pQ824=;Qln?cT_crfn*RIxmpVf8tSW8pr)fk z8$-J{XoEyUtj;)T+0ym=4&)n#9+tf&xmNW{RyG{MK^)uT(jyKyCpaj#z)pl6`sVfo>cSV8gM6KX5=#rSNQ^f+!f+YR*M+Ht~D$FSVlU+h1H zbJ%yY<%bvXW)&^J`u<(Ly(lRJ>Vjx;B_jLiIb&stHy?NDqkG!GpR%#5C&7tXmN-z72ifADju^re@OA8^0i$cag^eA&v0 zuH`7EuQe+~2POp9_&$y1F@&0d(ndq;n^R(k%-k_<7~=)juV3hD-BwM&YDg0h|3#J^ zvRlSK1bC?q6q+RiK9*&GjnlkSeQjxHLms-lS|tEkK`JUmls0R6tCz4Bk&cvano>O} z{%>5af0E6kG#E{+8qi1UK1z#Q$e{&Ae9E>WI+p)zF|E>34LON;5ZMGI_bo&_f2b+h zo7ld{Ff(CSf|^fs0eQ&l4QtR*M9L&e;UwGfs22c{KyJU=n95qNJ#c0Yg3cO-E%OtR zPC<7eFT4<@;r>DKa{m!np)W2S=Wb9z?9(jej>xJk>VHf0SlwnrDnb%dsW~$fR_HCn zBb7Kz$PSq^yu7y|6|vVKAJ%M0N9@xqg-a-vBU)GKzN%^E?VVGgd zkMUuxhLi~`TFkG0>F$8D*qk5~`h{*}-t^TjpOEG$9DtRK`q+KY)DU? ze^b|Soqy@f?z5}!gc2F%^`YA)Qk%6IgG*!CNWi6*fMdXAjLYL~BTU#c;F9!3#9U)r z5!p7IsGn<#Ez^^o+wOzfCWkHArn4=`=vUuD&h`PWlam}fki3;RcMBy~^G?Rnn(vY- zupH29@mFImQSAse$?Tv$OXyPQ6%?W;2t_BP?0=ip=R2uKU2=<4BGau_sB{K!`0LHE z0|I;5Pe1YS=JrxM?xqu*PR$X`H)2OV*NmtRWku z>VJjr$f3{*)2s8U4iuU_NQSh^I8&=Tb`g|xxkl4FtI}xf(_|9&N;OQ*QwmM$k>It9 zPYgNZm>)*1&vNR?8nyflR-xfDoKjIV(SgB@C#TQsf~ljTsIy%<2-X0# zSNySYEEc(J|1W>5kPvDZy4(3WBkV6y(hj&R>lZRihN+H-S z2CK846o37Z8lg%Z`zDT7308?%F-;pe6yfalFx%#XIxJnB_S*2PdY^JYIoEb#E$4)`5}B5mzigHcKi^8u zAynfR@-_nrP0MtTzg&ws9%pJaCZ{J1I-%>$zL(pGL)TjwmsE>5x4ji0_(m4RL#`(; zZMu0I{ptH~zHQHJDOhwvJ@g`8F@G54ie7Je{y{k#r)jkONx_ZGSiY$;uixK1O78+8 zR8BgEj7ES}SU<>5gMWW(`L5e)5W!Ob)m4Rbxvxy4rEeeFI>~kKZAlKI>9;R^P-ru( zdQf2)SV;J5;=Lcrv_XZYRdfCbLh_3D&o_IR^k}5*4+3@6fuHlb!ms7b?0@FIQJ7>3 zN}p)SnO3!KJx{Bd>Myk<$V=4p4|Y3ba&YcG=l9dHo1c5aF>$eZ!!BEezSxMI9ucjB zvH?-TOFc^Sq|-F371m+Rl3!<-ctT}pYIQcK-1ZpZL)r|gwmsTBXjX%I@T85_5OWc& zx?;Z14l^csa%!X`mZ{d%hkxZZ;$u3k*( zstyYJK4W}Pt3grUr`3aoI4J9OqYjE9eJ}@3C^eyU`kAE{f$GVs5a$%}jGfF@Ha#)#JsSloT0J zqu#mZSbYw$V(&JO7V<+z_h=#C*=P+Rm!6+P$TOAKh ztY@z;kvHx)85n#Xhb9BVpJai$R0&N6h9(1pH`ftepSUG-w12Cp`Phl8KW#EF+%p*| zKHn&XEL5ZyXfiNFi-mBtVoO$&fgwm+^Gm(Sz(53ME_Ih8vBX%b?+CT!J1h}Nu zB)`2v-x=g5U4IPMkf#dv4JAX&RSo8k_1oKMGyhlga&;Bhl^e|ewbyV>*0mVm|LMU) zm;J2Cx+dVD$-4H);?@T9H(A$qB@1n`uH6d*yWefaw zDW)Rl`+vWsj_$^+-PKNp6=upXNSJlL6n^e<^3~vgkG?>4^{0-)R_U-qN z-#)$HVEzX4H<-V{{7nJHhQ7c2oAzWDv(9>QYlHb4%s<{?=TFNFxVYVWtz#l|hwbrz zGTal&?es~gM55RbeILv}8dL3s0y@1hDKUHcs(%LaH<-V{{0-)Bil#S3(_MW``OWMj zF%hz{^Z%tOn%)#mkL!~+cK#SNHQb(<(^-l6sjpQ*-zQ;@%E}|@d!k>rX~v$+odi)o zj-Vg6se?G`P@Is2rh`6(=R%mDt47pLq>RLXT=NtQ)mLShf6yKg)JsPFArZh76*cYv zlYgdXD3?*lorL|p5p`Si^K_b?UK=_Q>79FHGM|zzJkB8HTFl2^+ax{Q(5ILUEzq?j zU1B)A=jZ? zqVi+qOm}_$Q_NjuZuI5MfX-_ap|{Pk2jlWvuVw4Z^03>?R>Rt zU9LXf^0)W%#eDne>&x3j=WlI%_??c+;AF0K;rr*Q<4Fxmtep z!+d$gvszct&-2TO+h)tF*7hdijiO)Yn{Bkbj9RPfmivdi1W&qM&6itRy1ZNSwyn)- zaVMSFv|CjsZs2YOmHiO7OMNA($y05a5_Y9vPCBg*cXY+2u`Ze%<=Cx@%pnmjC_#{%hO1nf)APK=tEn z3D*4x+I5)rD!N^)KDmExSF6RQbve78aUvIRn*eKpwy~g}2NB^Qd{nbiXl%dbx z-K>5Ie!iUDhCct_cewnXu4f;zFYDD4I?R}uJX_x0o0dc7-*jg_Cl0RJ2mm;T0?rG7 z4{hvo1K?h}^=7@oRtj*%wmREva55^K=|L^u8AC0$;eTkk0cKi+%xChb?agfK5VZrt zz{%M*QV%sxl4g@u(uV?;H?8+kv}}Q;<>jtg_cu}0y2VR{E&0RU{A%V*ziR;P66^|! zZe@3GZllZjY=MFJf$r6ucUrXo@oND2rgb|Lzv^5p+o0w7(!KEQe6f;OUyBQ@_4r@X zo5z>iIe*xltVSFPR_jkYfbsamz}O($6cP{Hn2pEdDTeE5Z#10_H2&52c+?R?w0Vey z$KAmY^g8ZOhW+VeYK+Sk9%IWM?}d(sB^-u@xhIKZfx9bw_aRf6`fyyYQ?xv zup`t65bNz?wuPneabxlC++Qywg}~J@G8VJ&FEdQPz|jnaMizs*R@M>UJLB|x?O715 z_n+W7fU}*E_a^!jo0c)zLgb9Lf{2#@)%njte+a^6p;rK`fBn?@{_S_02jx5s+7T-> z=zlxM#NZxzzZi1!{pvPa$2fZP30lU-O=}n1Vp5Kh;T_9?Ii(ZtBo`YtQHqee-8STg z&P0L@JA>ZHK;R4^7h^xwR%DQJp>C48P$OlREVY;AG$Bc$K4)8+M0{gHf!Zs}>e&ev zP5qyAb1Cq4;eG2Lq`AQL{bse@u0CppaDU*U9b^Yt2hUgQC}l}g&1!bV3DXjjg=^h; zIPE;_b*o7y-TrudT_EzFh-9ri&8H$BU%Q`BclGJX(8^P4C<{CH6Bz&95UYam`DTX6 zZ9QvhetH;+iNupRm2OPw>4y2+)cmxylRn=l6>YUFm8Rxrs_bKGbdwysNe-S;-+wJ; zdmOu2{_Sgi_Ny)7W7t-&W*;Mv(c?9o@K(3=RqOrYE^7BC{=1T|On$+aGmaGNNB8<2 zBK-ofg%e=&s6U-TjqXj!6%reoUo3C5Njy6iblT&|00J}dfRLq!a@u%wFL$**9#CPl z11E%t#8ICxLZDvpdJF$4pFE`W=zq8`&!<#r=njS6+hjMPn(3H>3aPsiQg!ZyzKMu4 zixm?=k{JBE0|E~_9ReXq&B6=4dHnYN8^Z41-9*t=5~=t8M^*q~)BbVru;iP64s6Jl zYboBvyE0UCJ*%L4(w3erui_p}NbfkDOa`4{Z#bTk=P}SDM5b$d)K7X;_&4SY_eAtkjrl#MCef40Cy(x_4`S{3Ej~)v z0GW0i>d++gonKsLnzSBtYdc%q8nXYoO)mrp^+Zonb0My$JP>|g8WzUaqi%1cb?wEk zTdhF3vm?3?QI#0$SRKX@$xko-e*fYolEq;TaXi7QRO&a=KEHK(B!7)cn07fG88|GD zM#a-^d|2*wdJ>v!HHADOTcm&PUruJl`@h`N@^C7@+~laJW$klJ!gTw&exG}76=KdF zUwxb}GxXrrz$UjA*aZTD?k;_FZ=`@gGw)yOya(qMz!iXZ$-Iu6d0j15Yq!1r`HNl8 ze(#F^Wa0V`+${Rd41YymzJMpqME?#ZI=F!I%>NjHBnw!d&>F@3r7C8>UJDDj@PS^@ z5+`g_x13xuH=Rs(_AlA<(|-j|?L>TxCu71V@XisBuMuPlJ~@ICrmVlx$TDA@O(EFE zbN4d(_&$nv5`)eG);~QKie!A;G|toFQItfjCS+Gngi+_OmIxf2e?iiAxPuB}t=#mDkINdTg(JGeRZCOOB_ zw3gw_mg2JMPC8gTn{@w8>dz+Kf0ORNN%xOKXE5o;?3j`$+{Emi2adwtdHS7Fzy=k4 z>(77u&v>f! z$8V#}{9n<_)m0!quu1gkju-d;By#A^AH6?4;75<2e5H>TW<58FK40juQb)KZ(Wj9j zXTK;e&L+|4mz(HQJhgJ-(j>PXp))72w{Jfskz9u2*vQG3FDE*eXk9ruftGCK#B+w- z?(^l!Nq+{Y6_I5Z@w-VJZ1AywjVyiP#iM&-`2GE4j>w-X6!}G+yaE&<&ByW3Uv5s$ zdm4i!M*u3L$w^2ZVQM$_xufG=-->y2wy*(k{$D~HyIe<-_d&7;FGv7RBC^{R5o7ac z(<0kKmdh;3{y;F?RRqx!W{4!CXw5D!quZ^^f`7K2Z+>bmqMxIMgv`wr3pRO)KO@SH z?8Lqqcx~}3xm(F$oHoZz?-#f|{1^QDalNo!x~NY5ilaJc+uRl@ zsWf*>N&+3UJ43P_<8vGgNYC6i<^~>oL4Ov&4~gF_Hp&0zkIygOzWDarXK(MnefIpm zJ!taWJ@3fVM9tAu&aJ=4fG^3BLXvGr9ij(`9N>@t)cNLLM$0>Ql6rj`{m!@UG%E39bWynlZE zorqOM!%ucp&``{|oTIcKTk7KaAB7f#^qC{PNx=}~T{pZ6t=`j>UvuGohP4f0bKkeh zu|(@AodPYimfqp6O!Z)m96-t^9JoJ}Y&QWB`9m(yQ?H=d&!21x1@Vr3pP~oOwSck~ zO4-_VN?(``1R$I?BP0-xT&3g@?SFTMB=#q8qhn+!9*Mw%^f~jW2L(W7<%V7QMp~mB z^+uYDd(?w8`7?QtUY~g>3t_D(a#^lK^_%Xit{Np;p+vZ85%rBR-GjI>HRN_lERbwGJ~>Gg(&dVew%RI%do zrQ+P9d+w0yBaqxb9^KQg@yA^I%3Y>{?-C$!*dh$Y`&BIOBI5D0`)ZY@juk(B8rPax zG5w6jf0j`9r}-ESk=TUHE6?4_|4+QCW$>nkiGG`^M*3Wz?Xfky{n#e3P;~op=o@p| zQuYCDoH)SQ-@}GM(a;eLkALZ8MB*SB$;R2=q;O;yjB4wtKP;F*b9=5=V+Y$1|Me*6&bAGo3lTEs8GoNTx*1^@AG>53CmxZ#)i_Qti45eiIw3G%2& z@!&WU?tHn~uJ2-BWq-?%5Yl@%!N-+@pSXf(59<2)`(%g;`T4WYjh{dM_@sXRQG3`Y z!O8@uSkL|LWd#)U&-$zLZk(D??Yo_@HU9dOngE& z|A-&~V=CC`=O48P1QxsZbieC^O5^7L`?HtN6oLLv4<43t>VK6@>kD!7cZZNiC_wFg zA7iY_EL~m-pM0Tye%Ae@%6_VKyKzzNUU=tU+IcVk?sv*N`Db(mc%D2~CKL6HE{yv41CgbFH!>}uLsq6ElA8x5^y7z;EPX3CuQ~E|)ogDQ>VL#OY zT|3&zj|Qz|N`L7$Z8WG@YHGo@YL-;v;Liw0b*WVK)$AY4!+(HQXf$W$t7Y?!X|y@x ziFU0gx;%t@kM;2Phr>z|m41!J!%yu=$l~#Q<$1~49~Q{y`x|=rIl<=+A;)_7C2mD> zw00yptMXi>&i*vazeg_D$+Tl~Qe{V%K|3y5HR?_XS%2tG4LjaM`w!z{l&URltLU}k za+Sm)5H|rW+%1*FLS~~0;@kYP>B+kZ;i~cZzk7Yr`1~86e^bhR;fA0o<=&KXUkUfE zm=WTSUdlbcC(Gs-@1*ET)mc-3Ew-q(lH-xsX2$j7{Lsey9{=@s;oX?Ed*KKQc-J&ApTHWaC zqkCVS1lmgR_3i4G+Uq0n&26^SPH)YwR>T0~f^+`8JCx++Zcacg&#U&uZ34w1Q$A`^ zwFG8r^0(IW_3EQ5UP1^g6$BVcJ`g+qqkFLzNPqrKNd6WF8$PTHIIz?}k&EMh#+RCE zC_-UgCAV~9hiP0jv#K#4kD4_%wXFdfFIIup1Z$_Q#YELmYh5w7*6kXhz~RP(x|=o@ zL-Ar`JwkPLV>`M=GOd!zkZgTys#fm4;wMoy6fd~20m zLyeS)NX@R6ed}`DNS5aRj_7y5R!5BFUKz&yQd6!OS(2+1YuO%4uB!R9L6eZgHbpQ% z(k|D=M(k_sBkXJJqwJIHmkA_r4v+vrnv(4=O^>my(`7p(!pE#E7Jh>Z9=Lh+{-)D`x(?v4J zbFb6vZnRpOX?9aQ;xrwv??4t0v4SUAG8?V%vdi1)Vkw{Y{c2d}5|-wuplo*sl|6kCDgA3R}S{-^xXH=Q_k>?n+F$9Ll(qF4Poovd!< zWuED~xPX57b27cTUCD1PGjO~ZKT%|bu@!$>4!!V2IxgSEF`d8{?_xZEdLSSFcgtjt z&9Ba1&N4w%KG?I|*mr#~_NNCq<@$}s^P5?czYeATd^TO=^I+9KE{M>N-z3ZFAIU{J z(LCww0~Yr5-RxvG9ltLKiPw4c`t0S^*>6|Bp1(YNL?0#=?e%E2N;0q#76SZ=%ddZa zKD#*k>Fx2G(?g40E>`tL>gxRE)#00;o*g>Ae^mVU(a~f7 zQR8{f-d9iaukl-d+U3v3r)P(R^wEpA7pLdXpC8KiJp4|4b&}4~?7K%t^^ctI9^r=$ zSzJwrY|}3?a;O^mna^j+nw<}2-9i{JX%(3Q51@cRgh&F5S0`~1~H`s_<^vHX9y*Q}kS zcZ*r_`{g*BE>_xieuB|eL$trl5ZMMk87(z?^mPh3E4Lb1K{29BEHGI^B_y|-Cv5(= z^GTA;u(6wDUO_eKzqwpx)Az~hHd{CEI!)K_W{~a073umWm$+=OFA^a|r0!@wLGsa6 zHkxaOe!QHH=H-gAXKr3}HA#Q$%5ugYv%URdG`~4Nl`ogfAHTg6%*dI>8JK2Zn!Zf) zq!6+&iz;dR8p8G_8!c|ZNjho!bDI586XH1wYM=H~lHMh&?9)L*YQIc{8f$K}m#NU` zy3a3f(~sKE=c9%0^Z!`GggC`$sxQTWuAUxTq#u&2G=C>5W|av;>?VII@0BS-%_F`A z@oe$->e+NR=Fe6pUPXaz@U1COTXY)=ORkj|l)>)!%5OecAJfbB&Ggh~w zm9fau-#-~kC=a+uOGAI$I!@=;(;HkdF;=NDn$5s=7s?khPLu0IC^+Nz>NW1mKENw7 z-oAOUG!C!R^?U-##>J`lasjP19UC|6>0~q?Cy&%i2+JQH*pqxHPo(=oeH+(}ymsHl z#S~%dmEMf8$+z)M=^hB*L;OUsm{z5?;C19&8=7J6b&xMB-zI-H^P7wR4cRk@mt%XT z6V;p`>f3nyIe3?9D|I+Ip=o>4JtJ&hyZqi=8!_qMy6YjN8}}~AYBzj|K90c~;oxrV zPVC}>JWE%r^locXpW(R-x-|Db3k-sajjc6ZQ zzUB|%Dk;oyx$;#iKCI~&io4mSpT8U7k=o^7KqXy^pE^cTN5L9s6h*+aPuMd8Ce#o? zb}XQw;|9no4Y!d-M7>A$Dx({Lz0T)G?fO6kA7*U0`v8kEyW1 znmeY`i*>P9$)o-2#jR*5NlHZCp4H;k6z)wcws@HB8qx{fNNLEQ;PL?k5pu5Z)8Nn% zuT8jjRYZ!q@*q>C5pBjFLb8+2xqEd5ZX$1A}OJmVCt#rU=W?q#-bAG`(Q#FF7f{Oy2i03C%ca6g@Bdq(6^kx z3j;bqUk_gorpdjVCSQolMaI+Kq_^G1=1yQbNCO+#JkRR+6Ibq^MJKO@Bs zxH5nHdZhVarF>@M17Fx#_kAqi)7X+*ewKo1)I?130NaJY=T@}*K>jBhp}&4 zvBj+E(q@5>4-uvY_+{HMOqQs{XhBdMX}`W@A;N$gVwST@ZF5r)WpN6MvbbjCix7n6 zAW9KiF*27cdy=mNGuTaAl9yL=mtBSLE9ie^&pSd9c!-2v9+4JP)0+RgWqNEg_{&yM zu+~r6Xfj38^4WZZ9K#8*_sL52c$Tgwqe;40{X45(ptoJF-_bkiS7*PkvJqfB zB$pvUmVWa*8{Oq;ZE~SrrUr6B?$)yrz364~@z?2mqRVqb*3f7@TNUg@vM$c&qM`z< z*Zk@-%~t;{`Bc73$5i$*$C!w?KR|y}Y+yb=Up#NGDaR`T%#bvlLoZf1pZa1P0^e0R zf|OSka9`IM-LwkTAucLpynLfpiZoh~Q{0rLu`Pv%j;Z|L|6@2%jU>nJB+V9SChLMs z;}}R^Cen&1a_f&9b-g;S2>Q8p@VnHWV$usUGJ*octZKC>^VEt6XpR1#H|x(y@33S7*ugB&^+ z?@xpeGhujCiP|qPmm<_Ql`ntd!D0iup3iUT!)m5WQNUDOB$FIj1()mCU|h|F$V;Cd z1O)glr^GTtFAPJ=M_xc2SRp5(j21FCxXcb73jR$ z0Y)2OXp$+jo^^6i^vmrC1ebf0O3 zo(uMhE!#!t83UoKsCcoY>(f~dVz$FuhpSPDreMp!LQN=q%qV~KIP=uWihbM0&8<|a z095b4(}N#)%r^Dwoj^0goQd<-?8I33`9XK^2o`SV`SO7 zLsL{K>(vlk;l$fc6VUl2C$OI8E2n3yjc#mAB3J79UNd?#7QL0lw` z03Y~JzWw&Jt=)grSf>7??Ms%=vUXb|_U}cmL`iJqb+92cW*M25vFnTaW>iYMY--r* zQWM(N?`k~22>{RpqAtPeCzovPPK}C}cWoFC0n$y$cCuxcHG#qZ15i2s||m$eV3jsflfr&ZWy@uZ|ph_ zc%BVlXR3U#I(dT7x#xMI6$KGQdKA&ss*|;_2pF%83}T3WR58su7q_GWgEgf=^YrvO{onzoHLY<^%A`l$Y!iB z?`~AJ;^cn;EHS<8*{=my)xkBBwBS&I4ckqBy2pt_1!Zj6u>~+3Jt+dc`9w{B_#sk| z#&&FbFdTIYNKJnWic;FYYFq1W;I_Y&`%~~kq9}w+*RV*<_6Jv0q6(bVeoMKPe7A6^ zLJzh-z|1dYi^_;?Z5hj=&xrKX#xDQ=)HIs}NA?R)5;v)h?*hJk? zXGR||3*eeC2%wboc4>Z#nrq7zZgJ`6du-f&m~lf%vU3HzonvM^#I(6~ z6Ig$q=L5wG3vYw_8EXE@X~>08VQ@xl7q`=;Tc&(c*Mzn|itYntd?EO^%@8b);7x## zV#+Y>l(ovEYth;tr88V1*#RQ~fq(Py&riRFN zYimOTH~_fYvpgpP(}h|dXTqI>0!RYbEZaSRo)wthbxXoYQn_C4FQ>x(0}Fr1 zd*@(zBjN#hJ>UBU6xgqEUv17r_)SCfnxH-5FbUz1l0|rI66Q(Mld=whG0c>|7 zU>J4?GnJ0F{ZU#K0JMIKF*p?97YQC&lM$oI<32Su# zpF9z|s{q3GM``7Hj*crRpPMGlF@%2rije;w`N-S=9L~6u5#B7=`v|p?TR0XDV7zt2 zjIa)t026PPrX^vf<=f|(QPtXu2tK(1lD9$`CgTWVW1cAp0|>Y$tJqq>f;w~=1+qLh zMihZPt4WxM6(Mt5r5u(QP)F|ri_2%dEJCv z87EKxbkLWuRuF9^4|u?)=x(Wtit(w|3L+*;19add@}RNC$n-{Cg9JGuK+yDBwuL!e zy&PhJJucE3bW6`s>edcqkrUQSt!;Kw1R&FMJTLZuk&A8*Ey9v+Vl9-qo#==NRR>Y@ zesn)uWZ4Ku+ajeia6-g#+P8l&8?Ihv$;fFx-H>N;Aj=?(A`w?<9W7g3Es|>8hvCOY zt2Kr8N_B&ufnC?(XHXs>eg+gTiPAXCWKz40`5B=bR#7^AxSWAV;24yG2y7CrG_pnL z8Y%+Z&nV->zKvipV{vsu4MTDfkFY%nP1=YxG4qSxQtDv9o^gy;DoB4chUVu1>Ag4_ z%$kN(svEa@8{}0Kq4DOB+r_7Ld%0B*%|TuSlf-H&DzY@@))5b4+e>Q@2-D4rEH|={ zChqC6MMV}i0Lk2lBQ`Z`xO9JMw--ap5jX6b}F(GlPF0o0X1zq zJxHrzyJoF*{q&ogZnMw=C=S91ZMQ`h4Nse5WEs0LfTUajnqP>y{&}l&emJ{ee^~}mztjdJ^Inr?(KhV=sjtD4)|{{Pmru)mG6nDE`7&#x>R_o5kTd^8Y&bY zvIg2M9j1A-rVeajbPDpLJUGRZbos>&aPo z8X+r?UffPsYm}9|D{{5>wa1uD*QJD2TV^k0E1BNvjS2g#Z*F-N6#$ZjY+5?KjkVYf zzS9aGXg!sVU^syYLIm;QCi{!Zs;PF5dBDq9%?76 zl~6o!$?AU|E}IwttNrL|CDb;<e2uK!kA3rwhvb;&5-_Hsl{3bSc5LYrA76MNYjaX>OHMAyPuuA zS)A>eZY9sOxrmsd4jYy3a$=+UsFRU+i?lGfp`w45gxjcP;qo;r!Vc zZdFewY}cOkURrH|IDS!M21$d%DCh{9WJP&rp9~NxwYAD(8?t~=^2!@oIMZSIP^x+~ zl4PSI4AD7QQbLJTNvo%3L?6>;aR8(~iD7@B!nbRZk;rO$ZXy|$>&MULX zy9MNKPP{(r06Q=WMUH!fgjLIBb6007+oEP+UkgMJMOv00dq`6*EM;#)oB=I;1u{q#@tH`T9^}EywyV>&K8x3#KOjLg$ zC!K3-c_EJeEO1lX>Z=5ShieGCdD0l%Ls5suH)dm^dD=4DcpWpX6u0HJmz6gPl{S9=h6n!K*aZ9sL%N|Yg@Lfs0G4vP#5ebG?4nR8 zMbcxsR*gN1T21Anpu(&81hT)_zGM@^o~1Q~YGrvF=7Y;#^qQa>gi&S~DjbPwMoLo` zc$~@|LvXxPQKNb^Z!J*3c)fR<|n!ecGjn@pup#aMrCRpx^Y;juCz!)8va5=-6i1;b-|+hbIw>oEcvmHT|M zl}z7Hcx;=XLT?L|@qkwFY!gG-Yk-WzW8l5&v`b~kD8GLn5i(M_jQ;4Iba(TrwL%J& ztX2GJ(|Gq9A|qY8&?l~QynBt2A-zyl+o5`|lkQ$)WCX}W$CFOF`;32)-OKjfEYr4% zMQ#=wl~B{h$go{H3{}eb#85@otO{<3^!PV5R9SpO59QJj8Jaw)lpNHH>ro?ar&5Tn zGbgJwF&L`X0(;gXWD+1P9TJ?XLjnk`3PbpOJ@YC047(JdInd*wH6ySOxDE7WnD0v& zPNy!mp^Dr{)i@H71!jLpx6;(1HyjAnGlUxHE;OlsrB-|^ny7R|UX_|$rczo5O7}`d zv}{L+;C(mZo0l=G9(_C)xs|9E3o83b%1Xj+Fp&2X<2m20RJAY=+aBG4)}4rI?cHsN z?!dfSs0eknWqBx?zcB8o0~ot-uin(%iYje&ie!;i;lPYZeLR1xmYd(H_R&@W2~U2} zyrXZvojxAMqC@DwN5{~ZWeEZUGzp;((btw<%b1vtS0|bfq9Ikdes?h}kWWz)UxYV! z2LeWy3SoUXjKhE%a(Gn&q)erDm?CN?tCLSC;3H+?K*;FKHD(#j9aN`Ugjw5XnT=K} zp~5md4$OiYqHce(tYZXwMK)T#xLO&-%|olxcCI?QipV2ZQXO=)Vv05TLc6oh@#c}( z!q5oVhU=iK6;-IqA?;4PeKO!Is^_6stHEg}s}F-QkRK7T&fz*mdrJALytyZ%OSuYJ zBN||NE3!Li0~P}N&!QpXE)t#<)2as*vAfdhV6)af6FPreheug9EWnO*wc=!(6{s?^ z^X|F*umzmJkM#uoki$43RI;)*c_@i_Z0FNZ~R&<@h zZp)iL@FJ{svO4*LK8e&c>QwJ&H%i-&^KHb)a=y~ZA0+6K-k;ncYfLi={i`K*c{r+r zu1)||t;dlD4^)tHXp=5$+`@6g4!SxCgg_#Rz4L$UfhOI)%gg6kCxUp#jBdvkW%DHQ z7d20Ga@ct3F7k9S`mM;~0E_$t3%Tiff+XnU-PCH^ATzL`cOk2nRh!YbEo_!1{+Q#C zIEh6ENW!4(0wn3~BY-5&XF(c1U2MgX1d&9yVOluPbc(v1A(AxNsHJd~Ba-X}raIK~ z>veynG#j#I1T{dCxyZGyW_IaN+rHPY(zzK5*d*M+>${Ls)DbTu5~@ z;lgdDA-}#RNYwru#37eVT#B`drhgW32=jlbgAu8*Mi_BBaX7HyN8{@0!5|O0JnS$R zQQ};hi+ebd+&B3F%B8AyZ4>R*P$DOCgk?cDIl-_Jj5uA5d`|5_`Z=}xitJbUh`-~E z!{&8`IV0`a{E7AJssos9oGFd^D|EDg{fH*Ffgy|xjZ-D(v6yZ;KWY+0 zNWW#8<*2^U0p)N@3-P-LHg`=M?YhWvmwX=8zo~c|!9j9IAKv!C&SE+T<`(8InY@?j z<$ScLc2>1{{$o8Izdy}JH`SL9$=rWfV*{tkp1#Pv=jVrV>Hg(r^{>{E{O6H<`a+&T zu3q_B@uK85zI$@JsLRzt3*pk$+5>Ytrf7CeW}7fKm+k{^6U^zKUT}XY-j4SuxP7yQ zwOt%aOzji40V+Np?2~_bHvb~_i7TTRxqG+=5$>Dl{84p=54Fbh~fAC3w`2>?z?V+Kvd`nHLa zx?}YtdNL3%mI5v&`e&i%7{0J$fGTu`=NY!9$fB4WArJ> zE|R-T$m$*=jl-&5mc&o4Nd2B1i;AJh>fZqwxwi=NO)f3#xx7oTRfffAHVJ zYw;_`dG+(z#o149kKddgUR=JqI)8a}_~xf)ht?5(A07GDBgROVt535W#6*`LGM|^g zH}iKk#esD6M`9qaujtjs%jszTJe{wqVO9a3I?}k`*Jir5-&^xn!zMUQW&#Yw@GBsO ztix+8!%a3?+_tR4`Fwx!e3~uE;MEG@n-|Ho=8Mb4@wHf3;}>9GW@YUtqetLHe2ViO zTFtK_k$*1co(^8=m;C=xh*UnW4mgo<{*b|PEu0?K|alg*z zsNoj2aOW0prKwAU=-S8ixw=YzU;X&Qcp<@a$#{$E-_MhG*?NDJeKODq#8MXtruyq& zet44KsmbSouvONx%&s^v1UxTyC9*8Ap%E^q{t}NV|EdzAN_iWaRNNv5jc(G)diG&o zNJ)xP4zzS(fsjhx!dR)qEsm{m>BES;war|1qLVOA4vlaQ0+AzB%nIm{Jh3>PMiQ*Y zY`Cn=g)NjhbVELa`@4M3ij9G2L=<3YMiasq@jr_pP$1nNQZ-Z&h@N>E^9zHD&FVw3=I7 zyjrmXbH#}`Oc`mU5qc_fRe-e`7hB$ZT%SQplk&XVdR1nCR%Cm76xj|$b}kfg>TiUe zQxm9C%LRcWHZsuMYgiJ<=Yjuh=_EbgC^(Im-^jOR~YnCO4$4Do!vJXtSS>0NOlFg)=u_*A{_ z5Y8aa<|9Tqz7j@OVTOwfE2BIspEW9soCm)%UfK$e; zqK$H4mBZVcq#p}Y{lCf&-<(}uy?S$YXfgsLCcRBRG?p@B(V9ChPFK z@`CRkb&>&2aWTqnrpl79AOpo8Z^TP%xaNN1tNoK7y8Sd>NLx0={igw3t-pA;05li4Pw zXpQgS;F9tOzGR8ks3|&0?-sM<_selMU97aPT*oTN6ue!Q5aP?H2Y1U4SGUPs&NP2Z zBBFj7&DJ^Qhf~hwK;K@T9sUp7J#$YZ>+G>*Jv+t!Sk~j{%(L(>v^zL?jy^Zfod3x< z_H~B0&AC-R=4EPNGu*9bBQdufFS;WD)s%ulb?Xiwr;bU}De8QVT8TpacM8;2r;j>A z{U20$BMkuR>UO#`!2Q#)fq%G0dToCM#&m9s46OMyS$1Mi5*hDMr7oJSZl_9{ckD-% z0`k$QQUPOC!3C7#60ulmQW#qdk*d6<7~cqfE`HG5gFJwEOGq99{vA{pxa8_u6K|?K zy&4SHe!XIXJ_H7(`Q4y2e^7Ghn^2nDI@*=4MB+c$j6_)q^mkB?+f)cP#oT{x>ap`V ziY*aKQL%uwp zuh#R#7|kcfNs4lbn{_r4#WwKj=A)Y=+n`RtnuR(Q?_#`3Zea5iekpJ?7qCa zC38Qvd3{rr63-Jo(TMBGn!tZR73RPz3Jz*1Q&dZ$dJl)KMRwj0gYG`6F>4QCT2i=v zuGrr;J2T=mdz5NoYpiroRs%7JB2hejvTK z^xJYTI5$%0%a#{#nj+v#eJPE&{6-u(A?MFu0FOX$zlu2_&dk32x%zzO{#=!RDZ$r~ zWJ7Fr)_69=aW);z=)!)MFSjWdp_W*{TyOlLVTNrJ2$ZB3!sm6mlz9v!IpMKomf3Av zWgmQ=muem3IKq=qIHmb5FI%W z9@<#7!mC^7JosiFK0_D{{kKDZbZ8}pW2xXm6D=}vCM-Gu2RLe*B}P#FmOl&Cp-7$w zPD-Cebe(M?h0}?B#|GMr#-sEy?g-|wJrKre$9|EC)&oV2MUO-EvSHB=u|WK5TJqsD z9_sq95}g!?Wdd}A2F;(aXArj3k4k}Vo7_-Sq^3aa*^fq=HdJe`yBer}X%9*|2e8L& z&9p;?zQ20+50T+1r%d9^MD=dcJwK<}A5}J^d~DrDCr{g?$O-n^*NyC;)`S+72>o*= zo5Y3GtR!7!hO_uWp<$%*Q36PayH>5z#8tPX)ex@Y%?i@;)mlkYc(rG)NllLTCPe|s zUZnDvOmhbJp-zkNrhr9%H1SO|FfK0W`kv)=3(;8xIEC=8{vu9i%zREdCDiB4Ep40; zii{Kd4 z^dr`-UkQi&dSzwxqOhF{I>a`I*rvvexTn}Al8Z$gne3pZmL*?*R&Xq{5eOQ~%pv@t z8A`XiTfI?-^8P&6@Bssu+gV6NnN?bVSV&EqrD%2`#Pd~aCR1$I1SXM#t*TR}wc8(~ z#A6@9*h-RW>;4a_W=bfc)@=OOS+W>qNf%&?pgR=UE_#nnR;lUGHKtLLS}M5EL{cI0 z2Vxv09z_98ejwX_tnxoS)34WTGZhy^I0QY$Nvuc~Knr@N3#n>zfR;*)Dwe*7yNT}L z`87*`FpM46bx7dtCa*0>GL=7Xs3)Hj|BSAkk*y3+RAZ~{3+kEn?4{hIE zuCnR-WObW=t($k9rt5bzcrL{i>H6ljdC`kR6s#;4qp^mrSvGIv>y06OkwK z>vWEk?WJK`N9DgSlMI^b$haGgUtRuoBvVI@=aVd*PE6x$zFcRCvAP|t@IT2X10IR- zE?wP!8q4)!k!Gu8V!ZoA@=sWDipWBdw|+|3nE|6X$rjmknf$;1^}m>p1H2Nra@Z87?9Gq)^DfXEXPM_l@iTYzvlz}=}7uC){JF1=a z&{4U;O{(YYG|QU@H%Xo&pjiI_4aLDtqB3W2lakrYK0em1ZpDR|l1O{z?S!TgmI z|5*l>#!{sIXa4Md#wpX7_hbGxls{3@dpCb~C-%_huWcH~%Vn}$8q%Dc&aX36s%Gnd z@d_rYGI+)Od`~Rid9wPLX77zfmj3<;b~8zdULN5(n54Kwd@)bPtLca7>XXQ}MuPPs z#kaU-gPoci%(v-sC9KnA{$ZM>b796V%}$%t^ZYW`S|9UP7qrE^#rL~l|A0fQ65qDE zBo#TyW8MtxFGB)>YMhEd%VIfYDGXun zMys4{Q@J~9Z2?#fVQ)=b;R}Yn#V#N*k~|Sy*9>F`iXTXk(Yva5JJ^w^Xss33gdKaC zCryD$#9nKNng)7v@!9ztB|ZzRuQMa5l_mw@`ah_et4|P!jC8I_ zZG(n%jfi%s0X_7XKyq5>qg@e_opH1|!D%X8s4PqJCD(v5)NRK>fF54UIcf-sYf*qoI1WK^BF%=NxHc$W>AnH&`O~32b>)Ar zXwS~X9vbZl5bVrB8H3ccYpURXv18VmfNf4>fRO`135j1;_ZAOSpbx6!MGu-ake~@d zjRv~UAl9i1YSw7UU?c*n^I19)cgkXY0Rtg3=RKKhZ7HaR;~2>{$hB$FqdV36 z6{inG=-`Y7*^-sD{b~B(ZfalD+uXCf;HHus3jT)3#}N5w>ts5V10tFMomv1Htn<;% zk&i;^DS0Z?>-No28)BI}Mv1~cVzbp;xYxKx(F(3B^5KZqF|8VZau=^r7QWjS`oxIv z2GwJwPP8pk#2DyzO-)$!XdrGVaVdpjWsj)2lyd#IY(Zn^75T&zd*}q$rt17g{mbpn znrM{c4P9rtPhZ=v>r7LKD&h6#tXffGy^=9v%jfVDGrbGh{(0_Sy}MQ?tz4`T2}Du@ zG%~s3Zwbiq#Hn9NXqPF};qeC!8}Oo03+XP}4K{#mcg%ofL|~ z6mY9TBRJ+d6sp&XnCoEcL&W5VTJ&?u`J@(o_wyvGUZj10OoPoS_mxGyYp{Lyv6QFJ z@`91Qm!S8Vsi7c!QJo?C5C!RbU>gRu4O~-JIesH;45)3QO$1WL`CbHPDQpI=`KFs+ zP)mQ{nsUz%*rlYWArx3(%DRQ=o4ivMG+0U|EaDjqVh$56wc5RoQu;7Lo~lPF30Jj?9x)S zB{XuH$D;8{Vw_Ghv|vfIPk;T(U;lzmFXHtIB50(IN*>hHpf$@HPg@$O(b3;5YjVo6 zpJbY$fs3rSk*y2!F(eZ~qUfdg@pd}CHAIsbQN<&h%NQR==t>A$?-H~{6z68vx*U>< zq~*td=?eE_+;`%o#Q0IS)I4|-v-FtsIGm>ww01`}*LWeZ9T!2i^Z62UKkIk~-UKg( z5~X?au^gA|uqgU6ilut2Mu?Ze0E#&}H4c{vdPSnQFc$J=J)Ml^<3v1YiB`g5-PViR z3yMCAtj1_^2X+BlqXUuT+4<pL0S~E~_ge>-x*dXHd&-+q3lI3!Ofy9FqUD2kpB2vtF z@e<+;T6LW`l&)Yr^^r)gsCEMkJMkyFdgj0KAMLdTNG(CRTv1yfq>ULCe?L7a|I8}~ ze#+AIf;K?%DHi`)^%(L^oVDkKzJpYMe?RoRmfS~?V;ERSF~Old;vf;cbqQu);c&_6 zJWu<;k&@`Q>ASv*)BD7U?_S=tsL1=k*MW@_Z~5I-qKakWP74YDF3u5i&~XB3p2!-> z&k{Jj`uXtcHW4*|tTGMsX_^WSwG0E$$NyMPfd6-N#RH9$MGL15(i3K@lk%*8BP50% zp)l?dBU{VSaL3W8dHFc=;~g!On-Oq8Sza(Im+C&10y{ z)J7weV<9xE6kr@Czetuyu@?VtoS!~Dz)px&3NT}JdCAiQiUpU<4%Wbd9CqY5I7*a2dmn z>xY#L66N^K>0ys!n(t#RpU4#wEi-L*FSkV@m^t8YMjO8aKKq z?hVmjE%dzz*grvmYAM@)_nvuOFS%v5Ki>QO@p1vrO&*}bATzO`y!_OuWrngDz||!2 z%)%UuTcnk3J4ZMbfSVT0gUN`^SFiKY7#oeVq&3$xPU6C;cJv3HT;ouxW{U{TMH@Pk zX^hP6>YQqx4l1(4Z^_fy;SBV9w=_iyX5a+qv%U$Izg!63l=~xpPxS2o<$)y0=FaK7 za1PPtfqW+MH|i@E;H$|+O&HfijkM8=|6zMnm3r9lsVr2ExS~D;=YddxW8>*j=-}8w zDIe*k1rA!gLG9Dxx%5*Z?3?F<9RmpbDVaCFc%1>n%B6~Y8C?g|qA;mGK{g4s?Pr33 zdRR8jHbLu5peUh#hoec@6p8QY9NEm{{5of;*^dOe&4*@#kd6Y|^&C5Qh;xMnE*u{#YEevt*>)VXo_^sIdbJK7n5Sy5g-R2QzZE@pB1_AZXElzh1xA~95!Y7 zZ*XENM28?&UuPZX*=#mlh|?46l{ET2AFze1Sy8*J)Nw9L~3B2BmOuT{e#iJ`cY-N%Mvnz^!po(e!%%{M!yIpB5O;Y=lS$NganWTUi?KJ@G{fa zH@z59XWR24*G5E=<=N1To;b9u$o68SiMtG@u5ftF&K>UEWArx!!L-{-LMh?0AOKv!*Ba z>fJv|^Fjvn?!i2o*}Nsx+i;qveKEhynOCV8R|}#%;*;eF)X< zUW;GJ+(dO>T)w(eD~-x6)NY|Ri=B(iG0V-BR{2 zDyDe%-r-iBA=yX}A37lqosb1~Ty+{B_=F^zG09O*(zYG5shv8=6IG7D#NFj8o4!w0 zx7oVsPoAb|$B~p*r0bj8=0z{ip9B3)hJH(ZPZU!g-k$XHC+_ht7K;oX&oj*nXUF6#o&;gg&L~tnB%dKRNGcl%Z45hiR71 zMRO?i(gIuVa*)x*1c%@34cZQWO;pmI2VTsp;X7Q zLhu}Y3dOOv^^egMM!b3cZXv2<$zG}9-UEDHbDnBNnAZ;hUkjSAM?x>>C^19(hVz2X z>AoP<$9r%k2M3wXt+2T-$D>)Eb;h}HaC{CflbbX#-qzSrG;u4=?%mpd@zJLAZmLus zPIqMbOfYbsE1?NKG@~s2%+3B3sLz^*H~LX98_J(3>Af4YyAyk8gVr~VOW6alikg%m zm6}PZ48z=-9dBx<2%EF7t(v#+oX*Fy^#lPPv?)y}E7aH%IZYXzvIydSu)r=}k6Tpiijy2pvj= zEj>%e@+#aUT4jnhi0MK;4VE%`lp2c+eMixz^Ew%=&{=hf9)=wq3?pF-7aa`$KYQo8 zz|qb%zUw4T+P<+2j7whbH08s`1;H5 zBn=yhJDzMF-S7fe`Gqh(b<=yXR$5g}s$hA~P1q|+e6%5bu|WqTtUQUFsvc$OpZ zsZ&U^K-b}j63{_^Iw7%PIwotC6UXkjpE4#n`4ZDm(kUp5lp>6T!-R*BbB4h0IEn&H z-#Co&df!&Pui)*Bqb_Zy@KKs?$b7NgTA00`uT`|BW7ny(Fe;^;?|&wjY#F&0&LlA z=?3IE>hX#lus2tkh-D%{bO%+-hlDBmYoirsJUKKgpS?XQs7YjHcC4Gb#{4^LH-DV zEZhJ4SEu)X|7RGV#*Zh#=@&up@G*Y{!55R$B;a3U7kTtG0{UU}zZ{9uB^%5^koVQ~ z$%Uk1m0(JexKx%B;<;E#d$DG_0>;WIqfU=<-;x4Igqfudd0}DmbL>{`aGW$Ysfjk7 zpHogpYxao8^Xtpidw>asx$|q1Vv9*}n`c)NxB?!3xn33>_Rg0 zcO?NvBer(*lD2SN#GX~MROP~*EY<8dkCG%FPdWb;PAEVJhOwBh$we_HpW7sMlgpK; zW9l+f6wcrY*$ju|JqxDM)Im2IU_eaGK!|y4HF`0-GG}=WCA+hHQj+>4qvSWuGFL|_ zpB`6#RQjNeZ4L}8@JNP;#uxIZ1T0zFTn_~!t)$SE=QKAmzt}#Vt=}$kPAEB>b|Z;e z=DSXJ9YTGn=fdmM)GZh@y~QKTp_oepEuL~IV3wezxXJg8r$F7}Ap%Q|tnBHIRd4U7 z*N?T`Pp?Zwd7Hd5N4Ip;L~!TE?#$AmVl&!*6!vt|s<4M6Nu#`v!d}0luCR-s$^$$^ zgDa0!ep1Kkbhm0h0hf)$ot1su9BaiXi)!y2zva1V&1ULscFxx6csz+h4(DhTk=`vk z2dnz#>J2SfQ^S6w(oWCcPlZ43;plzZkqRGJ{JF19;J+F}!OPQEXU|`r-gg5_WNB4@ zZ3Jp^D@Sd%YRaSb{%6GnpMBoiOyx9H%7E=v?dY5nK`VhIl{0~ z4mLtm@3u=Y$AZJQbFdM0)@=_#hX<7tSTjDHtO>3W14C&%7!-aW39XU(V1_@WJuLWJ zmakWo&MJa)GG_|*ia8z^YGFY=GA0RgYvE6#Bo^P|qS*`{Wd*eEzk2@Y^MWCNB`9@= zy#f*2=4~M-?|$Ho(m9no?h?F>hq5ek=oSPGVL@RE#!HfEnvB4fW7m+Pkz71ZGB=O> zO>rr8>^qna6G{0r@->@dsuj~gm?|GlTvDmnRESL#BTAQsdT{4Dd|FZ0Ck^g`3QF@G z$$u1d7dzWi!#k8L^+7wW!In>d1m3w_JU+hLJy4%IzB^e{oKlN%|I9m@f^$i+uJ(-y z(e^B_0%7sXadn=4$^3pIL_Qgn;9ICP>&wORr_yPQPVjeKWAX8P^Jcv;ydYya(0lUa z{2Vvj#{B->c6AC&!8pqE?k!*0cA^I!h9Si&4J7dk>AH-6N=cmm;nvmkz{{?#jD2LAi}eb#DW z`!1CSrTrbOR8dRHfAm zwzNE_R1%G%$!J1d7}6RvkjkhxI;K=ez$?NQ8wIgru6DJTaY8BI5tpYl?>4Kwy}VvL zqWTDri$+qxr>oXNX@qD(eKB;c$#^X0|I%?%QFrb6-Cw=SrKKS;Dv7o~5AN0cYVmq?d9HVX0!OzU(gMk`tPjW{0K2z*y-duN z(nJnWNTV~!2MpTbw!lIjzc6rb=`4~V$?&3=f3#e)w=dL0zRc;T~ec)W0OK{ zW9onBW!kbq=~k@k(-{}9bgSc3iw=LwF!PSyW>YRAk4IBQzB1Yo%A{IlU{y{NXL`vLBy3lfEffxi_5F zW79I88Li^wHxKV;Nx2+eyoSuXZN(>>#cWxaIy+ikb!_UbP_;v}?=opOmzVRcysqx0 zjq+%Y^$_9nVzn{NJv7fSB7)Q3jT1pnFZ~WJJ-eNMkuNxz5YsT0Fo%<`?>5$pirVCG#OzyIKyl<;6JRo7eZwa&Vs&z*5A#x zd1HguD?%k!%P)xYyjpB9y-8d}*1shU{X8H1vReOixtg7ChC5&ad&W8Gg-T~ndi0Mb zmZxU-7RP>Uj(yILI7&IB7kT(o{)@xGom0dst&cOmCwIK01-9=h0dj`INC0Jp)a}LgrJkpaYbeq*3e7+YK9dzZ;}Cd}n+phHl83^105}F{XnBmM zA1dCtaqWZW_X-^=Nql5kQtkk89G>k&rS7K^D_?vOLY$$7AEeT2%v2YMJ^)Xvc(AAEw|^ugyi z)Xz|(Y{*NuQOoYI(7(&5aYqT^09>&Ey)?zpg9SJ9N>)gl+@YpDAX}c?5s*rMo^=%G zQRek~DoX(57vnyeBnh_#UV{(~xvKytF!xYRo?t>qmZ;u@c9&2iLU*FtaND)59oB~IY+w;zSo~=i+ZKsCA*ZWVc(iuM zD!se{p7U7SdYQpe;) z&czfua8nkP%o66gs2)4J%RV+nPcR0uoo=rYmq}q;aX&TN$1-Do+iv?<^K}*D$XM7f z)+yJ?KGxxm-@SdT!x&WTW8Lm3(V%EiAqMYBu#bH#Gm-CUA0tI>YINs)>|>eV6D!>B z$3Esn8WzkMONl8hccogjGuKFYlSOKZ{By_VzT*d|?xy2>>H(?_%IUfu%Beki>Q!aJ z+|QiaLEL1>3Oho7<*ZPKta7E3msGurG2?p8sh!)!oZ512Yr}Q3Oa^=^hKR!4cxXEw z<4EgE+jXEJYyM8H{iy@F)=8-})A~xS?Rw3rqiG}=JUW?ETdr+wxNc4*&C7)FG!lnr z=G1uFW`-hbNaIVkHe9!-?$>bJOSU%bwWzlAqB_UB8!l~sWOr>+?Yf=32FLo|J=$8g zV^$a-YcEp)M#7FZBo#_-oZUWE;jU_TrM7y>dD#Q@#%~2 zp8xpt^x4_q>FL?G&maGbjmj0KMZ1Z05?T}MH~1;9bw~iYc}m}3;cy;NCp;x?3-f3+ z4aSc4Q(94f!{G=GiImFuM_UQ1VWrL^G9+#tViCMT0(j$`Q_Q>8ZP*&S3ze8~Z0N*| zPGDHeRPk`5?R}@Cw`l|UrIBfz!g!2{{ZOoj>@3mmpuYTpBiYzl9Pd-MM9T>_!J!-I z>rz`|@Z>R}8OfvwoOY(jT=LaDJxSh?^*)lQ5f62LB!8rqyxvECX)c7UWS?z+VScu+ zO-Hjfe6OvAthWvOXy=jG0h(W1S0C{{(!OQ;YePF}e(f+&d&1j@_q|z-&F>xR<>!57 zkesz>&94C5;j*FOo^XWJIFPL1Y<%;qw$DTmt(3xLMs;8kQ*i4gtIPN zgc}LUCvb}Js5F^CyO0~LxzfG!&RM|K>2};ry!THhn`>y~MsPUfSD8yU(`r;nDeep% zS1V;UU<}@5I9!F;XOS#n7(F1Dy<1*hT5F_#Bi&W_kdumvOu#BA#2&Wwgk7GCc4R64 zr0ib`FFtxVThHD|iHuC!6#IsjPBo*5UJzQv?znwj5m0Ie>k^v+V%n+qx;v|&7!E{KXk0{Q6 z<)faXk2APiA66Eo-EM#YOqfp@213Kh(LzqhJUBd;$@0A(Ba&pQQ{m$rrMl|G8OQ-S zMMzIZVNA$O24=GZi&cPGH>BJLg@GY3s{YwUw9m2iagK?`71_!$GcVNANf1r|?I}Z~ z_LiA=67!gH%P13W=+GxPFbe0F60S~vrLw2nN1YeI-Se&Z>yVi`$$Zi^;HY%ueCz1V z@-V;4vsp^r+7I;}mA6)LWqGR?UOp~g)y1yrUGp|oFKD+1{XOW<9S&ONV(a!u;t!`9^`O58 z{R8rgTsazI5Be2W+`+MEuof%p`5(g4-J(1+mFY8M4 zdXB@rew+0$#Zf>e81f9lB9a0c+S3k+UEg@;)SeF>3*8=~BJ3Vb=%{6)krkv<7N-~d zF$1VLLPt(>ByDP5k+Z@+viyG5WwC=!^!)X|72v~k=MI4U;dueK@AGO)N6j`Q`>M2z z?hLfj+fWgaj?gPNBxtsO@tDU+KwP((n_R}^6UnZ3SD}hJ_aK zK3$}9p1He@pf524+JN)AT2eoz%R|*!@m8HuEH$&Q${k*5t8U}px2<6f8K}n1%QZG$ z56H@htvOXgFIkHc4sXm8g{7g1r?G|^EA@j`_D4J%oNUMoO=9SOGWj%Ft*@@h4*hy@ zx!Atfp&ox8ES7IBZ_XFXw}Z{i^)*HG$dLVdz4~P{Uy~X8d@*~wTy035G&rAaXH<9F zZn>6k%J6-s;`Zz=^iGM?C4yJC-N;m#I8ST+_*H0u{rNW?p>`A@Cyi3<>P``4TV<&}K;q*IFlXtW*tZ5c^sT?2P*oRh*li}deyVYtV zwaO`9E`+jyu4wLR#`Y&EKXjAdCI&(0NUX_3O*omKso3 z=GUqg)x{-Ba;Cu-HPj{Ad52P*HivZY?F5P?xW@Q@V<@FGoyJbEb)g-n1m~H{(g~5< zlu_4uLrpu*oj{@cFjr5e5&RFi^`UF&vZbTfAxP})=+&0Z?AflPS73kH zmZK@`-Ig|p9oE)xT-7x0RBt}Gu@9{`N5cW3pr*jFlpCIHHjB4QJG?)#_yCqH5Vs?oW`g5ad=e=4;Rp~Rkj{Jvj-wjUwhxF#;jj6s2xtv5Dt99Xj zWfyIAVEf-eU#}*9yNwe&*Vi5Qv{KV2l8J3X@*L7KPNq)2wwju*b#7NVCwt;_I;L6{ zN!UVk?j6dx+U^y8WyOgNoiiaZD)}XnaWKKR|J&tU>xr4oQAgG_)e|!h%B6M$k4#U@ z)G|lZ!B;&oQ$lPM-ExPLtghT!*Xl8U^lycs)lqs!$azN#!*TWSSBJEDrIHU*VSpY$ z!aTgO4~>_@;o!+RJjlhx`$2{k1y4fB1jSnS&cDpyZ`wnfqC2mtH7;jbBQ@ z_OI^;-@p8B^LaBrly+utcR=J71}OK)`(-ek?^oCJb%w1s@1cWUZ3eqoo|9&WmgtgY zRFi~1?Z{EwF@ISY2;I0y)#hxr5-ImNi~CFl@3v28>$eM=OR3JAthtW*^kwYWK9d18 z71y)tcMX}D`%DIXCIf4lRrZyCK9fP+Kl)pbN!<$F=PV`{OP{{1PhYnEi`99IQ|bEJ zkl*Fs$*i5lHiqc#ltZ~Qt9UrfvmAuMD2cH_Yui$Z^>Z(l{?f6E6MiKuH1a}EP+KXy zs-(7$vZfU6cB{Aqj0HjdawBx1-YTv_9{O|zl`yTEy3sS${Pc<4*3!~{l+}lJDQVV+ zc4gW8=gTj?e6VvBL;|xmp`I`=_3%_Q#3RvCLPkHhjQ!;`$Dc9|PD^)s96~ zvkOH#PCnp5acE%uIyqa5ydc|@NUV(nz%a;>-KPJ-t8eEE7c zTNhl@%z2+DFS5p~%wcbT5`O2K^<22Cv)s`xj`WMg+Z%CguVAOH@OHl!AAOlKDd)1@ z2szeJO6}u>AzEJMa9|5pdKf^n-Tbs&U4L$GOSnxu^B0Rtoc>gQd9hyz_p{x$Ce+Gj zv#UA5Tj3Xv2l7Uj^I-%nPU7oh*9o13-4ue4`6Qm=azg?bZ`ezWNv-50RRBDkdrN}gR5QXg_ zpwv?zUtE}OsN0W}2UO)U5XSWi6qXgU#m4~j`MVBgcsgHy-k2Uezn=f++12%bTMo`< zi%Y#gGG)D#59;x+-mrh)G^z7GdmlnCKOQT%YQ8;jADIbI~ zAEwi2l*XxlaN<33>36xAj z^?U1sT*}`sjToYqi3qO2lgFHg1gNwLEd6p_#77r@+0k8abZPMe3oNNUd-{zYWE-OK z`w?74j|h?1*}#qU;mBur8F2gLnI6?_yOc{;HTxS1xL#1rv$O#F3aUxFpt372S2T+t z?DjR`6=&55KL>y5*Z6(zS7mQhibjqa4% z{Jrph?&Swm_J5$Y{e^R4O&V0{{P$IrnqMDPrH+S5FdauIYLj>bSws>&)f8~|APmwp z9ZlkBJRMIb-s`J}q7+`95b+sLC(~)*Rf0-beMGf8b`vt~RJr3}98QyjM9rgdLGCaFRwW#FT7gQD(BJm~uLQDdIjgd1^PM+1d97j+oYP+QEPwcEtzS zctFm5->QaEcS{6rIY20IS1A{Ib=&&uf;#@dxYTuhcU8UXN8g<*#$?nB5>A(pVE!}< z<9AF19u3>CB_Hr0zslUavKv)kz28e@dB7WKb@f&cI)Y+7Wz{rW0`;5jD@=M3*COJ7 zdIh~S)O9sGc9w%36*Hx0G>XLCs`LT-zZY$VBGM>qwGN!iNS^|8dsTdjqSGt@^=tgG zRq^^3IkLh$#p~%z#BJg`T1)p3-;s=yAeqJ!aLF_}FzeAM9F5{2Oyigg$8qE&Le`kr z)}=J-*PM#~r9HlbEXQFQj7KAU)8Qz8a|ZXNdu&OIKE9)m@318ooyaWZAMfKk$mpo} zB|C?vuflRb6&A1G=f$i&jK42OY0g1=p2;e01c5qmCIf*s=2C3g*-`4O^BfL#Z=nvw zyR|T^9scr0d8f=PHFnBlkI=|KZ(ECQ4{yw4v)IvC!`PK;y_G(h4hJu9G|5qavlmS= z&H2x>%bSc8xxFDtCh0dVPf^D0&yWwvD=JAgSBfjCA5)fvd_;bw`Pw8Cvc)-0%g0NO zp;wEm8)|6?1#>%lEziu`&&q$mmOQ_aoS&wNp)dAI^Ccm~DUj6#ze8UtzU7gR356^j0pTx6I;wb`F znSLI<?23R)?tv2)jT(nlBman?zxGN|LWSC9V?#V1EqWkP}eOieH16n7WEkbt}oqdSMgIKbHw#Y6!Hho|~V<4MXQ98ackg3m@G zF$+0=8{Ih?O`{Zje44;pB>Ql$JKxvU&3ji+?+WT&L7p5W0>}G*0vLn?I~ws0C8aNb zv3j+fUDvIq&sP6>vv~8!9ruGZSZR)fctb9Wt*yd(IVh*0?!Kf!^FL3r4T)Sy4 zIuWNy0ZQ|v7s{c7uV=ra6O$o<<%G;6WAGjEIZkp|n6}ye2-BgPC!*xkMnmqMPJ(HY z%0ohjedMH}rFL3620zBrbeyJRrzMR|!(kA`&MV0}?!Z@nBG-dtxQ$2C@q}=o$!`f# zjj!$1yYpX)7%mg)V}9-AKwv(3(IzEh@A)J^l>Sd;E~8O63F2%NUcH;ow?kPw|6~U; z7>y=S&Z2QjP;+SHgC)`x^Da+QV>$`5$SUpmZv6vKJ3dt$tl-chcVU>Gs`;!2*D z@8%b~%9Fg5SNqTdY%&rtTC!q>0p|mjmLNfIcg`#7 zHDs91an}FVRUACIK`K&y&+(BW5K%Y^(i{?$MXIv{|Fl?jIft=YWM?~rA1fEp^;1i4gEHc0TB+Y+x6E z%066ex2vlL^xuQ@d%O4xJxCv5b{C1A9U5A6p1}A1W^U_ZDroy+O=9#+8#brjv(&iLwGQ{V<+xmc@N8fjR{=?4q1lE4jkZnsV61Ra+-%h^Z>J@n`HfC zHI`coNiA#ph4~l^rMv^uLrsgcw6Fu2m^|w`HXm8aAUc@^ThHBES+bInA)RGBYsDR{uk_53E z{Nqs=#v#lWN_vc<02#0CPnK}i6K@KmNKd?Rm4}{qbFZD*VwDo5aNTyydWhabbg$34 zhv+>-?;(24N7fT>3L1JlH@G0QXj=3ijChmmfaophSjEGF+3?l&{pFmZpD=Xhzix}4 zN?#*J`OLRQ#?>&GPN=#$fnT0~Kzpw+#x3t=8pk0?q6l^k!`Pue_6Gjmz`x7De_Ooy zvD*84-c8TD`RblScJ0aW>-RGQoS^O>ai8^4NNe-eYvB7?>sL`O81IlH=1lMsF!P z7)w~y;MweIF1-9132$eFTfZW_ne3K>C!0q%8@Rps_dsy@*NzLRQfT>q_j%NFRss#w zAB=TGc>(n&!+4ZVM?{+v;xr|U)oW-E33W=6U_?#6kZ7R9q1YQ`AXm|1T2YpICk!>2 zrc$Xeo>0VLMA)jnuo7-sDUob#m9CLHl8EXl(Mb{GMs;xbNuDr^jNrlihT*}=y6>&bWbKa&R;OYCQ#KQK+Zzl}cooR1zb z37W>BFt<#Qvv>2W`MGZhR4>ogv*pIjRQu(IVAADc^%mVOr$n^eQxJ}u-=hc(e|~YX znQt@2wDaXz6jqnZUtcc%{bpW9Hgvehq-yz^EVL{3>0hBwH;#RO(TRtbH=VC7!lj(O z`26+16{F^CKk>zVv!0zV$k_m{+VMvE>Mos@)zkgy`s#h3e!85!zLX`*h&tH$D43|6K)xje5~Pr7DsAEk}@I)VoWXZn6wZL_qYO-R)`skNN+#{71_vIZ_0W?MdPM~isXz0guuIm=&t*mA7$lFyfCA*n!^V#k0^h{dOTmBCLTssB5-?I~i>yuhTu1kz=j*&{5 z87X(_1h6_agc}NMM&oSNkD#-RSg?9tZ0EE=91$CTQe7c7TV>=dA$z$#HZp{p&HH$q zr)j9H68Fp?Tvm2r{yxr5v<9gOkp`_FQW4VG+Qf`p|Y*vFiIR8dYU@)ag`hQ)_{>_fzI)Og%Ajte~u zCQ&e&hT~+Mf{#rXWhBtJCdG(_55AZTNgD);C4&&uh4}P~Fzq@TP9L=CF0+I%>c;NX zjtV*rokawV{T%{20x)=Ee;y2EaWE!e0&p>NpRbO6r(NT#L;6WZ#75xbtTktJJ$2cC zkGEfUkM3lej*9Iw$+u4mv`P}OmfBrLZt>!(=~OPOZN`0vTbE0=!`*3X*mV_k6;yg} zPd(x7M{c#W*Jt*3f*{^udK^4?j3qox(I%TQzFrN5nOt%*?uGFY3Q36TBvaO6FP^>? z#z*|HY>fOuCQh|fwM*{S5I=~MF_v|I0Bt~$zoY7s+J|B5E$p5l=pnvmPKXX- zEaeIXKiXkJ{bNG>y#N`KwLDOuPioQHj8rtlKj^@APYpo4Zr7e0O+ZjUo@+ za$j0(VgVwc#Q7WqcD>lYZM=59cMX^OUQ<*aU-!CTDhEy8iN1ki!ElEJ&Lz_@w!>ag ze>dnrH%-fV-&^Yzx0{+`>13UfHCFFzmr2kN^R{|~0H1E#Q@5&-qurfH779CnEvDpV zV5`x-0=6M;7G?Z(+CqOi?MYd^0)r%n=Zv1N8B=#p9r3ND0u0{` zbwq@a)v*)_=*a(A8fl0v2m8h=!w_X@S_ofSS2}4(lm2CMmWgzZg6m|J~(}_ zcArMY>_-~g>>P{YW_!7ARKv{TwBDnq6b=dO$rA-FbO+t24;=2*(-EnVbIK!~e|F4D z&hYMpcwNqAJE?Jmi9aW9j>l84!@5an2!gZ=W7Qead_RhFdXq)S~8b^#MMihNMa1+xNmLJFZ=zPSdywP^N-UF{E*! zjIsa1QVYXHbHI3NtY|k!;0|c&e+-gEie0+aJfPY%Ts)~|YHX`bgJfvSg=cCyon)ht z>3a3i`+QF?6@igu^rRi8a6--!>$$^5-zWi{EgIfd2D;v{*p)}S$B8OOQ`x5!m5Qg# zwD~KE>_#MA)TiiK;Fb{3Wv5Aa#)6GZ{pf0Bd)bH_P0 z?1t9`gxoe==2B=qm`oYaFo><)B7=;&Y!y1w6v;6PhBjZ_^sx~zJ?mCRBPHnUk*%njf1YaG%|LhhY;RK$!#=nc!+b)03!!iZ0i-kiFuN{n!$~9*PXd2JD18L}>T6pY_Msvq z5EdlKBt+@tByt{BZTR3G>*LCz@$NmASSKQ!M^a3e$)Vz3>T;@DJM9BV&Khh1g0##k z!1{#!D-zp5f7+~TRcF};k(_q@2cVr~J=PI;wLZ!Ig};OSad42FTHr76b$Q=Z=O{ zr@ubgKpx8my3NpII+3QaI(pvj8p+;N7c?qXG2K-33!<(VY=Df zTI_Vvee7?Bk!!(xZMK7e?}@B)-xgb)3Nx^81g)pg-Nngg!u0| ze;3+n=5-E%B{08*2>k>np$iY}YAQO{8A~|LHeiXnZq|3M-wkqddh0u0kKC*m1iNT* z55qKOvk@7T@OUFoVmDbqZ3Vzn!!r&EF2$6CS56_Tr5cuKi%aJ-R4!!XNfi@9mm$yp-6*^qD_mumMeSH zyT#5#Vnjo=p{+#rZ+$XN&qu65f5Ig&D5Z(n6SbAGch7w&mDS7sCgT(ME~a2k>zo5I zZz17Q!VsWJjYVUZz-KTz60g9sMQlQs>-O%u58fW_K;3<^NuP+gBqJ9TFX=i$JGTp% z*~VhPRzTRKz&rWAe(-havIB5@2>EDTb})p~tk-~iTgr#jsuQ6RHP~9ZQ5_$dTof_zGU+W8-}z% zXapM^Lm%r4dvR%{6J7`QstM=|J=J_$7zetnItNPlVANh+C089GVkn#lW$a6PVu@N` zgq@~#THE(~_tgiR@JNT~f8xOiCMBj^KNhmf2_o)f4Bo)p3&ip|PFp6mI&G{?fd$6e zC{o2S&>0IJC;UNZ!3UFIdBqXShJ!reC~Gz6+^U~2RV8$7%9zq3%ab#s=p(u1AP2)N zU}Z-px51%(^dTZgH0(GXZ?|q)2B1jUf>@1eoy5oh;Td;7`D|nWf7C>GS+rU{`{2($ z-2~}&lz_TbAM|iqJ(}Frt@;lAyKmKNn)(3E`VQVBH(MUOwTyXxTPz1*FqkdR2mJGV z^~)wtNL^;lv!o@%7_u2PFe=(a*6)|ItHm2gN~R#|%CMC9x-p-1hwGbpN)cW*MeQwk zN~7Tjvn59*V2nIOe}0|6h-#c7j7a0k2WvGsuDvGGl3jz#Hs{oQ^Zm)o$M?<8kH2&B zGb{R1C}}ha7Qw|L%5@$xncaH2Jpb{Fhx4~ov~+IQ)Epkqap1!hE|UqtgK-{{QG)lH z+M2#QOjAD?C#wt*R?ZO?bjv4|9fB#f^oj1cDq6ZD%{8%CS zWSufCO@}U>AUh$C))He_^oR*BbD3wLquS0Wc6$^TJ*s^3W9(9wWUfqq$c7F-9;-Um zf&iS8jr7slsU}TyvOP1bXY0k=w|P)%rs@6thp*3GKKbUG)0cYQPJf1)_QTgtSLe>s zq8pu_z-Tl)e?imOWO2e;P&>_wfHjc~b`KUvkdhd~IVY#Sg<7Grq0UDVRWku(k%6`0 z4z=lM1nLUt2H6SwWIFK%;?RoTX_zV^pw}4V9Euz^u!eTreTTZ2j)|GTuEl2ZXLXkI z>~HhM+jm>Df=~^y5$exW^PJ>rhefexT6($v#cT^je>6*{+{~wVxw=`NFP3l3TQy(C znmJjoSHBb$KASH!``%n^o|)=?*~esKpuZ{a>d-_nJY90mdnk*0j%Jmz_%SB=m!$gL zX1okVez*F?OoWqWUdHxQr9rll8k-kvM~0(S&p8dhUi>;gf3!NEo8gOP9lN|hH$S?7 ztQV`ze`32>EfrSD&a5W+Y0w6>%E=XvkpeES=$ED``yz$*=@F)xAmnzmZz0tHJy13r z+H^seY+JL^$rQd#p%7NP_3Di%)tkx6Q4-gW1R&8?H! z$v`uxf{-M!P>fPBB^3?jPmmpD(^}RoNahK!f3`RXC2e9t46K%mIpC-u$o58nJ&)&? zf|=!2@|EeST=RVSdNo^%^nV~|o$S~*>zORl2mkmFMgv$&Ns)#5)eiX25uW88$*ayt zpG^`dQ*KfOX!(KVdUX#!llRF(4$sD ze|4}o2KX^1K?tpE1LraaEc^`9Mu~VHJ%i0+Z8T;$Y#dRh&YQN5gC`xuA^Y8liGlw^?aej6DdSgQMN(Vd0~$_S9^#^yAZO6e;OWL z&IC+Ou0)~+*vTitL1?(e8Gbo6AZVpH|Ir<&XXSq(cf|1n1wwNRL@gwMru8O!a$^-B zsVlr!$i;-%dNq^=xYmX@ICnhtSVXs}540I9&LHvm6Vc_3x4_zAN1Ox2&PjnEYCFz5 zVj4cU8_c`b3jE;Aa?1g}3qN#9e-D0{7jz<;z5P6u({c zc02e-$YfqxbxN?Ke%Bnn!r{lN#loV_Rkrx$b}V4D-& zX&;b2Xk1|6T|dn@z*)O?=*zRF4m3T-hI7tT0H^nL+(V{IJ2r>&F8jcIpe!bTn!O^Z!Vvq%ih|6IL`AslJ zmpg zVPVJ;jOjSub0O-Be;bbV&8EkIg6V|Ir0yJKIKpcs!^J`C%I8|gDZoIZv=gC0NfT#l zR!94G9fznprKgLR+%&5Uhh7!5jb67bK`*_Le;lP?2LCg z(3)qw=(HGBq(>487!s4l#A2DTGoA#7dPvPpbina};c7lce*wFB%rd1lSXD6e+j`2} z0Lvt7P`r(P6|uReQnmq|4`DCf>oQsmQe})vmlJ*KEyPTmDVuwVMqwJ88*t;N_doGcOP~TZk6pNJATk;xa0)w1m~h>)T{@!Lo6k;;WR5*}bl^Toy5rG6Y*!_;8GRD_EJ+VQ5&OX(=>^Y4EA?#cgW?_8Utwvu)I-4Xr|J)VdI?7%&Bzno(x0@IC$bGU6T9{g#d zX$t7=ri)$Oc*gtJpC^~JmNKQ3O6o2!Fe=a3P$g+;-E!sS%{Lz&ihdgO27$^G4Oj>^ zU(|;3a7b6|<8k@~tt~!E4{oMI6*g`}NHx$peYPg@gAy%eBCSv6mArt3qv4&Dqd0Rki~nLiCBKnFM@}6bB2eZo$2)iy><{vF$2t3tdRFdqMjzoULUpDR z8y6claA6E5e3W`Xd>KM3f}WSNhZA1EjIoXb!As_bKnl|9rZV-La+z`U{B%f8>*}Z^u?^YL^-?PG!ItAt7T0~POf%UjQT#EqnzE5;p zCIIGO&)BH-V{IPk@P34(+BI{QZU`|5$iXKyPzD8=PBB_)&ezKe}`rn zw|t7Dc~sveJlGiArFU^$8kcyAb5>TL5+-($U1be`dDz8ER_BQ|fEzFjGr&!kfENhq4t{OyD9DWPe<;*6WCen_ z{(E?VJ61is0CloH@b-nm3(Qm-J?kUG3yg2DvEiz=c|~|Z`=+ZZD*ngI!wcFEwxiW{ z!g7@01x~|->!p&=mf!_@-+puN?Bc`OY74Rex7jB~7MKo2$JMq2zl6@-e!`b-_!K94 zk1SB8#SUa@)hcfVQZKtQe{J~Eh^uD9_#+|T9WI;z^@dYCb+!$W{+WwM}1szxOSA;B>b~+#SzaC_P zn1321t0_#uEE!Cf3XOD?Ua(+7cdK`;XP?hGsKuPrzH)LJmXG|+NqBog{#)&(zcPS;uaMSBJsJ0)28}d zg-ariW4Tr8a-G|(&Q9x6r8~EJ_QCHt|B0wvThHSZk2K11=0Pj8KRXa-tK*zeCieoD zgIpT6mBW}Ce_zHp?8*;wz*cz`zNkO>x=C!941%g+WVGCxUTB^2MIJ+Um9|oVBR1SL z{Ea>K;$^L-K7UEZ1)wa6c*1xpv}NO^mMM*Gdm*zfZEx?izpA$6bzU{oeee0LYmc94 zReaY8@9`M9e{}Zd-a(j&)!FyYp9bU^D@*`p*}icIe{p{JOBOy1Do2^-1UuEUY=f( zY4Fy^>Yyi=fK*24vLV)|MuJZfY>!2IOHIFf8{}GVgE$&sQurUeJU#jE532&KSXB+; zicR-?e;gY`G@7V`ADnDz^pyBA`sy|>uQmMbPuEwsdAfd^FTlu<*X@$~eZBjh7eRN!69?t3kiut~fWm?x z`M*+ih@+l*ifxnQ%=>y;s(s&5*W>%9&S@Q@e@-K)?HrvDstOX9g#`iHg}ig+uC>nm zGoAC)V57m*={%`(W)XCrxl-3cC$jp0rC%lGs>z_m*!jqB#;-dJvArmoIPe7|94Hcg*u(W7X@}nwLSTr)|t4tzx&Z#eo%?U25a#_toaX>fOtnDZJw158mvc%KZ6t_ynn@=+2)0 z?e@Xpb)}=;y#M^c!M(e8uZN3%zJ34tck*jss{ZcAP3POucQ^QGgHIgAI=E1;)2W8r zIFjV@-a+r3OucgaR)}o9q50~S<1gRif7>g!4)ptrWB#KwxbRNWfD{( zaCxAfQMk`|e2gBf&v&f`N3Sb1B_tnl%EOU^o?#voPn|0@>glqb8l`?q>L`?DdQ?nL zw}s0>zg}gdjv~}j1NbuJ-BG70DXF;2qdHBMkz(+3&Y&ARf1nW) z%S1i8xtx1bPwU55tBP^VppU4XskoHt#|&m5Rv-vKskMd4k?ZARQB_B;>nLe8GrlfV zb@^Tcd@>k7Gok!e^*#3pwK@%WsBRycln4@01l{h|abh^&{+|``)3}(*<0oho&7IiR z5Y+<1qtvp)Mj~lzF%HMOU)}D9oDB=s=j2h}uX~RnsXy!mHoC$9jzoy;F(8e}Q1Ba6mxu z52e@K?9I4GT6NegGSjYiFm-De3bEon;l9yptiD~(|A7-J5BLZ%upc8z-Mw71o@b&{ zvpUpEQC6cVnBLm;tWS!hbU+&=GB*pM&pNJ9J?i+^@UNux38ADARA$jRaa&!&3o_J) zMSSBX-K?SW-eJ+k`H<$ie`(O;KByOCOE|j0FOLKM$_Vp zZ{Mb;*+MO1kthCFDLNey!jo_rmGFvBTR~)Gr*}e8`=WRuvwbT4 z79zl+?_HS>K`^VWD*aC9Jb%cU4@qmxEKoS5rzlNwnO06)M+o%EeB}eOspDpu=~l0N zK5FX)K>kv%$=X)kf77wsmMUzf)~$Lc+>SSLA!Xd4z#;|(Oa-9e)Vy^~pPHXAC;-i7 zVGR2!rwIxSp_`2A#*EAbJ>hXPmV*MYD@L^ky}JI6Br+*1oor&jXGX_NjckhwXy1Gf z{C{{WV08Mpg17woxWd10T)|YQ{kKG-e|>QYVPY(!UQtczePPhiIRyFWb6^<&(IeDT+ zs~Xx*$2M}6fRd&`1hKI6eV}kj(TmgOGeQ!AuU(I zF+i-*!aXfhyMpK0b{f}(atY*8ZE{Jq!SHV)v`_^}Xig${%Ai!W+=vT9>Gz<(6clXi0>QL;e-DC75Yc%&8fdile5>D^JE#Ea-BHr- zDaM=_0H_twa7!`C<`x?sj{WZS`(D5IR$s5*_xk+HpGW*$Z9S|? zf4h@(=S$Slb=B{tuE*myb*_y@P}?~aQp&Op$=arL=_IEB5WRIYQeDdvTyC^5EzD%N zO1^pD8l5L~&W=RanKNA*#w;B%m&`Ay<(HT_ZAnC(wsFzMnX8=)vgg&Xi>;tmURYi- zGjq!1;_j9@(P*dHa%?j*+WPX4e2wp(e{HxeIyPo?gO06trqZ!LzgT?>o4u@In*_&p zv3iq1)_c%v(xdxWy>nFc8g{Q?_ZoH=($;@V4O<`h`tVK4N*f$o(!{c)`v~v02bNLC zb+cN#O;2iainr1;2(vfn8M;lSXTXH1AoDO{dPaculy2_t3~P+ zaSW_I?#Y;x0}jFhRfn5H%cWX1!_#isoX4qEYMbX2*?`$bHgT=CRjp{GBU-2Lj^;Ci zG>8tMt2OI7)w(oG-nVi-ESIf@f7tVOWyO*r!$DqEsgws1`+BKHJvUXSMu$49*s{OW zPOBSgSLqw0;lvH0rk-A=Q8z5#rBRcHJ1{S3dTRW$ZdhJZs!W^NTiU3w4c^Y_d_I{? z=2Xan)eCp$a?W4Sai@^sWbSnFcP_^>FfQ}q0;<);EOX-CXyJ+0c8CG+f2O^va^<0s znL+O2I9t-RHmK|MBWxIQ(xVzCE6RxaVH=D9)z9WL=x)g*ical}da68roySQ_()hY1 zCWMheIX86Om5-gqe9&|nY#k|apif7EEen*zY&aG-zpSXz2uiSHwpb443@B71t)l^E zfw@xIV8xiVruEg>*M?E{e+08-27(2tv0(*qAQIVz-c8j(<03MSut;PVfUlNlEM9LNVU~=;dOfD49OITqutB=BQ zuvm?#bv>R=m+k!srmI?~N>i1%UnN(-NB!5oJ>+Zn#^Spfe{-HdY3fC5tJJ)%YaDi( z8L7CJoMX(*cXQI0W3+&5zeX!v`@q2pqfs|pq$U~JP!fFe_jq%3p}|>IBcmZ?V;Z=6rSWB zwy>+s~O`vyyPCEm5qpLgKlh$2&SJ16jkKBeq^@XM81h(@Nhbazf zlX?`dty_vRbR_dm$*h~=u^7&iVp1OJ{pIK~$D#I35jX9&664#q>1j5=g=o~tTireGyQr@Jh3($<|RA=XRuBbgK{W7JbJf+=IP+~v!iz>$9u=? zvon|x)*Gs($j|rA?|eAFSij3JLraoBwY&b-e>E<5oWr-SNl8W}9g=5wPWlPOYbIkn z^Axj~m@r?I56Lk+M0uT)O+1?|q{uu+x8pY}+`>cX=4lu$nKXE6H!Z{EKRv(wN8H_yp~dShXnQx?wgCPgLp9|+()$&Z0H622;RF{_b^3>yo<88 ze+rq5^L-c@r;z3gcQ|N~tiz9QKe_(+;j`;c->y~{`)C;BKi$b@@nn5=zW-u!v*wpy zCYBQ|w3LY&e`t5sk_>m~(PDo=O$!h?)bAo~Jul=@X=h-2G%R{#fB9u-dqg{(`eUE= zqIElE^y*L-dt_LjZBE|2$xBdXv4wxUf4KYX$-SR`I((w%?eMqN*~N>y57w{D!lE1P zo-p`R%@dye>mqG3EMg2jfDQ|k0O&n@TJ7wPbnq+}(;-+Ql!rP0@l_OVDR!F}mSe0T zGW$mCI}*mc#my~diwV~OiHyX-**6%bHTT$^#@1iXCRE*#^vH2-ckFIMzXAI}f6gRE zIVDj1{R#EY70PhWX2-{&164}G!RRJQXLhlQqM#`WM|u%GS${Ztb#nG5?3(&=p{$hK zo6Y*4iPf+E(y-gZ#o?J#-CBH1^_SwV7EMTx0(DZ`(xqQN@48fe)stL5KPlkz^zHhe zVIs_ekg<(ypa&f4aW9&C{Q(FODwK+yDLK;%(^cmOeZ`=a%({ z_p#SCmn&0%WAI|LK1I`z;w&&dJzF6M*XJh}oQz8Uh#rQDTvRjx^^#Cs^a3?1yjD9I z`%7^-xU%g6_5~fv9_X*di{REr)@iP$}e+_S8EwUE; zT5+sJBTA3X>+8r$j`g>z=2S_?TbP5m?PF1^4pyh4y-MTxdiv`RvUvXb!}0sQdoONX z8}QqMljF_$eEs@j@7~$PhqKkU-{jgetLxiuUavQM>$8{Zqm9Vzy`!^N-+r^VIXVAz z@96w|b$vGPcWyrpfqL^GQ{Ov zhMYh@#2(#&GAu0S@bLctoKw9x&YOL;{K(E4F5g&4A(^Pu&%385fA90nUj907M1TEc zbb@BXebn>8@g7g(e074f3w8|7GYv2CC|Eg7dvu` z1*I^D;HL)&pQ&H`M*)9ApDDf5k=9$D5bD&#`4g|NOzh zy}Ng>hl_r`egFD*@@qI9zq@hM`F8Z(4L*9Ig{>{x-PfnCY31?o?C9mGl#y>l<1{IF zMj-D%r$aCJe~0GIi^`n0{)4<=rOOKBvpBe~r!YGL^hQuehf?iY2mz(pm4u*?01Zl0 z;ljz)*Jrn`sqbdmmoh*L*voL~vG79(63>27BfIJM8!e)`rmNmQg)xoP8{Fj+lohl5>sN0jtYxibN7grzY-Uj_|FH!q2J^8^ut zH$lN2VSOy*ANR%Myk2bqQ%{}91V<_zT^8AH`;te7JDkIZSh~#L{xY9%nd;6<*9#$b zf9hqUbcjp6elDxs;Z)Tdwef<^-SvPF)a#V$!-&Hf8Dk7?<6+Ll0;60Ilt6|MI`Gzc zZGV}r!JMkd`Szq9Y22V3)$nM;a0js>MvH*toGUwb*uz60YnWmv+$HxD>ElZO+AfGv zQF+rbP*7eTslum#JC4w`@asSTj-4!!f1}GRQ4jt`nk>qu=mkizrH@~z?*TW+vLd|) z$P)>;aSpuiJCC>voAX=>C3*KtuEAVwfssoLz>D=vjdNm5v2Ovt#3aQjVwT#@h4y{A z&^&aB1-+3m;FL;&tcYvewf zhsb6C9W3}D@9;)O3DV}e&Jx92hJ?3=BskE0_8jll-1jAL2i||YoWkh4aJA8TX^A70 z-oj=*$G6_pcZLW1Z~;~XRZzwVf1{jZH4ai+fwNWB9AUCx^fMo`Ww1G)x=X zn#lgG>G_N`NX`)srRgN>iOS08+;dM$W%aVZfvlt7jcZUjspqJeSCDX1z_5~bCKmfl zmN5&Ow3fKoLw-t_^cL53f9|`d-tO!`-M-PK@1UNRV)=xwhu~?E9)QPyt$?s0LMPUy zbMUq4vQcm(8Xw;*dZc#NWurrwW?cvJZdI2SdX?z1Ijmq?sV~+byd)%O5cJ}JF{)A= zzqAFgM(2|Ah)K$7w%AWICgyzgH0uEwj2w5ENZ{dcL2PTc-a8myf3jY=7y>Tk#U&pM zM<448e{tcZztTrF(QOv3md~F0 z)1{kex-BK3Zq-vgOshMSySi2H(Es?Yx~{2D(5!dx?zq|Ff8ebk=Kg+iwl^d$bo=bp zW_|MN=H9(WPjBx1ucLSG|IgmLqvJA;(L-&Vl4ASgi@G0z2gd*Ya<7~n%CgKDKqCya8U{r$5s3#O?s1e7)OiX<+ zP5KEM85K-Ge}n-_qu|%G6Hq-Zz7J$-Q&H%MQ;3gRAR@7*y5xBS?1o+(<3S1Qd?YofJC*qSO82p z2*2IsNAFj1Pl7o%;E3Pm*FJjv`h0bf85^xH&y=Ayf0w^JJ^Akss{#Pp;-06+N2ja1 zN0Rnd6ZnrhSweaJc=}=6wQ|Trton8gy}r85%gZWg|8#wI*Qaa9mjQ1zp}guxy(Q!; zj<^LiwvsAkSR*k-{qe+#fj5e8(SB-fu@V#x3H_%q7FmXYPhqv64+de*HSRLb`LL7B-$JgDMP~0@ntr5p_ka9kbKuHA0+n$ zl+kWgA4$M-fjAakVEj`U7d2UQX~y)?h7ViMnDGdd+xGM|22Kb^uyY8NRyGA+hROO0*}uH)_ElKitz08E{(RG zM$=QzOm7;qoveM=O5bg(?x|#@L5J`^-Y-mI>ZVHi4vX9M7RJdRO)#}^8G$7Q7il-K zS#o;vJ#hdi6{B%UQ370x*pGT+R_38?f1_shy)!|4-DGeJlM>=!TdSiXTLD8^fS_&3 zptS5r^0rG~36_!n4o3yvd%SacTxti{6*HZtwQZ|rggu#rjAV#$vO^6gKvGvbEmqTI zhS(EeAAb>h5^Tqf3oxT zHK<20#4KG2LxU&VQL|>}72VwRpIwmL=Hn-V0Wr2dU;|=l1q5c5KuqKr0u4&iX z+uiyLSf3=w8Okt5faPv6&1&iCZSGEU+qO~DS8s2_+ehXNN;1m@q=>PXb~MD^-tN@d zOD$w?Z|}I(7JFNkb=$o?1rvmCe^%;&gE(%U2^`P@dO-WJF$1|i2a zwMbaO`f#c&fJ-&&ZtX73k|h=ZFr4rZ>r(8X&Wh7p%-h(wz*`UTr5bhjb%#dDp18!k zy8C*!trkmNf;mJFB2htwddx5vEK{JyBNh{i)ViQeo9pWXICaEg3sN&kf9+wA0mc$1 zHcKh4_7tFj{ffi@;H4ZrAdh@4S_fkwfSt(ULu3et!-U>bpP~b^7@_Yu5z~c4v4Qy5 z+keT3$$l~E#@3BUOp22l#2D%=X)4Ca6MI*RwGbx;rzPkE038u?JiS3Z^x#GC9l6`EJEyjO;De5t7B2;oxU#M}6cySd~-p%g4o_b7(7TZvdnQ&82J+|I>yb~#6yES(C zs;3_NBr(gN3c=WSk+C&}c_|UQoQcXBE;; zfB*KI!+*VBZ=iE~lnCD-fIB%|oi_v81ih96+FZK_<+qcaRJy*qois)*Y{PWO>_=LH4px%n3B#U(Gk^#Z__NSl zy1#{)M7w0`6EFZfPBOGB)vT%p5{{@jOwLQ94K-7PnpV?S_ z{=k)<*1nycSV>II6|JOtJ1et!UIZ!0aVjaLtZ`_XXE+pW+1GgdYBPzmO)@;^9Pi}+ z@qbc-yv(X-Jx($=XlXXb?BWX`*Ywm5PL(AaT+e{^Ti>_eMuhnMq1g$cM zq5@qOt)#iDtCG>=J*~-VYAdsQt4X*fuVyv*s%L}IwP?#7|WNPwHU=}NV9|($@9E%l-KP%rnW9=xLx~U3(%~OA^>1dl)Sm zL@x0SS92WZ&oH`)Yc0gr- zf60K&h-_4!^g>xf*oP2$0UXIG$Fmm7#=~N1t)U`lRQjbMXoNK+9{+-JJoIH}EhTek zxevIGFa$s{@Xy5i+;&Q#AzgsShLg$#cx0+F--%nNcnj59LnMky2^qm6e@g8cgA`WwliqDisQJ`1qBb2nRBR#WE}%Jq zFh39bmXxikEmU$t)-+VIg}^nD-wOi=_IQb@DR$_OwS|l?@uQnR#>ipY)C80IkWn8p zx^=CzBR@;?hrFM=C;wW#x)ZBS1S3NQBPuytTf#wt+bx79-Vp{2vGXMZt5 z&4aBn*7m`s=b=hS%^TQp!1kI!VKV@!F79&Itg0ws(2+As?x>_|qm+a@e+HJrF{&q6 zZ(^gaBU%oXKfZdMQ@2EYRds~QTkC3cMy*P@?)4Q-iuz%H7WDn=*I~vgT>NOPHvv6a zgq+B|+P1f3FJB^Mw|=#zd9Lgz<-RkbuT_$6&E80@HEp-X)|^Aa+bCCWNQ<~_vLtU! zzer;zyc46w2XXa|c<5{le@S;Er`8az)D$7n8sH`l41=j{?3#~xNmYAK4#pt_D^Xq&f8s%^qnYW)n;Cce z?MMRsfY^iI-E^HwtpZk4QE@tu)kkI5EPjSG(8kP0B>?oa<05^q;x%5k; zi`f>f%GBeXwUk`Ui+$KcRGrRjlK%1c+xP$9Pxqf6N~QW7k$;nMh=2V1(dn;`H>=mH z&FbuUWimyQQ<-qZ5`Vl@fg%A0s;#g>uJGiYxRIHG8Yghkf72ixvjftC3Kh}}l zgK9RbH)pTHnh#c0ry}xV(dh!1WbRk3vX4{%vrk0W9KAZBU~3zOwXYadQ<1aEhn1;_ zo@7-QCEqjGe^nl)jPj@iCFisETy=e>=oV_AGB)mfk*NmR_z;yxB^%;&#O0r9K;b~5 zC^kHuRD+@r5vmlZY3)tSmGy7{WSZW81ow}z2DW4)(Ef<@@dbJXrTs`5$YQgxb-*h` z)QB2^TyG29IY~c8xv8?EhOE6%o;LR-O21Ie|=SM9q6wP!&MOoL-h^;+fpZm z5OaXp2$tsNUUh8A9-x$;Frk2V$CwHzm~f#T1oyfdH8>pG{5a$)v~9XF{535%g&bHf zt#Tcj3e`(UJ}Xoo4618;qCw=v=tWQFOe+2+4*mRZ+N?}&<)8qGKz6^H?9+Jr&Y2^E6}N#8NU+ordfLvs|q|-CmhFoa2%= z4*Qa6livqaNZ8!7trB;ht$SY_AjTuRyYlrx)*s%ytzLA0b#bxUoWDOhcG?Yrk7t{s zGpEzGh_D$^fBxz(NrUvg8N2&OXK(Ih2ixlG`{z%qGp}O={md7;;Om`vSF5eM(Brmx zxE2vzUG)#wB3!-iQxwoF*N5w;XGib7>;LluM}Nz~=IBlFV@`RD3QBO6} z?b)qsJVjo$-ZgKwOv|TejU)?sIZp{+6_U34E>3W(+M}&caiUh$r-aEU+cg!;1Ody} zCvP6S+5B+)elI&2{_NzkUJ1~tz~dJ#HAgn zw2v_h8xQqL09V7U(>TWxR1zvka?$pb(_~2rUttyFe+}HR#Jc?#uaCoH{XXp)KNNT2x2Y;_h)pfQ%1?c!ghqY~pn&TFw(<~X-&7>qcL!f(| z&7P|?ZF2=Cr5yKKg;8XWK>Xupa!fR|P*uxXQbn=`nUn0ms6Ay;_hk(g7gu|qH|j?G zJ@E)xv;>#qBmG2-)H;hdT}l)}Hy@YW?MyW!FA53T5aG`}eMIA!#n?K>Hh&UmE9`;X zBkG6>SG{mko3}6<*c}8^UHbv3pH@i^D-A zw^#~GWcSA%4e$H_yFfXt_|m@ClSTuIv~*>O4LgopToEFvipNUse{J8=XrKwCX$g<7 zz2zXRyCFn_S6Ce0sRk~XoPW*u;=W2(31Y5uH$FAoRj?YOArykH^K_AL#^gbk9O zFWH8*x9ns%+_RQCXvI7DG9V2HnN-EcRYcO(Pd@RhhyH;o4n7d0MjWCt3ie*VWE4o^{{f`XnBcLT(|g4~MBNT$#h zFe%FpY9vw=H7@>EyM+RLX!_|RsH%^d)H3(4Aw^Bw~S+gEr87#_d0Q1Po+qM(q)-Q z_IQA-*Y+xn1>{z0ti?d6y=ONg;VPp$QiaQlgCYxXcQy4Xjl&dGu-GO|x2R!g)<#`} z#F`6Ts=L=)FgoLI%-p&VlXI;OXceO^)I~fhIlmtm%|U(*T>9>ff9d z*+zDBo(4}j$DblDr@Z-QQh77TnN+-|m_1!);gc$zW5HGzi)+$i7AQ)hdPnDK=j|$U z;OUz90F`rQizR~ZL@h6)aBP=Hu44D`3?T|IBECjUcX`E*oL!9nK%ik41DqxizF$TYo1Z%Mp+L6E|7yEovt;Tcd>{ zRSAaPI|J8owt}siPta(bzx6){pRG&Tki%H z1N~{U{y+%*!O=M{cIz5p7(HPs1}f@YL8oN4Vq7pL7D_CsM2S=iNa~oVqy#928COdw zg*@@nQ-425;zmSMe3nv`tCJ_kFAF*-6-*7+WlB($%t>8GQpk&7A1?RHqhYTqo@GZt zT~*FsF&r5{b>0Ex4sBH@RBymI^b)K6_*|qmvTGUQIfDP8t;TE&g#0cyXdXNWFP=b$ z#MO#il|Vy~iS%Ok=;pRSq^}+q0oQhPar`zfoqr`b1-JC_aEPU1RI)e)S%-Z(66H)MOmvFdp2e}#vLKA`asY{icm*U=3W@CB zW`9LOXps0n<#lJFICaCF1<3V#m_Pz+3{(s3)|!G#N|c0=*eZLHtdPqgUrC~B=(>lv zJex}fE-tb9ZXf-=+B{gjd%4;K5%I;zj*q^Xt=FP`^@MEfn-^bsgSq*uS&fVl53vg=H(@%bAe!dI8#W56xbzDqM z%gXoVxbWjW`R{6j9xqs{Iz1j_&DQIc8lUIBC^cR?1Cx+J4WKSI^R(~!X*i^+1?(V{%jBCtpX22wM7gor6;u8d7Tp>lOrlV#_5iUtk zIgiAkahp;o4M_QqL{ZicTikm26xEsZWqg-b@H0~gJ+GF{Dm7Al4VFI!mIHEA_ng$~$?;b^Dc>1EyGUl}DC^yQi8-EH{_Qfw*;VxcB|u%hM05 zeefdn@_5^|O|lrmk|LU#WbsUh%`sM>+>ofBj|NRLc{tn$)CT5i0-_9Zl7EG_WVLL@ z3gUkw!s&~-RJ!u6x8it2c}&o?!m&b-+NY>ccGGwtHy)_GDNr!Ds>CT(mE+28n(Y%N zAIU6J0|`)R=Hw}nnBefWjNHRm^tAj-xtx!3;)Jmh_$a`o@Ck3WvzC%+H>I#I@KPwI za0)=lJ#yNCesf`a6bWD|zkieoV3JLk&AkwT37nO-cH2%_;Wrrxq8}BU4(6vT`kbam zuQF4(lA^dA+$6wm8T$;YGa^9X0!r^-tildWejxLvVQqxpgRC)k7QfkhJ2;8WDa+fVRMWPsf$U;QLK{oJyQQ}0=ODAXz7@l0rv6@TUST$zfe-I%-5 zV9K-BIoK>+SyAaXM=nm$QNbGHH4zTi$;2>}YI$fiPc8d~!g~uFDp>)=v2a4;l}JO%6AsR)o75r z%e*e{^m0nkueZh&G7q?;g=2NVMN&%#ttwQ9DI>?mH=?{3@-@>hLTP=B>5*|IG$p-~2^#qc_O z!X_xmeKxERwN}YmKcNJDd_>OZ=IDK07~tu9S({>8MBS(z$P1)I_~7iJFLl zmH(PO8m+D2bO>S<$On-JJljhxaDbi97nEqp<)c2Q4o)`taZvg;npbKOi>%LgpZfOp zhl}-3D`(9=-hV(HkV%#BG7r~#Smy6OoE}M2*$~#)YOcX)WO3I43j8KuZWqFpO`Ucj z#Lz<|zw0p~(4qSHd5)52Fo$Fva)c;$PZm<1K9;Q_Rsm&D33c!@sfN0LaS?IewLZ2! z&oQZ5`C;a83G zW(h~PMpb*mqe?rlh!UJVUfs@V;N<~{dy_Qc30NeP< z>Kv-h2eC+_i4pXk{U4%C>plCKO5c0-e^B1|-hZ<%2@O`O?X`S69-m?Squ26#Ex#Hp z>plCegHyd{Ka=~Dqb+Jaz?7Y-`3sW2CR^3~A?YB!qVF8Sy`q1uhw$_eo>HZWmLSMp z(eD-g9>Q}?hMFe(&C2E8qQuU#6rzg6pBCf0-J=Yf1i62pWC;np?vMP?XO zI3cO2<|OJa_u+#pCt?>m|8UE+6Ty>*w-wn#;%;(L|O;HO4r(-bU4g>iy(?PLu0yRN?s`N&MEe@N49k&V{a~L+a=9 zbDGQAjoQ3(QNMgjE!4aGw_Ddr41ZeLPtGC{5^|q03xzXOZiTZ2E)@!tcp95lKv6LV z^BF~BDc$H2U}=?dGL&+i)Po(2B}Y6XSt_Z6mJ~+n4$p@m+NtEXoaQQQ>5hWa1)kyM znBuvxl`knWYKinCcvQDm%L!S}tve5&;+``phq70x(UN1<}}W3H=Xc zhw^e<BVj|BSyDA@*RVH zm8!?qyJ$9QAA0*-=YO(xqc-kb0oK%o-r{dg=uLhyF6g3gm>+tZL6$k24+%%jr_=z= zgDRz1mr+J%#Kk0*M#Y+OR`j5BwT`{PMNMI{#e&i>1M1tjfjt|08xY#z`pIZAgX|nI znHLKzf^QV7nG6YVf%uxDB});YEyZd|Zgm|lL)EsuQ#mgw+J8lH7@}#sn8Y9zq;(Imk_% z4_k^rPWH2+%St&fybHs9O3u!~c7VMdQL9M2yT3 zH2nn_UWs!ZR&TwV#}>oF3^0D2C-)Cr&$!l)h4m&4sW|UqU^~EW%Bw> z^?%HpAijPrZ$=B_=O51nmZfh>kqu4cu4Y7A3aX)wOE!GXhH4m=zkRBqmq6CRuWoTW8@_D2!|i1iee6{LXp>FIt$MSl5Y_Cx6xt zD|uVCK-v5FG6~Xk6kn^~ii&S*SG=FWXvSZ%6KkD(i8o2GwgT(?F3ZE)a!3o;S6)Te zyEG6bZr0l%4z2+hI?N}0b7BSY+KO(sNt#;`zG6VXOLl3;YhnC3N|X2&v;Fg*{`{xb z!jLeuO)y9WClI}ptW~+XRT>6)h<_=r!_Uzwv{r0x+XOzuJ8PF=MFqmtf~Q!p26?9! zAFQXpMlqJ2S&j{?W}ot8`%JwiT(;IWO|GI%Xys@WVm;k%LYT)^oM0CDO_1Ze__-QF zPAap~@c(vEifP8cN0tYhjl^AvGx_4}F3YXUu)=$|wyx6TcH~As6WF^*EPuFDqN_VO zq9BpmV0D9Io>>9lW9nPDTkfnxk^n%6-AY5TTfotYmG0sKnRyvM&O=NJyDWx^!!PVr zwYsOPwkDkzBp>QM&*xV zd+ei|GhV5KC<4Fy)A0&NB7a3he_E&k7>>`z)XId(212X1Dx5Z6qo9aR0#=)+$p#jd z5OCr$&E(7fYSe&HNR_Zr8aoD^zn$HcYSXx}@Avp`SXiO(vlQDNh^KCDD8`tAWy#a~~o4%s0YN=zP zzWeyg%X4Lg>VG(aje-mkuP*ySr&2UIlIB`Ve2 z>1N<;we$$91)z)D44uXnGx@b(?3=BC4MmkvB?!h3Mahkp&8d+bA6hN?zk$c%%j;eq z9f;O!k%3UlGMl=ngF#Og4E3*AIEWJ%Fgy!7cK2kg_8_Nc!nv4>l0vNw9BeM7NM*G0ogMNSP#+yhp}r|uBmfJLRONeRQ=T%ZB zo1$NhK27#tI)$TVX3C9#+i~o!MTl|u^?=5Um09QzP`aL z(dcb=IwyV%;rFW9s#+w)Ito4gnUKaftq#t(?s!dbcv)gaG_ih6N%h)Ux+tms<&2U_I z52X{uy-Q$2QDo?(Yu^^If!OkN64RO4Q#4*K&yc4*#0R2+GE60?`xc-MVg+_D8lo)Y zfuIgZ5isd)jz%Rb;b@T4%bKa;wiONgAb$)^B+cX26lpOuoMQ@&l%F-u1$Szx7dS(k z!oKkei$w51t>9_!Gk##kurqiA(Z)~_;ZnEg2jga=P*Ra1rCWQ65C++w?t?eX&-8+# z0^73*-B7jM433J*io!QN>}-e!*)!<9mDz}!d&c2H$Alhe59kVXOz7BP2lxT#x__G= zFvFZM1azZ!{7Q4@E)R8J2}9r_2JS+-DeCzHIYJ*hRv->$37m;=GOd8<0&8RZmctht zbMRUoRvk|MtbVGer8{0ja)`v9z0qycOZ840K<7KJ^zUE+ov)m!SK9m9dPg#wemZx1 zyA?4<5T)~}?f6UK6$9Eml2(v0AM|p@3}`kKl>$1g9M@RaX$0!txrQyJ=FdIfV}GG)HFy`X zf+}*x$h~v+I??GcgmNRib0D2C>>Ef?V}%ABB*bf^%NQvdOeLTI^Wjr*y`oxdLiG#F1lAbx!u)cyQ<}bM+G{9%mrzUCG-18n8kciJ1NmRZ`9W7>D-z5)fW=)=twO(-wUjs&MTPs zW(cg0UVrmyn!KxE=c(2b`h9S`7gQ~&-v{bmDAv;YaiNYNcCpb9K!5Denc?`U{pFNG zJ9qzJTHg!m!K4mZ=Q<1Yt1P~pap(F_O5Y3Up@hB{eh;PdVW1<(T%h|Q$eii=?l@)t za5CQq>fvNQbxS4R)@!9>0f(1VG55A+^P<3liO5?3iot*-H{UlfToWucdgWEB=}65F)z zm89skzVwjNCw#WJ?RUmHCsl5F$1y#cqiyN2qD5ZjN>XzrseieW^xx;JG}`9cJ}6Rl z);y1RmxnqToNonZD}tD^gILd4q%5w|4#@AiOXU_e<$m|PaTBFPh*RQD3)~rj#*@f& zDHKK-Z~V@gh@1@gdXZ4!ApwgN#hyiJ={|1!R>NZiua}Wr`t0d0PyQZ~CJ)N-_W|Y8 z+q`(8n9RGx`hPh|Z+DwOyv|gaCW5q4hJz4ft|S#y;F~K+&6T9)N>at4RLTr8R13!F z2(N;;<)_X{DKb31`w#EY><9fF9Ynp>(G>mpq`NBv>WHTc&z++-4Z$QLrf8x~bGOK2 zEWZZNEs*OvL)p1!V_-TSPpmg3=KHwI9C@-bXn!KHBJ95fu9fs0WUI|QAAckpU!DRy zGG3m4Wn$4fGTH@qib;RXCW^zk@ZQ7xfeHD(GE67xkvod`0#tXGK-wx zqkk#)qmy-vqHmIQz^d9FdgH}6UVM|RW0G}@qHnzT8_`-{W}y`(9{N|>zESk=aAk&3 z^s5X8GI1BX@$MU?-=ywb&=|W(-7y*Z@axNu@$Q?{ z9i#OBKvFPG>W;|k{jQlbE$fZ`>%IHSfq%>$^m;j(&fk@wkBlB%kW#0+FR64l3Hnm` zH#s~ehsWgbm>eFH!vjU%X!%CVH(I{Y@&`*Jjh2rjiSK_L((+MA*rny86_2PLEW7XE zCvn$p)r+UD1FibuFDB@LPc`@|Ki`{(JDVNfckCtl@Zg?QQYlmG`LhWcP0&BF;(uFz zhC*IQfT@o*`r__LG6pTabth9%Cm>q!%R-%o0m$oZQR;+QqYeJj!9}QLPyVk|Zu`^c zFwV~|H?KC)>XRhkVj1s0{PgbPr{6Aqef{n!t8{D^zKT_ox=x!t-l`?Na>c)9apl|d z_ZP3o4?=ts-KMk2j6dU|6F* z{VX+EMiW*I~L*Er1xf_n*7|a-OHrr!c=sckTI{CA-TFTBVgwB)jXI z_Cs&NJP*@s8>}?TEbw}f2C-(fr&$!l)vmDV4hLZrUf7crl4ScM^-TAj>xxcj?P@in z^YA(et&gwSW+s~?EpYHx^nZWDzY)|w?WBIbWSqZZME}I zKZk!L>F=kT=vws&fk5c#4)JXUVBRL5!;3^_f>EKXnzj+enX*%re@^keaN)^$xN zq-t!+sO8vFzpuw-0yK^9a@sB=M@HnD|BDXk0*vVRT$rfCm50Ic|P zduM7o7xvqaKdiQ84j}e!TYo>hoLJ{!Ztb>K`0psoqxjlF5524CdY1-yl*HECAP%m> z)LMt1qg9xxfdtO}X06nZq6tFzT4?oT-%?k>}4ZGWBqzQc>BXV3qYfX>z@RuHePFisN$O7ffV){0{5b)4_w(0ZDM zp|yod6s@f5U9=A3RcK)m88jfVG%RzKJijfLbPGu3P?-QwOi{rS^NZ2r$ci$&A@LEe zt*az$&gz*$foKag5M1+*Xm+D=W@a}G=gRV)3Y%Q`O>s$`?SDH{cI2q#?JZ$lQxayj zw=})c!wJ{zxVZP5D8k(Ic9(PE1gOt=ukkHy?|N?JC^p`E@K#sG_AcB8PyZqe?7|dq z|MCnUy4A+^W;K$Js8ym396558?SvXdV|z1}Hi#NydvEg!Nyhem(shIkog6?XR5gD@ zE@^x;%8mAo`+xFkn}oQ!jqNSN72W1!hlN*O7&ByhOAWu)%$eLgiuFAP!lY?R5S_o6 z(J{^MyfguY&eH`Y`FX3rkE8|%im;z6Kv(!(*8jIpA52O{`VNk<# zhm{Kp7~`w)h%t_i`_H8%4RC;-RK|7%XM|Y`7yHqo$$!0Otut}$BFam&;_=q(LWF#& zLVbu0JFTf+IbV1?YGb-Kf-1s{eEI1*Ud!N&2^&xG(L_*9*jTGO)&jzWjS2fRVdJxc zpM>%AkLQB9b2_2X2rXGL)!BrNn|;0iTha@R=^Dzi6T?rm{KS~9ja;qA2piWbwlt2v zlIbe#hJS}NSnmnpvCY)?TM-EkHp=vD8=@-&b@LFB(%bC@DPst_ZWF{{qc9V}*|*Uu zO|s-FS7BP%nd=ay?k(cE2*FyxY87tt0GVu78fBlXP53!PY&Su)c!NAa5${EyH?}G; z@j8-IDqhX98k~q6Z*WD8`U8GmCFwRnG#i75S%0!i5yiHmD=R4NVG-i3W&=P)=s8Z} z=V~>%TKAAC?E1@|2rqPfVFFdD)PsrD{>1hD<$UNOQ+v_~;no&$yO|}?99g8-TyaD& z1HXW|;;6dj2qfLg@-6Z*!hjh=d0BYQ#LZZ(Yp?3} z^l_3`^{a&07guN2ua?149$}G&dNEagJtvuK3A322^bFRPd~agxv@ewtihfVb>)wjK zJ@I{a;Z%zLoJFasq)rF-E}Q0v%3*7oBY#@|6yDmla&9`JAF241WT_mhAk!%QM(KZ- zSU)G}?QRqBc-6&=CuP+^Wff@(bq=(OjM8tEexvjorJt#orX#wHd-p5-OB>qO(G%TD zAI*X_HmP*}nQ-pok-Aul_^E40|7=pk%F3}Ej~Qpo(cjFCB*W>_;p*Ad8KjLGEr0pi z|CDB&sqHFkWYUa( zP8Oy`+YOPHw9^fV^eUuAbyWZGUKeq)4pl0Xs2*xZIKDr>3ASN|&SmRGh$fNvg^+bGp8OQAK|kVWumb$uL7e^~sUEgPOZh}TTKl)M$$xLfW92Jl zhu^a41_Nf##sl+;xQq^%Xk?ivU{XsN2KF+%j$*bp5%#H;=FNpcsDn0cX|UNwFU?)} z{xN|KEN$i&2-ED^I7E6rTiO6L&l3$v4?v`t?O1~B-ZcQCo z37i8YK#-zjyBg9=mqh|N$jp=H`kj+6{_XeMsqrbv7L#E&d0y}xs} zym}Vx82|R;pa1mYY;=E}9Hz5nGFvVT+%#M4@7yex^BJO8E|lNy7_TR@}TGMyTy`#Wco*>5|>FZ(;8 z8HHXP$B`Sx_^;#bJZD$^O*R8IBQNtz@u)ZsLO;SIy_jD1 zb27QUS<34yGr)gS@DoK=7+ZKIz3_E9E?>_viwn!wGhXfQNQ!^8Ouu zhttXUV?ju~&fBx&(~INZE`B{Z-F-?QCKmK;v|J_`*bIM*1YXAF7e61rIsWPW!Mmef zi(M{O{8gGI*RxA``CqOa@ms&?&H3AllhcdccR#({b$oxX`2VMS&-|y2=e_(`JO^0mLFVAl- zKhrN)%*TK0$yjW7vHuQlM%ieL1;(Cymwq-*eiN%)?YvhIQ1Zs}~nCj{J7Vw9j3SQY4ZE|IGfCu z+IN1A(N#mVzs?ZZ20k1uG<)&+83|NGfxl1;I(n`GWX zZRx)`UuKh!$?_(ODNn%%)Gxm(_?boB(^~sTZxn%b2{kdR9&NR-zGy~K0Wt!)OkcG)qN!v3B z+v{vJzX2!dr0vgX_K%tn&sk9Ww4ajnHd$t0b{bOqG!<&BxzSEjq0x1ppWmdPwV%&M zbKU3vaR(FP2&1XK6a%{0-+7aMN-om;ov449RVECvo2a~3rVKTY_!h*o#oMcA)7_Xq zyJ_`RwAfZ(n-;ZLH>1@wG|52a%T=#H7ww25q%s6~_w8|Hl{O zdBLR+tMlsLo@tzA$$XS0#$yeQ-SyVnb2_bR=c zU4pXl=16=whbEhhjqAI~D=lM{cOLvF*LarNm?Y@wUDZ+Lvy&q$h zFXR{Qi||bF6UAa$l`exzlJjq9hJk-C{TJJdd<(7xxvKJoVl#hA@xLK^81aQ{&vYW& z@h!`S9~868s3+v{=i%k5UDn|Vg{JLUfp~o6+a6pz#y8x9dT>WbEXVims0dleeG#(! z4bP*G8}Ux~#cMksn>Z{l)8#U~U7OTB{G37a=DunXv7n-2ZEe`pyiFNX$pn8Ume!`# z)VyobYKXOm)4Q9KdN8d^G;N3W@?6Ad+9G)yYp*B{Eidp}BYBpLlxuN5+$Q#vO zc_a@(K`VAGj|KdQ_HxWv=oZU?=Ca(tW!G`_CBuwRs_N}3R_#zg!7UNR3K@bM^SzQ@ZPg3Z#FrHSH6&99t7Ai^Pm91YF0B5Sn;vYtOcwJv(-ItZ2|` zVg(<}pIj9SWJ~9dE<+u|S$nay=h#J*Z}47K)UoE&>2zpa(p7?K`#N+jT20~la7y$Z zv>r^0w)n2?8r2D*fC`QJ6P!teT!ic^JV3aL#2*xnW0f1D&VHGE61jgdmSQS>K;LxO z7nS0)8P5<+$wH`9Gx~7CDwgZeg}KO9E`OWrW}Cjy?SbnABBRH2&%HBRL5bwa;IhJ56%!j3!xc&)UK6zyo4X7I(MN{cxlJY?QHK}gvR>zb*JR5>!4L+aEfTv}R3d#JO=!b& z-X34qIJV?u*D<{i0c$(-Ehq58fNK43hpz|I20^Mxf7To&NQ%j zjv@Ldw!ps@o0sw0Em+|Fj1)WIR>HR<&6z`cf3W0WrF=yz#qUU?uMH_iaK!aQk|9LM z-ij?|O_w$cgnWp+Hv(d|9m8aaT8tK?+iiqlEDMPU+z_*b1+~phL6k*hXq3e@BOeJ5 z*hffa#8wOpH6VYrs||M3mgMEt++|n5fCtZ-KL&i5XSBuCkc0+D8?On*Z6=S|3W|u_ zPub{l0*LhSYy?E(rHYmCmw0vX`utc1Rfwcm6*?~gj4NQY;g$H6i%iB%VYD^Cw8b+d zCAJZ$+1if=H_Tv>+E=WHgUFEA%c#q_?s(eI04NLW>BoNp83$-G@MQnfrTO2ZWFhgr zfG*3Wq0Ys@{5rS10HE~H(eI&MNk_jGf~?C)@y!s zo@UGck$itC-=$+JdzoWQX+B&)RBT{AKVKas*p%ay0A`UiU8F>;a6a|LI7EC`ArdLC z=0Lr5X%(tNyig(Iu;4iM?f z1WajR6tzj0rg4!1)dv{gRgzqO7>z#~qYvrb5@3J9$-=lSN}c5Wdj^UGfVww6X9&#; zsNfy&gG=L3NQ#4|q%b=%e~yJX_$fpILhu#X@O65f8qW-%e6d-@x2<0merlH90b%V{By2ZJ*f})RxJu3o3~!OWlSMVFfPc*8v#M#rqTC z!%Tk|o>iju3(Td+cdHliV6lN+Pi8mtVJy~Y0#!&alJH4ZOXfN@l1iEhk(ci81SIfX zPKjlPUKoY|KH5$kSRp5(tRgZuxXcbYn(=sc?Mm0Uh!D0om6?uQ2<63Nr)Z6oUw7>u;jf(*LbOQiUB1%L% zt7SMueyiB5nAK1}tDs{0K(s~?UeJlP>q}~0`?q7c4slK^K?K7=q2ir3bzHnngQY%79M4s?&_`qih%MBY{w16T6>Xp$<`-(`u^R^bER!Hy3e#i&jowM zmhB?-jDgTqRC}tV>(f~dVz$FuhpT^4h^Ao6z={z0##lp-Gf$nY*tc!m+)9-SK=u9` zJt!i3zFaNGv%<&=Bf#fe>`S&eOZnw=!$HJN^*b4jZvoo-eY^ULALMGvn9}p2vpq%F8)7u9S1zm2Cy+z z&Tu+;g4DU^d7%{r5kz_vb!{&Ti-7UkKpaE#qh^|3+{$o{PMWMm7D6))oxryP%XeI; zJhmk5gmv{xWxKnYl&H=n5K4?jc-(%6n|4~8S% za!M>v)8B%kl=iRM*18+G?QiA&6#S4V3L(=qdc9`*gR3f01dfdP%z|)D z7z9vCdb_mdiQ2*~F5P^Ojk^yst|-7Z5k1OvRc^XEot8`Im>GW$F>S8h1eWKa9Zwh* z-UjzG)ch%yD}+#Ca7Jtwx6`FtrhHP@gtkA5?gM3fA^Eq?5G;?xn-D^ZDZ{i=)+&## zMQeYQ&TxffM;Hka2nb4;l2P~iZ#V{>=_;I_l{@a9t40-DxoT?-I9Gma@*NdnCE2be zYqEQXY+>t5b&Y@C7v3`66`~!kcDrb2FGys&16A(ZDEotBAwh5$HytUPk1H z!w?w(%k_hfVBc!No@+M`wUNR~=Ne0`W<`|-U-+akK4*Vqsa!Ajms7?50}GM&&cO=j ztcukzhHEFQ*8u@~)PY_QI~Lqby&0f}n+Nw1-OmHM0SiU96Q(Mld=%QpA=vIjh+)_v z%v3tw_D5+|0HXD4jKQG+egTjnd!wDORt2y}A?8jWRc946C!}wQWCXpsov>C1@W~UY zyDC7~{wRN~T+gH9DwNMnljayg1d2pKvJd12!r_cd8R6A}y^l~UxrN8V5g2bBF(a%C zOMr=2OVg4t)AH@}%&2PZMI@ix0N|}qrpb5&u`$my7J?9PPgb$Df(4b~G7DsRZj3Af zdsdS$5i3IGwoWq>X!<~>AHjExLtE6EBPqCoFwK9mIAKqbrVop{9+EU=9uLL%WOp=1 z?8-cW3P1;a32Oz>TJnG=Y>Hl*y5KFJYONq*vNS;B&#n;z>5aMu8RUo%f~ME9EzIfa zC$tQy0s&+$O-GE);hZ>LLk#~JoM>7j9hewXc3ll6Kg}M>xqttP<4<+ z??-?4-XhCJI$HE}Z~`YpE~kA9v*GGxmdu>?(+xS211N(qibP(eb+l}CwUJcoAq+n@ zTCFLxRjMoe4D7lNKZEiB@iU-!NtVW8CX?E2%+CnXi=@ob>C@#bhy;#7DTs(o!j%SE zgs!0?!2OIePmDHL{lE+^@)5QtLz6agP0WA%QZ#BYB!oTDBpFzu(1+&d3F)mk8qAu8 zRjM1evIu~yC{p9iA-9W9?e=o3B$@+U1e3&SDk`!x=hl%AV%tk=5D3%Fi!3*?02BB0 zu|-7|HUL3x#1WesHe9;DwA+hC%aJ$in&i#MQa_{et7wpZ1=)>4%+wN4)3(urv>Jc5 zYt~xlU#l{^o>b>H%l88G8;{WBTcBt-Y>JU(?8X8llm?iV>8nZGOL?#35-H}2|J?KcF@)CY=lB9s9UTD zGb$DZJd9Z9NcXl9raN12>G#na6_}5BRSzPktE947dwo5+lQc)hs;p6x%_W`6g6PVRiOAIM1?yS zA3502N6+3O3c=Ck?R0fQuFro~D`yVqbmHIe)Neakt&kI{7cLKukcoYP_N9E(STV%# zs-O{2f%M{bx>}>Gsn1O-#n4Wa<%5sknr7up$sN}Y0_u~;Q{uNq`sOO%#)fg69ifD)n~3DHCC zWVI5C1DCAs;j)QAV6`7zt%O=aGz0v-Qj0YNSc5LorA76Mfa%0N^`2ImJI^NIO}*wxC-Tem;FvlPs;5LQx03xSg(6T>y4p z6vT=&3g^!T-Kw5W*seY6y|mf_dHkZr43Y-H4LX7*SyA5E2LVE*wpLlJLl$9_yz)jC z&U9Ell&U@&NzkZBLv#**mXuHeDrxo9jOb(9EDnIwCpipM_;yV)piC-30+?lAcM3X1 zL)TMzUWp>_7Lc1c@p{w&c3>0=jC%yYDw^YWj@P1QVP6YGABwarKlT7qE-YnlMV0v-jn_d}E3z0~8pX_X z3=O)hjFv|f+Ue?H2k=Em7};Mzw}R*c=)^6}4#HZgg=DZJj-rTS8*Qh$cX8E-K~@O# z^b!FJ(r{MA&ccy@DNbc-GwWbe5q{v_UB`g6_LV3@M1{H)01gWTg}!L0+)TZL4^%C| zSgb}&9!20WU8}|(MXjdtQ7k_J^cUNgY(m(xw5Cw4EN{hpaM_Dq6LfAhTA&Ey_1j9z>OSF3&~JfIak>*P?jnjjv}(LtO_7lQ!6}T!jxlE_!u7k0VG;Qh zHStAygLfccbg2;5r^9#{a0P}}0U#xm+F^>Qovcnip@5H+i6cTrXRa~JXzrjo)gsM* z+CIx{v|0%jmgqPz3u=hE$+C_S>=oH)`QmD26gLm8PTRTa=qfUgTuF7%)ru+B=nL)6 zI>(!5VhckfU>mN3u2xi`E{C)`?e@tKXHh*5y;==UJ6U}ij0O3T5$hbTQ?#d)ugaTy zGP;zjfEv*Rme(S?fi_?%u)h@z5jT;4@T{0tJ*ddtl~xCvwf33N**ZMSvSI-?q^lJt z>#RV9%+9;#_LC=o-D_4JT>x>cyOL#W=IT;xL$X?NvJTnJ40f$FVa>Hyz})lRp6HlHQ-(AZtuB3jM1k zc6mCggRV{hRjtPXgGW@5a%hu(E^FMvqKT?LvKP>FRNBZ-`22M zn(@ax4vCXkbOA{ilwAQyy8B2#lH*wb!>5a_IFdvp(QTL(&NH2&E@u&cNeVVIaN)^s`#U5oK5*d@M+>${Ls)Db z=^3h<2^X#_4f*voL8A75=O7NbWa3h+RW$uk#39V54o0NL8ezos#Noh(pN)(Cok1RQ zdDvktqQtp07q@UExo`3VluK3Z+9ukqp+rt#gk?cDIl-_Jj5uA5d`|5_`Z=}x3iPXd z#9wj7Ve`7eoRRiy{>1uq)d9>l&Xh*|6*^kL0!EWt@-o8#<;CHDwjyU=OgEjM9@8uz zAP&&O!J9{~a|h$qu6)+NTrdCC+LQm>vyWcOW15xTe5nXmxAAq%RY#XKiY}|$WOG-Z zj7gZIl&v!bVy@xxa8%y-hz}vC1o43H*zS+XsE)FH8_6gen6`v3G$seB0zlwe0$}C3i z9&Uxr(fOn53?EW?R7!K(GtsEAO`?BoPPgbg54Lw<&Jb&Vkj_tE^WEf+gk1hZC!%6**TlKwHACjxk>dk*KY;Q5mAD(V!Q10*7$`WE8vRiV<_`4S?bU7c zfwlk8w)fX!Z6r@lN4E(AFE8(=(`0E(CyS+t!?TJnbf0U2-1|GCwFPmOAg6!JT_qE} zb9@|$oc}m~T6VWg)OF){KO7Z?5&)c(#tfQ@^=%U;b;s&Q^kg7jEDgAr=%0nYhv;V- z0VRZvWqB-Wc0+HVQAWH$L>_H%?1u_V@Z@qY8lx{s_9nUgkYrWBLOt%6BwJ3#qv^qP zay_dYOOls9ycuPq@e()ZuAs^bswW(#(=>nZU&1SY@hiu9@$>PU1L^3GjDeh8(5nv? zlhN!|I$Ku5tP(!;V9a)3o9WtqZ_Qr~ynd8SMZ5^ZucC}(9nP=}*V$-()3OdHv&&bL zY(WNpuT}`(yiTq(U!2bmuEfHMiMPzk+EGT22s801&Ua`vzlucuxtM!8c%@(R|Dq77 zd|o}8O2+w9lHMlE>`NX$>z#pa?n_elRn2uRbJNWGbv{Q8x3Gmfw|FZ}9SovtAJ^yV zBKdv!dpmI$fjEsT{)+~U|8 zmp+WhTieWKCprn^l!xFx|X1t){G9lU8$!i&ralV6He3t1bi9G(%5iZf+Fj z4Awe__n@VLJa4vMl^LKF+1?gKwgZu!3q_pz8=>bE<*GK3jaFVn##SQRD?~AWnggQ? zm1xdMF6$84Otf>6t!!@jcEzzTYm4mS?2B(jWTUm_=rXU)ZpgXV+H+QjW>j&8R}EwP zdl1co^i6Z)wkds^Tj$}V@0zsg5-~^WKaTWWgVrNSUs3K;L@my;$*r)se@;f1Nw#Oa zdj8r(PiKhdlf~iPVwv6+7b1p#C;kPWs@EOD8RTd_VwB@6VPq9%xVW$~%Htj5&1eC0 z2)4U8_&{T#2PQhKS!mvF2ckbGDjkW4rt%(5BONb9!FGh>pjza;W4eABDTlAuimx)! z|I|ar2835)6matzB4u__!Ec)o_~JE-pWG7dA^3X{s#%82$RoyWZeU-3IpVi&mD1P- z&Vk%3{vU>Qw_UA&+Lnd)`OW2L<|N>hajR&fTv+As_Ab-Ug{l7E<%jQ%&oAD-JKnV# zHu|s0-cAWrdSlwD7hC0~UM6o0%EFR|j9 zi*!z}FfE)Q$bLvDLOu6?WxB*xUHi79r*jh@M*&L@T3K=gD=N z81GN$>fqd z@iWVMd4&J5tY^`&XW?IHcX0R$eQsVl|H(M^EW_L8+$tY)ni|*)w|CQ#nA?sQ-7o;v zl!8Ka>kc5Nj!Dxg>U@q`iNg8n6sWCEA9aTMKdACX8Ud(_o5{ie_fN(K{^1$vl@S<| znK3f3=96U68GDj{k?{^y>Y~}|daAT}$97aHLOvQ*D#BP*aslPIL@ZXC6vh^dNLAia zjBf-#7e8q3K^{Q7C4h$z{|>4cxa8_u6K|?Ky;>Nq{d&a&eFzLn^U0tzUnn{BT`0|U z9qme20{BlhBT<$j`a7t{bt(j#Vs10_*!djAmOTX8TH3LHLon72iH34~JNuB1vP2cJMxw3;4%}>XjqlUU_z4mFxp9_G zC*v>1+Yf(F#>-V272H{9RPj2-yW|>XPvM#(lm^?b%{479mF{Hj$~LcWYE$BTqAeQn zK3N|aXu~{z_KKQ=8fuCvN)+(nytT;Adt%THNR?*o0ZdT}?~nZCnVN1*X&3pNp1$SE zr?00buf&hk&xKz`5-4;6#K$B%BX85+hb#-daa~uC-dnnExg(t0DfDH_3ph=YbEfW; zMq+*^zMK&CC#Pagh(EI}m##jaxl31pCHOiLK*VZ)e~kko4zkH;N*DHC?%XOkLJeEM zyl?!WVTN@v1WMQo;d7QQB$R>R6P^JxvJn8`evYbjfD;K1L*b(yy!s{`)mY;CHr2jD z?vi`eA}Ed9C3@FVxvL-4;gG%{h=>l@gNII5tr6C>VGq8UXV8#ILksQ@O^JoXDX+Ddh2o3Nhox&c}W!>=w{PZm-CS}E+~qaNxCu#%lL7|SH+3Kg0^VatKo zQb8&Wx-P(>rb$f_63-*!8gbgtt-bDQL{6)J;Cm}2ofFvOwkGtDMc`rS3Y4duG8tkbP9eUlzlh%%Gq;mY33WSjV;kr50++(`l%;}>I*WQ@vk2BY zj_ccK|4!6xKA}=zK{Fyyi(Czorsz^7^tZ-ns_Eza$+$1{Bi6NF35fi9Woq@Ju$~_} zjvW--CVG)hR;dZmTLy=SLkk8tZw2Slu+(I!2}4{JBJzy>FF_!a0SW$9wk$rR2L!zZUIIFC5;=9-_Mod zN?+A7(O(?!h!`iOM^S*jvdmWGt!*CMSv~%g%$7$VriX~zf6R>n`8sdUj!!R+f4lhg zsci7y*muCrbVJ& z{hu?=(p1wzy*x~uWnEf-sC=$j2IAcwCeR|vtT!b_!wQcPX>m;B@FqzDK{GhpH***u$nERz5CU;leyTqg5r z`sEg%O3Jqq#327%rs;HHj7KwLo@C=dnWn@b1_~agD{7kHZ-{nEM29egSoEz&8CBr>RuH%4ZV)620dnk@34a_`oXFg!*iYE=b*A2pLMDq}@XtK3($8wZ29W-Qe+MT0?% z$ce^?9t>iwg$TdA5{=bxV^t zD6;o{=mN2S74Wc9WfIrp{H#ib#fW=lHPbO(K<%uee5S~oio)2k>`Hn3+$iovVo010 zbuLx4mk#381JXJqPGvFckT`{&ZfWb*3{z@!db3ePQ=k&DSGgW5+nsejM~TnE0P4iF zw9=&ZNdE^_0piZo>3Ooen|JG2^n`3xks=;a0gCW{7XcJeBd*jo;=-F>(4N z+KL61=&b7Su8>R((%XsRLszoAX_^xTAzDVVTq_L)$wJb~P^|@VsG>tBI}fe5EenY- z7e~!})!8KQ6)*!0lNEFmg-yEtJNwYxq%-h zi3HVu)cy3P%zQW}`5v?$+ehvycnP2cx_T{m>Vh_hQ+)rx4kr#8chF9V!;MN!>zdGJ zmg}KEf9MDWM-?j7w5rD^5+KNb(5r~rh5B3{r&~NZLir9F+({nQ7MJ$1c9e-#Z&S&( zYEyX*K-~eTt4YNS{^sCs3Q4yXET*TwS(B%Ko4T9rk5QtqkJ$V=-e%Ftq1)dS-HJBR zkXnBet+WNW7N>=xBLdW-zE7Wn2)<18yM7SbR@_ok>Y08V0+axtZfM2g>~!MFGNlNF zF1#??4P4xTz%IRzI-?F6P(_gwSs_}zBKk}0wGPJ=I9>U=K7cr39Epa3#Bi(KIKUEr z23W$*fYY5$4Rp;bahB+9aIY3bLgo*!1S0+hSb`Rop!kIP{#vw)Qr;xsvV~ri%nKUu z+}|#qTk#1sV*2vQ7OEKrK4JUs+vSrgtux^MrAF_E&|&s*<>2-5+?rN@l|5n}z}f*} zy4e*NqwZmJ(?aXhnxjD+fvv-wHYfIf*dbicG~V5b{<)XQQb3Z>5OA3+mcYy#$!L6I zEYTQ6blFv<037+G{t_S?apz59T#1vx@U%~pak5a*`{Z)Z$aG{R_=yz>6t{}@zNkdF zy_@08I0<(8JVD)npwQCW5DkC@O=EYFB*tWxW3@1z1^&?81F>+I2>{liEG>9{s>UK5 z-!8w~5&f20{ce%^TsO}vTSeFwp#CT%W$D;57HwOm$gooHxEX=2`kD}PlX%+*X!A!< z2V0%duy)rbkxgb&gD0*Z+^cSetiRKI?|NsnG>TA%PEFmX7OvN+sR@=*cF#X&P2ZaR zjN1DCXzYllZeNpDF4i7Sov-)I?yw{Ni}P7zC*R7-t3_`q9;tD{E(-XD zYBX{G=99;oXx zQ$rhud3E-3-!=>?Z1;x@?+#oeJ8$Sulp+T?l}V*_xrW*%TG^zG^Q{QZ@`(6B*nFQo zUzD(+1p$x9HV>O47=+CO3mfXdJtEf(!sh!HHUT-Z?Gf2#5H{asTQa4h!mq{%2a&b*{7z~ zbGbxf0%`dHNY192Px)znh{F{k1XAkBh#_ z(pv!|O>alQTcX3=GE1k^B>VH9{`{wNG}#a+%;M1+0A~%1DZAW>M$}WFQswJRW|Jij zl{FTk4Uh48@(&zzEgpT5sxfsPZoOw*r)#}{>@lqnp@Nx;f=n@B^|1iGE=M2Kp8_{p zekZUn#+^KO8*eOs@T;P?U;24AO-Gn}O)*HpJYY(8eSUDc?D-95U8K`usucErx0tLPcPtuxi>VWTi6<2s zL9FLuoK5CvBfgOHnqFt4+hQis#C&pv4vj_sa^n_=Xv{e-#O6VdM>H6peo>DSdrEc} z7mdyF+!n-h0h693pV_SnFuf}_Bc79YFvpI)O2I~I{5^J#Vz*-26?cll+G_FCr||5a z|M(Q`&-34Z@?*jAz(9}ZdFh_u^gsWpyiES1z4r$oXi?ewLmX0NhQ;6eJLR8w-LhOy z+91-WDZ4X;LW}T(z^}u|@O55DU;`Y6s%4ynYk4^E)@Kmv3Wx>>HI4$pA@gzm!#iIQ zP#P}u{W!vTxDi_U*bYawQP8vn1e}Zh>*X`^&R3m(JvtoJSXZy=ITD&yyW;}qOsl~Q z8ld3dd_RmW6dk{WqSM}y&j-$<1`YJBN5c{HEr~sNL_{~@YnO68=rW>%a7NyOPPH9i#v`+&HJ}>W)Ue^TGe%` zZ!~7(qu;?o^heVPq%Ux+vR~-H$ts5Um43-(!tiD^weQIvCbTYs_j05p2dd!jal&Lu=U`q)|E@ zN7%18hYT+pxTx(QyP%UWb%E8GaSnuMdEibd23)&1W1%JpirT8pNmHziBJJQvHXA}C z#(8QH4tb#CP!d29_96?T25i`a@W3q5YdgnGMSn?{iPz4#?vevJ-HHPn7WBd8?POMe zRsEdbjONMW#~1Ry#>vtC4wPD~s(zT(l9%l7(CjZ2-EIV42?9IvL*LKm?ffQ5mXOd< z^xve={VR~neq`hSqS(UW=TxkgIu4yIB+44+wOXMaLa@tuCC|#mFCG>|F_;8Pfawof znpQzW1lT($H}b;(ZzxLqn@WXAbg_GXTyc~9dz@Cnm9-IESv^{t{su>#kN+Q zb6IXfRRum?9oh^3WW1yJY>?$rn9J#}^|Q>+Vq02Qgim6=H?`vf`Wx6Y4QW%Om)I05}{B zk}=XrQl(8Dw9|#8wq4i|F1850mTA+|_wQbww;z9NnHJ<}5aA$JXmAS(hdxQkRz(%+ z1*b$ofA~1JLe{%hvc8?F&T@d&01fD)R}_w(vY6#nCkk82b1WM+6Aoi_BlMOc8m679 z)@<;gKG1q9ieZePdn0{Povg5b&uk0shKv4Jf!A)Mu^HBc^&V(p>9NMt%1|cKmf5M| z_2*Jxi)P}5j8`AXzYD7<#*%7$`9juHm#>Bk=VF=A?>fSgvQ40tlM4HW zpHCP`UC(SAI}%ns&L74(8DMuUzi`{8&k(q6!$yG->3DLmZN7Qi2E5UKZrf0R&6fDR zg;NH0mrYHEu#7b7w`0l|{XfwCZDZR8Y8O5y%nKiKIxgBRwnZp#F1wGO6)&OA;x7oT1UTJ)9!1ym^_6BTN7|v(*ictl7+va=J&0LI)X!743N&os;k86d zP}^~}F@*B)fV6KU>go}Q(-XvHzI8Y6tY);u+%1kL-y z?=S}4Dk#5?5qe)h1m)fVrbLpqTM``ZN zgS%z=Q=-|jXF%`FbEzVw-)U;R!qMq>(~)>6Q}Sfe8jXFG^1I&zAwi8Wkm&R+jy4ZP zJMx&yWbr+nBb%j6zRg+EnXR@D%?2SY8n1gWh~yY^g#|8%{Mbh54@Z!MEQzC-XdSin zZO%#4s+KE%kE9WR7l@1ofsZL7vmzJXjbk72y2$f^h@dS09Zrl^Dm9%iW!Znt)?>#& z`^^`SDfQ+r`aK`8g{#?Lo2=A9F3rrk;bK#_M*6qsb zR;_t?RJ|&BNnxXy05Pzi!RW`{q9*JO?BOx|umV3N zq%#Ff^#zCxMt|;Nv_sDBXVU_HF&O=&W5jfHZVe1Z|6d2Ae=z!+@@FvmAvE}c(XJF_nW0tLvX(e=n^?T z1owq;PzPiT!TlUU;jOUq0o7@<^F{WsLh;~#FOfwk5k6I+ZV5~EO%F(WAgjH|wULBm z(3%o`joNBd9$2D)3kA6@gQHX?zc{f4Kp+Q@KT)_Fu*>pPN0Ae80athNzyQa60F}ft zw-nDKj-%plCotT(vscR|ahNrV2vAkwBfTC5s0PnrdHM{`gM)dFKjCOG92amnos2(! z<`W(_Mz6Xu@j5s0k#;VwX3NDp!v9l{CmrZ-$dUs5gStI#8nYN8_KY zzzDtl@b}WZkikqM;t#hJl1KIZ=rRYRk;Tkw)MIPUv1=vjwA9ay=ufN};JwPWzfCQ+ zqVS63h#6c>nT}$sDM2CZNQQb5JF~rix~eJvDru#Ob>I7REG}!iX_*a?O9m=mu63Xq z1oDbWyazE&Mb-aj?@O24MzS@3Pe=4S;8sP9?H-$jl>lqneM7cnm*#qFNv`Er2P8rg z+a$r@VwdiX8!=BY5%Y6i?LNtTClkxbL}DRD$xA`*sFp|o2_!Pl`Ofy8mchh-*VQ*x z;;u>{J!3#AiCn-4W8hRdID6N`CS-yANMWLZG(hxd)vUa|eJXDcF3|`bAyF3PAV&t7 z)GXv)C~tQ#MD8?d+9Dqs5oLJ%s8W0TgCPp8!C_(#QIm+P^1~GEjg%Wy@qvdRgs0vO zYPC1`yNGlF^@ASn4RwzEO*Z9!;vzGAII^i!F~HqWW^%bF)$@Agt%-jv>-6$I+IG>H zJPlZpb$w5-W4@7Cy7eCVkgFu8T=f%`0}_%$jZ1D(Y{xBfF2q zH@nOZ-*&7)#n51ez}{`v-3Pl5n^j5v9$2{vi!z+c$<<~VuP2}sm0YMG<(*8^bWzG}H#|ULl8EAbqfF7c9 zyPW)PYLNQPuG)+YaD+u-Hg!;0DUf!C+G2s8US2eBr8z&%kCG} z!;@zR&mW=jL%fcyC0bd`1y~o&7$yliLZr*9c#d8c^f5Jmw?Ks;dNd@|gJ6L{=%aOt zU6WYT^goSSgn;R*9Q`+!^?| z2$*b8PVTv&#uOq)BXZKPIQWS0Lt}&IN?|6-wE<5`={7=qlPq5+vvZX4RTx#Oi5{X} zPu!`VKKz{m1@x#;{dq_`<}*am8&E(b1?7D}^DPa3k8DVgJi?I7(wOdC}@QPJ-D|AV{ShA{N zV6@qP>LdDk%;bJsG3oqsJl)8Z?m{3F40(Tg^zc6%@5noh?4u{P{p=9`vF#_(k#FNS zaF#rO0RjEY{ZB=rbm5rU$q#(GIJl$=XdyNSXpz8I5^@pCr6f0!agdiuI!o5eo3a2e z1E_6YRH+NV0GMeRnxRb4mHSrn#u@>llz*mw>*QNG(|=70t9D49%hUNf*BNJ%Y>Kp6phZ(+Jv=%*d1S59=|*6ePiR0^LOG7un$Zij zzNmBkk&mlPgrx&p6Jg~mL^~0<$W)(R0XmR#idH(ra1nwfF7i~$x)ODaRHqul8MuOf ze8XV4MuP)158>K~0}SN8N)RG0tLI8{WPvsg*+s!;iHw`9Glv{iKk?2pW~wOV>q|$a zXW$tviZh_VBSO@CA70YG60p2{e{gd6kZ0S~$LI7WuS&7*OVmX3~I54JpXCNGGj-Rw|Lex;wu|`_-#b@h&|b6%pKdusic~Fm9)Y zo_Y~AY-ljp(Zv8Z);0!v^^B^)P698hAt4K{RIB)lsnrp0;b%7OBj7S5gl6-PzH)pS z7g`pky%GW|^(r~*pnmyTif$cIV=A*<6W6HuiKmH1#>l^r4{ant^LM-vXV~M z-_C^JuW~eAZBGs9a{RfiPvCzDN5RR_>Dk+pqlaqk3N0<&N5C93nyQt^sZ_NOzbg*- z?os0~$z@w9dPR3KgCT!%T~neHh4N!K#iS^~i>~|_PCHC4}AaN0M za~uB$-#E-80Jj(ZmGfE)VLUB=+qfpgR9L3e`_5N>4A0u^|Dang&6!ru$2~pa-aQ}M zJV7G;kv$*kTm0ktJa%_S2sOF06GA^b7l0YkL@{W+o-H@4=I*Ha9_$VmYH&UrEYXOW z91NxNz=Gg}_W{X7RK0VF5*?9m#3L+-x5)PAMg5Nqrodm3AmW0S(@0f+5-tgGYLU|P z7JZ&&@FmY~dU*Qw`J*DEiXu!c{tAfL2Jq&B>32KuRz2e`!CN?>Wg&Gi{wuXnzA{Si zhU_Rv{1N3Rp%sVfNa0AXY{86h54sC8wXa}0xJb&YAuCI$sYXnPWU9QoGn%f-Lf9@& zlr97H;O;vm;M0h@zG`rPN9}8rAA?H%qo6xa*`6HU!N_7iuudzmLczS-?dNF z*B;qASWe<87vttPulQ1xLyC3PHK0YY8L|ktKdTZzRqtq;$_UZ-d$4)>C4-#sq#FJf zmgQHLWcSsCL4QI^kL7eS|4;^Pu?_ygdx9P&tBd7C|s(y8f8iRjJZse$i%b+wKnAc=yqe@4tyP8)G*U4um zH?*3-?^cFZ`-RGXxvE5YkpX1QkOgGX@(>mma?6m)wn8ljQr)a6O4g8!HbGk2DoGTJ zNMBroJiJS;-zIYj>;gdUdkgP6a7Bed0Mi6a2w)aaxQV#&0?)A<4I@;4pvAqyflwMR z2)Lq6?8wF~B3o=|tHcYc^#b;T5X}%h^hgT=byyzl#qD{2=xs}vbI~k0Yw_H{YC*#V zYFdkv(F`Xf_dmAWXA1p(o(=|aK>wP&mui8B?!^4k8&kRhjH z-xl5y{9?*~CPzURdU)FCSZHG-M=ICJH_-&_R`Wyc01(eZ4sd`}GF055HjfK9(F%(7 zN&8xRfVra(O)w$((d-oANVowZ#N{ID&<C)DeYN&~;n|f%81eVGC@=C|Q(&E@Pb}S7_jvRdfJV zXJ0>kkbNOiIApzt{8qu-EWg7+hEZ9&;c|(~)Xb7kMTxEb0VKIIL}D%hY_$?Y z%%Yfo?9o8GfC{J8aI!>w4Z#3^Kn!K|Yfww0>~i((A^`Q37HXjdWz{_UP?TBdwFoLP zJfGifvoZL&MfQZ4`R^rI5tEhGb`%GwH+xrzS#h`H4}&*(&mMQ$kH>FlP8h7*8cy>$ zWhh#oPnlLBsXLJqs%C?7$lUHLR%=x|dS3H?k`lUIUE;9EZ%5TiqJ5W_wwX?oHNkxT zlxluHa2?)-%2!6h=UuuI!#xw%5DOLBUrX-iCpSFV?VNn}L4=xykjfkmUfgZ1Lsj*6 zDnpR6b2qnC<=h->iYC_h^dww_m7)Lyd~CK2Z{i3`;^$WF*QuBr)=T znv6oLc|xmUJ9};b4dyD*uu{RfgD?VLrHd}UK=Nql%tG3wf^%UKi|{n)L&70y3HV`( zvIFj=TuFck2hDEb+F{q@z9X0j7!*-->XHmzZ5bjr0uxo=dEnPXNFTV!h5?e5Fq)Cj zotF*VJ4^QYCH*V4T{Y=VbsM=_?wh86vBx(3(=WH@)JwfCL0J-n1k|Dhk_1AN%V*P4 zFSVRVI3PJ&bOd{=Dv)M^K+g?^>vC*=rmFKUXOIR_3i`M0FQBPCV2ALsqDA+t_6WPFnvKow z8Ek}{I-=XG$usiJ(q-0g27lMKM=&o4;KhJ@Qij|#Cj`!5uiYL9V2JQz1jy%uyv_7B zagMeGfcree1|r|bX|{BIR|is80V13@2MyTK%q4UP2Sd_iC*4LTo2t=&i)@*mgd;De#BT2W~pH@qxLQR!%IeMYyvuFdR3w2hnmT zLKcz)9h`X z=Swq>#Z>ht%*HInp*`C(Vf7g9q;iJxl8sMjkQhx1xq6qSR=o9p6G0}{JVCi!DxR!g zemZ{slXYj>=8LbZPRIsb&eJo*OQraK<<9BkM2+nvbm886_elOUgm`GP1Yvkx9RQ^_D&|aKHw_e%{7MCL^El z#CrmKjk%pm zwS%~kx*EO&O;_B?rP_I1xKtaCEw>mbFxVtiid8dLXQSg{*KrIElE$0P*8vAXng6Eo zd5kXA`j?`A4byl_jpG_{9n!)^E>To;a;Y{P+c+tB^tGBFwda z=4Gd3H8;6gk(!PKc_oqHHkpHHC`O)Vbm<1!VE|ql?sF(I2XT~ZQ=k{exDE(>`B5dP zmh6W}^s|Rygl66inS<1x3cRBl00LosU5jWDx^US?S+JF|>c5=J%1?1}qD z0;3&&qIM~gLFU|KR!{u)G6$QHFXeZunS)x8Tg#y6TXa*41VggnEy#jDf5KtW7-Fx9 z3?vsy8QyBYaWTRyx82hyi>Fd84RpP!dQ_3PU;R+j03cK;k5^on+@WpE@%RH-XX=aF zyIs~+;nC-z*0_KT>6ukXSXI+^=d|B;tO3Y>FH~ee_m(N{{pX?XJea|_6R+g1oc7+p zI#?kAb!Eki#T3aDqA|q<+J)h_^T`xFZ8?Jc(UN_?Ci5$6wOLSuTlD=pU#6eXO$96{ z<4JrqPglswkX^r4Xv&Ra@r|Le7%^3%xz~KX5`>lWbpAv#y0-9*uGW0iN{U1i-hR)dxvU_hID#k(CE=pw8jV6le;MfAZyNh-_dRPk=d z2D*fvDf4y&RE(Bj{CYax-Kl|YAlyuJuYlAJh-u1Q16L3qu7|rl+5z`qRT* z8IEsuQq#Wb;VzQjt3dkgN5KMT_~vwfy#yWC`g*yko^_aRz@Andk#4T8s|US;vVs=- zD!Kg#pnXP0$U8QRpe*^1L5TD=(xR*}-p?ruyG-VLFR(!fCSnI3e~@H1eJ%Xt9mTNNbt^SH)Lk zQqxTdPTZ`k_agm-wh}P9%_e+*L2OFKY)gbG*rUbm4ID(55MuH`t_1o}#TYFjO#WbG z(+UEA9{OB+%GTiq_t2(j6#`6t=-{GU>B$`|;Uf4j$h8ysNW4P|mBMtP+S{IJ_=S>0 z+*wHdElN?L+RbWw2}V5bmWVV0v@{!G!g_=I^zGU4o3n>~e93@&dxKkl+S9E;l-}Te zP{&Ez+fF;!PCX_@{|Q5RHdl09i*AimO_*5M(xp;W6#Ld=nK1EoV^x3w)7yK8#5xG+ zJl1_9Vs~Jn?fnIj=2IW^c(s~b%`LT88G=s9d(E!wLqi@Pc730I<25j znHh+JjX%4Rbsev)^CX#nTR4YCA6pNJpML=-AR<#&o5?s9fuyB%0dBq+jnrax_G*z_ zprZ@IO^@0_Nc$yQ>jG$l!4M%IRGgq)y9a(~1*-0XXhYGJAw*@okF+V3`F}5v))R?V zU_J!|5A8^n-REYpiiP_aQXfO=V@O%WW)EpWo7$&LQ6U9Oglh4B&$Aoi;m`u~P1y}A82~1+$a(JwHEObNmLVLVUfdEAYeI`7-gB@d*MEwEc09` z>-+}UPyo%D5BCOtC>ZWv>h8OoCu>5wg68WZQo77=n7Rf7F#mpIy+3)idQ_jyg>hnp z(}AkBd@YirT&!)M~#@b-dQZUlILK2kEa6wfe@3xUgh5FiKk z2*ngEwTt6uban~R+lAeg%&HP&{zXfwQk}!($wm?*nqK)~;77=?W;;?l^Uk64=jnN6 zV-7B)FkuA0l3Lzz+{ezyRq5p$DHQLD&tK^ci?J$Sz0?Gr~7EqrHYymy+=r56rx5pYLNdmdC*W~ zOfC7`kw+DFA(-8nz=7CA0hH@y@{!N-m)UK};H}hT@wO90?U)<~(|}%0Xqt#7?OC^` z%)RlgwCO^86|vFCi;&}t*rX(Wm8%G=04dGRXo#4=g8}QBZ!-jk;8! zI8ajjam=f#buQsgTEgQrc$f{qEQu`yvhr=(&Ue`7gY@}-AmqdA>y5K0O1lY{vxz827ItD+=lQo? zfYH~bm;S~5tP^fhw8V6ZW)nSs!C&*u`pp+~l^~lr&fdky(O$-jYnWQOz~N?B&tJeD zRH7!METimDbD_ij5~Q2FW8KH%n_b2xswPJBSc8hC!98(gKh!?x4#BwH2fOcJ95T#* z-pcliWX9>I`818kBEY6xU@~8=<0-;_&cvaH3^Z(0#NH5Fdyd#(g0|Ba%Y>qLv3g_a`9D#PVSSpcukqFD;yM{` zD3rF2S07~bY`Kx~zEnOJh4U`b*^B~zYnN28f!wy3;&c!MxS5nb6ywSGp!Ue^MH!Tk zm9Z>4PYx~0#G57q7d%^em$Aynk|j(KIxC&AN6Z6MMB&gGTWl1qB?i8i&XwUH5E*EZ z>%fJI{-LI$OWT~?9pK9ou%tM#t8UvE!s;+qP|VY}>Z2>2Ln3nW>tSb+D?| z;q%sdujfWyTM4jhRE5f#+vz1#yjGiHz(-eQRR0!(3jIoW0o#8c}hBN=ATg`0GA zmCQ}w1{q1g#NmR6uZUQ&Ix(`HEC)Ox*mjuNZFSKMbf6J71TDa)2fGAHkNKK&55~xq z&`!A!GR9%z1clDP65QT{t3w149Je4{85YZgUG2&N(U3u$CTsZR ztc_=6LH26Yp~IyoP^7LnZbGbK&k*B<(;TfLPhCOAeZIn{p4B{(O-rQRvTVk}oPcRy zc$8+NWVIHv&@Wr5uSgeo5_9%MF%{2T8oiAhVVLukl5VT3(C`GWqsx193iQ2924iCK zLwuFwJOQ|s5~*JXgh39fv3a0(c~9!J?t4DTU+`gso%@VuYw<+`-&47VnWOtY#V){R znEWWBwyvocpCH>q+WY7U3m8m77MhXQe;q%})*rWP(@r6cpL#X!kEyQ;xuIk(Cj1&a zCD#gzIB34P5G?h2GRc*vgj25#3uG2edxV^f*&$}lb}0f=^B zrqb`r_BSoZ!8!XO4**a^c9b3w-+L4R_3!k&pKgmkJD!I>F4263ug(5lmaYvDV_&dZ zG?IGF0~5zN?7Mn-xR_)wgMM|14e(E8M(jp=JP9ZB*Vej?GfW6|Q-eCb|>YR|t|xwy1W1FXN$)FvLAK*@ZY;Vm#|OKYEns_Qe4 zR}8Q`X%>hh^I@V4u@SZtx=l8WtJ2^9wWXTN4O6CT|4ofx-N{?SKO`MJ?b0MuAWC5Z zbVmv_8R~8P;9>`D#J|X*0T0Bc9fwaXzkRn$42h1?gG-l)ibV8G=*v?Hg&qt~=?>`9 zC#Aggwx8VQXjD)y?WU3nens(hMDzRnl`~CW=KdV&=*GEt_XB=y32RFUz(3k3c@kiP zHrTAO_WSSQtoGl_-X^2|771b^3)tNbew6MblR!$u@Deys){$rZRR7i8^&77j#am*< zNmAfZ*5ChqU)6l*$2?BIze*n&2oW&`Pu92H5gq=gi8F@T$M6>4TGHB6Wz|!in`o`r z7%GE!v>C!fbT+mxcCY6_F}-%MH=q58OmwG@97yf$;TFm&C5gt=ZT&n0eQhNsdPNlD zr+&6=`ho-qB0}8{>HOM=VyWR7BzB9WtQd?c=Myw~k>cmFh!T^F#~0^DtmDbos`i}P zOxe50q$JwT+(cL-6QJ;?rjzOP(6K#!3iD>k9U54RUh1Yf+(_QyzAxwm!%HWB^y;^$ zKtgc`L-~S>dP9dYKcDrPMWL%~Yi%!5sNMR8LWBHCR;^HC!3OtB;XyWT&x*mPxw0z7 zj7I=#|8CpRHHZl}9Jf!bYi!pD&zwMQo?@1(9Xk||=Q9s^3gx&7?y#D02HgR>f?>b*$`^FGM+umS$X39E$bc^M`39J3Utw51Wzu_szvB@E0;{;_vJkQX&n8E`soY2i|)Xniblzp!t6z3 z@>4MmrNx>5hf{k8IW_eOv;6$>*U*i@wfKJ;`hYBCep!~*raMKt*v%eZv6M4&$qmqRXzEd^3zjz0Zt`=6!_Rb z=|0d^*mP-B#lGwa7nwuSns5<#vGAB%WUT*N0!K!Mn1`oN)?XuO!TMG}d3Q{IxTMM# zpO|L$|8sbZ+E)wym4Rq8=M5i(lX1y|Q!wGB{P9DyvvctTqOvnMFkEQ8PPD{4gJDsV z5enhi6P}JAoJhuobd3PE8qX7i;noZ1KJQG7RZEt{C>C3o1b`-G5_*mh*Y=Ai4|Rsg z*@9^Y4t@~XPiy*X%#S=wz|T4;Ekt_2=l+HUYXouT6xmsw^d7~_wAy!*&5vs80S(&m zT!VcYlk4w&kQ`YV)Atd1e3_%T4mJbE~Kdhq#S znLe*`y*o1^?2CKqSNcSNZnqo7>WWh>>xXx|0xN7(Ew&6R`c^t?yzBkD?X*>*s}l&-D^B3u4L+Ti9UC%MT_AyTwh^a|D>RBDLLMlQ^^mj0B$N>Z z6!<Kp*EPG4nmGJ{Fj%g8w7}G3UASK{#dn!MQCz^kF^P;L9U|JLl-N zp-VYf!8mt#V+zgQ>rCgW3l2~-al=|3fOW$Ogx#&!&u%h3TO3q#nd{^&^rrYNPr4n! z0@^N^%IB|hptBpw&q7%z<4b34i=y&o1%OHl_*>s`7xTVQcIEB10o$J=u>wgnkT*p$ ziQZU=T*64-k+&gho$dGv4UM{VX%8lD_Q|{uG|sw7)97WuhHFz8HcG{uu}y9w>N<9E zd^wVISSjrEnOhW=;25uv_Jo#{28~N>YMpF@sP$+sh+Usmq4$&XPwdQZ!<<$+mn2;gr*`Sv`i?7d&dV#p1J(0cW4|Ma-0MMHQ{hMJBBNGTlHJd1VnZm(x{KI=z?TmS67J<03Rzm`**tSQ47aJip4i0+ssGam-(w=OV?}OiBBfoVo=737NU$SNJd3xYUYVgTFQi0AX*)!y_BQTQ<WI{2=7f!3(6@m=)N*#mHX6={a;(U{G7^c1u=sROJXzhzkmC-(vM!3e@H)gP&aM$ zAHKgTdUQ9mq^)$FImLpx=HxI`mErjcALq7pj@KNczjELXr@W*5lD(ms(d8hoPkS{5 zdC6AvkD!}6wRO}Y4+zyfiGkmb#!>!BLnnxnPbR|0#ys#7oZ7RBR8o?>evc z86jKs%a+xw)5#*!M7CX9JxUZ(R7a5H(1R2MFqH#(RJjv~?@!~`eY83O@1Cg-oBy^bqgC4#}yKbR!vV9a2c zKNHd6!vW8Sk_nuyWqPept2Zbr%8{HYmUR36cSu@71?9Z|r5$sNzsB~?*6?}zrL_NM zny?SFJ)+6kDIfRXyExOm|NR?GE8H)RnpUyvT&k$9-$>I7%NgQPtOY9zqi(vfAi*g8 zgz`jWEKe|au1C|((SzG`Ctk*gf1PRH`e6iQO{8MoDmF76dDaD#Q!A@#WlXe$e~=CJ z9O&3zxE~>>O)2MMz}_o7m3Q!adzvydKe2K|0>D`d09lGR^Jkv&3dY84+Qqj*gyR%P zC&2M7fjifAmr3|~BaWwFM^B`0Aa@%wzT&5t^)Ip>7$%f^8kIG~MKG^;<*r+FNiq1$_!;!782o4dzUGW9poi zRF2Z1H1<4(!f+ZK^r%l>5+$6-qV+EA36#ReR^<0}N%UsF*N%>F>J+`lAWwd=DBDpJK3WD!b11ZZ~Z z-A)l9SY-QvXu2Qd5OG(P)nRfB)k z9-ez;=3&i0#%$G}RG_!bMSW4*wCdea2S+w(i}AcUj6}GFeHBl#^!~B|r}ImM$cgt> zwdn{@P+gtQQ>}t+`VFE%ZZ6=S*zNvV3T2kaYb)ShAt|@#uegIe2yn@MRsblta`y3v z*)04tMZnz(0J7k{jo-}%-1nJmoJ)*L+kH+GceXAAKHeVTW+xorAjQ>xkn+)88MaCY ztlJlcP69r9IoM(wb*j}6^X#yq#&gA(?_ zP5a88Q^T2J4q?tg-bbM=|5UKtt^83qtP)A#`(vvd}60MN4Wv- zXew1Gx^XuZqn#nge4=&%$LzEDWdya9jM;n*L_AGz%R${8wRs;hBW5GsaS_XEoakL! zeyT}Ty>7q>^=Ak-V4`TU7evZOg!QG zNq&WLv*N)ki2nwrW!>&4AO^o)V$U$}^E79uj&wiyO;f0=w>UZv7WQIvMts77m;9r) z8Q^i2JK@n{gDiEmeMR^_Oj4{f&3{#-5H+RsbfG6SZFCRFKO3O%-jvIB4d~17Q?inc zLMg-f2YkCc3K!1Z);{cps8fkdbo;y# zzX=1|_qJ$4vkT{VsFJ)1s|AI_46R*<>y*I9O@3Pvj~+$>Kp`5Agj?SPuP~vuA@?Ny zWO(iz;vxxN4|K<+I=RCv4nIkV9t8;-;Wrrl0CNEGb{|q+(hVO|O_mFEvarVl{fFp?{xwQ+CPh z=7k#MA%7VDjjdss{NKKuKegHTY*+b{Kc$)nXQtbczucYW(dgatUSsOxh~G})<0r2+ z54MHoZb>qyGkM=ka*~LAbZ+po>4>}l*wR2rw!C2LQ+@f}oe;M$p_{5L} z>XyZg#A-p<#No*6i6Dj{<_5<Z3O;AdEs{>-Mk=Ryz)DJDX;v{m5z(7&N&?c zk^9g_eiT_cNmfd;wWQY3iTS(OF8JwjaiE+XP~+PMtX2>Xna!n_M9&{J=P|qQc_#r>1{tW$+xYt`>Zyw#TQ!bX8>qj`hLPh_S^EGs|?ES%Xbd zfp4$hfG<;3HRh0?%{6F+O|!?UW#Y4wT5haGzMfV+!%YI_Ez$TgR;ko znd^AEm+6v$+3_z!#*IbVdT1A~thH)ZI0uW|pMv8KH_t}A`g4ed$^Nb%zte076(;vE zsZOv?C}W0p!f%@lwJ1b4tq3zfo%js~NTJlw4C}$RbU30pp^!^jp$z<8L^P_5Vg*1} zumwNJCdi>E-i9cpx}P$lepQ9$-}a-$w|R+PNRo&+xG}I1kJoX(#pJg*a8`h+2VQUi z?&)2Fl4a)vF9R9v-bIm^52vFhd^sm-^SZA>Q! z@2BHh`^%DSHGEi1WP)7wZWP87eb{KxoYZ?DVdD^Lybt$0u0d(301QG^AJgJVMLjV0 z)rUL6*b^Ww<3HB0C3e-$mGf;110@7WEB107)#eHA0@z-#5Uch`$LB#nH_+XJdk zC)3Yvc>yfza+oB#+JE}H&Pg$;BI<#qm#CsEt45=RB(`B1aR%q|-m<}~#Q-Fle=ZFM zPnD!iJEpZ(DY}i5xPs>ZYvjh#XkxqAGI-RMc#p&0Dj!3i^0K^sH7u}ID&!! zJnVHN?Y@UpyVoFBSW1+wPA<=sVh8Bn?gR{v^4{vpy)-)?C)Mm)FESE22{3m58LagZ z9AxW8pphs3Hx>%Sm1MF5Vb!|9C+< zBZo*&xN&bN|5$Y=$P7>svQ1g6KiG$-kNI1fBTl6J60Hx?&&VX`_HqaIZKWUgKc680 zP1Lcl0Qqy6_Fru3oB`$R(I|ZaR^QPd{%K7I^qeBf<+Di4P)vRUp4*r}di&hV){d_Y zDMXW09QcpX(ZqQu6nq5{uuWd4r?}Q*h8(1m5T-R?^t^mPWM+>Erm(iDo`p8=6?m`r%g_%mGHe_NVi8MB{`A)0o#j=-yCYfmSE(ErQ^k;y64edX=+y# z{EQ!1nwpfH?J2#sj2yr(4CQAhybwvH)>S_YHCSNBOkPW`PnL*i9y>WTbdv1o(CDnhm}KPLn=1wsZ5NHPm*BxcK^rjQp+xlUGtDeNY- zOYMTTM*G`Ccl2*qZ%=hRSeMytavzz~^tz?t(ZGIc)}F!7<=rROj#Q_q;nLaF+QJB$ z65j*`3q^V0NWwo=%Hj|=42MIoPKm^G6EQ@MT2}n!5LCy~wGLz5CNSH)FH+QS$ z8QUElS#*%$Mhyn8k32q4fkw5c#^Y{8-A+MinVS3&@f2Vv6J40TOHo^Zo)E|x;c4h@ zTZ0fmL@%U6h;T?ZD!Y9%w`;k`?ILDE-QV!S=ewcF{_h32Jpv9fr%?V!hJim|uyJM3 z`$m;>7ajw)(aw2$=fy$!lLU%P!!wR+YA>j3 zsQd36%2m>}W1pu-EY-H6j(Ppc(gh)e1w?uE=D#^zWT@XwQ{20u3+Z8>1bI2KbHdu zGL4Y>#0S>ItKn;BcY@io`iuk zgdp=Se+q!eeEOJk4!EH(GoRp49&K)W9NY@zJy7#u@CmHb_fDTd5ZgZ0@NXr!2L%_c z?<5)RiV#8S62cZlOnQ}ROb3Wql)(#j&HtL_vdWjEme{g-4bzQ?Fsotv18?)=m?E_0CA0df$sT1_ePuJc}0IROy`j$5~-#+_sN!EZP#TV+LqC3II84GQ4hz2 za0#T|6Jmd0#e6DRDbj-U;VfH2wGQy-bKp2FVa=NfIp?f8uMX0ERYOQa4BmxxSp2iK zZMl$;_jX6`mG6ljA>n^*@0M_o&f`kJghehAfFm*iS;uF^${F|$$D|^wPRkV;=TY6qM4CkuhLho;Xvj^oF-xs zHby`a5pgZhSdWBES7PU`v?KYbi6_p`xehe&j|mG#%|ef`B3Mo6@k=VWg!Ahp?i(Pc zyfUtHmlh(SYf3qPY+m1wKLa}^$Rb}R58$f?*^ zC)GYpqnTy}9sd-YGWVTp$xtPqI{;Tfn!7i>H9IcrY#nWlO1^nB_7wMnjt#yJa@CWCxUor;*#|Z8H z)q{<1c&yw7UPzdkZtHaV6Xlfr9j(Jn{FvQe9BVK?@!5n&9E_h5_M2FMQPAq#0JV> zAxR54+oYrX-kSH7n86*1Dx{Q0H5P?kG!H|3$GY~a$vuNNNnf_5Z=0z=|CI$>JdK&$Z}CEctBAD>o?iAIPDhJpg( zfp6w*F!DzMO67bQD1E|@xxIC2Wvk^SnR>+X+gE6MBuX6+va4Vp-G+Qd-+sW3MBT1X zfI)D<6Y*0Rh4u?`cFtsFSU%)3w#zrwp$Lm?gYcqYWLYCzh613gZ6~}c&yRZfjEi@q za_>G20#!}iew^okYyZ|580-hwwCDcl41ut){@S9A)K$LDrFt`H_A6KDT}7yJ-;!ru~ahEO-~KkE+yKq14P zgKZFeh{h0`g#x1C){=LIqBxRO&RXy(%I9|580U0$9E8wE$%YOhpN;i3+ zCepIVBiVbs`F8}2TEh3-VtZoIKy0v7L6IAb-Nskaef5x*9~3bz%-i{Ag1bniFI8@D zy7#l~Ko1rZDr}4Wg(I83v6njl2+scX@}hi8kFcBThnF-M5Y2qOn@`toK)|=q4`Z-oU4}bJBVU&q09iGMOwtX?o zBYuX}PrW*{gzwp;G>w8)Ab|8$)c}K+0U@9F^+!4p^0T+(l8>!EYZoawJaN{(Zyqs7rAEA@yGuhS| zZ@e0}KANo7g@D?iSfQg6q`jotQb4yCrT$Ye`m{3?fny_FsPf7lgc(p*p(hp?@PHX( zk>Bq|sJ(JEJMn5=mo=~r$nWWA)~rNjOwxa^c9mdEjMmQ;Cu;4OE(PMJSXsU78Nc86 z-n!ALOrcmKjy{quiq1p@+Y(>6<`r zR7*3^#!n|`lg9e;ioI7ZoR!`pmaO^Z{<$&0={sfG0AQQ9{AMU-EB7rtgMm!ABrRU? zJHU=vAg}TWPteM$qE!+YZVsgxM8(B#?qru)5~E=TgP&ys5xV6tPgED5z1r%wRXxht zwAqro2Q5x*2Cpcz+1kkIECF?8#Y2F)8s=~fkUhPU*L=%jMF+4Kn%0!9@4S7b_Vj%t zCBe&%e2G?O;C#OSOpM#Tvm^pgIpymltGDz(pbs){IFs>qu>V&d`Rz;@Nrcn<#y;|n z#}E^PqgM<_iDAjqnYb&r#z>@sClrRvp0t`=dwNx>pq^iUwQ7t_QeQgxA=ZXU_FU#9 zG|1k1m8Bu>4!r^WZE@(?%|XXA7a-6!ws6&u5G8ba;ppI8TY{5`9(Dt-iS;(yX=N%M&4P< zBw2`Ii_OnC0=hmvJYXP!kVpoCN-M_6<5ih4U@&}hb8{$Pm;X`{c_kZ;3$D%XWd0;~ z=jniCIyO^?EVZnEZlp9P%eM=7R4#w6{Jl0`j3RW==1RuLjI&7_Hhcac6E$<4DX!3!2qYP61<}@7~MD zQS8MAT>;eb3U_Zp#D>&fjkLc059q8&?Tb|-q}km^6J9Cr$@04?4jqRNu4tYP-Fbgo z@p~r;mfw%z^cA*IGc5|7zZnj|Nd5jGYO;__?HR`zoDgcjx~n4kySKgkNOQv#Q9%vF zCgp)7<#&sIO}7O+4^FEy7-~FuY=|-!AyY8ADT8|aanog~FHcjvy8~R0RV|^!TJD3Q z6?AbQ3txU2xVLSeo@7)Y&x5L5 ze}%D!S7NsQEaeq)c7bkZ^7vx!NNfXr1)qw&k1e`PpWehP5-~GGbDvul879M9&GIuN z2%0xm>h0zt>0a8D)KD*T-!!9{9+eWRZ&8-f9G`X)ud@Ak=|Z`-**chJkC+7D5BY26r8lm4H96Iy!Q3iF&baYm``+9@0chjDc(_-JM=enb-OFklJo)w}C#{3uO_5g_2Csgu zawC=#E5*CLBoPaN1V@ZVZCS*j%M+-`+ahcMhM53jD!^Uv9@wD) ziver>SBfGQS{Wp8Yupch4CR6AOWv#LEz4lZF~TOd7MpcJruo(SWNX%_9eoAVpYEdW1$ws$qV3dFh(`l+ZMK6wv%1)ky1sE59GGtC*=S(c zr&hkuB;4c~x^&N4GADkZY}j8b)P%1q%~Ht4Wt%0L*od2@fWsHCm=fa*UoVQJ-hCIq zp$_5^i8d-dS&)=$6E2;_fv%syuRwAeg&)~c#11NuS`ec0%-FG9;PX7{$P~-{+%mIZ zo0Vh!qFBV3g~gNZd5b&cl8QjO7Q2e zGWN(XS5$d=Mol*=7qH$sk8(3 zTCVDP!!Jv-HAGnSVA^Kr!LeMKdCh=5Hnomk6$jb<*UqCeVYNf;sg*hL)BZ0+L6%7h0^0;r!7l(p)> zI?@AFvXu?jn*GPTyKw94V+vReR+-c!Wvy~EXjbFoeMSDrCNl{+PvXe778mw)p4&-D z_t{gTPLG_Iq~J?(#&K{p33m~i+>uD3>rnkss`;q{^8FwW&vMu>SnVX}tRyV?z}Gd0 zXqNnm?T8r&{N^pzEl8GXjIV|L3zhIe-p3B$#YKh>Jv6qkhBqP}!qo5a$59)=E>evy zN1qxtmZ;ZFAIu7n zl0h6|^l+Plg5@sL&?o@PcdgglVu~3O|8aS45XZLs0o57s$XfI$LhG+Anng?ucE&g~ zt}rQX&wXP~1yY7L)g?h`Z6j7>mbkH~$ka&-?p7a6&z%XvE}JFlpLjob3}1v{Z!Ek8 z;UlKXq^Yb|mcVhZZzU2BDkvZxBSWGHe>10N`>~RbgiT&5wxLd| zqf&pEpJYYOAl=5Jxg9Hvo`4D%X(et52~GB(Uq-5#Vcx zyb6ae#NMs)NLg+ZG*}_?o+eAjMP$>16cvt`B8%S|s zm-j8YCu8@Jj(`vx7F~4YB`M>N&JZ`x$GXRSUf06!zTR4f!P}GVFt!I3sCOH64v_C& z28Pb9^u4>^xp(r>SGr*}ybBK1Tt0zgcS}4CxUQcrsmh9;vJ5Gho8(Bm_6gsr2 z-|=?f7NHoKaKE}xSoQF@WWjza&%1ifXZ7qV(Gzk#IhgM96?8yX!W{l{Rh9l}qIP)t znHoo>TWNz;0Y)g}CnfwP(c&<$Gs7H{SWGHy#f0%GRa$L0_M1A{hZMVCqVYsZMMBzX zbv_!tb2fE((!kwclf0!;QqJ1+{+tMJR}~-b6v)>7!n9`2Ec=}~CB)>u{8&`4Yf%0(&^;L9$_pUtF!aG#Z?(rGuVov&Rm@ zIqxx7z_0LUpi2+#$V*s&c*;DZUD4EsdEQ^#;?bhi>jK|p5h5ZbH=q|$f7l6(=dO{G zm|h=NTp52=K%>j1nPP2y_T~9GB`oBxRbl-P+jB~rmGko)h4_?VP(wh2|5iS+y0mWl zgDMRH+?dZs1xi(x`OU-Lq4xX~rdS3vnbbTJi+vKgfsCquoi|R5e|rMtz_6WDUz&N` zBIzilNe0x#ukXKqpgTkpfuGMzLVgiCYxN!%w}sKgHe5>Op5UnGh@xox%5%w?a3V!q z#jjjQ5Dh2h_P=Ay0I8J9XGwt=vHE4hi=B-t#m_pJ&|r;Sl|D63>+(`z(8>EC_#v6( ze;Vb#p_m#UD2BupiTJzX3b-?AF>dC0SAW}0%EvU8(_IBr-e2Ye1L3^z`IJ_Fj(sf9OPPF z?FYWcxP-pZiPH{N@pr~XML+x5__xUm8dp_L{B^`He^v@ho|a@{{zKb-cqKouRr(CL zyHN3(eNAsO0j;KkIut`@{olN{zp`jPQN_f_tekTc!}RP(oE-6V)yn@#CJ2DQRb@zW zz36nedO0)P)|-jb?+9QHjz5lJ>^vBk~;`8 zM>{?vm+^71WSe~_j5tC#FW8)nI*pqmZNev#ii|UdK{9 zkVM|$@zr|}**=gZELb~H)pVVqs!Ae1BoPE>{%%*c=G$DOZsHkelBxe%y3-ADv@B%t zIDEzH0?|Uuk(l`gHf}dluvWUp%ve42o|HC>hxpe4dbblryf|)2kkLa zlS2jv*AJwS37R6EQilXkkr#6rs*$X=B#z(XCC)3~I8Giklq5V7+puLO`vf$x=YtQC z^Iv(NDig$dDZa;^!}z|&89K?*kbf%26}>*}oJ-6-wnd$)O8`F(P_x% z$7#Midi!0IcZqjhzJj&_hW=8k-_lTZ6f{iIPjNvay|CvZm8Va9!kiZ0S&$;30iROwzPif*(HFNU{7qBf$KEsPXqbMn)8!`g$8Xrz4*(daEQ6a zDl%|slJ5kPweUCPpBAus3-#POG)wu;oB(hG-v_sbu4(Q&stsWzMdAr3Ry;h|AX4H8 zO}j01*Ap>%g|buMg{WXNuaMVBRgh(@Uxz@U)o+rahqIBTfvg36Q0KFt+F z_+!bGU;*xp)z~)Qd4IgE@F%$d=GViFjP@m@Fk0z$*dfgWQ+Dq?*0*-KxXY7Rcq<}k zA2kKZYLP{i2i%(2zly5Sw0gs=%(eK4f`w^B-C=Tri)CVPr<;!T{cIdl53&Kn?+y;` zgzO`7o^c@3iKG{`(uC6 zv_GhjFG1yiMYLp5C5eq7Ap8r8NmWtcwE^}CHGvyJtKdvY-&qDF>4J!s8zJgolg@KF znFj(2201X>??2h$&ArVPHUJ6*Yp`M{Mf2F)S!ZSoQZCT$$Rl!*JTYi&L^P{E{X(k1 zq~bRO>ZV}%m|mHu8oaO6Pl_&<5Q9!R@kG*2@k4ez)8K~Me?{qMcnRjiYt5RuHZX6M zkvvn1XCo`}e0nInuYw*9&8dMA(p+kjN35;gDZtQ1-}D zMyGDXpBHmA)n|jDDV-QlXlyvj5qP~xkm!g8xk`X~V@iLi~9h?6c`5Byr%@GuW z?3r`>gwEEugZh>C%L?Jyp{j**pJR2h8~Ub~i-eW0RBNA{7$_5c^)==eC6C=BoVRiE zZ+|*>CKUV(88tKU$VEQ2m~30aNY(c>^V-)BJ`S1{!w4x0uhpzMrvdZblVe7U$j88P ziWDKF$}Iea2dQ~7Auh{HL@TAnUDcL($s9Cct0>fZmBb8%s2SqFPg#6}b5e%=3|!d< zh^t*?A;ob`44{I?ne1rpL%@`Vssf9qS!x}t4RAPjmqsim+D}Xgb_KtWn~+XH6Hb1& zG&AE%?=80}`{3QqJj*2X4tp$H+TrpA-2fQd`!4m%Y+DdepX^_1M2qWC0v*pUGK(CJ zo&tZy!rec8QS=?wK>p7v40}EvNd-#A?MGo;U4s~jJ1Ffd{nteN{agENhX`CF|8U|o zA&RuW(e+xo`}C??+9$rglQ--7c+Ns^AqIc>93q_VTukgWbjf`xoEL(B38Tn5g9O>H z7<=yg(VESlmEl*H5dABBk$)HQ)vo*-P}MF@@!11mdOuJ}3NZ8}`ei%Kcss48398x3 znw4QA@jy^J(}@pF4@nXe1};0*vKfOh$@wyt(?L{kjGcYsC-zPqUH?w7dhU%avQVkQ zk3FNdzos^4a=6}^KRHb98cki58Lo&}14c~#*!hlx6VIh=rfXoNYCJ|lziQ>%j_ft&!CpvdD8t&$QH zCMo+=jPwLGCDoz5fkq47k<6?#gp-x%e*)v_j>7EeRX*;2`8M?Qzv3=CxV(&| zRTUpBaQ~tTD+_-7bg+B)y%^6jiX+LoVYfoEC4nL5S)k5P@uTlch;V9eZtnUt7o*x1 zPkv?ojg_{`RiXZFX)HSVYLamZLZjF$1r%SNQJ#c7rYgVTTDnFNAd^sh&^mev!D-*A zrH4_>GHHT*0&<%SHq?lXDAXXLoo!6t71EHhlsjc8su7pnIk??j3Qub3>+jKL?DqKF zxHHq|ZocCZUMk-|yry6oZKP>mGtpMIw)3ct+tb5?7gUlE| z?TsZJ-uVSu+w}Ar~72_?G*fEiJ_cz>mkx!_eAejd)!@+ zcq@8kNeu@UF<-UQI&jd!EUe>k>lXtbu9I%I5YZ#JG8^U4l_Glze&@o`2j?57XS zA7Ar#5qrvxd>4j{1Ackkf7-awI)9aac|1Rl=&~()pUw;TJl94r31r~V7 z($&vo86}1qzaob6c7wm9qQzFH`=1g3DM7&z^UjKql7YHJ zD@v%NQf?nZ8vP}A3NwIFs0fRAsLz#RfMVfWVfg2px^yx}!Ia>iy-sR1B2jY0Jp13< zAl1pzf!T9PXje2E|rw@$2bw>#n@P^O4j_i9-K@g)}+GCuuR%s^zQnA z`DdT&i1rVovrWhlv$*Buh+e85k)lKcH(v|cLNEml1nP-?w5qbkeuI81yw(MiY4YJM z%I3t40Ids0WhtE|29ifz|CP2xbDsc1P^Z&}DJ!K&rE7<+yT+2MRpSWwbSBJH$CyEGmg} zB9Jrz41|flJudjIk>JL)gp@=Dzz5`wM^X;OOl9qD+|yAwmQiODO$=ic9Z-~j?n%2f zb=%w6xKc#ubHAPB&xrBNk#e0#z%9nIMs5?w2R{y!#?aeGTt7WR0K_{yhow*-`6gj9 z%8#u|+F*CB2{oCt(u$F1TQR30oyq?4Axd%L9T(+M$2mb}+ijTyU~ec3)CQN3`u%3) z)1_cnWUw1^sf&S1yksN(*OakeNp(Hs z2kAd~5dM5enhUO_r~{>k<5CF(!LXue{@ueroj%F`-eIH-ndA-Aco-= zZ7uEh5zzxPqd=sQm)|zru=>a&;=MOv(AJU0`64NXy0Et{s>z6*mSE_Z0H_$0?YO=w z0w!@)X)I9uGa{vgHk zkRO_O#$p!?PoNK7DiI=+hoPaET0vLxR$ae5_`ifymYO-968xbAlyzz-zLB=Rkna)l zIT3x@R`hQuIs;tC{uPH-&*Q&qpH|U3eEbh9{r^xYW71Qb_t{+cUr+SG5y7+=0Cd60 zO?5J*fRe%`E6hkT_`E2dD1Hg`(W{Hb97!!ZiZU;GiKi%8dJmW|0bLAbn#?qa$>e+N z=5xH%`oFs4@y>EumC4Z8NtSC#CG4pA2Z-MU4k-!@Tb=ILFT3aOw~@UmIQQT62qR3= zs`KiugJ&4EH@|c{zIdFvp|1!GZS#H6A5#7RolTm>E>Vdw^ubt2TH}0dwY)A+>3Csa zecwJ)Byq%Pe-<#2G7|ZCKOH24s;`oK4`#BEUpN#l9XHMvURG9qJ7*`$e7#$d>A!084({d_%{BjyOyd3!k))Js9^cWN|FFHXT?ys+)Gc$d!n|-TJ zRt29t;jQ#ym9~m*HzB>J?-cn0jl8{ioBs=1K&8Jx<>7GQbjJoKlsY`!tc#J$oP$r#e_6bHl`)UB7x z59dWm$@D5^aM#FPGEEgCvPIGw38PSxIU>A-O=imPH_#mDj3BT=f<_lhrG{$yv%zKU zt6GW?q^o#3^+)EXV|W|Z%YO%n1(6U=s{b^yEiOSMKAuYP_aROuU(t+%8SX0vBY(hA zEQ`_24G-he?BhPhYsLWy3jj*jJoLH4pB5gQfbAM04JkbIUmo>bcVfkf` zvlTOn)oC$;AS26+Vm4ZyV9h9u8XWv&E=zj{z=|{1Wl=Yz2=r2I28b3=eS8s~-BB~7 zfSj98%Pq!`qR5^3wA^D2DU57={JL>~()x-V&ej9OtUumJBE5Hplu6M}Sk@Q)-l3GS3aNn?FgWgY>E zG?js|Zq(DP23A}t_{`8GOI=t~yUdkQBaFKPIG%pK^Q$8RqlVOjrBxEw@ce)aOnm#?3^dHwCPFYlU=hODUegEsOG56tDVlMjogmkKv( z^Gg}@)#=Gayx#1+K0ji5H<_1#8|M;H#h7etC7hI{#sD{r&1=^RCCsk8dv! zP{kF?k7wUEFM7U^{&OF$PEMV1!;Do?5;H$Gjn@3+uV4Em~YbNBq@^6Xi33ob4n ze1G$*TKUSmrnt80cTJP~tM z9>T8|7d^?rn)3_mwW73oio9xaH8xR%X5uoRqR*x1uyLLezN+@yYls?N7~#EU;Ke84?O zI=87!qmTF^!J#-YHQl=-UV1}xHQL-A@fhWq+JO?5k9uNcrAXdJ{A(wNmB!MPp#P$B zIP@yMeT!Oagtao|?=h-m5!HHhzB;{F5Qr2Lq7C!cdQp4)Y7AP&2l`370m*!#^ncZq z6lyJpm9(bp&H;@$0Qt@&n^LK*T3Ac&(9~E-#tLixY;7+x&LnBwby}MUQ^$q1s6hJ@ zbtr)C-g%*=5uBPp>b=+Gp_bw?InwRd*2$L&M`HQ5JldL^WR(N_Zn?U(LYpWt)_7BE z+2z7C`c2aW4xqqO){Pj5w zgomrsb`uZL+}Q9LL#0a|M$@#~^51-R=kasBG18UMHC+wYxX>(<`}WQ*^+qZ=t~o>L zWd^@?a7tUk;`>(X?Ij)%$w`{W(~lPyd!MgPPI0U}xLCZu7Bm!5=Qbt8To3g7d+!FN zkOaj@7gVJpj8n~gx=*VMfq%^x3W*!{R*K27q$h~l5EK*0sX{|(GWF>#!ST5y+mFEQ zP$I{>-k!>23=&Kr_lSby6lLmzvrP91OCV~}`^W3+=#S%x#j{LGJWK7D?`p-U4W19sAH4}a~AcD1^JTuRy*Vq+||F{0QQxhY1a7-OaY?oiCK2tE+v z0xit&oZ=}Ycu+9`f!3IibeolHVL;+*beyA{4r6!RS%s_~jP^;M0xU(^DWy*4e)IVt zrPNIH3eZy8NO5OcOP2E1Z-rNi9mQhpWS{)HSiM;M_;#@h%71{7K7Rz+apRkLUG*<+ z?{4O+Z!lL2fot10m{zpy2J2-jV~gh>{YgQ~Ir=-#w&C1my%ISuPb+js zA|V~g*dp3=D}@ZY{4~_B?QxFQ^l+v5YSW|X{WRjK`E%{OZnqZgUhZ&Zwt5A{pQm%? zLcU)!UoRpYLYJJQBb$<3_XwJxYPMfdc)tQHfXAhuG;AVPCKvZ zi7*?tK8ovlT*sNwIf@n$N#*Kbfr6H%4qQl|IuUwf6pz>U)}@>?a_8H7a>;o{_Ar&Z zL$O4weiOVn0(hxg3i%URd6t@vhh(%QzClH`E}BHv=hQTsnV_r$OJmaC>d>} zaAkqXl@w`K7g~92uk_0sTfv+#g5e#&r+WM7pD6$ZF-zgKL&=GuN}X$mCsBy6hl*}E zC8PugR-~q-bHnS^PP>d$7h;dJl_FP-3VWT=0Dp>7PUsVKI653tfL$Dv)xPT-*prjM zlcnzAn8KSh_7I!9dRW?bfnf zf$>0+QARQuZcAJDwv%E{w$dj+Dst1!3wRE>V_g)F1jsrk<&T=-$6T$i?Ht$(^e}bO z$bW>Qs=Pr<@1{gCRq0_Ysy#`G7Xql+18ZMQVlJw~QU^>bl#-}B_wyIiz>LQfOZhS> z*G}42_Q={uO(O$Bhgm6TOI{j_@FBMd#3_ z##CB8D)YcG6f=}M@e~o(L&v98hn><6HUb4@IZIphkDl-vx&`(BtIy1kROcZ?F?hT3 z>L&GthUbQ^Jn1Nvi>l|fxcbV;hk2{f{hk%2K7_Nfd{6lo7_?V6q7*TerP8PH{D1oD zR8)P$nGR2jvyv`B92mo9#8G^yTSaNc^a=!p^b_mLaR`ak#eT)8azbVk$(TtWNz?9~ z4@y|3>-n3btM!hpOow-vP~u9C&*C%Vtvim-G3~I@rNO=3yf#gT$gT2HRDurLlIARG zLB)QB_xuLA!#mvMk-4bOzHT7_oT#FT@~7qmtIxq$@A%NCqLre=2()TI z!7o2jj->UT^*O=lYDqVyeW~IFKjxc+gJ?n3_N9hLmw2F%JC$P7N6w^HlFDg7cNezlYf@DoQNU(fI_c!d6tSr2@S15b{@PN@Pn&sZb{QkQ_y3iy^6Tv9e%zq|EOsfDMOuZ%^ ztYORGsoysyL$RCGaoTBWmCHbzPeq@!NxG3`aP@9!8dR=B&ymVWQeA6X`Sx!HPtCo# z1D*W%k}7dUx6f#~3KOl_;pgkPCtGwmo559ZK_XQ%+wIa6tWrgqwWIr2;kQ*SLwn5h zvZAxL@^xAT@eGC)riRM7BZ^#|%}L_kTuv5BA<(d|d3~_HK`7 z_FdZ**Bt8&s^XgC=~#ND9}-2PK%yZw=?q*Q)rJv1Oj;e&MVo#}vanidNLOo&3DvhL zZ$hz9I*Xwpy8hx?7!!92V@Q=rYIggj@GJNy;pCC*MHUu+FU9`t37TF>;Xh}Tg`##e zdEny4q6c*#p??ljpB%Q~;cLHi;Nin$NiZ0RO_RV#`_=|35vnr)u*Vai*o0ROrAM+u z5XJ0gmY`JHzwt}Gw0{Y04dl?}5P?4BKq+*5OHbozWeb7EFZFTixJ8rrDZ8vH-fe!` z5CwR2@-8xQqi)Ll;67eJ3o0^&*5N(L6jK3t<|^#aGJkE`ylG&<@O!{am^-WA?7aiR zLS@aBSBtadV(*)0`pwFx3IyJMf)I@O`m|mA$|3r>@hqsspn6YhM5@BeZ8*X=1%#wa zR@BFHu^}v^LG8+bW$`Cn7>X?-99912r2S0x>Bd2f2D}~ZLnpRsSSb(Z^f9n3poJeP z%5>e};D4w1EEQ|@dKioc*GYw1_AsGJ5c>K;D;$Bjt9LpsV(($h|EyJYvQUqRkDo}N zdK%uLXayk=-=cn}lCJtqwpS0TzSZlXmLDE|xT5%SU<(7=Ywq<%QBt)V5nwk8ZgtQkYEBeAj?saz2*ME|O)^pA4<(0mI04tGa^@&=I-JPE= zudkOs>f4;b|GrqoT*iy@v-FB;ZXA5&Fi9v6s3h`#Q1N%#glG1&Q@HzyJS8mAC-?3L z0j$2N>VGQX(ia==6oQHw-iJ@v1U13WhP_|>-?GDRC_-PJP{U|-a@Cg3^y*4@GcaDP z)qhkMk9x+|g`XNx15hPQRw-%W99Db{}Y@p}2i!r}RsD+-!LsS;@Ua=8b@_{WbIC-P8Z z-P9pd9!Si};-M2H8CEzbfF1$BrN6I~>3`EQS$@}ZG@5J5f1k7Dxn{wK0oj_-$`7M`0DslbrYaQGa|& z=jXa!S>0O7d_8FNk09pjx~qEEB<oa$;8>=cy>6R)9bpTzH{&I-1|Em&mEZpDbJjzG3{_XcYLtM zKY3zyN`E#B?{GX(?vLO0DE;JqZ%yexru(uE8kc(he4pZY%1?5Ws{LqxI#EE`(cwNo zzw#gb7Bzf6SlLoQQl~5?@qbiuU`qM9^p61q?!fxdPT7I=@5W-tUfR+QtY0E{q=X{S zMw?Nw!|?3D`ej0cIV&O7i`Z4`9Zj)6J_52$(|&H>&337J zM^IdtJAz%GJ~rvG#jmgfJC=yyQ4BSvzK4C8*ODff)5OO;|Rm&cN;s()?J6eO`t5e$&D%RMm>`x^TQ z`x^Tw`y~5i0tuW0BtVd&WV;$tbhSkSd4SB5=lY$KKm7aecT?kIk}W3b?8TmKT6;z^ z8>d&3+0Bc+)$;mTv}gSLU;q54AKr|AZjz&PwoGQrg@K!9ix+#h%jNw0=g$}8+vIMv zFz+VgEM276OLLswJx{N%C*$P##|egh?pU_-{BAUv?dA7=pEd4I=gAD?UZ>gJXt^-c z?4}svI32IQAU z&1Cl5p7G0zz0iz8FOK8L4P*Sj6K=rlaE;R16z&AS52==Qk&>FHe5E{Ppbh{!==bSkO14sH z{ORQU@m^zg#=ww|>+4#m|>#uP^uC{`hj=@%@A1e@_pd z`A-|;z5Gy(=3nEtKH9}khsP)Tg!I9ycjw1vr>Fb!IrpE4ua44bnmu`XQ2)qz@)SSx zmBrQcm2LXv#qHH6`sJE``FNFFFV9EWjo74O_DtK2=uf<7yu%i_q$DoWIlIM*T>hiE z=a(c~PR66@;dFAN7K-eipWpvoY*YCR@^vnfvDolp{~g_qve6g|j6L}_{bZc|CRVxH zd8ZIi^2UqgCQXcYXY^U+tmZ52UW?!Q+R&A@4)FUFi_Pa-%7pxX(Ly@*1-Mv#+-ug3 z(!2RI`Tb&?P3BAOGe5`MRj+7&nO9^R_-M4y?9n$VWU$<7WCg_=U0{L98Y%(0**szM zznfhp*%TYQN#9%==3U3>>iraQzqle@-Q+@;z3i(*ND--5nj=U) zy39s1&8r_SCZkz@xuR^$^^2}1iCtOF*fX}bUyWurXUFp4lG(F&7lIi%(>Mdu3{2CP zX`UBC7A8|AZQnrH-ejZsEjURhZGTF$f7FC{&Vt&}eoWH4WSM>5Ye?b&~5XBuy^WIoCgV=}wWMvG;(8ZTE_qHYj#^F2JM1wJ#D zx1*&o&(hz2KN|}u6u49iL)IL{TSPi-C8wsT;|4i5nhYD@^~2XhnG zh4|Rg`J<~)$8gp`Y#lgu5xg6mQWZ?B`D!|)Sr>JcWMa~BV+GxGO5?(BsKja~ExRFI zA5eR4PwTW}ad5lIoUuW;<(0TMS)_=8o-i~8_oPD!M^nD
      sT?gTmW|q*zhT$IDcq8cMGhDBCU; zTTVl*(I+7mC84(Jasy1I9`fr_lizJn@*=++;Hb7Ff9i`61 zY>b$(a@IV*D!s|T%R!^Ro~b%T9(j`~PVid`<5`vCWC#tcd)Ru=v4OmMHjJE zxjTkH@ooNj6fGMo?HXg{5EN@30m==rzgya#T#9rF;vgb+!6jIuUa;%(f_Z2F0^J~E zzD#9wGxWGe!3En91v_lfaVm5bT6|6qx;8b(pWG9+ffA8F44a#`AyABU>WK^3jz1y~ z>GScm61F)9r4`vb%rJWgCTWImX>_l|nSj5y6@EE@-cKC0ivp{Q0_(4}-~17k=s&@a z*K{WJ$NDjQzZI!2b^z7}9ho}7kp!`O48*U{y!k^-xe(DV_ea=CA@CoNuD*Q@n+E#z z7gF%4-M9Z`aWG-X`5df!p2fyLlJ~8N(lJ;~&RN0;%%Pgh`Sv*8x8@S;5Sl>W` zakjz)t>SHEx~K=1-d0x6dt0ITm)>Qsv&GZS70DYWQLmckqTaoL*omm0h322Y>ntUZ z*k#KW-8f+c9gg5Kl__~VtR{3s1MW-51Fmr-^0|brp}NIZ@iFBvkFUlOcZ`j>0@o^Z zDX%gwmW~snmd|pT0g~5x(9SXH71lrn z*d0U*dO6^{G2+Vhm_hI@+iwZgg!=D^H__M@g-S|QFv!s2Y*QJ-SyX}c^qf#x5!-&k z-vzUJ%^WD3?C-({tJC?+4pUZ@8}XmazA&7GrI)qk2)PYjn+;hY8&H9vF^g!GULKMyj#ReLP?@w7GITnxRilisU+CoIEeX1m$czq+D1g@G>6l?j$7oO-&xyU?TF|0I zjl?QZCrz6ihII@OMc=rM4xBBTxYO0yK`)dYTof4;dn-Yk{ z-AW{Xrc!B33{I8~I_&aRC2<3eOfdY;E8^&!DRA-pI3*ci8=EmE-4O--NzLR~S1aP; zkKPeAuA5Vlb-pC}?v_|Vx+W7dqEoE8LlSXUI5iyjic`vFi$%OM%GX0>1IWJM>_``X ziVs)srsyl2pbsQl-&GfN=v@u9a&t9(hDuA}w$!TF_k)|6-eUNQ1r%m8M!s2B*e2N6 zFmfj+?#d_c4@UQL&GwDLYQeR#8%Q@B(`CM8KKep8Hw_-xOk?J)_?iw=R*qeOHwrMr6h?!?EO3$%bE zUR>x+irl~C0C6$&WMO*Z%N51GuDFy%eG$2Q%s09U_^DBG1@T-$r;uZ17fokrgD#uZ zWC>d)h!?uVX*g)k6hRc%*V4sIzQJ-}LS78XPBpv`GF)IO#j1_dxHQh^n>Lm8ybqoo z>0Mm6@hZSku~_-~cANGQ(DI(|*DMd9>r0f-Zo4Q`oY|@wiLxq&|HvHMBJcWq*nvNh z=W6El?5T?^oaDh5I!D`y67V2y3nt#-?6OTcJ9KwmKFgobz*nLZSAq^n-7`#heqr1>)VmLuw5t$9f^&~EJDQ`(wXlu zL*A8B!@JXq1iK>H!6;|3jYog6$%~-0@lN6hh&(eA}()3C%OmPWdG3ov96_>=HV6QF2StK#BN$L@uMNP=afu2$jYoe86 z%d|`#tFChH1|TKb)43doc$Y$wtk7bL(Q?;?>rQz87TAn)B>ooU4X@JOBSPU*}D0Qu|Y1%q&bQb4BC%!?4e@y3epWXPPQ_f#| z&02}Le3S+(9?swKX94D4(0Bg_vf}(Xp69f5+cTT^wR~H|7azl^j=_lcX^a=Fh_vg< zHxGGX2L7>37SF#v%Ougd0|Gw>3-rxu;$7UrP15t_~eHQ$pw&*z17CRy=aJmz2~M9m3bLyt#_fzLN750;~H ztCV46GK?UGespD2HjeHn0q7cq2W~Mw9hZubcU-}t*yug^>Dfs}N@g2kT(;0r{<;|E zjY~N$TYMZrp*Kr7=lp3_W$gg-?~fkE$n%P`vPQ$X;Q*0+FSivDk*a;KL0or}+DVcfdCA z@sWtj8{Wd9_8K@Ymg4Icn&gS1XGe0rVD+*lyDHnoE>g6ifT*)*q3Br3KQcVls$36a zfLZh_>H#(yBa3xfjWM#66R}Dahr%nPSQ zVp%k@EKOqXA}WVA%foa&D>}w9MqfyuMn`5fea9y2qR$A2)!(@k;joHGE6In3evU+1 z84HJ{db_CIP%Fc5Sd+0R3!AL5QA`VI-m`oYIYACP; zvLy<5e)ton0MlgS-PlFo14^j@(EcsQ7a~lg`T5Mmo@Tp`3Z7SbBX3@gvk_}td5Sh6 z(tCdThR=m2c2F^6lC|@jv%=)`F?)&eP77&=dK}&F6cNGLs!&As>T6#`tgs>;QvyBj z!44^%#PT%1kPfU=mkm`@3q401E9mzynNo`Fv}s0$8<$qG9Amn%#hvk#0$hZ%S;Ewg zu4=3?f+M`i7V&k#zp0J3R#8p)M*j(;c2_+#ZK!OZfa3HM)i7*tLR%C%4+RigSg_>$ zEKh9X1_kKrB6oX{6uI%y?%3}C@uSrabCJt!}_j~8Y4 zOXH3@EW0DArlZJq6cir5YPz|ItKHM>z7sCKlH_$tXLQ-c_XjddK1hgyc1=V(KKhCQ z?KshP7oCScASZgaxHwkm%gxZ6*HXCq`Jq21v#oBPZ-aK$VFG}Kd0>k%`+kw51RIIb zT>QZCYKIYR@5%0be;s23#ut`G^a8${Ac)n{fU*&}IKUz~#X@o5M?Gc$eX0VsH1Zd7 z~fJFC}7&xC|%vLLP4~MswlszH{i)BgyL+9yGbIaPCaomNDR{o28kL zil|3fOW6QA?Md{yuCiw9f}Iwvr=h|-avE%<>wjUX}oHZghudXRX z*+>lZ!mk9@%V(70+<*lMc@mT0I6}*9KWce&fjLE$ml`cgjpsXH;L)RMXR-2>NanhE zz6$`}rvVGA%s+q8HOa@LMwz66a}#GSQLvvX#nSQ$?6tBL5;JdC$4X z>6osy=gl;7T7H+EyJSH{N2Q%W{K+?~)MS%pJ07O_pV)Z#W4%NhDP0b4XuaPm*ffh+ zH5f%l&xq9(xo#$Qv|Uq>)~;anc}I(3(&fe}?nr5C%cAgJF0ArK_XNWV#7OFK*LqX? zB$CCuhtlufBICKJ=>k0{C)W@4BO=^u_595TZY15}@bkW_pwo}phTDret|nz#;RSlv zC)0v-#lyzNd;){)1ck50z}Qx}A{NTy(%mGzA`gw*38dX&;G%gXKFT!k0?A!`r!boS z!i*M&#Kkq#pAm()&RcfXdqQMh{Q^l~WG#kn>t;Y7(ep<+aNa4ES(Fa0FvDJh9t@YUWGFwSvs>8h zQNBF`CAIBRiPBDXoQIPiqo-__UX7(DdP+z|6DSX+yxKUFh0-w!0H^sNxR7r6TJeSFjrizbL=8 zqzB|8U{z-q6Pwcr+A^CWJrF45jUJG5$X%5MWf!>)c0kAgZ5wxweHRn77@>>F$0a}7h_GEN6448^6E*{oM@MR8b2di6LdMoo)H$*mwAzNb>*m=Y6Y`9a%4 zJEz`6n^>CL=PPzRx4P5ly*D+tSJ_o2Usqx@-6e}O;fn3YPw`AybTG~R6kaKX3&Z$! zJ*~o>lP0m-lzG&8DQ8Si^ZP7;kc)IiacT?W+^!{}zh(;xC^lAw)5p|)ZOr>boE(;D z;|1=}F>SO8wWawWCPP=Mf4nv16?(fZ8i*zds^B4V%s_hm5>oqz{H9ZK$PWU-HuFOJ z#g6zFuJce7uaC3`+2VcJl)DZ^Hu-vabO$wj!v8?#k{fDX-2fuV){%uRUxK=n#cRY@ zfa7-lW z^fAfd3)e2u_RREjg`4hC%rO<+DtLlo?7~t+bDWP!iupYwU{WayeKyA5lQFg-K3lM zft&#W9!i}06!RhpoT+I z+8)UksXg@T9p4v`S=n7RU7V(_?}*`+cNeT*+5K zyd~tk2cc_*Y@q?PbZ%bwr4(~pg5OWOT67pkJe$R*QvF* z1^$A-8mDm!QW+FgVfvxIEH2{~xJ{O-C$lWqb(ed>*AydN9wt22Rk~(GfHyS*v}fd~LmcZ`h*n3GN*`eR928=cjj%gOLYM^~()@+I$Xe zaWL=S;jeo&o|ca^&Rc4{hFcS z%hJc#_Z;=<^=p-^c9%v6YJnQXFdFi zvEZznkJ-wI2q9NbP`D7?Vy=44D6$q$si%ESG3phFsphSs41-PkMtfQNbGMgFLw|6o zU`PFyLIPT8qi(H!CVy?eWvKX~^a=JIf6bwwKD`dE^Vh>~6$}27MuzQ`D{V4YJ+Oaj z$J&3Mv-$^V5fOR*#Qo^^dM!t2}i<45#;XR!@&-^^dfJ>zwsL zoz>IhS^eYf;5vVOIA`?>0%a|nDMiXA+#qL%>0Uv^<}-h~LA6FE_QjRPy;qsIry(B%V@{p!Lo11K3qy@!uYx(%1OK9f~rvMneV^e@3y8K-S>%TNM6_xz->u*No)|aoU|q=2rU5(6HChTD37GwO^ae z$vUWgC-$c#-NUcl?sL_gRyXOI$8uk5RGYjlL%tyJ+Jb-csCT^;_O0f_gLdif5Yv4| zw{^%q4$Tc2dpIPJ#;nxvJE{Yz+GKBEx=$A)D6RmUHRtK%^bxADd=YP!() zkc_wck@7^FPFsDxD6r{qpPelDX}qV;n?n7If^(f>fIa3u48Fe7z$KhI#psW~8%jC; z;(|k(@Ba5^>ew*(`7c-WYgE^q-3wbB>UvVm7S(-+kNwKUvf7#{nRKfbrX(luGm85O zP{Hw*GU>Zpvx@VEmQKZQp$__LuIM#+erKU*!mL8kPP#(hMATLJ9#Le|CmFPgRVjh}ADKbiJpJr6tHh(>IylywK~(+habe{s(s8z(r5{^e_1lpf7sT*GiG8SAu1D9*Urz)fe3vv zd!CPF!TD^*UE@Yg{EB{hai#GFO}~_GsFSH2X^pTW;ewr#7Wr(GO&)%ZTXa9lbyIrp z%)e~k`|V}^;YYM(`}9)0j)2mIv>>IGuIdfpj$7mHbJKBCgPsKyw>nVITTfDnFi3c*X;nXMi;2;S$o*Y~D-dW1D-{QOk^>UbK6_Rg!Y&n=V{V3qeVJ+bZIrTmKMdz=)h`I!bviz1I7$~%GY{(r=-;Sh{Ux;R{_nrLtVdr;WKY8S}M_#*#*H#}x zF9^y9+0pTWDkJaMi&U1EvgLYi^vglPv;MD@0mWc%{){p7G!-L-^* zO+;4yGtfLwQfeE$Si463#(4nmLXAXK3FDG=&+eUY`&= z-BBGY`Q81%QBFAt00<+YqL3U43}W7l<6QfEKXjwL9m4!smTf<`)1ZpQh&A3ia1QD- zv+t;DY=kPK09A}{8%sI{zB;fQ4D8~ws zW%RhF34qpt8|}bclXb^h=^z(t=GNQ88An{dLCC&1DZk`^DSx`^{TGiwX1zSB2SrC$ zf`d5}+*$+Q-DOJU;pBnnF^0Qqoay0r;$OE>d3SHuvB zo}wdSPispGp)`b`dHy_M%GRP4V$ICV1Z!J^$v_@aQ7ef75*6vAKFw;7tqxxgo;4xh zK4g}sh&u$w}dd7(;Y$qgRFW_M+I4PyfuXEb=yxI!r* z^yC7TooAeBvw&qOi@wXhfPL*`Px}@4RV@NXmXk@V3pNHzICKdf2Z+O5;uNk0?q9_p zu6k7#N(nMT*osO7@lThgFDNXlr*1jCzR-33B{Y-1hWDYDSM=Guu>iH8lX^7^)GRL{ zg7@#{gv|Thp-Y%}&I@!LT!cF%e~i3Z8HBA@J$_mON~erin4^moFF~%lQyA67749LS8uF(8m$^8 z^z|k?7`Gyegj%GlHwU}&)M_-Lt5+uDH1^dj6T*BXpI-_d+3}GbKL~bQSvc!M&mX?} zChuOp{+B2JhX#Zt;Bc2AZh?aAW(FM$n)$~vFA`e*S1q8QT#Yh<{qdaW31I22ebKkT;gSpTF8u2pfs*;ZQM9*pNR5F*5>+ zQHNH3LIrIV(ws~v43h|b!Jy`fL2f27*2gL}BMW%9Z3*WfX6CJ^ewK?u%G%Bh&1itW zsrKM-I#zaHkZB6{^dp5QrmX5)!a0Z+Ac`Z~XKJHnibXo0-b?uqg4dyO+MR>?%pL@w z0&O9LxHFkrfd<`ZAMoB+Ki>~o=HU9zd2U95hJ-BU$<;2LgKFm1dAwwFbm?iVDd3V$TEjK ze`bH!Nd4ImIO^-!^Tu!EJu$=yH|(7A(Sw()aEUA2{PNYu;G&O1N56@Kc~9KBSHAl@ zX2`=XWB)w8{XXQ0a2aU%;dlf`lEt{DwR-fP`hFe>r*e^?ST{^x4|TFWQt1~u2M{5F z4`m;A&=3jOLFDA6C%6=Oy217=8(M{+UXf>rIte%HqU5NHQr9@9Ikw}BXotFeL)Agr zpK9!F?9~C`wl%9p61h38?DU3ckNbYaBZ-t5WL|m5Pw$r{Ul2xmAy}NIy`C=ek|TaA zQSt>rpBD<(13lK`0JrjnbeSwUToC?wK|dKb9C6FuFVRxF2XmjwNP(U<$qAlW(_}yS z>0m)7uW8DMz-~I<)b*>0qJN-~;O)&-eEMcf!W;TX&<~hv2@+M|Vf9T5>F?lR159`KSURD-@(E{KWtpwP zeRq`tysjgn&qPaxt*Ng+6}#IlW4bUre2ZT$OgwUcm@Bfsuc|-li_8gY3XS1{h^y1-))yU4@R$i}qbfVXmoTdQ{OUTVr{7|g*-{G( z?%^BX0xLh!-wIR-miB?P7DvE)IHBMc2A=^M8-^##2y0UpHtll51%X8usH){8t}-jS zmUJ27V0O&?H^a!arfqJrecaFYF)iMj^WPr_Ul5h^_u$}%?=b%`4u1Hq^Luh|KGNH8 zX2Y3#mLnALRs+*bdS#;d=dm#;71aY@bn0j0T`SsiGBaC(r{Y*G>YyRlY9@4}Hlu9V zKIgey?&@q$>Ylc6A9Y98XJhFF9xynNt-knz?A>#Wtnard__l4^yKUR{ZriqP+qP}n zwz1oG_ilGje}89A?m07Oa&IP+d*_dvR3%k!Ro*;#YGpmCWUbF)V)TG8wajT1f7O)? zeoM|lSMVCt*Phu;#EY?)8#xMYOdNrBi%_*XB%tE~M_E=Ts2sKwSAI!t9s=L-3=uyF z5my*clfll4K!f64;3Lf=L5FQe`K8xkN?(Mlj<`es{lp-N@zW8M*QWR~jhTPt>^U@F zhlL8lGVOPOJ35sO8$ep-A3*Lm6J0?>97kEbe@E3w^`b^f3qUXE7QKv}^RR4Uu(X5b zwu|G2?f+93hqC6_oc1RhlmuH}4)Insy3`%hfZweMdS{0){ZGeamO;<+l%tfjKLd=7C5{Z-5vIE$^6k&6&OzfhhpPSK0-sy z(-lxqV&Nho8BmXYWVaw0P5=|Urbl$euZXlKlRt_<@W)vR0b>H$N?bYvbL%_9VoVSb zN8{{P(@*2w!!bez8X(v+ES+2~k`C+}GSZTzKJ}ne*9q27lV)^s&FCYg5C92sHdc-X z?wZQ2V!Q~=boHGL@pL{4Pd44>`wD9$-?5);Zg=!C zIg0a;#T(9lb6H-NndN~>_YxeWc$~TGDQJlqjH?B~rQY04TuUO82fP?a8=&(PG;QCG zx#CVe1i1xUeAd4lY+YmHlc9|pgtqJ%jwXDw7LaFO#i$xcK4x~%2Rc6=!KQ~ki5f7c zsJ49a>R2``SO=9(ImZfw$;>4WSIrts5x6{Z={Oun>Pccd!!7hKr8N{yuE@L53%4~R zdoWk!7}RCAe* zLU!di975`;JgfMOgl>5do-VSHI$5rnOOv+@YhB-;w$jI63?;WZmJT*0&{DicK-Kb~ z-{l>%rP^c!3U;6sh#VDd$zkRbs#+~r61ArpuvZAmr96xDyp4;fMB}aOD|-OxY&^lW zE=NEOKg)WirTf!y+5u^)cd$y#FY{xsD0NO`Eu%=2PC{*$iDb+^oUBdUl`@s16J{MP z%fgZ>+BBzk_cjN?hXf?E58P7w(=i}%-aT^D>(N4RXE)f&{kdU<)M~YW=*Dp}YCB^V zXQ?N1;tl@`ukhbkZdFpN+WxOYr-5{_ua%dj2o_#qb~Z>tBH3zpwAVG_yr*9jt#g z&(YS|!O+<8Cz?duoWzuzegy2F*J4U61pfe!KOFl{y#1Tp{f}Ar6PwIz3_nUYEjv5Y zKYpRUlY{w>>di>Y!pQ#5PxSK@T6PYme`rDae_-#QP&9U+`?1HJjD?N=f!^t)jcrVS z9C2pme_@3G4Hev0<+8zHfVl!s`~~;0&9+F2=5ZSOJDAmG0TVj&!{CLJNYGzRO~$T1hUY4;@JnNSl#sMC|$? zX;V_|yuRoW8CzH#5uKR&7spHvG?3)Z#gjhu@LkH=F0!R0ksIHflI7VafPu5905Hhi4((LR33AR!{d( zDi>YM&ZmS_OEJo6rPwJ0XlM#9gOSIMLTrmLH^En@rLse+EWx$`;mT((d&}kVUs0pP z(l#iqm|-m4)cf)*P%6a}UaSSd%Y+#y?GQOG4$#qBqq))Wci;&*|7FJe7o7ROqws%6 z;s4qw{J+gj`2RUo`;&72&j|-VsrX;B4H(&fQtwYr{mIAwZxCA6f8}xl)_+;D1g!r? z(z5>RhW|qdE$hFgTG0J}gU~WC{-=ZLKMr^Je?Bf4SQwc9b-?|%1LM+LJrQR-`q(q` z$v13ts=h|~1ryPb@v3Ewhf{j%n6-TQ+UiEAUX4Vm!t$J8`AzJd4*dn-`8F(StZag+ z+C!tfFwF-H2M+v?9edZ?aOHVw@5k^YdhdHlh3`}4`RZ<0+1J4&-Fd~%lJk{8Q;7wq zCZ?sgv*X(ly6;=+dBOynOc}55>oA?q1E(^+O?$s>&qo2{^3AWehm!~{j26$&BlPcV z3$OQk5f#+kpN6w@3Q4id8Q0}dy53vovMk$Ip_sQ@!0oQ@)NolVK=wdw?8Oxq7=Qk+ z3pS9a-t>v3<;-VYAAPEjCFPxfJ?l;Wx)mHNO?3;I~aje|nn|G6u#~)x85i5oI zNM1xr{1E~G2?BxMqfv-w42_r{+4=(c=qJw)B=vxqW6K-3%a9v>Dvk2TsEoTDgF_Fs z>bp({fP-p`mJ!&Bx?g_N#n6?0P&5-Ggz9C2qtSems)ZS2)ygX~lZv(3dgeZsPCW4|=1TMHW4 z{VR)4q z>}^={DLa20{Q8cVCEf-EuKLg|`K}>ROWoe=EgU^8srvv<9K@MZv`Q7Q{#>jia*N@r zxW8M>WPVcf78nnC?jbb-6ubUfube{voOduIjr;QuP>;RUG8e#o^#E$yelU`denBlR z4WWRY8|v!(7iMymQveKvu%V42j5O~{I-+VGnm5{!D-XX4mW2O}5AAz7-z>tm>6X6W z(MfV&i|4qDoDOh4YPIPzR^N|A%U~sER-!J?iCzw%=YE(*@G22xgH5V36=zgiQ9u5>%Nb5*EPf;py;SkA2 zJ~BTL`{WuYf;a@t@Cg}(kyBeh@6N#jGZ)@ zV>l0kNMsd#QzmqRP^}2ZY(pNt%ql5PGXqgpy~^{%OjbswvgAJHH^uqNOTzZjP%QgV zIcc-r{T#|?G_T5E);oIUD|QvOcEeR0uLES1M{PyR4bi;3*Ap5fy#{%gFh7fGt8^NK zc{ZA7kzaVwbXd?veX@Q_;d(P|J!ueyXPNg?g+CQ{W0&( zU_ykvq1VP*V34sDs%_}}0;VPL=9Z+SOjyxmPEcHl(C(bO;%QB^S| zizO&BlFaRlrfJcp14$*^xh?TAJf&(5R0wd3+rx132y$c#boG5N3QGaCoO^Kv7jk!HWH%$(j**#LNv@ zw$(Ozg$&|8j)Q=4Rv>v4M5FCp@|NH#bB6pH#S!mP#q(h@8E4*MbfRP#Gh{lGX@f$T z*Cz5Pt@rb!G8EA)k}R-fovXngS#B?7LUc-!NP?qK49ne{k&&!qvmsQwXd=x)4JBz5 zX~YMiYe_5)l&42fI|+9tcW=e%h3Y|6mLh~l#^@XTmW<5drp-qQ|ke4&2sH)Mi9JgA5MH>Fh>5s%yU+v1$0Qqap)Hv`2EtNL7lJV*!*dAWycHZY7RQnQBp+?&KN6=n1*y_z z8M3YywiP#G86~yN=oof{r|BW@1-#MW%p*Iah6LMp6rD}oF} zwis9hlxL=LW~-=z#TYyCE{T0FZm9{2*ky@J(r9qNz2-;AtsxywoSZ+{D)D)YG7VH5 zmTV^|EK0tX*VG?TQ(OmDL%mla2fA3?kuZM?&`vtH_0x)&1bl9B1e1iAl_wj4U5AZD zF=&}ZCcg~ar$wO^1v?6B4Q5%Tne3M2GSCv{!GQ{m0Q5)!DEG@%W;}~IkoR|I7U0J7 zN-2y9G!YHOUcNRcb=#a2YH-JR1lGu0Q8rX*l?>%@$b)zNGA;%PUa^IEv<62Q(-e3D zMnTfkXB?@q`$%(5k)S-B^x;hFgs`dcZ(pX<)1|+)FmUDz)Q-gKldBIW> z1&o;*uyF#B2(1xP0!$qeA-&|XHF=S_64iYDRV2-l(!NAL;gNLtF@uhvA`qs38McPR zdds0&R(u}ktoc4+^`!ZD7^|@x1w?itrI`p9z!~s&)fUx30;Qh*{8*3^k<{FhfSP#4 zs3X-=74&h;Aeh6jOT_Wmqy{K#Y1Zs{c?rZ-f5`-uOMxb*%0b98Sv|@#h{*4%K2;^^Q8yrO${TaHek1o;&w#k2?h+4oI!uWj zsYQ~Tc2ms>&##)v`xQ{hWx_`mp`e~7X+>R5+M=F?hzT2i%5i5fjwFLzW8+nH!x;x9 zK~bd$Z`xb+OGo0=;hvI&pL&^b16?e#dOrU9m?ynOe<9>9!SMk9QV}NMDtb@I2Jo#3 zJ<&gkV2CWHYSn~oc~|P#jw3D|Hw&$CW15&<+J6V5;0kT>l_W#6BE&%}mlmk_ty;{v z)A$0>c@(M9e~u5_%Sa6zi!$=00bB68LR#|~{$+{~VVOk(R$5aKBlcWIm{Q!E>K7?Q z%9SVz5i1oXC>BFr)K=^y4Fusp8rexpY!&R5i3a0vHswdUDQUb&)&i<<@KPs?eDXQn zl^H)$Sxjn8iKoA^(-dSxe&9C75dB%tG9#G5fM`M+GZYyJJP@{+Cbt`xg6aK%hw1ty znWRd7|H!lbJIhO0O$|)6cWu4qlXne4g*s=*5StgC8Td447xZqB3b$R!?4hT!JLK`D}PuGX{ zg7)nM?b-9)&LM~QaQ08U;OyD0*|S(b9DZvp+cF02h#^;_oesj9PHRRUQW0; z*t6hqX29W2fI}brduLzyeHjAiN**lkA6Mns*zkKkh*+DgB8b94SXB^Z?_xLYwYQ&K zY0OT>fpR!kt~psyc}jW@F=o*@i0_zylFiD&W7)8qa_}~^$JoR%o9IEV;=P9ln-c~Z zCil{g?4}&pO*n8GabncrMyW#$Q~rl8d%3flypnU6tiRJ6_Yx;|!-?h`ycD`SRn@Ua zppHbu{xl%f5v#8C+B>x_KE4pG}~8Ze5+Y3 zFU)S=^;>1aJ7_?ora@DCn^Cc5he`38 zJ!bbDJNg|w2v_7a_Hyfib7Eo(whe@mF5eLM z1X1br{P^)L&3<~zpc%tq3m$GDofIp}<)y|Xum|}UP2`@-D5sAXf{BuIU_Gl9I+RKs zdq_6)fHX`@A>P7i1-j+nMS9qE1jX&x1!JXb-CQj#yTv{WA{4S?V+WTelReY+kn)4a zHbFVd4spUM>~eb^ZN?EO_A>+~2ToHpac(#b%$u&elbV`o7ZELoQ;TpE_sJtq>8}2g z_bYhO{Hfg3{u@%c`>^!+15FB~1!mP{#zDPLa_?`}qp;)~_O(ycL)hlzv16MjEKJJ3 z<+ZrCn?6MqpZ%SdI#2F~{ABr<>I>JfgPvb4Ag zsyD+8R7t0M7V6JI0-IvFBss8M$p4h7DY|Y<(-a=zg$Y;Uyf`_x9z!%jkoz1GCk%Qi zPwzc}GG7S|tSRD^L#PstU&#|R!Z5ZUbFS)TD(y|R z)z1Z3Fyz;R+hmCcEgT?$`10#;jDC<}M}I^4?TCnmt<)hz3{YFR_ z4V`@t*Yxr+$mJhQ47%ZJt#8B_q`CqJEA#&uYq#_K3*B5lx-3Fpf65lxCVqVe&Ymgw zC}(?|9LmIz48CfNi1Xs)p0Tl(3vqr3z2E%H0osohKAw{I%(Y?(1irI}iUmxxPrZ1A zPbV@{$>LNO-K2ElQ8M~;pmm}-9j2Qy0ab~elKZ);qOL?R69IC#+atF@I8)$>OSbSD z68fTZ%PPF{#T!oo6K>lnL^}d4b?k-2vy)|%0x#FSW+rof=SkyNi^cB}BKxBXW#5mFXEs|w+SXNab zs;rMH;=YW}pYu*BgaqT-JfO>I}~_SS^M1gs0=KIl!MHA(lDk zGb!sjxqGs?XXQTsdmyhCM4kaBwMXmrdHX#76vWIu(>dRIK|AfG)RuZ-sIlMOXFoFD z_Z(6;RZ0h$3Itqypo&H$_c?a;)E%3fF^R>B`)3}b+Y8yt(;2Sy^>r{fHUD~y6~M@{ zd8Ql^D~vRNlCcsRz_;6zmFH>x&d|hP#V`MqtU}o+McdjS$=JhjP@=`)(4=!rCBM6U zFiL|&*o|O)qs~n4OSQx$OAQ>2S%un*;p6AEIiW5A4As%Kte#2F&rYSZB3UDu2AV&T zR6BbLZ1E|mC-Gm7P_G0IC;`Z-A?LC|H!O$bFc80QUh``rFp}j`KzxP@m`SMfKJIL{ ztSM)wfeK!x`QDz6gNm;9H8tM5_}M~A4M)2H#Wz>h1UICuoZ?BbS#M<#`~GmG3!w)T zAV>{A7{e=#4lc4}3s=izyDwcMqGLbB3u>PZcV`K_dZSIL|BafTtHcgo%9$@M&M{zy zo}+$J4mt6jRiZ(M&#c$+rfTsFb^sC}VeAwWn;+*FLRNngVD<;aa$^;l460!}v|j8x zVd9-Tvj%re^JuCDWpzDqp4fRlZnahtTkuLO2CfBqTaagFJw%OrB>1Y+n2hv$RVt)J z`8Z+u^|>AC!zYwIT=h(~NF-JR>JOFa!Beb;q)_qvQ>Q?83Dc zs+G!o1IC5n9&Z06C;`67Z>!)%6|0mE&Mks50uL?vTd23*$8C;tiK)aw_Dnz@pGgoQnJPPAezG4j=9u1cVWf*o>)@uJ(ZpC_(_`#{)n>0Yr^<2 zDRLHSWkZ{&VGc1~q?C_tH9oeZfGl~WjC0yren4pT`GtAniKi;fwe-F(`R19N>~F|M zQ;bl{9meZE5#`N8-1cEm+t_H0BQg=r>v;hB@e?NseBcoS#ETM>ytIZWw9g^A^3!(H z){(*>BcZ656z5kL+{U>rzagOoy3WbgXaPq!Q4bwG9jwn_CH80qj43i>I$4u^x^;?# zat@qf%nJpQ42sgiVw!NfWu9|}Fy)m@0y

      >R3WsPPZ%uMbz#Wp zyoAm)Ts)V4d5jwBv;44aDw@UC=o`C4uot;S4pgsZtJmBN9$8hNb~uj~b2miy(t~B! zj8rweI2}-LtSV2&W`{A~80hIR>lWfIG{BW3KM&9tGj=P;ERn(Ad6E&krc1OhW&Xb$ z*0_KM>%8>nw4bG&k0gV9TEG!Mo*uo(Iw38`^s<1r;%p4lxegq};x0aY`)i zHN4{R5>`Nz!yLz6tidqHr8PB6rw0G@Q!1Xv6Lpqum@3L~Z5K&PW^Xp{OT$OqsN|aV zLUqM#%r3q}79rN9M_hSc!Z}xU2CkhO$w=SZT(Zp;Uo%^;67>8NU6@Is;v4$Ms8ETga|c0R87ZSL5tZ3Sz-wsP z3A0$SkZS&dWpuk>)x3329URX&p`v;KGYm+`BOuqcJ>A{UxjR4QpRZ@xtIb^WSaRxRIH6XkMz`i>Y1YPyA6G5eN{{fbm}sobzJM zkf@p?Z?kBcHA|Uoi^XMnjG>r6wWUxr?^Qa*-qH7QkaaHNWBw&E6#-pYc5Ndr%%Dca zJ(xQQLY<7g&`As)80pN~Y<__jVAy|W{C%z@i%B=T77u7`Ta$LSL!{aBH>Z|e0=eEk zrvPDH!hj=-y~MFOGs6Avs#nZQ8;Q=F9b=|e>|hRdo8WG=S^ zBcCrVHR%Xdn3OB_M!O~9iday#0=i^moN{9i!ByinbUiF>Eni>oJ=fD5A5`0oJ*f}Q zWi%k{E7qH5Q0K_9_8!qaB*swzG7nhr#Su_W&UJ+`RuIr8N8jj+U6Wj|n0`jgaxtK| zl829P{9!_>=U%usj1#<9z+K_(@g&^Df;4=d{gCFGwpF!{->X(DAJ#R`<(th6`gVA6 zr`PuZ-ROnd8wgqt`7i?$D_LZkZwnVJYlpVy&VVt&?pGYKgJvnR!*N$I{{AE6tD%h; z&KXVmz_4()q0BvE9IkK$4}15POX&6$HSfLa+54`5Xp1V*4`Us-WkrS?&3GPx4VnlC zAFMm@5->_6acQ`bMHa5-x?aqSZyF?{r6`~J1qxrZEp(PZbY`j5V1qa|Xzx`=g&|y& znGC$W=nd4ZQ2OaIx=q_lrb=hiLoJ|rf?p92| zSI1$GD-E-&-vHutOY;f>zpekgkmfd4@E6?>b>haZ`2i>l-!?YA6Kp}~<&ffy6Q4^B zl~#>s?Himqq8asePn^jgQ zISw~?`$=m&+KtKuu0zPjEGJbE*6lMu2FA#C$NF!mlKW4UiL&m&K+l5_tqQw=PhT0o zykLP$B|r41MFunRKA*;`2#+E5(0 zuuz>*;>Hk|o$qGvRFnEZSUv-$o0hqaljRrZXT05^&5oa9yLVOX+hm@`fLa{bsADwP*g^AEwcCiwWrW?vO9$0E)L=0Fw6>*2m73Iy^@drmyt5_?T+*B zC5j_8Zg;af+-qZp{$Lo0O5DoPBoiv4sCSHd<%s)w!ft5!vw~YRJ_8-(_h8Ml%@_3_ zOUSW71AlnE{urVW!0bu!aqR_j7)!@Bmjb;Ng zn`JC!JCb7=lh105{h73Y@0JiMkWT?Pbxm`BDqR%|8CgtQ0V#TD9HB{`pFSexzO~^E z;@rXR+o*FfTH})t^>fc@zpla3N)~qO3ZGImbHVFS7OP+}ZNO7=&hS-M*Nsu6>t_Xr zldw!;!C5X%U$opH*|X=uFkV7zRv(*1*u9fxVG{#Io^fe#z~P7*ewT%1SG|kUj+t1y zqf*4JY{+qosS;Irx@w&wndXMUC`;Xeff@jkNq_}cx->&ZLodI-hUcS}cQ^u8DFYX4 zR}PlntzL)yA#^JqbZLvFQH8V$ll7+!1~Wrh7+UgwI>RhmC07yq1G6?>Y@H(eu58m5 z4xg*fTiMOWo)Y3YSIcJRJG~C*Ji7QR)Q9gMh*82Cjo^cPCdPVIc99kKrtVvU5FWW9 zVsTcsXo)`5L>;>J3Zo;7Y&Mta=n=^~KI!XB`UxcV)$C)H5UIYyWL6)Ik5*SlQ-{~^ zYNhbQ&gO@h2VM_UZgc5*lA%eFyh)G$_ zd(YmWK6Zo_*;b2Oa(5E=;cR9~k2x;eQg^X*Gx(wlK#G~M`nGaI98tPvqn0V&Gjpf^ zl-SfEqQsKTxmXRHlmWtspnE(~mS`JDcMi1)D~=p0t&37*5|nSi-Fb5uQHL&X8;6pM z7{p4k5%&UWI*zSZFvS^7)~*{F{o)glTq^zW`Ig-UCP*z5%Otg@<7B` ziIXcRWP|;|B+!A%Roh1Y9pcFP4!x^Z#aY?-+-Z^IO z1O7{O1heD{E-~6Qn$vxwkC`U5FwfG_`HPar9#_&|5h75r+nT*8~X<(f9Sr z>_UDqyZR&;S;%q)s-(JkGwfw7i%L9gw|S~Cc+j(dN%um4>h;I*ZK8bp<8hW|XO5KP z}uGQ@LVDD?8n4a z*Z!4z1}i(Oxcw(r_yzvL-r2TTeOLo6t&N+h9(}ZO53$dIh)rF{HFM_0RSLe*HZ`0^QSyW68ylQ&ugt;e7L3ZN>n%dqUY4#zLLlc|SMo0F(k z?-lf#aG`77AKvthqfBUyR?%PS;3S>se|223Hh$ID;1J8Wf&JnVVw2W~AP!LzKYqXL zOnp^Y!KHnSlY7PH^#+XCxG($*{B2qDDWQvhUwtb{IZnr$bmuGbc*uL>`lc-7aALZo zPR2u(db+pnb?dcieGE@(^oy|mizC#n$zB)7-L=)XIGj~RU zjno5`|C~P$m4yBN5SOFff5E9IQEv;5B#Q*Shwo90#!0}wSLXgpvXHw4`B2m8T@~jp z-6!HSPpa|Fs-n|2{bFj`qPK`P`5xL@4GKKsu5ih3U{g^ZDjFby&j;4I)4=#P;qBRJ z;2N(1A|augtuHGunRpw3n8jdK)7&IBl***WkE4g-H7?a(XIsxPb^AeS>YdoTe3E|l zE_>%RMXmpHV7&muwH8+1Uo6yrjXrC3)wCZM6kz#Tnz1%PF?mS`tQmIJv!U-~q#f zfj|uDC!W$m0oJqm$Nqrok!BrD>f)=FCB$*Zzr;F)8Y;vdZUq$)HCZ4{FjN(n-oK19 zc0%8+9r$oT{>s2D1**??Y7d(A27`*O$<}vM)&%C&zJG1UF?^Jfkfpuj^gL&KxI2#r zBt4f`ptil`6K(Q+!pRgstX{PVG5IhNVwxU1)zq85xrOtvn$)i!I44wF=6nFW%qZ-X zsAy7vx|b6vrYYeHSnPx+ely9xS;69aGXRV4A%(2x^YWEzsm2AN!-Z zmVQqaHw+iTrYJu8d-U4#9$(Ye^k*cp94~2mp@46Y#Mm!UO2%fN4E1|)Wg5cAb-cod zeHw<)xhv@6Dro${9tP*kMdO@oTC^kdEht*et;}m;Y+0@K%xtW@*Q#Ce$JvRiob-K} z4oe1DJBsY~v^zxwp$~FNcRRiB!Yi?J7Yf=$aD>6Ni}FI!jkU>hZgkizThn&;w-<^O z9Hq+WlSlmzXFA76v@l$zeNX^s!&&;rw!>`6DjIK*zrw`kB*Y8Gwo`%%tg7DU!TS_D z99qHoYr@v+o1-->Iw4)DQFZ|{rkkx9ZM-BCb?Kp`o0xrwgTHsrJa5l`6J5cw35O=cp!hh%SkpzlFa@lonZ>RiiFeH^(gv2zvKk-B@%zlN*n550h=3K zTqcu1HNY^>ACN+t)yb{>*Mr%V3Jt|~ z)mFR1A+l|UF`w%u%O^eC9vS829^1L<8H~d?Qa>Evazhlqr)N&sNa?tp8+DhwqpU|D z>DCTq0ZBJh0jN7WRXf-8Q8w02>cICJQE`1_h*{W_r?Yhi)MSnXoQn%Rpbv zlP9^Jr%L?Yr;)kh%L+wM2c-bs(hODXJTHA2XcIq8=M2u@`%D<)wtQlb78qt8L+A;ZpIq zPlqvsj0-)N)wHHqsUdYVLsp@c@gP61N27Vdb>c5+{oHFIoyRoq+RX@AL{GBN{`HVd zSh$3bO#;rrzP%r0)R>@Ez)wHbaOia$_)G^B*Q_SEbuFdXj6eQ2WsU;ow^oQ2NIgHB z6!J~Th-4RMV(uVGKMq!}5Z28d+JqL2aM(9Ej^Af22|Fo8at6hEQ<t$%yAn!EItaO3JGbt2t*D#54F zZVz{c$Jq9Av3d=A_`qznE4h0jyN{a#Wa6v|Pjkt-{Xoy-i!rNK41VtvMMh*Yo1ysB z$h26F-*pr{d(&h|IW%jiw!_)7rPUw{BayEj20cZJ=6im2qnDe5xQh^bBtb%O@AMhP=hOKiANIaY!jRp$Ncq?dSP{H%;h-RDE~JW#jL(ypOIyj6$Lx~FD)6F7EV`wMjiA<&5QC(8%umlw9sArzo^Wd-)?tV^uKV#M5S8^G>ZhZe^=CH+{>5QsZ-?U-#VXl z$=}Y3)b8-)ltF6Ff8Va%*pTp!an`LiQWNWO4*K)C0u8pdonPzE!e?~v(5LGdjTmF{ zy7n5c$m%i<`y{5X8xqsn3h6?ZGeyuf365`85i*s=YC!rA{F3?Nq^xbK0BII$-6C?=G0-DBTYH|vz}EXGs>X-eJxt2 zzD=9Bun?BHK3L6TR2XVbD5ZAj&ERdSVCqAYHk zRRl9>n^II#GPAuf>$JORDWK4OY4KOyvX;$bLjsypmzvGwJUOv=)KJncw>OgY`6fwIABG3)$4^AdC-{*yCUXT{P*$ujG$*DlvG>JU9N5{2&gyXjh zI+voM@9<}Z$qS6h*HMF`O_(U>~$P}tql%#xdnu}dy;2~lev9_yp< z-(7ga^WaxCL*?UDjTf7KHYJUXRn(q!+OFvyC0p4c^4=wS#Igj?`m2CNZZ3(Py`Lu8 zR+C6C)IF5NM`PKtG^INcu>eXs6E4*E+woPH@0v9(8Zd%n%)r;r#pU=wc z#~> z2SVG)CGteuzNu9P%_$v_9^VuYv=avvHzHy8pHsz~jHO_T9eBNyHdVcVAS$R?35KUC8C~P8Nk)IX)cbhvU%8c9H5TK=-mH( z*cC{tvQV5YQ}oVkkCtziC(g_aI%*37Hs)A?h@=S7>Q<2=aT2@%;c2~?iZXhAl#<36 z<2e16=F#u|=#ZjHm{(0*)65fF@~A|Nsy2}607Y}9mj806a;&_Ie&y$nbB9$@7zcv= zu0}U^%k>_1n{Fl_{6K?BG& zh2u-me@TRM@nEEQDMEVaR8p@KQ>&*^N3!MR9{=L_83tM@vqA8}zsQz5t zDML?rfYblvMdI9#lFXgyy53*8$&CA9qE;FoIxnPolw^9v@Vf=;(`;?~l{UL_`cGrR zj_BV4iha})oM?6o4PhRMI|$&j$eO6%7#KBcsfmiG-n$x!-e�Q8Q6j&PD?-j;0x zkNQbQ6vguhr?~SNzPy8(QKN06iIN9yQTYO94aIIzk(-GhB#O*5S6a|fmLUbySfl-r z$b!V5hTwqo#EVY&08CCedDWwBWYAG3I0SSord=g7s7Ggu6q53ig@98$Jl=PXm{TNA zmv>0ZX&wgA7!FcPjgLX4ymxlMQI@iT?eLjqo=NW-sg9!U51A!pf6is*H57Sl z976JBH-XAG90yu`&_yuC%~^ulNpf>1%}UNr?zjSI-Xs{zT^DByc5Qt`D3LU;_5ltu z675FpKRiP4v434~5NBbyQBM>ulhRbPsONE?K>TguK=|cNo^%nakdU7wDwHP$^tKLT znh}6kyKAF>unSNZiPB^SIbkc!GNjfi0AM;Uj+iFF_aFjbI#CUdB~%oW9|u`9g7zjV ziH0%D5x{L7LovPK4)v!hS5zTD5r`dL@A@n>St&zWLCTjFIJ2Z^v~%4`q@+ea4Oc#4 zpN{7{%WiyhPwFvg=`uGK3M%5wRH6FWjr9DcNaJUGwZ?Z4IFksEODuTVmuy9IHGIXB zoCovb<3plCwY9f=weS95dP!bxl!f(0pv7mdk=|m`BeGJpwGUbOC9xWv4zbN5hFM|B z=8!n13v#6%)(Dhmyzl~$MARml4gq2XpbD%k^%V}s;sY|LmH9K8EpQy;+=_o?-@%Zz zG_;iG;S0C^A{M)|-6#nfkoRJq^e--|mRoUQT^QoC;2JE!u0ffB-NL|LqN7O$5U{!KOyOQUk-q-g_hGgJAxe?Luvkw!IC?p~K4IxMz6{+1 z@!ptTAfN$vZhp`&&6?ifQ#kQKZI2cneS-&w+zYRRQ=r&UgQPnw(Pd~)^YcRt_A&)tC*5en|S-nl*0ub)!Cm&e%<#!Hy+;v$g23*{OO&u%Ru0Mr$YXFZ{ zLtuxh7}e2pzn8L(c9fX4fZf#XWgrrF0$Qnk0| z<+U7J4Y|S%XGb5{nPQ|={9FM*8u4k8lIEN8twVUbgmKwsfUKu-gZbu%C|imw4a&c` zj-oBsRi!lW8{~IFrI$}^?ZP>2wyHX!=C@+1IGFqP9gkj2JG}Zzd4=dj>J0Radudpr zaQ5HMl-q@W%;7Zzbc8T~7zDV-19lP7@fQj`|UZ>=W-n)D19YNDKpRCNc0{|&tF7iuji9uo_bGH#e&xI94@ zh1>S&*;t&eunz|x4+CTH74hpOlGZIfGt8WLlz3m=120eloMDij}v zDAQaQk%a6L^Qqq?oK`(igKYAFq}&N}&M$xOvPq0ZyWAh(ZM=a4-e%EcS&D<~Gb2fu zhT09Y=45j!o-<4#@ILsZ`YUn~HVs9&-=bVmc^FwG36*c;tLvL5UB;_VpyAzI4mH+{ z-S!hk%>d8J7>#fEp=bx7Vd=jnALYnKo2qbM^Pq5Q~&Y~<`O8<4YaUSyaNRf^^( zXGG^Wx@BqMZ%mo&lX(9J3a_+u5X3iCZ;YFiMI=B@DbwZIOw(jBU;1!y^Ht9toO}<3 z01QGE=)3Ml+L@CU<#}fZ!4tkv0Rp8ubHl>=BuSk!tH>h=>JkMqX0Gu18#wJMjPhjf zz=46L0#MiKxo4QE^DR)nu|5zYTNg~S!&4ou`0?nHBI5vbg}wlp_Y?aZIwQY`Gr~XK zrN6LM_$Q?*dZwFtiO75*yFahbh2ivaEQ@>=kL(zoRDh8-3i5vMHv>^^G|=j~Ropf` z1+vf%+~CpId(cr(W}*veKVlHSvZXzW0#t(6tojpWgr&4d|E_MlxF_!msM^n2>cTL{zx zk$~R}V_|<&ECbzKp6VvkwIrK}%9`Txh50FZ7~=LAxfMA;Lxa-9K2LMzI38jHlK&sf zy#;U_!ICB{W`+?nGc(I#W@aXfnVDI#&|+q0h7mK9#b`;EEJpiezqfI_dmDQf7yIx1 z9TO83Gt=2Q)zw*`_~1-vTLYd0UG zNe#QrW~5>lN^mSgFSZtu6@X6NERwq@am->YT=$}=4cin`=eR^_vR*vtn=i=jL`l1* zCML4VM+f<^XkYIX?gFh=6>{L+TD8}Bx+_@&oT#|@nf;OM!;2Gl8Kb@^iMqQPNYkoE zNKM>JvH=-(_6fH(=bC`Ci!Mo*PLZ(WR+*Qm}e@=PsGcFz#S-jiC*_0JgBlF(2og(1H zbdD>^EXjfnio2H!f$S5p22!UO58a@40l${KWfV)?ni$>ko9ei8_?a$iY1!?0HYNlX zH*LDbpvIBd@>jP@!Cmq@^dq#P87kOA)I7F)05J z82Dd6`TqfR#eW~+$G^b=|G_5z|3a&ON2|g1Z?yd1P`LcJ(~$gc$Xot9^!a!F#r|*l z>tEBh{G}oJuY%sQ68{mc!X&{)%);`I7CZ3=U(VmpxQW?V|IuP0{tI?zlHed_`3r() zlHep}{rlzrin9M;-T8R^k?H% zk3ZJ4RICJheSco&?Svg)5c0h}AH|HY|K8}&`@Ojfa^U~L9QkB8x8K!PmtE>zmgF%g zoCK|d;BPf!(CgUnvp~AlR?ZSF&gq2-olFa7z^H71NpvwABEa-y_ma^=EfJLi`S;6l z8OxaMOK-MkS&GLXwIFJJ1vGQf=hKL|^MU&fOx~_tD;Q5yvZ+s=uXiW~SyW$3W-@x4 zCLvCuUJiURiiJd4the)eeT}bs0&BVajlsK-6XOfK0>VD=Q1br<*?9YW<=5pfz3s(! zq2K&UdGW2yea)88e&gNvs`VSPir>;k{i+rE+vc!)-;Qm5L4!|O&1G{qo_^cN6$do8 z=n#Q|&g$j2fmwwS{-8cWiC3ZN*8sog{jSHw3-mmBxK&|u`RH9Ng5<%_W=DafV6Aax z*zM*dqo}}oX`l4V-p#IOv38I*LZx*@pJ~|ULc`Iu(==RALY3z^u+~v3WaikA0e%#E zr6Wj=ZV6}3k4jo`%oIzM4K44a#h7-;*cSP3PA(CrIb+3x?AzNgy-AaA< z9OS{EwzGw9x&2je3WT2@&u9l*sDoV|JC&#`?U>GhUJ~YvC;6eUC8-|U$iirukVa!n zmz&E$H=-QrdRSZAmbql*rtvthY;70R=~%(Rk=h{UE;5{wkejh?zoC7o>aqDaz|NSt zw!oiDYOV8I*~*=sY-~Y7E@j;rXW`WZ?HK!mhUNf9oP&-D2*_`Q{&QouyGXtU$G%6p z!bo-GyTtG1&>YWD^X%$C5*9RAwF|MK7@^fj~6g7$IK>Wq3 z?3K<+9{C+u zLs006(H=#PP^E;rCA6bR=l!7qHsjP@b$_#V4_@@Oz-{4sBqU1GwzSJxK!oo|-<9(GEncO&B&nQp%yF{BiN~AV^ne(% zk#9e5(9zyCPIFfo)DH7yhwx?UxaH|(>!&NL1F)J_9B(3KQs@{!f1ha9_Tt9xwBtP( zughdw`$U6;;_$FLBk?&Gv2Q;ZD1Ul;_&Dk--STO?)LE9WjB~L~^(om`YDibNX%)1= zui*xXaL}8$sME?}0rc%eWn#9CoU}m7N!B5M*cE$1T$<_;3p9&B5a@Zke1HW}X6}ygE3?>YX1^Pv_pgdT3b;@C}KFe#4)8upRm+X=0n(S8$qbY^PHe zPeQOi2%9ajjclp%>+|fCQ#$T5DtTNK=6s9j7$7KZ+%jtf3E>5GI>LWGLewQcqOMdf zI_!H#@EK)KSS71>L1*vBcAHVfBlg3fHd8NWF{Sp|b62jpMs$vT2K%Utd-#`Xd*s4| z82j=HMobwu2LKCZWfygo?l_@-o3LU$CrH#qrF4o3rCf#4ptJ);6@uZs{&pQAYx|ZT zgx|EBA%TwSg;`$TqLwigw1cb5#o_Uqbj{BUZ>0r}ZzZCz>06`#HxyGQS^h-=a^Fha zP=94WLn_>I%amG5t&A#87inj=9-f(2$1BWTR(dbvS4y0-=aqLjG9dS;xPN@i5{ja5 zIf)v^DqMkf@NZFN$cl5b&z8|eO|1)@Wvi8m0(&Kk{VwPD66Yz&S zU)L*F_==g*t87Epx0xTmrgz!Lr3^#AUAntJIv~_Y8@#Ao*q6C`+?a3#M_)z#Fo=~? zx(Un(X-g`NcbC`JiEgzQD2zaIf&lZ(>{CT~wDYi!&m|z#1Uc+1l(P;d z)8>Mc@1(Nc9vnZ6F^udnV za1T?h=Qpaq7eb(<92u(sM|VdU7ys@g^+`mE^2PQv0fp$b5>%72#c7MONt}N6ucZMt zhcFAvjMi>#J(SEO%pS0g@l@(E&)s49g(lfToh>a~_TnN+M?H zA7YJ8c8Pg?dPdYpnsMfdMk4`M@d~WckTf#ioNleX{fiJN_<+SjbBZj~12E(QS-NcgMX@<7)HDol?Bw-Q z)MT|;#BcXdB76nru9X$0-ByVUV*+Vlb7|D)BF_2vo(Vz$geriM?gq zLIOgA&pm}G+-wMpz2tEXn>;;t`2?u}-PKp{@d4*(Mq)-rpdAtxhQxx)W?YZ>dgTvf z9Qhswq;Tn}%rXat2e;_b6Umr_?dkPwR3t_rhO}>Nf|2-flKfXeRhC-&&(GpjTW5nN zh#o&?dwxCRg+u{C1w6*EnLX&G}{Przn53WshZ%jG!zl(#4Q{!JtoEceY{Gv$g#Mxn`G&v9trhh=nem1WVe_5t8=>+O zk-d8K$ zr4VQ+Z4$~MMW<$D-(cuypUp25TDzPeUg8>}Q=*=pLSn8C(vs*#8mIdm-QqR9mBfHw zGoRJp`*Vr!Q>NenHNX|gfK6MA)%n{5*lK-A)Z(29-WPN_Vp9Iby&@|C8I)}g|K#&N zYv_XO&2FW5=T4p}ZfZ?zqvH59$~>2bFl~txrtf2Ws7O{XMHa49CjC>)rk~eW7kk-X zE)mNT=zJ^)hU=Xto(~pSO{LS*xo_4E8mV`?wdm+BdJ)m>BxB;FBIYz{)0333I}T7A z?^-@wfu5lhFwoW$5@XZ-iDpNA&`;@+u6sc!t%}c@LBFEg_{o-?$X5yx9DQU*`0((_ z!8~p2$M~=P<0JC=LUObez|Ur+2{jO{PZllSZ$0X4S5*V`@8RerxmMT9>z?ZA!#)M4 z$P=;Go7LK1c@{kvl*C2ASmsh3({qBU=N%mZ#9^a9h@5`iaupfl_?=VhaYy~S>iUsz zhO9V*(po=TKf}}?o0S{grFAOlI9wb{du|Y z?pra3pKwQommT3xQvgHyGjdC9dpfN{6F!M-%=D|Iowl{)xAlWc%mR}0-yxOOKY7x()0ey33qXB4gN*%j@C@AM8c+X} zQq+`SZ&g3FosXreU&?Q__pBQ+4sHc#O+|h9;%}V0*XZp5w(#-;Tm{Qdx<9f!Kamdq zlxJ-VJm%6The5Ups2D)}xWJNU9@7+Gsub^z6i5&lLf0}>d;y~7%#zF|VC?Df4muro z@$eH?{+xytZ{V(>YVd_m&>_m@-e%! zd`)NSJ3Gx|y%K00DhiM`@MPKt;Uj1PX8^A!J=orZOnylYY&VjPoW@-}Q+jGr&Wr6W z0A<@mfV+W|G4odi2e4(RKY`^sc%Oh5iUpE+zlIX=;hxUv?(cKuxsWssNpQNt#x*g>}#>P-;PZ>&{(nNlY<9uX(< znseSDK#*!q5T}qLrY2Z6^Q`O=mOG`mRK=rtz`2y+lw!(B#w5k!vf7ckHYS>v8-;@P z{#_0wMkBP2#f+0*yp5~rJm)KPP#?lCaF&hH?xkzr$jiwr?_#I&P4P3z;?5pn&fZ~< z+wa2BtUqD%A>|*dy!R8US8JG?XSR4|@cSxs4hKz?1a0k)JR=w{kqhT`bNH$51hvnn zg$RK(^4%bx1*fMMBsj~pWel9T1#B&>XF@PI8~HU8)~M?|*R*OyoyM|Fil77;aCt2z zDdBjItjsg)S9B2Y!WcC~+;fIbUvU#pV6eCvvC8tLu(`Ft#gCQt$Ktt{FiBvNYYW1h zh9rj`!Rz3348naTdDQh1)15_A#Ji7htOZfuE7*QIgh&Vx)gU?tbFMJ`5;o1dMq0Q= zLJH?85g%6~;EHJ1`El5sj(;w&uir3z;?SULkTr(s!oD*GD#WmaFM*}mD&38vAwE$b z#VH0xIA40(Kv0FBjG#HqvLQ`{|0$~tSqppS*|%_dB?Z(cxtfaoILnOw*U5h1)atnSL_K@U`mhr>lQKCY38xL0KdRuDE*uo*Tl^BBzMtsWRoKh6m#d>x;UXyl+ z5#9~yfnm7LtY(C8ySGx<-0;yg&>Cuh0U{1#EQ5L87iSC&;HR`xN47dw+;r%XcQh!a z8wsFZ8ekZtT@u3N0=%?Fwjx+Wt)TYfqrAi`6*)dA9;Uwd@I?g6NT2&2d`70H{Sh3< zm~gMx0$H`;-N#(;lZBo#1uE8VJO(IS`7TKJtm>Y(Yj7gZ0^}`x5w`i(h7+Ps0y#1ZdW*k;?;!M|0Dw*Yu=tu8BCRAv0(o?+Xr{}`7I^}77H}-z}rp8FLy_DPL^*Z~k z%cjZtxiu-{aK%XZQ~{!d1|FVklW15IITHSgg-U znJ9&2N~swr)3{$)dR+k$d0>{7)3kSj>Tut*)lNWFGiefh-}&vQ#er4G=;xZ6L=pEC zSP?^t+uviOW_O&PVPNjq&ch_tcTzFV9C}mRt1Swo~Z^4V-6X+op zk;VR&-mvaA{9Y&9n=H!Bb)`G^lhvm-p}j~ex5spPA6r}VkwT3XE~MJC@+!tOCxk4c z``YEarak$$l#YD&Y-j5-oDY5N?};^TTctD1WzPvv3IqlI1zs{pHLnZ}HPeUm=#GZ{ z9ErOrwWl(b!L}L??Sso~B|Z1sMNYd}Rwqv+8(PZT0}A9S5jIvq{{nU}(St@UJPQ2q z^QArWfLbJsYeiUa_3&seGD7N=@eXov>agDfDQcwdU^<_1Zj!sF4OVGcJ!0DoGSwBT zc$~fb@pQ_EshZfD1WbnqN_P~=W1FopB8TaN{tGKDSnO*kStLoKv^j8C|_#@(18EhlxnONsLKb#W7p+8(5< z_4gz$OI0f6_>E`q3;pdikD=sZuj;s!IHazXIKO>eJ#l}q-#_%mY-Pi52#^fRTz%}l zfvpH3c`_r9?9}}%oTA=JsF+tgNB6HPYXI(FbB#k^zMBDBrrG-!5bMu* zjB{IcrNVBZTEE$XQ1hyzaT^yo6=W7=ps8NEuE}!2{{$SiE4p_2sb+m9!I^k;{r1id z5y68cqZ*T#?P;ro!)tSytGT^D+lV3GrY&VUcul+#vfPvPmiS1UoHvi(BrUnpuS^F^ zqW%C)^}~1Y!kiOec2Lo(n+UMss+v5|d`PA55+R2-ORX9`k?Wz0$0)|3SLJ7sE#>hM ziv|~iDoj!AEO7Q(jMt`YyYSuA42UFOS$odNI%`FtPoj}>mnpf`CP8~nr#&dl?KN5T z+2EVPD`NJUbiXLlNIrp}Z(lfpha|n?k}OD=WvKh=MXD0g<+Dg?wl!N^y{R zx+|@ZhWHC+6*FGXaS_C%p7yq~*KFyw2sELXRZXv{|8eWSZb9ZPDDo!5>=sU)NYwW= zR6pqqw6R!=TajMc0{FC-8dQ+M9BECz+yRMV4>g0`Eu9tF+H_^yq^o_b#mKKv96&C8 zK1we@m9!z~p$0#!G734TZ#Bj6NvPB`RGyR8bP5Mj9lJIg4TS}=%Pu)hhm2@0v=e-I zL490y?7l{?5{M(VinPSUkA4=> z-naAgprc|w)E?8cXP))FOe3t7;nDL z5uQpjsXt8s_n88QHhSWWci^4M^#eW+_Rs3lV>G{(YA=BN%z~qd| z+ol}9`CXqcuf~S6z2TkaxAEyWljYZEO${f`Yjd&1b-0ME8prWGvCRZ$sBbf`NO9i= zFR7zNFUq)&Yv|Q@Y$hxPXYbgp+{~Ks19Bt0Wu+@%+^$tK1uurp>Lz)u$uacDHyczEEH=jZKsGbiC^qS8W%OR@UZd%V^??=nY?-NX}Kj1RmYSIg{YYVb%IB?oA6i<}0kzbk%M* zzC@wXJsrqXLp{KfU!yBfeQ9-G?!xA`nZiUx##`lbed9!caX+JMq#uO?YFEy3R2dOD zEyq$9!n)tlk$~(Q!_!gl*)_-j`_HOC@I1f@!$N2GigsjMG8*s#O;qqjXoj+fKE+$r zFOmUX3yV_dk72waX+_yRmlbI}GEv-n~u6t7AG9@`fA0*k^@=Q0g{KXt z$+cGOj^l{L1n$n*mZ!t>Vj$k-*bk?rfb9Pw=j-)KO>uHuP||$FAIlwWL1jhvLnim@ zjGUMG3|-Uy*B>;DmA#Dw9DM1YP-q=#KX%SmfXRpDqKZwYFAZ1V9tz$F`{Ox_P^%?% zlq8vivkyhN2Il*HhnEv41X!&0@O)rlFlvi7_!-GGX-zunfoCMyJjAN*OYM*saY@_j zvbW?tZOIOY003vDJ?+W)m#uOod+w3@n;x@>p&eus&dG+6uVJn$XK2clXak0Q7p;zouG)!LGDH*JF zE0P;d*yZRV#BV1erwxZvjjp}N~P?oLZ2 zNVLX8`lvKP@slT*u0bnaYVY0GQyz;d{ylQ&Hy00*V@&al0M! zUVXMgbWL6rU19Rd2ivijkKKr46hnpEjn{d@OoQQ|H(Wz|IJCi_&hr}*Ey8^e#U@!g zvU#G_r(BI&Fh>x7Q0)~nH*7MAPoUsEEPdV2PoLu8>66S)t8!%dy$y?2Mt#=T$~;_ms?U(jrRQ__P6(YnDYrl zGC_y!FY0V?QB+W|(CPJOhz4=ax;Jd?`r)zZvIGPCHt8xnQ%{#-Alpo)D@-tnL}OCk z@(%!k5(Y;!6~~p)3k-Xp<&>&b_!+r^u58QKY?NnISmA$ zq-+@*m4zkphZLGGSpil{LV%?ACi`kTh1$79-ae?wwfgw<&0fMcv2VQ^*O_t4&+TS) zxU4Pc{-k5mRV@tW@X?u8{1k=?TD8t{BBDc0QlAH8%ZNMbPc_3{IOQ}AO=1a6x$Tr9 zfAUH`f8HXsMKI6GVwTfat1#4aH0W&?wshC*BLGEcW5loEDxFc#S{sCB!oW*}sPYl( z&N)io)VTe9>$Y=LtH%kCWBq~xVMxa6fMxI4Q|U0W1J3%SFU+r7vWn~mFLd{oN%tl~ z{l>>v?o^|z22W5E_MJ+|ht5k6yR}WEOuqJ&@*P=7v5JYX`xx)r&DOUxU5_iB^fsWv z)y~P=it|9tefP3<=gMR4G|?=#t@Pem2^&HLd!ek=_2A{}e&&8H(X|@A5Z?$WV1L7n zRS3aEl{w}5{L~b`40nHC8EM?W_$0doot{27BurAKVidtv)&7cSRd?x1w=NJLOK0A3 z?WYX_f=AkzD*n8qkda{1m&p+a3Ug;6OladU?7nN$b5Z$?h?S9-=TD&J%5t>c=^gZ{ z0huJ;Q_V%NM|oTbn_Hx7!>I-@)EWtyNQ!l!qE~$(xx;w#Z~4CQ17Ic;BVQ?{1mSN3 zvs_8=z^fR_Z=3CX|LmvjwM2P!=x%iZ-?I(3WY3Mz@!n(fc3S3CHnEUP7cqUDuuq?k z>ZNju6uXhIN1cptkxM%coiEa92LmxtFHq^d65jc`X|QDYbuOOCYMwwv5@6(((t>}h3;_B($GNYb`XJZ36IH21I7abv8l<5 zPFn!FLwOdBoRqSH4v{J?dx1M>wjqCxL!9H5m>)HRYia z1|#-v7$ToXsRWXHb=dIanIsU|oV^)BA-7HyWebST*yA#b#K||F8Q9~68s+c8A6(&6 zgUu>?1_t50i>XK$z^C4>-mS?Lu(Qf`mykfk9TXk zIe9Sy>y;Qe%OiSwhYckv=_Z6Yr8vjhxCb#oWZ@FRV4VY>g3{ralI`v2kc~B(b#)Mi ztmX*2zSH>_{RE3oV{O)988anK4$@w5qGP?*4U%bZ5)ZU1FcRM`Dl1jxvK?m*={G2ws-~1;7nxs|pC2CHpk~EE2?=@frbL z2}|ngHDn^;$iVQGL|Qfk&)m$VJ06|MmAv%PkCa!dtc0von=5s+AH3HU(UTBsJ6MFx z24AXNG|b$K1QYhuw0RH}ZJx5`6b4yQ^TitjN2yUDou7k~zNUVVyZV%W7U!C*`*Z#X zl6Xq08B~(!3$}$>euJ5)vL`sU;Nq|(xf|DArkU^)$5Sm`vWsk7!RRx4W7 zuG2=Ctiph>eGnEHMSW-j1MxI=pwX9PVyn+yv3O<|>!T9X5qllIg&b+})mHNBOPMRV zPu~!{IP)2{1B|>J(T)g(%mj4k6dCG#$GsYJ7;ysO)3MZCdo;*hua(E|^_+{PC}_pm3S|^^BIp=pA!{X9R4J1ywQI|pAw9HfK&Zc2%^@{cnV#Zie5=9 zj{w6))hcWo?w>@QWM|Z}3k_DoU^RlAZhs8XaHU_3ElPj%f*VDDAxF-b0uS=c1Csv? z95wU*lDz^uq>a0S7E;(91s7m)0d^3LfOO|5A=`fHyD*{!`T}mw>>)0KN{}EIObuZz zM`CdY1BGu(J_KTcXNzh{=I&-Zki0vX7*$lsJ}*CF_dXant}HL>bndLaY9?IUMR#%GI5q z=mLs?;3qqUCZUfC!NwOLZR}TT?I;QAc_4w6nhmI1)^e+75%F~wa@?KR_}U{cBOHBt zkgz(hO6jzpP^6-*Hc?d;HaUj+f8ejbcNyw3feIf;^WthODe z*fJ-nwH}9rhGQ*=P*PX;+DseOb;13*B_kQ`@Qa`(^DT0SMsYP?e!uq=Rd{h-Ca=R)jkO!zt7r6wZiu-t z*Boq54SKz|eu0+DM3DjvX=sWkWZC)yVJJk_>2L*!And5{K!oAG5qL$EE~FV6=iFGJ z*s1mskqs~JmYFe)Yo=BBO7jp$+*euWDGADgq7jMlG)Q5ik^aX(9GTQbG&wo@ElX`t z`fy5Yt)k)Eo-~NQ0;UAS^=jf2J4K4k)m9>vQM1K4HxmROk|xA2W5JD4aLeWuAb8w& z9l^tIyU7}!jdri`Wuy%)MwyxjIOxjc>2e?W+Wai+YWcZo>`>{nD(9w>TBrT402mmf zL%LmBaNmoOW@i?ha+Q32EP z7QxPl=%7$rRT-kQtQ*s^Gz2EK*6>L+Hn7rg?RJfF&i6DPV7rf$-gY!Q>``0I_rI|0K9V1iX+a|)G+GL4^u`hn>! ziLEcAI&PlOT@h~H7omz*RQ)_XNL&l4fh0!rl0a1w%xV>-Vu)?HTDAUtt{#p2QiuUo zsTc)4J|k0G$c=M4Omn5YF*}0_VMu{kI`6@(tM_Bn1`Jp*uCY$3_93j_@;3rED54io zw0jFjXdIOBV+m(Bju+94Fx1*M_+|{B!iq))pu%J50*PJ)HMOdlzvW{FVrc9#!tY2V zFfe?&yReZaR&3x`Xug#`WtI{|Q?a6lBMT%a3D6z>M(~!v9!Cu8^8$smQDMyTK}Z2P zKlzv@l*pENKAE9M%cxjUPWees;eeHG+Wf3uPno}-+snR0&rLWSrV5ifOjRH1;`&uw z>3fsE%)mZ|+6J5u7V}bqc6cEu{M%=kWMU0!HP4hBk%2QPJPLiIC|C*>MsQfsY7{ah zTCF@;$U2ep8V!g_=BQCD%fz2*`|q->yxp+to-lVfTwh!Rfy`*3k!F=deD?fWv<*wm z`x1lVlSs6|gNgCdQeq7C-^f3E@de}giL=USUfb1RvEz=ei}SiC#mA8n20qK7Q z4AZ*@Md=%vU}ZebLQ=ZVM+79F4lxeb!?V1phGDxqh3exQV@a+7QG4UL2N|{M;Q?`({=4mFt#`TA2fYy2EI&_QR9V4bH;?(k?sC`+vGJ} ztkZk>eyYOX_lvV$X#C!uun+0)_BNPESjelA=Bj{njgx5C(4!!!9|!5Ad)nWAz(DySgZuJAZQc z?C4R?xm8>5XS^ui|Kl7q5a-d!D9&=8l@7vQY z>ued18nfls?UK{G%>2f^nxay+>>IOh9vGP}w<&q3)-kj{vejf8DYTQ!`E2X#Hj*jU zos;aOTlX2W3t;dg89UbUoW4xKnAZ;aO^itLCT>| zte)Iy^BxlgFaAG;CCf_1u;^-aM7CsHmv16HhI-_Os_(A7xU@M%go>rev^QW0k8>3O z7JIR+SpKOCA}oAnK0O>=X}%h&HH&-RwKORd$M${Fj^%(d?%Q0wI$d=F{z-6Gn4m1h zofS)o2g}??n(yBOj}%KjNE1RQR+X#UWItg+MOcT$mL#*(nXg!(#OGiA4sA(9rNUe; zCJZ9J7l6+5DXSWI8WRMNr44?C{D&x%M7u8RE}A^BF0B`ke|AnF%ivEF5**BAS`i$~ z@k-Q8{qxZnSPXpAKzNzr{(zyMCVTH6Z{9jnj@??P@HY+C{bKpRf5>AFCr==?+=FvS z<&e2fBQ`WqGKQ5i-HXNFGB5YTBFkn@C|m)KZHH+|q5R9=!6w@$Dqm2lEDl43*EAMh z5>p{iq39uvkZM^2E4o-a<8>RPZq8T%DhWncDn=;BiX_&tf{=}b_!m#rMB!u3o1mW6 zxF}TWfmte-3=@!@EQZXrEt!tu=os47nCKKZ#AVB~&((>i)@Kiv|7E^(- z?2&MJN}H+`wmRPGSVb{XnlPTVg7U@>nz}v0ZocZqQv1;GE9y(E>91d>198_gy9<93 zL(URcx}!F^(1U;!lT^pR`@VvLga_)=gIZa!H0Tn)GG5YA)3Fd|h(;VwjWlDQ@1F|E zTs%r;jt9aN0MNgAa7tGgGnDS}ReG#iu~5)NlOP#lS~s+RH3bDBMnpAt2=NgD0nrk{ z(2+YUUtXuF7`HLGH2I1X-|Oifa-;@b!_HkvHPFN>!BBd{hnoxTh#El30N`coV$1%h zm>Xkc5H-sK00CJ@9Q0k5n$W}o0|7~7Cv}z(_{@kR-z|RB@yW@|*K%emC{7`2{oVWs z0Sx_hPC3>ruqzCyb0LF*_m5m!CXw>bSf+4hV`7CD*W5XObn`>)aQ}E{rQp6=OP@w! zXHGl!TH4Wku85L3wHr}~O@B&;J)eWEBWkh&x02L{{o!DzBj?Ihv~0p_4q-ZHGS4## z1`^0q9~1G_L1@QNd}MkVskA9sU5^9Xx(e529QJ5^A)_JVij5+s&14qGW`lSx5LbY+ zm=uIqK5D8^AP9+bE1;6<1eXT~n*o5slI z3;@3c76mXZdUkEjxZxM80RqagKZtIyZq z)hk6p+)@4l2B#mQ7SqtE@W~9PiV0BiXYghO>BNZt(r_D8sYJy4kFwbX~nXUhJivnXcu8KJa2{*3tf~XrE9%LkIqDS zk&=lVjgQC8gJmlr*%S6)>286}`Y9%;S@Qes$9NkLpI4o?n7u|`K|KmP!~+4*MO!gB z30;pHT#u#DhA_mk!7sSV3ua&7yoo|%8is7JmZR!21@)^a)LGd25=lT)a?B&AA%aUX z#T|Fk4gx|KIm$>0;?4pRNC4~eh^Zuvgf(a%9mG$#|6;O*mNFp+K;^@QP1PbPS`aA- zD@4Fc?&KWA)}{3-GNOs?#5Ug0rH#yZA+};kOcQfXVZ3g&{%dQDXh|Ns;~-4K?4t`m?r#NsCu?siz_hQ0w;WDKF79Sh_@k3P zHEo5MLAS0XsKr?0)17*ni{uy36`18H#YD}b{DS#Awe`Ex^ZuDfK--7QjPEhjgykwc z!bXNlMw&B@8-nB072I((48GFF;t%QxTR|&ivGA<_xs5Scf`&Mo&=YSs5D^hw9=uxy zDw>hm){AE_OTVyD*Tgwr$W;uP5Q$(bno^FjpkX0&5J2js_KJqAW`#eu6xINn6P6oe z=2a9lJ|(`wc)1nqmi-x2f!tv&1$V0pb{4$W4Pk7bYw*9>Kp-JsBon+cxcZV0>&UTP zaY@mCOhtj>(aH=XpG{gQmQ40d!wBl;j9Cd8N*OJY|NI*nMQVg%^Y2eq&urzS0kiWQ z1~_Ff3=Du5y=5S`424c?Q}6RAWUs&8p7C$bf)g^51(PhpEhrc$Zb-&@UV|8N^;%6n zC_Q#pICy+o%`qX(5i;#JBjmeLu= zgoVHeDBIZdKyz=_8jCvB@any!4pI1W(jj8?jFxza)*gM9#$IoR3VzV4(Em zS4*$_QHySZm4XzeVVVnAOqPv3jM~l=ldPUsB%r8XJ1;hv7pytde_oc!r3L}1hima^ zl~gi}#bpOt(0n<|!=WJ`ZJgP=*xDHIEOfu$I!QnV=+(n86Gf#ohfYP(yerQVrGFtL0YqL>>v5iX$l;bIF{@0xF=njl*+u^HqZ!5iHt;yYfDxLI(BuN*jxWN?3u#ih` zU$p|`0j520<}ACFekS!&BOla;4>HK6VTX097YsDL7UOWp9xcHQ{haQKAg=Q|I%T-+ z+|t37SeOyUjk!?1IXf>dT_qw}cXWHE+SViPA9HR+g!2_deEfqGS;JSWYy%^rag}1Q z>`NOFYm=(`O`4tR49zv9(D!_+X021LOL7J@h7m#Wqz*9~E0*I3*1In891fkuhKN?$ z=rnmN(<*v~gemHAUXHVD?`48uFDMN%(}?d8v<%Hv-w#y>7QGIF2<8_}rT`lZHZjF_ z4DV=r--jSWSTAWRO?k|_^2=+rGgy^#DAl$!LHI=6fEtFe@^f*aCG*$?!{)x3dn%K7 z^30vepLaZ41*{sDpxs%ZzLl08OwDo-)vOepaa3wDif|S3Q+8$4$JyGl475ox5CO59 zGrTv*JaE*1!+=?W8%V#aR0GWnP^tj{KgQR2QHE0O^f@u`svm14RUUR+45jGk5Oz_$ z2_}bU%ZSqkiMr(4PE;Nju?jIx1AfioOwKtM8}Yl76Ql9{Wl}8}-j>q^C|XEDjUYMm zUkN}zmjXrkJ`BI>X#K~Sx7eVM!6+ILX==eH;3LZ6`Q)23X98ciBcC=QH)K&+i!}8$ zQAp@LrO~<}vl(`SbDCP?f!i7oSCH7@OaP7iv!%hpq|&1H$7eZS-;^Lg6NkhB5G@+E zgD*K!A90Zw&JkT*tN=(Z^77$2C3>2ym`w3&YsS#Mft!DWSoBVRC7b(o0-^;fv4NR@`;&B26`(0(N)lWS z9s%J!22#+4-qsGz4JOu*MKf|D5peLJ2`o5`zX(47l0(LTN*Ui}8@kcr1b$&R9sD$pl(5WLW2rLt3ZRs$D+DUKZzcMl<$%&lFp| zXiQMCDH{Wzvv_IFq~KgS2nriV?zu%?y-ciA@2AIfY2w1N z(e1F7WjC#*cWJ)p=vk9-Vb4-{tZ~F@l6=NR8d>)4(7Na)fTCZr%XjnM&P#nH?@hyX zz|-6Mykxzuj0fPy{J04^n(He3ZGiP#*vvIX31D#|z`pwpH2p-z2ZgH~NDgX}9PApC zJhqGZbU%Dc;pLqdX~S6wY)_Fa0AjGi<^7x-JRKF*DVV=&Cvb(gc~wS+z8FrnEt6=$ z_Nb++l+)On1w31FYS9`~j~=>*fm=m-TQKZKV0g9M&ZEG8;FTMRtU zVhp(s$o@X`5yj9B>0QfQ2nE!0l~Rfpgs>#}f`jlVa|x8@yI(wYY4lQdy?;Yck&V%o zD;!c+S?`BqLIMdyQe(jyQRbJ{iG9f0g%;FEa_Zm{<;$|eDpHA1o}VU`K+8-;`|wDM z*Qki-FHE8aHlj~(y*lM|y-W%5D4)yx{;ZZ*6{)(?d<1<2i?mY#gghE6EsX>^o_=54 zB(bQHqjh4=I>kOhJrK^oxUyCdadUW?jZ6w;9B|vUn1u)U;y;1C{9Pj^uo8G0r>IxA zVHVW$Yt?i-op58I9f021)igidJ&*DspdNf>11OeZjfD=Co2?2V-9v+`o?)yKB4|2 z?g!Agub9lQe|WGK#HZ+?3sIU{@L|t;_jzN{bM`^2uC!Qqe|qZU2o&qLW*PZKL6bKy zV78<@$#_Wd$JPFGKsA8A+;85pfQGVQsUB-q791G zx4V;4(*QI_#fX2+__O+=*zO`I=aKB2N5dS~FzNa$r@|ZktrC}aFBSB|dk0BIC;^I2 z<_47q1-)Ra4w}#-?__#=Zvonf*j6Y~;pP{kS$*RXqZO4eTQZx749e zK2QZaHv7XnHCxi5zwr=eSLUpMux^+uC%~Umr=@q+2?Cf-dCi#+`|W<7CdqKNgWr#o zQYV9B&x~yPVG~hqz{$ae>`%RTN_ujrk_x{`?_uGrb6jNpr3i-xqgsqL#1#&NXgbn#eV45 z`m@LXoX2EO?9hWV8iz35Eewy36f98*rT9dVRByLkYFL0T_7Y1)^Fg3igDgZ8EX9l9 zfYhC#${2!=cGlSko^<&R&nLYFEpi)F ziIs!@sM|_VOYlP#fx{I;@bQs9dqI9L}eZn4?J@J*-8}r-F_eL;xb82O5nCn_L+tT zYbvM;k59(yg)wjihbRUh1)Xrs;x)ro{)pn`+ch?_u5_ZqzoNr+O04The#Hsjch->S zs(BLn(&XXG7ZIYpjm8xmKlDCzf)>p$$B%Ey5tl~hh)q9q)HyTE-CMrN<7KsC6={ij zq(OC?z<7*M0}npJWx+Kt;RkB=#x4p!%+?GD;O5of4SoyIl3|MqVor5Cd9UlVzrAS{ zfCq0O+-PFMkhT0{K$cbIMcD~g8mF?WIo(N_tzH!|3!36Tfd#OLKLbDcEM#(?&6)Wn zICHhamh|89c_LQye`73Ao%*g0Hk?7U__0}+RL1XbJHb_}!S?TY_N9tgEbQBs0O37J zrpus#5DhP5U+b6lH%(T-okBv}Bv7J?4^VXB&=1yV?;32ji4U?;L0vZ9u?=6&6%h^) z+4m-gnzD1D`{}tepzI70TLYz1;+y!SLg@bd)-=dI8Q$X8z)Gi#f+4=NmGNX_%1_DN zt}*I>m_HBw=J?o!fuUoDsw|@ckz_yc_wi(h@f^yx4V>y#$7%m!0MWlV+&3nzs8-|s zMP~_d`=UFmV1djQ?~9oRW5$gXm4!9hY;r1VA>+0VO|m;H)i{bLd=w(V1SrfS1x#Sl z)79wC%87(Iy_pk+zxA1+R>S*;Q`Nu=iqSNvb}5uoPlj(A45&k?mkxk`hJTogK*_en zw;s2s6h@a)0?vZbPOD)K85FgPSE4h>&&anFg6j${A!bRI`hDX2PUJV3txP*=OJ#G9 zWF;J{FVC5<&FP%K_2ut)?tt7L0XNByLDW_iu=pw8ncRUN!8dj?$Muw}iVuPfZ}ONB zy>XIdOOM`T!YS4^7Ns<~&LfDM64VFm^q(3pK{a-m%4og|vG z1P2mmcV~tpKrc*n_C#MkS5H~gA638k`@!e}H1*c71W{FshUo3LAzupwpJ5*y)wV!e z5!5WKa@lV~RTA0%!JCj|_kg`PN?a6!tOY{s3If!e4;lQI1V%$hZ>lH(+AWe~KY$fJ zhkO~>TwS3Qm8vc`PQM}Lc<#;9Hg6LanAsk6_7kS4Knksy<1QW@5sqk z(*{f7wSRLIC>|fQ&fd1WF2>12Yx2wo&I4s)U-}Lt9_tVfEg7paW8=?H*`7P0z4#WL zZ{#Assp8nRV!fEKD>6t^QM!1D?WqfC0-=IG zVsMcP<^25tE0@=0>~p919u3zCGGgr8VdVOC>5>Hnk$%&0(U14LyKC3aixdEgR zs*rimTR7Z0JfoG*2RM4+8!Ti|&I~gkv?)rpH@_A&tnuL;y6~+c5KHUOfoc6(J~;`h zMu6&kH<~R@T9H&t{50F5G8ath%x${$pKKgFG|NIIzLoh=qsV0Qrz-}a|5R~!YK1K> z5Z2TNNju}HXZ-O1%R`FxiU(Tq-+3-UGrImKlYjdU@X^ja%Oy}0F7Y7~gfGKXdiq|Z z8ehhnWXOnj>8?)w9ZPHH|4JoqX#Y&QLjpm)lF@Q+ppT;eixY%Vvs8H(ng1RaLTd@X z{x8n?N?DbRr>yXdelrv}nTSF9zg4UsTnZZ4|9R*C?~0;AmwiA@?ZdF0ZJVBfh>Fhs zIXFB_Nlir~w}N8*9{@q=o#c;>RyVSL>bg2PGy;c)zCu~#1#V_$W>o$O zCl2qhjC6JiYxMqKNzL>BN=1NV3T#pIzfX_B`Y$E|{-hxJzdF~OAA%F0PMqD{J)f&> z{nE<+KJph100DXjpP#$$M|4c?R2+uIOzy7tzeSs<>HqJ5>VX^g2F!D<^Koj=@cW+e zwF&t(IrTu$f@HV0aW9)^6aQ<3U*$l|g0Kp8un6$2^X~f;JKpyr@!76!>LqKxbd{fy zbj)}(dgi$d@Nw{AC5r#|U5x=&yFhR^7VjcsOMCpZIaV+{KhH2)GNhwi_pKCYSg`82 zcb`tc_Ss&Ae9D|n1h@fk{gMS9HOa=+VejC5t1x@cjOpfUDfwb@WXWDr%I;Xg?ilYk zxSm*E`EcEHBP2BAk>%LvW{r0m`rn710}m}yc>WmNI-d6BaqYDp%ht8>>qmxR=HBk{ z5LkSC(`tx2)a%zdt>GS4+Tx8Lblj!u~Xd>9ch(XT{aXHm^qe zogvXnWq^MBrcQO<+J5!oTeMLC#!HluqA2lGNJt1VxY7M$b76rXh4?==65jlU2alMX zo@z&YeJa3rebH@F!GSQ+X8NQ&#r!od2zJ=~klSAa(bIERg#^0MD!wP>mB&Ke)0LZS$VM@p!k zVsl;NF08=;L@8a?PG0Wr@xE~cL2gYZ@1_x?(WN3Lz31@OV#x6u$`qL_?(H{l}_$bTU zNgaXQn(+>y>a$~ehvDtcyvPAazdS~p3WwG@7kn@Rz&F?@K*C?xBJLtaPiaXW=cdc& zZ5*GJsXqG{kU26GK0eA;*a@y)8ZQcuFEH#PN&wb+W4<+RdE`_tBe+j+zl2>5yH&cg zs(=(PK16IRo}HfE?`GU$oB`YL%S8DYkV_lwzTgVMy`e>|C7Af-eCC7Q-oS4Jt8F-G zHfIFI5tdT*>$P;*Z^Mm$PSuUpLojdcZ$9#ofI< zGc&V63XksFuqRSK8F~39Z)2ulvoVA$=r6?BwTJ54LH&*?msx>2UsAj_R5ZKAP{J0= zfTJ<>=3!nc>S#5^NEE&TbucM&Dc9M1*d`y1lR0DI0`(-tI;|=@M8-JXbe9)63vT!P;`$T)f1c-^Qbb(&7YgzU8##?zy> zhDIEi#~s(J>o$UsnlaNznz$p9R-HS!3i%Nub_Zq8Zhef@m(7SR9}C+~#G>QfGq@*Bi4v(aMaq;o9Gc(T4&RNg0&%)q*vYMKjyo=l0 zTUR%?yX))gl+mEIHUIXt-LbVoX}*s3QVSD38`FrQ2#sq;2KE+H6S+|?*M?RNR(}4V zIvhq|HfUws_r_f0+H|>g+qq?5>mMD3b>4rP{l;?T{4g=^+OXPOXE^IAZbSP$Y@kAD zrdrEdcYl@euA2Yu=5Bud)%a+4%jd?2UHM$*hlxbtUWsQxrU2LTRbq?Kll}DU(JFnl zWu@lXLrcHbspm;Iu(tlZCVvWiyFi>d4xIb0qOR`tcx}O!%Ot}wfRj#B{rLE}v0=!@ zT=%#qV+ate4{V~R$H!$wMci(uD^F(~`i69S^mHX->N9Gpt(#@f9Zy!ajUAliEqw^2 zcngk}K+o=K^J2|yc*al$ZK>Z6ZBfsI=;&xfu(^c=X&b#amQu<^a#MoHnRdp-`b*PY z%eb?(=h-IY@nVjYnaZLVxyfX@{o!hLnvXD4e-ro+P1;fAyG#MpQMbztSA4hmn0VZb z*rIt)BXc^_cJlBHA;+{Ylf9F(s^Gz}3gts^>1_ zz`d78VU1^&YvZaL*;0MroR^pPXW&S&a-m!rw@4nwLj#Qqvi{XzEcKT!Uk07uIo%`y z4HDvg{r#z_sp)dm7RcL71Tfa{f6m-L(;~3NBQTKUd|tcm5_kLXsrtO=OjRp~%A1Vb zj;?TfV)c4`4q5CzsQKBw$2WfEVB>HrFghgd?^MsU)P}6ZHqE*8_}sv(?4B}zBCg;U z1{d!BD^BCqzRHLX?mX@@1bYxO~9iY+5Nh(5e_jlaVU@3mPec|z+cbu0&{$bH9suh zE6nYr#|n8hJtZK0W^;P}&M-b|D^aV_DV(s=>}s@%b?eru!@;&8&KWslVCmX^+kHK^ z^`h_FdUMz!AdRC~=@9MHURTK2VO`bk*LP@z#2}byXK!CsP_P@A zse%K78;Fk$p?R1;amB*GFeK%A5C&_$d!Xdwe4JC>YYID3q!%{8N zQa5VH8&hil-$E7yXsR>f)?3upO{$wcAm6;8~$+NJvrdVhmbc%ql3=bJ0^ z&K^kkv^m?oE>xB&J^`iqdMtlU9ZgM5;ejM>urwQ-nfN6m9UYygmltc|e-N0O2-UcN zfPmRpnp7Yjy#sGVrhS>u>9u6N3e#XY>$C`KtBE@EaPjLkIR;E|N{Ig*EQIE3F73hT z&!0bEt%>bgFZv#?_R3#Pzv}(qv;1@&Q+zXy<>q%B8Lpy+WLlDNqE|O|6%w2}kYNmq zFpSf0V1B`F&#f~O`@34zWN2ZK!iWO`iuzE^N!c;iRUa4q<<)v1O+T>^!=U|ASIA{MeCqaO?=z&sVXDP)H_Qt}HC_9J48Co_Tk<%TZ1ib9MZhY(#5F88%SxTlUU&d+se50*%94NGv7~O=jC0Rn0T+iN+q|E zCMRy(ro7MZSauI>_=(vnYXi`PN4|bsR?`ZXFmG@ywLB*Whpdc@#>+GlZx)mx@Hy$^ zV{!9Z~iOl4GiY+8tj?Casd|63ut4!p5 zjupV(A$Y*c&(Ak@e9M^N4UE*-)wRB(1GduSgz2ZHsH~+d32l6jES ze769Vx3+6#n6IOt>kz}>sjt61Y+2R!$+`KkCp?@r4-UdV`VojnuH48@IfP@|<6k{) zTiX6@*vX>)X-elV-{aNKX(iFrtNq?!wjjX7c<*v52Xxg7R7QgUUq^nB9bi9mZ5h0> zOGqWNNG$vry2g7t;w9v}({yrJ z4DIax^~#r1NG9=dvxigLdNi%pQ4-r1V8hoJm~Zw~krjH#O<8`0ooTSqzb!0|@_||K z2X-lNw7h1<(dz&_Mu%s9VS(A_t^hnXo>H8cW&5%-I}%&17Vrua|i#d?wBPK8lQVKX8MPdh=?XV~;E^XKDIa5gjyU=?`JuGnWQ z&kG|ffo{H>Gkg&;Fj;^iEA+PyZ+Ax?RtAn z5A14i&ZNl`MMGu=6iVz?KIG(Qt-VDqXOe(4XgYyPEr zO_$2?c*y0H`OJE8OMc-uLP|oE0;9yt9Cf{_S=o)TvDa@Nzqp*hq1(li_&Z{5U7QI} zfp-ZY6QBX5U_3TP>PR15-BkdF$+CvOt6exc9*%HZblPp zm>tovdFYXsOcQl{yBdbX^HkWK9dWA&cp4H`FTed*2#uiCI=(KfS2Z#Apt;*6G#_=V?nBCuC^o6+RxBm1^)fma;NsHyGpA~6py zj;|dhy~wg1!NtWz!sEE@aJ5iph2Qj~=ErUj$K#ijWPSUMpTjN3Vw1$RP8YI-f4F*) z05ZaV7sG#dNjN`MSC_3d?tl>eETqx#i@cc}q~ol0;)w z-G;8Z8-z&^yBaLCIB@=m2w)7HxHD!lC|E3Sa#VA=fzk*ubjp1p3;A0G-7ARxxq$@`|RRLkBxnxtbFLZ2mKRgYHm z*Jp3PLy-gB9RZ2zgNT^%q-^S8f?3M~XX=(-#$Nkrdo%Nib(28HO{Lp6J&#Cg^RHmZ z2$R{0AqT(H=-u$MTMp84kYk84_`|BorhObPJ}pPOsJ4fc;*AAV$nt8qQ0PT68gJOu z&rotFAyGc@;ZB84q!be?(LVz2zaEKV?6|hRuCJ`T<;=T9%Y`=wg4vBH4~L*Ck= zzYQG`Q%q1Uw{}xCd2PQuyx~YiWBvvdEe(FHvFg7bWHX;yE7JX5Rfh%7dxBG_`zZ3K zkf^+$)=3_2+au`DA_g^C`|HTYUmE-@eFu2#4XyDU876BnJxCZoH3F%nx>dvI_sA5; zBh>IZK>NtgskYDxp+RsXilni^ZWka_)NbDxHG39YpC7Q)cbZ-=yZVkBn2vebYhTmR z#G-Y@w--{9N`xfGj)ydknnCG%x71phl?tdnn`+eI?zIFTWVZhr^%GULYkO1Fwr#Eh z83NdrJ*Fjt?@ArZUQ5O!YQ^uWzl38voo93XYIeeZd%dSW6!xrl(Gp~g`3dZgt~K&K z3wrz?fy~bC3_!-xKYxM}jPl?zn3z0kI-6Ym7K6FebmP^1q-;m4b^M@v$0_dO$&N9H zVGQDb%LhuE_!}OZT{tq=^zQD9{V}&|k%X}+9dhhmUG5g#G7dD_<&x>l%F5eJta=XT zy#QfFZaj1p-`MfS8+s0eD`2LfF+=3bE{mSyi5cdM<^&`e->K7t2Z$)DAD_luDn{6K zWErxx!en0OTVSUlb6hJ%3Z%~4tw!6o?44})aBi9OFu(@9K&5j$ASVZHbB>eD0cg2*()m^8cr=`|-oFN8{(Mi<-$QJx%0pV$u%((y&)_KU>;b$c<9+aLiX! zwi(tu#bR-J?_3m+@J}b)NkrC|fXq=*T4+oGt?U?Z%cJH8eRarkw1G!ySsH?g_uJ4Eg!Ryxn?C3S`I zJ2<0zkuVaqx@d33EVN?F&Vyc^AGz!*^k1~>(55n|lR{4q)`?DXOad@IZx)DPJa ztEXHhgRQ#>`qY18|2&$^?&Rw<_K*qnb~l*{kiNg$xvb&A1XP-CEmh^bp;QwxjBj7Mi_8(7ZtKn~8Jn7jNsN`S#UAmQl}XAbOmtN_w+K z-JSJK^OnwSSF@0x9&E0!uRpO~X4tyJ!k0Q-cnCDf>Y67BGLGlV%Cn2{wiiqHn`~@Z z^wit7p7v0^{k2Te_v9_afCrYyRSf&$%$we`L2#7oD7tkS%;~^5?n9Qoz*WSNniePJ zYZg!79L6G+nTc;Xxpdl@?fP_FetEDc8j0LhfD|E6t)w$hXFw6$t4QbgdYa|gjZB`< zKM7?!kSkHH9`Ms;7LepQchLNe{O2Hw=t~J>rFFvE2vvnDKl|TW=gm_n&QlpgRvO=x zCK5^e#O_RKwMHYU`d31oVFo_~8)ZOJH`&^=ibGjV3)&tV0j|U*$YmDSjLC699HU|H zJ@(W)XZ_x=Qfz6K{Xu(=3P@?9JbvB?_Lxrhu%L#%lG?07I8%a57C4-%d!uUoEI5Tf z?(gHHC)LCY%Ue$sb=5gXI_`Mfd=uc7D&Cq(9{1l@$G|G5pJtiwXh|5esD2sdyG{6D zBC)f%QokJh9z*$*j>UxC+9nJ@fdR2BcV2UM}FcJ&@th zb1+><8~PbA>el9UP|8e3=84)`2H#gEGH_a&_z}TV8btF1&g4rY?|xF(hZRLLAERK9 z=U9{rLy+w6H?NMFhh?1y7zPgELYVsIM&UaLbup>Cm-`9P54|kY>%4x|s=j#vuB`DK z=iL&Yi0tjw?76rjGkGIn%*n;6A?M8J0ADnbypuQup@Bc2 zYRTk5JV#3HLN`d4RYNF$XbSuAbvP+1z63csLnz>Nt-U`YBV;9&s?Z5$Vo9i}s&W{U zmlhS3&}^y1&8nz=n{#+bFGp=s$v)e(NH;@>cn0@12qp?O|4xa4!Y_mV{9+~ga3GW< zVu;53Z(34K!OoX%n8)rubbXY|UAE#YxxRaG2WOOKrr)avp_vmgDZr~YFWilMRBRQx z4S7p?4u>j`5>Rt%Q>&Q!HB#$-rnz+?@a__eCC1giQMuP&rpj!NBGkIC8?cX;L=}@} zPT5K5q=7wufpbU{D(t-;;T;r}E(%US4bH57cXpZHpy)B!1?sOuBMwpOMteN!^7Xb&D3Z`&&o8FmrhuC;6GD7H+*yIe5hLSV&5x1gP(@?)@Tqw&= z2Zv5VW3Zed4rqj|mGfx9a#XP{&d$H09k>ajs{fj*vgmO}t=%15j&0amHQAIievF>5 zo_P=$vq!FYF$`uFOKuJ3JHC=T(p#tU;nuge!t;CEa#bB<;w)$2(#?mp6I*E$JH}JY zw_v$-(8ei`e6|e(qsu2CDD?^7~({r+y-5m)m%UClJ5Tmys zcK7G!r>T=vahU-MUx>Pk#J}Fgd51#rtwlXElT3EwG*;s@A`#wfSlQT8@fD(I;&H}= zX+@BatMM|wkwN-gW%;4yoV&mR#b>*JQT0cy9YT3+W*@}e*ji7qKk^=v5@5q-ziX1t zgPiqFWy~EB!v zS<6?(_u{Ard*Hx>M|W1^>D^&j%{rThZ4FEO*Vo2=LfM&3-}z|+2<6PgHGBnOb3wn| zZj0oiBHpjnV~-3x(U{_L068Yf-s2a6hida&dXCwE#(Es-k7Rj)`aE|0Cz`b%Kyak` z_uXIkP2LCyQlvsh^ZL&ODCd-ym;ckjz`y{cveD5|8yg#ib;OQ@;T@`26jYqXtGdWm z>i23(&pRLY#yp3YekzMJImqT)NT%=n9w4o`Uzz+<@fGrm=?{x=P?65@<0zbqr3AWe zq{jAk(C;&wsNG3kJfB@PeHMm;OMJ)jbzSE47>>As&`-VPJip!Uic@AYz9t-Vi;NGQ zV1~9l?>Z2&z>R&1WjA+t7oZ^&N%FPngm-*J`H|1@-L*oc#%Ji%!?k_4-{sWqd4?A4 z7!#}IFS+)<4v;%@i}G?TWRa=(S}BuZDV9Ze2xiH zWlTOWTSuMRR*Pe0MWPdN$6Ql%sOlaRVtgu;oD*UF;DbY6TA0aZy`$CHbrC}>`LEq0 z)VcK`*-;6RC~j*B<5RKb_BC{-K`kWXMeK3p^B^`o6v)G4Jo#rc`XL#pOWMsltx(*$hqPR6nOSVZ?m3Cx5{k61oyk*;fK?Y>hR)o>Zr_}Xq?PpW!Gz5| zi0kb>$Vi;~?Uu<`omb+2cJ9F!m4?@}=#sVwGToAechF`TF&_{Xe<&PdQthDlwduc5uKOnwOU7}+610Y~ttg8PWafQ|V?^>yV%D`NUv(h` zSu3qMt@M>MwXGwyErWF5?)=s^FN0G#GG=ji=j(?G&0?^pg4wXYt;$9xWr(*!bYCeu zzU=wP(U2z}B`d3XKw2*+=F@icXP5+465WbyrR3?jl@fJTV8b?}Si6#$M;^P?WBN9B ze^k{7i-(20Js9t~8j5^xCYQ+dordW5e=Lc<(`EQ1g8v08u+p^54XLTSPPeS8%6_@t zX1UVzXs$e!%PvB^%wW*Bw5LP6-WvGN;51xrKZtgG3Tqrhcck$n-h*Ax<@XBlDUN-y zwscRswRh9XR+JVDYy}F$3?MD0n=ScxR4aq3^REL@Z%PH07GFj@E$C*F_aeTg_>h5? z?h1IG@wtAuacaQ3lSGi%Xvy#L^sGt;(q2`58p?2hpl=><#H3wO4ed`az^9!4S|Xls zK@v_x#Ix0Bks)YJEnyU5h#Mck%gfhyTB`P?O;742%h02K$m;{S8j{L??Qw5=q zS(aBl*smsi7;j50$R3G==VmY2<}&vg#pgU&fY!+_^h{^mN9P}3DWz3ObE^hdBndur zY#qP!fHn21k_+b>+rzv7xJaKwfvZ>mg41TOA2UbHJz?p0r3?+zffJZu=&Km`?>8~R)QUYjcR z;Ks92P>0JHDaO2F0|cz0Kk}qVPvvhPG*nb@z~E>Kl(khi-N^pwsVRVSR3J|)^9Nr^ z%dTtE7WDg|=c110tgR`_1E!mX_%#}~O^C{m)3%8cdHpqvMth7yCQ$aIL* zr{1!+A9UV}nP$Q~+r&4FxRFLG{yAi9MFw-MYtjA$>%6aki8JsbZV@g1CqFd(#Bx=Z zAtblM|AK6;BI*Kts4iLAY%WC0X(9l7`?@^kh`OBnWErJxc&LAyfW~}qhA93?wne8q zS1QJ#o0XN7)nRII>tm%#@o{l+5fv5n^5WAWapon$De}!ej#h-%MMnu{F1GgX@X2rC z(*H3(_eU|PU^b-DhV|wV6Ivnh#hTI5OuPuM{(%3$3|+n=UZ%M|Lj2E{m8L)~$H~0f z4RkSwH*xh@-Ou}u8xtUgux9XTgGysj?{@b@qr>-gq6LN3n{GtfRT{iuX9MSde4Z5Z zk@droSIyz@8G(W1cFl&ClUWPrPYy>4bgi|h z9(u|zV*`!&gYRTq`_`Z(lTcgd38(~i=C~O|!@oz=R zJ*wU2-@Y>vwJ<~oMgbq}pAnBhe@aVZAc}UVe(k^{5#;B`4`4?a3%4p$($PUj3)_Sf zCYzS~)Y`!~B{Q7=hh@b`c$6+kRz_d!XrbLSwfit~>0p2am8*!~N&YZXgFJbFSf`(i zWHo{Q{=8An_%{5J^Z^lMkKiO7hQ%Dh!#PaQv~U8ZozsMOl?lh+WP)v?74)l1o8yBO zdjMMa?zsgY zW3R$em|?S|kA3V+It)zfpW*%+Oo@`3GHyHtR633h5C0k5^3Hcw zkGBpoyn+3Wc5!trnY9e=@$dJG^MCuc+r{#|mbP}enpKA?z&HJcg~_4`zYsQ#baS{~ z`wD$bW+@Usd3Ye6%?tWXI*vV~p9NHzg;w+FENiSUSl=rUm*O}Irt>^hFEFr(Y+t?#w)h_uqE5F`5ZsbZAB@c^7nU({GTF2kFo8-{) z{7!18VLQ4WwFb>uUfg*znWWG#ta(E6=K&IeDg1@U9{#D z>oNbOG%tipf#0g;Y%MWn?1r9)8z8{N6+L)B)OsSI+@N_f|m{ z(6RuC8>WGgTg7f;Tvu18@TGq&bc?VN(f0z1-{Zt;O!yHwXqcj6QG2`REX%zv!e4I{ zlH}6p8 z_t(=U8QaY9k|&`b#mRKgiz2TTbvzqik*s)6hse%!f2<_Rt|VehE%vTz_8uKAB@h*t z7L}A$78iZTZ-I#5OMmn2Ac@chE>%_4<55F+!@2UxO7&uuEF+_rnkW$w{HH%~Olo9~ z?afknnOdHCWQjv$r-S(IHR>*D^Q$|Un8#(vzfE0`c-ZDMBP~g^NPiL)88Lv^!0rw; zW#R$q0o=csT#b}yU0$*^1jw~nzTq1=Tf@QD_z$syznLhhcSzEm%h&v|bx3W}ah`T5 zj3VZ5QO1AYu!oH2YlD+iMemsNBMLlO^G8($H@#HPw~@(5AKnV4N^7LwQ$p?n-77I1 z{5;0eGcWmHSR_r;WiVk{gM#oDGZ@>&T;rI99Qf3(cFdT~e>40hQZy%b{zxQQ+VlQd zLu#%fro*n~jm2asP}J!gQ&s~nh11lO7r%9 z3A#ZpN1!FX2glHoD-%`xgQzzbIFO&tkZlBAhU~^w+k7QWZEe2RijWrrXY^XkiZ8A$ zL|$|e@?WRJC35S7;dLHbGL^^6$w|xUqdAoi*CGw1MtU!>R3Kyht57!PhKSV|#``nS zD9@0EgJg0${@Mj%cj1rzr{HgH%(w;D=?TcX3>8`6)ucF9rUVWKe51)}(e-3{ceBXq z?}yc1l`*W1wG9WYi+kbhXkxU^T+r+z4aDS+4iIN&h*->5d?QX3T~$SW-N^yQLgmr; zncnguV9jmlXtL>bR{nEr`WONXBt#frn$W)N-`@-O*0rb*a%Pi}zcmE~RMtvTc(-*6 z8H-;{PRn^Hso>U>V#CFnG)(0eEGHnMDIc?^NuYh^{Ql>fLl?^dhl7jT@e0KIAcuFl z$9=|POo+7UnF(Ef&OtPlGZY7hLW=Je7S#i{(pO7D4xZyQc5%M+LN&}V2$(nk#RLB8niX_(4~4RsdCyOq;dMUyB8v}TRX^9OIb_>%T^ z;!p{~;m?g4E-rNnG=XRX8Zfc#$1E@;j)$2{0=N3o3kk7d*HHtJFvX(=@_%IkzPQafJr+Hzq=H2shK)V>L5ACYatmyw|1 zojwzW!G-Qd4JW4>iQJ2a^E9c?6VQ)h+=QH|qkv4{z`Qh41nKLOi2oV1$odMz8`qDg zpycb$*l(N<=Z=#|k}k7s4XfDsI!GHao2bOLg)YYxl;4-2Y!lE;#Q#KlLLCM+3j;c^ zy9t>8s?1P6_eP=g#Q=<<HDl)4@Si=*jr~CZsF49eVNL)DOrNxe{Ed(` zh<4jm1Tgn3&B~a0ybaCK`Rgm*vUW?{v=ahXVE|Za61w^Jzi(Dn_$)V^PpnV-+9h#t z6jbfE&hT_6TRqP?{O?SiONvCFG9yJa-xSlum(>|E`Nq;p=04)^@Q^#=l*A+{g>>K8 z#-?0`%857K$VVrdG)t{?FbPV$IlKAyBBPc-})km1GHgwex7;&YH4XX5fS^=8Dea9 zt;3*nAvgM!SdaAaJ`dBG;qdiWuEmMJfNcHZ^7goG9A`0Lz+dfrQNDfWZ;ZRv`Rr1L z3+ZRSn#dft7`iVG=!QKg;fZ9rT#-M)9~i9#qHk8}9}?<0L+;X!uIT95mK-2rd=o2m@3P0XU79&LI7UBZeg z%F5U(5Mdk7<dlk6yqMh#WAEcE z=Q>onTB~}s4Q72Iww4!9iGh-_x&ijv|EUM8G z*EShS(#s!-?cfTzrvjYdou%?uHnmdK+{qslAN_?V78e&MCntS506h_4S}$~_v$L}X z_JE#vLjFb#DgP~`D*BS-ahdf>Yu7-Y6R|*HG{@sT%6Pw!elSESesMY z9v~6`dSsJd@_9m#F=|WUndXdltZuCRvr<=C$smxO)(=?7#n|jsZ)$g(L zR#*%CB6eR139YYzljetdEAH+}?Q(0v-13Diy;B=N^2e_|@XEW`4W=kl;{?d?Yupkj zMXkW92=0NioSvOE`TR!Z#GRjb+H%fH29R9Yl1B_!l16v^OMBmzA(!?@bRN)=+ZeWe zLE2C%omHIwEfDwuRP7YL^e%WJPhlxgL?fgZ)0m4fjy$lv1S}r&o)8MQV&CW0uoBeNG(Pv^X zSe!wSF+C|mx=n=!b|2_#SJNiGRoAT8DiNs^eZ=LZI-Py~8Xy@wAw$j7VfsFo(WES6 z?sm;5Npj^{{&gGOaZL)IMAv!+Ko1ljQ5p$yrDgoYi;lzjL5O9x5RIkfWiQ>Z#l{~L z-Hm^d+4!?$0OCe90R8;s3&-ct|H;qSE|5&`f`vtcc9J4$rRS-H#V0Yg!4ov$7)Me zdxHe<)W4VsT<^bs_R5kt)l*%(0q{uSoRsY#-h?6tTgBMLQ8NKiTtHHs2o`$a)m~X= z@fl`k@jHEgGR_p0pSpg6c^>wxF4DZLl(A{O{OWMHDdQc493~?2>e~oXpZIcgW!w`U zt~KG-G5`2FQSl_p$_;)s+g3mu{{(S*x+g6G*VWhOfJq0q5r*W>!f+j&Sxv2g#7h-x zQRYYH==0dTVB;}U#u39Mq;8tQergBdDiy%v8tY3c6HZ^;!Ln$9C*nQh8EQ(ldN@xy zUFRG=9l$Oyxd~JTx8*ai88OWCPAzQ5T2c7%maQsT2~gYDoAX>pRY(T{CDB|ywbj_>$f)|B(epIR^QTjJ%*@YYkvv+9nF)?iBo_c^)C z_~@l&{%80@O6-F;c&x18Rv*@zOR7Z}PtK}}(FWa$gxMQD#z<0EJ7i~cwj7;JI$WM{ z#WC#X(}41Nj9J~Xnm@0hth6}$nb=0$ERo}DNX9UZ$q^-M9r_@4IH!p3dl+S^56g@WsrkIFE9 z%H!`|xg4-Z0#=5*S^Ans(qhm-BtE> zGO}S9<|xzBzU27Zeuhrqd(HSUDnb?C8GpdmxXyKPmoU z@-QV+3l|0FL&Ll_*Q^F+-6AR2WfhKuGmsLiYl5DYjr_PgZ7cJ(}L#sD*#eYAdnTmPIgFC{X>8V)HXoUtk;wXBZf$ z5oZB|CG_upH${Pi>IFVQ7Dv|un)*jguaHSPzUE3W0Mv;C%vn9i^IK9qWPQ1ksfZ;p zGz}4H*RlFzgbbXi15&o5Z`wRY$<44&i5b_=jv9%}8R{wZ`l0p3(#L;Ewi`S>d*O4u z`P$1w_D0?j6iC%r#!DwyngSwKEOx&zd*RNwy-9<)wlAm8egzv+QR8PBML9%e^S9ww z?2!;p3%1Cy#mg3qfe}_T>~FlCGzE$qIMO1fyIU-nm|X;6x7L@?@F||cYwCMUsYH@7 z)Udf2XY^f=MDFB?>yzZ0va#NE34GD0`?piZby~nzC_IE?RW4y6>ByCUhU3}x|EPP* z=s1=oT~wAVW@fUWWyxY@W@ct)X0n)>nVBqRve;r~W|l1G*WTyMo3rnnnY-Rw>;AaC zs#>Y6>XYaU!efSyCWGGW3*kY4-)_N$p`Udb@s#k96hz?FwI?J>p z$P6Pwg87TmMu$S1BI@tlaS7?AG=tlA7M7O$1vnxgl?b?g(s@98TGMxus#&~w@}fx@ zO{_U>io26Jo`^)Yw6<2JK%+^4)$EUt$ZJzu5$Ls+4Aj%7MgQgFEe8xZa*B4q$-**5 z=0`H>0C~_48rS{eV6)}q?IiV(n;esj@5<2r(L&mtI)?Y zt0*`+4I6I9aBi<8C*scALhdvcA)xK@CwWD`G%M%R;7V$Emi2Gva%uV4TBBaDIm2`ec{N>rXWNNQ#v|6o?{X z8#L$KQt&bhae9C=I%qM9QN4ddzMA3%sk)u)^rXde7Wg{;siE}Jt=0!|au>7>%bzq_ zj^Z;<(X<)x_eiT2&5c%3W#yRx;V+Nx25P`y?6tLTNfOp9xDcme3I_J{NVS@n^7XD1 z2U#p=jmzQ%lg9-^P6Z*vQ2vpoe05tI=l8S78fV$D%<)#)vFo`0qb&fWd&pYGQC1kB ze}C`Oay9H9noz~v`STXalu4j|xj+YHQ&UrMF+@W|-*ykxD||Wx%;4dTF+4_I1(~!fN zya0W^Xu{h}B2Xxp>FBT^t}cfxXb6^fJiWi;_hr^e)=eF{Msu zQF4;1s@)L&%n!V=0Z6$iONMlnN`(k)#XO8I$3izQKN6`rJ8)&KOpb*__pu)^vx#o5 zqMA+{n#lnfEG+bg9a0iJgb;x|JvuBb^sNZHL>Qn2h_Oj?yxR+OcdV`D{>H-NC#Qf6 z$NEb(K<$VL&~pS7P6L{s=_~2~qY_yEf9dhj&CN#oXD>U_?MEY()t}OTyn2Y2e-vr{ z`&9od|B_n&f1iY%iS9phu(SRj$-xf97NGx=CH_BCu%BmoTjAbe4<$4ed_P)1Z#2Ml z!hfYNgqL1v2rKi{PgmhvVG5H@Aio}BI>LG}q$+d=k1zk~1P)`EpIBsDfEyrS23TQ` zKpk?yJLHbuG~lFdN?@zS1=MD-g&6`Sy6%?`+v{n?cO5g?CPhnz*>f&^9$uc^vo9|% zTy@m`zng=BcfQ&1sxS8FC*dYdflz*&DsQoZMp+p%Qcibv4-9yQ4U5CF@T2GOdmWRY zEhFK{buT^MdcpUhW&Dfoj^>rLo!s?v&j$dDm<73Sb8XRqlB+@Ub@C6*9c>#*k8FGTrQBM~sY8_S^cOI~{MW0iCuU^XQ*n_RDl zcTjC;$S^K6iF{>LC{O&7C(=>i*c{fFFl*RhNWF59F)bE5HXv(6W~5UvH>ekcV~;7b zc-2f5JkmNg^|!po0It9A-v3CUZ?ox=JZyA8C!Mi#j^?wcKWowX+xKGKaK z$+})0kqkwRmf^vXG%sf6pRJ@ajK~`0b(>J_L(HuAU)@ootvKC}c=GS< zl2VdtTdX|Fj0=bYQSk>R-^%2FGl3P`rf|O{ttUO=P0uMZpm@quAzx-BaN>|nYH0|N zY!?;`r(4KJ1uDj?jpWybPasQ6VW5mTsyY2!qFgr|=i-VoIP7{b>eIRB>}U}I#&@AWkJoH^A+kP-GziWY>rG%u`&aGxAgP;SB5w)0t*qjz(~$*G@C-xL|Vjnk(;$ z8AVeJ$ZL_jgCUPWI~4CxE5|Is2i{Q(+^SxC^wU~jv*%M)h_;r>zaVm7GwK`gD=JoN)%@7(fzi=c)0@TLB}~R5yzZ=>@}y;XW0qyJ zlyr(N?MVYP0uGtWmoi1Gvf0GYcM#C_ zYU-SUc+$*m>UAZw8OOo8k(HS>>cYrM5gLu`dnB0kFk&&ps(aj3Fqf)ZI!QHih%WlR zbBAvn3>odpd!4t-U4`i$GqXX7I%1o>#kU6J_akxEu&pF!u8`cTgFB~4)FBRPKM;BjnL5Jn0`7qN4 zqXa`0MBdX6XRgqeNAaXP7ASkUA=sR~B8vREs-obKa;rx)9^5a8arzM6dF9F1IV#Id z$ymQr&?tcL#=mvKKIN2K5V$`2FY|D5&4yW!`YUM9Ec0H0E2bOT`$=!mg}Svehe$%#hH)tzhxJ!FO>}758p2vC(BVV z(bI1`v<8QSWXY6BTG+H`8QP@GZ*#0~J*q2jE}$6t$d}tsjgKbknk{JTq9|V{&+RS$xxL21hMHNdMqXT~z}i?OaOUIN zdm0|I8!(N>4;X4{>a;1Su<9lm`Ky{@&lodSblgHIr!&w1)k5E`#_aAgk!?H&g~Ha> z*4kS7DwR2EpyCk>N0^$Nu zJV{@vHf-0tg<4UKw{T)b@7ZxHkaEg6>d7oHP?5X4se(;Wt{7b zvGwX9@vQ05>4{}b*oDm>A)0CcG5x%7ZeXHnCE-!RmC-u4-y>;0CRb>au_=vND{=XN zq|muiM(3B8%M{8~zM*!wDt5kFMAdD1-7Hc%txDcDW8yZ^rJTXQABUqai(4t2Qj-N+ z4?F`O>>#7nWtgJj52_yyKyN_O^adI=&clrjXgqXNzHW9DzMrpJBX%xaS9QBwl+9gG zEP8hdb)zpsZ~CfK?pL5HyF12h-+$@LG9GNFl-^|9xG6yO?tVA*9YHUdVc8!!#;pUT zGr+;drpJkjg~l)dW;;&rJ!O#sSwG3N&^S>E2IZVGH0d^+n4HN#jg)xC|>52|i< z%uFJDjD}#fH(xwA6A0N57NavQAGA)dT{*x4x~81$47ouA%ml1)2njFG&#i52OyHhi zA_FDL%qnBnjw|9uYIIU`pQY@#JrtFz_Jb+{VzLOA9OvrT8Lo9ON3;zj&`(J&F^*U< zPcC^3-UpW71s6qWu)W&0u_J>;UWs+}d?>N9vsTqWYv~vjARr-;<>bO!S$rHNM)oCI zD|Kir<$h^q%!zasZ`z!@MqvlPsg5T=1&U5CJ#-kgRxvp=)7-CpR%{Btt<6`=?Q7Td z9;v%bJb$ueeYeb{+kk2*Ilz)m_Rh)Ne~wUH@X5{8bm5WphXI5VfkCy zjT-9<3lM;qKL};OqBLf!I`i|=S*U+L*2EHXOlah`BR>z4A==cLm_2UUJEBX0| z)5U7O{Y-^?WJ=6?fA?8xy11~381V0QgTI8t4Dp+fSMeMEJZ1+yqgJJo%DTjkW#!V} z-(r&_0UlE_Z=wGRj0+eG=y5HBhh== zTdR07N->6ofjwr#pnqE)DkHtEBekXb9#{W!TbH5;xFr_>5{|v73$Aygs>cq!mLy>$ z*>?mXL*KK5PelkMKQK-z4dfmKd2VB4!s!v_LXnO>=r)v6L|oQkYkY8Ukb{$RHWO*W ztEsis-Odh)!T6=Y0rC;JZ^e=&BW`CV6MjMmE@bUTP%O_XAcaJakAsfxJ096cLTaQ` zEUwJt;f?&DBq5rs5j&i}iVLKQ6!|dx2MDA;L&~|L)jS^4G`7ekyRCiDk-ocpG?S7};B!jII%t5ithWTd6zM5qGNv`p)lQ`4N&rb_ej zdW{%*Sz>{;)58{x@gkPkdu{LU?^1gl#RSBQy*`T7l8|n}d3kx!(a}<7fy5~8!MFU2 z`mZy~%U_=^bLeo0BfiLtc$SPjKDOx8OvZ`~=ZDT(M^6P(e^$3D|NPo+u)aA~M0Llnh-;?|9e&h7Zs42)A9e13f20UY!b z4u&|Cqc#))aBY!}cg(pS!~e}bqp69-(I1ZhYdaE>jQ9)3mJcDTrP%xM>bpD|;? zYM2?wi3I)l4xIabUM0L-)h*rpulc#?O|%Kv4)g@r4U0j`Cwb zN)UU=eWye74*?|nu%L5Cq%qLb>#<@X2_Tk|D!d+wZIuL8=Ih<0w98J@_Jmz4^J#$%+c#HB^!a{e|E)$ zGClEL*<-N$d&dUrzdAO|ove&0z7o;$J3E=#I#5XHJKEY1shXKPS?fDEngK5WQ4TGP z4W0h9ku-L9wRJFZ{8JWmFxGc6x3v)h!pBhvaWK#^(9tn5Fwis8F)*=H)3E~R=m5ZG z(zZtbn-+2ownol|#tszkA0W~o<{*Y34j{H5j=<9d#0jJtga||hSnCKpZU6dD4#WyX zAH)V&&+s2?0Qvs^^Wnci?y>!=Qrzu~X=R6)JDd3R<`ceK*T+2px*|lD^qtG7e^yEAnS7a4u637 zSpQH~_$L)My8o35(3Rv2Y(>oi1oLxr(j;R1tAU!j2JkOE0|OHgoi@?Ga`M+5{>}*y z=)Ys?8voJje?yPy-zn;!^!^g*pW^-1 z>~G@zsrkEjvNqH}My<^qjUE3RYRrFG#J`vBFNyw14cJ}(i*$c#{!UHUMc>N#udzj> zZ(~GcWoxK!MPzGZV5{$7WNu^n-*CY4Kgj!!OaIXCe=*&^jQQ^zC>lHb!Hp#1H?p<+ zV>Cpv4o1cf{~h6f*wMf3*#9Cf``?uN*Dy1%P;|1Ul_6rLqxFHQm z+5Ys{zc@m@H4|{zlL>Usp*}#mw+CEgg~}4cBz4GH7AoTA7|+eC(5R&&JCg}17?hK! zFcLCIm9=kdUypcOPj843)kY}4JI9}_BMh~WXpDV91*V+bYz1KhIngpMZz^{xccE-f zDwiyBu09dKwp7;ss)<%!oy6Gqt6mGewRlo0sWnfwpnPox(0SbL>INwBy%LSml}NG- z>8AW*dksHr&;FKRN=bXo38Pd>Kzb6tLA=6IQ40E{+A+j7a|S}`M!;NhZJ(X~1cpv{ z6Afd)a)(_s2%9@mC>zHhlbl0i7L1v^gjdQ>VTDpLKhfoO%Qv4~wM(f?$~x?;bk!si zfrST%A-N(;vr_v=(tPQtnFq+tAcdvacXyehZ-vI0b;kSy(s`9B315%%iYX(Nn`px5 zJtmFGrfbt2h;kGMXhc`5RAd5_EybSaK;v^9FdP6~_|M>#Y#|cXWm<80)!_tQ_W4?v z{i&m9ZwmY;w{o+xbA-at2XZ3@lMD*|QH9Hce)%cl?JFkN|3>9?x9Qt|?qqp^UrL;N`LLg?oy?a{3iv()u0_J?e4TZNA zKb?jO^Yl`kqry4(Q7NIu6eDMcxT|11=L7#usi%6e5=J8*KNhmw2+U8}qOrLeJq_Ri z3L#DhLrqqx!SyMR%$)JlXDDH7gd;!qg~FCVIe|R#BJ#q#q{8`IAz#a->XqbNtxxWO zYT6)C;A~fBr1!_rN){1y;B;bjv$4`FOD05!-VlZ&!zAt}GbD(3iF}5~IafNu)_18R z799aRBl?}p8aaY4IMhTYS5zJ>qjF849%6`4zuiE=8DIlR8Uk)Jr@+jW2t-SxDnZ_$ z$_d=b^kr2ksINLtzBU0bUZ*VTT}BHkVsvos)q^fKF0!^88=Pf?-la7-P6!o>*SD$r>Vp_K4>Q*sqYxHFi$$R}bPP&rT) zTXUe-cE1Mmt-=TzO2Jfqsl{jnqz)J+F^#dsDBnV!DT0rDY03rM!X2~cVKnyUD|fLh z^^{-95;XGMe!W)Og*K*&01g894!1<(Ky)xqRns2WGa+~`R60N1o%rk1O)wQ|QfTfP z?;3&juVX~e{3$0eGeOx25reKh?$T{0Tq@pt!5BtY=@5^@Q!$~SN6>hQJ>_K7}z=@8p_$YP=0z8;@xD>&

      cIKPPE~Bsr3~d|%9H0gt;$!kO+Q4gEP#F&i8^Xx-ak=A zWMHr07MqO62yUGr&M=!S6S3?&331h?Sw_>a#v(6t{7Np!+3CJq{(rey{+o3m|9M~^ zzhYYdWf6rVxAAqX3+!eH1H28_erLRY9horOD02|ru6;8wH;K8C$nC(~IYeM5%pXnvSnW`9swvwGdHWU*~ z<(AGY(+O=XDv`dACbZ!??~bo)99wd->zH1MIJ6!5aFe|-pcC}<@bzGtJh*9p@`bou zz@~O4z3nzOcLLLK1~ymFpnqZu{7bQU8L-`fciGQKu>-Emz8+~lSSj~JPw<63lxEJC zV(gCWxIn~K*>NH0tFQ?TalsnN(GLiYxSor6e;E6=6+#ff?FS`-t^_a1eRr%~I%c zt~*Bi3AkecDg96Y-hem;OzeNUbYmYU3kll=B3UjCbuJFCu26%J!$MK)FkPnKkEiMC zYIK#(m;b@aBj{}xtM~Ly`qjzr%WQ-&9uR6k+0t)Lv(X)bdg4>Tps!N{;E}u4bVM(D zoqYOrGP}}&k=*0@>Q(wG?i0>+(A?4Lv18qvHP#xldimSD$~#K4d78<>BhxrUq%RY=q=iwG99@~lWeTu=9?*H$NpkgmH2z?W z-lwZ2Fo2VVaaB|>$@>osVE+N8H$G(u%?kwJ3b4SXaU>+gVN+6=olriQ^@L?tl&ni*-1?E!ZyVZkuu-L$^XR}*6Sj}`P z;C;nK5*5ix#9YS)<7y^EUixA$Ac604N-RJ*!Z5UaULSafkMLKCyUH#|B&|wp?Iv;QKZS@Tujm5avPg z?x}^F08|fujB?+OJlDt8u80t;r>R`~DKyiwD)5Nqv4 z+9lhZ?CW=LUtTC}tI>U?6{6TPaAM1Lk$T39&{b4_5}~B)(^(DxK_g4v`nnp0XbQFr ztO${Byld!j=Bbkv`?ignTd7h3sGfhTfg-Z!%hhr`D~!A_vMk5NzGSP_`bhDnBh@Fu ziUAXH>^Kes2c9*6=WX-P)*YIn!njwj;0h<+b|TM?d{2PvtL$kyYvlgD$dyqN8@LYk z3XNF?ATxG-Q7!F2ov^8CWhz_0t1$pjqR`%=kiqIFmu&4$jf#gyO*mpbfTa*VX@4rZ z{S?bV(^)~_Lrlg#z@bcfH0Hv#pz9Heg1W25tvXo?i-7mF0Xc@~ zM=3PDxOHhAoiy2qEQDqp0>^9zmhZSwd2C7A3G3uZAJgb>d2qnAwk52SD4P)8O7Fmb zAZ|)+$l;u!e5_X-bT039RJG#d5iBvi?AfgaSQXASL0WLAz=rLnKi%WRp@K5DY#`hb zGDrSiZ$44eAAX1wq_G{_9t=mi<<$P9roRP6DeYgit#vnW+uzFlDfl5#6hfvGd95ha zY=3Z7C91$#?YER$2_*x$OBH&s{Smx>Csg_v|5SeJwpZtSw~7eemgyWxO^A9ggbJiH zs++u4s&vcrA7~9TViDSzkxG8fjMSLd8XJTe5z&zTVQz@)Ifd~eOfWlg3-<_lAG+vj zCK)e6(A&htM+S(niMpfCj6T9F2-k!`0Hvh2OY>XQTwAtqi%U1(WAELE8Q0W*Rhx(& z<+>_2U7b$LrSqK`4>4`7-2|5Bq03Gf7TyN;Gt~T*(~t|H!r+Y9E^enww@f)w*MznY zMfZU+zL5OeoTiE(iU8DDfcT9JUXosuaF51}x64~xR zmHT$+cyKI4T_4>TYHEmVw>CC35C;HvdzR-!V7gGt<4m~opa4Js>t(x#pl20K@4BUA zYW5!7G}(!056dtq)F46xy0=gdBl5#xh>U>c`awsqZ@pm8wVP+#p0Lt?xyDkfSy83I z7d~l>&ly=N*USCoRI&fSLgc;kWrcHA#cCMCwUgEBfB>!MKre_L3vQ;~3{bC|2lo-( z&jY#v3q`jRrYfKu3e~L$wmT7G7$htkURJUXsI`P?*VzC(yW5%B+!599{I z;fzZe;q`*Ok5DVQg~!4X7;k-JMpze?028m5rX^vf<=f|(QPtXuNItm%z+0hAlko^* zW1eXc1|i^{tYT{g3rfRf7Rd747+C~1R+BIhD?;YBPBRl|`aq|DAHjExL)!zNASt+p zFwL?!VNa2!4~x1Uk~C!=&+8`a$~=JzKnHyZYX#9p@_;97iWZr=tQenatsr8uG(bO3 zA`cpCjDiN#HOL?bdH}Rshgf2di?jya(sPu$wIi~~3G1cSCc7y@Ak%X^FZK{4 z7wsWhgeBd?+ED6$W}+h^R2^i|`_a9($g+`+wgsd!a6;sA+P5%!UA@ebnbUr{AxClm zWe`S@$g8xzEn8h}B-MHd!;ihK))d+))ir(wc3p>`L3x1q8Bn|=OXDz;N$ob~XM}E8 zW$En)dYB3}i`3T#Sp-CILCT4!| zTS^^_uxA{j_X>c<(EL0hy%R@+S<|peb?>d72DpkMHQsz>W&v?N*CY(!sgy}H2e=3( ziPcn8WNFT=BOk=bY7GKmx_Oc1MiyY=o<6py$ifC7$c;E+Q^Q`D?l0~3V$pKs4Z9|J zJF?WzsQfB_8l+!CcB>FGwFK0(Z8eZq!*-=j~X4gn{ZnMxI2yMh8^zIfY8V;Lc zWEs1$07xSgSXg zX$P6rO}GR`p}hq1)os=Ze_`#;Mkus`y2W}hqhe8iz{7}jj&yG;VY;*RmVO_-QPHL5 zCxRaR=xX=&CUm#jk~ZDkC10U?zT+!zzB`W(s)**q@T3HQM3gPJ*q(fKwMPDfXeqY1 zS_!mUvTN)jm;)Vl5#4OWF7kZ9B~bJf0kDbKpVp*ccF~53UfZ^aFN-Ze7EuW>ZWbZH zP(crWd5B5fP&12spXB2JGSbngrPdxg{3<%$lsHltgt|vkySgjj+%7%odX~G32mIHV zCjhHh<#QrEOrNoxE)|~Y4WRO14Hb$HsDXA%hiz4@sRLUWor2K4Pv&YkI8Lp9Nta*j zFz#)C1+6?}hO*7&fBR5c8AtI)hzfTuK60>sq3@$rVII-t=<;^DIw99*tCcecbUN{G zcJcYYOEMycva8{s6cvgJ6)|&R`RaEYVT@~F`2G|gjHK+ zCuA#`-s+7B`>Zdvyvhn7k_9v^o!-V;Y!|-M3Lap*O9TZ|)D5Bl<`Ip+D;L@sfJ&Wz zQrfXtC3mkHWL-;?mUw|1x_}a*9|_Sz?PRqQiUXI52B5W?f@+`9i9uksA6>14+T?Y) zfyyHV?XRnqW)vImuWuRML;O~`MtRcV}bdfGCs#gR|C+?|#_q5XNVRr6%akgW+l|0j85ivs@HY(la#76Z| zCnMu6(!$_|idqtGqn4E)0a^}fS%<~$SZ2=aQ;4*=kt$N_RcM);Na`gX*+^xf!J=VU zn;b)XW*oGJs2fa7Y;I=9x9>2mu0Y<}tu`6jLK9J}W}=jzfPJa#1B%eNux+P*OBtzD z7d*qHcSTCNTP1q*>Vkm6?QW0PVnqoxKvw(PYPAKhb);B=BhDJLjKlNt3=eWGD4wA! z(oR;dE$CK-pHGKslBM-hDC(dWx6{?C3&8G+f>@D8;r!X4Th-GE+qGxCmsVRKk6+Z7 zLDHa$IemjBSyA5E2LVE*wpLkxY(f@cl)Umr7S427K9s6H8cEQoNJDhKEGeM`RMP6H z8PUhISsVbVPjVQj@a>vpK$%p61Tf3K?i6&2hOVdbyb?v;Eg-jZ;`OKl?7%1#821Q( zRm){_S7$2QqGn-V3q&7^v@AdN08=h3Wp7QM0WEz6&lkYAzJMk@?0}Vj&LFqNL{R;m zQEf$b9lNw$YUsm}*c|Y{RpwO>{VsI^b8>py^57c{Z&4&FA}5_|Yw$)b& zYU{ULbt?cI76=M`(NMXWdIuk*ttnJ1%Ud%aT=t^Z1mzb-nZ;1yNK`XYn!1R8$0_U>lH;9<8r7qD zYk?w+*L$~V?ID_IhrP`xcf5pFV)&vwx+NCmNl;6LL3>m3hMt}59y4!ixS|NphO4cg>wC;U(nj#}zy3i-C z^L=-kBLlopRokI@uaoXhb7UltiH;|oba$B}dywtBUZ!o7i(D@@Dxs#$kzu=Zq17LzU$>^r2juB14lW1<66ZxISvc?Nl0~>%?T0CI*Y@wS+xu88R6l zEgce^szXwLNv#S)_D3SKzADfhnvkL)Rk(h4F)SjVq9(pbZ}1KTj4lkuq^a$mq;9W*N;LRHs^`S=(osy{%S4g(W%;%z_%CZnCUn z1bamGwtR85GK!mrR;TS;b#xV(N3Ntg=xW6jYxIS7XPxhxXJQLOBVZe@gRWLop)QBC zJMH$#5NA<654~CqPCHqB8jJ<`krC^BU8iV&PbnXjH}_<8DOc%}U>lL$LL0CY*x!nV zh}%ebR!pk~Dsp$F)xl=1eI|6a4$rczS%59+YQ@PWD^MY`^X|F*4HmVq22ciW4*+>`it%gIz04Saa<)IoIvTYK6%rWLaVR|ZKtafKpW9@3cD?D{=kc{+R5tV5Belh z)2LIuqunTNKhC!iBg^?pCw~CYCA~j?xk1*LW)%8YOYHJ=R0mz10IFJ#0|t+%Amz{| zUDmjT#|=B^>Ld^ni6r;V(F0AoeV3QdvrYu@jv3vKEwD!f_=}n+Iyvlp=`QkgIr@#r z;sA^M1Pi(8dIm|*$GfT3Hi^u@hTev(URJG-zHMN$G~AaUYNKJ=gDSj=RxmKD~1@#`M$(Zth8sqHv#U9iq zlt)KkoJwQDhn%mp@_69Fv)^8S?2)kez=h&O;}&TMi>-qTsct4*xT!Sc*VhDz+Mk0s zS zYS%W=ZVe@J0wXL7y2%NKm0-l_YUFcj57N)6-B+Mr16&}^L$tFv7$h(ew!>N|47c$tE9T6)1XvJ;&mzx zG?q89Lrov97kzU84xsw?V*cAI`&k#n2#;KC?SWGvaA2kUgrQb5m@~ytm0p)N@ z3-P-HHg`=M?YhWvmwX<7)xW8D8_7X(M<3qy!Omhj2j&*$E}6X7>BVd`uXa|odH!=X z8Gks=MmN=$kICFvV*{tk9>2=H=hJ<;bpLX*{5R`B{`0^-ekIQ!SC9O%cu;a1-#xiq z)a7cSg>dO=?SQ!*Q#89KvrU+rOZS1dNzCaFFSx%HZ^t_n+`id=!rCqlC8qWX+W-}x z5BA9)p3T3Aed5Y2M(!T&K!p1yI)7B1;X|!7w>=Y$8rvlLm*#Y)?+4pkSqYUjNZ0hM zw!OjI2;=UIw_P}r=yNO(a`_LPh|*NCT@&Yy*9@7jM~)BN{YUXEagfk1jc*tzIF%ax zQ48h{^xW;$ZS;YEwTGa|uKh}|Hj*c=M|TNa+Lx>8G+7$c$zo|%U+6y91i4@AiPjdx zS%RF-V`;XD-Z?&wM9zO4ExTJL>bh~fAC3w`2>`m8F@vUJecQw#1F`xMJsF4>O9L(@ z`e&iH#P6o)D5WAtfnFIndIDB|<8B z3uC2!61O_jJFoE#eA90VdqsF)R@M>1k@I*lY)&)INUn+s<&mX9z1 zj@p)Tj>l0Ie^kjHCK>Vk!b+K~B>wxtU$b&G?tANc^^mUMY?DpS&E6Kip*LYIY^1 z-;<{Y&upJdVlnW`59P3lBYx|{Ui@@;e6mk}p5frtyYu6-)6@NekoZcGsDI=k|=4JBG6*B(F_AK)mi=KXI*OGvU@gRwb(RnvZwFFM7Inqv}$Vk16A zmTb*2-EwjYmZdYP^U=lkt+J?zCu{DvDm%n<^TxEAvUWpS%`Gk-t=NIN;zS;%%rw$} z3_X>(D#2R47hB%^z3xFv19{$Vy(%+6E3&;EifjiWI~R&L^*2J#DauuCA{(u|h>Wd7 zwpWN^GzUf(D$$&iT-G77nP}%CTiM+5>55}tHWt~%*%x1n$VO|;(N$iZ-H>y!b>OTK z&8XrGuN%hpw;-Aa>6_-pZBzO-w@xL0rP!X_f%M&wR$U_INd3o=z8lbbBZ@qD&8S}m68U2!2|c;a91se0WZoI#G}BStyC5=K^G zhKma;qdeX-&PNNFL$KY&!3P=>JuuN>%|i2bI}rUjQRzrTG?n*g8tHf;3brGE90%1R z?;T`<%1AkUy;gjciNi2GbZkI)B}M@^uOU)q7Zv=7+=TKm;h>10+!E~}_rmt%i;MYcjcixh=v7CaSUt%LvY7CcFr>Rg<;kGJ9>)?9O$&gm7Vg%bqX4+%x6abKoOY}Ji#J5H`gtLgG`^!{R*7I2{g z06_HIx*%E^wYo@d(!_XoMkkj{EXpGBTTN_hgw3t-pA;05li4Pw(Hh@>!NDcv4}8fo zTBD}uD7~9clix4K*<`-dK5{))L8jo{q6{IvezAAA_;`7n+~rKOAR_9Q(R7u^{BX*- ze9?CoC;R_pyC?2(WSu;-te405k7YfJPCN_$Lc4>bQ}nrc>HIh2*f$xTHs@A3%Zm~U-(`m zNkS(;d`vPh@;3c_$fVF4H+A>uy`_7WJG;3pLLaugfYTIzd1dM{X=LIz;;#u|e)d|- z3GrEW<+j!5Gk4o6Km=b$0(w~QlX1|)VKx~}>B8R2Wm^Y1sNn~ghmAip%&;j=K#6l9 zeBPuB30EK(glCpng4i|!8QjkqwGMIW;87_2(8JTO(ix2LX zBb~Z_pbn>h^9O=@=zunO=vLJlMco+M;G21t4B0ZY*$&Z&l~{+Rf(y+64P`?Bh|!Y} z2e;9SsD8`GLJ=r1@(730%ZRSCO;EylWR8uXvWKH(=ylxR%X4@*bQY%?`vu~xN3=A? z!QbW6hD9UNBC=molaG&Vs4KuqcG7?=lb~xauGQxHQU@zV`yHKnU~w1T#L zwpQAIG>+O6R8p7Zy=l?VV=r2H_N6(8yU?gbB2$DvG?`4aDlRVQ`ko=Uh48FWnL>P5 ze-XbkW^N~)66$v5#x_m^1@?sJB1;7wbr$Z#W)YBe9M`we;+^RDd_twbf@VZ87Wo(? zM$w5%C~%F@R8!FT$ha@`Bi5N;35fi9Woq?*qOh4CI^;2jJf_B!c%VEcfW#taOm@%~ znpW+NDlE&a2ojZL1{40!ylA&aTs?1xdcU9d_=u^@&1@*5?J6xnY^bJHQ?$Jh;`_1{ z)6@{BL`t^mR-In2No6vOVvs&!vy~)O=lut&W=bfkR$Ts@ESZn8q$?AO^g9&XHhPhN zPFAT2(Lbg&0vqDH7%lxRw5GLfw7sVrwDM3r)2|nAGyNAtI1N36f`-N*;#KM?Io!+OBAtTmE2+G}3O{IJEchOxO96T4an8QAGW@*W$OnHgu(nayh3J z%+s2ll(~+^M0M*v?r7Bu<{t5_n07xJE%E>X`xL?8VlxucLOkLHGH4{Apr)OF*a-Tm z!4`ifvT;*v-{#0ae{B2aVwp`oB+J`u)x7ICUA>>eu_>-dS2wrKi(Vz7a%C|ejWu*7 zw_IkUndWVIuST<*vt#+>$?Vy?izc5?AoIW{S`I3?;GdCC zDkF)Qlbac*lD|7_@}_aBSp1)VGvuahH(`9_DFC*o3j>!~R(xNtt(5IY0Y&XKBT+oj z!^GD_1^u?fXf)|D0&I?H9NnhrA~D9msg9NtXbNLK9WAc`QeDu>-S5>O0$ONHX5;DV zN`OUvoy>sUUKqA@Q2zTO$)KqYjJwhJ=ZoJCjM41MIGkN&>Ey~ZPG*aLRhAgb+tCvL zNj@8JNR0RC^43_a=JPaLCRfJ$&us`5F_gUZbGph57{y68&nAoH|NXE3y)dql`854} zhfgKRyU}cP19UI`T&C%CVT?yJW1eK<-HbE`!-!W9V`jMSYJv$!XU1~0_^>dIE-%S- zQBU?*UJ{BP;Mt&r4X&qu=$=Jvjs9K|!jL}79y~Yl0te??(oyc?C5bv@QJjH#SQk~# zh;>vO>#?(TgO^kX^)$Po#lEuQ1*5qV%ouOhiTaA~nPymNOc)yjsE9U2WV(`wA<)<|JV9c}h_s=k!(MkSh zl}XESae(V!k>V2Z#Vi>wCm$!v&jN7`ko7#px434FnVQ?nx9MUjjMHTHagwDoVZ|=Y zPLtI0{1S|<&xorF+A`wefBS7B|A>ZGrM_+TNh)uWXT({oAK8N36AX~dmR)-y)CJof z4n))1y7gQRt9D|!fnJ&Gbc_d3`>7~{DstnZz_~1+Q#Qkp9B(ww*%bBNS$&Jh)sP(5 zBp8O|xGYK@lH;Mwp7+6rz=WZe+GE=0MAxUW!GhI)}_=*)_j0xf5&pYg)Hvx%W9R7y!~PFL_%0r zf=-i#YRXI^;CAdJ--Fg;`^a5IO#yUVSI-PjUC`!mitiuT;lzRQ4%$NT_J5_O^-Rxo zEf;l4s6L9|a#Dp#HLdE^iev|J9rP-qcDKS}7b8dLq=!a@f09SF1;l-<9c5zG+l{iV z+Ektc7<=$H2Y<7zqtxJUK7hYjlcz$}Zr-Fy6u+{}vC;6$0}$Im*;M4f@odqAMM}f68~_RI2<|X(V3{fe9vi+FVBM${4qd0U zURc4hEgKL5e=Ej?m6=xaE2%$f;RFl;J@5gx3FAogdnEQ+?ZyXpNC)J>fIJX8fdC8F zIg@Krz2$Kx13sG-Hndb<4fyOoCO&%ytwx#iGw{jR&nMJ&c|<8W@QJdSzw&yIDw{*p z?SSLYOWKM=4mHbn5Swk9{gsiWjAI6Hf5 zVvilUbxq^#O0++|N|pkNB#`aNVhQBCk&MQ-#u7bmM3ZC%_ve5o^_Rfbh&yi+<60c- zhS5Gw#>qkf=##4hBh!(Qm?sAHFK!jxnNe+Ux0>O|KZ$YrGy(cwP-tmOiT=%krm??B z5@RyUe<50Up9TKV-2<_($^`D}NEQe@RqrD5s9o;1BU)*-y4%~NcV!n4+X8eS1;i{1 zTZW)*v{Y_An_5LUs+Ki+ciV+G%#y*iB(Ds&Y}k>@mPzC<=~Xu))!%5Ece5jQ8pX#$ z6Rz$2e+{2Db^C_2aU_iTA54SyY9a~k zv?V^5t^@Q=Ze}^A<%%M7qEITGWSeLhDbYS2+E4KYlT}(2G2_|@BmxY;kS&k63~iiN z*%1K7@j9|aNX2!v=q(TX)(%KU8QxHEM$R^-c&D}J|2#%pj-m6$8Qo(9L$rNttLn|% zf5$XfUtv^9@NN5TZ2vChq1(JZZs&ozJ~K76-!jUBMf!-nk!u8|#A^aq07 zryNn>(uJ_0wn^V$?+&2j^dZoUu9GnMjzJIi zphXStJngV0N~PlS?h0;{dJ0egzy~dOf*LkJHvbd752pZ0$a^NU$r8uc;m~LlgBzbF z|G<%%fBw^-|MX+J(ZI4Hp#mO=1u5YEqNj`cSYRubqxb4h0Z%Bu6Zm^$B~RwWf0GE9 z1Uknok|~fJ@-atqG@wE2!x0`kMN`8ZNwN66SSELQ2N|?woK4fw6%ZiEpolk;Cwhu^ zIZEefN&~<}{*jt41?@mL9OKhSwoOzpkGx4Da2}Ioem>~*vl!?yHPGpCaxF&7`#FlH zkGJUHv5o`s~IgOSS^4^hE>a?J{7Qyr|1Tm|Ef<#YZ_ol#&a3P5@is7{!@98{6~A` zq!U@#25n^>8{?VHwh(*Ik8MDv>f_Oj!e`Q@HF1JfG7BHql=o&5a-O{z&TWR ze8~)7y^@k)c<|gG4i|H5Nf{(%dO$Sb=T(JHEtbrt4p)=RkcBxIH(J!^Cw1DkbAU>j zrwkR}Z1+#srFN*Brqr*|e@zjCio2$P~X~n1?vz4 zkh5%2XdBWqaCdqTA3>zWB@!P{cvJ zWZ`N6t8G^5Fc(@4!%^4($FB%2CUIXDcWE|DbzdP?Y7co-f8AQQE2~>enNJz zyOL*B(!LU}6)$vpoOUOm9Q)>r82ac13LDzSu~lepLg!+z`SY&JZ<7T;ROjiHMk^0C zf9X69Hvd$*Wlx?Sv=_J&Yk08vMN9L+=9it_2b&*9Ef62*OM6Cx&ENDE2b;gL^N1WD zY<_WI@^>{8e|)g{Ur34Otg-pG>}p8&BBJ)WBj=kQj-YjH&x_ER3H^YnM5VF)IJB(D z_Tm7+Di)=#Ony;)h5UdM#X*3+!U4N1_kapl$+hCh#ee}ycaW@L0Ua9VNB>|PPDP)t zN{iN*hX?s>-;2>cN}OjE-~?cl-40beLlw{YD7%>yf8kI>+-m2jYeLs+QU^c3|9feK z$v6ZN@w+nBH_b-S*!=oKh3^%c|2nnUdHS(Dr(F}QCZQu{J*uEO6%wd=dRyGl};g_85qcA_reV2>|D4 zX$`Sje+WPYav;?yJUEL+ocov=X=ePGr2uifNpWoYX9LmzsoF)i@^*Kryt^7Mx@L$I zZUSV{?I;jRlq&X0XP2EnmD7OaQhyG+thgN%O^XKlFYi_dAa|!z1$FMgHLd>2MrU^14m{OOX_*a2gE#^^_f)qh_86Y(52SMw ze@>HCj_Z6fP0LP+3L`G2=KB)gFWfzX(4P{7K7j0tN(eSNpyiQZwIvq)LeB4oirMPu(ofCZchx(&OGDVcg!6|R9bYfe*#|5u|jYWHQ;Cn8}6`hm-{-wZeYdewdese zYPsTQKEnL9i1%>nfX`9tH6Zr&W3-0Ep++=Ir^&PTqlKso9iywb=nOtv z;!|V)?aRZXrw7K>XgM-66z9%l2lKf|Qz+G`63}Nvv{Xv+`J6`Mw%NaF808`$MMCs7^2$j7VY-oYTsPuVhMmuJl z|3oMTg>}kM-=#rq2WU2K`H|yWeu&C2R>{Il>%3eF&0l>Suf=jx#LBi!e-DG8>J+6P zuH#tw-q#*qnftXcwsC|segthFI20)?v^V6QZ9fX5&q;Qk+`Uh-X0TQmfT*2HZe~~V z%fHm?>Gq$9OA44T^%CmlYOVP=xzBmRW9GM4pBPDB%(w82UhEYxVyr5>KMm1l-DrMa zeU9n{qheAi0Wl64{yxBmf9e24ruy}>nO9SGp1j?XQXm#$4fp{k3ndZKdA^-mNZ*RA4x8dYlT$agrB0#aC@PJnm6TYS8{P44pj zwjk2^m(g?u+5O9lJqH3=Z2xx`C;R_pyC?2(WSu;-te405k7YfJe@;9L|3ZD?(J2J< zOXt6tMCnrxs(sLPVcLuN;WhM1E;dc8#!3*+B`f6{NlT=OGwKD$fw?H&9S6NAEhA=V z^J73e$5C6khdQZ5123ilK0A3%wfCW z^plh0w@-~lI$cTIe?=aeQpN(Q#nx@T_>iW|vJh`t2Iy$;PF%Pqc;^>O=y-_X#nAsG z=};OS2#dKQ#OI)P7)sye?IkL!Lmbgg?k9EzM#wouoe|2c8yd|6AeA~GwTK+YpcbZx z<)f_E3%oDdXQFAP?DkOZFA-{Ep_0-b$<2oFTKrZ9OKvute-k{7b%5We2foE)h+-Uy zYT-m`oi2J|NE^K`dfnBijO&3`ZFa-xMd}_P*LC85$kIs`%tg(2l9yVwKr>4x1eQ=) zQiOdcLknEpXk90IdaBpG{7U>|_x2|qWIHkJFVYh=A zKGr47Rb|Bq!Q#^7D_D(*Pf}*O0O0P-d5cjhhc6nBXoLD>$;r&iM+iU#IT=?B8N9|}AKOG*Q>=V6w@ao<9@!9F= ze!UX7vp84@1Od3*Bqs2$lFHkY|IgmpHn)u=dH(fnf5d(VPEW*I-f*)4K6Cbb8?q&L z`_4~msi(X5%>*scGOs04M^f%_TwKI`ii^0H_to~3+%Kz8Ko(E{L5lJt+!NDn2|%F= zRhj?H{AcFL>C4y02a#tD$ky^}OL?*^Ynu6?pF?z)27N8aI-4t&cHQ! zP1(u)e+k?YQk4DNpTKQL)3=kG%k}Bx&B=Oko!B%se0&@KhdwyQrD7q>9=Z^C;6?dA z;&IRW6PRnY|3h9mQ)Ih_%l19Py?Z`#>x4u~%~iKUzah_uzfZqipU3X*2w`>@LAjF? zB7e8rg4SgawX5`Cc33z19_l=(!ufExq&}xKe}oOifeue!QA~5$f*vIKGg*X%c+33F zf>NkyQjQI#;IEhxaiIt)g+Yx=!rYq1lU~}=q|&R^He+oaoV$?zl_vHf+nbusWFkx7x_!FavixZfLqEr-4%MI*WH(6n;3p`M=S ze+KdVB^@+K`ZOxG>0Rwc*M5^u8@5#TXtI$q!=@74)f%V)ci(vdpGwsAMT5I2htfhS z`CCDEe&sCb%h~+*ENIIy_?vF*bTqZa z@F5Br`(B^P!}D`!K`Zm~ckA`_Uw-&u^82KHwff=ga&dD$0aEMBPj24mJM^!P|Gr*M zp3dJc3S&H3!Vj`P73k$x{B@A+#q^I~W^B+ifGFP_fd&sMWHm-gY_e?2Eu z;s0;b59zyDDl-FcuqbiSBWpcZiR~653tK$rjR+YI#@;}IZZ{gh-vi7jw z$293vr6(SG#Rs(Ug6Ft18jPq6e@!ui5>goj1cnp~j(A1bVuPsbxvPEaW!R&U!GO#A z4DS!CtrlLdJD~nBkLwJihId`7g&Odk5gi7wwMN6Cxc{@jNzUB4^DK@}Q*Lz9mw(K> zjaRrBfb~0xcXPQM&+f)K9C^r?z(fEW7ww0@MTRyhPWO{{iL^8%MkUc6f4`e7Cuc%_ zu|yuhM3t!$&}Xk^Zx)y5TA(Y3@NJhgMRL2PNO-STA;~wzgg-|0PXE~UZOF-nQ8|98 zw}k)jA{&{2AH?H`?jjKfdE}QO`6>$b-)eoNEIaW$IKX|VWP?tZB5PW}eJ%C+JL4e@ zYmoed2w_gao6KcZqh9|Oe=6WhD%amZf}%EQ)i8|VdFw@~SFZodS(glZDXCt>sSX{! zSV%Cph>u?^Bpw?2d8#@*(EMU?GM^;TMXd>5EdK3gcJ})bIS1Lp5+dZrYW@C!ufQ=* z1a9$}4(;pY;FslgZZ6ed90+Gsa+_ne_{@XH$#{i1WjCgxUN4}lf79Rb&>s~q#XaVa zsK_nZE+`;yot-_{0Gk;li89DzTCb-UG+S9dXg&GiSsPTH{QBX&^Vb2p*{;%G9Z2MouXIh?R{5>`Qv-sdutm%2x9?@H&YL94N=cCQV8f~DD&e@bE2>P&=09GgA}l9LqUP97o+1-bmgELhkr*|3HPvce zqty_P-A*43*71VXnS$%Iha<{KcIdbTlBfBaN&(0e9Pw$IbMdE33D*I+1o|>h*@1h7 zD+!2*scwmDe@8t}`;IUX7?dYUM>C3D+YosWnD}V}UCLh)(gzns7$8XsV;BkDx$o%s zJ$bQ&z#fwo`+I^qWhcLUb^PM=_}9~4p1wHn1g3mYpFS^_D-V#*G*t9Q^YlNzc`N^9 z+HRBEsFQOW&_ew`c05jH&1BZHdpU5at~yf7IPewUJVtLV41Pvp-msK!9x$ zGUXKJ#gv-sCZE*P`MJQSaenr8myeL|BCK|2&SXwFAjD~H; zY8Pa=yjwC+Wda5!x_{BNkq^VC2)W9bbn^G#`;sH`kk*SW@{b&ZgjWRv(hO$Z7-JT_gMI6;`pT? zHl+ke##5Im{a$&UR`0lxE%7cvAN0hK%@eeG9ayV#M?oWQTmL_&0f7;B*Nxbr(W2H@ zt9y#M;JS^}TQz&fHmk-R`ddp&QMOJWhX$TXe;a+veHrdhpPd%x=8lL$>FlF!l1*K_ zC$|NFfL+1_qh62OBI^Y&yUEQ*dM8q%s?(#{$}kp4ob4N>vbMH&Ly74rvF2?s2gT(> zCV3l=C@=v6sm^`924)3|2Q<(l70yEl8=*v!(XVUcEwxt473Ib#Jb7>g=~E ze;$7IX*_F6y-R6>)cWIApNh(XHOa~e|W)Ylp2}SPVxz+YF2kNBSPy!VV=L zbmwu0s*J?e<5s?6<#b1dVTA%xcb#jDf1A1Ml`Jjw+|=n6Q?l~4kCKVatfgWUsS&QH zO7Yz8ZJ)cX>B2I_7tO*Qxw$>EqP>8XM4l%BlH?BWBL`;~kQiDDxVNlxa^1B%&j^`V zGJ|Zp6r5VW{PgtkPp!k(kAHf4di?nG=hw&ox&i)<_vqakwUe}t1Yde&Cf~bdf6%Y> zTX_Vk3=tI#BZbdA7*sG))P)-RG~O+#x>N8hHQp`Jk)`gwe25BqUFP)Rzc@ez#v-s9;1~Kr;qW3c)CqY+j6B{ z6s)rU?O2{0c>T}z%8t>M%f3eL%-Yry_6!0`Yu4<(&wKfythV^2#iO*o+mX-4; zy{MQ3y2$}H#1JqZu#EvOsbVjkStZa^?f|piw9O8%^6NALz-S!`jl+fCYB|7a-0{^r zz-p{P&H+~MjtuUJnG_SI97WqWz%2CJ(g8-T*S;~1w{d{k2q$i~ug3xAf2GW&6cESl z$osb>ps=xMMs}0au?m*lu|IGBnU&7CFZd7L<5Qn${?rxj@V;_zh5@NjwU_U7MmzdU4^LZ1$FH8ffBfw^46)YpKnowOWLUQpj%+Os6T z9<8>?CG{SnjiqgyfSFf=i5Lw@LK@i+v2#)Q$q-*31+W_0<}3dfLex3_L(>FInjHlE zs<){6`{{kF>kmn}e}TQy5JUuILVBZtrX_|l&35+~r?c`+3EJ0KVxk@p27d8}hRly= z%Ur zRP_F-qdN~4u+z-qZygTFc6uRDuG1j9?bhLHC5^Tw*ViNse^}b+86Cd(uQ#*H+4_S9 zgMVq+R$a6CMQe3)eNDX>T6MiyF8-ha3WZC~XOoNhVg-A`HtJeU*K4ljH)&^z7KLeO zZ82T8q_`ygxaRAXsWCZU%)htAY*wxKRKhujTCX*c-JS2L&2HEDwmkqL|@I;L^7!9&5 z1R&&GHOMwthT-LVQ@Jewu}{`ZN@%U$EpLiQ`)F}Pf5o%(ip9;vyW&O9&{n9iFR~t= z3sGsOTX0)BKUiY{ebf6yyDsbQlRZ@XY%FE({C&RdvYkB90js+Er17Yv8Es#^-pTAt z6^m*-DmF^Jwbh=4?5atOMf32koh#066jQW%taia7RR-hU{Vcl=_ObmeG+TfCZn2f(vV#4QCYpx2K3S}B9kT@ctYGQ;w$i;+*&WBiTe2s z9X=+ltJ!>ZHMzX}fFtMqWHo#5Js8hQiJykrwLItCHYer3R`L)E)m~4}s8>#5fOA|i z?`O-!{K`0Vr1i(*Mn+sN-q84*HX(C-J@U(}e`V>xw0+UW$J07`{_j}}5DCg{2s-xn z=(*`yQjAz!PBo|gnjXzM@TmZ89_5QD}TKLD1XyW*Xnj!+TBCk!JT*Wlrl* zf6wj=BO8@mjaEI4De5~r*SWT9+FfD^uukb$k3h{cU-v5=y>~dg^H?7n4R_kDSIfnj z^gj?RJ6Ww}7xR`M86+4vov#$KmF4;iD03yZt=~=71{M>xTrRF@nnTOE66~5jsr7EM zYQ33G=PmA$(a&24(rV!v-!Ku&i<{Z`f5ZeBmx7qr6oUtwW_LTVyISAh6k6PG-8>V5 z)95k-t(TWA)ND$1f7-1X zgsq3m zI;(u^u}a}McfGiE16Nyce@oxw)*lnxrFdJfCrc=GGdOwlRh}E%YsWI9ET{b5 zIEiOV$DC`u`Cy^4kmMNW1K1Z|ue4`g&Zld^w{v3a~}0pmSUG!#XiH%N7CF#n=@KbP^Y`!8^NqsCo+e@@0^?W zX_}Tnw2aPds7=+d5gZ*oe~9DGgLvGzzoFc<{w|++3$qQr*e|LOg9;Y!D?26M?IUXx zp(6p_cF>?Y_WuM-5ij+i!Y#ZLa{3ru)_hSjq{R3^d!K>t&Dbf0y18eJy>~Vrt=z zA@+_2ahK?$E!S%m7P|m~dpsWS>xfdhO1dVPRo1w++WI_qP7zF-FE2%mM^QYYs|uuf zeYVVpr`2gcminOZ{=IG$U*N(7CESnG#np7Z{6MXxT<6SBS!>MXZA(I4-sj;^p)V8% z-iOPfs9nC4%TUh)e@9i|GC4Z>uspKl4U__*{yk8ncW(Mm(~qnFs_eX z)w?ER8uegR2wUs z9awL_GcDDOw#pScNMZlLwp5o4izdm?<{N%t#(L8L+JM!j%2QR)<;ChJtyqK@pZsOg+N6WwdreVeN z>HNm5>C5Zse?LvGuK#7;I-Sfe_4df0A%%5o~~#TC;x6eJz}qoMjRH;#J5HE%q0)+X=hG)loJPd zah7{JskWG#Ti=r7>@_f;lX>vWb5SkXz;&5;fREOTfBWOkpx^C}#v{F1oNV|iPt)GF zyY&lrMVT^PrOw%1?RIgmE#@K@ipVH&2iM_8coV4QM&^JNs<&mQ#h%K*gNm?r#|P<@ z0e6i215)}9`oOzecbZJ7?9@&V3Y3x3M=~$telU_NC*$y~m&-W)rr)fL6J&b)qh8pr zPu8U~e=4-xLmMl3w0}WJuSE0{YfO_?geeVX14N*Y5Sk_^)HBugAK1j)lfc@YC`0 zf8&Gi#93jEGu_sbHf-sSXe!SiF|O5_{ye+{ed>M3V}dtSUL6o_4(--jUV@Mf&)zS` zw;Iwbd|T)ElpoN9Z<>fIcigr=puVkN=bdtfzb`k!uT^jZ)Ep<19*s{x?A3f&;n&0~ z8`a<3b$tRwb$QnoJ5`uFT^a!NyZlE@e``62YIk{1$YQVB+1uIgyS$OMirsgPcX`kr z?DsLdrd+=1H*Mq_0R$=fv>6&z`#c+eK;}KH=?~aK2yX8WD3ymBt@T~bY$MmwC}gRm z)kbq7AVZk$_O|;NtFT=9>DTzSZTI34aj68C^o>y-j!^$?nvU>rL@;=>#GxHjQfz(2gJ+cfelfI=?@ub z_DW4Xxtv|QW1T1@|!uPC5@ z{Ojp2PhT8(Bt!X3uO?DiZmup@e|*&qO(>iC>g(r|C2WXfj}<&$;@N(6s=rZ_G}a`I zN#IpTx+hJ2^@sO1QRsi!G1`9Klv9`@DNAu> z5ql>pU!G7t0AA>v=2s&swqSsF5O6-I*?3yqq1oLB)80sj2eO%k1~czce_XnZN>WLC zr0&=2n|VoPg8%s6|97S9daZBP3o030`sre(HiBe*ElM8KTDjWikAWr>R+p?RS2pbU z{p9k-R&|#jpUkdq$VwAp%6jrfo|)7Yvqi>8__Bq0+eXGxP5bEa#kw zQ9V|Bkhe7M)QH}Bu#as-Q!bF&2U1}rt9MOploc(=&d%sv_Vy-cGCKoW@@&P@rOwLR z*^(;M=hOF8BU!oUe@xFGw3e9X6MnHyBChKx*NI)6D>P_tZOvBHPPw|enVVi|)H0Du z*Jgy0>Vs5+kuhzNmDwEA`NrmrwXo>}_aF&wmQt0)8uRzvTqKsV!NSh7Z1)f#q7p!t zq~$(Y-U@G}Jj+gdOwRvsIEZ2?b`p8EaXxB9S%D6hNWByNe=y(H9#hPu--$Zo(YOP# zQD2y|wMX!g)$3(PE0?vKv$ZLhlD#hl4%HFM-PqXLjji3-+KsJk>Mu5-q+}y}EL*$5 z#-F18AfY6!rZc7LsqDmY?deX@)LTcD>W|fi`r#u3rMS(@l@7j3fNAH!J~lS)(^$rJ zcbNlPiT_Xyf192$%f;m-9atQElqLF$!@UNtE(Pe)@r6QzOLe0ON;#Z-BZWAC$18&9 zQsgh`0At#?Q0(R1f~tR)rW4KTY&pB8ldn`FlqWA|XVMxNARR|3?4C}}-rYChDJi?X zUR+akdmz`W)>JrbP0knB(k|En_8XkMtD6}m56j!qeMU6SV~c+ zBuKT9I@O13IReHGI>X_R@*N>$OdY{4?O6t$m}1%>S?Ow%IyN$7Og>{%Q837}%CiZ* z%qB4X?}t*4eQiiVo^TSY=a;E;SV{;(Q72cWLVpUm+Dp%CDhj6CRL;ed#d3NvKQ~MH zXO+CDfB0**-r_iV(21)Jh8WB1?OUTY)a@rf9UdJYsIeYA`}z6N(MZu!{X(|d9fupL@ z7vSkVa$u-fep8aIo_V&M&pEPr!NE$^*{ycSf1C&PC>gX+4O_iy!gEq4TxR)KQtRR> zZ#bBLv`5Tew|IEe7DkzH%IIy=_xtQLpx?4~s*)=j(4T_uLJor%o9YkSyO8(rXt7=| zu5`9U;G(9C_{Cz{`uVB00+j{Wfc^&bzgV=edxa@2o5XW0;%qaGGZv&H)hj97lo6Mr zf3lhL%h`@i8S(s@G-bqt#WEdtvjP1L=gn@JTiu^n2krxytE<%8CfAD*?l z>8~l(Y=2>#{rb0Flt4uSVrqccqID1Nk**Oe`az9x$;48A{*)&Z_r%p@>iW`*WPoj= zuF4F9aXa?_j~mk&Q=hBfBTWSRg6dqH` zBo({#y#>d=c;PbN^uc%O1^$@N?x;&pKldkq+>7wO9p&z_bw2%U=%eY|$<5{Ze{}NZ zgpgZelFP=xexM>KJ5jMu_vJg^o$gM)nR6TXEqVB^1&e1h8zDn)dAL?L3}D@}+1AJ! z3q=q3$FGfV3NqOD*SqcUM0!w2bsYWESBq8ghc%fdea{{YS%VZQ_<4RlU0xF6Dh~7c zx4k@+Tu8lKn?JUL3f`3;CyV*yfBNt(!FRjRwa(=uBHYup`P^#H7fN>*_PnSic8(d& zKEn(OdMsABPH(oyAakv$BmXl|^sI@&)$0A}yXln;imnuH|0{{4b{}>6J#!jvNfsni?%f7 zV*^}*{#pf>l3$m=r99nuuW-qv=9)fIB;IeO7$``HwaYJFRP-f2I=_^+)L+WSHADR1-jHK2T z)JAaj3hp8g6&57vJ*%t9<>iBx5Y>RPoZ54UmhWfF#atMaE0a3}e@By>=aUOC7u}v` z^S8^1O%l4{AqUg;Mf*YP==s0jZ?}#aBbh_%Y%*`XG3}#itSlK!m$NIllIN}YjhN@c znM_~l;O1IhHI6Lzk`$&TcN^a3rQ}o@zNMvnwyT+xfYTH)94?m><&9h4x848@>D7jY zeY$#lvmylLD#6=}e;?l4bggt+_Zga*vxPbunWGesiUnqaHr3!pQLhiDj0~lYMWi|P zp7~$mc08skDFx();DMfyK2td8AYBG5BFfo}DPK1v`H5=Tqww|Cf8yNPUD`Yk;!&Rp zz7fUbZH>Cz`{<0Kzza}gJ)2&yKcv3=U=+t=s)~3WBh7Ude>Xxi%}q=>meTs~Lx@@f zsp&rEiSnM>s!Hp>S3WBrne|>skYDD&@qQ&<6rYV*sNbgEIQ6+0i)L%S;p@fC{2T(Y zGs1G-G-hfxVrme2Z)#T6{NCK|Vb1J#{=LeIx|QQ3eJVCw?$0fp9+_-Z@42H9RedD# z5TV#1qC0>Me~}#Vq-Udi?6hP1mL%*^do+$aoo<($LOQDsJcnv_?E7s<+8p?Cr#B+4 zu!Mx&X-B=Gbbjdd`47n2`gr&**dfQVHyBc+n`8u^-=W0;tTlNpc^YNC2a)yF*6_kY zkwuVpyU3~0a5%!PgPckzGC6XM7AEQl?XS`$uG8zOf4ErF1|jCWm>+v>{P?zcTktmD zmNUTor5^gAgG43$)U3kEyXka|6Ms1PlUv9L6+nTf&agkC8L>y8O!t61O|9uD?&qJD zEw4r4_W!-7Y1Po->t|mU+f+VL;N{3(9f~^W$HO7&Kz*X>EtPv*@^;?q=&e>*E%QEZ zg*+){e{XXR2X9%1Qs(#5ZMD31@e~xVeK%zPNnidk^HzNH=O-^upT0Of5L&zL9RJ|^ zZjRo5SGKL^*+mKjR6sElpe|C!jD#XuG`dX zb>_48dU>s*=Dpc46$xeirsil>JWEkNQm>)r9@5GRML3862K}*;?lq|KTgdp&b4iLGdGp~TQNsN$NG$G;I(kve ze|JYg_hWEFuRo%nyZY|#Y<)TFQWL{F8}_s2$oL1|3ba%n-tsdYCN`gs&cNM7z!G-5 z9m)ezjul_r57}*rK*^!+$H{nwIb}Bnr*@RSr?wE2om<>qx_1l(4Oas#EaO* zd>BztWfYaAp|@m`dX-zl%v{~d?%8Nk#PXkSdm~G3w%_rmW5*J=wnwq9p{hA_#}x_` zV%f?e-7)Es9C*o=jK?;yH@Cgg!w_*oX;|DPIfZU+82I|gS#S9kzTO_Wd9*Ah$Ax-u zQIcXF9GY}(Q;0-*e?)NLx>6M(I|Y>khmczoNe(EMq7eh#xE~ZYY1-SaLl+Se;zSZu z5gL?27>+tUD^5!0+#}REq8(n`LwK-CwdbrgfXf^8#cRc9mUk2t5SFX?kVrx49iCs! z=9#h!)jg2Bt$^|}mp;4~tP;#ibxBzqnPM?gM8d3vi~Wu|e`#@pexF(eqj)r?U`v@_ zi3JrUNHan_Pzd(?vr@J+brRSld;*rArq@cxX&Eo=xko)@?Qp;wCbffepVX7+a(c*4 z?Zr%oEU)0V$cb}`^-zs()ESLv86F44xi8Bpo6H;W>S!`@o{;LoziS~+s@iAx!pjQlqpwTe?lZ@ zUU8^cdNFd9fQaXd_tVowMavLO3o6B+tKu;Y-+I_c87gp6&Z+UvU`Sb;z zv+k8+G;f6iy`S6Qo;&!k64`R!Rig|Ck@h@lmfz$I{A!CI98ivmMqyd+qq?xstYkf( zFz$8ve@q?fd+|xVL*RCi7WM@@KXAZ2Y!iH<2v&S~b2QOvI!#2V4l~@5aoJ3{&y=12}+r7aynQulF1aso*(_kCaE;grhDnU+< z2Oe;6Z>AJ4(v~_Q6j7ygVoh})f;Jt|;5bvqe>i`kXm~2TFlu*Zby8p#9792 z!jihqsb9^@o4)gktp6sZ$xX@JzfNe5f3v0xxd~2rHO^kX`S0>o%`c4KFzC1(r9rvl zzh6)0=aV;=)7IJL;^w@K9}f{&R?54^<*J%@A*MIfl>pfn?q~!*PwEvNW?oUf71Dhb zwS%8Y-5>s9Ra;KPka~dKD&B^z+KD;0?(k2^3wRHx+@TfDR3{E|lMYILy&b&4e*pth zao+5c{72Oq&?!ql{@CwGWo10d$pH-rZF_@zSFCsfG;vV-=R%FNtwYX_Bg6^bZ(kp) zxAB%=l3}RRj&EYrC!QNzJcjXCyeB=1s3DJQncC0PCJWEP7YNd12>?C>oe%+$s`o`t zjX83G(#f{9Zi_aT1i9AB#U-||e|U)a0ss1&J{#%52rRVOi-c_Z5i{+MMijVH0UX~$eXt^fn|*;8T(RG>%j@j5UzwHJPu^Fya3IrG%3t>Q-DEjAleSsmJeD-Y-n67T z4=uIIuiq}9x&Clzg=G1&HII;GR)4&JjNf6U{BdFUUA(?(!LkH`tzx5uf8L}DI*!93 zJt4^|3@xSGI8~q8!*(iCTbc$_Ynz!(0|lW!=yD(j(5{K}S2+9f1BVQN`U6W^G{xlM zdb2=;zi|0^r@C^^Av1vD?VWK%3&ar*Lr&hwVuwtD`g1O5Oiy{_cVHnl`h0e_T&xyv z*Z=qrw3nPpo52?SQ8q+Nf5#4R8u{ots+zx)Moa5VsT>D*vvRs)lh&__c;*0S@ErL{ zrp^R>4O4ag+#Kp^@4FJVMXBZ9EbD+-agAb=K+#fvd_e8Bt}1`r9t7*oksImOfXu>Y zLBj?JQu?fWfR8A)WLS!=mbXm|5v|83jHzqDqP6j=VLh`2sr?&`+-eH|L5}u@ zJr-lYWkdpLmoktJ+33rlt(XhOB@%uLhY<$OdsUkW*#zu zQLQowW);5mqC?Kz6UoR$xsz z-{2HZe^z%l9R(6A9&1s_s69BB;J!{2JgRPU1AD}t#6OGg92Bt~{E=D22od82=t`i= z&Q3%YtYskV2(dkslPt8m7>PF!x{vw#_iN~-SBuLJmx`GJ54t$tD!lA;)1d*UuU-#-7YzOU{{Ye0B zf9QQsF9=OOXkQpM`gy+f>=wwn->b99y}^^SkuHGu&UYTEd3ts6^6lHzbe(8#yYa3r zl4S_&V3%b`MV?|csD-2oLyhjLi5#R{mz`id#&S#_x}9i zheQ1yek`E!8+lOxGq=#hauI-J9|k7Ie}#HtRSyhrBsWq%>c`JLFN}F|I$GfBl0Ed- z>2f`z+3?||5fFcs!c3gDE&MRr>l|>7jw^dV*e`f2e z$@RUK_{Wyh)rxqr{l$NMb^N3E<7dH!32`o3B;@X3vxS@Sfx-D$tSYTIdO&td2P9 zP^yF&^wOsKblmQPuCOD4J|If6e^W~IBw+$!9gvwL)FQ9>td>sg9w}+!>A+aP9ENnD zp681vnuQvcK>%<-kG~JKi1B8X!2DhDhGb{sYr*Qo#fQTML$4c*G1Q9v=9W7&GGZ`Y zNkD?_u7+>LPCkIm?G5%-iLRg^00rT+I4;dpT1;2(5&k_0;sk#!7|D6#x!zwn0Dn35 z7?2&%j*T1);s!Xh!|03+ilecRF9QqdK|JpGbywsGS&M5rQ;*}fZ}RtV$o2f|;j@G9 zeFUuNrfi2!hV)-4OU<%WCWUcThHN_p0f$cOg7 z*~08}*@65CM&$KDP;x+p$7*WvlXfvEJdMVCLZbMC2lIYY$w+6My2`L&C;V z{tMS7gh%}_x6f`pW38^7tFQiyC3GF(43Iw4d>nj!c%k%rR<3pcxU{`JSn-h=nO#8g zDgI@AuY99X?QsK8#~(MW07Gk?SAA6*e*@X%E}0~oC?XZFT?F+tbIMSn6so`_2&-A> z)cW(}w=e1pbkxPKgnNkX?tfkE?IADf5VgyNu6C*{v<#pF? zGf}+UGE?JfNxie9@vuu4xD+TEm`KE!m>NQCC%0@!HbgjWMnnhjkAEW$q3DLbmpi2e z?7P*s9pQf@x12zV)Nhe*t0p6kJ`f*XZaR?S3B?;&+eztt)Q})z@d)TZCdN*Xe}Y)t zP4addSPDmip(TC9O9Du8JTZKn zpB+_=FPGRl1}H|0@C*W1Zav{p2w1ojoPFRDg(id^ADVCJ6a-Wh-jrG?Op5TB{7HlP z5DTExQw#*t84$u$_ZHiQ!-Dq0Fh+_I3fpc5+#uVE2&gbP?0;*S;9cP7Td#O9K$~|8 z1mv9)8@JnFZE~7$_e+!?KBvT}3`2))M&O2=)#MZLmFj*A?O9{DXTb`GNWl_BgN4i3 z>jSHUyD6PqZ7kspTY@F-df1R&zZ>M_%{HW7_dINnaqXi?`P4Phqy!9cV!;4Ipip-$ zbQ;qgKsg{t^?zeA3M6C8Q=!|TNu&$;KLR%-r@cCBpMlDU-K?ghxC}%d;`&H`3G3rp zW2?K6BDX}6`=c$TC9X_nYf_^avtsTn z4~|NxFyf(;>oCeut8S6%3LFoGh0X$%g&-m#Cq=(h1Aom3UK^z|s1PSU)DnJ3xvB%F z5{P7f5!)X~SQ$qH87O*2qBm+>w)IC3!B4Cq{GR}OVQ>*|t^DZdXo_%g)PRvtkj9~l zx0yM(48LnKb*ojxr-EtLfhIw<4&k&m ze83)rWr0Hp0+3mt{La{V<{^~I?&W+7R|~@(wn^p8fta_DaBx~tTZV>+BatZy?Eb}GN(QpM=T#Rb$sN zP=C&WI=jxBY6wPcHC3|C$HJ~f`U#6Nh`Gu&YGE$OHs^tplUDWnt>+qoO+=*0WCONR z3IbQ|2CnSblr1%Ny{MR~H&cy|n*VIxV_FMqA8 z$=S=3EHl;dd<}7+_4EkR5ZPFc*_+S__vBLjG z^jT=&SexySOQb!1FT9pFm+(^0et);}+=%*@uZ~~X>hmuSJi3g0ImoNf%#uO}=5j^y zffBCR7xHPhxLkNRTU;(L;}|HK;8I{7Jvn@Ka$I<^EpOE%j}5VI#W4i}`hR43ESSs= zoO-nHLDVq6A(>h>O^&Lng@pB|2dJu_J;}5na(|v*P3Dt}>G=lHicz1?Kz}JFGP#m2Fc*dhigYO}HB{&Naw@2#>8VIYDxUk4ndnKUbCb+W1V02FQ!yO_AH`aMKry5M zRL~ulNozB8bL#8zh@3VR0t)+wHB#^Yh=ne>A!&~dc>G#_H=|U4ee!&9?rklmQR@l3WyupXQJBq%pBOHl*?joZ!(Mz% z6(+@tSVwjq!d?lFF)V|O$pDlxk2E=e>=Zf<+@g*h_dpNq!=8Z*j$bV7cjO*@*5qX4 zLW7-5;6qB+*}a-01%ISBxub{goc7faHqY7CLC$mw!2Uu}4G0eq6oa4|nOS3>39a(@Bk37QJdp4htWk5Brp zPX#~!L%)0Zs^@WP)s-}B_&Vw3Rb=t<1*yp#cOEihFmi0x)?PGw%9G0|N!g(0lH7S76suuicP zs-Q@mO|rYyH%Pvd5#7$ZmfvsV$mb0pJxILs2M#9?0$QjzUruWm4D|^m#-%c--uVi#W1yrO#Pu2 zlck)A1TZPNK^(z)Ve>z2C*IlI&w~U}6FWGd+<-S?*Dx`2_uJ9(KTHP8{Wuvb|1Cuf zxULOY9Y>OJXYIa36a+diKA+5QCYP5V{_!8Cf4^QVska6wnOwG3XUo|&f7@VuF-(>5 zh3&AF@qd-OetY9<0FQ#$J&|R&EhLllLU`!o7+>Fq_x`@EFSf>(<`-*Z>IVWc0fO*A z%o=SnB6_L$l{X@C_|HJAN`szAQ|5|OaoR}pYQbS!Uh7!T5f05c>x%*4RbZUOpl+oXi{RPuS%EO6s z8+MKLuQ}@n(}=Qz6bPX95&0v^Qc3iKIXAbky`-arq+#Hq!@{z9%ngqBoMNKlXM{%S zIoXn35yqdDwig^w?PZ9O9-I&xD zWtZhLn^fQX>wD{VtDpeoT+%E! zz$59D;}w~AXw=OG;Q?uPD6DYmE%+roJr7Y9gk#tID*GVsFT_V=DpV69!3hM3+S*?^ zypRqI%O6(~(zJ{9={FRw95_TXg@4a3)b=j96?koi!I()pFdq-U4rBz$;^=#!lFEUL z0d~w1=^{WP`v{6234q?i3QLWe7{ZzyllDP2g^iqfKFh=#m|yDu&)eDbMiIkc_^E(*>|D zEup@EFe%PJ+s}{vB&QbOt;D0z7C!(txVlnU@jkS2u)SU`c)GV88^6PIZ&U7J18HBV^ zqP@HBxuM@9|Gw*jR?iky|B`sk4=0Frl}2bpq|O(KQHxzlfvFSopc5it#?UCZ-woVf zeB%K9URI(5;W#I0Dt=G+9)@JAg#xHhS~C(=jPsQrKgNCm`uR6a6n|3_!2M4P_(s|h zTB_Z!jkjH1BDv1K#cc_0mmobVj|6Zx5K!pIJwd@nF?o*oM6k5HjV?B7PWhBV_%CJ0 zXn3wm0d&OSKfMy{kRp-VM!2o~jJNL#H?73o!*S!^Oc3>REA+UUp$8GmGDE2;+ma(P zCUo4;1m zb-<2`{T>c+Fo493i;7Jupz21DWgoc-Vlrs9-gZ%#T=#po(asW*@C`Izr zm|7}IqA9|$IW;0@fLCzj7&u<+dh+WYdn+H?sBK@_(pa!2^fsHvLpkvAk!L)5agUCUmd786*eI-E) z&w>>dE|mpa(}38E!$++Mni!dupc)?sKM&BPlY)$(DdCcrJhQ4ROow};m)Jp7f3p0 z_XV^$aS}VYw4A-H<0^tstjSo9KP$7)$PO)fB~QpKQGXdXhX&E@In&$<*br_9Xf#sv z#z2YT9hPT_V4cQ>$o<|-hq7;S=Cr%j%Bq7-jt;-B`8kITq2I0Boic3)CRLY{eWIxw+dJ^fw$2cjlbKh0wtz5??6W4{6fP)4gZCj~;X3d0opx z2Sg*Pe1Fy<7dVk{*!5Wj2{Y0ZcNbC48Wvdt!0Y0aWbb8gKs2K${2rbwt z1lFA5m=F-5cuz-leqaBpmi8C9rtdG)AFYBqUw{9woQpg_t5n)|@nygJb0`NpR97pi z%74gp{O}@W1?u;^ANxnnt6o!5y(dW|$``t3-RXR@}13M%;eox@j zTxjH=iOM0gD-SK*z7#^^<)=|=0>fi0s2#5Oi0N1X8=TlQDElP)RRJKfPz4Z> zDPK$Ki%kM3piq^WU*?yYKmW@gi@EV3S?6iCe0*R{%mX7?PP19MyncMJDXt!d2gbkr z@{j-U^PBiOd73SYWLe|}PFm)V4{nNL^|wcl^65>oi1W!JovyPyyDBErZ1E_&x=Mei z$)gV`F8#qT7TlWcumUE(C0ZWb687cu=u>tr4m zxY_(BUFH00f6G_#Gy|c7+4^w+F_H zbeWtNw{v{r92n2i`MmktMe;|n{o8*pKR-?8bK}+HgE#5&?+3M=?9v|=l|7uQzdo53^Z`Z^{al3x#gbs${r*b6O^Oq}|{qkG7`1SPV>GOBT zZ%+fNBlW3-eJjI&?~-Wi(&Lx7ujm`IZv{p$QGkd`z=`)=`@}n&(mwgL%+WK zceV%l6I<-T&XXzI&3tpk>-c&duWqn`-)0|;v%j+$Yqr&|+4|4cWgmaxxLwHdE8XF3%k#&Fa9Dc%B-q^9qTan*avtF5+`Q_);s#>G$jg}uh;yS9Oz#y&! z1@$v@GB9>2%NtBPe0EXSh7)JM}LxF#PGXtreJVF^??MKC(@> zl<-7s!6;gmLJaSq+KS{eN&J*s9jbiy)6=b3J*Kb|+QY~aMSg3FDXWI*o!;JYWoa|w z@hoYRu+Fe<&JBuh);ezS;&ldy#7^NK3^jc$hwjh*a#h>o&vgGgqiJE9b*>J zpdsWJH)4q4>xDj*{0@88%H4+O(ho!5MY9SN(m!w@A4}=~e3LSRnLS+vQJ5fvNz?p| zz!&=9Tg?zmAbhBt-D(4GBEpJB0a${SKqS6s)e;y2{lkBk!%pBKDoPQcG(f|ec!3#2 zP*Q#nxdKS~blB0m@oLkESdPMEd=AU;Ysp&8_imbep;hj|BHEkTZFMbk+n?CBUgotYScZSTwJQ1Ujg&97%n?}G+cFxdt2DvM8uDcnPO@Atvx6#jQfS;x4X|}?l77G zMIzgE9=5+}gtm4M9(?!4$ro}Dy8E=j?MaI`Ll(Cv-Syhm-obl!eIt&sPy3`pZad~A zp!k1MknYVohw>scw$JY#)NYjT(~aUd_CB59-o)`7*A4B!3w_%Z2pwB#4x*14b;f(X z^hy^Xly-!F!;WyQ?R`4J9RNws_8ZC)mB`KFb|${d$h!2~uSbsS)&0FVP(VoDr|}JT zi66q#%~*W=hpyjdb-QgFT`%p5u>5_}PQHJL(}Z#DYukGd86lif#Zp4bA1DQ4N;gZ} z!_szHwuk9@b|j{HG^-r@gdbF;g?J9V7_rMiRO824rWe?5XbSp(l5H94C07iFM)koH zW2bqZ4NJ>Ky33ac^Vh*2l9#~^hQG{0_RDWckrGnnXFQ3g@2}U{W;v@9Hy&F3xgmdv z&3@aLy@%Wofq5L5)6&UK9;IR)TlSF^*<*4`;@f2XGFeLSlpKQigN(AhPXBxDp{mj=-aK+taM>d?m_y>+q8GAwnSu! z!ku0Fq+eH8M>k(_Tb79aL)g$Q6e%(9Oa8u+jL!?&mB7q8!*9-2aO z1Ix8&YzmQ~^q(Q{94kkLIwifWY@*-q$whH?`8-1Fo*ON@7CbaKhWdJ+3= zCRWb;H;?f9;K*s=I-U^4M-VpgIf@Qc_iTAcWo>?7V@c2YG+V6Z$sgy_e|5Sll(*bY zaUoOi4izb?r$_mSMgHLer83GzlauJ`Z}EIn-jeOHWUj{t@6JyT|EJ}gIwzrd`p`6= zoZvsE`7k_nP5j9>!>7+2(|cn7r?6t*tZ}#Hr1HzW$_#9V#bzF>ENpV4&!u$vL0RRp z6l6DF3AavQB7>sd>(s_%f2IC=1#0J*6buc&P=iLwyzFU{s(o>j<_1=OIyLYI-^i}; zpLA)&2Hts^CcGzcL{MyXQi3|W=#Qjm6CHzW*0+qJM1m4L{fxLA52 zN}9M%;6%dSYJ6D8RADO?HBxNHvjXuj0T8*CWnqUy)jGBf9~N0cfAy=U`Vsl+<&|+7 zB7i_zohOtp+L{a*VVq*TVn2M~N~tj2S*a8{YwTlMcBK0}ln&2uo61F%9H#hpWcgg zyi`2;ah}G@?JE*Y-F~gEdW*yg*v{KSVLD&L%j>ffev8TSf8o1xwlKd3+u+TP!aV1z z<11$6Rb`A?O9|q6yOernNmldh)`*v=-8Nfg>9R0pNl{f+ikCA3mC;rxnU)xbrzdY87nt`tjo6je_UBNY*Fv9ULYU(tQWZPMp`e@8M5`lUSL(?V4x$w2HYoBHXwfK21n{i z84L?Oa42l6GggQ4HMZybmdE^#RL?YK4syE6YXz(}o9lG>ea(pvd!_k-i-N4wdWBIt zrw$ZsZ?g0F+MXRW!Zy3R3W9o#RK+b>mC!aWE-f+MF#N5UHnEj9+>%V+FEM|L^O!-?sZ z)k`^u_XPFVILkYem&H;TA%EQuKW>0Ce9-l^F8t{SafaKiABFn-QGDTD+R#FrivB33 zs9zg4c$fK(ce+ZbJx!b>d+_!PPq=qiNo$@Uk+%4@7F<7&t3-T@KdzJH?*0p|CW-dz zG+$(ssaCS&?0N~-hEks%>>NpDDDA#bPq5^8J-tEkx@pmP8w>;y;eW13*2eM08{;Zl z8@JhJZJ_RZyiEV(HQtYmYzT2LasD#NkKp8(A<9xDs1#i!Mp_u$hrv&U&AnNt z#jWvrmEc=eB;I(6!tog5@ci}D2gYCrM`Qt=_ZV+ruvZ6k@EZ8{T|~8k-it2FESRtr z!>uwNUg`8+n2_dM;(r0BfYytnabLJ7>r05it`PDO47Ne+0#g0aW)*ImO9z_9uniCm zC>=jG{L{-Xz|PS$29=ur)@Tf3+9L5}?2*Utg>5(S5%+Jr?IwJD>&DyhI*sR@X4!yn z*mhkF4R6&;hEhAX>FM=u%H0OvD>MmrbQ=vC90i{GNN^nX{hF<}Ak_YJ)Z+u(or zB;ItA?U%(`l$6u*xri~P}ao^56^>}7iR`R0HrDflY+_YAk8X!s8L`j627d<|U9Li_l}yus7aKn6APUXM zMdUR=w-LJfMeq{1=ojLHt>y(t&k=&O)XR(pXt*;ZX9kE1JHClW$IcnxZbpC@{k_nb zD+)q*w##Il@)kaO>nyl*R|x|U+rCAdqQ^fLnxf&|!tdS%Q%ApBbArm$NET&HWPB?$ zS<3><-hcT`k`xoRj{ZwMk!Z6LMm8_t5h7?!U)wgcz^+E-G^`St$km$Z-GX8KLAYA8 zR!poY`eq&Y?bJ7CIZl9>y9d%D)*!vN{w3AATy=NC?a-wr&DPzP8jB*~IhwhkH+=8; zT`yV@l=jAYf1I!2_2KG3oCyh&mQ9En#vXkRCVz2=i#Yb!FMn>5MApqpX!FAFE8Z?} z$sq+4kW&sakb{UFG@f92o-ESKY(As&w#PZ!ns->YEDc=pdH2T#40?N|#%vTFdG6g@ zGqx7^dMeRL&$UQ`$d+xd<4uu0PZVAEhGYdW3+KxG%`%9!TU!!s4}|ni*o>(B?Hj+{_V|+Qo6~Irv@6NcBrubKS$k#(>c1fGCp}bWLvN0mRU#MS}ULY4zKCB zlw&RHtRxLreTb@EL)XKT>MVJmKrdCNsZFA%+cO1Il`Ax1yw;MT~ZTq|IfctKxtc`TqWmy~Poyn})NM}iEf7M31HqzN5&_=p8(uEF}JXjbkf4Vb* z-CKKPwC}u3Ag=fg3g0lztyQ~un~0+=ib1d&UHSsqy6k2t(NO-JUernmfDTUy$4uIVkP zt3^e+#2(isI?HDhYp`X@r8dz~e^yh|TYlNf()-{5X?lx9i_-L#inAw3Bu#HA+N=Og zZ-Fn;-C?4G!n{WlJ+jOw^iV+^EN&Ej?K06Lv^FyX3zgn2%MnP1+KsN==-Q2bpeg7j zYrGvkIA3WBI(jK+3ObFleQBP)w$ZhXe#b@+wHr>m(SKw&x+mM{kLrxkfASB2dMvTj zI6HZK;J6Oz`RvbVhc_H~xh5Jfg)Bux&1$ib73|ySL>i(QsTGR3!<-PK%q0-7)}O;k zIPN-Evla}@+!5;sjmXtRuNt3r%4m8!m`9drA0Z7+EZh6FCTG^O!8d^-ySjA68t_N% z-EbZ~hdNnvRzld$#PB*#e?t>awo{}DCpua4@qtd(HYI2OEHsL@dO0#>TEQd>g}@@h<2Y|4x< zO067r@o^fkyPc`n&Gd`4K_yu{CD7%DMb)!)n;IqF?0tEle+H-yxjfh>X&hFYy!@PyiUP1Yjm3M@&2nvmwm$O z{|b-%t(T1!XHMDlT=_yirR7Kc`f2o1qW-GiKia{upJqE#$1>{%|A3zN#TJNMC+}Nd zCj-litIK|Wf68J}R@B;EFHq=BD~Vtd@OiSC&y#{Jzdj+y%ROE6OR%%$>{+_b%d(fk zzQQ+5yOeP%x?uPax+?4DFu`&6)& z7Gnhejz_&Kok&6EI7{c&@1{f~y#{9IFft$+aGhpGBs@Z0buY8L5IPFw#!dVoF_J&h zyhxYVe@(ySyzU*eT4%G(w8+sxnKe~TShpe6)K1bh4*rm?v*iLUg^blYMKSIot2-32 zi_MY`DJ#Q`Pt~AkVw@F5nj6z>vB=m}JORc*;&FOU35|>ix#%XBFppig{gRv*f|VF#ho$P^!GxEYYHAetXn0 z8@!bh?oRO%@(u2k%@i)kkRU&FivHG@sC~|WW%*iSBfrgyWPx5!QzKsC)uBz)#JIpU zf2R=R>^)s3a}+kkHyd2=WK?|=R89F^1An_x|-X60p(VuRUXJ*ilmDgF*_lKD#R zOl4fhc&r;Th>O(x=Bom?HIv{V=Pn*l^%7M(F;|?&qPhy2vH@aq({E(AKh4j{$ z>ra@V!VikFMgd~`^e75kO9+f=fM(>Ff39#Capt0rYgJj_kKmm0gySfy!kv`;p~5IY zuTjq~3lZ+bv0mL+3S~k;7KuvVZ+Qa}{r&Z^x79?)WQZOAD+d*bL>;T8*753aE zdkcNJQiL%bn9~kp+Oq5;E3!p{x{Z-hEvqTrU6Q9|Ei5&$9(0z})_TB5DjYrFf3)9{ zHAG1~?=Xa3U;g`+_R4)g#BSJSh$`%>9xG%QMsIL1UY!@u${N+A82a1iPY%ta2%WL5 zieJ++nruqciv3G+0$)Ng)m}^LA1LjZaj`Zk=}w@kyNZ?Cwu817f@iv%^Aa0PJcMDd~Jf9qj6r_M=ep2E%Xgth-OhCu`>JFpe1>XTbUOu0Su61_1FYRs0rw z>6oE2bcU)wetgjWRLC%>!?d>TN9r(bfa*NJgqCZAb?yq`nXRgfeBqX-`lw2!;2Nl^h`V7|mbEs;OT$ zjn|?9fosB9SKcRXw8Y0P?J5D##Am;4b;$65?Ensx|B7I)r2>;F`)yxghYI}d_{HH* z>_S``{`8>iaV&mnfB*CVKXfA532)*8ExJpE0M`v%Dyo@jtIYl*hh3A*-Niay=3GZ~ zUwAuBLk=eQJM8ePXWJHFcHakQ8?x)azPiejqBIi+A6^QAA&0{Y_#d03=^-}YoO6KZ zS^i?Kd$$Kj&0r~93-;QPa7hs(hP3P&(dKNB zI;xBYDvt$Ye}fF&(L6|2qYACJwM}~TUGKQE3unaR$r_y8V(+lBNmsftS}OXJACKB` zrL-UMc>QKX`FxGZN7mIiQ=7|*o~w<bxU-_8~#A`x<7(5f5vYm*9crc=mxsc=6|(brK`!%|p_Q__hp_FW~bu zQUtqWe}vHsL{+aCtHmfjX6P?HMF_dLHC8Z>;&na&4y>+qvsv=k`Znkq8!#i+w+}Dl zd^^;``luqy=H;*;-{dUP%A&QfAQ4YStQtYFy%Uqrvqhms!H0;ecwi%xHj>A;m64GhI1(#x?g zZo-T}!>M}7wZsyES=@O13wNf+ox-M zf2#3mxAUOxh_3NzgJv~8?esQn5wpgp4R{VIdL}@DpulkeRH1TOs$(Ajw5=-%x~n}% zHA3stW~KF3#RteEbKomm(?Dp0A5T`(>hOJiXS6zeh~ZoK z&Tv&>&3B0jI>u+ht0zf5U8g(}xC4kGHl+Y!pqg~&c-Emp3*1!Uu<=05p4jNyVWQ-( zAKG5z3UR$Q5JN>W8#oK44k&PHfS5J$!Rt5KF#(7(p>VM~0WotDf?8`@z+%WEe?_2> zuU$T3o7*bJ3j0KCtp+p@yP@xqh0tiYquawrCT@s9sDYRUV!OhSY>m|6I}OA%5F_l8 zae+c&>k(8k0*I+q&fbBTtSgE2QfsJt0AgbvZ@3jlrkVr5F9*a%Jzt-d&;ueg5Su4| zoOAnj8xO1#oPTs6HfCSn5r~Z$e`5F+rXWf7Z}j?6q_7GRWrDwkj`5j*7-!2YL511@ z!{C}wz%aP@hQP4aVdG&~I03T~z{;~N)Q|(@p@w-IhV6=nA&~1@et2(hz$#KSN5(}s&W~JM!Aa_v4G!9#~aA_5-D*2tIP1Free>q{0(?K<1 zvtFV#veJZ2P1r;s1qiNtCv5HkhbeW=Jpi$`wj|cey#lcj&o|tR` zOstermH%T9PLgBJvK`#Lvj+_!do{)kF?f=_196lYDAvX+l4a|^he=h|g_nZX3aNMvAxi;uRF;>O;6~kUSMXsq=s}a|>4R(Wx zbc!6aewlzBj)~~eLt;}jmZcGwMqJ-2;!-P|T{c-8fXKCqWKF5iYt=BlN#BBRxjn9I z4-QkP<-oF*CimDou52Xs`p)|_cJDX}!?5M0?R|d(CU!q0MC!>Ve}y~-B%BRRB&*9N z)0HO0rRZ%a^XGW#1xwHuGV&X~qmcc3|E08LqU5(;DVexz)pNc3eb??7;mGZxdMFel zdl4_M&rZ0nJy||{cg_|-xuKNn`s<-`juDR(5eU+PLP%L6jTmCMAf!VogcH5h`aO=7 zwRDJkj2~KcsZzF}fBNHwZquuyNsvQz(duInpt4U#0n}ma%o?Cl5jUQcS-og_5tCU+SPA(U7e$hlZfNlt>za7wj}$rG?7#dk^~6di}nt zv(>Sq)ID%Em=AvOe-s&X7!0zj~o1`j4%e|`h7=-{g>j67w!hVoJB zIxO;NO7ncbd0V3ioOBl{(PQfw8`#(_)3>-~P|J?}gap}hd?O%e_!g9xkfLm*ycI^! zC~Mo8hyh`fQ(U6h74!y0@iFGY_Xv1slaOttm6L6ym4AvCtA9ot!m8HF;pxfS2RmR9 z2!e{Z9peqMe~(+R2%nCEMc!mcWy^4a8q8I-NHlZkN?MbP@Q^?}iQAczAQFCr-a`~B z4XQ>ZLZ!06NK1%llvKA2tv8LPMrvy0LAOTLC`qFvp-GyqW!YI;`O{I7tT>5zR7>m{ zB?$^nu$^`Tq(S<$9!OHsZjrJ%CeAQvUMsV-|O3$-yr$cU#)nBExxD^S&tF+LL(R`sn!HBa=t+~lkuV{BY* z(s}U^e}zV4e7=b1A6f0uJezNL4+vgAbX)jyiI%O#b+Sy>=+MZzNUpQGmMPlSqIPHg zzQ|Vjk+DLz$oO*3+BPmw$23{vGgj?1M~?~oWilc>iGnFA9A16g!r}OI6b>K8pB;$9 z;R+G57KM_acf#Rqz7ISAWNp<_OapO36PwBC8Rw0x%9P(>Y9K)+2ojSbN+PDdtWIwm&I= z_$|X@0pw{YTpN*G@@pt8P`Gx9J&GA+vi=y6N6q>XPr%Siv zMZ?Ux0YjvyCI4f_dk5*CUDjAT3`?VIWnZrmd^vNX08%4B=wL#uLP-;3EZBnW2b4o2 z_ZIIR^MX_}r-Y!I5&L8HBOJ5+?hJ^Af0J&1NI*n+vaeV)?|Bo=d(%Yo4qrWgvx^|B zYWo1ZRDImSOZapYUIIZj@SF&J9egW5V?3eJ-L{;lKZ$518e1qj+5jd*j01F#w<144 z3m>ni^}FK`!mT(c#Y>>SIDv(3@}YxH5%!SQ@4g>4m$n^2yVO1yO_!C?h3@D;e`7Q) zv{jl!-L`gfxUM9sD~UFwGo4gOH`TpI>1z3YUrB|7)X}HICs~aWq*6a)H4OSFb?duc zR3kgmM?9W2X=`wDi@n2+1XFi@JSCTQw=pq%TEBLv^)1H^iKgvffubWeFW4eP8Q)~N z{2?R$p0n)AkzEb@e;8U;?g zO4oT|%n>SJhs~0!WSJ)hIJoS~oLzKcJh?US>1LfSufd{SUZvNYigk;te;4=^Qpx!dPI~>yoAmj_%De{f`aqf}IktR`WEO9kJ0ctm4d(B9 zGmi`0;B=bgxlv>W_{ixrf6c&EK6_)tvl;FyPrxOfWs5jnR;1#0Z(odJ6ssDgz;RK1 z+;Uvt(@~BKFp7OIupGyBETk@lf?yx(xIld03(!`@u^cP3JR~2J04`w^%R7Y}M;#Z8 zOB4oS=%bf$WCj6izbVJ`#7J+SsZ(2h+H;{j7yV(s#udQ}_-fBZe^b9#SL78~SIl0} z{NnG3U%Xr4e7bK!)|3jpHXKBci1ZFosO7-2mL~W3l{zPe84SZGR_UF1dK0hXDYC?n z7t3az<;a>tb7Z$L4?E^tOVt&;1e%LnTa%iLEZgL}L?lJovI}*Lc%+CxkV+e|0;u?O6hH+N*$w=NeIgcNx; zk#(8UL4ao)pl+`gc|xFG1gHa;Q!+l?UOEWM#-1&fs>Y`ppK5%nJH}{YGH)J~Too_l z^>w-|!%{<1Sv4`)^MdH!vSUZk7MVY`OWz6hTAME{n}s82f4$sh+YZY#_&tKx?KmxU z-urk8`*2J#-`&%y#IBmetVzsLQq&l*rb1GKrNQuB`DsXMyCM5FJ{{sSMPZN22<&+k zfqlD;z#bl-@2c?YA@nR&7P3rqI62FoZt@~qRNpE(p-6|ZqHg1G7-KkxRutKe9omuG zfy2BBdWACLe{kpl82OP9PHb=(0`~xPQH02&7y3aD!?{!*p&cSN>01K$qd06(fj<$4 zg}70y6ALwvBF7Ars#4=Hjl;fo9LB_;Zq2DPKv|bo4YWQQDCpQmA~d*Dre+S(H@nQL z_Aqh=sH`UmimAg7)i9Gjh1QEiWS}+T@!(SB_^wgWf8-W>hm|eK9&#O^Uyr`-9Y+RQ zBOY(axIZG$+8w&=EJ)k(bqgd|WqIN9?J8$kSCVZTXr(k5zAGsTl6Okaj=b9tp9yGj zzUQ`7?3UPiYiz*BL>1X<^h9|$y+OxP##ddZ`TK{L;KI)s*>s)7V0VJe$=I#4G@oXu z0eg!gf3fQ{TZ5(gC+C!w1!C99BAKNnZ57nmWI0=9>9R0BZ04-$?3PW-SfmSfDMF0R z87+04#D!6|d-;u=b8Ebem+>{Oj*E#LRcH-Du05ZktK-BFKg2lT&0eP;@T|Al#`uut zDZiClPL0J~6zgnmu;(f%yvY>A-QpH?aPwk=e^c=&IB#ua>+5(~J+M(u5T^@QhhHWj z-L4oHA_W6>V*Hw3-?YiU{8ko8yyUmC-cC`;?Om`NW$axreDS1L>uh06Z!b}Ex4xyK zoT7@_JL&I&<5k%A9Su5K)-a6RK5RTjW@OsXvm9gshn@)nER8~LW0eCjG6K{>d0qkg ze+se6wgM(GO^T7*h56Losx?SvTbg={YdedT;MK)?=PV-AV#k&?@kM7Zl-A*;iW+kG zSCa;;K{5}$b-yzSzwylUSJO$3C4z+#bHdRQk!^=u(3EJD=LbXw{bwtW-%uk!ZNVcfQte^9rR z`QF;eXoRW}YBJ~E86Cz&Qr@62?g&Du5D6KLU)y?8p`=v!wXM*4$5r9i0qRr*Uzv&~ zx7a(ZY%B^>Rh#{v{CElraSUI!&rT?xPZ?m;d|Azx{gQlH8r$jHm3zWcLx=cmVca3{ z(Zh@1Uhb&=%SztL|7C#oa{h*{;LiwBqb;+b40?q`~ z6$rSE06q_vefZGk(jQPqif|H{Fu3jgH%j~3aDb~1sif~ zP}YVDCA9?~q7LgFN`_M-p2(Vv7-=km8gXeEG>v!&pkvigUpr3vmMiQKe}aXs*o%CG z0#%ms6{?k%ncq~+>Nuht=-4GrDN2;(+Za*WDY5AgvS1rAM6U>?qsTI@#{o6?s-Fqr zzD%d^ieDS8FDIaf;)QJMKGb3Gs%3IgR<&|dh^m>_IrPFv>pqMT% z<(qIW?}u!@S#Sm~YIUy*e;j-RhVe4NRX_lfKy1HhzGP*4>ud1~&(aU+Y!lDtw~UUQ z7#)KeS0E}gYVbS(YZ%Pr-1rcK5RFo|C~Uhb`7B^6Uo(pI&7vxG3obP)jf;c9yPg@B zjDH-@Z*$z%VZH&&I!2-4d3<}BW$*I`>;{uR;svWST-`k5O&9Td-1VX)T7NUPa6`Ff z%wrIeaUM9t+5AIdT*6^6MV;WfKx3%_L9Ar&d z76ahgY0=4EXH%mK{C-CTe$9~O=eWM@`jJ|R?6RZV6kgdaAuGIlb4v`AXG$z6$mvN zhEQ9FjYp`%xXc1VwIg33DK}B|;aujXnjy*!gK$jn77eiv;+D11YE!r@@*Ev+M|Sx2 z63Mu~^%X+ZTxJozpb=4iDZ%Sbxm~9P;P*A32lTX%@ zicM1u1DMvW(0a#}?ZOd{2cwM)%TzSE#ol3MTTz&*`W1fi%6Mq25BuweVJ@t_M- zW)$LeL(_4C$ba)X>Hym)US#^V$EnOH7c5jlYCsq00D)_pR^$i1=X#xWfXzwdSa!*d z20_~Oh5jxSb%EZryF0mvx?FS@-Co;vgi7)C`qC_C&2rv_LgQ7!py=ywwP7d|yEXne zN!J4)NPYAWTtsoy?yJ+Ihg@BwE)>|?@y1x8&1|!rv48ekI}X(uq(d`E2kDznM_sa_ zB#@?7QZ+2;Q)s>LM@C&^9#7WM!2*mdXUla0wy&$oNruN`)2YIK<)&*G!! zQ_ujp92Clt&?%yL()U$}^5k;jNfnvtH%`oTAwWl?f`*B?-<7*&fi@SZ_T=H;FlH`k~R zQ5SlSXETs^Gq9Igf#V|i0})ejlfiuk&$nh-Uw>`Zoco)=(E11tFbXV|b(Ob-Vq=Oj z$4F@~4$ogdEg8?a3*6dOS(+I%=2gZx&#d}1%YDv`|JbC{_uzQ5;o>PSi0}f)+9RU0 z5L^m}!LW)`cI&Y54gB~cySFy1di@2;Gqk@z`wO(cfNpiBB(%Rk zSy-G+jV2g>9Z}kS)I=VjQ9j)x01}(13W;@A>#YulfS|Di3$@JvmK_2h8xMcHmYE7Q zOm4DwVA(wGHC0>4eE0(@OyW@wxO-sj5`U;yqb4Oc$w(UhFCV@;XZArU29&$x>uK&Z zLfCeSIEs>G@ittFDQVpH!O1AI&3@; z23wIR(8ZT^@#Qa9e7TGw)w`v4TT&3D z*eWW!m;$ZQV|*r{)kIk@$|&k-ReufX@a4tnj*81Z2+53TRyB(}FxVV%NGwh zyFfg(`WuyK2oL_9Qy;vEZ6VnbLBGHWOfM4RdD|c&e3KyZQd6tJOTi?tP|XnBVKWLs zD-voe3wVjeA%%-jkmO84FT(exZMtD(MkVCo!~7M))3HUUWbxtoLMTUTAAjDk90dx= zvw6BI=Ro?n){O-Cy+tS8Ka-c)OhHCD{eU<#_$p74=KH=PlrS~(`pxO9i_^bf{C@W8 z@PY6EQdoi=&I<)Re|P-$8j6;U!0%v`=*}$o0v5*PJh-1zx>P!RxnzLi9c^KEF%7V#?F)LEHU1l(P?T@S^g4S zv0wg@$%DK+e|>TG>f-S2^CyS4=N(o5J~(>lnGb|1q}(HPEv7$;Y?e=IoIXyq^11Hu z)cuN$&X`W`s|iHIJIv$%aOh?}N%HABT`>{`pG!K2$Fmuj4<&(h5r3!iBKzBPo^59F zEL#=-ZBf_An@qC>J?(sRNzbHTo&Hg*p}PexgD&}wyI#pdA2V8HM!m1OV3owPS1K3zRK7t zmv87*#zd>?^Ya_k1An~A&X@5@b^O0Es>une`&D1c^HY^`d5PBHyZBd?P^7b3ODuNX zS_-o71=Ex2QrWDQb7M#7vJ<*T z5HwWtZW{BPsp?;9@)2MEt5qd1AN}%w|BqoqH5!fK@HAVmvVXFe;>0)x`*L0KrLf(T z^@n7JI*l0$FM`{2g%XvQ@$|hBUuK&E^rtj8W+=J1fZF247(vXMCvlz_A5mfw#V#`x zl{8S>@+p%P$Fii@(JS5uv#Ih1H@EvDyUvV<#`QYJW@X<#KIr(ev~76O_JQ#-&Y?XX zAK0Kd5xudsUw@)W7-Dh2WC$ZW3SEKTMD3TrJ2^c>5xOv?nJ3e5mjMrzB3!R6TEu9D1oUVHw_&;0+!*$Fz? zx;`$Wm>GV^;{#tcHzu-mVb__SWuZEU8Hj__!jDW64u7+J*i)G7z)>IF%oV&0t`{(m zyXA+Nc%iRReQ{yVEZ?zE9xT9%2pIdVdEokRaUNaUhE3>4X6U-MV+vCwo>7UUi5Xg6 z6xkv2&K#uDiJUX#tm2}AEnTj+YE}dFtYQ?)a~yP}#tk9`PxT~ZR?Q$l14r9L>k;4c zEOi^Xr-Eo~oJZo|&T~Cxn$Twsy~%nt$%D`d4*bi;k@-nzk;x(%zadVWa1VI1(XFaGBG9ON>sIs=J+AhnA61h~T6@8`t=#!Qk zk@ZE+*r>j5n}REL+sngJWYxLn@`5!lq2zL2voQO4ztuviV-J>y8#k7rM4% z=u+WY5W;*(enao%ZQT>W#SH)gMwcrMS$}3Z&DY8ER=bz1-eps)$-=JafmyXpmzQj! zT*C5r^QgmlOPHe?h=cvuXgp*&u5`VL?=du>ye6@Zw81#z^72q5<{iTeD%O;7`STK1{ z%}w8CoQ=Y4e<0HI=N>WuX`lBww^S1rr0JibCFNE4l6{L|7t|e3CyRzb^cKLx0~h)`SNTnhefPNpYO66dBLF$qkJ^O3HyZzK8-ISwdC` ze-kdGULIwfvZ*{$hZcX7Ww?UuxRLNc0F;=LUD9%8#b>R-GF{!JXH()n@YJMY3#WEy z!K3m!$afOL0@>7&t=T<+E$V!wuCedJ7pA)b?cin{+SLmRY%fsdb${L#6&DL87Ms^~ zf$iC0Ljykm++Af=(ZO`B$>R##aUu)fSEo?dAJ)RqpaGe1rl-CVm|Cqvn5TjJg?l{Kx?cu)%ZRuK38NVt_S%lX5W94 zp_Y@29pWOvSECp%PJhcj2qjMkc{^-zky+G!;K%B5t0pU?J z?8Mn#boemx7Bh9C2D=t-Q*ar4Jpnn#)Mf<{Wj7L|j2wQFm zn0Oma17W4*smGwB6I2VL==$rh2U;|b_{Mu-#FG(*-b z?!U0OXOzSv=v(AmlR2>_Wq#?e1Radqv+rw?irN~@uLIH-xoEg7qhL*Am0IieZ$n zcWP_Ya;1Ek;-$Rh#0^uMd>&bO&zSF3(n-HT_AD2(v;_RNo%JA7!=`pEy8ouiOg(AI zZ5eYR=|NdlQu(ue>h z35%>RLi{@AEwN%#Zz|Ic%t{juiBUZ{cb)ufg03mqxI*VtH`i`n*s`l5R@OP;Uio1~ zSW32S>F?1SUNp$z66PmPk9~Aa**-$|ERoEma0k9(WNJ}+pF=v14^_N5JvS+rKvL~J zU4PTa|0r5Y9j=K$mnECFi&`pG5_XXkHenYrGNG?29qmZi#P?^K6v{3-80gJ&d6z{5 z46)K?(Q)@{U5j`eNk$fpMQH6~yI<=TuZzzk#UQj^$xC(0;jF+!!L~flAYIzwzhRz` ztdfQIBs?tNF-}*4r(Xdo4{K;rd}Iy8Eq@)g1k=>P7H-JN?#AGhPL5mQu>NqNxHrB8 z6AzW4oNN4#Kgz^7nSX>=IC=QQVB5ORyi-zVm&fT^Ah$=<<`Yx*8y)(MlQluksa~!; zMFx_%Y+uPos}sYAH#?0MuDm#1(vFX(C1VQHO+UtE$OoR03_xKji4(R;tU{BC!n43RqE^2ifoycMb6ltvMos^ z)QyJXWKD$9iAz~}xoTr@tjYt4(=`$5$a1xTsyzj9vL>3z-1vIqBG9{>>z*Q>jIm8* z#O_bw)%|4FgZo}Dy>CSj&6kHsmC-9+0stc{pu4Qc^c^bd4k*ZvSxnf@bM!{ZaY7&G<-X9$jdw)Ycrmi4v z&Ez*PWMt+VyB+9~e&eGL6rpLbjZ2thq@XTzgvq{&1iI>`y*JQfs|%47o~LiTnJP+H zBxJ=`YibK}>qN1H&Ny40Za?oaRgubSh?BLog%nlp`N_i-X`1*`aTo|rh|@LI1!?!b z4wW#9=Fin~=XyG4yY8&_GJmxNar~*q45VRPpy%wwRSn7P z#CeA-@-#r6cZs*N4v@gEbvf=G8NgYY1m>Kn7jwjZuLWYeA~X8pRDYx?PnL4E5oc(b z$}v}w?@eg3(+*Sx3$ZN)K`TL0?5{o=M-AH@iEy~m^(pddr+x>WaGos>-xvuVG7}Zg zN%D-ds--Q_(L@k2BMbA{&uFn~Bo0j6a5yMa+u=AEk zT99$TGdnvQtLu{s#-J_MAFpsDyDZra*8{wma6QPY zn{Yk2D)SM~+JA~!j*6|k_Ry|}V|9?q8Om`=q4&@KP|w5vczBGoT7|NH*V^bvt-SA%wk6ld0B&ORw0vR6raI!O|UnV?uB&e|4 zLRCCq0?&~c%0&ZYA|Au-)zU5=W~s@%V1!ImE*IJuTYthk6@4Of_@NQ91M9tLh)i_p zqEB3MpD!9CBfZd9+flujq(a}@Uni1az*9IvS>Iy0u&QcdgsFEA$8%GjZP=<7r zrsciSj!^r&{7TQEDeqU_s60fIN>}o#{O0z%Hdo5ZOfN`FzDJ+VMUL*S z=?e<|B!^1Ev@=lm6Vo~0QL3gJNQp-}(0Ue8(|_JQLi7ygHC;v2)rRs=n!hOSSQ;GX zaIbCZ9-=B+osujPv6GR+-)r&_|S@m*G{H4&-}*>NxnHAHE$s$+zDMYUSZ zR3=7g^Ds-=&T~gs7kSi5DnZwTDb?tUc4x`;j*-~O&~Rhw0q;^=>nL|Sf+Mv z$!}+pHR0q4+4Br`6HQce?Twi0d1Os6IYO2;Um`hIrz$C4R-kQ0$Z*NKKKs5pD}T-= z`cW1_&>Gxz&7Jz|>-^|7pQs2k6^atY5^J!m8QH*(h6qW0H#SC^vp02H3`JN%q8aq! za_5@q_f1t6T*8$hxL$C{Resh1I+7cwYXQ(9y2WI-jm;kteSXw(E&O4drD>E@@3b40 z?Z>qksnu$}vhas0GST}}8)U0(rhm|XKH^e`qY`v20GeBmlLn7hP;%&+u4>$({e}s; z76K7S6tQ=mJ+P*`_jvU_TM(o>W~48+l+BC8UuvG@=BV{bwyLZc{UNdpuox#;3_`cl zNkSj*wN^XgnZbrWhpdfN+upYWHp|-oIQk)(#9}%m!S{qiQc9n2NG@-SrhkDgJd$)9 zmWA_5r+5Zd9!Z&O6e(QQ9!d2Dr8@lc7Y<344M`z^WLN!_u=(mMi>_vS9FmgpO-@jY z(B-;O39>HLT9fJr`L+2~>CdX2i_(-TX!mp0j5+kPo+bl1;~>F@5{(5PYQ8e@_?`>> zxWdUTe$Rz&#$W^uxymHCP=D%X!G%ZBP=9^_Bwjx6;ZP%!MzJU~{lCB=!JY&oN@Gnh z;xRb9XTzT#eD~?Ydpy*5m^K&DvC~w<&wqOP@^ts$<;}ahD;nf-*M0o%i=W=zy?Hf# zfa~BmA~F5RVcxUB>x@ez!(G_vfzjQ7Lpu6TK_Oh~a=@X`_so(bSNn=K|LDpmH&8GX8yXRx-zKel!h!;@|LQ)Giv= z?@za1pI-grbUV_KZ@iv_Jgi&Tr(bN0Gd?u2IQxWue)q|0RPo*WY0xdzK4L$QjWGU9 z&9@(>iO#_9%o=%(yMOF!tI@st-devJ^6=&9rF%s;!FJkyhPRyl>BQ{;BapXdEI)qz z?5msGcX#VE<~M&iJvV;w^zCQQ-JEJS)R?(tRQRYr#+2w$HrFJ^pMS+OBtR0oV5;QjYZv0Z=5A2m^sp4Rvj-|?Sp z>f|@R!19Zqy?$Yh?f&ZJ&D#m-B^meQiHQ91x2JbE|2}>F=Gkd2ZNp^k;ROD6eS0&E zGaf!P3|1em$!d@;dSq0Xj3z(bykKCuI9-58oGyP8r++KG4&ijmE1b|2Xw!`vUwu7! zt)KpQI-%J4&2Ri>vdOM5GVXjgKuWGH@PM1AE4OuuMT&>nJ3Oo7=4xOyQqp)1okYj; z6c6xk0}C-@m4Q@rk;8YskBi0}D)F@Gb<}DkciEfc-(fd4oT?0jzh)gXiorIq9dGoV$-ArRa#Je3}oL=CC4 z5oZOx@zDdnFNJu!V1&66Cz zCU?MEKA)PGZ?oB@SRqB&B4u;lP_vDQOE9>V^e|+<^`SaJ;Z>^sXsQKmX^^5tJlaK4$)60$dSdvTp zCOJcGFk|MYNYg@s=O{?(V0S*nFi_U-GCVl-F4E-iLM^0fe3#9q7%{!|y9l#;Hd!Xc z^MB>_-Sva%|3{7V`OV!cPKzYm)5{09f4F(}>BHN{&jwTAk@%A3esiko{afsli)gj> zisFARX|91a(+j7DxdQpUtAWLhT9w?r)hpQh^=^-m*A`Ey2tD_ z!uJa4W~|`;%9K-5UTKz!?Li)(0|D_g|9@(39xH?6sXFZF!YyA-K#0doH*wL;adY}# zJ#Bio+|3eof9UMMbLG<{&|ouBcR-R#!<1$E^-h62|4N%0kBKu>x}pNcRfUaFUyQ)b z>Mk-8#mRfgg~|>J%F$^9+RGd5{Z6uD?By8Zp6%NzOX8holS|8OVdy6dX4+VzU-5p59b2FedMs|UI@}17&0jCk4ew)6R@dpAGmq~6O5SK=;7#p`= ztr&3#3OEa9q;&xR02>RJQ9l73e=#n2ZEP-bWo&b_R?AMqFc7>W@eh&j#IHJOP}5!z zQm?3dfR#9@p|K;|RP^t$M3E?J_r#u}*vgD&cD(+t zUU$zAOH#z7U9S(`nUDSuU)NCcFK)13iBx_VY-gT)_c0llt|TjJryRL5 z;I9m1daJ+JRrxlX@mBu9c0nq51l{uC-{K#aKV_g7k#_wB00960m*$-b5DI&mF_~Qf z005l{mr*|f9G9xM7z}^QYQr!TME8aMgVDZv_?4u@$)*&tE$IgcS$34hl9ANV{Cx#Y zp)T=V<*tlnJV!HkjJ)1{4X5m^eK5{8L{LsLZIx?{?HlsGe|=h#EJSHrd2&`aD6skE3glz^7rch}==KF@e}SF8$RYP4pW)wVw(B~h^ovuUgSPQT!I>FS z^QTqRt&ull)gacS8(~#nT&h{g8UL2UzAY%D{OoXx)7$JXa2`?EbwCj9t+}M)$ z{p-_`6fr5+tAlsCB_|!pcJuhKe$xk)@=I|tb1broi!GT_nx83+-K4FGrJuFSPX-^X zO8GX7bXMJ`8a1sLYiPLCAe$@AV%N7M?E1{#pXN;dr)^CaeDp&qJ8$XHWCK~0vujbB zw~=(n8Y+xBwWNP6&r9)q6_S;CkA&XFbAit1ARpa7uOL3UeZGS56-SPrvj*ZXknuu- z>GKMkUxV>;Z2#2?GX^5zN~iX#&n~`=CPNL^I{I^-l*SoS$@oVyf=d+@>e7v8n_9e^W_pe2ka^kHOyb3 z=MQ#)8XGTaD1LPJ40O-Y?KAn8ueul<1WkFPT9?nd7(9PRZc^f8QwrIZ^Z>$^9kr2U zBsDa*ub?T^C7IoJESx{aUQ#awkno>(k|}|K3J9VYZ&>Yx(_vK zUJ23g@K=9>ZDyLqu5Ve`^_jmvPnrBr+nO%;=!aBx-tv>l2C^uKxhT(NBptGb3ZqUf zE6dALygX|m%UmPl*YQwO^Pxid)c&i-6~@11|4Oue7)+<1efMd#OIH%+#^&hfS?J!V zpLJQjPkOwS!y|PJvccK_6*V8w7=YS;wLES} zmURLZ1TpQPewS;!7(9QO{FF?xDTQoH`T*kGnV3c$)Q0Bmd!eBuC2>_(gNo<#95{ED z>o0q#ju4{pt|fwUQi0RHGj3?f`}Xx|PO6xc>(s$JXvqm8S+5=+mTz!S2`|N+8DoVi zF1BQs()i3+)H|>$Qa^&jlimlb5-!8QMx{U00IcSG%EF}vSzUi=R-3LRVbdXhdm54a zN81`5eDr;y+FN!sXaGe8zZPZqj06ESR2U$&gwpd?Jbxt@6yHeLZM=}B`6A0Nk6+~M z&q}**cn&Y>!hFG}Ieuxp6mQU?r5o*L#$xSJ@S=y% z8TGT@(ESL*-3~Gq&w)3&9GW{h{M!hc%yW2wGr8yptQXlCFe!|ea+0&ZD2;FO>6f-& z&wkTqS3lL&HQ|Q=a~=?v6=4|>heAOaheAObheAOc zw?aW2pZo>?PaO_wm*zbkB7d6?TvXSU$6vSE{dC*y>ZfZr`FxtTX+KHZty?#0rG}=R zY`cw3W71?b>JUmYGDQ=`j3C3Ps7M4+VlqVhvjSr`8k)!?fJPD#gEixy^&ch@{tW_? zfJlhJkf@1q%YM(h@OZodglxLI-OHOh=bn4+Ilpu6d2imm@9{ZJ(|?}e(_3s1alH+` zZ~VNb{q=T1%goHqYnO@jrcX`}ee=Og9R7c{LIxv$gls$v=SFYVW9x1RkA zZH9K2HjU4(>G>BeL33!y+9TQmZBCEmRKAbjV+_-*Sni-pWN*@r_X%mKBGyy-=M(gZN)TJPhj={C}IHG~2Xvo3-2tW9og= zb@o(9n=tOQO_eX3?O*x8wN0BQEuH7Q)8=%}vN;Q2IGwii^mJ!BYMpY>w%O7P3JP?N zlctkim}0k}K$^%bVU%;DGkt^bbxBo;J`thi?CuU&@Du;Kio%N(o9Zem>Z*mf@Y?o$ z6@@yTt9KP%tbeY!D4dFY-omuX}JuZ#I&?VKBHW4;)iGrA5=)EDb!Yqc?>>t=tEx;AQb-EY5KJNw3( zsL{1Lr*1X`qej=y9^H`mt%k(!ax^ZV+_>^5>Nw;1Cx6BK4D0q+x0>_6ZEJj$Z!rf` z^QjM%sIj3{cMu=WELDOFzS+LbrMd<)F&KY9FiO9|U*FZ08#Tsm_t+^O4+mv~r^LP> zO*r-(K3Q1_o{|y>k0&SRm=KU9&m)?BqIZobDJk@T1@5ocQ#!3mGf= z8JUnkoqtoJ+bYS)$w4Vrgg91GQsVI#dIlqu{{Hx7IJ$LBB{?P766AVYzWF3>%gV`0 z#2I_mN_?Pv9J_y~YlK3!6Y}pfO z+Lu0xYgvj@0t|Zs1A!r7^>}cah?(&-#p%Rf?|&tzq9!rXleH3#SjbtB6_fFZ}HU1SlR)to|Jv8y|0fBdSVyEitqc}ajgZ5%=tgqO!e?vdw>lncJ*RsS6#)2XAT>^ zW`F#|=kTN7zf!fE-eaxZ$4ZXzZAc2yD&^R*Fn&KF2~8{GTPqRn@GUl9f4F|el?J_W zkzTL&3IDT`md@iAb&@t#`{DS=$jH*T$nNeS%1XPt5sC9g#y+%l(o(sNRx%5Jb@Sml zqh4S1)y~QyWz&M6^Y_X-O{&XMV>d2R^M96>YR*`e0rtBlZcUq_eSgYR>tgTu@Y%1T1V0j2A|)OX2?|jVTY1w*l=&nnjin? zmCH1Tk6*?HgY`94H5IR2KHo&Eyu5t>%84f)x$X_mH%_?5T&VJiO#d<%ex$0-H-Bky zUSeCGw-k{5$Mv*M1}l_IN@U~%&#%$63CNHC!gZC8UU%v3*AW^SeqAdQoOOJ^rbVKv zur}k?U)*r(*R>7fv~%T4!!ZnjfA=SswegZa8RNB&yAFkqg|p{U=XV}U`l_aN29p+_ zKAHGnH1et6)lMah{`lP{1V)6P(|?B{mcl#+pZ;ZQaf*ennnU1M0=wsaO(C%iH*66u zl`07AdgJ8U33Dr#-E=%oJDqY1=W;mykI&XxR2fY}kHJwy%Zr}2mseYus(DTPrx)K8 zj{kha;g7oBK|?SI{C)+$7*f4zLZxfenT_{1ubAAJdV9;iFKl^cA$6T|RDX+idcOgt z#vk=l#>D6$TX(MD2KA-N5vm^S5;Pz}m~DHq&XqqkVDHfQRd~aL{7S-2Ek_G4zEz1%E^4^&HlPIX7DMk6eHLr7Q~)G<+|PIB1byCIU+> zy)@t1zv+KkC-yAdN=aZ2@XXZy z_T%HfLqO^0CkFhTO;v+k|5Xs!J26Zs<p49>(}4C`Wc4A#l`XSO`ZSvoXwjzj|e|u{O9Os?Y4E1ks3eu=qdHa ztOa54ftmK6KlKjr% zf}Wl|{S}Rkw?6Pd#g63oxP*1i+n9GcMv9-{+`W4B*s){ZKY#Sp&u+OT`GKFm^2#d~ z0Osb<_|1|AjR|$n5cG08*RQmW6u(l(Y%WYlU>(8?_A?OH2*+<( zDPO3r=y+{=TW)6a3TMbQwJl?8jcZ zy~Q`rSZf=^nWaB$T*=Y11|KQ$?wbJv|JlNomf^bc;c6aG82!feGn93YMgM=l*?yqF z!2kBe@Yg7(>{MCI^9Z@Yo0qDos?x5b-V0#*ON3B zdXwE4N?+!-+p`f6<~%SUQ0RK{Vzm!*%9c5QWPc!Pj4XdypXQXv5?GeYc2D9qwdSRk zH79+tV}BqEWPPnHt7FBHWx2j`hu?jS9SQ6CEBF()s)5w{TAcNGjy)kOAt52r<4Jv# zy$&`dL?;4>utgzO*rY%^Oxw!o5Ow!8xmsCy6UJPGxg|TNU%>0Bf#3Fk$&W>)x-ei_9xT(SHpLQJB!iwze=Us2- zJ~UYTxf^WQcpv`u9E&HHEuLKSYQ=?Gx$R+d;P+2P)vcRMZ?1D3MD5z!Pt5y5b;b`* zC5%x^1H>%(qvFrz2DeuoCw{Ly&Ck!T+<13a-FE$k7yLa1v8vp}M>_CUtmj;+{lYfk^u zOhLqWZRxj0zj|PScK2=Yt7d$8uz&c2Km6tm%>+p9k2P+7`eJ2RY}J z^>6dqyUEPA^BxUf|DIg%H%gdA7PpIr9teFpg53Gv<`EYhuDuDFmwrpa^ZpIJ3GhWk*?$X{|ar3Ffzi-TszHoXs znfiU%>yQ)A$lG_1Y-`<-6n~ySC}bN~*QU)f$s4E!Be0To_x;cQ>RvU!hz*9n$HaJ$ zN(q|wW{n7U)s!WArk6 z)F{K{!H~oM@WT&TZd7cH-=FJ-VCe^QK>V0s<47r2^}}PvT)DC?2~jVb4CupOHet+G%qH?*dF3bb)6DwI za+hphFgYAQY4Dr*^MAT2Vl)E&p z!>hPBaGWfDde)pd|B{>xKQc0|yEKjv4H5rEnVBs1pImnD{(ptny_P)c$Pxe3k0$~i zr;Jk%Rr!(EtJFRB<^fPmjEahw9YK(|j6S`7{o#zC4|xB;JhG2;aM|_yUD|7@w=i)` zpNdRA`*QlJZN3huE@YUv_DbKOic)3)8vbDULswm0-GS_TFmdqlTbK^=876uD(|nmn z3Slbs-lg-z0)MDpc;SUt3$rR-El0n~H>IDhe(yhscz5~E?f%UvM~)m}Ms$W$5+8P# zB*^TaSbu_%Wb=WO1#D`_5cm-|{rZWWzO_c#eN#a4xmhn0#a7swo^aL)5({LSZJ%&#!qt z$h$PyvK()1naefS!VGWfV%D*U0h?OkS8I98*kS5t)PN??Z^Zvh@;D6rc^&HgrSSY$ zS;sx?xqtk*!AEc4fC#_EH7Dmt=?j0@+Pr)+;UWz_IQ8;Kha*oCGA~B_QDs)b4cM7Q z-!o4~FyT9$9p|`!4_!X~_+zu40cqpz)X;zKpnqt!^j^N)b1$lN4vqhO=~ISsgDBs) za8p|0riwz_%(QsQ%=q}UG~3L0+e|21+RU_yihoVKjW!@=Gqc_~+R&+p%J`d==J@zc zC==q@7U(*s?Ri=fIj--0cB-P+NNobEsvi$(-SvM4||`L zYk%Uu%A>I*krvH$o6Aj+Da_5yH6vHy8WH|W!NWm!L}$rT!_fK0(5tWPQTQK=TjN=i zYO~GckYck{6p}nru8E%z1(~Gp^ zx1 z?22}Mc6ug4fZ`TK*)5P>4gkrF72vl%PIyX2A5LKC#StdA08t5*6j7x6YYPnn&vi)G-b7%EL;OP=R;f#AcR)s>ctDa%7#WX^7hWmFG;V+?%N#X!0cU?8+; zc*aGS;zPg@4Z2#oP)=9)VYz>9+np`1TZA1U?*rk?p*dy?^V8H#=k#G+gexWaQJ+_RGY(*${$oJw0yd{ z%FJWUbai!g7l&Si?qB{#@o%kjc)d1Tsw3K+>Py85-HX(+GCaT+2Y%x5HOvQ{JW`mReor!xiwKxpIZDz)N+zMWI7tqD#s^K4q!I$LhEd26KE2 zCWIyavZL)B0>xVNzXJmqP;j}1EAY&v(2#Ch_=iJZtA9OGB@I~O>DTM8QU-Zsb#2gyWQ|n zDzl_}7|lGoqs3I24;lfykm&&>5fc|gluG|`cRc5I8#5J-Uw@B3^5QQFWyYhUQx_6j zaLXJ-M<+|D^!US~hA(C{=VvJ8)`uU6L~VQ7m_}o)p^;8 zlA(ABM3+F-7tdx{l099UiXH7^+Nuf6` zWdaZ1<&m&Ln_fE6cM4v zD`Ao^ZGWW~`SC;#E0$PU@RM@tv8!^QC*bBdSOeQX6n&CIP=gJz@GZ^36D5~>{EU)b zHGrmYM1+@eHK}R%MHw|@CQN9Jff1ShY176bTq%aITFE1>apT5GgRz<><{9r0qm_O~ zrGKAD^ae-w$-pm={Q@`%B6BHC1+y}VnW@A)9HmMV^I#XX;+h7@C`ZoD6<84z0!HtO z5Eo&fn2Iihd!j-B#8W*I>({HuASvGJgQ?Y6rA~r^1LB~gtFmun)5w484E4IX6Nmk{ z+|O&Pu(_=U_73kd2(!%4v_8ZVXF)I!41aB%c|6qH`@m<$p6vTJ_9c}qd&v^A3#pW~ zsAN}UsfPB_B}-0{Ze%H?Xp`(&O0ty}DIpZ4P+da$J;(9=-tWDypMS>teV+52=X^eA zWXTD9D8BHx z&7k*d%3&Xc4D~9jp^>W7%OC3*SSu9B-)5Kc&5JT+VYOFkG}NgS$4L^OL>U34JxY zKh-?mH!6lPWJ%2c>{WBz9-}jk5V`bu(n90tn^ik`Opv0j4vRQ}13XeutP0M^Q+rN6} z)a=p1>wndJJ9V(Cy(j1BnmTg{wu$y#GCDS=ee{{d(;Nh!GV%gtpLBG^3{?*4oyiq< z_(Qi&<$)#j_nFDo3HhEh@hb-&XQn&q9(b0yVeZw%mdd_;G0~dk!NW--&Puk+>yr)! ze0i?N9a}im$ZDa(79cx)&VI+@lA)t9!;4<1iXBq7OFdiryY~>!tAU4ijGM+kzT6cM zz;x$MbVEZ!bc0w!14B$qEOMizWtgR>=LMrf;+97fQj$^M%^iYut#SE}m$rU;m7SN7 zT<}fnq}ahk6HQfvT=#pSeU5)fFAZEKAslgwX=7GZ*~YhCA^P`b@{s52I{_kJzm2ul zRqdads`ftcm`BQRPj3yC{oKst*ALZC-bKCtQ{8A=(bbq=NsOdFMh-*<|N5F< zaSa*8{v~M?BUp1%MOF1dmVmND`#k&eRE zil)PUUAd%QU9tD~T&1h4E2BKJa^KWg&!v!xl3P1JG^H|RCRQdyO7DOFvFB;!;9%@4 zajh{g0nr{0mqyk0glct$Lb8=I$NmzVZO?g+rsc1RySHi#d*an>cZt6llvSY4}%()Z~lEnSa0na$HyWM$;!FWK4|!{A+P9K+6J zY;E@Xv~ury|4Tb}O{pGvB%N~7?!C#W{C;^#k-|(_mjvUK+qKNh{kOK6?bzPGFD}8s z8(n#K(yL1+rCw&bufu~$m2KaeMww*~boP()@S2zD3yYMyN79z9U*7lp#@Qzc^kCYT zo8^~(xLB~7@XuC!4lHYZ9N}8{n$f?ij!%B>@OPWF?3BZNW)_?5Pi`&j%0^5zmQVZ( zdspbZaQoPxu1`BC?CYDz?KM(SL9q`%G{76D7SCqYBy(@y@Rj#+4HH_d6*P${S1VTv zTfz=~Ay?wEugwx=Y^nLN$wu)D7r_GKSL`@l+{E_xdJmUU& zqoxB7hfgLj`XAI~Rr_Tb98F5=*mrmi)mrihm!8-x#Y5u|&JoFYK%-E0p=@_46^1l( z%0&fN&Qq=dY;u8b6>^)nSg$EY`er80&3Gs)9J!M^T~qg%>9NtvNy86Q?#dN!K4g?A znmM=1`Iav8_%)H(5BZKL1poJW*n*TJv39c?N;BNx;<4b2jt4d*a@&uD+X z*_5Z8Q>Q(>iM{BIYE1r;XF5$KfrHvY4EKq=U3shYeui7SYzE0mR~V2 zE4Bo>r;mtGIEjE)K&3}xe<C4t$jdL z&oZZaE#-P&8q0DD&ufI~2e|oB}R=&>LtR?Kx*cwZl*XkGh78@&ASPDHd>N6>M z&e2j`+pcq{`d0n({pDt6ZU>E-!Bt)l41|zh3d(xBjWM{a@Y+rT!k>kG@^Z z)ny!>u4Mc)A3IZ1HhzNU^}ep>>w)v{p0C+)syRN>(O~1Zk*+VT&EqSa$K;{{xEll7 zZrn)8oVyWHRFoDwYUSimae-m9+&lkdr`4D}U-xUrhc(ul0}7JncE%s|Ol!R|czLML zZ#b~oU+J@P>gX;*sdvgBp0z~h1&6vydU=O9=oNPtbnA`(+!IjkTsox6xO8B~@Vw&Q zx^Khz>TNHd_^)7utS|l49rnBVr|%)2x@y0b`{aCQ+3?>@F;NhGm6$qJtJGnYSQ9f6 z_mo`3l9X@TnpxWXNlJyvc(1|R@OA09l-xU)4@q~|Z;;?F?~jXAR5)n@UzMDDwEphr z;iCs;vJ4e&^Ixrup1r`xh|c)&JocR*L&p65=c8v54*GeYdDeJWBC@)&b>p%Gm7?^l zTg5(X$3GXAP2Jt#sUp&=tItE_sy}6=yJ%1^@YqL|4^E>OQJ5*WZGQqMqtaY;O>^b? zkee)?LJcXCan81Bv+PfP+4)La6>ZObcTA0XyT9F(M_686MDh1`xx=du{FGUu+}hJy z`^-*y^uo-q zN?mGi;*}L|H2NyxCr^p$L{96~ty|PA?g&O$OF7hYwCB2}u@`Y3(-hR%C}^Y1A5>o8 z5l}NUxpztHPt}&#s>T+iX-pMH_ao@sr3GK4p7XHqSDTi(mB!EE)72f^tuMGwy`3SG zhL-cXb++7f?{?dAlk<}OIs3H8jvNiqv3%ibSUMxTPCV??qS~fMn+5!`PI*;{Ua)oI zzp})sCb0JTqs{&v+>&ek7)u|V9y$B+O-0iYU#rY36=CKVo}E&VyDHlEdR*qSp0k7`4xRTux%P#zwWzW+`WToFn?-@;YCMuaVP%e0zD$F7X@ixooifxNg8Uo|yKd zRim|?qudo=YPgJpPIP*$lE~3XWN1HQ$uSWoEfpL12;C)l^~|K;BO=?BwF z_P0+Gr&UTXwf`_Pqe;uZv57wSSFy`l_|xZ{9;@rJCl9^eVw%MLu^@ljV4AmvhhFLfoDhB9DlFARUZ8EFCXKb$86quR&#u|5$4jB@N#K< zbylk($Hpn$*JVYb((xtAORs+V)ox`Xwj|1BPu+*-PJgxfG zQMl=2lS)!;YV#4GSN}(9OPknYf8PyY#J^H{Roi-hGU-yYPzp06Hzp$Q)OGRU zlP!KeTs`60I#b)61^e$hdn3N$-ma^WW>>QMV>@ZaW1iB#=m+lC+fO^)7CRR`&{|OG<{f;i>MZ)rIENLr>ha85dsq4)kb1eP)$jhSu+H(|_l8>ZblRAhQpR04G| z)3vFq5jP9np2^LGio#5&;wXxRuF6zxMoraRErjl~(AAl8ED5w(QdtlyD_xb!jx<^6 zYnhB)s3=~ZE`m~6>1tFNREy<(UnCj8ABPCKiKQy)!&2@N z71ioMcQba7p(uCTK7-=qsqqYe7EC$)9yC8Y=Xe_94F_aLB#&OG_H4W7=3yL6TF39m6#dCpN9I+7I z#|1e?5Fa;4)7S+W5(_yZxgm!m%Em3r;-TdgO&C#mAp8^3)TWkDum$%AUK{CZ(Q z%JPDIikx^su6?i|OR$7jBv?kjnwJvDk`D%2fx`Ges(ql%pVD?dx&~DaQTf4%OcUqL z5AGUD#?DHFX+CZYyRAr80NnHv;^G9r*`gBcUZoMoD+ul`G8F`8bB?%+*zutb>^58? zPD2QsAo39cXIe;H4R)*0ICft;iCZTO?gok%2Dh(|xL)k05T6LRD{p$elg5t#9F z_!l1_S&SAWRTLI1&0>KxESOo4gD5QM+l~t=83L&Cs8$quJ>Ie)WyL_gLQY~JXLl~h z5-gQbAC{c^ndc9Ri8vI}kHW;kIh-S|9lP6zDgmzX1##XI;M`F%I9e?Q#mmx#(HM52 zNLCV@uqSbGlHjhP66_Mnh~t$4*Nsf2z>QQBcM-c*)PY@N192L3aEFl(9o%dSaq!iz zxbHZ20|!8)F(^Vpq*nUpehG&m7BnB41$IPDljm?V=nH) zA`ftHD**=#Z?+Ra7?=VG^a4=T5T61JryfpRxB>*|M-V8-pcF-bSrMS;1O`#$pa^Bd z){l8W7}jJE=mns-rJFe?-2!62(jV4W%(3tFZMC+wCQF`=rE`8~R*3Yl5;uoFSlrBKIjLjpD!*o_IK zVz_Qf;0=apa{`LX0P4>X2*$v9l|U(m4@L8kz8uarn& zprA(AV7g$)PM!^d)!^RR9I`;AnB;B{N>`shJR0hd_FX8_REOi20*+1mm0T|T25x9-vzpJogMmJaK?JQafO;}0sBaZK2qqZNHEGi<1UfOC<0K$u2r$D-U^|9D zAp$o5sD7x=5QZz1BF=Or1YDLSa1z63MFP(-h{7etDwryL6%^vFMj%OzlLZB?f^&UE zitgE%uI=yJWDKmvxwNdlc1VhrJRAk0c~HO$J@gn%Cg2}=UkF}%0M zAd03|L!Xa91Wb)#xa}y+7={}FK}qPsZcqcMcsTRLyiu{97PrAeS20Iry*=1_+C8sfH^LqNY3 z22pg)9EvWpCGZ2oPIm&UEdZjT2^_=VdV)YZ05vV$5^^e~5Vh43+OOphxQe0l8iDT^ zhH42Itp%uQ#vp>eG(-IfYvFJVb`jIM7AiC8ArRaH%~Dp-e6ybzZ!4J0pD5W12L9tC zaTDNZF`o#mv14-|u5;p;k zc0Pl^N?QOS7#2q##$cX9pasJbxIn`#!gc_hbp*UHtnMIi83SX4z&HRk1j*XNaBsAc ztRr+iWDfxpeFEzGJS@mn7S3v)J)G4OhC~ZFKuoU*0Up!;#JsfR;ayDm?@y~G2`IqP z6M+QAFi_$!tfkf5AoA-CNC6Lusx;d&VwxQx?0O{z5hSn<4pDv$0e1}N>ImdvNNgnV z1p}=A`98%>Jgmsb2~tKrAtufVPFM{pae~PXz95d@8MiZ zMkOwAV7@p*N$dCtF!*^{&?*;bW|bu-&IOJo8!C2z^g0g2@vnz2;d=;d!BBOcKrV)_ z4+xB6IMz-;*A;*|M?hl^h8Ys3^Py%zKA!(MwzY!DbQ2UcCdkKvT3n%yL^WdgHb5OW zk?97gL&k?VM<0l~yaA%z_Ym_LqG$no3FvGD7>Ffs0E6T)0uM24N+iI$2{K0@lTDEM za2j^P=;9`LBuzyGY7ieA8ruZJ#Agz7Jrj(986!e z65!$v(MeMT&SOxRB`}ELH8b+@fa9#;0drr8yggtbIZ@&sfTP`BO@PxAAkGwn2)b^{ z&x+hUVcO;Ei8=2HYb!X8z#xW%Lj=^k0OC>>I;KF!{a(<~Gn1GaXr>yVaW5EHyN)<# zZ|Gw6ia;iYGyMbxFkBxZu-pe=?*xHJ3{%qtssX6dXv_za8p@(^ADE%@R+vD?(s@W< zCcuI&ZiO-)8j{ul+`7Y(!18SXeH#eyZiLv_Z4m40K}!G;Sxm9 zyDkA%^kF*`6*NSQ>JFGcJaNr8@5Zorjz9&5E6j*50M;|}PB`gRoCNGKR0s9S2GCU`wG(ZOWD6*i*VD}Z3g|tH zG6U$!l7aO{%RAaA6hSA}e?@4UpdK8->PVm3TS%c~H~%|_J};6Dgoq!t<)4%HQ799; znf{fd|331C2r11IzIC7MDU|Va+P@<5^+Zvvg{Uy93WVv`A3?I=aE{=;A3;RtqA%tZ z`^U68;Icc2Zb5sOfNzCSVh~*N_a%zr_oI~1>kv9G*`j|jm@drJpEU0!@Lqi#ruU~8 z$g@b46P*f%7xe?l3(D&{sCQTmrYtD$8=!DPq*pA;%k_5^L#gu-k|;I=vJR&$#J7gf zb!nf^kg_C0=|WO}Z>OhFWd80CzcDgI5ibi&(=U`RF7@{g?|;W>WiG_Qrtd|lG8ATq zcPFEcP?%lI`GrPm7+sv~v6T)3AAMoLJA#+Odqmgb?c?y#$Uln^y0{RRh2!u}NO_1; zfUW2Mj60XT5cesJu1%ZC!6#@r-W(}Tiz-38!s+mB8sT&W;W8sJN~Hg8{}A;cKVN?z zb^jor9e&#AKsa4ZoM-+2)25@gE7T7y+D%`|Bymj)X_$(MAjjRX2!1!C*xht9T2K$F z#<%n)#Iy%)#q&}79#|J!_Q27d-&!e2p#(ZmD8m0Zy4{zh(3p{w2+G|9$)X!@Cl&So zezM6yq4519{`fP+SDOa~j-+Pz2qGX7Uuhh@i_!&VQD{M4`yTA` Date: Wed, 22 Apr 2020 15:10:57 -0700 Subject: [PATCH 152/249] changed smartscreen file folder --- .openpublishing.redirection.json | 2 +- .../Microsoft-Defender-Smartscreen-submission.png | Bin .../Windows-defender-smartscreen-control-2020.png | Bin .../images/windows-defender-security-center.png | Bin .../images/windows-defender-smartscreen-control.png | Bin ...osoft-defender-smartscreen-available-settings.md | 0 .../microsoft-defender-smartscreen-overview.md | 0 ...ft-defender-smartscreen-set-individual-device.md | 0 8 files changed, 1 insertion(+), 1 deletion(-) rename windows/security/threat-protection/{windows-defender-smartscreen => microsoft-defender-smartscreen}/images/Microsoft-Defender-Smartscreen-submission.png (100%) rename windows/security/threat-protection/{windows-defender-smartscreen => microsoft-defender-smartscreen}/images/Windows-defender-smartscreen-control-2020.png (100%) rename windows/security/threat-protection/{windows-defender-smartscreen => microsoft-defender-smartscreen}/images/windows-defender-security-center.png (100%) rename windows/security/threat-protection/{windows-defender-smartscreen => microsoft-defender-smartscreen}/images/windows-defender-smartscreen-control.png (100%) rename windows/security/threat-protection/{windows-defender-smartscreen => microsoft-defender-smartscreen}/microsoft-defender-smartscreen-available-settings.md (100%) rename windows/security/threat-protection/{windows-defender-smartscreen => microsoft-defender-smartscreen}/microsoft-defender-smartscreen-overview.md (100%) rename windows/security/threat-protection/{windows-defender-smartscreen => microsoft-defender-smartscreen}/microsoft-defender-smartscreen-set-individual-device.md (100%) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index fd80622eef..738f52aaf9 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -767,7 +767,7 @@ }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", "redirect_document_id": true }, { diff --git a/windows/security/threat-protection/windows-defender-smartscreen/images/Microsoft-Defender-Smartscreen-submission.png b/windows/security/threat-protection/microsoft-defender-smartscreen/images/Microsoft-Defender-Smartscreen-submission.png similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/images/Microsoft-Defender-Smartscreen-submission.png rename to windows/security/threat-protection/microsoft-defender-smartscreen/images/Microsoft-Defender-Smartscreen-submission.png diff --git a/windows/security/threat-protection/windows-defender-smartscreen/images/Windows-defender-smartscreen-control-2020.png b/windows/security/threat-protection/microsoft-defender-smartscreen/images/Windows-defender-smartscreen-control-2020.png similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/images/Windows-defender-smartscreen-control-2020.png rename to windows/security/threat-protection/microsoft-defender-smartscreen/images/Windows-defender-smartscreen-control-2020.png diff --git a/windows/security/threat-protection/windows-defender-smartscreen/images/windows-defender-security-center.png b/windows/security/threat-protection/microsoft-defender-smartscreen/images/windows-defender-security-center.png similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/images/windows-defender-security-center.png rename to windows/security/threat-protection/microsoft-defender-smartscreen/images/windows-defender-security-center.png diff --git a/windows/security/threat-protection/windows-defender-smartscreen/images/windows-defender-smartscreen-control.png b/windows/security/threat-protection/microsoft-defender-smartscreen/images/windows-defender-smartscreen-control.png similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/images/windows-defender-smartscreen-control.png rename to windows/security/threat-protection/microsoft-defender-smartscreen/images/windows-defender-smartscreen-control.png diff --git a/windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md rename to windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md diff --git a/windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-overview.md rename to windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md diff --git a/windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md similarity index 100% rename from windows/security/threat-protection/windows-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md rename to windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md From d3fa5b1eaf87ba080d7fb66bb577f78e81b9b7ac Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 22 Apr 2020 15:33:33 -0700 Subject: [PATCH 153/249] Added missing end punctuation --- .../windows-defender-antivirus/shadow-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md index fc2adf887c..e7573d32c1 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md @@ -67,7 +67,7 @@ The following images shows an instance of unwanted software that was detected an |Windows Defender Antivirus engine |To make sure your engine is up to date, using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) cmdlet as an administrator. In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | > [!IMPORTANT] -> To get the best protection value, make sure Windows Defender Antivirus is configured to receive regular updates and other essential features, such as behavioral monitoring, IOfficeAV, tamper protection, and more. See [Protect security settings with tamper protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection) +> To get the best protection value, make sure Windows Defender Antivirus is configured to receive regular updates and other essential features, such as behavioral monitoring, IOfficeAV, tamper protection, and more. See [Protect security settings with tamper protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection). ## Frequently asked questions From 30f2ee20f4a53b74d423d6732a34df88b1e6137d Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 22 Apr 2020 16:09:59 -0700 Subject: [PATCH 154/249] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 738f52aaf9..79e05879c5 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -762,7 +762,7 @@ }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", +"redirect_url": "hhttps://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": true }, { @@ -772,7 +772,7 @@ }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", "redirect_document_id": true }, { @@ -13108,7 +13108,7 @@ }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", +"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": true }, { @@ -13118,7 +13118,7 @@ }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", "redirect_document_id": true }, { From 39b63b9d3c2a29c0fab9cf54cdef7d05d7055490 Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Wed, 22 Apr 2020 16:12:01 -0700 Subject: [PATCH 155/249] remove integrate-configuration-manager-with-mdt.md This topic does not exist in master and generates an invalid link warning --- ...-a-custom-windows-pe-boot-image-with-configuration-manager.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md index 091ae48f32..487840d670 100644 --- a/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md @@ -90,7 +90,6 @@ Next, see [Add a Windows 10 operating system image using Configuration Manager]( ## Related topics -[Integrate Configuration Manager with MDT](../deploy-windows-mdt/integrate-configuration-manager-with-mdt.md)
      [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
      [Add a Windows 10 operating system image using Configuration Manager](add-a-windows-10-operating-system-image-using-configuration-manager.md)
      [Create an application to deploy with Windows 10 using Configuration Manager](create-an-application-to-deploy-with-windows-10-using-configuration-manager.md)
      From 8aea13207b8f5e05136515f03fac0d0796302609 Mon Sep 17 00:00:00 2001 From: Rebecca Agiewich Date: Wed, 22 Apr 2020 16:32:22 -0700 Subject: [PATCH 156/249] added missing comma --- .../microsoft-defender-atp/data-retention-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md index f0606f868a..9cc9cb48ba 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md @@ -31,7 +31,7 @@ During the onboarding process, a wizard takes you through the data storage and r After completing the onboarding, you can verify your selection in the data retention settings page. ## Verify data storage location -During the [Set up phase](production-deployment.md) you would have selected the location to store your data. +During the [Set up phase](production-deployment.md), you would have selected the location to store your data. You can verify the data location by navigating to **Settings** > **Data retention**. From 15b3600c0f493f21555efa859a47cf68a8d5105e Mon Sep 17 00:00:00 2001 From: Rebecca Agiewich Date: Wed, 22 Apr 2020 16:33:40 -0700 Subject: [PATCH 157/249] fixed spelling error --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index c32612f134..a48d6b48ce 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -702,7 +702,7 @@ ### [Microsoft Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) #### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) -#### [Set up and use Microsft Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) +#### [Set up and use Microsoft Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) ### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md) #### [Windows Sandbox architecture](windows-sandbox/windows-sandbox-architecture.md) From 8cbe1e136394ffa9f86f8f7abe9df2a73f8e20b5 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Wed, 22 Apr 2020 17:41:19 -0700 Subject: [PATCH 158/249] Revisions --- devices/hololens/hololens-kiosk.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c114270ae2..ab4ab88f47 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -25,7 +25,7 @@ You can configure a HoloLens device to function as a fixed-purpose device, also This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). -> [!IMPORTANT] +> [!IMPORTANT] > Kiosk mode determines which apps are available when a user signs in to the device. However, kiosk mode is not a security limitation. It does not stop an "allowed" app from launching an app that is not allowed. In order to block apps or processes from launching, use [Windows Defender Application Control (WDAC) CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) to create appropriate policies. You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. @@ -43,6 +43,9 @@ You can configure any HoloLens 2 device to use kiosk mode. To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. +> [!IMPORTANT] +> To help protect devices that run in kiosk mode, consider adding device management policies that turn off features such as USB connectivity. Additionally, check your update ring settings to make sure that automatic updates do not occur during business hours. + ### Decide between a single-app kiosk or a multi-app kiosk A single-app kiosk starts the specified app when the user signs in to the device. The Start menu is disabled, as is Cortana. A HoloLens 2 device does not respond to the [Start](hololens2-basic-usage.md#start-gesture) gesture. A HoloLens (1st gen) device does not respond to the [bloom](hololens1-basic-usage.md) gesture. Because only one app can run, the user cannot place other apps. @@ -56,7 +59,7 @@ The following table lists the feature capabilities in the different kiosk modes. |Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | |Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | -> 1 Voice commands that relate to disabled features do not function. +> 1 Voice commands that relate to disabled features do not function. > 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). > 3 Even if Cortana is disabled, the built-in voice commands are enabled. @@ -78,7 +81,7 @@ For examples of how to use these capabilities, see the following table. For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. +If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. The CSP uses [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app) to identify applications. The following table lists the AUMIDs of some in-box applications that you can use in a multi-app kiosk. From 6f6c565f903025ff82f7bb9b49c27ca67c2c3d74 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Wed, 22 Apr 2020 18:04:20 -0700 Subject: [PATCH 159/249] Revisions --- devices/hololens/hololens-kiosk.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ab4ab88f47..7602c26e6e 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -114,9 +114,13 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. -### Plan access control +### Plan user and device groups + +In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +In short, you configure assignments to deploy the kiosk configuration to devices and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a Kiosk experience. + -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. @@ -129,9 +133,7 @@ Click assignments and add the group(s) that you want the Kiosk mode policy deplo > [!IMPORTANT] > If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. **Examples:** From 2060ba3403f4db6faee875ba18d1bae03c830d7a Mon Sep 17 00:00:00 2001 From: Kurt Sarens <56369685+kurtsarens@users.noreply.github.com> Date: Wed, 22 Apr 2020 19:12:42 -0700 Subject: [PATCH 160/249] Update manage-updates-baselines-windows-defender-antivirus.md Adding April release versions --- .../manage-updates-baselines-windows-defender-antivirus.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index d444eaedc1..05e049fd27 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -50,7 +50,8 @@ Only the main version is listed in the following table as reference information: Month | Platform/Client | Engine ---|---|--- -Mar-2020 | 4.18.2003.x| 1.1.16900.x +Apr-2020 | 4.18.2004.x | 1.1.17000.x +Mar-2020 | 4.18.2003.x | 1.1.16900.x Feb-2020 | - | 1.1.16800.x Jan-2020 | 4.18.2001.x | 1.1.16700.x Dec-2019 | - | - | From 162fbd863df0ba69a27315dee11b2327ad69aa96 Mon Sep 17 00:00:00 2001 From: Skatterbrainz Date: Wed, 22 Apr 2020 23:36:47 -0400 Subject: [PATCH 161/249] Spelling and grammar corrections Inserted some missing words, and some minor grammatical corrections. --- .../hello-for-business/hello-faq.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md index 7d47fb49d1..fca4b7eaa6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ b/windows/security/identity-protection/hello-for-business/hello-faq.md @@ -45,7 +45,7 @@ The statement "PIN is stronger than Password" is not directed at the strength of The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. ## Can I use a convenience PIN with Azure AD? -It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises only Domain Joined users and local account users. +It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises Domain Joined users and local account users. ## Can I use an external camera when my laptop is closed or docked? No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. @@ -64,11 +64,11 @@ The user experience for Windows Hello for Business occurs after user sign-in, af [Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) ## What happens when my user forgets their PIN? -If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. +If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) -For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. +For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. ## What URLs do I need to allow for a hybrid deployment? Communicating with Azure Active Directory uses the following URLs: @@ -88,11 +88,12 @@ Windows Hello for Business has two types of PIN reset: non-destructive and destr Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. ## Which is better or more secure: Key trust or Certificate trust? -The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware backed, two-factor credential. The difference between the two trust types are: +The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: - Required domain controllers - Issuing end entity certificates The **key trust** model authenticates to Active Directory using a raw key. Windows Server 2016 domain controllers enables this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you do not need to issue certificates to your end users (domain controller certificates are still needed). + The **certificate trust** model authenticates to Active Directory using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to your end users, but you do not need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM protected private key to request a certificate from your enterprise's issuing certificate authority. ## Do I need Windows Server 2016 domain controllers? @@ -102,7 +103,7 @@ There are many deployment options from which to choose. Some of those options re Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that are sync based on scenarios. The base scenarios that include Windows Hello for Business are [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. ## Is Windows Hello for Business multifactor authentication? -Windows Hello for Business is two-factor authentication based the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". +Windows Hello for Business is two-factor authentication based on the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". ## What are the biometric requirements for Windows Hello for Business? Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. From 3e55f266c44991e71c50f1661a5918c8a1aef304 Mon Sep 17 00:00:00 2001 From: pawinfie <59937840+pawinfie@users.noreply.github.com> Date: Thu, 23 Apr 2020 07:16:38 -0700 Subject: [PATCH 162/249] Fixed broken link --- devices/hololens/hololens-enroll-mdm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md index bce3d27644..0e557e9c50 100644 --- a/devices/hololens/hololens-enroll-mdm.md +++ b/devices/hololens/hololens-enroll-mdm.md @@ -29,7 +29,7 @@ You can manage multiple Microsoft HoloLens devices simultaneously using solution ## Auto-enrollment in MDM -If your organization uses Azure Active Directory (Azure AD) and an MDM solution that accepts an AAD token for authentication (currently, only supported in Microsoft Intune and AirWatch), your IT admin can configure Azure AD to automatically allow MDM enrollment after the user signs in with their Azure AD account. [Learn how to configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) +If your organization uses Azure Active Directory (Azure AD) and an MDM solution that accepts an AAD token for authentication (currently, only supported in Microsoft Intune and AirWatch), your IT admin can configure Azure AD to automatically allow MDM enrollment after the user signs in with their Azure AD account. [Learn how to configure Azure AD enrollment.](https://docs.microsoft.com/mem/intune/enrollment/windows-enroll#enable-windows-10-automatic-enrollment) When auto-enrollment is enabled, no additional manual enrollment is needed. When the user signs in with an Azure AD account, the device is enrolled in MDM after completing the first-run experience. @@ -45,4 +45,4 @@ Your device is now enrolled with your MDM server. The device will need to restar ## Unenroll HoloLens from Intune -You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard. \ No newline at end of file +You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard. From 39e21ce25bb5f3fb3b1731646b20f2c280864507 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Thu, 23 Apr 2020 08:46:20 -0700 Subject: [PATCH 163/249] pencil edits --- windows/client-management/mdm/defender-csp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 593b1dd546..99080ed5f3 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -272,7 +272,7 @@ Supported operation is Get.       **Health/QuickScanOverdue** Indicates whether a Windows Defender quick scan is overdue for the device. -A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and [catchup Quick scans](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupquickscan) are disabled (default) +A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and [catchup Quick scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupquickscan) are disabled (default) The data type is a boolean. @@ -281,7 +281,7 @@ Supported operation is Get. **Health/FullScanOverdue** Indicates whether a Windows Defender full scan is overdue for the device. -A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and [catchup Full scans](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupfullscan) are disabled (default) +A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and [catchup Full scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupfullscan) are disabled (default) The data type is a boolean. From b90b5e6cf16fd6ac10c56fa8982c62367a3299c3 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 10:00:37 -0700 Subject: [PATCH 164/249] Revisions --- devices/hololens/hololens-kiosk.md | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 7602c26e6e..39986a9f07 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -118,31 +118,32 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). -In short, you configure assignments to deploy the kiosk configuration to devices and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a Kiosk experience. +In short, you assign kiosk configuration profiles to device groups, and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +#### User-dependent experiences +When you configure a HoloLens device as a single-app kiosk, all of the users who sign on to that device see the kiosk experience. Users who do not belong to an appropriately configured user group cannot use the device. -One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. +When you configure a HoloLens device as a multi-app kiosk, the device can provide a kiosk experience to one group of users and a non-kiosk experience to another group of users. In other words, it can function as a kiosk or as a normal HoloLens device, depending on who signs in. -Assign the policy to the group to receive the policy +#### Profile conflicts -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. +If two or more kiosk configuration profiles target the same device, they conflict. In the case of Intune-managed devices, Intune does not apply any of the conflicting profiles. -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. +Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile. -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +#### Examples of how to use groups +- You use a single group for both devices and users. One device and users A, B, and C are members of this group. No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. +- You use a device group and a user group. Users A, B, and C are members of the device group. Users B and C are also members of the user group (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + - Users B and C can sign in to the device, and they get the kiosk experience. + - User A can sign in to the device, but does not get the kiosk experience. If the device is a multi-app kiosk, user A can use the device as a typical non-kiosk device. +- You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. + + You use a single user group that includes users from both vendors. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. ### Select a deployment method From d6cdabd6101b26537201ac4adbcf7a0cde0185d4 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Thu, 23 Apr 2020 10:41:58 -0700 Subject: [PATCH 165/249] Update microsoft-defender-smartscreen-overview.md --- .../microsoft-defender-smartscreen-overview.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md index 56b4084b8b..cb81f9cb97 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md @@ -88,5 +88,6 @@ EventID | Description 1002 | User Decision Windows Defender SmartScreen Event ## Related topics +- [SmartScreen Frequently Asked Questions](https://fb.smartscreen.microsoft.com/smartscreenfaq.aspx) - [Threat protection](../index.md) - [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings) From f264152d3400cde485db89dcb6bf1112748ca468 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 10:58:42 -0700 Subject: [PATCH 166/249] Revisions --- devices/hololens/hololens-kiosk.md | 313 ++++++++++++----------------- 1 file changed, 123 insertions(+), 190 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 39986a9f07..134b8595f0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -116,9 +116,9 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you ### Plan user and device groups -In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). +In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). Because these groups are security groups (for example, Azure Active Directory, or Azure AD, security groups) you can use a single group for devices and users. Separate groups are typically easier to manage. -In short, you assign kiosk configuration profiles to device groups, and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +In short, you assign a user group to a kiosk configuration profile, and you assign the profile to a device group. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. #### User-dependent experiences @@ -143,27 +143,17 @@ Other types of profiles and policies, such as device restrictions that are not r - You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. - You use a single user group that includes users from both vendors. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. + You use a single user group that includes users from both vendors, and you assign that group to both profiles. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. ### Select a deployment method +You can select one of three methods to deploy kiosk configurations: -While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +- [Provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) -What are you deploying: - -- Single-app kiosk -- Simple multi-app kiosk -- Fully-customized multi-app kiosk - -There are three methods that you can use to configure the device as a kiosk: - -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. - -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. - -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. +- [Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -181,17 +171,111 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | +## Set up kiosk mode by using Microsoft Intune or MDM + +To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. + +1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). +1. Select the settings that you want to see in your kiosk. + - [Configure the settings for a single-app kiosk](#mdmconfigsingle). + - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). +1. [Assign the kiosk configuration profile to the device group](#mdmassign). +1. Deploy the devices. + - [Deploy a single-app kiosk](#mdmsingledeploy). + - [Deploy a multi-app kiosk](#mdmmultideploy). + +### [MDM] 1. Create a kiosk configuration profile + +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** +1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. + +Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. + +For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). + +### Select the settings for your kiosk + For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). [Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) +#### [MDM] 2. Configure the settings for a single-app kiosk + +Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. +For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). + +#### [MDM] 2. Configure the settings for a multi-app kiosk + +Additional information: + +- You can optionally use a custom Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). +- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). + +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. + +**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. + +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. + +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + +### [MDM] 3. Assign the kiosk configuration profile to the device group + +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +### Deploy the devices + +Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +#### [MDM] 4. Deploy a single-app kiosk + +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. + +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. + +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. + +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +#### [MDM] 4. Deploy a multi-app kiosk + +For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. + +If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. + +Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. + +To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +## Use a provisioning package to set up a single-app or muti-app kiosk + +As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). + +To set up kiosk mode by using a provisioning package, follow these steps. + +1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) +2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) +3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) + + ### Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. +- Do not include Classic Windows applications (Win32). HoloLens does not support these applications. - Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. #### Add guest access to the kiosk configuration (optional) @@ -211,33 +295,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. +> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start screen and does not need a Start layout. -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` +> [!NOTE] +> If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). ### Create a start layout for a customized multi-app kiosk @@ -263,158 +327,27 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ``` -## Set up kiosk mode by using Microsoft Intune or MDM +### Start layout file for MDM (Intune and others) -To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). -1. [Create a device configuration policy](#create-a-device-configuration-policy). -1. Select the settings that you want to see in your kiosk. - - [Configure the settings for a single-app kiosk](#configure-the-settings-for-a-single-app-kiosk). - - [Configure the settings for a multi-app kiosk](#configure-the-settings-for-a-multi-app-kiosk). -1. [Assign the policy to the group to receive the policy](#assign-the-policy-to-the-group-to-receive-the-policy). -1. Set up the device. - - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). - - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). - -### [MDM] 1. Create a device configuration policy - -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** -1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. - -Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. - -For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). - -### Select the settings that you want to see in your kiosk - -#### [MDM] 2. Configure the settings for a single-app kiosk - -Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. -For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). - -#### [MDM] 2. Configure the settings for a multi-app kiosk - -Additional information: - -- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. - -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. - -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. - -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. -In-box apps you may wish to use are: - -| App Name | AUMID | -|----------------------------|----------------------------------------------------------------------------------| -| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| File Explorer | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail | -| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Microsoft Edge | Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge | -| Microsoft Store | Microsoft.WindowsStore_8wekyb3d8bbwe!App | -| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | -| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | - -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). - -### [MDM] 3. Assign the policy to the group to receive the policy - -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. - -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. - -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). - -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. - -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. - -### Set up the device - -Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. - -#### [MDM] 4. Set up a single-app kiosk - -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. - -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. - -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. - -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). - -#### [MDM] 4. Set up a multi-app kiosk - -For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. - -If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. - -Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. - -To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). - - - -## Use a provisioning package to set up a single-app or muti-app kiosk - -As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). - -To set up kiosk mode by using a provisioning package, follow these steps. - -1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) - -### [PP] 1. Create a kiosk configuration XML file - -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: - -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. -- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. - -#### Add guest access to the kiosk configuration (optional) - -In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. - -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). ```xml - - - - - - + + + + + + + + + ``` ### [PP] 2. Add the kiosk configuration XML file to a provisioning package From 187f033f6894073dd19c8b75cade1005b5e3f365 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 23 Apr 2020 11:40:06 -0700 Subject: [PATCH 167/249] remove --- .../information-protection-in-windows-overview.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md index 34cb228572..0c80426a9f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md @@ -2,7 +2,7 @@ title: Information protection in Windows overview ms.reviewer: description: Learn about how information protection works in Windows to identify and protect sensitive information -keywords: information, protection, dlp, wip, data, loss, prevention, protect +keywords: information, protection, dlp, data, loss, prevention, protect search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -35,7 +35,7 @@ Microsoft Defender ATP applies the following methods to discover, classify, and - **Data discovery** - Identify sensitive data on Windows devices at risk - **Data classification** - Automatically classify data based on common Microsoft Information Protection (MIP) policies managed in Office 365 Security & Compliance Center. Auto-classification allows you to protect sensitive data even if the end user hasn’t manually classified it. -- **Data protection** - Windows Information Protection (WIP) as outcome of Azure Information Protection label + ## Data discovery and data classification @@ -95,6 +95,4 @@ InformationProtectionLogs_CL - Go to **Settings** in Microsoft Defender Security Center, click on **Advanced Settings** under **General**. -## Related topics -- [How Windows Information Protection protects files with a sensitivity label](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels) From e4eede7b1fc6848dd0275faf6a40b18ba53a9b84 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 11:40:19 -0700 Subject: [PATCH 168/249] Revisions --- devices/hololens/hololens-kiosk.md | 43 ++++++++++++++++-------------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 134b8595f0..bcfab903dc 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -192,39 +192,42 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. -For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). +For full details about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). -### Select the settings for your kiosk +### [MDM] 2. Configure the settings for a single-app kiosk +This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following locations: -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) +- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +- For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). -[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) +Configure the following settings in the kiosk configuration profile: -#### [MDM] 2. Configure the settings for a single-app kiosk +- **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +- **User logon type**.** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. +- **Application type**. Select **Store app**, and then select an app from the list. -Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. -For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). +### [MDM] 2. Configure the settings for a multi-app kiosk -#### [MDM] 2. Configure the settings for a multi-app kiosk - -Additional information: - -- You can optionally use a custom Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following locations: +- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +- For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. +- You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. +Configure the following settings in the kiosk configuration profile: -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. +- **Target Windows 10 in S mode devices**. Select **No**. S mode isn't supported on Windows Holographic for Business. +- **User logon type**. Select **Azure AD user or group** or **HoloLens visitor**, and then add one or more user groups or accounts. + + Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. +- Apps. You may choose to add just one or add many apps. You can use the following options to add apps: -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + - To add an uploaded line of business app, select **Add store app**. + - To add an app by specifying its AUMID, select **Add by AUMID**. ### [MDM] 3. Assign the kiosk configuration profile to the device group From 2524352a600abd34f2b57968090f26b9959f81f6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 23 Apr 2020 12:11:11 -0700 Subject: [PATCH 169/249] update filter --- .../microsoft-defender-atp/machines-view-overview.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md index 6b96503525..e570e0634a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md @@ -71,12 +71,13 @@ Filter by the following machine health states: For more information on how to address issues on misconfigured machines see, [Fix unhealthy sensors](fix-unhealthy-sensors.md). -### Security state +### Antivirus status -Filter by machines that are well configured or require attention based on the security controls that are enabled in your organization. Applies to active Windows 10 machines only. +Filter machines by antivirus status. Applies to active Windows 10 machines only. -- **Well configured** - Machines have the security controls well configured. -- **Requires attention** - Machines where improvements can be made to increase the overall security posture of your organization. +- **Disabled** - Virus & threat protection is turned off. +- **Not reporting** - Virus & threat protection is not reporting. +- **Not updated** - Virus & threat protection is not up to date. For more information, see [View the Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md). From 9d58e595d1107a8e3c3f4225c6395e7b4a223909 Mon Sep 17 00:00:00 2001 From: Max Stein Date: Thu, 23 Apr 2020 12:48:49 -0700 Subject: [PATCH 170/249] Updated Microsoft browser extension policy URL Current URL: https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy leads to 404. Updated URL to reflect new URL: https://docs.microsoft.com/legal/microsoft-edge/microsoft-browser-extension-policy. --- .../microsoft-browser-extension-policy-shortdesc.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md index 91065aa687..8a7bd04455 100644 --- a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md +++ b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md @@ -1,12 +1,13 @@ --- author: dansimp ms.author: dansimp -ms.date: 10/02/2018 +ms.date: 04/23/2020 ms.reviewer: -audience: itpro manager: dansimp +audience: itpro +manager: dansimp ms.prod: edge ms.topic: include --- -[Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy): +[Microsoft browser extension policy](https://docs.microsoft.com/legal/microsoft-edge/microsoft-browser-extension-policy: This document describes the supported mechanisms for extending or modifying the behavior or user experience of Microsoft Edge and Internet Explorer or the content displayed by these browsers. Any technique not explicitly listed in this document is considered **unsupported**. From e28f537634559e97623c9a2ee9b5c3aaefdf757a Mon Sep 17 00:00:00 2001 From: illfated Date: Thu, 23 Apr 2020 22:35:19 +0200 Subject: [PATCH 171/249] Identity Protection/VPN: grammar, links & spacing As reported in issue ticket #6556 (Traffic filter sentence incomplete), there is a missing part in the sentence "Network admins to effectively add interface specific firewall rules on the VPN Interface." to make it work as a full descriptive sentence in this context. This PR aims to correct this issue, in addition to various other adjustments. Thanks to klishb for reporting this issue. Changes proposed: - Add the missing part of the Traffic Filters sentence - Update 2 outdated and permanently redirected MSDN links - Uppercase adjustments for "Traffic filters" & "Lockdown" - Add MarkDown indent marker compatibility spacing in the Note blob - Reduce bullet point spacing from 3 to 1 in the "Applies to" section - Remove all redundant end-of-line spacing - Add missing space after the corrected sentence (after the period) Ticket closure or reference: Closes #6556 --- .../vpn/vpn-security-features.md | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index 18e7b41ec9..22517e110c 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -8,7 +8,7 @@ ms.pagetype: security, networking author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp --- @@ -16,8 +16,8 @@ ms.author: dansimp # VPN security features **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile ## LockDown VPN @@ -29,51 +29,50 @@ A VPN profile configured with LockDown secures the device to only allow network - The user cannot delete or modify the VPN profile. - The VPN LockDown profile uses forced tunnel connection. - If the VPN connection is not available, outbound network traffic is blocked. -- Only one VPN LockDown profile is allowed on a device. +- Only one VPN LockDown profile is allowed on a device. ->[!NOTE] ->For built-in VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. - -Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. +> [!NOTE] +> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. +Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. ## Windows Information Protection (WIP) integration with VPN Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. -The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: +The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: - Core functionality: File encryption and file access blocking - UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations - WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN - Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN -The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. +The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip) -## Traffic filters +## Traffic Filters -Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins to effectively add interface specific firewall rules on the VPN Interface.There are two types of Traffic Filter rules: +Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins can use Traffic Filters to effectively add interface specific firewall rules on the VPN Interface. There are two types of Traffic Filter rules: - App-based rules. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. - Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. -There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. +There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. -For example, an admin could define rules that specify: +For example, an admin could define rules that specify: -- The Contoso HR App must be allowed to go through the VPN and only access port 4545. +- The Contoso HR App must be allowed to go through the VPN and only access port 4545. - The Contoso finance apps is allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889. -- All other apps on the device should be able to access only ports 80 or 443. +- All other apps on the device should be able to access only ports 80 or 443. ## Configure traffic filters -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) for XML configuration. The following image shows the interface to configure traffic rules in a VPN Profile configuration policy using Microsoft Intune. From 3110c0ed5bb45058e4d2dab913f4c1de52b6f811 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Thu, 23 Apr 2020 15:28:13 -0700 Subject: [PATCH 172/249] removal of acronym sccm --- windows/deployment/update/fod-and-lang-packs.md | 8 ++++---- windows/deployment/update/how-windows-update-works.md | 6 +++--- .../update/waas-delivery-optimization-reference.md | 4 ++-- .../deployment/update/waas-delivery-optimization.md | 2 +- windows/deployment/update/waas-wu-settings.md | 2 +- .../update/windows-update-troubleshooting.md | 4 ++-- windows/deployment/windows-10-poc-sc-config-mgr.md | 2 +- ...-level-windows-diagnostic-events-and-fields-1703.md | 6 +++--- ...-level-windows-diagnostic-events-and-fields-1709.md | 10 +++++----- ...-level-windows-diagnostic-events-and-fields-1803.md | 8 ++++---- ...-level-windows-diagnostic-events-and-fields-1809.md | 8 ++++---- ...-level-windows-diagnostic-events-and-fields-1903.md | 4 ++-- .../resolved-issues-windows-10-1903.yml | 4 ++-- ...issues-windows-7-and-windows-server-2008-r2-sp1.yml | 2 +- .../threat-protection/mbsa-removal-and-guidance.md | 2 +- 15 files changed, 36 insertions(+), 36 deletions(-) diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index 9dbe7740b3..d125672d4a 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -1,6 +1,6 @@ --- -title: Windows 10 - How to make FoD and language packs available when you're using WSUS/SCCM -description: Learn how to make FoD and language packs available when you're using WSUS/SCCM +title: Windows 10 - How to make FoD and language packs available when you're using WSUS or Configuration Manager +description: Learn how to make FoD and language packs available when you're using WSUS or Configuration Manager ms.prod: w10 ms.mktglfcycl: manage @@ -14,7 +14,7 @@ ms.reviewer: manager: laurawi ms.topic: article --- -# How to make Features on Demand and language packs available when you're using WSUS/SCCM +# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager > Applies to: Windows 10 @@ -26,6 +26,6 @@ In Windows 10 version 1709 and 1803, changing the **Specify settings for optiona In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It’s currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. -For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS or SCCM or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. +For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](https://docs.microsoft.com/windows/client-management/). diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md index ac597ae387..7284fecba7 100644 --- a/windows/deployment/update/how-windows-update-works.md +++ b/windows/deployment/update/how-windows-update-works.md @@ -106,7 +106,7 @@ When users start scanning in Windows Update through the Settings panel, the foll |MU|7971f918-a847-4430-9279-4a52d1efe18d| |Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289| |OS Flighting|8B24B027-1DEE-BABB-9A95-3517DFB9C552| -|WSUS or SCCM|Via ServerSelection::ssManagedServer
      3DA21691-E39D-4da6-8A4B-B43877BCB1B7 | +|WSUS or Configuration Manager|Via ServerSelection::ssManagedServer
      3DA21691-E39D-4da6-8A4B-B43877BCB1B7 | |Offline scan service|Via IUpdateServiceManager::AddScanPackageService| #### Finds network faults @@ -117,9 +117,9 @@ Common update failure is caused due to network issues. To find the root of the i - The WU client uses SLS (Service Locator Service) to discover the configurations and endpoints of Microsoft network update sources – WU, MU, Flighting. > [!NOTE] - > Warning messages for SLS can be ignored if the search is against WSUS/SCCM. + > Warning messages for SLS can be ignored if the search is against WSUS or Configuration Manager. -- On sites that only use WSUS/SCCM, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS/SCCM, since it’s locally configured. +- On sites that only use WSUS or Configuration Manager, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS or Configuration Manager, since it’s locally configured. ![Windows Update scan log 3](images/update-scan-log-3.png) ## Downloading updates diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index de0d1957dc..a5d605d778 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -110,7 +110,7 @@ Download mode dictates which download sources clients are allowed to use when do | Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | -|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using SCCM. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | +|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | >[!NOTE] >Group mode is a best-effort optimization and should not be relied on for an authentication of identity of devices participating in the group. @@ -119,7 +119,7 @@ Download mode dictates which download sources clients are allowed to use when do By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and Active Directory Domain Services site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or Active Directory Domain Services site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. -[//]: # (SCCM Boundary Group option; GroupID Source policy) +[//]: # (Configuration Manager Boundary Group option; GroupID Source policy) >[!NOTE] >To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 9de80024c2..d37589c3e6 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -54,7 +54,7 @@ The following table lists the minimum Windows 10 version that supports Delivery | Windows Defender definition updates | 1511 | | Office Click-to-Run updates | 1709 | | Win32 apps for Intune | 1709 | -| SCCM Express Updates | 1709 + Configuration Manager version 1711 | +| Configuration Manager Express Updates | 1709 + Configuration Manager version 1711 | ``` -### Start layout file for MDM (Intune and others) +#### Start layout file for MDM (Intune and others) Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). @@ -365,66 +366,65 @@ Save the following sample as an XML file. You can use this file when you configu ### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -2. Choose **Advanced provisioning**. -3. Name your project, and click **Next**. -4. Choose **Windows 10 Holographic** and click **Next**. -5. Select **Finish**. The workspace for your package opens. -6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. -7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created. +1. Select **Advanced provisioning**. +1. Name your project, and then select **Next**. +1. Select **Windows 10 Holographic**, and then select **Next**. +1. Select **Finish**. The workspace for your package opens. +1. Select **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. +1. In the center pane, select **Browse** to locate and select the kiosk configuration XML file that you created. - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](./images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. -10. On the **File** menu, select **Save.** -11. On the **Export** menu, select **Provisioning package**. -12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -13. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. - -15. Click **Next**. - -16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. By using this account, you can view the provisioning status and logs. +1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. For **UserGroup**, select **Standard Users**. +1. Select **File** > **Save**. +1. Select **Export** > **Provisioning package**, and then set **Owner** to **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. +1. Select **Next**. +1. On the **Provisioning package security** page, select a security option. + > [!IMPORTANT] + > If you select **Enable package signing**, you also have to select a valid certificate to use for signing the package. To do this, select **Browse** and select the certificate that you want to use to sign the package. + + > [!CAUTION] + > Do not select **Enable package encryption**. On HoloLens devices, this setting causes provisioning to fail. +1. Select **Next**. +1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. +1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. ### [PP] 3. Apply the provisioning package to HoloLens -You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: -You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). +- You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). + +- You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). ## Use the Windows Device Portal to set up a single-app kiosk To set up kiosk mode by using the Windows Device Portal, follow these steps. -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. +> [!IMPORTANT] +> Kiosk mode is only available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md) installed. - > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) +1. [Set up the HoloLens device to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. + + > [!CAUTION] + > When you set up HoloLens to use the Device Portal, you have to enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables you to side-load apps. However, this setting creates a risk that a user can install apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** by using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). +1. On a computer, connect to the HoloLens by using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +1. Do one of the following: + - If you are connecting to the Windows Device Portal for the first time, [create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) + - Enter the user name and password that you previously set up. > [!TIP] > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#security_certificate). -4. In the Windows Device Portal, click **Kiosk Mode**. +1. In the Windows Device Portal, select **Kiosk Mode**. + +1. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. ![Kiosk Mode](images/kiosk.png) - - > [!NOTE] - > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). - -5. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. - -6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** - - - +1. Restart HoloLens. If you still have your Device Portal page open, you can select select **Restart** at the top of the page. ## More information From a52a78eda28935e9fc436cf53b09a0a44a9c2cb8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 10:58:13 -0700 Subject: [PATCH 194/249] edits --- .../microsoft-defender-atp/manage-indicators.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index ef48d72ec9..c2674dbb21 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -151,8 +151,11 @@ It's important to understand the following prerequisites prior to creating indic You can create indicators for certificates. Some common use cases include: -- Deploying blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but allow behaviors from signed applications using certificate whitelisting. -- Blocking the use of a specific signed application across your organization. Using the certificate 'block' indicator, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. +- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but need to allow behaviors from signed applications by using the adding the certificate in the allow list. +- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. +- + + ### Before you begin @@ -160,9 +163,8 @@ It's important to understand the following requirements prior to creating indica - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). - Supported on machines on Windows 10, version 1703 or later. -- The Antimalware client version must be or later. -- The Engine version must be x or later. -- This feature currently supports entering … or … +- The Antimalware client version must be 4.18.1901.x or later. +- The virus and threat protection definitions must be up-to-date. >[!IMPORTANT] > - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it’s trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities'). From a5da7d7719dc3ca2fc8ed6846e85ba8703115ff2 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 11:37:28 -0700 Subject: [PATCH 195/249] edits --- .../microsoft-defender-atp/manage-indicators.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index c2674dbb21..f93b12d0ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -69,6 +69,7 @@ There are two ways you can create indicators for files: ### Before you begin It's important to understand the following prerequisites prior to creating indicators for files: + - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). - The Antimalware client version must be 4.18.1901.x or later. - Supported on machines on Windows 10, version 1703 or later. @@ -151,10 +152,8 @@ It's important to understand the following prerequisites prior to creating indic You can create indicators for certificates. Some common use cases include: -- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but need to allow behaviors from signed applications by using the adding the certificate in the allow list. +- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) and [controlled folder access](controlled-folders.md) but need to allow behaviors from signed applications by adding the certificate in the allow list. - Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. -- - ### Before you begin @@ -162,8 +161,8 @@ You can create indicators for certificates. Some common use cases include: It's important to understand the following requirements prior to creating indicators for certifications: - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). -- Supported on machines on Windows 10, version 1703 or later. - The Antimalware client version must be 4.18.1901.x or later. +- Supported on machines on Windows 10, version 1703 or later. - The virus and threat protection definitions must be up-to-date. >[!IMPORTANT] From b21891d0f20ee66a596ef09d7d6ca59371e73de6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 11:50:54 -0700 Subject: [PATCH 196/249] typo --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index f93b12d0ad..e04c52cc32 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -158,7 +158,7 @@ You can create indicators for certificates. Some common use cases include: ### Before you begin -It's important to understand the following requirements prior to creating indicators for certifications: +It's important to understand the following requirements prior to creating indicators for certificates: - This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). - The Antimalware client version must be 4.18.1901.x or later. From 5dd024466cade8dff7f4e70777f4ef8e1366192f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 11:54:01 -0700 Subject: [PATCH 197/249] fix warning --- ...lock-potentially-unwanted-apps-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index 91816a7033..612a4ddb65 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -62,7 +62,7 @@ Admins can [configure](https://docs.microsoft.com/DeployEdge/configure-microsoft Defender SmartScreen available, including [one for blocking PUA](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreenpuaenabled). In addition, admins can [configure Windows Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/available-policies?source=docs#configure-windows-defender-smartscreen) as a whole, using group policy settings to turn Windows Defender SmartScreen on or off. -Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md#create-indicators-for-ips-and-urlsdomains-preview) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. +Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md#create-indicators-for-ips-and-urlsdomains) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. ### Windows Defender Antivirus From 9e5a8bf3e72e11c7795633ed08e0e90d111a654d Mon Sep 17 00:00:00 2001 From: Todd Lyon <19413953+tmlyon@users.noreply.github.com> Date: Fri, 24 Apr 2020 12:10:46 -0700 Subject: [PATCH 198/249] Update hololens-insider.md Fix typo in speech command section --- devices/hololens/hololens-insider.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md index c4d1cee1a2..385eed565c 100644 --- a/devices/hololens/hololens-insider.md +++ b/devices/hololens/hololens-insider.md @@ -88,7 +88,7 @@ Provisioning packages let you set HoloLens configuration through a config file r 1. Plug it into any freshly flashed HoloLens and press **Volume down + Power** to apply your provisioning package. ### System voice commands -You can now can access these commands with your voice: +You can now access these commands with your voice: - "Restart device" - "Shutdown device" - "Brightness up" From 31806c89cd852e3fcb6f053302939890746311cf Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 24 Apr 2020 12:12:14 -0700 Subject: [PATCH 199/249] fix link --- ...lock-potentially-unwanted-apps-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index 612a4ddb65..7c0db7f78f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -62,7 +62,7 @@ Admins can [configure](https://docs.microsoft.com/DeployEdge/configure-microsoft Defender SmartScreen available, including [one for blocking PUA](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreenpuaenabled). In addition, admins can [configure Windows Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/available-policies?source=docs#configure-windows-defender-smartscreen) as a whole, using group policy settings to turn Windows Defender SmartScreen on or off. -Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md#create-indicators-for-ips-and-urlsdomains) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. +Although Microsoft Defender ATP has its own block list, based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md) in the Microsoft Defender ATP portal, Windows Defender SmartScreen will respect the new settings. ### Windows Defender Antivirus From 8f015dafcbe59878379b7debe8aa18d7cdac5956 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 24 Apr 2020 12:13:03 -0700 Subject: [PATCH 200/249] Update miracast-over-infrastructure.md --- .../surface-hub/miracast-over-infrastructure.md | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md index 2bb6381924..1401112971 100644 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ b/devices/surface-hub/miracast-over-infrastructure.md @@ -6,13 +6,13 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 06/20/2019 +ms.date: 04/24/2020 ms.reviewer: manager: laurawi ms.localizationpriority: medium --- -# Miracast on existing wireless network or LAN +# Miracast over infrastructure In the Windows 10, version 1703, Microsoft has extended the ability to send a Miracast stream over a local network rather than over a direct wireless link. This functionality is based on the [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx). @@ -28,7 +28,12 @@ Miracast over Infrastructure offers a number of benefits: ## How it works -Users attempt to connect to a Miracast receiver as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. +Users attempt to connect to a Miracast receiver through their Wi-Fi adapter as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. + +> [!NOTE] +> For more information on the connection negotiation sequence, see [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx) + + ## Enabling Miracast over Infrastructure @@ -36,13 +41,19 @@ Users attempt to connect to a Miracast receiver as they did previously. When the If you have a Surface Hub or other Windows 10 device that has been updated to Windows 10, version 1703, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: - The Surface Hub or device (Windows PC or phone) needs to be running Windows 10, version 1703. +- Open TCP port: **7250**. - A Surface Hub or Windows PC can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. - As a Miracast receiver, the Surface Hub or device must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Surface Hub or device is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - As a Miracast source, the Windows PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. - The DNS Hostname (device name) of the Surface Hub or device needs to be resolvable via your DNS servers. You can achieve this by either allowing your Surface Hub to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the Surface Hub's hostname. - Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. +- On Windows 10 PCs, the **Projecting to this PC** feature must be enabled in System Settings, and the device must have a Wi-Fi interface enabled in order to respond to discovery requests that only occur through the Wi-Fi adapter. It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method. The **InBoxApps/WirelessProjection/PinRequired** setting in the [SurfaceHub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) is not required for Miracast over Infrastructure. This is because Miracast over Infrastructure only works when both devices are connected to the same enterprise network. This removes the security restriction that was previously missing from Miracast. We recommend that you continue using this setting (if you used it previously) as Miracast will fall back to regular Miracast if the infrastructure connection does not work. + +## FAQ +**Why do I still need Wi-Fi to use Miracast over infrastructure?** +Discovery requests to identify Miracast receivers can only occur through the Wi-Fi adapter. Once the receivers have been identified, Windows 10 can then attempt the connection to the network. From 51a324d7cb43060bb472017a701f48c33e8ef70d Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 12:22:43 -0700 Subject: [PATCH 201/249] Revisions --- devices/hololens/hololens-kiosk.md | 88 +++++++++++++++++++++++------- 1 file changed, 67 insertions(+), 21 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ee917f8b5d..6a906f35a9 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -116,21 +116,83 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you ### Plan user and device groups -In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). +In an MDM environment, you use groups to manage device configurations and user access. -The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk. Similarly, if a device does not belong to a group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk. > [!NOTE] > The **User logon type** of a single-app kiosk specifies a single user account. This is the user context under which the kiosk runs. The **User logon type** of a multi-app kiosk can specify one or more user accounts or groups that can use the kiosk. -In addition, you assign the configuration profile to a group. This group can be the same as that specified by **User logon type**, or a different group. These settings provide flexibility in how you manage user access and device behavior: +Before you can deploy the kiosk configuration to a device, you have to *assign* the kiosk configuration profile to a group that contains the device or a user that can sign on to the device. This setting produces behavior such as the following. -- To associate the kiosk configuration with the users who sign on to devices, assign the kiosk configuration profile to the group that contains the users. -- To associate the kiosk configuration with specific devices, assign the kiosk configuration profile to a group that contains the devices (such groups can include dynamically-generated groups that automatically enroll devices that meet certain criteria). +- If the device is a member of the assigned group, the kiosk configuration deploys to the device the first time that any user signs in on the device. +- If the device is not a member of the assigned group, but a user who is a member of that group signs in, the kiosk configuration deploys to the device at that time. +For a full discussion of the effects of assigning configuration profiles in Intune, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-profile-assign). +**Example 1** +You use a single group (Group 1) for both devices and users. One device and users A, B, and C are members of this group. You configure the kiosk configuration profile as follows: +- **User logon type**: Group 1 +- **Assigned group**: Group 1 + +No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. + +**Example 2** + +You use two groups that have the following members: + +- Group 1: + - User A + - User B +- Group 2: + - User A + - User B + - User C + - Device 1 + +You configure the kiosk configuration profile as follows: + +- **User logon type**: Group 1 +- **Assigned group**: Group 2 + +No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, the user experiences differ as follows: + +- Users A and B can sign in to the device, and they get the kiosk experience. +- User C can sign in to the device, but does not get the kiosk experience. User C can use the device as a typical non-kiosk device. + +**Example 3** + +You contract devices out to two different vendors who need different kiosk experiences. Both vendors have users, and you want all of the users to have access to kiosks from both their own vendor and the other vendor. You configure groups as follows: + +- Device Group 1: + - Device 1 (Vendor 1) + - Device 2 (Vendor 1) + +- Device Group 2: + - Device 3 (Vendor 2) + - Device 4 (Vendor 2) + +- User Group: + - User A (Vendor 1) + - User B (Vendor 2) + +You create two kiosk configuration profiles that have the following settings: + +- Kiosk Profile 1: + - **User logon type**: User Group + - **Assigned group**: Device Group 1 + +- Kiosk Profile 2: + - **User logon type**: User Group + - **Assigned group**: Device Group 2 + +These configurations produce the following results: + +- When any user signs on to Device 1 or Device 2, Intune deploys Kiosk Profile 1 to that device. +- When any user signs on to Device 3 or Device 4, Intune deploys Kiosk Profile 2 to that device. +- User A and user B can sign in to any of the four devices. If they sign in to Device 1 or Device 2, they see Vendor 1's kiosk experience. If they sign in to Device 3 or Device 4, they see Vendor 2's kiosk experience. #### Profile conflicts @@ -138,22 +200,6 @@ If two or more kiosk configuration profiles target the same device, they conflic Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile. - - - -#### Examples of how to use groups - -- You use a single group for both devices and users. One device and users A, B, and C are members of this group. No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. - -- You use multiple groups. Users A, B, and C are members of Group 1. The HoloLens device is also a member of Group 1. Users B and C are also members of Group 2 (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: - - - Users B and C can sign in to the device, and they get the kiosk experience. - - User A can sign in to the device, but does not get the kiosk experience. User A can use the device as a typical non-kiosk device. - -- You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. - - You use a single user group that includes users from both vendors, and you assign that group to both profiles. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. - ### Select a deployment method You can select one of three methods to deploy kiosk configurations: From 567d837d9f993188b0ffc64827db97103a47b4a0 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 24 Apr 2020 12:45:46 -0700 Subject: [PATCH 202/249] MDT updates Removes outdated content. --- ...-windows-10-to-surface-devices-with-mdt.md | 776 +----------------- ...-surface-devices-to-windows-10-with-mdt.md | 214 +---- 2 files changed, 6 insertions(+), 984 deletions(-) diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index a12b2f2dc4..05db1ef1d7 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -13,6 +13,7 @@ ms.localizationpriority: medium ms.audience: itpro ms.reviewer: manager: laurawi +ms.date: 04/24/2020 --- # Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit @@ -27,779 +28,8 @@ manager: laurawi - Surface 3 - Windows 10 -This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app. - > [!NOTE] -> MDT is not currently supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) - -When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies. - -By following the procedures in this article, you can create an up-to-date reference image and deploy this image to your Surface devices, a process known as *reimaging*. Reimaging will erase and overwrite the existing environment on your Surface devices. This process allows you to rapidly configure your Surface devices with identical environments that can be configured to precisely fit your organization’s requirements. - -An alternative to the reimaging process is an upgrade process. The upgrade process is non-destructive and instead of erasing the existing environment on your Surface device, it allows you to install Windows 10 while retaining your user data, applications, and settings. You can read about how to manage and automate the upgrade process of Surface devices to Windows 10 at [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md). - -The goal of the deployment process presented in this article is automation. By leveraging the many technologies and tools available from Microsoft, you can create a process that requires only a single touch on the devices being deployed. The automation can load the deployment environment; format the device; prepare an updated Windows image with the drivers required for the device; apply that image to the device; configure the Windows environment with licensing, membership in a domain, and user accounts; install applications; apply any Windows updates that were not included in the reference image; and log out. - -By automating each aspect of the deployment process, you not only greatly decrease the effort involved, but you create a process that can be easily repeated and where human error becomes less of a factor. Take for example a scenario where you create a reference image for the device manually, but you accidentally install conflicting applications and cause the image to become unstable. In this scenario you have no choice but to begin again the manual process of creating your image. If in this same scenario you had automated the reference image creation process, you could repair the conflict by simply editing a step in the task sequence and then re-running the task sequence. - -## Deployment tools - -The deployment process described in this article leverages a number of Microsoft deployment tools and technologies. Some of these tools and technologies are included in Windows client and Windows Server, such as Hyper-V and Windows Deployment Services (WDS), while others are available as free downloads from the [Microsoft Download Center](https://www.microsoft.com/download/windows.aspx). - -#### Microsoft Deployment Toolkit - -The Microsoft Deployment Toolkit (MDT) is the primary component of a Windows deployment. It serves as a unified interface for most of the Microsoft deployment tools and technologies, such as the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), User State Migration Tool (USMT), and many other tools and technologies. Each of these is discussed throughout this article. The unified interface, called the *Deployment Workbench*, facilitates automation of the deployment process through a series of stored deployment procedures, known as a *task sequence*. Along with these task sequences and the many scripts and tools that MDT provides, the resources for a Windows deployment (driver files, application installation files, and image files) are stored in a network share known as the *deployment share*. - -You can download and find out more about MDT at [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). - -#### Windows Assessment and Deployment Kit - -Although MDT is the tool you will interact with most during the deployment process, the deployment tools found in the Windows ADK perform most of the deployment tasks during the deployment process. The resources for deployment are held within the MDT deployment share, but it is the collection of tools included in Windows ADK that access the image files, stage drivers and Windows updates, run the deployment experience, provide instructions to Windows Setup, and back up and restore user data. - -You can download and find out more about the Windows ADK at [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk). - -#### Windows 10 installation media - -Before you can perform a deployment with MDT, you must first supply a set of operating system installation files and an operating system image. These files and image can be found on the physical installation media (DVD) for Windows 10. You can also find these files in the disk image (ISO file) for Windows 10, which you can download from the [Volume Licensing Service Center (VLSC)](https://www.microsoft.com/Licensing/servicecenter/default.aspx). - - ->[!NOTE] ->The installation media generated from the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. - - -#### Windows Server - -Although MDT can be installed on a Windows client, to take full advantage of Windows Deployment Services’ ability to network boot, a full Windows Server environment is recommended. To provide network boot for UEFI devices like Surface with WDS, you will need Windows Server 2008 R2 or later. - - ->[!NOTE] ->To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter). - - -#### Windows Deployment Services - -Windows Deployment Services (WDS) is leveraged to facilitate network boot capabilities provided by the Preboot Execution Environment (PXE) server. The boot media generated by MDT is loaded onto the Surface device simply by pressing Enter at the prompt when the device attempts to boot from the attached network adapter or Surface Dock. - -#### Hyper-V virtualization platform - -The process of creating a reference image should always be performed in a virtual environment. When you use a virtual machine as the platform to build your reference image, you eliminate the need for installation of additional drivers. The drivers for a Hyper-V virtual machine are included by default in the factory Windows 10 image. When you avoid the installation of additional drivers – especially complex drivers that include application components like control panel applications – you ensure that the image created by your reference image process will be as universally compatible as possible. - ->[!NOTE] ->A Generation 1 virtual machine is recommended for the preparation of a reference image in a Hyper-V virtual environment. - -Because customizations are performed by MDT at the time of deployment, the goal of reference image creation is not to perform customization but to increase performance during deployment by reducing the number of actions that need to occur on each deployed device. The biggest action that can slow down an MDT deployment is the installation of Windows updates. When MDT performs this step during the deployment process, it downloads the updates on each deployed device and installs them. By installing Windows updates in your reference image, the updates are already installed when the image is deployed to the device and the MDT update process only needs to install updates that are new since the image was created or are applicable to products other than Windows (for example, Microsoft Office updates). - - ->[!NOTE] ->Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. - - -#### Surface firmware and drivers - -For your deployed Windows environment to function correctly on your Surface devices, you will need to install the drivers used by Windows to communicate with the components of your device. These drivers are available for download in the Microsoft Download Center for each Surface device. You can find the correct Microsoft Download Center page for your device at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -When you browse to the specific Microsoft Download Center page for your device, you will find a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. Firmware updates maintain the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. For more information, see [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). - ->[!NOTE] ->Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices. - -#### Application installation files - -In addition to the drivers that are used by Windows to communicate with the Surface device’s hardware and components, you will also need to provide the installation files for any applications that you want to install on your deployed Surface devices. To automate the deployment of an application, you will also need to determine the command-line instructions for that application to perform a silent installation. In this article, the Surface app and Microsoft Office 365 will be installed as examples of application installation. The application installation process can be used with any application with installation files that can be launched from command line. - ->[!NOTE] ->If the application files for your application are stored on your organization’s network and will be accessible from your Surface devices during the deployment process, you can deploy that application directly from that network location. To use installation files from a network location, use the **Install Application Without Source Files or Elsewhere on the Network** option in the MDT New Application Wizard, which is described in the [Import applications](#import-applications) section later in this article. - -#### Microsoft Surface Deployment Accelerator - -If you want to deploy only to Surface devices or you want an accelerated method to perform deployment to Surface devices, you can use the Microsoft Surface Deployment Accelerator to generate an MDT deployment share complete with Surface device drivers, Surface apps, and pre-configured task sequences to create a reference image and perform deployment to Surface devices. Microsoft Surface Deployment Accelerator can automatically import boot images into WDS and prepare WDS for network boot (PXE). You can download the Microsoft Surface Deployment Accelerator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. - -### Install the deployment tools - -Before you can configure the deployment environment with Windows images, drivers, and applications, you must first install the deployment tools that will be used throughout the deployment process. The three main tools to be installed are WDS, Windows ADK, and MDT. WDS provides the capacity for network boot, Windows ADK provides several deployment tools that perform specific deployment tasks, and MDT provides automation and a central interface from which to manage and control the deployment process. - -To boot from the network with either your reference virtual machines or your Surface devices, your deployment environment must include a Windows Server environment. The Windows Server environment is required to install WDS and the WDS PXE server. Without PXE support, you will be required to create physical boot media, such as a USB stick to perform your deployment – MDT and Windows ADK will still be required, but Windows Server is not required. Both MDT and Windows ADK can be installed on a Windows client and perform a Windows deployment. - ->[!NOTE] ->To download deployment tools directly to Windows Server, you must disable [Internet Explorer Enhanced Security Configuration](https://technet.microsoft.com/library/dd883248). On Windows Server 2012 R2, this can be performed directly through the **Server Manager** option on the **Local Server** tab. In the **Properties** section, **IE Enhanced Security Configuration** can be found on the right side. You may also need to enable the **File Download** option for the **Internet** zone through the **Security** tab of **Internet Options**. - -#### Install Windows Deployment Services - -Windows Deployment Services (WDS) is a Windows Server role. To add the WDS role to a Windows Server 2012 R2 environment, use the Add Roles and Features Wizard, as shown in Figure 1. Start the Add Roles and Features Wizard from the **Manage** button of **Server Manager**. Install both the Deployment Server and Transport Server role services. - -![Install the Windows Deployment Services role](images/surface-deploymdt-fig1.png "Install the Windows Deployment Services role") - -*Figure 1. Install the Windows Deployment Services server role* - -After the WDS role is installed, you need to configure WDS. You can begin the configuration process from the WDS node of Server Manager by right-clicking your server’s name and then clicking **Windows Deployment Services Management Console**. In the **Windows Deployment Services** window, expand the **Servers** node to find your server, right-click your server, and then click **Configure** in the menu to start the Windows Deployment Services Configuration Wizard, as shown in Figure 2. - -![Configure PXE response for Windows Deployment Services](images/surface-deploymdt-fig2.png "Configure PXE response for Windows Deployment Services") - -*Figure 2. Configure PXE response for Windows Deployment Services* - ->[!NOTE] ->Before you configure WDS make sure you have a local NTFS volume that is not your system drive (C:) available for use with WDS. This volume is used to store WDS boot images, deployment images, and configuration. - -Using the Windows Deployment Services Configuration Wizard, configure WDS to fit the needs of your organization. You can find detailed instructions for the installation and configuration of WDS at [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426). On the **PXE Server Initial Settings** page, be sure to configure WDS so that it will respond to your Surface devices when they attempt to boot from the network. If you have already installed WDS or need to change your PXE server response settings, you can do so on the **PXE Response** tab of the **Properties** of your server in the Windows Deployment Services Management Console. - ->[!NOTE] ->You will add boot images to WDS when you update your boot images in MDT. You do not need to add boot images or Windows images to WDS when you configure the role. - -#### Install Windows Assessment and Deployment Kit - -To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows. - ->[!NOTE] ->You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices. - -When you get to the **Select the features you want to install** page, you only need to select the **Deployment Tools** and **Windows Preinstallation Environment (Windows PE)** check boxes to deploy Windows 10 using MDT, as shown in Figure 3. - -![Required options for deployment with MDT](images/surface-deploymdt-fig3.png "Required options for deployment with MDT") - -*Figure 3. Only Deployment Tools and Windows PE options are required for deployment with MDT* - -#### Install Microsoft Deployment Toolkit - -After the Windows ADK installation completes successfully, you can install MDT. When you download MDT, ensure that you download the version that matches the architecture of your deployment server environment. For Windows Server the architecture is 64-bit. Download the MDT installation file that ends in **x64**. When MDT is installed you can use the default options during the installation wizard, as shown in Figure 4. - -![MDT installation with default options](images/surface-deploymdt-fig4.png "MDT installation with default options") - -*Figure 4. Install the Microsoft Deployment Toolkit with default options* - -Before you can open the MDT Deployment Workbench, you must enable execution of scripts in PowerShell. If you do not do this, the following error message may be displayed: *"Initialization Error PowerShell is required to use the Deployment Workbench. Please install PowerShell then relaunch Deployment Workbench."* - -To enable the execution of scripts, run the following cmdlet in PowerShell as an Administrator: - - `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser` - -## Create a reference image - -Now that you have installed the required tools, you can begin the first step of customizing your deployment environment to your needs – create a reference image. Because the reference image should be created in a virtual machine where there is no need for drivers to be installed, and because the reference image will not include applications, you can use the MDT deployment environment almost entirely with default settings. - -### Create a deployment share - -Now that you have the tools installed, the next step is to configure MDT for the creation of a reference image. Before you can perform the process of creating a reference image, MDT needs to be set up with a repository for scripts, images, and other deployment resources. This repository is known as the *deployment share*. After the deployment share is created, you must supply MDT with a complete set of Windows 10 installation files, the last set of tools required before MDT can perform reference image creation. - -To create the deployment share, follow these steps: - -1. Open the Deployment Workbench from your Start menu or Start screen, as shown in Figure 5. - - ![The MDT Deployment Workbench](images/surface-deploymdt-fig5.png "The MDT Deployment Workbench") - - *Figure 5. The MDT Deployment Workbench* - -2. Right-click the **Deployment Shares** folder, and then click **New Deployment Share** to start the New Deployment Share Wizard, as shown in Figure 6. - - ![Summary page of the New Deployment Share Wizard](images/surface-deploymdt-fig6.png "Summary page of the New Deployment Share Wizard") - - *Figure 6. The Summary page of the New Deployment Share Wizard* - -3. Create a new deployment share with New Deployment Share Wizard with the following steps: - - * **Path** – Specify a local folder where the deployment share will reside, and then click **Next**. - - >[!NOTE] - >Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume. - - * **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**. - - >[!NOTE] - >The share name cannot contain spaces. - - >[!NOTE] - >You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer. - - * **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench. - * **Options** – You can accept the default options on this page. Click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the deployment share. - * **Progress** – While the deployment share is being created, a progress bar is displayed on this page to indicate the status of the deployment share creation process. - * **Confirmation** – When the deployment share creation process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Deployment Share Wizard. - -4. When the New Deployment Share Wizard is complete, you can expand the Deployment Shares folder to find your newly created deployment share. -5. You can expand your deployment share, where you will find several folders for the resources, scripts, and components of your MDT deployment environment are stored. - -To secure the deployment share and prevent unauthorized access to the deployment resources, you can create a local user on the deployment share host and configure permissions for that user to have read-only access to the deployment share only. It is especially important to secure access to the deployment share if you intend to automate the logon to the deployment share during the deployment boot process. By automating the logon to the deployment share during the boot of deployment media, the credentials for that logon are stored in plaintext in the bootstrap.ini file on the boot media. - ->[!NOTE] ->If you intend to capture images (such as the reference image) with this user, the user must also have write permission on the Captures folder in the MDT deployment share. - -You now have an empty deployment share that is ready for you to add the resources that will be required for reference image creation and deployment to Surface devices. - -### Import Windows installation files - -The first resources that are required to perform a deployment of Windows are the installation files from Windows 10 installation media. Even if you have an already prepared reference image, you still need to supply the unaltered installation files from your installation media. The source of these files can be a physical disk, or it can be an ISO file like the download from the Volume Licensing Service Center (VLSC). - ->[!NOTE] ->A 64-bit operating system is required for compatibility with Surface devices except Surface Pro X which cannot be managed with MDT. - -To import Windows 10 installation files, follow these steps: - -1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench, and then click **New Folder** to open the **New Folder** page, as shown in Figure 7. - - ![Create a new folder on the New Folder page](images/surface-deploymdt-fig7.png "Create a new folder on the New Folder page") - - *Figure 7. Create a new folder on the New Folder page* - -2. On the **New Folder** page a series of steps is displayed, as follows: - * **General Settings** – Enter a name for the folder in the **Folder Name** field (for example, Windows 10 Enterprise), add any comments you want in the **Comments** field, and then click **Next**. - * **Summary** – Review the specified configuration of the new folder on this page, and then click **Next**. - * **Progress** – A progress bar will be displayed on this page while the folder is created. This page will likely pass very quickly. - * **Confirmation** – When the new folder has been created, a **Confirmation** page displays the success of the operation. Click **Finish** to close the **New Folder** page. -3. Expand the Operating Systems folder to see the newly created folder. -4. Right-click the newly created folder, and then click **Import Operating System** to launch the Import Operating System Wizard, as shown in Figure 8. - - ![Import source files with the Import Operating System Wizard](images/surface-deploymdt-fig8.png "Import source files with the Import Operating System Wizard") - - *Figure 8. Import source files with the Import Operating System Wizard* - -5. The Import Operating System Wizard walks you through the import of your operating system files, as follows: - * **OS Type** – Click **Full Set of Source Files** to specify that you are importing the Windows source files from installation media, and then click **Next**. - * **Source** – Click **Browse**, move to and select the folder or drive where your installation files are found, and then click **Next**. - * **Destination** – Enter a name for the new folder that will be created to hold the installation files, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the installation files are imported, a progress bar is displayed on this page. - * **Confirmation** – When the operating system import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Operating System Wizard. -6. Expand the folder you created in Step 1 to see the entry for your newly imported installation files for Windows 10. - -Now that you’ve imported the installation files from the installation media, you have the files that MDT needs to create the reference image and you are ready to instruct MDT how to create the reference image to your specifications. - -### Create reference image task sequence - -As described in the [Deployment tools](#deployment-tools) section of this article, the goal of creating a reference image is to keep the Windows environment as simple as possible while performing tasks that would be common to all devices being deployed. You should now have a basic MDT deployment share configured with default options and a set of unaltered, factory installation files for Windows 10. This simple configuration is perfect for reference image creation because the deployment share contains no applications or drivers to interfere with the process. - ->[!NOTE] ->For some organizations keeping a simple deployment share without applications or drivers is the simplest solution for creation of reference images. You can easily connect to more than one deployment share from a single Deployment Workbench and copy images from a simple, reference-image-only deployment share to a production deployment share complete with drivers and applications. - -To create the reference image task sequence, follow these steps: - -1. Right-click the **Task Sequences** folder under your deployment share in the Deployment Workbench, and then click **New Task Sequence** to start the New Task Sequence Wizard, as shown in Figure 9. - - ![Create new task sequence to deploy and update a Windows 10 reference environment](images/surface-deploymdt-fig9.png "Create new task sequence to deploy and update a Windows 10 reference environment") - - *Figure 9. Create a new task sequence to deploy and update a Windows 10 reference environment* - -2. The New Task Sequence Wizard presents a series of steps, as follows: - * **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - * **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. - * **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**. - * **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**. - * **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**. - >[!NOTE] - >During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - * **Progress** – While the task sequence is created, a progress bar is displayed on this page. - * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard. -3. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -4. Select the **Task Sequence** tab to view the steps that are included in the Standard Client Task Sequence template, as shown in Figure 10. - - ![Enable Windows Update in the reference image task sequence](images/surface-deploymdt-fig10.png "Enable Windows Update in the reference image task sequence") - - *Figure 10. Enable Windows Update in the reference image task sequence* - -5. Select the **Windows Update (Pre-Application Installation)** option, located under the **State Restore** folder. -6. Click the **Options** tab, and then clear the **Disable This Step** check box. -7. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option. -8. Click **OK** to apply changes to the task sequence, and then close the task sequence properties window. - -### Generate and import MDT boot media - -To boot the reference virtual machine from the network, the MDT deployment share first must be updated to generate boot media with the resources that have been added in the previous sections. - -To update the MDT boot media, follow these steps: - -1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard, as shown in Figure 11. - - ![Generate boot images with the Update Deployment Share Wizard](images/surface-deploymdt-fig11.png "Generate boot images with the Update Deployment Share Wizard") - - *Figure 11. Generate boot images with the Update Deployment Share Wizard* - -2. Use the Update Deployment Share Wizard to create boot images with the following process: - * **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**. - >[!NOTE] - >Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page. - * **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images. - * **Progress** – While the boot images are being generated, a progress bar is displayed on this page. - * **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard. -3. Confirm that boot images have been generated by navigating to the deployment share in File Explorer and opening the Boot folder. The following files should be displayed, as shown in Figure 12: - * **LiteTouchPE_x86.iso** - * **LiteTouchPE_x86.wim** - * **LiteTouchPE_x64.iso** - * **LiteTouchPE_x64.wim** - - - ![Boot images in the Boot folder after Update Deployment Share Wizard completes](images/surface-deploymdt-fig12.png "Boot images in the Boot folder after Update Deployment Share Wizard completes") - - *Figure 12. Boot images displayed in the Boot folder after completion of the Update Deployment Share Wizard* - -To import the MDT boot media into WDS for PXE boot, follow these steps: - -1. Open Windows Deployment Services from the Start menu or Start screen. -2. Expand **Servers** and your deployment server. -3. Click the **Boot Images** folder, as shown in Figure 13. - - ![Start the Add Image Wizard from the Boot Images folder](images/surface-deploymdt-fig13.png "Start the Add Image Wizard from the Boot Images folder") - - *Figure 13. Start the Add Image Wizard from the Boot Images folder* - -4. Right-click the **Boot Images** folder, and then click **Add Boot Image** to open the Add Image Wizard, as shown in Figure 14. - - ![Import the LiteTouchPE_x86.wim MDT boot image](images/surface-deploymdt-fig14.png "Import the LiteTouchPE_x86.wim MDT boot image") - - *Figure 14. Import the LiteTouchPE_x86.wim MDT boot image* - -5. The Add Image Wizard displays a series of steps, as follows: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, click **Open**, and then click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. - ->[!NOTE] ->Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine. - -If your WDS configuration is properly set up to respond to PXE clients, you should now be able to boot from the network with any device with a network adapter properly configured for network boot (PXE). - ->[!NOTE] ->If your WDS server resides on the same server as DHCP or in a different subnet than the devices you are attempting to boot, additional configuration may be required. For more information, see [Managing Network Boot Programs](https://technet.microsoft.com/library/cc732351). - -### Deploy and capture a reference image - -Your deployment environment is now set up to create a reference image for Windows 10 complete with Windows Updates. - ->[!NOTE] ->You cannot install version updates (such as Windows 10, Version 1511) in a reference image. To create a reference image with a new version of Windows, you must use installation files from that version of Windows. When you install a version update in Windows, it effectively performs an upgrade to a new version of Windows, and upgraded installations of Windows cannot be prepared for deployment with Sysprep.

      -By using a fully automated task sequence in an MDT deployment share dedicated to reference image creation, you can greatly reduce the time and effort required to create new reference images and it is the best way to ensure that your organization is ready for feature updates and new versions of Windows 10. - -You can now boot from the network with a virtual machine to run the prepared task sequence and generate a reference image. When you prepare your virtual machine in Hyper-V for reference image creation, consider the following: - -* Use a Generation 1 virtual machine for the simplicity of drivers and to ensure maximum compatibility with both BIOS and UEFI devices. -* Ensure your virtual machine has at least 1 GB of system memory at boot. You can ensure that the virtual machine has at least 1 GB of memory at boot but allow the memory to adjust after boot by using Dynamic Memory. You can read more about Dynamic Memory in the [Hyper-V Dynamic Memory Overview](https://technet.microsoft.com/library/hh831766). -* Ensure your virtual machine uses a legacy network adapter to support network boot (PXE); that network adapter should be connected to the same network as your deployment server, and that network adapter should receive an IP address automatically via DHCP. -* Configure your boot order such that PXE Boot is the first option. - -When your virtual machine (VM) is properly configured and ready, start or boot the VM and be prepared to press the F12 key when prompted to boot via PXE from the WDS server. - -Perform the reference image deployment and capture using the following steps: - -1. Start your virtual machine and press the F12 key when prompted to boot to the WDS server via PXE, as shown in Figure 15. - - ![Start network boot by pressing the F12 key](images/surface-deploymdt-fig15.png "Start network boot by pressing the F12 key") - - *Figure 15. Start network boot by pressing the F12 key* - -2. Click **Run the Deployment Wizard to Install a New Operating System** to begin the MDT deployment process. -3. Enter your MDT username and password, a user with rights to access the MDT deployment share over the network and with rights to write to the Captures folder in the deployment share. -4. After your credentials are validated, the Windows Deployment Wizard will start and process the boot and deployment share rules. -5. The Windows Deployment Wizard displays a series of steps, as follows: - * **Task Sequence** – Select the task sequence you created for reference image creation (it should be the only task sequence available), and then click **Next**. - * **Computer Details** – Leave the default computer name, workgroup name, and the **Join a Workgroup** option selected, and then click **Next**. The computer name and workgroup will be reset when the image is prepared by Sysprep and captured. - * **Move Data and Settings** – Leave the default option of **Do Not Move User Data and Settings** selected, and then click **Next**. - * **User Data (Restore)** – Leave the default option of **Do Not Restore User Data and Settings** selected, and then click **Next**. - * **Locale and Time** – Leave the default options for language and time settings selected. The locale and time settings will be specified during deployment of the image to other devices. Click **Next**. - * **Capture Image** – Click the **Capture an Image of this Reference Computer** option, as shown in Figure 16. In the **Location** field, keep the default location of the Captures folder. You can keep or change the name of the image file in the **File Name** field. When you are finished, click **Next**. - - ![Capture an image of the reference machine](images/surface-deploymdt-fig16.png "Capture an image of the reference machine") - - *Figure 16. Use the Capture Image page to capture an image of the reference machine after deployment* - - * **Ready** – You can review your selections by expanding **Details** on the **Ready** page. Click **Begin** when you are ready to perform the deployment and capture of your reference image. - -6. Your reference task sequence will run with the specified options. - -As the task sequence processes the deployment, it will automatically perform the following tasks: -* Install the Windows 10 image from the installation files you supplied -* Reboot into Windows 10 -* Run Windows updates until all Windows updates have been installed and the Windows environment is fully up to date -* Run Sysprep and prepare the Windows 10 environment for deployment -* Reboot into WinPE -* Capture an image of the Windows 10 environment and store it in the Captures folder in the MDT deployment share - ->[!NOTE] ->The Windows Update process can take some time to complete as it searches the Internet for updates, downloads those updates, and then installs them. By performing this process now, in the reference environment, you eliminate the need to perform these tasks on each deployed device and significantly reduce the amount of time and bandwidth required to perform your deployment. - -When the task sequence completes, your virtual machine will be off and a new reference image complete with updates will be ready in your MDT deployment share for you to import it and prepare your deployment environment for deployment to Surface devices. - -## Deploy Windows 10 to Surface devices - -With a freshly prepared reference image, you are now ready to configure the deployment process for deployment to the Surface devices. Use the steps detailed in this section to produce a deployment process that requires minimal effort on each Surface device to produce a complete and ready-to-use Windows 10 environment. - -### Import reference image - -After the reference image has been created and stored in the Captures folder, you need to add it to your MDT deployment share as an image for deployment. You perform this task by using the same process that you used to import the installation files for Windows 10. - -To import the reference image for deployment, use the following steps: - -1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench or the folder you created in when you imported Windows 10 installation files, and then click **Import Operating System** to start the Import Operating System Wizard. -2. Import the custom image with the Import Operating System Wizard by using the following steps: - * **OS Type** – Select Custom Image File to specify that you are importing the Windows source files from installation media, and then click **Next**. - * **Image** – Click **Browse**, and then navigate to and select the image file in the **Captures** folder in your deployment share. Select the **Move the Files to the Deployment Share Instead of Copying Them** checkbox if desired. Click **Next**. - * **Setup** – Click **Setup Files are not Neededf**, and then click **Next**. - * **Destination** – Enter a name for the new folder that will be created to hold the image file, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the image is imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard. -3. Expand the folder in which you imported the image to verify that the import completed successfully. - ->[!NOTE] ->You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media. - -Now that your updated reference image is imported, it is time to prepare your deployment environment for deployment to Surface devices complete with drivers, applications, and automation. - -### Import Surface drivers - -Before you can deploy your updated reference image to Surface devices, or any physical environment, you need to supply MDT with the drivers that Windows will use to communicate with that physical environment. For Surface devices you can download all of the drivers required by Windows in a single archive (.zip) file in a format that is ready for deployment. In addition to the drivers that are used by Windows to communicate with the hardware and components, Surface firmware and driver packs also include updates for the firmware of those components. By installing the Surface firmware and driver pack, you will also bring your device’s firmware up to date. If you have not done so already, download the drivers for your Surface device listed at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). - -Many devices require that you import drivers specifically for WinPE in order for the MDT boot media to communicate with the deployment share and to boot properly on that device. Even Surface Pro 3 required that network drivers be imported specifically for WinPE for deployment of Windows 8.1. Fortunately, for Windows 10 deployments to Surface devices, all of the required drivers for operation of WinPE are contained within the out-of-box drivers that are built into Windows 10. It is still a good idea to prepare your environment with folder structure and selection profiles that allow you to specify drivers for use in WinPE. You can read more about that folder structure in **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec05). - -To import the Surface drivers (in this example, Surface Pro 4) into MDT, follow these steps: - -1. Extract the downloaded archive (.zip) file to a folder that you can easily locate. Keep the driver files separate from other drivers or files. -2. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. -3. If you have not already created a folder structure by operating system version, you should do so now and create under the Windows 10 x64 folder a new folder for Surface Pro 4 drivers named Surface Pro 4. Your Out-of-Box Drivers folder should resemble the following structure, as shown in Figure 17: - * WinPE x86 - * WinPE x64 - * Windows 10 x64 - * Microsoft Corporation - * Surface Pro 4 - - ![Recommended folder structure for drivers](images/surface-deploymdt-fig17.png "Recommended folder structure for drivers") - - *Figure 17. The recommended folder structure for drivers* - -4. Right-click the **Surface Pro 4** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 18. - - ![Progress page during drivers import](images/surface-deploymdt-fig18.png "Progress page during drivers import") - - *Figure 18. The Progress page during drivers import* - -5. The Import Driver Wizard displays a series of steps, as follows: - * **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 4 firmware and drivers in Step 1. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the drivers are imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard. -6. Click the **Surface Pro 4** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 19. - - ![Drivers for Surface Pro 4 imported and organized in the MDT deployment share](images/surface-deploymdt-fig19.png "Drivers for Surface Pro 4 imported and organized in the MDT deployment share") - - *Figure 19. Drivers for Surface Pro 4 imported and organized in the MDT deployment share* - -### Import applications - -You can import any number of applications into MDT for installation on your devices during the deployment process. You can configure your applications and task sequences to prompt you during deployment to pick and choose which applications are installed, or you can use your task sequence to explicitly define which applications are installed. For more information, see **Step 4: Add an application** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec04). - -#### Import Microsoft Office 365 Installer - -The Office Deployment Tool is a free download available in the Microsoft Download Center that allows IT professionals and system administrators to download and prepare Office installation packages for Office Click-to-Run. You can find the Office Deployment Tool and instructions to download Click-to-Run for Office 365 installation source files at [Download Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/library/jj219424). - -Download and install the version of Office Deployment Tool (ODT), for Office 2013 or Office 2016, that fits your organization’s needs and use the steps provided by that page to download the Office installation files for use with MDT. - -After you have downloaded the source files for your version of Office Click-to-Run, you need to edit the Configuration.xml file with instructions to install Office Click-to-Run silently. To configure the Office Deployment Tool for silent installation, follow these steps: - -1. Right-click the existing **Configuration.xml** file, and then click **Edit**. -2. This action opens the file in Notepad. Replace the existing text with the following: - ``` - - - - - - - - ``` - -3. Save the file. - -The default behavior of Setup.exe is to look for the source files in the path that contains **Setup.exe**. If the installation files are not found in this folder, the Office Deployment Tool will default to online source files from an Internet connection. - -For MDT to perform an automated installation of office, it is important to configure the **Display Level** option to a value of **None**. This setting is used to suppress the installation dialog box for silent installation. It is required that the **AcceptEULA** option is set to **True** to accept the license agreement when the **Display Level** option is set to **None**. With both of these options configured, the installation of Office will occur without the display of dialog boxes which could potentially cause the installation to pause until a user can address an open dialog box. - -Now that the installation and configuration files are prepared, the application can be imported into the deployment share by following these steps: - -1. Open the Deployment Workbench. -2. Expand the deployment share, right-click the **Applications** folder, and then click **New Application** to start the New Application Wizard, as shown in Figure 20. - - ![Enter the command and directory for Office 2016 Click-to-Run](images/surface-deploymdt-fig20.png "Enter the command and directory for Office 2016 Click-to-Run") - - *Figure 20. Enter the command and directory for Office 2016 Click-to-Run* - -3. The New Application Wizard walks you through importing the Office 2016 Click-to-Run files, as follows: - * **Application Type** – Click **Application with Source Files**, and then click **Next**. - * **Details** – Enter a name for the application (for example, Office 2016 Click-to-Run) in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**. - * **Source** – Click **Browse** to navigate to and select the folder where you downloaded the Office installation files with the Office Deployment Tool, and then click **Next**. - * **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name. - * **Command Details** – Enter the Office Deployment Tool installation command line: - - `Setup.exe /configure configuration.xml` - - * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - * **Progress** – While the installation files are imported, a progress bar is displayed on this page. - * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard. - -4. You should now see the **Office 2016 Click-to-Run** item under the **Applications** folder in the Deployment Workbench. - -#### Import Surface app installer - -The Surface app is a Microsoft Store app that provides the user with greater control over specific Surface device functions and capabilities (for example, control over the sensitivity of the Surface Pen). It is a highly recommended app for Surface devices to provide end users with the best experience and greatest control over their device. Find out more about the Surface app at [Install and use the Surface app](https://www.microsoft.com/surface/support/apps-and-windows-store/surface-app?os=windows-10). - -To perform a deployment of the Surface app, you will need to download the app files through Microsoft Store for Business. You can find detailed instructions on how to download the Surface app through Microsoft Store for Business at [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business). - -After you have downloaded the installation files for Surface app, including the AppxBundle and license files, you can import these files into the deployment share through the same process as a desktop application like Microsoft Office. Both the AppxBundle and license files must be together in the same folder for the import process to complete successfully. Use the following command on the **Command Details** page to install the Surface app: - ``` -DISM.exe /Online /Add-ProvisionedAppxPackage /PackagePath: Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle /LicensePath: Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml - ``` - -### Create deployment task sequence - -The next step in the process is to create the deployment task sequence. This task sequence will be configured to completely automate the deployment process and will work along with customized deployment share rules to reduce the need for user interaction down to a single touch. Before you can make customizations to include all of this automation, the new task sequence has to be created from a template. - -To create the deployment task sequence, follow these steps: -1. In the Deployment Workbench, under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. -2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: - * **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - * **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**. - * **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**. - * **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. - * **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**. - * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - * **Progress** – While the task sequence is being created, a progress bar is displayed on this page. - * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard. - -After the task sequence is created it can be modified for increased automation, such as the installation of applications without user interaction, the selection of drivers, and the installation of Windows updates. - -1. Click the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -2. Click the **Task Sequence** tab to view the steps that are included in the new task sequence. -3. Click the **Windows Update (Pre-Application Installation)** step, located under the **State Restore** folder. -4. Click the **Options** tab, and then clear the **Disable This Step** check box. -5. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option. -6. Between the two **Windows Update** steps is the **Install Applications** step. Click the **Install Applications** step, and then click **Add**. -7. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 21. - - ![A new Install Application step in the deployment task sequence](images/surface-deploymdt-fig21.png "A new Install Application step in the deployment task sequence") - - *Figure 21. A new Install Application step in the deployment task sequence* - -8. On the **Properties** tab of the new **Install Application** step, enter **Install Microsoft Office 2016 Click-to-Run** in the **Name** field. -9. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**. -11. Repeat Steps 6 through 10 for the Surface app. -12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step. -13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. -14. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 22), configure the following options: - * **Name** – Set DriverGroup001 - * **Task Sequence Variable** – DriverGroup001 - * **Value** – Windows 10 x64\%Make%\%Model% - - ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-deploymdt-fig22.png "Configure a new Set Task Sequence Variable step in the deployment task sequence") - - *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence* - -15. Select the **Inject Drivers** step, the next step in the task sequence. -16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: - * In the **Choose a selection profile** drop-down menu, select **Nothing**. - * Click the **Install all drivers from the selection profile** button. - - ![Configure deployment task sequence not to choose the drivers to inject into Windows](images/surface-deploymdt-fig23.png "Configure deployment task sequence not to choose the drivers to inject into Windows") - - *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows* - -17. Click **OK** to apply changes to the task sequence and close the task sequence properties window. - -### Configure deployment share rules - -The experience of users during a Windows deployment is largely governed by a set of rules that control how the MDT and Windows Deployment Wizard experience should proceed. These rules are stored in two configuration files. Boot media rules are stored in the Bootstrap.ini file that is processed when the MDT boot media is first run. Deployment share rules are stored in the Customsettings.ini file and tell the Windows Deployment Wizard how to operate (for example, what screens to show and what questions to ask). By using these the rules stored in these two files, you can completely automate the process of deployment to where you will not be asked to supply the answer to any questions during deployment and the deployment will perform all tasks completely on its own. - -#### Configure Bootstrap.ini - -Bootstrap.ini is the simpler of the two rule files. The purpose it serves is to provide instructions from when the MDT boot media starts on a device until the Windows Deployment Wizard is started. The primary use of this file is to provide the credentials that will be used to log on to the deployment share and start the Windows Deployment Wizard. - -To automate the boot media rules, follow these steps: - -1. Right-click your deployment share in the Deployment Workbench, and then click **Properties**. -2. Click the **Rules** tab, and then click **Edit Bootstrap.ini** to open Bootstrap.ini in Notepad. -3. Replace the text of the Bootstrap.ini file with the following text: - - ``` - [Settings] - Priority=Model,Default - - [Surface Pro 4] - DeployRoot=\\STNDeployServer\DeploymentShare$ - UserDomain=STNDeployServer - UserID=MDTUser - UserPassword=P@ssw0rd - SkipBDDWelcome=YES - - [Surface Pro 4] - DeployRoot=\\STNDeployServer\DeploymentShare$ - ``` - -4. Press Ctrl+S to save Bootstrap.ini, and then close Notepad. - -You can use a number of variables in both boot media and deployment share rules to apply rules only when certain conditions are met. For example, you can use MAC addresses to identify specific machines where MDT will run fully automated, but will run with required user interaction on all other devices. You can also use the model of the device to instruct the MDT boot media to perform different actions based on computer model, much as the way **[Surface Pro 4]** is listed in Step 3. You can use the following cmdlet in a PowerShell session to see what the Model variable would be on a device: - -```wmic csproduct get name``` - -Rules used in the text shown in Step 3 include: - -* **DeployRoot** – Used to specify the deployment share that the MDT boot media will connect to. -* **UserDomain** – Used to specify the domain or computer where the MDT user account is located. -* **UserID** – Used to specify the MDT user account for automatic logon to the deployment share. -* **UserPassword** – Used to specify the MDT user password for automatic logon to the deployment share. -* **SkipBDDWelcome** – Used to skip the Welcome page and to start the Windows Deployment Wizard immediately using the specified credentials and deployment share. - -#### Configure CustomSettings.ini - -The bulk of the rules used to automate the MDT deployment process are stored in the deployment share rules, or the Customsettings.ini file. In this file you can answer and hide all of the prompts from the Windows Deployment Wizard, which yields a deployment experience that mostly consists of a progress bar that displays the automated actions occurring on the device. The deployment share rules are shown directly in the **Rules** tab of the deployment share properties, as shown in Figure 24. - -![Deployment share rules configured for automation of the Windows Deployment Wizard](images/surface-deploymdt-fig24.png "Deployment share rules configured for automation of the Windows Deployment Wizard") - -*Figure 24. Deployment share rules configured for automation of the Windows Deployment Wizard* - -To configure automation for the production deployment, copy and paste the following text into the text box on the **Rules** tab of your deployment share properties: - - ``` -[Settings] -Priority=Model,Default -Properties=MyCustomProperty - -[Surface Pro 4] -SkipTaskSequence=YES -TaskSequenceID=Win10SP4 - -[Default] -OSInstall=Y -SkipCapture=YES -SkipAdminPassword=YES -SkipProductKey=YES -SkipComputerBackup=YES -SkipBitLocker=YES -SkipBDDWelcome=YES -SkipUserData=YES -UserDataLocation=AUTO -SkipApplications=YES -SkipPackageDisplay=YES -SkipComputerName=YES -SkipDomainMembership=YES -JoinDomain=contoso.com -DomainAdmin=MDT -DomainAdminDomain=contoso -DomainAdminPassword=P@ssw0rd -SkipLocaleSelection=YES -KeyboardLocale=en-US -UserLocale=en-US -UILanguage=en-US -SkipTimeZone=YES -TimeZoneName=Pacific Standard Time -UserID=MDTUser -UserDomain=STNDeployServer -UserPassword=P@ssw0rd -SkipSummary=YES -SkipFinalSummary=YES -FinishAction=LOGOFF - ``` -Rules used in this example include: - -* **SkipTaskSequence** – This rule is used to skip the **Task Sequence** page where the user would have to select between available task sequences. -* **TaskSequenceID** – This rule is used to instruct the Windows Deployment Wizard to run a specific task sequence. In this scenario the task sequence ID should match the deployment task sequence you created in the previous section. -* **OSInstall** – This rule indicates that the Windows Deployment Wizard will be performing an operating system deployment. -* **SkipCapture** – This rule prevents the **Capture Image** page from being displayed, prompting the user to create an image of this device after deployment. -* **SkipAdminPassword** – This rule prevents the **Admin Password** page from being displayed. The Administrator password specified in the task sequence will still be applied. -* **SkipProductKey** – This rule prevents the **Specify Product Key** page from being displayed. The product key specified in the task sequence will still be applied. -* **SkipComputerBackup** – This rule prevents the **Move Data and Settings** page from being displayed, where the user is asked if they would like to make a backup of the computer before performing deployment. -* **SkipBitLocker** – This rule prevents the **BitLocker** page from being displayed, where the user is asked if BitLocker Drive Encryption should be used to encrypt the device. -* **SkipBDDWelcome** – This rule prevents the **Welcome** page from being displayed, where the user is prompted to begin Windows deployment. -* **SkipUserData** – This rule prevents the **User Data (Restore)** page from being displayed, where the user is asked to restore previously backed up user data in the new environment. -* **UserDataLocation** – This rule prevents the user from being prompted to supply a location on the User Data (Restore) page. -* **SkipApplications** – This rule prevents the **Applications** page from being displayed, where the user is prompted to select from available applications to be installed in the new environment. -* **SkipPackageDisplay** – This rule prevents the **Packages** page from being displayed, where the user is prompted to select from available packages to be installed in the new environment. -* **SkipComputerName** – This rule, when combined with the **SkipDomainMembership** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup. -* **SkipDomainMembership** – This rule, when combined with the **SkipComputerName** rule, prevents the **Computer Details** page from being displayed, where the user is asked to supply computer name and join a domain or workgroup. -* **JoinDomain** – This rule instructs the Windows Deployment Wizard to have the computer join the specified domain using the specified credentials. -* **DomainAdmin** – This rule specifies the username for the domain join operation. -* **DomainAdminDomain** – This rule specifies the domain for the username for the domain join operation. -* **DomainAdminPassword** – This rule specifies the password for the username for the domain join operation. -* **SkipLocaleSelection** – This rule, along with the **SkipTimeZone** rule, prevents the **Locale and Time** page from being displayed. -* **KeyboardLocale** – This rule is used to specify the keyboard layout for the deployed Windows environment. -* **UserLocale** – This rule is used to specify the geographical locale for the deployed Windows environment. -* **UILanguage** – This rule is used to specify the language to be used in the deployed Windows environment. -* **SkipTimeZone** – This rule, along with the **SkipLocaleSelection** rule, prevents the **Locale and Time** page from being displayed. -* **TimeZoneName** – This rule is used to specify the time zone for the deployed Windows environment. -* **UserID** – This rule is used to supply the username under which the MDT actions and task sequence steps are performed. -* **UserDomain** – This rule is used to supply the domain for the username under which the MDT actions and task sequence steps are performed. -* **UserPassword** – This rule is used to supply the password for the username under which the MDT actions and task sequence steps are performed. -* **SkipSummary** – This rule prevents the **Summary** page from being displayed before the task sequence is run, where the user is prompted to confirm the selections before beginning the task sequence. -* **SkipFinalSummary** – This rule prevents the **Summary** page from being displayed when the task sequence has completed. -* **FinishAction** – This rule specifies whether to log out, reboot, or shut down the device after the task sequence has completed. - -You can read about all of the possible deployment share and boot media rules in the [Microsoft Deployment Toolkit Reference](https://technet.microsoft.com/library/dn781091). - -### Update and import updated MDT boot media - -The process to update MDT boot media with these new rules and changes to the deployment share is very similar to the process to generate boot media from scratch. - -To update the MDT boot media, follow these steps: - -1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard. -2. The Update Deployment Share Wizard displays a series of steps, as follows: - * **Options** – Choose between the **Completely Regenerate the Boot Images** or **Optimize the Boot Image Updating Process** options. Completely regenerating the boot images will take more time, but produces boot media that is not fragmented and does not contain out of date components. Optimizing the boot image updating process will proceed more quickly, but may result in longer load times when booting via PXE. Click **Next**. - * **Summary** – Review the specified options on this page before you click **Next** to begin the update of boot images. - * **Progress** – While the boot images are being updated a progress bar is displayed on this page. - * **Confirmation** – When the boot images have been updated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard. - -To import the updated MDT boot media into WDS for PXE boot, follow these steps: - -1. Open Windows Deployment Services from the Start menu or Start screen. -2. Expand **Servers** and your deployment server. -3. Click the **Boot Images** folder. -4. Right-click the existing MDT boot image, and then click **Replace Image** to open the Replace Boot Image Wizard. -5. Replace the previously imported MDT boot image with the updated version by using these steps in the Replace Boot Image Wizard: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, and then click **Open**. Click **Next**. - * **Available Images** – Only one image should be listed and selected **LiteTouch Windows PE (x86)**, click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections for importing a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Replace Boot Image Wizard. -6. Right-click the **Boot Images** folder, and then click **Add Image** to open the Add Image Wizard. -7. Add the new 64-bit boot image for 64-bit UEFI device compatibility with the Add Image Wizard , as follows: - * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, select **LiteTouchPE_x64.wim**, and then click **Open**. Click **Next**. - * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options. - * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**. - * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard. - ->[!NOTE] ->Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices. - -### Deploy Windows to Surface - -With all of the automation provided by the deployment share rules and task sequence, performing the deployment on each Surface device becomes as easy as a single touch. - ->[!NOTE] ->For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25. - -![Set boot priority for PXE boot](images/surface-deploymdt-fig25.png "Set boot priority for PXE boot") - -*Figure 25. Setting boot priority for PXE boot* - -On a properly configured Surface device, simply turn on the device and press Enter when you are prompted to boot from the network. The fully automated MDT deployment process will then take over and perform the following tasks: - -* The MDT boot media will be loaded to your Surface device via the network -* The MDT boot media will use the provided credentials and rules to connect to the MDT deployment share -* The task sequence and drivers will be automatically selected for your device via make and model information -* The task sequence will deploy your updated Windows 10 image to the device complete with the selected drivers -* The task sequence will join your device to the domain -* The task sequence will install the applications you specified, Microsoft Office and Surface app -* Windows Update will run, installing any new Windows Updates or updates for installed applications, like Microsoft Office -* The task sequence will complete silently and log out of the device - ->[!NOTE] ->For Surface devices not configured to boot to the network as the first boot option, you can hold Volume Down and press Power to boot the system immediately to a USB or network device. - -The resulting configuration is a Surface device that is logged out and ready for an end user to enter their credentials, log on, and get right to work. The applications and drivers they need are already installed and up to date. - - +> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) +For the latest information about using MDT, refer to [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt). diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md index f483ed4583..82e6317686 100644 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md @@ -13,6 +13,7 @@ ms.localizationpriority: medium ms.audience: itpro ms.reviewer: manager: laurawi +ms.date: 04/24/2020 --- # Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit @@ -37,216 +38,7 @@ manager: laurawi - Surface Pro - Windows 10 -In addition to the traditional deployment method of reimaging devices, administrators that want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. The process described in this article shows how to perform a Windows 10 upgrade deployment to Surface devices. +In addition to the traditional deployment method of reimaging devices, administrators who want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. -If you are not already familiar with the deployment of Windows or the Microsoft deployment tools and technologies, you should read [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) and familiarize yourself with the traditional deployment method before you proceed. +For the latest information about upgrading surface devices using MDT, refer to [Perform an in-place upgrade to Windows 10 with MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit) -#### The upgrade concept - -When you use the factory installation media to install Windows on a device, you are presented with two options or *installation paths* to install Windows on that device. The first of these installation paths – *clean installation* – allows you to apply a factory image of Windows to that device, including all default settings. The second of these installation paths – *upgrade* – allows you to apply Windows to the device but retains the device’s users, apps, and settings. - -When you perform a Windows deployment using traditional deployment methods, you follow an installation path that is very similar to a clean installation. The primary difference between the clean installation and the traditional deployment method of *reimaging* is that with reimaging, you can apply an image that includes customizations. Microsoft deployment technologies, such as the Microsoft Deployment Toolkit (MDT), expand the capabilities of the reimaging process by modifying the image during deployment. For example, MDT is able to inject drivers for a specific hardware configuration during deployment, and with pre and post imaging scripts to perform a number of tasks, such as the installation of applications. - -For versions of Windows prior to Windows 10, if you wanted to install a new version of Windows on your devices and preserve the configuration of those systems, you had to perform additional steps during your deployment. For example, if you wanted to keep the data of users on the device, you had to back up user data with the User State Migration Tool (USMT) prior to the deployment and restore that data after the deployment had completed. - -Introduced with Windows 10 and MDT 2013 Update 1, you can use the upgrade installation path directly with Microsoft deployment technologies such as the Microsoft Deployment Toolkit (MDT). With an upgrade deployment you can use the same deployment technologies and process, but you can preserve users settings, and applications of the existing environment on the device. - -> [!NOTE] -> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) - -## Deployment tools and resources - -Performing an upgrade deployment of Windows 10 requires the same tools and resources that are required for a traditional reimaging deployment. You can read about the tools required, including detailed explanations and installation instructions, in [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md). To proceed with the upgrade deployment described in this article, you will need the following tools installed and configured: - -* [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741) -* [Windows Assessment and Deployment Kit (Windows ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk), which includes: - * Deployment Image Servicing and Management (DISM) - * Windows Preinstallation Environment (Windows PE) - * Windows System Image Manager (Windows SIM) - -You will also need to have available the following resources: - -* Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx) - - >[!NOTE] - >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. -* [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 - -* Application installation files for any applications you want to install, such as the Surface app - -## Prepare the upgrade deployment - -Before you begin the process described in this section, you need to have installed and configured the deployment tools outlined in the previous [Deployment tools and resources](#deployment-tools-and-resources) section. For instructions on how to install and configure the deployment tools, see the **Install the deployment tools** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#install-the-deployment-tools) article. You will also have needed to create a deployment share with MDT, described in the section Create a Deployment Share in the aforementioned article. - -### Import Windows 10 installation files - -Windows 10 installation files only need to be imported if you have not already done so in the deployment share. To import Windows 10 installation files, follow the steps described in the **Import Windows installation files** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#import-windows-installation-files) article. - -### Import Surface drivers -In the import process example shown in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, drivers for Surface Pro 4 were imported for Windows 10. To perform an upgrade deployment of Windows 10 to Surface Pro 3, drivers for Surface Pro 3 must also be imported. To import the Surface drivers for Surface Pro 3, follow these steps: - -1. Download the Surface Pro 3 firmware and driver pack for Windows 10 archive file (.zip), SurfacePro3_Win10_xxxxxx.zip, from the [Surface Pro 3 download page](https://www.microsoft.com/download/details.aspx?id=38826) in the Microsoft Download Center. -2. Extract the contents of the Surface Pro 3 firmware and driver pack archive file to a temporary folder. Keep the driver files separate from other drivers or files. -3. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. -4. If you have not already created a folder structure by operating system version, you should do so next. Under the **Windows 10 x64** folder, create a new folder for Surface Pro 3 drivers named **Surface Pro 3**. Your Out-of-Box Drivers folder should resemble the following structure: - * WinPE x86 - * WinPE x64 - * Windows 10 x64 - * Microsoft Corporation - * Surface Pro 4 - * Surface Pro 3 -5. Right-click the **Surface Pro 3** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1. - - ![Import Surface Pro 3 drivers for Windows 10](images/surface-upgrademdt-fig1.png "Import Surface Pro 3 drivers for Windows 10") - - *Figure 1. Import Surface Pro 3 drivers for Windows 10* - -6. The Import Driver Wizard displays a series of steps, as follows: - - **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 3 firmware and drivers in Step 1. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - - **Progress** – While the drivers are imported, a progress bar is displayed on this page. - - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Drivers Wizard. -7. Select the **Surface Pro 3** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 2. - - ![Drivers for Surface Pro 3 imported and organized in the MDT deployment share](images/surface-upgrademdt-fig2.png "Drivers for Surface Pro 3 imported and organized in the MDT deployment share") - - *Figure 2. Drivers for Surface Pro 3 imported and organized in the MDT deployment share* - -### Import applications - -Installation of applications in an upgrade deployment is not always necessary because the applications from the previous environment will remain on the device. (For example, in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, the deployment includes Office 365 which is not required in an upgrade deployment where the user is already using Office 365 on the device.) - -There are still some circumstances where you will want to deploy an application, even during an upgrade deployment. For example, you may have Surface Pro 3 devices on which you would like to add the Surface app. To deploy the Surface app in an upgrade scenario use the same process as you would for a traditional deployment. See the [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business) article for instructions on how to add the Surface app to an MDT task sequence. - -### Create the upgrade task sequence - -After you have all of the resources in place to perform the deployment (including the installation files, Surface drivers, and application files), the next step is to create the upgrade task sequence. This task sequence is a series of steps that will be performed on the device being upgraded that applies the new Windows environment, compatible drivers, and any applications you have specified. - -Create the upgrade task sequence with the following process: - -1. In the Deployment Workbench under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard. -2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard: - - **General Settings** – Enter an identifier for the deployment task sequence in the Task Sequence ID field, a name for the deployment task sequence in the Task Sequence Name field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, and then click **Next**. - >[!NOTE] - >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters. - - **Select Template** – Select **Standard Client Upgrade Task Sequence** from the drop-down menu, and then click **Next**. - - **Select OS** – Navigate to and select the Windows image that you imported, and then click **Next**. - - **Specify Product Key** – Select the product key entry that fits your organization’s licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**. - - **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**. - - **Admin Password** – Select **Use the Specified Local Administrator Password** and enter a password in the provided fields, and then click **Next**. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence. - - **Progress** – While the task sequence is being created, a progress bar is displayed on this page. - - **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete New Task Sequence Wizard. - -After the task sequence is created, you can modify some additional settings to provide additional automation of the task sequence and require less interaction during deployment. Follow these steps to modify the task sequence: - -1. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**. -2. Select the **Task Sequence** tab to view the steps that are included in the new task sequence. -3. Select the **Windows Update (Pre-Application Installation)** step, located under the **State Restore** folder. -4. Click the **Options** tab, and then clear the **Disable This Step** check box. -5. Repeat Step 3 and Step 4 for the **Windows Update (Post-Application Installation)** step. -6. Between the two Windows Update steps is an **Install Applications** step. Select that step and then click **Add**. -7. Hover the mouse over **General** under the **Add** menu, and then choose **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. - - ![A new Install Application step in the deployment task sequence](images/surface-upgrademdt-fig3.png "A new Install Application step in the deployment task sequence") - - *Figure 3. A new Install Application step in the deployment task sequence* - -8. On the **Properties** tab of the new **Install Application** step, enter **Install Surface App** in the **Name** field. -9. Select **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select **Surface App** from the list of applications, and then click **OK**. -11. Expand the **Preinstall** folder and select the **Enable BitLocker (Offline)** step. -12. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. -13. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 4) configure the following options: - - - **Name** – Set DriverGroup001 - - **Task Sequence Variable** – DriverGroup001 - - **Value** – Windows 10 x64\%Make%\%Model% - - ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-upgrademdt-fig4.png "Configure a new Set Task Sequence Variable step in the deployment task sequence") - - *Figure 4. Configure a new Set Task Sequence Variable step in the deployment task sequence* - -14. Select the **Inject Drivers** step, the next step in the task sequence. -15. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 5) configure the following options: - * In the **Choose a selection profile** drop-down menu, select **Nothing**. - * Click the **Install all drivers from the selection profile** button. - - ![Configure the deployment task sequence to not install drivers](images/surface-upgrademdt-fig5.png "Configure the deployment task sequence to not install drivers") - - *Figure 5. Configure the deployment task sequence to not install drivers* - -16. Click **OK** to apply changes to the task sequence and close the task sequence properties window. - -Steps 11 through 15 are very important to the deployment of Surface devices. These steps instruct the task sequence to install only drivers that are organized into the correct folder using the organization for drivers from the [Import Surface drivers](#import-surface-drivers) section. - -### Deployment share rules - -To automate the upgrade process, the rules of the MDT deployment share need to be modified to suppress prompts for information from the user. Unlike a traditional deployment, Bootstrap.ini does not need to be modified because the deployment process is not started from boot media. Similarly, boot media does not need to be imported into WDS because it will not be booted over the network with PXE. - -To modify the deployment share rules and suppress the Windows Deployment Wizard prompts for information, copy and paste the following text into the text box on the **Rules** tab of your deployment share properties: - -``` -[Settings] -Priority=Model,Default -Properties=MyCustomProperty - -[Surface Pro 4] -SkipTaskSequence=YES -TaskSequenceID=Win10SP4 - -[Surface Pro 3] -SkipTaskSequence=YES -TaskSequenceID=Win10SP3Up - -[Default] -OSInstall=Y -SkipCapture=YES -SkipAdminPassword=YES -SkipProductKey=YES -SkipComputerBackup=YES -SkipBitLocker=YES -SkipBDDWelcome=YES -SkipUserData=YES -UserDataLocation=AUTO -SkipApplications=YES -SkipPackageDisplay=YES -SkipComputerName=YES -SkipDomainMembership=YES -JoinDomain=contoso.com -DomainAdmin=MDT -DomainAdminDomain=contoso -DomainAdminPassword=P@ssw0rd -SkipLocaleSelection=YES -KeyboardLocale=en-US -UserLocale=en-US -UILanguage=en-US -SkipTimeZone=YES -TimeZoneName=Pacific Standard Time -UserID=MDTUser -UserDomain=STNDeployServer -UserPassword=P@ssw0rd -SkipSummary=YES -SkipFinalSummary=YES -FinishAction=LOGOFF -``` - - - -For more information about the rules configured by this text, see the **Configure deployment share rules** section in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#configure-deployment-share-rules) article. - -### Update deployment share - -To update the deployment share, right-click the deployment share in the Deployment Workbench and click **Update Deployment Share**, then proceed through the Update Deployment Share Wizard. See the **Update and import updated MDT boot media** section of the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md#update-and-import-updated-mdt-boot-media) article for detailed steps. - -### Run the upgrade deployment - -Unlike a traditional deployment, the upgrade task sequence must be launched from within the Windows environment that will be upgraded. This requires that a user on the device to be upgraded navigate to the deployment share over the network and launch a script, LiteTouch.vbs. This script is the same script that displays the Windows Deployment Wizard in Windows PE in a traditional deployment. In this scenario, Litetouch.vbs will run within Windows. To perform the upgrade task sequence and deploy the upgrade to Windows 10 follow these steps: - -1. Browse to the network location of your deployment share in File Explorer. -2. Navigate to the **Scripts** folder, locate **LiteTouch.vbs**, and then double-click **LiteTouch.vbs** to start the Windows Deployment Wizard. -3. Enter your credentials when prompted. -4. The upgrade task sequence for Surface Pro 3 devices will automatically start when the model of the device is detected and determined to match the deployment share rules. -5. The upgrade process will occur automatically and without user interaction. - -The task sequence will automatically install the drivers for Surface Pro 3 and the Surface app, and will perform any outstanding Windows Updates. When it completes, it will log out and be ready for the user to log on with the credentials they have always used for this device. From 098f935dbfe13b51a9caf088b9708a0548aea211 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 24 Apr 2020 13:38:19 -0700 Subject: [PATCH 203/249] Update miracast-over-infrastructure.md --- devices/surface-hub/miracast-over-infrastructure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md index 1401112971..5ef43af85c 100644 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ b/devices/surface-hub/miracast-over-infrastructure.md @@ -55,5 +55,5 @@ It is important to note that Miracast over Infrastructure is not a replacement f The **InBoxApps/WirelessProjection/PinRequired** setting in the [SurfaceHub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) is not required for Miracast over Infrastructure. This is because Miracast over Infrastructure only works when both devices are connected to the same enterprise network. This removes the security restriction that was previously missing from Miracast. We recommend that you continue using this setting (if you used it previously) as Miracast will fall back to regular Miracast if the infrastructure connection does not work. ## FAQ -**Why do I still need Wi-Fi to use Miracast over infrastructure?** +**Why do I still need Wi-Fi to use Miracast over infrastructure?**
      Discovery requests to identify Miracast receivers can only occur through the Wi-Fi adapter. Once the receivers have been identified, Windows 10 can then attempt the connection to the network. From a441d05778f416991fc54e39f40db8f03f047f6f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 24 Apr 2020 14:28:12 -0700 Subject: [PATCH 204/249] Added missing end punctuation --- .../surface/deploy-windows-10-to-surface-devices-with-mdt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index 05db1ef1d7..47f14939db 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -29,7 +29,7 @@ ms.date: 04/24/2020 - Windows 10 > [!NOTE] -> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) +> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). For the latest information about using MDT, refer to [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt). From 1a5318944197b8a8de86356b8d5573229292d631 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 24 Apr 2020 14:29:13 -0700 Subject: [PATCH 205/249] Added missing end punctuation --- .../surface/upgrade-surface-devices-to-windows-10-with-mdt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md index 82e6317686..c9345502d8 100644 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md @@ -40,5 +40,5 @@ ms.date: 04/24/2020 In addition to the traditional deployment method of reimaging devices, administrators who want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. -For the latest information about upgrading surface devices using MDT, refer to [Perform an in-place upgrade to Windows 10 with MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit) +For the latest information about upgrading surface devices using MDT, refer to [Perform an in-place upgrade to Windows 10 with MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit). From ebb463bbb5f5b32f312ab31189bd6f361a2782ba Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 14:58:07 -0700 Subject: [PATCH 206/249] Revisions --- devices/hololens/hololens-kiosk.md | 140 ++++++++++++++++------------- 1 file changed, 80 insertions(+), 60 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6a906f35a9..53196dcfdf 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -88,6 +88,7 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > [!CAUTION] > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. + | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | @@ -130,6 +131,9 @@ Before you can deploy the kiosk configuration to a device, you have to *assign* For a full discussion of the effects of assigning configuration profiles in Intune, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-profile-assign). +> [!NOTE] +> The following examples describe multi-app kiosks. Single-app kiosks behave in a similar manner, but only one user account gets the kiosk experience. + **Example 1** You use a single group (Group 1) for both devices and users. One device and users A, B, and C are members of this group. You configure the kiosk configuration profile as follows: @@ -230,118 +234,135 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. +1. [Prepare to enroll the devices](#mdmenroll). 1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). -1. Select the settings that you want to see in your kiosk. +1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). -1. [Assign the kiosk configuration profile to the device group](#mdmassign). -1. [Prepare to enroll the devices](#mdmenroll) +1. [Assign the kiosk configuration profile to a group](#mdmassign). 1. Deploy the devices. - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). -### [MDM] 1. Create a kiosk configuration profile -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** -1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. +### [MDM] 1. Prepare to enroll the devices -Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. +You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. -For full details about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). +For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### [MDM] 2. Configure the settings for a single-app kiosk +### [MDM] 2. Create a kiosk configuration profile -This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following locations: +1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. +1. Enter a profile name. +1. Select **Platform** > **Windows 10 and later**, and then select **Profile type** >**Device restrictions**. +1. Select **Configure** > **Kiosk**, and then select one of the following: + - To create a single-app kiosk, select **Kiosk Mode** > **Single-app kiosk**. + - To create a multi-app kiosk, select **Kiosk Mode** > **Multi-app kiosk**. +1. To start configuring the kiosk, select **Add**. + +Your next steps differ depending on the type of kiosk that you want. For further information, select one of the following: +- [Single-app kiosk](#mdmconfigsingle) +- [Multi-app kiosk](#mdmconfigmulti) + +For more information about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). + +### [MDM] 3. Configure the settings for a single-app kiosk + +This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). -Configure the following settings in the kiosk configuration profile: +1. Select **User logon type** > **Local user account**, and enter the user name of the local (device) account or Microsoft Account (MSA) that can sign in to the kiosk. + > [!NOTE] + > **Autologon** user account types aren't supported on Windows Holographic for Business. +1. Select **Application type** > **Store app**, and then select an app from the list. -- **User logon type** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. -- **Application type**. Select **Store app**, and then select an app from the list. +Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 2. Configure the settings for a multi-app kiosk +### [MDM] 3. Configure the settings for a multi-app kiosk -This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following locations: +This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -Configure the following settings in the kiosk configuration profile: +1. Select **Target Windows 10 in S mode devices** > **No**. + >[!NOTE] + > S mode isn't supported on Windows Holographic for Business. +1. Select **User logon type** > **Azure AD user or group** or **User logon type** > **HoloLens visitor**, and then add one or more user groups or accounts. -- **Target Windows 10 in S mode devices**. Select **No**. S mode isn't supported on Windows Holographic for Business. -- **User logon type**. Select **Azure AD user or group** or **HoloLens visitor**, and then add one or more user groups or accounts. - - Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. + Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. -- Apps. You may choose to add just one or add many apps. You can use the following options to add apps: +1. Select one or more apps by using the following options: + - To add an uploaded line-of-business app, select **Add store app** and then select the app you want. + - To add an app by specifying its AUMID, select **Add by AUMID** and then enter the AUMID of the app. [See the list of available AUMIDs](#aumids) - - To add an uploaded line of business app, select **Add store app**. - - To add an app by specifying its AUMID, select **Add by AUMID**. +Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 3. Assign the kiosk configuration profile to the device group +### [MDM] 4. Assign the kiosk configuration profile to a group -Use the **Assignments** page of the kiosk configuration profile to assign the profile to one or more device groups. +Use the **Assignments** page of the kiosk configuration profile to set where you want the kiosk configuration to deploy. In the simplest case, you assign the kiosk configuration profile to a group that will contain the HoloLens device when the device enrolls in MDM. -### [MDM] 4. Prepare to enroll the devices +### [MDM] 5. Deploy a single-app kiosk -You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). +When you use an MDM system, you can enroll the device in MDM during OOBE. After OOBE finishes, device sign-in is easy. -### [MDM] 4. Deploy a single-app kiosk +During OOBE, follow these steps: -When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. +1. Sign in by using the account that you specified in the kiosk configuration profile. +1. Enroll the device. Make sure that the device is added to the group that the kiosk configuration profile is assigned to. +1. Wait for OOBE to finish, for the store app to download and install, and for policies to be applied. Then restart the device. -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. +The next time you sign in to the device, the kiosk app should automatically launch. -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. +If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. +### [MDM] 4. Deploy a multi-app kiosk -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. +When you use an MDM system, you can join the device to your Azure AD tenant and enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). +> [!NOTE] +> If you have assigned the kiosk configuration profile to a group that contains users, make sure that one of those user accounts is the first account to sign in to the device. -#### [MDM] 4. Deploy a multi-app kiosk +During OOBE, follow these steps: +1. Sign in by using the account that belongs to the **User logon type** group. +1. Enroll the device. +1. Wait for any apps that are part of the kiosk configuration profile to download and install, and for policies to be applied. +1. After OOBE finishes, you can install additional apps from the Microsoft store or by sideloading. [Required apps](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the group that the device belongs to install automatically. +1. Restart the device. -When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. -For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. +The next time you sign in to the device by using an account that belongs to the **User logon type**, the kiosk app should automatically launch. -If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. - -Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. - -To enable Kiosk mode, simply sign out of your account and sign in to a profile that is a member of a group targeted by the **User logon type** setting. (This may be the same user.) - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). +If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). ## Use a provisioning package to set up a single-app or muti-app kiosk -As part of creating your Provisioning package, you'll need to create a [Start layout](#start-layout-for-hololens). - To set up kiosk mode by using a provisioning package, follow these steps. -1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig) +1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig), including a [Start layout](#start-layout-for-hololens). 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) ### [PP] 1. Create a kiosk configuration XML file -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: +Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), except for the following: - Do not include Classic Windows applications (Win32). HoloLens does not support these applications. - Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. +- Optional: Add guest access to the kiosk configuration -#### Add guest access to the kiosk configuration (optional) +#### Optional: Add guest access to the kiosk configuration In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: +To enable the **Guest** account, add the following snippet to your kiosk configuration XML : ```xml @@ -357,14 +378,12 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start screen and does not need a Start layout. +> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. > [!NOTE] > If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -### Create a start layout for a customized multi-app kiosk - -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: ```xml @@ -412,8 +431,7 @@ Save the following sample as an XML file. You can use this file when you configu ### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -1. Select **Advanced provisioning**. -1. Name your project, and then select **Next**. +1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. 1. Select **Windows 10 Holographic**, and then select **Next**. 1. Select **Finish**. The workspace for your package opens. 1. Select **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. @@ -421,10 +439,12 @@ Save the following sample as an XML file. You can use this file when you configu ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](./images/multiappassignedaccesssettings.png) -1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. By using this account, you can view the provisioning status and logs. -1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. For **UserGroup**, select **Standard Users**. +1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a user account. Provide a user name and password, and then select **UserGroup** > **Administrators**. + + By using this account, you can view the provisioning status and logs. +1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a local user account. Make sure the user name is the same as the account that you specify in the configuration XML. Select **UserGroup** > **Standard Users**. 1. Select **File** > **Save**. -1. Select **Export** > **Provisioning package**, and then set **Owner** to **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. +1. Select **Export** > **Provisioning package**, and then select **Owner** > **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. 1. Select **Next**. 1. On the **Provisioning package security** page, select a security option. > [!IMPORTANT] From 8ffd49e7451a0cdd76a35e01fe4bcd1a9fbda43c Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 15:28:26 -0700 Subject: [PATCH 207/249] Link fixes --- devices/hololens/hololens-kiosk.md | 29 +++++++++++------------ devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 17 insertions(+), 18 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 53196dcfdf..5b25494c44 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -60,7 +60,7 @@ The following table lists the feature capabilities in the different kiosk modes. |Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | > 1 Voice commands that relate to disabled features do not function. -> 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +> 2 For more information about how to configure these features, see [Select kiosk apps](#plan-kiosk-apps). > 3 Even if Cortana is disabled, the built-in voice commands are enabled. The following table lists the user support features of the different kiosk modes. @@ -210,9 +210,9 @@ You can select one of three methods to deploy kiosk configurations: - [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) -- [Provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) +- [Provisioning package](#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) -- [Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) +- [Windows Device Portal](#use-the-windows-device-portal-to-set-up-a-single-app-kiosk) > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -235,7 +235,7 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Prepare to enroll the devices](#mdmenroll). -1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). +1. [Create a kiosk configuration profile](#mdm-2-create-a-kiosk-configuration-profile). 1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). @@ -244,7 +244,6 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). - ### [MDM] 1. Prepare to enroll the devices You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. @@ -274,7 +273,7 @@ This section summarizes the settings that a single-app kiosk requires. For more - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig). 1. Select **User logon type** > **Local user account**, and enter the user name of the local (device) account or Microsoft Account (MSA) that can sign in to the kiosk. > [!NOTE] @@ -289,7 +288,7 @@ This section summarizes the settings that a multi-app kiosk requires. For more d - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig), and make sure to include the [Start layout](#Start layout for HoloLens) in the XML file. - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). 1. Select **Target Windows 10 in S mode devices** > **No**. @@ -342,13 +341,13 @@ The next time you sign in to the device by using an account that belongs to the If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -## Use a provisioning package to set up a single-app or muti-app kiosk +## Use a provisioning package to set up a single-app or multi-app kiosk To set up kiosk mode by using a provisioning package, follow these steps. 1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig), including a [Start layout](#start-layout-for-hololens). -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) +2. [Add the XML file to a provisioning package.](#ppconfigadd) +3. [Apply the provisioning package to HoloLens.](#ppapply) ### [PP] 1. Create a kiosk configuration XML file @@ -375,7 +374,7 @@ To enable the **Guest** account, add the following snippet to your kiosk configu #### Start layout for HoloLens -If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. +If you use a [provisioning package](##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. @@ -383,7 +382,7 @@ If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-p > [!NOTE] > If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: +For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: ```xml @@ -410,7 +409,7 @@ For the Start layout, add the following **StartLayout** section to the kiosk pro Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). > [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-hololens). ```xml ``` -### [PP] 2. Add the kiosk configuration XML file to a provisioning package +### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. @@ -456,7 +455,7 @@ Save the following sample as an XML file. You can use this file when you configu 1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. 1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. -### [PP] 3. Apply the provisioning package to HoloLens +### [PP] 3. Apply the provisioning package to HoloLens The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index aa636e08c1..6484efeabd 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -33,7 +33,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk). ## Provisioning package HoloLens wizard @@ -49,7 +49,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll the device in Azure Active Directory, or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..7c653de149 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 2c50d29fd068cfd819ff9a4fd9cbd4d6c71759a1 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 16:08:34 -0700 Subject: [PATCH 208/249] typos --- devices/hololens/hololens-kiosk.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5b25494c44..fdc46ab8fd 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -1,5 +1,5 @@ --- -title: Set up HoloLens as a kiosk for specific applications +title: Set up HoloLens as a kiosk description: Use a kiosk configuration to lock down the apps on HoloLens. ms.prod: hololens ms.sitesec: library @@ -7,7 +7,7 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 03/12/2020 +ms.date: 04/27/2020 ms.custom: - CI 115262 - CI 111456 @@ -208,7 +208,7 @@ Other types of profiles and policies, such as device restrictions that are not r You can select one of three methods to deploy kiosk configurations: -- [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +- [Microsoft Intune or other mobile device management (MDM) service](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) - [Provisioning package](#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) @@ -230,7 +230,7 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | -## Set up kiosk mode by using Microsoft Intune or MDM +## Use Microsoft Intune or other MDM to set up a single-app or multi-app kiosk To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. @@ -262,6 +262,7 @@ For more information about enrolling the devices, see [Enroll HoloLens in MDM](h 1. To start configuring the kiosk, select **Add**. Your next steps differ depending on the type of kiosk that you want. For further information, select one of the following: + - [Single-app kiosk](#mdmconfigsingle) - [Multi-app kiosk](#mdmconfigmulti) @@ -361,7 +362,7 @@ Follow [the instructions for creating a kiosk configuration XML file for desktop In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. -To enable the **Guest** account, add the following snippet to your kiosk configuration XML : +To enable the **Guest** account, add the following snippet to your kiosk configuration XML: ```xml @@ -380,7 +381,7 @@ If you use a [provisioning package](##use-a-provisioning-package-to-set-up-a-sin > Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. > [!NOTE] -> If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). +> If you use [MDM](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: From 720a404170e7ac79eedd188d8a78ec4a52a1aaa4 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 16:23:23 -0700 Subject: [PATCH 209/249] Link fixes --- devices/hololens/hololens-commercial-infrastructure.md | 2 +- devices/hololens/hololens-requirements.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 69cc524581..ddeb2b11b2 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -175,7 +175,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) ## Certificates and Authentication diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7c653de149..c8be6947ae 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From dc0062c6b87827051bfb2ccaf4fa3d89b560922d Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sat, 25 Apr 2020 12:42:17 +0500 Subject: [PATCH 210/249] Update configure-server-endpoints.md --- .../microsoft-defender-atp/configure-server-endpoints.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index a2550f9980..c0c8157b48 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -77,8 +77,6 @@ You'll need to take the following steps if you choose to onboard servers through > After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md). ### Configure and update System Center Endpoint Protection clients -> [!IMPORTANT] -> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2. Microsoft Defender ATP integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. From 16e9e90cee6d810cf86ba1e9c9b2d38cd7ff5a42 Mon Sep 17 00:00:00 2001 From: komsorg <33907047+komsorg@users.noreply.github.com> Date: Mon, 27 Apr 2020 15:33:55 +0300 Subject: [PATCH 211/249] Fixed link address Fixed link address in markdown markup. --- .../creating-and-managing-app-v-51-virtualized-applications.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md index c781eb4fea..a2dc196c47 100644 --- a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md +++ b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md @@ -20,7 +20,7 @@ ms.date: 06/16/2016 After you have properly deployed the Microsoft Application Virtualization (App-V) 5.1 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. **Note**   -For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx). +For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx). **Note** The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. From 7ab11c6f127ec3e0f077a7e009deeda4a432f9df Mon Sep 17 00:00:00 2001 From: komsorg <33907047+komsorg@users.noreply.github.com> Date: Mon, 27 Apr 2020 15:40:55 +0300 Subject: [PATCH 212/249] Fixed broken link Fixed broken link to App-V 5.0 Sequencing Guide.docx --- .../appv-creating-and-managing-virtualized-applications.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md index 197cff66cb..29d79221c5 100644 --- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md +++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md @@ -18,7 +18,7 @@ ms.topic: article After you have properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. -For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](). +For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx). >[!NOTE] >The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. From 91683a5cd6a34f752a4de8c98a1c0fe05b8066f6 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Mon, 27 Apr 2020 08:17:31 -0700 Subject: [PATCH 213/249] Update advanced-hunting-shared-queries.md --- .../microsoft-defender-atp/advanced-hunting-shared-queries.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md index de3d5741a4..b661399a57 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md @@ -52,6 +52,9 @@ You can save a new or existing query so that it is only accessible to you or sha 2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query. +## Create a direct link to a query +To generate a link that opens your query directly in the advanced hunting query editor, finalize your query and select **Share link**. + ## Access queries in the GitHub repository Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). From d41d3dcab0eab844524269e1c080a4b2ada060c9 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 08:47:07 -0700 Subject: [PATCH 214/249] Table formatting cleanup --- devices/hololens/hololens-kiosk.md | 34 +++++++++++++++--------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index fdc46ab8fd..6749505830 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -89,23 +89,23 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. -| App Name | AUMID | -|----------------------------|----------------------------------------------------------------------------------| -| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana3 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Miracast4 | | -| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | -| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +|App Name |AUMID | +| --- | --- | +|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera_cw5n1h2txyewy!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +|Device Picker |HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +|Miracast4 |  | +|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +|Settings |HolographicSystemSettings_cw5n1h2txyewy!App | +|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From 83feacbc67116d1cd92c109b2d5ed950e84716e7 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Mon, 27 Apr 2020 09:21:39 -0700 Subject: [PATCH 215/249] Update index.yml --- devices/surface/index.yml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index d9d7043dc2..cd2e9ae131 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -30,12 +30,7 @@ additionalContent: # Card - title: Surface Hub documentation summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device. - url: https://docs.microsoft.com/surface-hub/index - # Card - - title: Surface Hub adoption guidance - summary: Get best practices for technical readiness and adoption across your lines of business. - url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit - + url: https://docs.microsoft.com/surface-hub/index - title: Other resources # < 60 chars (optional) items: # Card From 7b26000055a735324fac1c4591043d2c356c1aa2 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Mon, 27 Apr 2020 09:31:06 -0700 Subject: [PATCH 216/249] Update index.yml Adds adoption guidance link to Learn section --- devices/surface/index.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index cd2e9ae131..b173beeed8 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -45,6 +45,8 @@ additionalContent: links: - text: Surface training on Microsoft Learn url: https://docs.microsoft.com/learn/browse/?term=Surface + - text: Surface Hub 2S adoption guidance + url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit - text: Microsoft Mechanics Surface videos url: https://www.youtube.com/watch?v=Uk2kJ5FUZxY&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ From b56979cc0136e8140d8fdc4379943438c979c61b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 27 Apr 2020 09:44:12 -0700 Subject: [PATCH 217/249] add cern pem --- .../microsoft-defender-atp/manage-indicators.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index e04c52cc32..b2176faf1d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -164,6 +164,7 @@ It's important to understand the following requirements prior to creating indica - The Antimalware client version must be 4.18.1901.x or later. - Supported on machines on Windows 10, version 1703 or later. - The virus and threat protection definitions must be up-to-date. +- This feature currently supports entering .CER or .PEM file extensions. >[!IMPORTANT] > - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it’s trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities'). From 061d4481412794a3cc532fb93cac598d6f5f2cd8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 27 Apr 2020 09:46:58 -0700 Subject: [PATCH 218/249] preview --- .../threat-protection/microsoft-defender-atp/preview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index e4676f46b6..a92e6a198a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -44,6 +44,8 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: +- [Create indicators for certificates](manage-indicators.md)
      Create indicators to allow or block certificates. + - [Microsoft Defender ATP for Linux](microsoft-defender-atp-linux.md)
      Microsoft Defender ATP now adds support for Linux. Learn how to install, configure, update, and use Microsoft Defender ATP for Linux. - [Threat & Vulnerability supported operating systems and platforms](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os)
      Ensure that you meet the operating system or platform requisites for Threat & Vulnerability Management so the activities in your devices are properly accounted for. Threat & Vulnerability Management supports Windows 7, Windows 10 1607-1703, Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, Windows Server 2019.

      Secure Configuration Assessment (SCA) supports Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, and Windows Server 2019. See [Secure Configuration Assessment (SCA) for Windows Server now in public preview](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/secure-configuration-assessment-sca-for-windows-server-now-in/ba-p/1243885) and [Reducing risk with new Threat & Vulnerability Management capabilities](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/reducing-risk-with-new-threat-amp-vulnerability-management/ba-p/978145) blogs for more information. From f0d49fc76f79c60c85caa7be54cf8c4b925290a5 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 10:33:10 -0700 Subject: [PATCH 219/249] Escape apostrophes --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6749505830..d86fd07281 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -91,21 +91,21 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |App Name |AUMID | | --- | --- | -|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -|Camera1, 2 |HoloCamera_cw5n1h2txyewy!HoloCamera | -|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -|Device Picker |HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe\!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera_cw5n1h2txyewy\!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe\!App | +|Device Picker |HoloDevicesFlow_cw5n1h2txyewy\!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe\!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe\!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\!App | |Miracast4 |  | -|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -|Settings |HolographicSystemSettings_cw5n1h2txyewy!App | -|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe\!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe\!App | +|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe\!App | +|Settings |HolographicSystemSettings_cw5n1h2txyewy\!App | +|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe\!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From ae0b57ae98d4eec420b721a38dd8c9919aee1841 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 10:54:49 -0700 Subject: [PATCH 220/249] Revisions --- devices/hololens/hololens-kiosk.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index d86fd07281..26b232e88b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -244,13 +244,13 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). -### [MDM] 1. Prepare to enroll the devices +### MDM, step 1 – Prepare to enroll the devices You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### [MDM] 2. Create a kiosk configuration profile +### MDM, step 2 – Create a kiosk configuration profile 1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. @@ -268,7 +268,7 @@ Your next steps differ depending on the type of kiosk that you want. For further For more information about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). -### [MDM] 3. Configure the settings for a single-app kiosk +### MDM, step 3 (single-app) – Configure the settings for a single-app kiosk This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following articles: @@ -283,13 +283,13 @@ This section summarizes the settings that a single-app kiosk requires. For more Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 3. Configure the settings for a multi-app kiosk +### MDM, step 3 (multi-app) – Configure the settings for a multi-app kiosk This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig), and make sure to include the [Start layout](#Start layout for HoloLens) in the XML file. +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig). If you use an XML file, make sure to include the [Start layout](#start-layout-for-hololens). - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). 1. Select **Target Windows 10 in S mode devices** > **No**. @@ -305,11 +305,11 @@ This section summarizes the settings that a multi-app kiosk requires. For more d Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 4. Assign the kiosk configuration profile to a group +### MDM, step 4 – Assign the kiosk configuration profile to a group Use the **Assignments** page of the kiosk configuration profile to set where you want the kiosk configuration to deploy. In the simplest case, you assign the kiosk configuration profile to a group that will contain the HoloLens device when the device enrolls in MDM. -### [MDM] 5. Deploy a single-app kiosk +### MDM, step 5 (single-app) – Deploy a single-app kiosk When you use an MDM system, you can enroll the device in MDM during OOBE. After OOBE finishes, device sign-in is easy. @@ -323,7 +323,7 @@ The next time you sign in to the device, the kiosk app should automatically laun If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### [MDM] 4. Deploy a multi-app kiosk +### MDM, step 5 (multi-app) – Deploy a multi-app kiosk When you use an MDM system, you can join the device to your Azure AD tenant and enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. @@ -350,7 +350,7 @@ To set up kiosk mode by using a provisioning package, follow these steps. 2. [Add the XML file to a provisioning package.](#ppconfigadd) 3. [Apply the provisioning package to HoloLens.](#ppapply) -### [PP] 1. Create a kiosk configuration XML file +### Prov. package, step 1 – Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), except for the following: @@ -428,7 +428,7 @@ Save the following sample as an XML file. You can use this file when you configu       ``` -### [PP] 2. Add the kiosk configuration XML file to a provisioning package +### Prov. package, step 2 – Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. @@ -456,7 +456,7 @@ Save the following sample as an XML file. You can use this file when you configu 1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. 1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. -### [PP] 3. Apply the provisioning package to HoloLens +### Prov. package, step 3 – Apply the provisioning package to HoloLens The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: From f81659266710157ae50236a17ce5e6bc7e25e7c8 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 27 Apr 2020 10:56:43 -0700 Subject: [PATCH 221/249] Reset TPM. Added small line about resetting TPM. --- devices/hololens/hololens-recovery.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 60d46d7e1c..4ea73d7495 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -82,7 +82,7 @@ If you're still having problems, press the power button for 4 seconds, until all If your HoloLens is still experiencing issues after restarting, try resetting it to factory state. Resetting your HoloLens keeps the version of the Windows Holographic software that's installed on it and returns everything else to factory settings. -If you reset your device, all your personal data, apps, and settings will be erased. Resetting will only install the latest installed version of Windows Holographic and you will have to redo all the initialization steps (calibrate, connect to Wi-Fi, create a user account, download apps, and so forth). +If you reset your device, all your personal data, apps, and settings will be erased, including TPM reset. Resetting will only install the latest installed version of Windows Holographic and you will have to redo all the initialization steps (calibrate, connect to Wi-Fi, create a user account, download apps, and so forth). 1. Launch the Settings app, and then select **Update** > **Reset**. 1. Select the **Reset device** option and read the confirmation message. @@ -100,7 +100,7 @@ All of the data HoloLens needs to reset is packaged in a Full Flash Update (ffu) ### HoloLens 2 -The Advanced Recovery Companion is a new app in Microsoft Store restore the operating system image to your HoloLens 2 device. +The Advanced Recovery Companion is a new app in Microsoft Store restore the operating system image to your HoloLens 2 device. Advanced Recovery Companion erases all your personal data, apps, and settings, and resets TPM. 1. On your computer, get [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from Microsoft Store. 2. Connect HoloLens 2 to your computer. From c05bbb1529e9e4889a92208d34272109db1eb059 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 11:38:53 -0700 Subject: [PATCH 222/249] Revision --- devices/hololens/hololens-kiosk.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 26b232e88b..8b4117e2e3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -30,9 +30,7 @@ This article provides information about aspects of configuring kiosks that are s You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. -> [!WARNING] -> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, [certain policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy) are enforced system-wide. These policies impact other users on the device. -> +> [!IMPORTANT] > Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. To revert these policies, you have to reset the device to the factory settings. ## Plan the kiosk deployment From 12c4eb4b7fbf148747dd36bbcf5960cce834d757 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 11:51:34 -0700 Subject: [PATCH 223/249] Link fix --- devices/hololens/hololens-kiosk.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 8b4117e2e3..a7ef78c0fb 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -233,7 +233,7 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Prepare to enroll the devices](#mdmenroll). -1. [Create a kiosk configuration profile](#mdm-2-create-a-kiosk-configuration-profile). +1. [Create a kiosk configuration profile](#mdmprofile). 1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). @@ -248,7 +248,7 @@ You can configure your MDM system to enroll HoloLens devices automatically when For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### MDM, step 2 – Create a kiosk configuration profile +### MDM, step 2 – Create a kiosk configuration profile 1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. From 8fa4f1193885344fc1a0e5667bf20ba395d0df58 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 12:23:44 -0700 Subject: [PATCH 224/249] Excape underscores --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index a7ef78c0fb..53136291e4 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -89,21 +89,21 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |App Name |AUMID | | --- | --- | -|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | -|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe\!microsoft.windowslive.calendar | -|Camera1, 2 |HoloCamera_cw5n1h2txyewy\!HoloCamera | -|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe\!App | -|Device Picker |HoloDevicesFlow_cw5n1h2txyewy\!HoloDevicesFlow | -|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe\!MicrosoftGuides | -|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe\!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\!App | -|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\!App | +|3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | +|Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | |Miracast4 |  | -|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe\!Microsoft.ZuneVideo | -|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe\!App | -|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe\!App | -|Settings |HolographicSystemSettings_cw5n1h2txyewy\!App | -|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe\!HoloLensTips | +|Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | +|Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | +|Settings |HolographicSystemSettings\_cw5n1h2txyewy\!App | +|Tips |Microsoft.HoloLensTips\_8wekyb3d8bbwe\!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From f8950778c61ae507c3a33882cf3a283329d4bb0e Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 12:45:30 -0700 Subject: [PATCH 225/249] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index f4483bee95..fc0b06a62d 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -13094,17 +13094,17 @@ { "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", From 1a2685212f8af26f2ee97f5d8eabc0d230246bf5 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 13:21:23 -0700 Subject: [PATCH 226/249] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index fc0b06a62d..c92572ba2b 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -13095,10 +13095,9 @@ "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": false -}, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", "redirect_document_id": false }, { From 3ff8630d041cea4945a6ef1ee03a6fbfa8f1bd8b Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 13:51:11 -0700 Subject: [PATCH 227/249] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index c92572ba2b..0d6d205c5a 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -15852,7 +15852,8 @@ }, { "source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", "redirect_document_id": false +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", +"redirect_document_id": false } ] } From 81095837960e95422bf325527cae0a6f0cb5122e Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 13:59:06 -0700 Subject: [PATCH 228/249] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 1 + 1 file changed, 1 insertion(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 0d6d205c5a..7ac89fbd66 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -13095,6 +13095,7 @@ "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", "redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": false +}, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", "redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", From f17cb7022caeffae5d04c69ccc29ec8830c6de9d Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 27 Apr 2020 14:36:06 -0700 Subject: [PATCH 229/249] Adding ARC offline Install instructions High Pri. This change is meant to include Offline Install instructions for ARC. This will help mitigate a Sev3 incident that is currently active. --- devices/hololens/hololens-recovery.md | 29 ++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 4ea73d7495..71896daba2 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -7,7 +7,7 @@ ms.prod: hololens ms.sitesec: library author: mattzmsft ms.author: mazeller -ms.date: 08/30/2019 +ms.date: 04/27/2020 ms.custom: - CI 111456 - CSSTroubleshooting @@ -109,6 +109,8 @@ The Advanced Recovery Companion is a new app in Microsoft Store restore the oper 5. On the **Device info** page, select **Install software** to install the default package. (If you have a Full Flash Update (FFU) image that you want to install instead, select **Manual package selection**.) 6. Software installation will begin. Do not use the device or disconnect the cable during installation. When you see the **Installation finished** page, you can disconnect and use your device. +#### Manual flashing mode + > [!TIP] > In the event that a HoloLens 2 gets into a state where Advanced Recovery Companion cannot recognize the device, and it does not boot, try forcing the device into Flashing Mode and recovering it with Advanced Recovery Companion: @@ -117,6 +119,31 @@ The Advanced Recovery Companion is a new app in Microsoft Store restore the oper 1. The device should be visible in **Device Manager** as a **Microsoft HoloLens Recovery** device. 1. Launch Advanced Recovery Companion, and follow the on-screen prompts to reflash the OS to the HoloLens 2. +#### Downloading ARC without using the app store + +If an IT environment prevents the use of the Windows Store app or limits access to the retail store, IT administrators can make this app available through other ‘offline’ deployment paths. + +This deployment path can be enabled with the following steps: +1. Go to the [Store For Business website](https://businessstore.microsoft.com) and sign-in with an Azure AD identity. +1. Go to **Manage – Settings**, and turn on **Show offline apps** under **Shopping experience** as described at https://businessstore.microsoft.com/en-us/manage/settings/shop +1. Go to **shop for my group** and search for the [Advanced Recovery Companion](https://businessstore.microsoft.com/store/details/advanced-recovery-companion/9P74Z35SFRS8) app. +1. Change the **License Type** box to offline and click **Manage**. +1. Under Download the package for offline use click the second blue **“Download”** button . Ensure the file extension is .appxbundle. +1. At this stage, if the Desktop PC has Internet access, simply double click and install. +1. The IT administrator can also distribute this app through System Center Configuration Manager (SCCM) or Intune. +1. If the target PC has no Internet connectivity, some additional steps are needed: + 1. Select the unencoded license and click **“Generate license”** and under **“Required Frameworks”** click **“Download.”** + 1. PCs without internet access will need to use DISM to apply the package with the dependency and license. In an administrator command prompt, type: + +``` +C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_1.19050.1301.0_neutral_~_8wekyb3d8bbwe.appxbundle" /DependencyPackagePath:"C:\ARCoffline\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x86__8wekyb3d8bbwe.appx" /LicensePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_8wekyb3d8bbwe_f72ce112-dd2e-d771-8827-9cbcbf89f8b5.xml" /Region:all +``` + +Other resources: +- https://docs.microsoft.com/en-us/microsoft-store/distribute-offline-apps +- https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-app-package--appx-or-appxbundle--servicing-command-line-options + + ### HoloLens (1st gen) If necessary, you can install a completely new operating system on your HoloLens (1st gen) with the Windows Device Recovery Tool. From 357a2f5588a6de8aa9e1bdc63d6ec6e84e0b5267 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Mon, 27 Apr 2020 14:49:53 -0700 Subject: [PATCH 230/249] Remove en-us --- devices/hololens/hololens-recovery.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 71896daba2..54d2d73ca6 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -125,7 +125,7 @@ If an IT environment prevents the use of the Windows Store app or limits access This deployment path can be enabled with the following steps: 1. Go to the [Store For Business website](https://businessstore.microsoft.com) and sign-in with an Azure AD identity. -1. Go to **Manage – Settings**, and turn on **Show offline apps** under **Shopping experience** as described at https://businessstore.microsoft.com/en-us/manage/settings/shop +1. Go to **Manage – Settings**, and turn on **Show offline apps** under **Shopping experience** as described at https://businessstore.microsoft.com/manage/settings/shop 1. Go to **shop for my group** and search for the [Advanced Recovery Companion](https://businessstore.microsoft.com/store/details/advanced-recovery-companion/9P74Z35SFRS8) app. 1. Change the **License Type** box to offline and click **Manage**. 1. Under Download the package for offline use click the second blue **“Download”** button . Ensure the file extension is .appxbundle. @@ -140,8 +140,8 @@ C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\AR ``` Other resources: -- https://docs.microsoft.com/en-us/microsoft-store/distribute-offline-apps -- https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-app-package--appx-or-appxbundle--servicing-command-line-options +- https://docs.microsoft.com/microsoft-store/distribute-offline-apps +- https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-app-package--appx-or-appxbundle--servicing-command-line-options ### HoloLens (1st gen) From 44b7bad458117bec94e5eb8f2ff38b97c39e7e9d Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:06:19 -0700 Subject: [PATCH 231/249] Troubleshooting table --- devices/hololens/hololens-kiosk.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 53136291e4..03ec36149b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -87,18 +87,31 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. + |App Name |AUMID | | --- | --- | |3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | |Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | + +|App Name |AUMID | +| --- | --- | |Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | |Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | + +|App Name |AUMID | +| --- | --- | |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | |Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | + +|App Name |AUMID | +| --- | --- | |Miracast4 |  | + +|App Name |AUMID | +| --- | --- | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | |OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | |Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | From 55f3bd0d6990d89986bbeeeca3c1aa424a1b0fe1 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:21:00 -0700 Subject: [PATCH 232/249] Troubleshootin table --- devices/hololens/hololens-kiosk.md | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 03ec36149b..6719d870b6 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -92,26 +92,14 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you | --- | --- | |3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | |Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | - -|App Name |AUMID | -| --- | --- | |Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | |Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | - -|App Name |AUMID | -| --- | --- | |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | |Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | - -|App Name |AUMID | -| --- | --- | |Miracast4 |  | - -|App Name |AUMID | -| --- | --- | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | |OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | |Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | @@ -120,10 +108,10 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: -> - The Quick Actions menu includes the Photo and Video buttons. +> - The Quick Actions menu includes the Photo and Video buttons. > - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). > -> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. ### Plan user and device groups From e97569387028019fe8580fb18ddce47ceb76bbe8 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 15:22:08 -0700 Subject: [PATCH 233/249] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 7ac89fbd66..089957ea4a 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -762,17 +762,17 @@ }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", -"redirect_url": "hhttps://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", +"redirect_url": "hhttps://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", "redirect_document_id": true }, { @@ -13093,17 +13093,17 @@ }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", "redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", "redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", "redirect_document_id": false }, { From befaea37a94b55f728eca57cc0e2b8fd7659d2ff Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 27 Apr 2020 15:55:12 -0700 Subject: [PATCH 234/249] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 089957ea4a..1c7f9c4f0c 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -15855,6 +15855,21 @@ "source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", "redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", +"redirect_document_id": false } ] } From a8ec188c41d67449ea90d862a13cdc1648558496 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:55:43 -0700 Subject: [PATCH 235/249] Tabletweak --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6719d870b6..76a33a3064 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -97,7 +97,7 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | +|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | |Miracast4 |  | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | From 79e3fb6b0e954a4cc1a7e20da64eefcca11480ef Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 27 Apr 2020 19:26:05 -0700 Subject: [PATCH 236/249] Indented code block in a list item --- devices/hololens/hololens-recovery.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md index 54d2d73ca6..ffe2dd9653 100644 --- a/devices/hololens/hololens-recovery.md +++ b/devices/hololens/hololens-recovery.md @@ -135,9 +135,9 @@ This deployment path can be enabled with the following steps: 1. Select the unencoded license and click **“Generate license”** and under **“Required Frameworks”** click **“Download.”** 1. PCs without internet access will need to use DISM to apply the package with the dependency and license. In an administrator command prompt, type: -``` -C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_1.19050.1301.0_neutral_~_8wekyb3d8bbwe.appxbundle" /DependencyPackagePath:"C:\ARCoffline\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x86__8wekyb3d8bbwe.appx" /LicensePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_8wekyb3d8bbwe_f72ce112-dd2e-d771-8827-9cbcbf89f8b5.xml" /Region:all -``` + ```console + C:\WINDOWS\system32>dism /online /Add-ProvisionedAppxPackage /PackagePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_1.19050.1301.0_neutral_~_8wekyb3d8bbwe.appxbundle" /DependencyPackagePath:"C:\ARCoffline\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x86__8wekyb3d8bbwe.appx" /LicensePath:"C:\ARCoffline\Microsoft.AdvancedRecoveryCompanion_8wekyb3d8bbwe_f72ce112-dd2e-d771-8827-9cbcbf89f8b5.xml" /Region:all + ``` Other resources: - https://docs.microsoft.com/microsoft-store/distribute-offline-apps From 5e208b44e444124be72271bcdc3e623a4b237f54 Mon Sep 17 00:00:00 2001 From: Bill Mcilhargey <19168174+computeronix@users.noreply.github.com> Date: Tue, 28 Apr 2020 09:47:37 -0400 Subject: [PATCH 237/249] Delete rules-indicators.png removing/updating rules-indicators.png to show 15,000k indicators --- .../images/rules-indicators.png | Bin 54311 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png deleted file mode 100644 index 6062d5248d0d691ae69a1df25662d2f4149d4fbf..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 54311 zcmdSB2T+q+_de=(JQ@`tR!~Z?(3GaqA%KX8NC^UhQdO$-9zsZ>2LS;AAp!y>K~buJ zNN+*9p(6yOCG-vfLLh-8+<3m@Ip_DEJ9FpWxikNJ-x-ECVfKFayZ73At>;7mS*!%VazkT~o`2YO*56MY5Xy3lR8oirZWgtUa$&&_C98H^irPkuj(8 zvGcM19(xbZ`Y0d2dHbw!!E}23(YwcvLqjWm+z>$DJ~;dKc=Xd4_h>nwmhQ8Tm~Ud* zKiW4NUHeu`y`XVhko6gOTmu)y8m>4*;Cz|8G1X{k5fE8Hx`6cX<2u zeMP%3P}3`OM(myAYKO{cA6E;yVuKc8IbKV7p{-puHR_m-dk6dKmLLP(E8m(}(|3Ng z4DywB1o@)^CqvmWZfKG01$pmxHxaM?p2Mf7od_H0yQcPDg?WzG)n#cbs>&Oygp(8g z4&H9$X!ST%U}_pxu+IDO-j?Y}!fC?}1j=oBwD;M&=uTlGq50Qy?mtMn46I@yy}lo$ zvEOgd+!E&$lC>0kN;W8Z&s<``Mi_sm5o*5h2n!!D*r6_w6r0}-%sRnfNE82xn}_A>c9WA zKCd;>Z6s=;{&^uS5emc?IU)pE{$9%h;K0?5X?I_@d-+FPHMp(c6j*3UXZEHMzRXh0 z4^B!7w;U3UqbY#j4}^mQ$m1xi88mK;VnHjfZF!sm=;q zb6R8SZjE>UxVHby0eoEQJMZw$EHCjvVn<9|ji7AVHlICN++v^unRqr@A`M`O_@Z8g z^gzu-Oy`!U%<=xR!t{L6_Rt%CXg*~8QRGPom(C48i`ZKk3;vY7PeT%5Dz(@?wD*0L zfKdZ2Xe0e||Jmv^>lDQRPdK=7zz!m2A(|Trai%tj8&e{DVLi)pyHiUM9DDt>K3_xc ze+NtWZtp}8E|nzYWO>b_3sVO)iA~PCLpjr_2Z@hoXSTgW2Sq@ppv?_ zuT|z_J6u#BE(v;+XpYwbZEiKsmY(|6Yf0%Q%-CTyVkv7I|0e2rRXL9xwu}3sS^gvb zgX4O6Vj6H+r<1r=f8Qc#-JOCbJs}h5y4C2_AJZS~pAd&E-&%hv-tM{I{`jW{`SY@b z8NiI)x2oH-poP(DZyqiVS*6_JyJ3g94ZK$J^)(~}1OfHiJqdIwy4@GnZKHC6ygr{; zIh~uCDZ8m#Ji{@;%Cw86#l^Ls5%Z0*;v;WUxqo%-3vvUUN@M#vEDejmh7vS%e{{yv z+jI;ew?HLtN{^Jbh5ptzl@*vD$9KZe%}!7mxxQuKEBUK+NzqZ5@i_&FuAYxW(`}ZZ zk^uT7y>yAoz|PPyV(LK=%y^!?*;JXK_C4Nst_m?HHo|lJZ;#Rb8qnF@9b1ceEt4@t zxK|2x8NWdd&dNWH0W`068zKo(O=JW`D_jAVfHhWCeLMp_7fN1 zPAm}=faz~JhgIT5F49$b4Z-dKMPP0!Yq39edf7dvDEU{@^!hI|S|`P;(dRN1gL|0y zeQ6nsjw`+E01dB!%^#$SH&2oQwE`9jak9W%AXkakr+{yAP}co~U8&2!BL-}H^8QZX zUwwV;d!o0Iz98FW=2hNX4e$VOu?#iUhc49qxlp1m0a?vuF9^ zyPye#Ffz?LvFH@cI0#v^*s`iVa?G&P5GxS!u6SyulhEeui>ppVR6}BvG$vU&ZKR+S zBbi?#xUQz34A99pxRQ_XSz3M9ixwwwXHLAcLC9|PdoBv4xSTO|UY-4xw0M-`nuOJ$ zKFnd7_s*A%iM5_sTCX8D!)SiVRJIjrJp!E{of((0ka_viDdI$`kig62(NcCypZ&z+ zR*f?|YkAWH9|@tebEvmxR$?fif)O@4QL>lUrqcT{%I-d6b20Dvz&41r zcB4XP0e+xQ`(@EDJNjzs$XSWX5$A)pcTObnnr;u&6&jQ&4-IV6BZUZOZgggrA|miE z!R*gN`q~VDP{k_@m7U*LYLcZ&jD9Qn)4-E;^9&)L!4oUR^+*@wm(RmH@+ku=I}hJ4 z%>V7Mjf+M8+=EMrz*}3C)sYiG#>v=&{d}<^{;QKK!j_o5JXcTG$%e>ryg(kNhpQG* z%@Z4PEzm8u(}n_pyj82pgWC8fuf`Mt5x&)rR)w<)YLqGza*_u;V1Cng^63w%z!Ki5 zz>RjfUFbIcSa%s7x|DV?F^y0|1iMfdM%GV9Rtk$<7LN$5wXC)H+)&5^;tG7&PW)xu zPpd>bLhsk;OzZyoX6@^=mgALsu#0V>1K4jst6wv=@4&avJLA>GYLk8uLX|Z=dVimX z0eI;^KYb!D*1p_eSQq{mE&QXV}5+Cg*L!UNxrU^pi%aX5Tl}p9225nO%eXp26P(M zlaLl9dsaBRxxbc1kwg!l`}Mb^r{H;?H@nF98}+@2!Yz*ncKLq{;45gvdV66rv7b)- z?{HDq@c$d(;@@Nc|82ngzwZswKd`~OcId)i%MaqE>d$)YNWyiSdoEqyGjK&C)&~f9QK(Ul$8X6(>Z0_%lQwtdEBj7<7s%C8vO2 zIEwv^I-;z;falrEO#rW&o=VTb_+on{@hoR2XXi{$yJ|XtbHbHN_7My?Egq-*jbWZn zCP{E2a%Iv85x&_rHobB3HmK>^zek`4l2_8$*cfKF0SV3G=>O%BQDB!v^oo#Lm!W7f z@1vdJ97OF>m8x3R!1gMfva`vW-ub#2#x7vDZL)?U{j}9=7kOr3@1Sd&L5)KMC$D?4 z?&ONHjJ#s_)RL}bxifl6yDyO)`;4oPsu_ZGhp$PD?Y6wHCgZRbSH2Wdnz7?PYJ(my zs###p#<`@FzhQ@j=i!a?>cnSV?6$`cNnTv|G9PaAZ7L=O!(#7L7ecp}^9}BCy^{c{ znyTOtgYdzuKh8R3ijgRkg=KYwTFUuNZB9VC9g9vDryP_sAmi7fr7^V`N^=QTQ{eeQ zKJpkVx^1wp{)8uruSL5)p_~U(xnbkoxx73^C_)`FpK7|fV#FCy+W#C;+C>{Th=B+n z?-gkAguH{Mt?<|=V%hTh!gH9hbL&^e=KY(+_Fhnbp-O9MSi_EU`?}c=IZe#~e4X3w z&?2JYtSxDDj{qgi+;n~UzK3O%r34kMHnDp7KNkVc3EO;CKTn%nCBa3aTr3f zbx=vXvEMGMQ@s_9m#CWR4K6vE!nQ#T<~fT`ag{@AM^%&+PugXtvO-X-yA9xMpG1DM zZmpzOfTE6nS!SFD2VeM>kXHLUI>YDIj%1EFLy3(TiTbl~bp`r>TZZ---cR3m#VemX z;vAHb0J4@yh=srJ4JCE!-hRhHn0DqGV3jW@D0v{cs_{|OwASnJf6tMT3@^_dT9}fx z>gjkc4e;^S={ttN*MON-E6jJ8aqh030n2kOtSdl`~5ziE<@=zfCF~h?ivAV?5avJm@&GU zR2L9j41RIq-yLvv%HC9yi&ra`mqjK&*E<7FhiZyHN?FSeQ|?4J-mcJwPg%S7rwAR3 z?e0kcRzckou^3JG$O!;5)G-_9?l?HkY89i)>+*P?O+Z6;Qhw+2nhe@meirxjqTM)J zoSA94*EM>MiF~sw^H+@h75$hKaedvK>BX-W&_=dV-aeDn3v2FnWHP_7S}|(3s-QH~ zzBHp_JL@vM8g8rUBZ_r)3f{1E^xuBCB0+25grv;T&UlWoM|2q)G-sXOWe@xSXj?%B zJiP*ai&DC`3s*=!8^Qj`Igx&KKdPV(o7}Ktq8rn*S`(ThT~{jfAiZ^&-Y*LZx>lie zQL|`(^ougMDcdm{KG}ATCe53@eK#oYsb!w^fj48`@*^(Cr2F-6#P_j z*6N%Snq%ZxI@kq48L-%O?TdJHLSB7qtEzw&YVWgp4ruw@Qu&145o)??{)ra@%)8SU zH`1GDwQ_{j*SRX#{@_j9+`UbL=FM{yJe8Ctn}Kkc=N%(kfju7_uO$6oz=QKX3}oVPfcG~5(bTeFtMNE_T=#ew@&?N z%T76kKzR+>39gYib38`h6R!z}FLPLg(qe8NEC{0BP%5`ORea)ti( zOgFvRZjo#2l|>1cs?T@MqQ1_6uT9K?N9VO@@Q>Rj=GBRiE$2_`=T9(95stXgO|Eks z%&eg8@8;U-gq`2y=^lLzYjO~^l6J_!3H{e^rk{fyd);rE3}6|by+6{+iMZ{>AvJJc z2b3Mu!g-tBojR@P^XA&;^1ZO+oj6gyKz|QV$_qHwyJ#s;P!OhcziX{$;ELiR=S;70 z+$w(ec}fp7Isa9kkSg{0>rWP-USTOv=REypjuUeS3k^k%4N zCE;~HZNi^~TA=Uu@!|2E>DNnoI+QTSka)0HrpJ zwX+7~k7WezMJ}(9oom%HREGnTDE}Ns#pSuGwagC9?nU<%>}KoQ@?XKyfuGUP-`g>_ zFC|;*g?^Y5tY@=%ZAr`&ZFV8n_aM@O>%?q<;Nij?J|NU92BUU0cr7L$vHqkk;mf1N z(XH_%EdCv^?(N%rtdLYs;Ilq^c!sFFL4AHcFa3}sJU$4JnHlmffzQh_AS$`0_?gnPI(3tw}{p%eec#`Ug%zJVPf@49x(i4 zPZBi7o|J|u!FMKY_%&}fUZbWZEg&zf^P6W)XLh*908@v5d_)EQ_r;$6F|B260vRMU zPZrt81!inK= z_;Wz)cxYtB!jtN+L73fJt-g|h2;a=V7AyBUZvvcmvHi&>?cYj|WihlrG$w~!Izh<` zzqBhAVVW77GnO~d2OjkWC9d@fa}J!Fl5cHOHf`Hni%)*3R^2`pFmd9&P4DIcd>$FZ3_@Q0AP1)l zkiWY-u67&Qs=>3BYV=2yN^Bn1bfrO1LgeoTjei=|7f$befzM6apBSifJbK9rBjR@X zIYxDaz9;X1gClMywg0PJSd!`eK+VDDKnu7Lm3mW6h4#`pIz`M^k~|&hQpCT2>04gV zue;Jv+O~{aJM4i4d|W-PU*~>J_FW6WqpC=s_CGDDfWrX}EOgczj_v2md_Qu5Y*%BJ zAM$;80Q{)5hsd}!6EPqDCnZQsOu_7ED4gmo%_vQDul~vyp?LA&S2;9Q?nnLYtQPzm z_u{X*5+l*_n}Ycc!?D+E=B8%kAKWgfB~ZVAFpj){HHR6iO1tJg8B9207bTsQ%>+e1 zw-~U<@#(%f*ze?G*)iR3fyYl=G7LnX8{Q)ZxNY&@E({68?4LkaSAZpgH#dDM;MoowcG^o0N8vdVJ+ez+Al^JA67_x{#I7)fah<&CHss%+s8 zjqFg+B<-wqx}0As7p}gd^1v>oa%3(%kXFDY8(1*%1wP-nJ{`|@|KYY8LY-S04P7d~>drr+rU$PaH{e(RbxbeecOBEuUqgt;Pm2>yjY1cZdqozmpcEuKq`iESoTwl22Q0VA zz(ax`CV_Iy_#kW{jqlcK?rcp!%DGgBdv2Xj8eXsa0nj_NGm>q`P8T1c>(u12fZH$oCIEV1Cq_1}2U^^}q(HuIzVDyO7(JN)xCiKp%o?^yozvpb>Pd-qNbORz$I~z6iaD{10^cj{ z47IwV0SX1$=Sulw;?iOx?)&^}9HO0}CR6jzsUKRt5k^JHlOm_@&NkT^E~W57-QT3n zY7H^76;F4DrWWRd=NJA-okmGIgUq~KzR!`ON(iCD7^-B}`ALF>+Jhl00XfX;h;B}c z(Ep{yBhaY>SBVW`IDpQ@ZK-R(sH(TKGz0CXzE`}C(+!x+JdDIEfPz(o|2`35aND~^m!i+V*M+^iD71X)Hb^8*h2;X_z zLN}t@HX-Y(gI+OZ<$-rWo3H2t94!f7q-}! zuFQ#zU;krBMxftC|21)Fj;H`R#Xt;AaJcq=^2-dX#~F{~ z=DGi#X#YD$`~Pr`DiY?jPG(?)I35G74@vsTCdC$rLs<_z|Cz^%glVmx1XTftXd0XL zC89Zz`PH8J&S{g?$)7w|SA693_l#F?W%CPvucQ7_-QEm@OlA~rqxGXV$n2&5ZPZRX z3L>+9Q$iPXszrvipA{o&{0=Pf(sxHvzn^!8k5mS@j0G49Qsz~$mK-Aa(m9~(!tlhs zJRUnk8L-D{$Y$}qPW5ss6G|{}2vb{0jH8JBl`eYv1GTpvXQ9ckBO|sOyYY-|9o`#z zE9AYkg+1yRbZ-z+z+Tr4>p^F5GA#GI1#vFsRIm!n*nAx%A&vvApLzu--Rz&!Dy-S= zG$3L0brnCEA5swii)MU!kf=C628HY;lgSU3U9QvM>Z>>AySxBO?xSnoedAuZt;R6N zZ=nqbB?J$N^J`1Mkyl~HH$a=G5&)$lz#V!QvmD1$C-)X}(2fCVIp*q`vXPEr%qQN< zGiNPlm;*y-#>$I*6K;g&w`xjWqYSqVT4)v3hyJb95X;zVnKoell~KDHWv0*>y;F%0mq^w5H9S%7pn3E*WSvTw7`(6Qb#EFYh zS!Nh?lPV#fmAL2ST1HPb2so89aQhJq-H`+ge&3cgF|eun+_YqEzHQ#!ZbCK7lbb@k z&!u4FyVbU+8nK%d=y*j(Zcw=3vYeF@99<$&I-FvYT50bj`oMN0Jqe@(I+c9(0i;Q3 z({T~Bo`J08^g-H4h36gmGt6r%}-8TSEz@#2rMuLbwIT zXFY{QjnN(1h4axVMof*$U37s6PRL{L!GkEt4VXRFwRsmiBk_Ed#a>Ij=f)GV^^iQ~ zq@i|fbZL!35lvny0P)o6IO^zbf6-l<){46wZ2dO;rC1t3hr-CEOutXc-oZ=P*rWEY zZ+TezJ1!{&60I{AenUs+Bu0{S2a3~}4aK!ap4z^Ae$lDQAhP_`RLh6*kS&=7rRt#w zw=bRyE7P%uH$k-J2HY2`ADnz@ z=*NJc&{+?3Duv}PF$#psYV6SVD0}O5d(?WI&`z2&j|NpK0vWi5+uN=aQF7>r)8`&#NA5h5-gO-!gg5m?ocY*TTXSCuL&&^JiEyIjy9gmARR0r9z zGnBuD_fDtafvYL!{eENoAue78Z&X$#hCR2NvrOqYGR=pzp;`l9SH6+q0}3++15(7R{t__{>ZzH z8Lf5T@MN7F_zT!&!y@eu+7P2$Ep#ssU))n@)@&qWesgvDadRT&ziSq$6LICefdeO@ zNC-G!5La7U;Kmxi&ssCwdZEW9sRm5lUF;ty9kU{*-L_0iu}Va1tA$4m-awtztiF0Q zG?tsmYTZR{MLT0v=t_IrD7L+?{aC;F2q#kk5&{Y%x4s*H&Z}11qIn=nRT0LBKaiZn zF1Od1s{FNJZ}^-4Jhdr{z+EF z@znGSfzzyFEy|(21)$&_P4{pV#FOnjLg}I`9NshGf1v>vgbL`~O1M9n(H=KhoDtXb zopqHN88|m(fn9+)c6UcapzzM7f`?i10h51FG=_PdT)Oca18d_0*|(QeLKFspIvY48 zc2*cyu8u;;;zX*K)8!kkqe(le zQac{$s<4hYPM`Pq$=EeM7~n2XYwshs}XZ)hD3Lu5ADxoIMd-Qp3q`jM-o~iQXoC zoPaP%uq(v#a*aHd!7hFD%wM!13|XVW&vT)ag{EXgM+ee+a=Qk3j@HT5%rAT`i*-Vk zv688G^NNBS$q4@pjTh}5O2Rk^Z`(h_Y4aPQmQ|YJn!cJw$lccFqb31+5nf_>=SQ@w zllg-dyDfnJzpLe#gE~U0)Pm~sK};#^9EpgF(AM(UAzrxU0RNm}bjoj!%*(h#k0WTZ zjj?@NGCG~6120XHrlUk%ER$59G1BX%D7JF$+Ja{RtHPeOeV_J zTNMm%v*6?q@R^UJc{mhoEyHRdUfbD|>AIGPotN96$Jw>T^>J+DU6^U@E>td=$K%MX za)>m85dUR7FbsOwqB;O%#=7Ucmbh2qN(?=9qY`0)sIwjU;jC0kyQ}SQNP+SVSPw=v9D1uThNw9tPah!! z)*Ww7LrEaRmkQqs)Qz59`Rc;RL8wt9;ttxyf*6$wYAD!LS_h$-|MJHauP))?$_ep_ z<@&yoNArF2us4iZrA9cC7e#U;7OSg8$m&|OLLvGCu51#N6NBK-gLI%Yh~jd{oXN^) z3yrV4Fz}!p_z%oat<2Yx7x^tRsq={`?X8@2rXsG2kp6tXeZXxdUhsOHpSo{1(>367CXaSEDL6 zya>&@_8S?bhvFXkEzA^#Kg9bI>(UJUkPbzcYg=n0y>+403l*?NVf%UX6!Ws}Cqrui znzk+lt&R(-*p1USq6Hph2Y~uFU2LvcwTHgh#xpu6=p4%CwhQaF9qo*d{|cY@R+H{_ z!^N%$*;2bsU55wMboc+DUle@8QuA2zS^6sP-3NlwpHDdG(&k3VpS=_Nk#*Br-?$cTzv%6gc<8kY>(=q0gfVGiK{ljl1z=aA;NoG z{y~a4xMoUu0%a`J%fpg|_6Vg2{x}&fRS#YE5Eeb$HLY71wjJXsq;X71J`X$Qca@@b!J@0T6Btu3K0v+Kvhr|b)%ya6{b+8) z@?64|H@*3#Hru0E$W+_|k;Cm1jlGl`6PbwJCrr2d5BpZv%D?mtf_AbVbM}MZ6z0mQ zXj2v(7d8dR2UVHv-CHBYH1<|}SufVCpfQ}`1J9w^_ycu*GQ%r&kgLaYIE33*&DRtYsjc)HH-y_s2R>Zpt79vy2Hcd@;4acj!m501n zUDPAU!jSBB>{gj!|u4dlH3&fOi z93~Zq!v}8tNJ9uTni>Xd)|9Y*gb@~>Dhy5WRf6YNX^_~Xo-tiuV(C`1knZJDAHfFg z^S$w}7uHSJb8>9wg}~~z>WU|XoC$)GDR}lo{YvkVKgG5PY1H_~Rrc~qQ9J_COZeQ7 z5@#D(mNO&P4_ay^w8hhZw@SH(!PP1R{;8PomQ?*yEa0J_U7z2&G*UqmmWhZnCj-~n zdXS5IBc&M=RgSU0cgE~#e}3MXRTpbCP*z6Sw5UA(?6f#w;;0)qZiXdZSA&$ z&yLF#vZ!@p$@~2V;|`3_x0)AEo&~k*3!lo1R$>y1bL!xbd!$27vDnU_lMTsth^(bj zoo0w#z{7Xng0^z(-sUmT(KhOD)ej2BHrujpJBTph?(FU|pS+@->x;4t57zDc`?PM& zdezjM$YOp7p(^B=^!W){r-ZX6xl1swjY&>mNZjAD1m!{9wR2@=4FcHrz19L68+CGZ z&$9hXtAZK2?pIENm<5HTXVaAaXv>xPhTnECt0ZjnLgg&TL%cEtWjbUVRY9EnQl(+2 zFbWMmUAl{eYOs%bFc(JYEnl?-5q9avETa_XNgT!N_9wk<=k>raVT*#w;Bz&(L%l^i zJTJFxhi^c9X!vbUg!~zy3fNZGde$UmjD9a9-I+$UiYOeo)!`Z}~CR^#XcxIj1 z;kA8JcHE*NBVgiLnTMhI!^2X}px16Lt|seuE(6;_FoW{(Pe`5p&%N$g&T4fINSm&4 zPNXWYbI|S0W+#0f2VT$%Co411Ynf-R-~VIG#t&JUHmF;}Zzf^D5{|P*h)-Q~xX&zi zPX~^d*@flX`xa*ew8pRtRDYYt$#Neg$2BVLtdGakkMz*PrxC=(@?0+{+G{hGlbVPd5i_NqtQw;i)wR_~dQ7x<)9sO0U~))V)w=tO<@M7;WCXq} zn_#C?ErN8S*r*<3zaq~)_dXRBvz+~W%Nv^tQlc42;wJw3u6{%KOH7zh!2{LRA72t zMfUL65m=Q*Fz?U91QIqv37dvlsJgFzkmqVXsWW4syz zkHf<^nySU)RxQcB#338*$YG8swpEQIo7dzeEj1O5J+kdHwLu0+d?=pkiO*19DyIl* z__%vnQ#WHtFU`eeEL>afAhVBtTHz?eZqwp*g>sU|*4?DVY<*4ZQNC_Lui5ze zd~LqQfC5ScN980=Qa^+3$#?Usk<`FNabY*>GlG6#y{}{`azcl-z0D3efZcAE8Dp(* zPjFVN`>hZ}1`wyDc*cFW$gQ+GLN~cV7nt>@;PSp?9$vNA_>$<=zWGkZ0yzxO@CERB zQs+RPx_X&XO1=zfS}dY`xN_(AMmil>mSTP}Z=J$is9R?*^v$1JD=w@#&DII_UZRft zanBX%uOjtuiy0C`&(Dr~P#WAQTa3y@q{q=(+)is)uM|%95&*8KqBzabG{N^8pZyTt zk7!u3BCBt8nlYH6d!NND^R_w&Eg-`*MpHOPi$h@<*@8fBRC0%VXw#qlaJZYN7=t}y zEwuV|KS}^m5pd6WV{pOY$w--c`J=gRxAI#!1O`RVph$DQ(;Yk53>VwPDGDiDXiha? z{6-oi?^7sdqjg!;{m*Uf4l#+>8$?gxENo{TdYOtMB@g&;@SrlaeRVjY$y z2TfM|hPhm94yoI4P87kgp7$f^*O_sW7hx;JJ)Z-U6r)m9C?oVuJ(pV0*sZJ#y$>xy zFPyssFUH!f0A$4Z=Jr(O`Zk<9GD=>;j5p;p((*+XYxR{O(udnl%T2&vOcBzau4T3; z{oYxXQnfaAe`~DG%w&06K*F<>kw0zu2 z^67IM`9f};qKskI;jeFk-`dk#=DQe!{GNulLSGgdAdQ+>H*GdZk~H%QjQ9BoS7+!A z+nSD-VOH-)H6mp*k$@K{RZnG>hp$SI_Jcj*1-8OP^&ZF1>y)rvG3#**bwX`uIiD~# zC5f(bnPd0^2G-D}n2%kd1wuSzg#i>Rx?48ssMx7bu4rdXR^A{bquQCQ+XAm(3@E@F z+qp?VCb|T+7KIypi=u__8%0+^rK-HQ@0-Ho4lHN!B0AI6J`$O%ggu>0~ zM_SXev-ZS|GF%l#b95y5WJ0LMSS$Wh*V<1JSCApcn{8EF_0f)<2iZAO7uMcd6(@%` zXoUvWKqbi=4%^zkR|7sst(Le({FpRzYpvXJp5+(TsCWoEg#pVTx+;d+GpZwQP5ECs zyDtYm4(**%{B(~tbTrOe2T<$__`C=+_9&|o)3^FTaP$qA!!6vYOpl;f?^TC8iwl|87!F=cUG}oRCx^&ge2f5=BciBk zSJ>Bm7l#Zq3Is7UDQqP{QbqE?Z05;Qzx`r`5iTEi=TB?Oh;*IT_OB+Ws??8CEaR3>jID74#r@pKwpH@u&eo@#60dJpGLtF z$F{GFvya)(8zXhfwVu(12N&lC2LXw>?0DRg6MQpC78r$$az+*m65BYUyi-xAEsLz-vBvFVhNNR66i}*#>_m0Z zGHqy9>{Si)WfpUzn5&zlWI>&t!j2}O%QZ?5+=@%IOQB2Oy`t0puNm%-DuC=1OcVgR{bRoGB zS0<-!mS%vqoy809X@Ft=9PNj{8q160eE3ue$qUW=q>% zmC70ts#hRf`Z`Gj30jRq7Nn`^bqv%!;h$9-(7+lda%CT!)X&JSk5Vf0$xm=D-W@B< zjmW+R_?!TCaaUDwNYXf#B<0~HAN2jbjg17*^%$F`u;)BNmwlge`GPF=JS%H(Q~2)G z3ujt5rjEIpRwf)D6DKowYqfHR>W!th(IJJvts>H>@bjsp_q?bk;p-mn*Y`DbWL1YQ z`QhSur2pD;35bN?*Flo5+Pi?s*^5|ByjSqUtp5B1ad_t=?>;JL-5rE8BH_OoF!QdWl&3%H}C z1FDM+Jd8z{N(nm}eLE7aw#>M^p}255Es3#emL|Q&4Mx&d!LWtzd?^bpb-(Xr=WTZi zUM#@gxcYgA;Zau;kMxnj%z!J;^n`;YB<~%%SC`f5!EvG8FX?dqJO`12-oef183LJI z5yWLq^N@0O}>v2h=0-H$$Uk~Qz7=IVS~LDL^E zA|Q>B)|OR~k!@@BQ>$qnbGb0%zTVJDjoJmTO9T-7)wXTtJ?OBu{`(E*!G0qhKBIND zc6uLhJ=aNcW9OR*(OE@q%YBR6&8S*Q@L9jYdO$TvX>4lhjZUI+f z$SO3BS(h9{`{I>>wyQFEhMExP;n@6B@%B-=rpOb0WG=>7DoTG6DY0mui!luGEG(5> zRpu12Rz^?lDW4&^)pJz#W{zG#yq`HWF)>)MTHuO-@-##d*tRLEhxq;q&}>(ydM$8e zC&($)pj4-5x$Q&g(DP0Ed(A!uoYFB)QjZ&tn?9BUw0f;ws zBUyus9FAgQ==Fez^Xw53)FTaVe6UEhDiPv;k4R5mYzoca`fWFN;_jq^f$%ZCZroV+ zyAB1NIJ|gRPpznD=mojDF;hD#owAa0Va3(|Uh#hIO3X34Pb(8!5T8b#m$*;;b*UY4 z-zO8_66qg4*zI4>N5L;tUrUx@v5i*7Z&Y`K%I$)z>++ErV8oBYE<4q;F(IcYQCm<0 zMZd;penX`@lP1;2a_^cPV(IFQr2qJS8r(i~@IYHUV5aLl+J)X_P903~!YkK`t9ILL zWf4u{|4f|o-xM!g8KN$vj7#@SKpN|fKwr3zG?6pXP`DTfc33WCs!%CB)T=eG{2n}g zS^(kky6ZFhFyv;HYhPi5;>Cp?yFBr0gcnlv?;G@`@w8S=%Z>eWB_}xS(uxlAVf04M zy}a*pj&73W5EDw&<7m3VMV7wKwYO85*>55vG7QSi2{|tYZ(a;>;=Px=yw(ufV+I{= ztlA!WSOKc!&m7)v(p;G0%~d2l@z`IyD^5%j-4(BmFdeR)IP{^glK-@8&T-kj5QUus zg;j(Ugcag~NtQ;88E({pmcSRd663ouoINJF@X-VU^-Z1@!E?+0sXW5|MyPD$6mpe% zxgnxjdvju}PI8PNJa&Im=bDVswQoJ|Wb-n393Lkq!Hh#1J{9a$D&D_)*&t_DtMpm) z4Ihu3#HWQ|a(8p-!>q`I=o*i}e-Fv-M8Ia{Zq>P>Gb z5=CbayLEAg#;8xWN*>&cK}~i=?Y&RiISJjcm~oH3;Omik~KOfnH@1?+bDL-^s2y{6s8O zTkA^m>n^ahKK~ltJ-8<3e!R}feY9kua<05q0nDVTr(wC~Z2dk|d2!OU=ZBRRY|4WX zG-rq4yO(_YiWe&_4wBD;nQ5aj(H3J*fR{j5751tP&%uhZ%g?AjtJG!4w%`jz?@qUo z#SFj!+1QJ{`p|$96lr*i={HiQLlH==>-5+Tzxb+BOyjQq+P6nM!mA905nH#b!N#9K zgFL#Brd(%u;K9Q0-cLL0xNS*tIG&r3?i~z(bQZ)MqPhh)n6d^)FGNBQ=aW8D=Kz7& zqjn#l9OfmMrVHHZddT#7=4_`ayjSpLO^x%fEjT>rTaker?o+RCSEV5A2}IMmGH5_x z9DAo@pet5rZt`I!f0KxIvq;8*)Ej`Pb5<^orrgikb?>Wb02-$tNp#5Y%a3V)r-i@d zsvR7;s>y%4xA|m00=NpJ1~hAb+#fM~A)HqX-E>kwM@H~RMNCANXY&F@m71qOKWon| zi>M1#K%=8QGzIeYuBDrKutKduqpe7B5m)2NJvs95ny;1X6P@)N=zS6zD#M)0 zU;43Kj>tT8&SjT>_Y?RXJ-O$ zgcPygZI=Dxc6Q{x?PfVtG4}GMLvW=Rm|mQA#j&zA_7j?6VSfy!C^*gwd}XExrVLa8^nVQ z^D1McUO5w1Hg|kRYobE8UZ(1JC$p1yQ2^^@`PzAgL{+FcY}H?Q7EQ(ozwE=|-1(Wx zYCH27eepoAsEGBWo@3N@eW+{Q4F{Bd&Mr0Pq*Vs|6A}qIfTPRgDz#%Cufu*JUhFf1zjJy*9B86ce=V1dV%ygI}mf;eC-Yo-g8~Cd_^EO z+-(&>U4O{Tg_k+ct<9tm`m^&5w^n|N7`(DIjtd0F+H#jm{U8?VX6eIaLMHJ9thH27 zJd(d|)tS}Q5p0L${FZ;{Z5h_Wr3;;fchnHL3?v-g7# z&l(vFmDrUu{oNY(jJ=d+a>F7^F1kxrPOjV*Op(F^+WR%1?f^?!rcr)+*G&0L37PIq_+I9@i|*dLBA$pkjCe^tZpxOK3jZ1 zO}Op^DmzG->FpGhMI@d#;E$CdtLz1r^wZ}ztkxrouwyWpOT3^}%GSgnA!w_+Zo|BS zpSaNXuu{+FxVxEux+;6xk6O3NW-Lz3%YC09e{GyOx@uiV4Wah{ONLjr?ls!g zRP`fmi2qd;4U_yZOGH$4uv55$z*Jm)mYtHm&O; zG|)2}Bt}}>nV_Ox{2%PScU+U}+Ag@PQ4!-31f>KUMM01z0s+K^NC{OsC`j*}(4s~} zL_lijL69!J34tIWy-5jGf|P)C2m}ZOGB2*R7g>AecV>QPzBzk;XEy(7lD9nNe(rKz z*NvzY`7Q=cAS7yeCNIVRs>4fh^Y@=Byng)`q%)($Yn1YVte3>uw^_BlLf3zhZH5 z&$b($l$Hpbs&x19gjyLfwE-#x>C%!FmruyuT$B=(W=Hp33kL-S!$PY2Irz(+N20`F zL5+0BpRFc+nO|rr7+J~uCSmx~$Ak*%??H|~`wos0|19eL-N6qa#amq(2)h}l;`1qU zNdOXfEj1BU%7JmPF0G)H=XHL4+WrUSO!4TYta^F(JhX3-z|gB7!2que%yAtJs>fW) z3O4+iGcDVE4oXVkus{P!8dQ=|HKqMa!;O<$af@R}s)!D|7y$_9`$681$h+gav%Yh> zqnNoLF<(s4lLzq?IWE!m7H`QNUG&jBoGp@_oGhk-+Qad)~)bxNq`uq3|eWYPn-b zaAK>A@U3o2*1e;esiXgbc*~7Fgo3bj^p=CY^6rlf2Uiowvl6|fY%Y*7L>jDHnz9t= zEb!fAE@kKRdSv)Ib?u)o2zIwZ} zV@yD((PGhC@Vm<}a~!Bd-(ypC+Myh%K(BY;Vp_Y}NO!g9eBOFZ#f9Lrb`K%!+IeFx z{`NRy+!Uq*l+Nx>%fgudSa9Af_(*=lpr*wj(U$k`HVLo8Bql%*uFdHAxA>j9?^P<@`m6$L)~tZ3iKp zdL*GqSA0!;bdQP=k<$XD2OXTCA}%_VubWL!q+y}PycYI|pS zH5(nG%v8GSee2_Cl`jBjyp;7%gaD6L*0d8UvK+M>4>$IgqWWW_(j%!U#yPNmSyaf2`GVa47B$+|( zyH-M*)bzVv(p$(E$fW4PDOs&iouV;wuTz!6P)f%OsTG~!$3Wt*U55OyghXC0vftgQ z=Ip=zqk3ms4DF*Gd-DyT8TJ=Y`$s?-AVjnFX3lG)%H3zn*NOehgi0R(hx?wW)z_%` zElaaA2X4BtOqPLKrYq>HQFjEW(yr5upsi3xYNI4|x_bNK>a#xr*u5tQ{+^Hjmm)DhFfHMM11>p8k z0KaDMa=;%??lZWG$a59(LRR?cR>i+mIvBMUp+Bb{YMINqW^oF1i8swolOLHW1c^uJ zG<{teI-|CFg9qA2YH%y*=gu%?xT8V203_?lTxUNqxnyBaf|1cqanj+1bb7uF21)S zW@}koRZKnGw)?EANat;Y51GDjjtMU&wR#7x0w8s>CIU)RD{8xL_ASP>#nXq(&at(} zKYGbxZ#(dIYpRjR3Xo^iXc-Zap!*97@wJnzC>4$Fd!~wv?HaiRM2Nv_lDsXKC{Tfw^G>{w)GPKUu{ z^FE5-MnVh0Qwn|m40kyHE6F(;pCT$)zED1IT zF!3csrBY7ZbehC( z0=19Rm`>utVsHJljJJZTRD7`P{cJa5t(yzKphbDbygGMU5y*g$Z2 zwGHHHxlc3E-B61UT}Ue<|1pL5$}0&f9zH^9%0eVYv9l<6NG%UoDkgvr_K_ zwjyWUPo^oZ^w_nt5|dQI4sfdb=#9tp=ndr$w8cKNvn@DVlIkbi_(HV@qfX18AhaVb z@MmOi@85_UtZPQRpi4ufX+{Fd9&aAgkco&%fNDwd*}o_i|4k@x{{qe)4A93jm;q=b z(xLj-(gFRE1VDSRIrRYml&FwET7LWDYWUj@X!+{C2|K2HMthcJ*7 zJ;-*@2bm}pmk2;sC?mdXeH?*#<9YePs%AohFBm7$-%|gHK1&KIm z6W(<1`bxdNdAOC2lkhZCWLU6eVU_9ysS~PObH%Uc)WPihH@r|8db;|Mh|yPE?dnQf zFCdq|EuWs%QO0Uhj!dE2h_n}VhV-h`J-ZWcmifr+wQld36X7UDZHCC(C0ENc3#Kv! zK3?pTf7LIR83E8-bi#Yj&GniRlek!;tL=-cN^&wfD1Z&Cl7A~Ej$xRE-TRzD$>F2h zpQ!HuDQ$2)RhlzZA#GRw8Hku^E=X^nnjha*e}7Uor!Wyvql>Qnk!GpdYbE|cF_S^s zrOsG54jos18xo=0{1{WkqIG|xUBAxh{a<{{`s>z^-r}5q+;?%&-iH}lfb{YZSEW`- zh^6+t@oLiAoo-zNj+RKV(E9-R>t=q|(~CgCzd^KZ{uSlX&Ba${<8L!?uk$BqCo=|= znw?PW3F4?0gtIq`#uV3vEetxhO^BIEui6!mf z1~a&d$?rHJuvN)4>*P|?1g&$?0OgrAhz)+KE?^>L3L_b>8#>;I$kY~62)-Lr50Dw| zrV|qYDTtqQHnt4Wxoq~1sGsA&(^HQ2aR}mbhvHS8BJ?`f?mk0>k8%e^!iodCUv#yH zdc2;YyG*K|;_z#vQHv_`hO0z$J&TKsbs1GxdRd!U?IczaJ>$i4BJOrc$ni8lAZez? ziKz*BFmu~%Jo@9dd|F#pFdlK%@ClYjG@i|5mLci0UYxx*Ax zXc(Kk0NsdF=$C;eq{{<3uD9@AIHQ^H)MNlaQ3YdJsp+P}U;que(K{-$wwxZgk?9(A9@9~Se=tvakx~??Xm_TDH zA}@loqWHVc-2uA*EWOjbwC?6%__y}ZS)BrwJ2A^?Ha8f#?v+Gkq-0Cu%mbB+G%;8b zxipOBs^_;gWr!u)lh7VrFBDzfwDjK|XH`FyU*D&0+jeo}Zs&8KMoH zZsGc`6cyxb+zn$Y(Sf(nxB+DpxXL+<#zeIDL^l`s?WwOL!aszx~IQI3K zjIoPZEV0oInEs{V_oPY5#NO^9KJK#G&^9hHKsQOW>xoR4#_)SLxXQ$d!)n5lORPrW zS5tWo{N2i~oP!3bi++XYLwVwuG*dA#@4Q!ftW1-)rEf!e?ZksfFuRf-;d|DG)qwmC zkSjQ{0T82`FVOhfeNdj^tt-jA;TowITbf5W6%Ex&+V7-HJrm`toEc$IGPg?vmFOwk z`CYzFOq!26TF43vy{>~y6Eg86&1ezYkh*@7beuvY>)OD~p|rt+ao|)2D;{6n9N15Q zMc~$IDG2Gl1PBJHBo7$_fezgQ2>vZxc7N%X0dTqKk0N0AS$d_?fB=P9m!YscTPJ!Y zjp50=F@9tus)_^fN{-S@gHxjZNsGJtFY>>iOvAsx zNBxz3`ERCX@tT;0nZ?i+y8MID>OD0i@-9d|8FYDN_gow8r;zIWm+4 z*02RsJ z26muluxqt@-NdBJ;U0i{>!4rIHZtffa~_Kfn60u(%R_kF@ckal>X_|NPm0 zBVc98+7uMRE`{4f+@D&Q~2z*UMCP9XIDK6h=sb$V`c__q%GM8RcXb%vA1YKPT3_6RJe`g zZj48Q%@Q{!m$p6oz`;B3+unbol3TC~)fwLG{0>_Hu-Q}6^R;vy=WPH0Li)5I!WPt9$=JTXI}ZuPb%_@KR+jiMpL!v%BRMQ2}Jqj|0{ zf~;Uenv%@FpFR*9pt2=;i=Ma%}JGy_3E$`H5 z_%Y!GO5|AbP4uorIU_3ox6SJ8dk?DeG$Z!%o?*rw~@$8#G zY393#SuUn*X;tSo^ZgRd?r_E6G152@`GbGmbeRX58y=YYY~n*(@n$90O46R7)82++ zmXI_YkP>o}RKK8PBq_SA<_`3r*x}Ge=gQpy?7$H-d#zwwqkbG9RJ#&5c=pA92MHcK zKoMd#v(c$X{|tf86i|7OV?ithF-!EbZ(ZV;YV$P^@9iJyaZmF+T9Dd;GC%KRd~)a{8J+p&4mAt*3T>q611!OqtehEkH} zjUI0A4fF>EdF!>`_Qc;O{qsuo{b{N}Xx|uVtx9(DNev+e{v>zb6Ld%RJ(;G5+C$uogBhxWnB;_aSf4Rwy}tDj z)3Sp!2DvpHbYu!!b!*S!04RzC_CL&WYj|@^`9Xz9P&*!4gm9-Mjj$SVY%S}$S~`cL zg28q^nUdNuxqyU0uu-LfQA}Eh*G?UBSS*)b3p<^>+6@c-@V7XPYP^S??H$jj*ur7pllZsz=(vQuju$S(k< zWyTWo&`$R~^vzk|RsWns#=R&`VkKrTkR3ECkJGnNfP6ji5A7JBLc^;CS-a2`^7kKU zl|n5lx&^>5X^cSbyA)6mP?$LkWElZal}0)stTTJN&IjnKV&%N9r6%^uxsNH#@Kywk z2J~Jz=a!2~)_eeeT3AxRL{0skNRQeSR!mN92IeVF9-NegUZq|CXb`S}B%dl1n!hOz zW@da-fu2}#omu4e@wvhx&%^hkR-iD@kNefWMahMxfbM6i%zk__rY$=&&V44qn$PaF z+JFR)c0)=r1zf7Xj`2utweWAB&fdstENiU;VgOZ)d;Npgj1|_ESs!2&F*Q50@Z7( zKp9oM)$%xfgC&}rWUn}?!rTkN!E9qUS3q#lQ-YIfE#DW!;|#2JsZmBbC@38!A(UtPRF z&A^mD$Uq^w=ov97?lLZs>on)Bk}xjaJ6q!x*TIiaf?YNxev_+7ea<(_O|pl$+#9ca zYd$P>Xa^Vg!eUqB45O`4|C@@#YcTKt$qnfB8bn$#+gM&r?&ZEH-K zxmT~azV+^gpS)dGCz^pEl*z=6`2xJKs`GqLf*7=!S(Fy|GOBJu=${3~~b{Wg@R znx#ZjX@Mj0AUILZ?n zE|aP?3BU+54b2ZIO`YUOHT~9O(>!xssquE`>r}$cN?aCyg+sCkjb#NKv++yZ&PrK7 zj+^KD39Q7ELS1X$ak)1BN|2X!bpi_6uL=GeIrxb1IN^!`yGk_Aiu@6&n07_}zQ>=M zyVaN{u4fs>16)W%(sJ-%W9k~s)d@hg70($y@{umlik?Barb>vce8JWFS}6P;ppsHV znYWt0@;gj~9o_U%eC!U3a6-m`EM+ohI!76~yW2f4&!Kp?WR8_1qL4O|WDi+$IfhJB zTwQAt2?^4^NOM1+F$n7XZ!=wCpd5?+dA|k!cKN2y2gI5g(e;8vU4PhFC^6~mek%_k zTK4R%RS$6en3gJ@qpb)jPNuQf|H-WXVLW;MyE{t%U+OOYt%~qp<=OpPJa80n?A^kT z;NWX5`c8t@#>GV`**Eu^HpN{w0os7DngCJiugVCghbN6;i@LSf?apSQg1OIqp0)LX zOu!AW#5!SqUhx*tc&prr0>p_J5Wga483^$8a%lFjLL8{wKzs<0OOJFO#^A97pTK~= zKhUYqZ(waerE@4{qNMBfKmR5c1VAfC3MRg5L~PnnC$}euBDjE#2|IH!yo7(cd<@9X zwDZS+;<9E5LyL73h>&a3giLGfoJZ``19X?%4p%)qRJ3dDlj-s#t=V}B5s8#Y9{`xh z20)k^j8(Rb0v=SlZ*T+X`;n>-VdP6Ux24X+sTToRFn8|8&V+KIgztxW-_acLGsL83 znBl?zRmar^T|U>?XD7Ym>Xex!2n^N^em!@=eC`lEP~@E{sA9)-hy~v{%uC~H+W|TC zJXlrb`p->$Cre*nI|@gI7vM~w&OF^~q%r8glN6IV+|TcOtGB<%*J0j&atdg%QB2|h z+KA*A(wMYg9UJjeiHOgJdB}t0Cp@R8WDRhcdodx*u+o6to+nhQeBf8NiM@!`=UNe) z_6yo60#E_zXR_U8W@ZK=UHW@GoC=N(LV0d@VVrD$MixN&Ay};VUj9qk^>77vMYm$} z)qs`dh^H}@l*y^wGJ&+PL;z1in;D3e&wX*02HjG|2z1p;{Sb^At&Y@xgz=drbkr1h zep_AsGx&EqsUNM(U)w_K{k{Yw8pp96d+h*Gg?0(}?|bXQY33r(?y{MBxhK*WsG#jP z6XjX#nwITh-oo5OTNwf{*HK@DbN_k~PWq=T5Lo>gn5#!B{c1I1z1=3JwICNJx7edln> z*b_$|eece9{Vz>eaW#o};0|3?=V=KGNbhP^q4%=)Vc>c8rMBOQO+b0Hpm#GEj*}*3aZhpP#A^le zklv2xcEOLc~hUlgSXiQt9& zuE8k_*ce^d$!l1R(Z9c=A)vUp(uAHpaL2y|$z^_I;@PAu+rEzT1w&6jZ1X`rz#_y= zwcLPeL%tU5V=%_sg}^L%uu-aJQ)}XkfPXu(g@LuY>FjW5I`VGeyvNl`eWG|%1u zN~M?ta{Hs~9)sqA{N_J@bu6Qc^u0=uTvZdBH=3Myck1`doCiMi%Ezk&Yj=$jR$Yt8eyg>|$xpY99FUP?5S z5NF#d81h=`lgmql77$mR04_94+Jidr_`~7GfdA9Ww+bgzPL!{&fbswq+aQMl9;?Ux zUfcoVVqUr48xR@9iZfg6z;Q^Gto2PL7@KVO4}MH>5M#5ZvEqkXk;Dyzk~DRL6@|5^ zo}NpBf9tUC;Foq?)IEKUkejf*)r@moF-ZjN;Jo_vKwk>>0aW8s%c#H+^7y!QE7Ba# zj_TZu0gi%*rL8VAa+RBNap4WN5kBnnk^n1omr|aMuu(cfdpc}g0Vnu@4IW>U9o~qxO5UaYl z<+3(J42U$!M*jW1P{4b6?bOcHbnC_SfR2p}x<;Hr>rj`V)tWSQBmDF3R+VU133dr-_p5I1WAaCJmMh)1H2Uhm~{hxyi z&@lhE7zFm5m7&@vrY4x7m&f)uwc#bWiXo2gHJapDG94Y`2oV8{*D1N#kL3N*$auRn zxFs;kuV(0RNeo6@H=qewD)zca;n{iu$h7}6uya3^p2`${1GPw`S54E6s9`C!n1uIk=e>FOVWBfE)_wKI*HL5E}}MI@dNGLK7Nz zIK&6Gsiafg@N#YE++{Q6?&K#sL5;UW7Y7UxTo6W@Tfc^@z;=3y-66f-y_}1g9^8}) zP#nQB%C;4=WfjI{9k^zd82MD{j%xG#`m03aNzYuXjEecIEGhB^z0l9AKhVaS;rF9j zql49NJ{SpHVE-t1-{Vjqp=5oruyQ;r-QC8kSi0%~1hRj}rOhc>_25-4QVj z5>I=2x??VVmRXp)cDSqmOJXVd)*5pj=x2Im|J z^E@@H4afBs)wDe<`wGjYI$B*;804U3)gRlf#CSRdFdLGx#Z=V{Rq=eaEui ze&^V>8|V-Pt)TfeBQdG+fbMWs;>BL?>S(}SrI}dN zZAfv61YEFh-Qt$EK6o?~*Nh~-vdGu=eYuu??L}5qT^IG#DPDx7hFm1&(~Ka_V&uYA zeN9avKknC{kp95S?mCkn5!a4>g0(e%I%S8w@W~!dSg_(SVk_S+4>A~0_*pI9w$HJA zBeo6Acw}`Vp)K|N9HXh?Zu|%R-vwUP6O%o-v4` zL`K^3QVZT)+KI7af~&ZBCQLA1RGnDc9XBtm^sd-iTiN0VO_RG^irCyd9~XQy;NrYW zV=~%SlPVv_Fv@81tJ~i+PPox?^)QIpM{)b=Ew5?Wr%{Z@%=t=yDx=QR*q-pAS6aRA zUI>v_g3k68ZSdQd@mc|T{5{cW>y@w8rMS=1T=v~+(u4jmYth@XpTf2Ha(>Ie51;2Q z(^FKxrfeB`JLXBlBTSAZN~DItXDc?bkF$6peaeEQzthSKdE6V5>`2DA-Nzjmk;kAE z&(O@&;FRordiBb=EV50NYEoivni{ug zkW=b0quOFquVO=2@f}W;=qZ{)L7Ds7J%GTT$?M}wFqi zM^7ng;V_j8LAb58AG5V2Sf4%`{|?CLH12npej|o~X7HHACbaYxv&}~E*6Z}ZF89p9 zRlZ$WoC$oD6_LKxE2zXZ5ScLGv)17vUgiHFNhR3_v?3keiz>=)w&o-VAU0&G`KoK#Xiwf)kdNb- zeJytSOD*&#jG4;6Exj2>%{^_bOmmny1A*9(_cW^lVm$~^>6ty?%2Osy{fUy<98MpV zn)m#{Lt{pPFSGj%kiMwyXW4;p1fXkNrLo&;El6p&wcs$tzkQf$zE(%wob0ZBG9yq; zsxv|uF19Ur!^sKEQPfM4gs;`xAu^vg$e?E5T85uOCeke#?%v&XhI=ln7s$JxjZG)9ceH-^yJhG~yb^vL1pOZnNYShp6!JnqH-=|EPc$D{s1cBhhJl zeF;zA7!-i*l;zBC=TKLWPy)FRQ$5V@j^FK}dSqw7w}?pzIS6lwVaf)gy35zC6TRy? z2bRQb4427NFZYw5YQE@&mk&%=Qy$~DP6~KSixc{|?FmZVh^D|~d5DYg46Dp$hIg+D zsnw`I!y$CLeyQn^M<>X**)ifs+=4;sN%k;5rhr4iJ*nZPQcI1E;Q-hF9` z@GUT9`DdmKrL${W20pjc={*sL(18Y9cs`Z{ZxPY{gHu-^S+DM^o<9V1oiLH;%xR^H za;);2<13b%r^{wf9Y3`%Iq+3M0DR3j>Cv*n+{jbEk=3L{l}Nof>icTS951YTxegs) zy&Tsy+*M)N3{UN!_d>`-U`XVp zo4(##oy4Be-LG@?xAuX^rMCJ6d-eW8=OO;^u~RiL5On~bD<5NO=S)lGuUUT34-61_H z<-YWcjPJx(m+rD^y-LyfPHcgp)ai^kkS(@qc{;s1j(&H7BxXc5lO8I2JAJa|1&!Hg z=;_Y%ee;a@6Ho zF>VlI)vs)qjDQ!N^QWyQh=32e?E^5!n~@j(>Q?{T1pq63h9;l(ulSJN2XdJ0_`Z(< zgB%X{o0)yj^KbTHW3Pwp)BM5$1KUqvCjS(xiLqf_1O0Qsc8~Q8hFR;XqTKgVk3fa2 z^whMp`h5Q{H=09Bk3NWX*Ma5;3Ye6=A5~y(99HT-8qDSowdmeyGlHx+*nQsLo~Q?q z2+*av$gvl6ahKoTIrT|651PRZj>V_S34`An(bT$7_aG7ejB^urCmH1!{n!RRP0@cu zg9w>Q<+a=2bH#niwJBjV<_ib_pp{K?@5j&I0eJ!uK*rF+8{ig%{`I@8@NZ)@PkDS& z)>W=MK)7P0S%mW{mah-Jl@D#rK;)f>yo0+)5L7BJ`y@ux$ueRIeYEUVm5spLNrq8{ zr1-vzWk09W_G%~;)L>7T4fS;;J8+l zNKDyuSY0)+ODS2oUwL|~dqFw&syy$Bm{%;MWA~Yb*gv#9s{LkesvV-zCM|V~H4Bnno-Jvg z!hUrw%CqR*eU|=ne1-ZAYd>B~_2qlzbjRmb%v#wyC*bHa^RjpK7*RLMJKNu8l>E3x z$OJVL8jJ1v9a48OB2>lt=RMVytFXr-xfL^(1|#iVx&>j&0^MvM$~PNaBjrjTpT$>v zvlFYlm0gsm`1zxveP{Eh3_a&pk#)aIQ2l1RJf~W;aFV_zH9?$8 z_PTm=TrNw)J~Y+~$hEz7xN_1ncBk>cY7+k7<>+JsCl@pOD;LU*E5>JTkcU7d=YZx3hW8Y&8(t}=EF(FBszyYoXAenCyP*V28d+H8GOZ(bpL10T zlLP7x45ExD#m{{BWTk8XIA(3MU#)7RG&Xq4eE*F%D5?(ivWm z(Z*I{%eSa>XWh!j{Je|KiN{w>XQhjkdIkB=?4y_|*{U4*6_ZGv$fFnxOcEVTZ}O~gqQ zqc7O5SHr;-!~Y4JJyP9kcTw3r*O(J%%Uo+JQe8$GN#)g`BS6qw@I~voe+$zLdgg78c=~ zR*`NKYVqgr)5%IY=lkXaq9S(G^0J~ODz%1FNX_^@+}XGuSGPQV^3oLDB0RHlf+SALWX(Nuk|OqcE_*N zxD@lmq~z6OCJDE-iy22-I~|Hg6y;|>rgS}33>JW8`gTm-^%Hix7NmSoEhwD5X8`DT zRpQ?LQ&DOzC5w9z1Ano4xg+xJpo8Uz=S^kIm$t){UKI>h+Dqpnj&KfpuMOB|1QP z86$I33Xq=i-I$$Y&+Ffq<^k|8xo*@4&?_{*J&A^BMBJWh4^I85D&eZ&JK54;=&EuC z{;ezLBFuZe?L#eurwC{>v1Bzexf2d*r^&R6wW0z`SWt?gr7niiIBNWdG&xD|33gM+ zS4A3Q4j6{F?>Xl!-=f~+jk*7@(r9Stnz8qW(N@GaYtAynb{tV1Yo z`;}K88ZP^BSt?WUhV^#?xX>5o1{XFgt0yD&I4fgK>by!JWd+;`7%G=lXUXyRT?YFt0L=a+f)7h{8ndccl%FHzw{c(n`Rd z=B#md>ZBR8ibx&j4IkgM6xWy((5wve=L6iJV$;lPQ8Q)=)=TRRR^kS~f9}O8%;jH0 z%oyBG)4r?S#@Gnkin~-2qyO;iPsO>IhEPIfkIvR)BM9^=u0D3|1JPit2g%ZE(Wa*u zJ5u)quM8>Pj*UaacGR%F-1oZn&YG^m-XI0-)K{4*mswj%lr8IdNcgA+q%%zj`*-N$ zAj_kIF=qH)i7H_Qhl2Z3J(+H4Aeqn53|HgwFe3IW_f3K7f-I^2c&cTsr1}ED-=T@T z&Ei2v>H$r8MXN9g%<;Q1k7vR%)uW*gEKyQ9DrQ!BqZn1?Z&zHIzh&6QTK_zs1GxsX zjrCDWn0dCPb;d$dddzHYHr9HvW4IFM699__EtF36d7cR39Y0MokU9YR@Xg2SoZ}pw z>fQo|Iyeg3E%2w7texrZydfGm8L`+VtjP05x58n)N)tnj~bdV~rBK z|E>_r62+ghociIIPORV~`y#btZ_%%@qjkizn4w9Q7-e47A={|$kW8h;7X(?%XgFSe z15n4_u_U&lK=*0VD`sd=Bz=pqq}0`lsQHZt`C%J8K}MyIvx~B1XW7zk`IJedSGjwc zlu+~x_Bk*>bmnnmal=<+ai4+%fVLbN0lZpmf9_d(&Q-GlnuJIq^v&ha>PI$$ zn;tpZfPMcH>~Z?vKZg2O1a;2VmD1X5!KK+bDMcj}f0UR#9B8)8Jz^42C3c8U3IA2q zp7^OAe~y?mu}^ROs&E-xA+D=)F83r@f5686B*()8&N2yb0RFd6T0boi0OiTE?Q8V6 z@Cj>1s$Bs~EYjQr2)rm=lGb`S;a8`66Pl3g7ykY^fI@_d>99|a{we}_u9Wm%R|Tps zLucrj=3qYB_{H98)MZrGsjEw7Emfvc;hkzbVIk176vL%iblJ930R=VlbSzh1myzwX zp_4^OYo{iP!O;GeDmVC=ojvtqyTL*RPh}L&(OEMHvva}fqujpe&t4^lCr_Iz^HEpq zVcAZft!PUtVNElBAc#6H0t8X|{}(}&v{S+qqk(Fb4%7W0>yu16{3)SKO7oY&Eq&F) zl|j&q^4GJE6*ug1j?(eCDTUZv&x@=6oQ5+UT6&z*!a0d9tM ziLre0##HEn9{aJpTrcC#yNOT5C1}hNP@%bDe)W}T=L;a9(dCRz4&8hvQRGfc0suI0FI72qxm?W*R%jr6OKp{Ax9*$RDG-YW8O^@GC%Z1lX#pX-d6i+1j^# z=4MH2i37TtSRD#3mia!-UfwHA+xw_dv{P@AH>9?rfu>5YVBiywD)kcwlR7GCLmo$T ztG$sje~4?=hxP5Xq^axe^Nx*9BNkUt9D|6nZ2Q>sJ)o{d8J}55Bc3t6x4Kv@4ttqhT>q&90GM9iw(P$%WU)$}uM+ew!q zkvL&MID#h3;slxp1vPDLp3dpKs4RX4Y>NlJV#t5f=${PxfgA8%HR#=+x0e8gOHn`) zC2-%V{G+UX{GP+h3(B;C}9;dFqz4l#xTS%%*dvfxJvAqY!>$=E>BR56+*_0y?_TM{a z4#q09-wcd=)mSWWlYs)VSR8@mpzgBc5(E~%tW5#_+5(Xo9!)c}G1IbeysC_S+WF6b z6WbDEzs?ynpTeV&cKl)K$Qys5_P&oF3Od#+gBVuN4_gMp zKiu|O1$vNI>(o7a>5SpEnc=%tNtxMbU>{y!siU(ou;Kq~FV&wYnI$=@ZF`C4#sJPf z;nK&L9JU+a+3OEqUL89A(0n~#^eSV|*^u~VnI3~2I4k$Mi+Ie|^N#Wn)81H&CqvYa z;F2?Fx8NR$!jh(`6Ye^&514n0Mz*dwD`m$PVd}TEIx81Gr%OJ(;nbTT!2e--O@}7m z4d8|%l^$#eXNsJP0*PLZ47hN>(*1f(u9|kio-c=C73MI#I#|a$YXs-7{F1o+ts+Vlu@2twR;Bv=}ky= ze&!w;iFLkP)q0FErsL6N+z=_E;m8#C&851<`p(Iwtp>M6<940Zec6?+p?!@;$F& zQRp!XjOv$XTsVc(bByvT4v$FATpU(Fb_}Z;0_2$5REAbd*OjfJo71Icazh{KjpqJ% zy{0te?pz2f?NBDEk;HK3p2qHeQnAe1{3)yXXyZ(hN>C)Kr$pce+f6+yY^^0k1I-%m zq~VS&C}kW<+9wYJt^g|VfEP`4`k#~Nx8MGA90MEnKZCG02vb}DaP#^}02v%)*zb$2 z{7mUtNw8u#L*va!y@y(OnSB1d+)IXKxBI%wNK$*BINln{ExkM<10KSiT!YX3CN7pjkVM&pzJiO zUA}*I@LZlZN(ciL2j- zT90kWYh+~5f|uk3-KgXaE*xi}g(>KE`9gdihwI#Fc}rOA*sLq+Bxr>u5DiOe1qAY{ zmM7J2b}+OGP;H#I?N%nfCNg8IQ-S6`#K5A_t4oU0Lv-$T-rl(tu7fOn0;8XYdo*kj zXV`jlr=RBW7d7VNMpN0=t+@+LAV$73lry9C$gU8_2k3>$^?9|1xz<2fyf}4* ztL!ANrZO2->l+!8eu%kZmT%C`VQKIrNNbi{k7YPAIQLF}V z$eN9I?j*61xoRtJcICblpj4bRSt?Ma0xn#QD++{(CVmUYxGm0cYc=i!sFnX1%UC&B zm@t~i&WCj>SUH(06O8SV{*fi96YQ ze6Sv#$&N@dma2z(+I5O&^9Vy3W6&UUN0oqKIM$uq_5t=4Z0CYXy0I zkn?V1+d5W+KGI4m7+8EkDC%slFznf7#s8zdD-CPvYPa-rh*O~z5k(DDtFed#1p!F{ zMVu%@u*f__6bXZZ3^Eg1BWghf8yOTxP=tVyK?Wf}NI?S<3@8u~WDrOg!Vn;YIdFHV zmGry!`R@I9`$K-^;hZNq=iTpq_ugx-wYJymnPdXKkiwld3v7(!Ctpy|8d0+fSaJ$k z+ELKIk`p_btLpIzXweUjE$l$b+4m9cP`WSgRYS`Suk!hdG_+<;7&TuozN2yf6TRJ; zs08HxdcP7pAJ$BdTSRS;5p)_7cdn}eXqaj;k^9}E-qNCjUw98f=k<#3mZuyj=mSJy}V%| zU)`q7DSLGBB@^#20nwtagIuA(bpt)S(~OEd?X^*XvkjA|3t2CNH^(7i4^MvAQWu6& ze9}I^J9zFf0Q+Y071^~N(J$9(ggDIT8l^XHnKejEf7!V$d2suqAYdlypV#_s9fKzv>x^e~IuFkxb!hwK!Eb$?_kf z5lGo8mEzB1&xB=y1?w3XLcTRGmQ)3A*qNoDW3y&%?51VaGBV{?ZiMAuNa{K-e z%jUE+Zy3SQbiufAq$kY!1Lo4*=K8YsqZI#)U;1$J<gx8k^2Hk0k=gk4A!Iwd zBj7#2un>wg|A|-3oNVl#_Tr#im=1tqls-jRsndXokHjt&V7_kF9Uh%xlW3D~WC6ES z79*N!-AL~m96aN%yMuB4$r!L zyJ$M_2J5?34{7jFj8R8<@FBj`W@)0wMi|)V zC_Dkk=$~E&2*Td(8E*8&V6^8yoZ?zIRR0Z=3O?Hb93{J70eK#~w)OPiuW2kSwln7j znBu-S;!N6Mms;4bXlL)Zt1EkoptO>aXy~MCv9NWZBfrZAcgfo+CJc(v74YDiMSM$y zp#-b&i#FtclYjij2n8$%{uFl%xD*Pnh-Xm@Af;P#YGpWhWwcwSO^kkR;?@6pEfE-| zjn9dvoT^$%l52Va(zPrOrccrT=B$R+JRApS|;}%336|Az2V;vs05N% zft`LcZxp?rNm4GzdmfD)e~nL&+~iXM%B!v_xnY+1qr$8ZzF|UzTuTNmNtT8le<*ufp!XO2v)^9=0WWhyw2FJ8a*kW9Rzylu z4c2X>qc_cE_BZx%8sSBq`_9H1yaI$zdlH(1ytQv7|KY%Af#)`{0TvpGo;9*~KY13R zZ`)K<z>rvLZNLA^vS0{vkvwzNsYX9Nbvqm(}0k6;LKtC+D><4|n+K|xm@N}>TFp3NW7AhV*G z8XN&K{!#MlfmuXZdPh6wVKk5G1wE^`NdCqWQE|__@kg=)j{`yXjTpCqKxWD$L4+!q z*13OsJF(G6`hFjUi^fHd`hUS^}l?T1O;-|iJ@$fNne&*)KyvCq?W}=Xo89x}y z`1h0rf{E=VD7gQ6e3HXy4>)ki_^Xzc0dfS`8kKmpiIgoG#AB=Xt~3T3sp6Ab zU*GSri!Wz1zJFzsJHA|vs0b(bd=eRwwdtl1e&TKZkPCEF;~{ab#(iXKg&1Y6(7hQEF<^H^f*p9NMI3d-7hN&B^nbLUfopTgFf&~FM% zq3gD|8h5bp3WBwS8~OJmeYyHg5-}_gq}1g5Pl4lz(NfALc1gr^SfhfIxbmn!C<+WV z6V2scF_gVS8Q|!%f}+l4SYth=Dn}Wcqa{k1n3IPncUw=&k&T52v0B1)j6K(Q?sY^rqpu+mbHE*%+H_ulQST&3>ACNjPDs4{*5)NN=NNC~u0$^d z&BJ_=&j0FIR{!KMsImy6vD&erkCg=sw^K(MW~Cf`)Ee}+a{$D5KY1c86mSJs&OBKj zj?!OyD-5FV)oI{bG0-Mlo7q?(5jnK}F8pw^coXo54sakPdf zY7RZV;@K!3S9iw)72v-ZsejwSOWPgl{;foX0<*14fB^7PK53biaY$k1Il!gcoSe-& zRx9SnrAmDDKaSw`<$vNfUKW_&p;?|Zu4fhbef>T7uu6GIfe#=%I zU?GK>2^2KsXmP~@U@rQzl=^2&FZ77qW$001A=L8N_X8juiwJ+MOtA=5U?YGp)#k+blq z-SW_Q_uJ1dNIy_`F^Te4rqXea^ic8~^?R9MC1A|3e493~*ZSlb^+RIwcjATIMs$|L z*Q*|ti!s3YE`;EXY^x2P0gIyxXw%uF7A=>eZ*;FCu#)Rf=8zV7HJ4(li9zEu@1a5$ z1j)fRJTs|hyb%ju!1cTDadNw3v)?obpm!4%$pA>?JCvPS#0AXr;B`3c>~r2UKo()> z)5@yIh1ImWu83&kpVgDriX1xJ8&E z7HB^g>gMfM=e5UWglq&MHvF9VF?n;{hXTAfVKwFyt0Ak~K=+HV(+iv8oEvOvorYg_ z6gdl+RlES=HWlK|yNlMl-oA^6h~n9W=48kDF(2K^n_c1i5_={g7Ayi4LL*VdDMA19O z!ZUQ0R^(xK#g>GwIDQgpKDkKMt1Amv5-`%PzHxa)Z8h;oRqXNupVqxUPmKcxo zbNB9UvOTmo6FvKEn&b!ejD~4zz>z4xUFeh0=d?|4$Isz!cH9RRIcTC%(;Ga%=ZFA$ zRx3Gl`TXIF-V;nl`6;e5kjzDJ3$y07pJ-Vcob0JI@6U;~3#b}G7lx#cMCJ6=SGMkz z0li@M(pR;V-V*nxcfv&#livCdhUmz`;w$NLa~h7SFLHn%daZeX_L}P3U8s9mWA1^L zGqg;R&vTJ+Nj-A^ROi2dcS(apnu7BsO9OhXUNR!M0XWRQeL%GZFszAYPNNUSvPw06 zju>lx}F4Qw604_tas3k^w*-cFR)R945LCX98mIjtkKmMq2BN-A^%T4uG0G4;D zW!`BxP1fILR&9}EPO1@Jxm&GND)9TW~=im6hUT*qI3Aeivuafts-MVN|?$292K(k zGG@BAeqkX$4<9rGke!0WKSUELeRi~T&*-kBSI>`g2=!rJ;1_OZhvpq!9GgEC3yHv* zjD!Y{C-al*_B??(mTW11Ny$vOs0kcUMh}9-{~ioSf2yl~WCjn#c<5mq?X|*@By1e93C=EEJp_9DIkFDV)j>8EhzFeV$ASJmgiDh*)tKB_AIZ3UNTB0!S z^L+3Ka4xd*{@;~CwqMSGq`j0|zl6AWuhCx@zHdWEup{y25j>nkZKCAXEj*1R;9 z0N{5FR7KjVrEWE&Mhw1!lC!O2og&*er0fOKT4(-D_%6S<$PDDiOg5z`DyxA`o3>y4 zIoCla;X{0grNuUSVvBkOK4R292sNLU3^_>K@eGS;c^?lsf~C);4lCCQj~Gz_q?TjI zx5ug5@rL4uu$$!Malas4G1FT?G=AUrmxYDW#ZsCbuZ|x+XAHfo5lKMUQCg#o$aUr6 z0Fi_xT4`F+1+UI|2VLE{74~(O3%7iIt#c$uC$4HrBVX zKd&P|H|T)#P@QO{r8{%^-OzBaLWp?nexW`r zC&^X71m$Fk^N~8`8|*#;9+S|yonBg2e5I#VG4#q_deyX}qpqlL2rK(qA86H+&|Ae7RZbOEjb;a^qH; ZbjdMO+B(&fN#b-dJYjk~``Ec_{{^ejqk{kd From cef8a47b09f75c563bd46e1ee6a918b3e128b427 Mon Sep 17 00:00:00 2001 From: Bill Mcilhargey <19168174+computeronix@users.noreply.github.com> Date: Tue, 28 Apr 2020 09:51:22 -0400 Subject: [PATCH 238/249] Add files via upload replacing rules-indicators to show 15k indicators to match documentation update and new feature rollout in mdatp --- .../images/rules-indicators.png | Bin 0 -> 47424 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png new file mode 100644 index 0000000000000000000000000000000000000000..67f0679c18d920e09b96456aef8eabeb11f76c95 GIT binary patch literal 47424 zcmeFZcTm$^*Deey77)2n5b27F^xhFr5m1oc0|5bPq4yG+Afi-3YN*m75Nc=vA}GC= z5Gf%jy-P_bA#m`1?niviJ9FNdGw(Ow_s5qRhU}2t)>^-{*SglVd9R_SL`lv-PC`OL z`TW^aEfSJT$s{CXe_g(K`bjKXWcleYQa3H7CnT_brsdPd1?$JEk4Z=>VknNx$WGf= zoSzxGk&s+>|Mf#UZN=(MLQ;o%{`9eqx5*mjiXSbi<>Z7P6{x`~Z>vof2f7mI|0p~* zsPIFO7^(8-;lC_RwQj$w?9S$hxL`sCRV<8( zY(FZYER-Q>a^tu{k^U$Pl-NTZ)w>r#ZL!9Po4@x{2)Ue$3FwZsAOKWZQ9yO2H^sI$ z(8CXl5gF;_kCqFdCKAbTkBXZt-Ga*XQW^0jP1uGNO+z8LY~DG`$7Eg5lKP?gAF^XcS3@lB@1`1I();Y;Me6| z@*=c9?yC7YkrBoj&%XOvH9TnCxyw%pw%!k3R>ebUORSicKu-~Dvs!`OLtCm< zyH8$l6a4#1cXzWY09&@-pU3UYOT@T`5lmsKphGyddB1&JIuPORoBFhaphb3)q|WQ)hiWvF?rnLC>r%J zF!PhLthJNHPGjPN)7lU%_Qg7``4Y&umBo_y%4ychGO*(j3>z z0L-RTTEJ~l1GfCLOw%>LJjcIYu%IBrV{(uU9c71g`^tEm$vIhdImv{F#ciI zJw%Gz+`foz)g`z-_KihoFna2)%BVP(;+KV7kkc`~ouy!;`o|7A`C-6RPM*A?9p=u? zetm<^FfM6kEG(NgNp5vtEiZ6^K77H(>8*4!UOTBK=GF zH;k;{Zt5iZy*_O3@7|o9a!UcwVS)aO);F)!AfJo%j{s+{50g)4`nP;)Vzgc!FEEGy z@D>!@ug5`ldwDF=+~6laa}KZ;0CAhRM8~O|*#mSMv}Cruih(hQ#feVRi(dBywh^W} zwo^lBuWMeWC(};?J11sDGZc=uH_%m!(s!Zfr{GXeB5aG*c93JN1F8&NpU7OxugTjGF0HNjy8x7&|}OOCJ#nNv+mJ^euw$Du-;i z;#H6vPk`z2m^IteyS+7*O{KmO2iL5itW-8nEfD>w&@u6PK&?v{u`x|KBRv_Z`mN_V zj4)0}5#s?rA3|21J&QqF9M+#3)!jmZX>{@}VHJD07G$3Y(Z{!XCG~agWE+p&;SUyS zK}chZ1!yjf8G!f}y?*YJjq~EgZDbn)hY{xJ@UmCjL;lVREd4{R&1ix6Mq!2 zKm_(`_U9pXAKloaS+QIh9_;zd_;y@6T*6EKMNn^+8VUTZE101)s zHD+Ou!KxXR3%|`QsH~e_KpgcsN6Dl5Mb9IP%~d6h)c1e{NN)X?92%_=ShYkv6IL}x zd_tT2B$IzzUeCYkkqo3B>%dsNAdjA)9G))gTd#8G$eBs+x+9-&`xNm~|F*+V3csfz zQu-Q$do$0X-e0Mae;RlIemkG1E35@#Tl<-Hky$aS7?Vm^MMy7;y_7} zgvcm#vfg7dQfnyb3he?&SZN~QyGO%T{xcVunW zEbjB|l4l6M(`A~^_vb1;?xLJk=I4PWVZu+tusBh$PGp8a%#CSf^`~t%##$|+QvKct z6Kn#~iNWUU&JcMe{)(3S01O5iX;bmMV?YJ3ig>$QQ3~8Vn*P9PeO!D0OjyI5do<%H zyHSlOAzsw_U1O!A5Zas4sy(&#=;HmQ;Mm-5-S)}Vc@KeQ+M}5*zPS$<$&^Z*RarDX z0D0u(M8U3)jCvJQ8Qo*z$T;k}=g{uSH#v$e z{jVSB!(pb*VPn$BSqqe4HsU7BJPyOu6xO~+d= z`#xwwPGFBy~msKhmq^m?H^+Qhf=spTpoE14pwHJo{(+&Dm*Q{XZlxARju>`(#7HzR z#m{mR=D%dDjA|cWZO8JAt!{3_ju4~gGhGur?&(&^IjcuFL@V-Mej>aWiE33(KUnM} z`o`Rxm^{Q}u%0}pUrq4q^w^jh=>n9O*tb*<$d0F+WXzvyAt&Ud7n@8$zwV6yTcB*H z<^+QO*ER|mt8LOf>sC8}@1X4KA*E>59XQ(;I7n@e>Db7rW3q_$igbb{KA|GUjlh#* z3gpc%Kg5+}K5qFwrvA}~W#Cv8o8#{{!c)5AP3Q8ylIf7`1k*X*U6EVyY(nhBPorig0uKOf*)FOhx9Hm!9woK3M);A%*h7U|br`0;w>mgDBgnkIZ*RF8XG zUYT<)=5B)AKF&Np@tUvD2~*#Rgoetx193C(84jo*pMSHx#?|45@bdyYy`$aUV^Wrm zBX-RJSx1u*jr-t8hHIb^RcgKEWFeuoW}6#D0<0`)flwO{7v!ahy3J6c@ty^KXvE^< zJj=&*G@qJg+l$(D17RJ9zGfl(^8V4pkw48hBh5bJf!m)Y)TLu~yzx#WKgY)CE~T-I z#3vP6J!+|5qSF@T>-I={&@eD;f;bdvuj2G}loln%!2GRPtD%jB@0#l?UzBoe=e=ht z&?aN;yN$t7ATIxw(|%zZsT(B*%l5*|60jkThcO(jbl47kP+Hr=K{jjB^KDE+kPSdl zOV?K|yI)WO3(EJW$q`4hzaM6j_;+3c+)rJe?}+5P<*uM{ z?{+pWYY;oKM*}B74knuSu2xSw5God~#b^n~_#dsxW_zB`x79_qw%BNd(N7!=J&aoV z`7Rif6WBL<0;|pUbVe>pK3dN&9eUG$hrGOhzU)K)4LAr;y@CNbXjB}r3?-v>MxnYv z+!Erj2lo3f;boTaiKEdH-3JK!x*TXW>z>T^uHCJI`68&O=-AREU_)d?ofLN$#Vz}o zm2MsVRwV<6aXLM|uiZ z`v4B6ulOlk=>5Iy&mK`;0<+yK__6FQeM#dpjXPtwy*~SKN*j$^0{F(2K6|W2lZ3iw z6zX2NOY0g2y!3m7nS9-T&PuA)rj0VLHWTi2yssrLbF|Zhn>)YrY`CEA7U?r*NcenjPi0 z$;jwc43s?RCG}VLGHYwk^hToNF;9_Pb!sQC)onTKmYPR&Vmtx8vm?=5Qb%f zsQl=Wx*L4c6puga7sLf!Bi%tSGoVj&(^u;sueOIRhs9tuHnCxVyUFr_SRxBH_O06o&mSAS# zbT+^v-M_ccTv9Yye4>3aWuhYIwb&z7vYWIy5{c~7uN^rl1!Hm`c1OnW8pcUIq^c-V z1P_P)Az57&`g02_#mAErhu?>R4N#P%f2M;zG?vXox@hP`2JpZ%LSW2(9J^}FZ851L zx76ws<-ZR4V+km&w?PL1q9C{lp}A3?s^-v`lYZk(eFFo|umsbO0ZbKW27E|MkIf!1 zk|_iurwVYT4D{eX97S=qP}Iu+iR@Ipf>%q&Fbf_3Zm6=PlQ^x1tU{Su5lj%csjt`# z@`&(GrvAg-Xej*St7-bVExpsO;f@{+h}Y$=h;EyH^-Ec^&mn#@T4~&V%$qV|;x&n* zz5fgN`D5d-e4)sfVwh6=jgDtd_%WkP>%~8q{8XB-@$D~4_MQI#^fY|BZwW94(B})P zm}-_LFr((%_TmG!8~KPfwM6gdi|YBSO>~ID*=`6!l}%)8fNkyf!(G*4lXsVOcQ#bw zQ|!=Z(*}hJsl@`n9S~RH$00NhQyJO*1ySJ*s;Fk&OYqI9=jjk*j7tw1Lo+UUZJl^e zp)1uBot{=h)F`GvWqVX^`ts$9DoVfKw=n zvb@#uVDSS4j zZkEaCZx*D8Db!#5OAsM)HX9@Le;zrFA@yu?8>71&Z$asrSA7JZ_aMj+D=OTJ$zr@l z*?Z#agIjJ3Zzhk)19*&w{1uDP78y6}tT}yb>{R>9^_!O9Ye9-Oi4eR>wO!-o)WW`< zY@oJhrpj1(;qz_{Ctj?a)}677eE-r)fAISHs`0iago!Sa5_FOKN6dK|G`}*A2qbuW zIL3_e8Wqf~s;rvu{hDygsmcZNvm|1 z>BCPkg#*HOQ83xr_TRb=f<{sI(za|;D^NOzcBeSGYhx`_x(~VlIK%#FvK4C7FEFa) zCkp9Uew1*xqo4>PQwYxpuqdch_UVOw4|D3hJ>ij#9TO=Va&Gyw`=(-rT3RKAuC$MD zc1i-E{*-cbm&$n0`t6sN07I$cu5*+G3-LZ#gVxDU{8k_{{v4`|%sf@AI{OWykwWo) z@X<%OvZP~M-)}9Dz=RY9^y4$rCPZow?G7%X=>hOoTJf#>ILDj!kVYlN=JPCoES3tD zxeu97F7}Q@TC->dHL3TfvwO%=tcG0H^|7xRG>f3EFRkKO#w z(2tS3|eeOEcOWr`Q@?LLQFYQVp$FKcon}rEq=%xKW2;e=co_iy_H{)9> zZJrpst3eFb>HI!Nq_%x6D>J51qxhWJ=XSuH4A!gqRRBHS-%1OD7D7grd#ieMwSJWm8{S^y z9lB9L0o!MJc_PMdd+-%TE~dmo7YFUFwGegQstDF>^tw=ZjH#CjXqYK9+cM%0ytJd< zQC;ok#rtp_fP!V?$=8a7=k4jCH5OXyvjpzC=FBuCLw3xfLXXss`d5?@ zkld@dv2EgAT62fRIJjBiMEj-)-^*+H!3cY!)(z#r`b9qNA`}&DOL{*OyA%&7CYdat4B>V z`a%x9yuZRv+IYB)@nw^z0OVKO*2);soRB1&y~K+vnIEzQnV-k`oS^Rb3I4I7#3M=ch$>#xjSVRH8wCYg_xfT zhu&>3L+AEX%Fk^R253s~o=C`E0mU_DIelQuDf&1+uP{;m{*Pd;kSFqGJMMexD;dJv zy>;FA=_xT)YAf=yLdr}->t!orI#(etP?@34{)gZzNx$7&(CT$kVOUezsn5UP$MyC| z(6~kK%5R(ajC&hIuMb?P`~+z-i(y)HU1u zn%u$8X@*)J`NhEM$=@<0A<;FFJh!0IEgSe`*{b}Aa7UR?cB}7&v^%D@ z4BKE~8#VO%o$>au-&-OHDlWN7x+B|1Nv@@_v`H)eT_$}$kDjM&WQWQ>&+7-o=x%aq zM^jE2i?7LQZ`MK5gWc&j5=7b2Zx3u>|Cx0aFStwXtX0PJ21&}B^_zj>i3w`2UU6{x zz;5~L+Vf1?B+jA<7U66DfZa!KL|Mmb zwDb5bsv|-~YGV&{{FzPh4`lTbt$uXScxt|{WtDcnHlxTwttai-wr1XHoF-6wm>W3p zbm_pD4WD6HB?hzT<8e~zE{kJUJsF0H$k^J0kJFBCdc^$aMt-G_WgDfLpFW<{8STkU zb;5*2QB_TBI$t<2%uNObV#w@w2q141OS7rh$!xCB3L~MR_-twt-4`kOosPRU4;+rx z${FDAGy}f+newJjHUkL9_koA5u|Is9ig$Ocm%~u_asXyUMd$;}w418l|E#%kX-Z+8%c9Pi7x}vCOeN-d8*PKCrp;Gi!q!>ZpI_k4TEs{(%Gf z^S(d`y9T!1m%@*I(;Aw6o{65KSk3`;eq{~(04RNw&?tCGPIO`5%jgod{KS_ zK@YLaW&WQ-lV43Pqx=IyBq?N?&tN-)BT1ayZvWphSBn0AYFra&Zr!p;BAJS;tg2eq z8Yh-O+zSFJ!Dk+{&Fs%L{ZB%Db)VYW+y8)Y;^|0*gBTN~joDxQ_Nj%pPN7A|XA1I` zPptlJ=|S6fUtVz5+pZ{$YpZhqZr6>6kFayQUy$;dk=zn)6(O^>i zZ*a}2zbfM&is-1O(wMw;=!^?+1&zGf@cn*1%x=W3i($c$yL5ZaD7aU00oSjU-xT2Q zirZQX!LPI!CgHpSjK~BCxw!%T69PJ_i^f%qsmI;6XjjMhDwuQlgJv z6?WZ}LSaBRHuJSs6|BpM^&gk|sO^-C6vX)a%QU3HId-}tsVae9dEyjFvFjw z+yJ+|0d03)F!MiBfSo%vs=C;t>q`#~LTxmLNr?ybf6?330YD0N=6-cd zrn+lOj`1J2jDMKx3J%OqUCXn}J`|}zM^v7hzJOCU=;bi~XGC$HUn71`(WXdxSS)0> zdA;eck#5M3z4ysO0GBy(i}XNuE(^7i(^4!WH8k%MW^$23*sSDGQDy}q^vx!n32qR935l{klfH06eWR82q`H<1ys{9q?72j~9A zF8s#>a}#~VXpCN0T6DT+R|K23I9>Yj1Y~;xBP(K9uy*JdiqFhr_Jl{s`0ri>GZGBx zq^x2&JAor{lMybmXw=3RA|4cH-pt?M{#iY3oy`q)NRb#Rx34;yd2#`q4{d< zluDv!jHOrkWEz35k~VO5)JKA4BU%SwKizPRY6Js(m5X}L#(^KX%n0`s|35hmLWHR6b87Q`=!u7pD?O!%)FX3xq!ms~C@+Dx+m ziG8;qqUw&tC-*rQv*AYbQb{HEuY3>p9t9sI*Q=6^aPqH~M()2k8XUZOZqo5RPx4s( z38$)BIisr8qwxWYlTlyg82(eSjlNQ{(K4(O+@a+h6_Wi@Qzrfih4j zH?9r19sre;8E9C}u3ix`XCCc=5h&yTRQp3Jk%@v){c)EzJEwPwe+=OU zjcsk+s}-U*Ex}KQj4X`%i&
      xy(3du~GvLidJR`^|&k*IR3e$~XEv!OENYsx@50 zP5uViiE~b;`o1=>$N-~NQMrt}VV;1m^LJczqjS16sNZ1vk8XZOpOX9>?2YGb~qT~-j}F*(?=d;<7F*Hy71HevL@GRl^&B&$JlWjOEkZXcZ#C{*vx zifA+R$;MVvVClt`?E;u0MoqFm*@5L(5ia@$YV|P~v;8iEmEL-dG53QBkk(<;Uh0Ry zacWV_^tU2JMryubX|QpJzhh9a8o%BIwOxlFiWoAwRv!!6<3{`d?Off>8K#K^91)!4 z-^Pgec8t}*eY-wsdk)rG^r+!hSb+jUHCxYkW8gh+dmY}BN5t@c!)8Py%AHl07N&n} zTU>N!$}+iPM4{Mfl@lsZ3XQKke-Nm=zcc#t7Mv7lA!HAv4_8FACp2R)9{vl%{;w;XV0`rGC00S@ z&4+X))mPMu4`xe6dG2T@h{<~zv~*(p2@zCDyrKDbqfz9D3BQZck?zH*_Z(~P+X)E@Zx>!Z^?!Ik{sx}M^kzSXGkY0k>B)%J$&<6h zX)GP~T9!+mJ4_@IWfV|PJ>_8(-=VVEOd|!!r@>W&U7IE&OZsaF1Tv#ft)Ovy$3V4D>b@yAB1NQt90dCt}!L!9E3GjUL@b7 z=jo_SQSLp`vvN-Zf2Z)T_Kk6M6zs3JeXqyl&hb!zoeToea7o-NlYcs zJ?um1bPibH@kf~_+NJWPSAhlGKpL2cwmW5DU~KnTR|59chgh`aD3~*t7&tW`DQOK{MexT=R{D}`^_mH z+!J&raeO#FK9)S`dSEEJtaieHXCU!*R)4;J?cd4o4134r)0i~K{FS4MPTBFBo`1%f zX+Ql~m*MVNX`PGekH%@8{Xf~}xlG!xHb;{ z_K(aBCUb5f+?~%*<+?AoqhBsf=FHCJxewp3tR%$dGq*+h{*L2Gf>s}=oL^9RK(+iK zA8MiTAsANYE>a^>Bj?jKO=yolHG3LX=m!8VEp=jHb%^H|S~5-v`vNBGHC_Hnv8%iy zrFi?yn6s>egf`~|=}z89s3;fylz}^XTC?t$AHg3!^o-ZTmfvwp^t6vv25;v z?0{{f&`{B=z?!#CEQN}mx;|v5rRO}mwNo~>YAkzyL?XSQ$|;c z6tBM4;*&QT;7mlS_**QOrWozlZj`;69y()h%rJ0$xxBF2gA)uMXDVfa(&7Pk%x=IX z19hruse4Um=v(Y7R@gb^ze7GqsSm-|eE+fZe;LWC9p-xpEP89V&%%ER{G(P$Ix__tH5of&$@Df@W-eTcC5y&mCgPbp6>9*ItqGg}Pm ze*D>3%`h{M^KOkt3nDJ!@A%}sGIvM(*kfhwN%l`55Wl`(*dMvOF&QdN%{l`Ji#zv= z4-}ND>FHSmmpB|YywtrA{62dqufA8_X_@)1$wf;BPXJGDz$}9}U`KnVrzmnwCf4QXY zYJCsq#12oqP=_OY(u&o+)PzsFN~ZRV;uPe{_7bLJbxJdfKE71#glx)HRJLBTa%yD< zRe_D%=vmCgZ?(408$e2Uz$oppw`~BkGvt>fi|w?ymhVs?kYru!_@pHLR|jgsPON44 zH~%i|1TkJEb;~0kdN=ysbypZ$u(k!8k9+k(%P7W6fX;u>RilG+C84}-My7v3IwOg_ z7(L6PZF~N+$6|?|N4?+ZrZ#k7VqLdq{%%U(r<-MKV;g9;9y*~wDU{UosQS9c{z900 zRGEcrSV8p)t0(Y^r@B}zuh|8hoZfQLb=k~ls<#}KSS@BaT4mrEH)xrlDa3a&lHyz3 zqmvi73L+yRIzOi4i#I!HnP&Za$64o2Sp_wKA&6bGiciWY`fAjo@f|C^?Q09vNvZ|R z*`43gl}~yDZtS#NP#t@U;~c1-B+)ROh#U!9wpFf5+TyjFphO4DKM%>!iV*J+)2ynE z?X}ix>#S&8jFOByXm#vcqbsVTf+6|Ij>_*UXtS=B9XrHTyGDG0H30$!Lq8G{0(MIR z3bSr6wxS7eyN=lHOY-O~;bNYCD)UnQB~j!sw$=~#Q9G609ZkVnC#!#2#%JhYUD;AV z{s8(+zUafxZ@$%i92?NU&^(YNY#%uQGB>@c|<^GEQZzKxNnd z&7xc9XzR~lez%6iR?`c86Nsl@vROn|PQi(P!4WOH+KG5Rmg1TP!B!*ark(96Vo{sI zCl!AL_!s1nLw7xT-c-dl4Tv>W&CVFs1}axP71cb!wVfOyoh6=YM`7sX&}n8u@kj{Q1-M)R5_)mgt6is47>8yl`*+D zmZxEe!6{-v_>7Tf4uDt{taDw;D40OFu_&dspj6hz~pUE?1tc55ne` z4>y#+#0HngoKR~n5m0%%N3=lqazg|4jsv;BPtvw$jJ6G#zn`6#Ns+L%9@hfeQ^62e zJ5X3D5x=FG&o=RtYcGUmomZt;e^lL23O6q(+1$se{mgsh=dgOess+xz_d3?;rJX3G`h%63ET2R94L=VdWICJ$QaKw?7 z-*UDNa#5tI$~m^lJ&vF%TpxDRX6AF7)?(Yl&!HCzCI(Qtw>(2G+)q!L%ZT&4_Q9hb z#~l*_rEpi-TczKxbd>n_rG$z_t><@vSqD{~v)ZAAA5Ta=(EC_3_ia6IB+wHwES6-R zg27JjxJFa`7@cb=5IJ!#KOC4Stlo`+9K0xW1tmBi__FMbO z7=|l8tt5}=qHPPW@xz9P0w<#;N{g(B+|YO-q2X@}oTU?XYOklB%=Rtl18#Mce6}re zB8EcLpA~)hAQ|{(v_Jj`9K)2t))8|pukqVsTnV*}416YwU^=x9PEX_OI2>AWMndI$ zo9icMr2+6t}Yw36|;w_tG1(K zwadzeEX5f}3SH+aJUOQF(eqFfezU1f5Q4uLB`nLRctSKqbgfTfAmd+f2Nj2In_iwF zUZDlwJokLUqxoXoqOLX~LljTigcq8#Fiv=Pc*=mqG@nmK%jC1Vs?6S9Z$;+n-Eu=a zChO_HJiG_}E-LhEPYECHY2H_j)}~lJh8CIZNc2q^{?Y9; z+ap%Uvbe{@QfQ%Ov4=}@%~9X<*M+G{#pT!MX)wL&(UE&N)g_T8VXi4hIC1WfxUIh@ zmu(eOpY-y;2rfBM@B5yKDta_I;0}4i1LM0UYh1{Yhy>5C_S2u>5zOTD$8m?^V#k5% z+!hGO_WH!U`rzH!Rk$-^biOSXq%ZyqhiJ;Brdj}vw5N0RpjEt@ewx!ztN(R#0@^W1&wwtfY0@+Vrt{m;>TQ{>)k_jhEn&=Mbf;E$=8`d58?A^=Gh z>6$ei1LqG-CZ2a<_Qt~ZpKJM*coT$zxMo8#V1IoxDbd)|Ul$ENwfieWb?0ZQHL9dO_3EdJE*H$D41;X6^rr4a=4f6 zkx*C$AUPlCcGvxt=OvuIBme;!(3p6g;JY%W%OK=w`CSw7d{%UabzRh=hdM8cQui=| zcN80tS#IGGsPNT()M0>UC|05&TE%s)#%*pA03{&$nC$!*XPu1DlFZv z6P`ZHl8iCoHF4)KpWsWE`uWNC7+jR^Hv`&PC~=|uL@n%|KYMjuTyCV@4T?xku{Hx(0W0}odA6%a$~PxAF1VgY?o4jJ$Kfn5(& zE;m==zAwW0m|QMWM>d-*D0A%vi$3sNR2wy5npUAXL(BCD?DURHhM5o z_U`#egTd@#vQCWkha6Q4V-Lfyn@h{=f&lN%Nz5@Y#Z(2pBAbi-CW;DSSfWlJp|c*C z6lF(W#(((6fkL+JBesL?HA&t!#u<0HymmrX9CC7G*@Sd`vY5P&>|psoa9Ry$p&ad9 zdTnuSc5}BNh7%Y78oQ0u#W6f&13t{xUW}BMI|xl{Pmpm(N?TEBg|N5BtSdzw4nucd z7CvFENov4yTK0I6dzQ&Dm2B4JE+HCNCLbDfOjng-pdH+KcnMXXPxXz+Y!~pIHTdFYFK5;AcyiJJEa=QvveW?Yk~-C2Sn9 zx-`pxo|XOWL-<}EyTTVbgRq?VvKDm^zzX|33p{dA!zR-XU_LJ=!E1&ntqHZRQ&n35Bf7r@Ix;5zWCXqqT zuGp$s%A~drl6~x%s&XSLz_Of;;lk=`Eah0d{@q+EF%WvZO4(4t1d)?(bKE0HUTS1S z^)zavJCx`l=JHxBquNVcM%*Oi3+ALcAQd!r6zV7*QG3$LfgW|J1yIgwAqZii(_Qv_ z+|o&2?gq@1EMf+Is~4dMLB}h$qic?m2D8#KSu^c2qsR!CqtU9+FS~<75FwE#RHOcn zsO1Z6lo>fWJ(4Q=NJ|;&m3@7}t#(Bx>=--Nq)jQNFQYapxZypsLt)Jl0GX8u?pg@Z z5|`*+fH8%^&4K&wMSIkqW9Df+`&i{N2bkq@L9<^!lk&-J1-J!(V-!H8`!q&_IXS^R zhELY6nt#x6b!TY08A}h@4n{3)pU&k6Fq+Np(>Un})5D%S6-Mw@P#O!@gX7a?be=+$=A4eo#y7KbRg1dIWfdt$`NX~&sGkzH8+`lH}wl?&Lq8{+}H%uc9f@Or=jQKPR)53OEYX)SQ1Nv>PR8c$L@NmR@ zKw#n%t=m}7ruvmb30p|E>lkQzXD4BqSE(tvX#D&|P?tIo&ViCJIlAjgBi-bhC>8}O zv%Ya$^o~y7P97AO|5o2CwAM86j#4KF?};};tjzoQofGR)6YtWW*azzTVAUezt&(}D zzTFc9Q)vWiG1;ZQh|?SVcSUJr?3#`t#}!*%V+`E_FtgV(+(DB5?%0iw)qB&Vziu=$ zE>LLM^~p`hB8@3uWioXz{sQS8H;|2fjMxlBNw`kk$H;($$(RZcJ)w*; zU8GC}+ur~<^OE&YkFlD=t-MQ- z*e~t=0^NshpAWC=#sJCvEs~n0KW1x+>N9kt+lCE<5`Wgaq*LKXVGTLe+e`H60J&~& zUl^9&pD3ia+>7qbm0~zaa-ZGXn^0!3O3Rr&XPdmWm$J+0d)p)b5V@Ms*Jg=^YFA79 zHG47>HHe$Wd3XGy+;5?TL;CnDx2r0Y8dYS)GWxBoKkm^E=iuj_dc zUm7RND@FF$Y`y&Qgw!S7G?h5dF>2ZZZ;E+?fHA!o4%V5iS&MaB7@li8uh{12aP;-) zfv;0$%%nR)3F0y4^3)pjgmQCli8?1!g=o07wqvxOg`R^CtXuzxsvsVRXua5BH+gbI zA=MD@T5&Hz=hahrl&xbFBTph4tj&z7$L_lvmUKL8Y(+K~XHOBAm78zD$~Dkma86@d z)XLi3p86#Wy9VIdO{1a-y9bCdo5jyIp=fdRlTkZA{m`jd{u2P@=)5{Gsv+GqO>k2A z=AdKlVJ*4dBh^4MI760+Svx%Kp)N;n6oZf^kl_+%mSenPq);@m53v5wQQWul@KuFg zTJ-4GeOR$+&%^1Llpy`y-R?1+-um#2ns49oUk8K8xa}WRuWrUu;m3YmW)y;PW|`@? zd5EnDsnN1LCUhi;=I2ykWhiNgN6$P20qAuxBsF!G=a*TU)64b8q9HUlCzZ?=3Kz-hlb!{wj?}6=LhzUE}$-rKN>sThViIqRGN;S6?wi~fW*GE$;@EEFhZz zK=pXUPFb9P)jYc6@@migaY3%$vX+{pX^1xMly53XeB;xBeBb!BMt{SeJ^lcck5&0a zxtk?39f#0Br<@-nHyMtUBUuU=i&=;nLdRAgwDt#F#Ai227V1IMzB($VDMgSnzQKLx zojpl(QsGKt#Ut(PV4&$&dP%^i%zlmTMHrC6SmRJ=R%-I}s!2VOb||aHgE=IpmtScA z*s^4JIjiMMF9G~WkQnL4uvp(jkkDs6>PKC&R`)%gw#N^7M-kEw<_m7&SZOSd>T6Y$ zA{w)Q)J%f7s|kLy5}s|eK2$0HP%rPF5(`s?dPtltikWln8%fz%q-G?A^%m$CS*J#= zlv}H*;SFRT?RqSKUEb}t@0>=Mo z2H04_0@lW{&!9TH=5TK(48z?x5}vff8bhsN?Y{74YgS*>!)X1bs0g10`qSM|#b<^@ zL&Wn?ynbKDq1`A&PPn0Oap)E@!(`G}<)j0~w8iqRQtJ|kYV3N9=9cZUO60(xp{lB= z($bhtdCF@hSMNv&;`ZvS8Pvg_-Ym(ErhKy2n%qC5JI|AudurNac;_8ncq>2I`jsos zX3<;0<>H;*>;B2FjCZ0rJtMr}A&kW}E>22nG`%W%?5i;xuGMZ|0P~;%cBOIQ z&rc(D8;0VxzU%3i`>KOIL<7nUYB6co3CW)9k~;-jW9pJp&77JeN*?+#8>Og5)9m^% zr~dV!hLlslrEJ4jD*IOz8g~#(I}?jMBqq^kEvyWy!#vdcKT1cPZA`9qa(JCKz`qzJVIN&6HOmDy8)+ENh6!RTst#KV(y^Tfg z{V(d?JF2NI+!wXuwjoN9z7-oFAOg~fTNG@7NUu?l8batTgkV7w2yB#IMWluz(rZAP z(jrmllzu&j^ya&@Gpr@Zd z&q7{QR*k9CG7&ilUEF`?z3uUQ;`uAxBds&3Gxb^F9~cwtW6)K{$vz^hZ>0bEq!%;j zu4N9S?5(Dm$X|Ek`c@$Ll-o)^Q8wiP2xuJS*2{yG~gutH08_P|jG4STM)>Z(#V_%IKVRMv?X8{r_#N9sJS z`51;TV4V@evBa}YHp$%KnX#_pJmYc?DAF0TAglb<=EXx9zmUkm?Mr&WqJ^nyN?v#C z7c%XRs(;Qudpk_VHdc3BCL$5pF;LgX40%0LB*W&`|ET?mnpS#CUZfxvtu+&Brn4N5 zr{pzf6~&)vJAb6Zq?ailMR^^|A|~`>ZIVmGn(Ff4io#4|eY3 zPkj*2i@fNI>t>QyJPSm!nx09?d(H)-(s?ppYh;G+8kJP=o|6z(f*WfaTpBxViYdoQMp2q=VNCHLn_#%s8owEJvpNiFqp9u z-46L0&e6Zwx+<|it*sohXKL1x8l{ERtMGojMY9lc@Fx@g^hXV{voo?18WX9_b4xV5^9I+OZngX-;hQ9nr{-RU-}xK`nlTD%1axK1-mGc3A{d zuFE_N9?(>TUChcYp&U-ffuV)AGc^EGoI5A2P2Dtora#eqrF!9+N-c2&P(QAU#*xl5 zwM&I7fmhRei}8?UTL%9{)P~9q{noUxPhxCR2WeL}j3r z3(Me%gJZUP1mlC@g75XP2HFu0 z{rUf7yeWUTS!H3caqfH&NVj)-b-&m0cvI3s=qs>rwT{%Qw!GD*-lVs6YsEdI_N*!Q zaZm@liuW%`804d-+#TH+5Ey0{MYEq3Ct=NK+UOLSAmt<4XmZ?M$bGLMB8#zILDm(s zUSPFu;8@ECBqZO}fpfABfZJ;Bu#M{Q%a`c-% z`?1X)E^>5PYs+Brn;{(24_^MgyE^{kadX7tA{XDbV2MVt`)ROE?16YO*4whc@wZN$ zhUz@`bZHP7*lWtW86yFZM{H7^YO}yIquLF>ZohNa)xnmN3sDVIWwD1)Ff;9gc$wG$ zWUf`Qmgzn7ZcrEQ!E$eY>AkX~U4m3>K|fWj&+D%1#zXP&`h7-GzS`n8?T+PZgnvD5 z`Ol#Er7KOkE{6*3x9x9ut2wp((E#gMwkpI%r*E7v=-5ghduOA8#*6 zb2iOM8_`pJ$%~FWYj>sB=|gxf!8()NHvKMHFYg{XYx3A%CbB_mUo<6^XvFN073Ht} zb=`*t26vo7c>L3ZFmc8Sa;cn`x^oa8Vcb!?2ND=jpD|Oh7sbAxrNy*~4R}&#ymA;@bEjWMPl)XkKvvY(JO6RahpE*=4qQG%n zqHN<1Doo|&@eJ?&`?qUE)*h`FIdI0SXWmBLP=6IGC7d*znK8So5*O1fRknCLOiQ7H zUcLQGU{bbM$l2MbXy?@-vGto*$h!ObWDBoVT0fCuKXvr3uCji1lg^uTLz!Y>0`~@y zUc``YPjr+IGI%EMo6#r=&DSxr)eIl_D`U%x57%RO8%i$m=b)gRr)LKgKNW}<;LQv? z`FOv&!9xhq`KM^v@9&|4yW?y(Y_if;k0f1;Ftj9C77D5w-c%HRv6Q08AO0dX?;HXW zl01Ogkd6F`95b2V7!(On8bes^2YE}7DYpvYkdgsp{fPW|*AId1Z<>aNX`d=@fSC;d z#%5cH_tWRZ46}fH9p=>Xd8b0-p}v2?ZP+^3&{YvHskkTO4BNZ;yt$iM{>;BLdEXLVKfH8++#s@8xMQ^J3O4e(JgZCa<@+c0kl+)l0`!E1q|;Jz70RjkGsObb!ab5Bf%fGm zcnCdu{IC{C-g-!kPBCR*m-t+@?pu+WN7O>{+lc{O`AnJnrrknP8dm{}U}5cl-`h#} zrpc!`F%^%-HKyIY=Z7{we|*r-E&TOD&FV!Gwkk_ASuzi-K0vu(eiN4rUcAwpuNdmM z9I%AHT+SopyvhH@F3&y*tgBLQvEQ0M>m+Xe$E!z z{tauBf=j|!^^KEx^$T$CjU+y=@rTt3$fux}tIbIex}ZVXT{^#{5Nmu+y3n%jCZ9CC zJ+R5U4P}`RsP{=Azry=EiK#y#V{4ViE_#UNbKGPA+J4Men3Om)kmVbiw3<}B`+K=g zu%tUc5Ml?8oRXR!IZKP}9vhjP>|6Iwo%QKRE}_QIS3RV+xw;aOY(#Z@${dZFIevrX z>2=*YY9ru_lrlrKHhYm8VC4TPrp{`WQSN1Lbj!LcUv3=~?rmc?mg`iz7+D8%p|hgv ztoj(_ZqWToE2G-Q?Dx~fCdHv+63_foaqV(fjp$Kz7~{B>MQE#k zdyqU%W|Er7x@P_2qxPaT5%FQ<-Na}TJs>?!3qh)D-{|VXC#v*GU{&s342o9lJgewW z*$?T1fdp)TLnjO5pk-~0?_B+Hf9Si2)i>|!N+>>GP9>2A-;ODjwpYOKEVfm6rdD=; zZS{wDY26&RO_okIO{WJC-`BNwF+Rrm>!IX}+EwEDhQVJ7g^BInK@j|kvFN7l62u?L zNJY=ne3&Gx=oOOgKBK${YzKIHZxZl zk?#HiZ%)$QgQzQ=f$_d4oo-kIi8&O=pc`ZYA*+9_W%!|95cjh+7GsEQF3 zgDiDDF`dsg#tJ!@+F>zV>2Lj}9PDPj)F8L$Ztwe?HRFWp0weAO2knV&7` z3RntT%X}=6O>r)rKgAxBj%S*|V5Ip+4_BG~astVdufpL(+M-W=FQ|AOQN$QQjgSvo zSAdGEFs&&!#HWvX;>BltkO|CkXG7}^t@0(jR-uYbe@y~bJM4qSdbyRp4Vwpvj9+=M z!4G$m@zN#H_(L{)O<3jMPCMNc4COSckafz6z$Yo4dw{z7#j@aF4)6rlo)ZdCr7{yW^i>tt=V zuoU-rn(lZl(>zh4oYs4#NooU4F7|c0k)D`edS2&|;5E?eL%r0c*|SuFdsyyEr`+$g zF{2%_S1aQ4-e_kZE3de*7pNk^H7Xp4FIFtCMdsGksim6n*aGm9Ko8lQk<|Umvzxbe z)5DAYbsG-k^znEH8ptyEa*#(l+1b}TKems7W^aT0yFd5@xZ%B8>v?So-pRAM&1Fq0 zBb6B^@D;b4{hLM<(Dk$22#4?0C6{)e)o!%Zq&g^fi&vl~b9sHCuT2sbbb6qC!;7U|dngO2;!HZEV;on%MPmKqg9{J)D*>ri98t-UOX>sw z4Igi*!vQD=&MBCesse+#*>-LLvyvb4TJL@KyYy}JF2IB7KtV5G6*xkFqN^rvB*=Tv zaELJA?Hm5Uye=qT03oX@%prZJt@~fO_S23;*3R|Lsf$j|H{btJR=MZSRIu{KP(b|% z{LNTr$y1>+v<~qfXa7i76k`ihz^?UheO`uXBZOrvGvo3KgwDk zmA_6CEtCBDAltUR43o5I479J;>SkFJ_)gBoPHz}#4y)9;JXP@t>s!8xUNH`I@SbDl z52n|hBoGV=J zgI7nAdp?x?fhBx75rYVu;}Gd*Ds;U&C7i~Wo!!+NQ6~15(bsG!FiQ{5v?zU_N+#bNm27 zkjGld(g!V=z3Om?^0+=g^X5~jgjXY`pF}_}5zYH;#xE#WYR)9(YM`jzl`1RTaqc&C zOD)l959Llf-RX5I{VgIdAI2hg$ywSQUCha~7LhC*GX975Pfx<@3X!Jr@+&%bo)BD6 zj$;@jE(>!DXncM8A7U?Yt$OEFtzgK^rbDRL2Wy!xT^d=V1J~$yv|{+TTIs`-g|sh6 zQj{mTc;Q?CH#PNh&DRNKs88@Ka-z4-N41=X@1Va0OH#?v2rv zpS6d;jU~*7cTT|?KCO#(U-ni&1ZCUk>KV6>k>r`wtLE}{DZGdUPlbRlWX5c=3&az_ zu5a*-bv=Z#Rrn{3rgi9c=f&|5O)|i(?Gw&zUu-RX1u>EJLBDh#M;jn?c*N+V4>wj1 zyzJ)cy|==Bzxa2t^`)!g7LArUFS51LaaFoI%N%k3nXjHCX;hjD#zp88FWw7#it4Wx zr-`dF%mxCGHB$`=SL$(wxC9X$s|_Oe4sHUb^1=jZY3JwQ$fdGPjVNCU7^DzE60<_J zo~I8B(Qbq38dDdp&i2VRmj5FxuHKOebyA0>@j+950wK2^-dG{0FVP|XCaryGgg&ks zAZZllKjZK1eEU5A>iU=M0szSl687ZI{L^#&#?ikDg)7u=URK`RLd&wd6%#=}U(Y3{ zSekHGC__gKaCh*Ed`q_`_~Uh zC7lP{Xpzjko$tKpg+5H9mc90$r?vnEKR!V9b;lmL(gZr3)52E2w>AsOA zZPVm`;6VM$HU5P{_1S~gmA;0W z_oh_z$eczH+aM|Bu3}Qx=Zf@wJ(zQ*FLDybeYX@E`Ng{ecw)}9`6(#uf+lJ328`6; zYs5{kRdFSxwVgKw15~P<)lm)e*YkRY7rpiIzE1y@ zs9xf6Vf7xX9XNNA)$xi`mwK6SN!!jts&yA1`wP_?mrX=$xCI&=zO*s;n`5dGg$k~| zFp!t?Cc?l&JJyct!e(%svXJGLA@yE z5@1!m^d3-?%xj!p3?`+NY$@~8Au)A`L6bu>4FMXvJ3^`>1p{Hx>Ngk81=2i!z1q)h zT8);8&gF(zOkaIc%gL4ADfd-A2QoH#S_c|_Q0)=7knybqi|m&bXJPHWA=T2`^L^9% zA&GGF*@vy_HZ^aaSIWp9lZmEOrDaAh#oE+(5E(+hZeCRa6n;zK`nx0g93$=Tu2C%x%wJ~=ubJ+=;>`(cHGHNPeMFmj$?ocSbG`tM zQvc!*EbN>}CQ`FTC#E3i*z7*!&C#*x_!G=Q+`Xulim}9$=@D3Dyx+*&l3i0#L&++% zaQUKz0*-{}X_d_TQ$TNiw=n3}jg6OTcYU^xNlk^ucg#BsyjEpGh9JL|_bk9j_Din+ z3$6XagQF|HXReP?+3s|Se1=GiQfcXWHBv@vo z!`9HcS2s}%@jasI1=nl^IflTPtOQ^!% z54g?9N;&6!&+Q?jB*uuzt>}ZJqY1x>GF~pmcPcHJ7hA{`>H9`p17O>HNRD zm;iJ%)A@V4Liy;QUej#LT#F5Q>M7hy%#$nTfkUo;0+UXe$llc`SPtQYbUocmK%h$k zD1@+MvRa%nw-n9)oKUyXf28WjtP0!iDRy=FCT@9nMunYO!XWu)VbhAR99NG?{k||b zKRadn5^^rxIq!~w1cx{n%0@r1d1Gh9Xx%sV0j+0Ep<} z2ifALcxv(UZU9Nqj_ph3Zf7XA|4Sm z&KM+mUf${(6LT0c;Ggb{AH^c-ZXd*dR$)(yrH9|bL9N?A-na9&j;eN5B!jWaSQ6a2 z7*ThyXr^h2F15;?NXXr>#&=QO^91M(Y%Cv4D;DqYL$6Ez|~VOa`U%q6nLdE z@ZdK9X}e~D$9vLug#9&($NUdhU&PUXC}ryHmhtp^QlqLc+&cm^^|^AqnbXlTu!=kR z?f^g(3Y$9qgI-}{j+kEsr|tm*$RRv*bv?pv9nlt$aeJ^TEw?bN3|~k=N$h>1BUy3n zXm^Ew@4mA$EC6kFC-9B71q6aD)nlZk23FUm2(=#MM@(dm5h&m zsYXNgNvTnK<8Oe#lv73td`(dAB|gnC?{@o$fj1eM8+m zJ=PWVC4R|_8u_k&ht+zvvI!Px|E`aUE6=_1Ejm1`DmsrnkXTr=D-Rs~?{Goo4oBE= z&wn2_hy67{LzC@Vb`u1_W>QlbekOuM`*Oq z=c4GxlOL3zW6JLt|MSvvZtpC>_i)tu%Mg%SDE`d+&8xHRMrd&L5xb(q*AYX5BKHcC zg`Y^TTzFo!a19#i>vt;;dd}pSyU<7X;DA$A*^SbB9SJ)O^Ea# z2@UY)dmJAM&ra=6&ixEsZJ6>Jq@Qvu+7NDwbJN*7=3E(?4-Ir{TBsMFVa@ix$V{(o z0MNBAm`RDjF1DUdTe&*1aJmEKpzLtxeT*7@nS(m9|ZpMcVlh(TMu#rSohxw=0Ah3-vNm1 zeEC0OvRt+Q5eVsjK!VPUyq92Lc3^TItQmnSx}r7sSQ<_{w)~~ zZkG6^H(&bwk4)>omCUTZV>d(Uz2~gVuw`}@iPxWKU&G$32iYX>1~OpiKe*M3cy~6&gA#oxOC6%Kmy&#^`j*TQ#Cd3idL)$e5Dv9 zdeVJnz9dhew@(xc5)aWf{1 zNkjRRm(S$#nNSTfKD@yq3;0mBbyX#Izbs%@Pdf%;iRdhU7n0xgoURc|CiBJm?v=q3 zmVLj#1v1*M3o-)b_QeeLI*JxXVeuO-D?>S&dMG3;owf2}*gnO9(5u~2lR!BBMvd22N=HPZN;^5GT_(S zQLOCOf6<(ig*(zr6>c@hr|5_O6JF*zY3W_Fmcfgh1u!LGww!sYc3n;Z5%uYs{yUT}OVk86ITxN8Gu;x(T+XSxVJJdgMD|4n2d)9mXnu2VYP8!&?tQ`#v_Od6L zu7ne%*f}{)S3jk%_*jaiT3@);94G3tyDyGlUe^kifxiD3`44KDMwMF`eTT`LNdQ@p z6B()?=Ekdf@n6ppEJ2mv=(4XGwdjNSTVshAtm^+ttcMrW?(toNF&A;D{v3*dR;#^m zg_f}BAeab}!sGxw)^fD+J$wO0!-b=V`sB|P70$E0gM*IpqR${9 z6}xl0Uz#egb%N(N{e=~1y;j}bTpeJC>y>N#-UCL2p?n6_ej|0UcJhrz5Tx>cYHePS zr?0TW?DE^wZ3DeTBEA5z{+Fk4YnytWO63q*WOKeC^R&BWe|Ac#@2?%StxChPHF#K9 zI!b@y(rX|V{|EB z`SbkWBjGOK&tN#H|KW$`ewm`2S99Ve;gc()cN(p{QS6}1g8fC_c|}3%p0$our2~h% zpP|th-5~R5YL`LHxNJFvSXx`-ts6Nc?DhX}^Dq^W;U*JbpR8nM?&4bTwhh zNVdI$L3Wy1t;x3-&HZArqyLMZ+;VR=yZ7w_b|GSasPh8r)gNSjFD3GWx5TrXQh5C6 zlOcn<@cr@nrz_QRr}Q?&eFq>(^$ReSr6|k{$zN`zgb-M*74S;WYLew&VC@Gh)!h`k ziNs#}*bctIX5kczUJe!4Y)T{0P^7h$-!7n=mU~A|6t$0tn*53xZBNP?rl4w;9K38u z=XA_Hv@kP$#;Cem&!7z4;I6_CYMDs3Ma|OuC0W%!_%}&F!?3x1@i}aHE%u95kbq~W z7gJ-7{9Z???h1+(qN82-$An*7WLtjH4|2qJ z09WRX=hjLYsUh#~d*;sp)PYwsZ|slX>Sgk&T%S5ALw&xCIr{O!IqO=LOMa17?6E&i+W?9}Ah2r?XqF%PJq@?M zv*iEKEktqupTva0dL3Nn^-S7aIZfjs6ZVp z)~m%WSa~t47a+p>^~>OVfa26#sme&w#zL}X4g8HBZ%X+=iE_PL^h~yTwrEev(fo=9 z)vU*+3M(m3hDO^=vEY3uw~8qLj|x(i!x}D+yyYPhwm6Lt?dRs1F-!P;JtXGl)#Bll zeKmK9*;nV=)pv}j#lZz}E8Lmy>tm~+$4^;m_vU5FBu~|TRp*(HI+5wR-->vS`Ubtf z6k~Y%z9B4w6sIIXSTd^ydiFrDtmQ#h52(RMW7fuE+W>91!F|34AIf@SdnCZPd@8@# z3`T@M!~GJfU`S-}y1*N)w;Ccgv6>>Z!U!qVeGhvi_wol_N+vaD4eg?O>S?+>@n#Ao z{TtAjkN=Lrmpali-~T1+)0I+n?^oPJbDd-tqu20_H&>)S5H)V93Pq2&lvnpu+T=+_ ztOT$wce$06pC*!>E92~%l7x&-p1bwbXoNKHlgT+j+8^>U?Ly`C&ZQ_j*W}NdU;RQT zj^D$nX5qh)aoGnlqZXT40A~3EzYTl^Ai7wM z-=}sAasK+k>WV+y-qrq+prrPuG2CK9Ky8PIoYFk{A)Fut#=45%g?f6tau*dVq~t!` zSiCwVgoSJckf@F}u|n*%<3OiFR5W@TH6ad2uJ=+(gC zB1C!I!3|5BE-^4-yWmX2fR;s-7xk3^Cr;yW;=aS%(H*PqdMDAMqbKaA5aa7 zTWoDb6!8R`-~Iz`KR|(R7bRe2ueW{9x-0J?H99lP`;i;>ex1CRgllJoF=mt2# z!>;M=C~ovw(tiBx!&M`Ly|t~-{@PvX-AwoTp??)pVw48#t`=XF-T!>QU?<wS3pawgqKC^+d?wgn0cj~g+dz6hC902kA%|temyZq_h9?@RPMC&hKjdyfz)YSrRPR(n{u2*^tv%!63v1wgv{X1+OAv9 z(y(5)rCGkWt-j|wKNlT8Pt; z`7;)hSFZ>mYpH4-;rc0x%32d8Q=auA)m&Y9RL3iW&sJy9qNWxY(&f3pGH4-Ho3y40 z#oxBfPp~)#d5oWBkx!&KgG}7HT521}-kKI-X%G$a?fxh2IoO+odsb>2tB%X%EFG7p z?L96~)%3+V1Y+)1w4-Y5hHQUATD>39)d}+{zy`XpVN%D@O|@1yre}mVXmDi?;mi$u z6j=v-K_cIG`lvWvM^|?&x2X6U+N8LssEJ@N(YAW%3iX5U<4<;8OvcJ0tu?$fi2CN` z3Pljs6*?cj_FkJN^CO#iUQsOJUNyJDtM&}P%Re}$KkvMJ_sQg2=kwMsI<`MJ%_P%* z=E*OG{kOk$EOJayXl55lBNOzDgaBGNkKjciEGVgA%{Tq2OwiJmy5(*TQWF;XOizLKgCXkf)#_)Bf$BX7 zvW2_%*8x9=#Z*7s8K^GekezerRYX^+F z`E0HKC}}~_ft6RcqUXRm-Il&)$Q%Plf!U+P_5pfltpl9xyvZcbQVbP;_*AB5z<@+i z3)ULewtFaYQK(C`ZLlSsy%5K!huBa|PDHY&3)gVY-4tNCNk9~hy#j;50;f9J%0Ua& z#G>NwJ9b;+4KL!CFJDlzj3ZTBD<8WC=46^}_MRc4VCro41cgnaluSP0Y{xVprCAg? zwmPd@H2tZ=#U72DOWo%60p8vRtN5%iLG_#Pg^AWhnoR*1)3CXbv2j9Uv3H}B@_m82 zsHe5gV;yuhS^GgK7|8EpLpg=KAR5Ke=a1hn8g%#OW-oG`xwZ~wLFG^58t9e*_cUDs z#_xEeXYQzB+%?renJAsq5xgBCG26z4HrGC8AT9DtXN6ShM2c1d3zgQ}u4LXZW!UyH zncrQsV0ilxj;VLdg=bCd!#fvd*1Czg^Ue$uF+z_`qfgY&PSx8JGHU_lowvhra>6gA zfUUe9;82xPVD*&MFg82baeLR0gRb`+LF(+gjj?03#)P^2hMqKYAvLCM-O4J<@BT)w zA7%RPvf)itOTlo5iz0cTiK#-o2{IKy$^UVb;6^ih(rD>-USzXAy&be^>s>k{%03>% zg0I*Obi;dgLNbvPE-A3^?09Ps7n7On@R)ql-N(z*#lH$7ku@_Cn|l>pU}Z%3;lIZX zT-ZGo)yjuq%&dJ-WS{7%XBSVZw<;&FCz3(W^pGpzD_Qhhqo|fR)_#3BrbgJneR6SX z$m8?O(6C5axPCX&f)s761ih6>NZ40{KRe#$^|5<$zwUlQl5s#ALvEgya;Qc?Kd|K3 zU!#^e$|tH87`57Br=M`l()FU$q;nW)Un*MOo0z5k+vA!^Mj|9|B>s&$KI`X=#TxM%I=1u3od| zvk1*@Ug{q(Z_$LH^U}f(t8%*+BIzn! ztG$!#TtLLtV3Y}7?)*`Y;zR9Q=JvaR#87$ZRI9*lF9k z8Hv5u@Ue%~8P^X&fX2McY~?iAz}-4iA~v<8xPA{oQLt3C?}}QT0zRsnHgz2o<8S&EO zc=a=JXWg*wYTs4l-H@XRu-Z1SA@Z0|cxh(e@oJtlJsz<*oEFU67n{`ZG^5v9fLzh3 zW^kEryry<+nxe$vWuRApa12<6hE_n$QYOmt#fwxc5Ro(4u*wr@bWvv=BB91BIdbE4 zw_2Jf=7*hob760nZ)1(NZ)?lfYueXbL&$RF)5O*HUSBLhhgI=dD!%nYe0#Pw!CLJ| ztu{U<$kiluX8<;O#wouT)oRMD7R2`lxsvma!CgI@{VvnW%P#TiqjR!i%C!!#a)OF2OMGa&q*=8L+;+~~dqY~z z+Zp!F1VWz0ZUmi-n;HHt*Pn|3!+$(JNa+Ydvv%SOC0y@Cr@*bF_Vuj%Ccg!0rfgMy z%?}qb@bAC6d|R@VRBI$F<^`XoW)d+FZPpKOtIVRJadQ@3+!lr0B+c>)OGmbU$ar9C z!iG^khA7de49j1-iKnG26P8=WN}On>+z>0kD63rzJZ|H4_F}nSiB*9C2G|Y}ZbfNJ zHn!&THtTXZ9S&$BG4K{y9y@ttMmu_UtN$-Uj)-BGFUndU9D>iuSsP4 z$%85D;i<*Sw0_c(2)deHpTSHRh_5#zSj_|$vlDMEUE#vWGhj=>mL;*>Esw3EL3-M&KjxOARF!Pkac!A>BPJv?I z#YwG?R0cyh?4v4R@0`!c$b8!^ayFFd+bM{$>bjrXa zndAW4FjL$7+PpAVij5mzPxFDEvzEwicYQLvva`e!@D?y3Rpz@Wtnu**&%fz__Lgg2 znNsq*`=;TwE1)m3K(kT&VOmr3TLv={P^bRrz|96{!o*;+1>kJlkdN=705(*yL^6^F zQS)?S-sXRUt%%wsB9I!{H@W!DZ9p9L5rL?3ECT}NJox_WlaQzZwGHbCH5!Opuk2L- zg0M66RnS>{|HO@@dP{JG{&yETm^0E2#IXd-e|W9Kq~VUW%wq6A}cmw8Z1~p z(EX&1GEmfWsG&2f66Wb$XtikCT|zT3fpBpaLR-mZ#s}NNb1K`a+XbUieUn^&>VY_g z^X%mukd(GGl3q(hMMp>bEp;oB1c_@}<;&LcJY=lp)6_!oICSTXW-mx3=mnXQdS&M*h|PNoQQJf@SeT_or1q(T!^rfM z+#+9-wDxL}P@945>gctW3hgNosA^QAn73eN(TjYqs!c_iN{28vzGwraEqwbqjrlP;bL`anOJ#xj< z=t0T=u<4YoVGnE-XbtfOcSXZS(xz-f#nM~^3CzZk3Of`Tn(FYQ2v%d;d~!-koxT=h>jWqTYneC zyRMxoKWmG&gz~R0Fl#ZM^gdc_GOMz(QX%O_20l2J5|{lxh*nRZXa}*}y(K%Ar1;`b zoJWrD2S3$A%o;3EVaQrFzHcJ!M?xv)D~M^Z7NXiCg;nz{6tUdHZZNs4-%pAfsh&5* z5|Hbi;JC~eu+b_mU>9IJZW?gKhYxL{F%0x1)n+&^-1jrrUOwMxl(8EH<9wYw0j@6x=@IPR1xhbLFm{?_R)HVn!J4R%X$0NvoHhFjr77$kDE%008LZezZ7L5963Q;4U=pO8>2<|E%7 zE3wsHIrn2~1-mNcANprcIZmDU8{3b^*G}h^$wl0K0#E)~?NEu8LjAP8pT~~>?4|VY z+mihHr~c|{t&Rr) zFTwXvevN06f{b^L&{v!h1XS&rqp62@g(*{TOjn<0fxH_SAQgMP960(8Y?;MfjHRjplP2Az>c?0h!njUc0RP&_AQ| zP8t#rxV68lxUsO&!^uFL2&TN++w3W2`vC}P1#4wQ!*F9kXU1v-C$@SeyP23h2MFAO zKY(-rVyv+@tWk~oOgLK8N^5((Sd>^KrXDmOxzHr1eO{(SwGJ~mJz3SMWh>Zp0Jz#0 zb&7xMiyPYKkZ2gIH^VPz0VB8-5`VtPl|YM`;9C<^3_RbUCP}x0MOdL-WggjZw`SXn zwD4UxD#j~zcM6{t5=Xq(`ZTuQR@R76Ctf+OzI~gi2V@WFN9e}KC)p|j0jUJ z-c1*E&wT0>b+&Xp1uJI@*#Fb$-8v|!|CHgznX2`QV&zkQOBd>OCdp&!XJ&D_E%W@H z_8`|Oa{ZK#rE|T{l7dBg4*DkDcEFFdINF)1IT_HmQTB1c^<4UTU8@(Knhx!x<|4CY zXfSo$9KF`l9|0m3e>0oDDUE@lmW=Uh%Ll1pFN$S02ZnD=#!KaWtWo>v3E8FO&rd|p zcs3Gr`j!dZaT{CDaatW8O1jH_Hl$7?6HYun)G{8bMJk+-vvF5OoOOoVYmG%PAnJVX zxdCZ7`#tj~q(Ro~xuAl8RK{f9$Zest+&JF>yNyU{ejHDFPJ1S8d3i}#G#{qPa}P&_ z6xB*b#&@Ef-gdrM=Pn;#s36aUH%DP3YmPP(qm(|Hl80ANSXv>rZ<3TWSvB8?;xtjv0_mkF z69uG_OO+3a9CJYo&JDA?<|2-|R|HTeLNktPX4>UK%`1zaz8XMD*SHcH%tG??a07-E z8cY!(@W{HKvX2aR#f?TrdTQX(OP@BC29>ESd$lj=4N7|jrMcqcBC^!SyjRF7{UcF~ z4d#6WTe}^dixju!Z#b+PRi2Ivuu_B9uwbuhwvtbyW;>Qr-Q3l54;^f&VIVC+rCX{M z@tEi0S{z*ovqjL3FE%%-+n>mkWfwpYGse0!T*~F5pqXO}`s(D?nLMU|*uk)ktBh3N@(YM`NKxiN=eG*eVoz@@C&x)@2ewsZfks=J27c#V8_=~hQy1N z1_ci-eI1+z|J~m+$Oj>(tk_8uSw;@6J6f3PBtSMsyaR*I<+P+>NAdb?Go2>+*x-Xq zMEyYd6K~|ly{n};{XJ$QBr8Q?ly z44LdM$!sb_*UThR?d*wZAoJv+Q>rM!A;a1Iw1RKqYv({eGKUk$thZ#NNG0XfLF{LK zdF3p_lwv4UC&NVd=-T3P45HK;qseu_L6^hy7D18J+0>h%wBhLK&pdX3)0g>{GDWY< zD^Vv`=;)nVGlZVhHNLsOH69+7>O>@(lVc)|is_>(%JJ8t)gK!#BUmRVefV#>zfgT2S#aB?G z{uRie6nMw%sXJ*JS$?T)F(ZnCNn1h9KHwbWmz&%1%gvSX3%g4Isf}JdXl*)%2p zC~MVePv<1xtJNTH`1WdMp&@?B5O4U9vWjZ!nGN95!=_gsR!vWlm9l|^HPisRB*gLp{fC~4kJ70Myo?o9d$ej zvJgGl*it_aF$mBYqz}yw3~EIZZjMnK*f14%;7UjJj;}d-B!df?bxNW* z)#Xf%B2-^{-O$Bm>^qP4T7^P?&r}?TKu)dMYwwNObmh>I%Ics9-X->RU;%>d0L`I0 zVAxtXQ}ZdEcu~Z+;y!^L4*9b33>3 z_WWO^z%i<~d-k6$6PZ~0?D44+cdG96q%H;KkAE?}r=1FS#_a$5MQiDqkMsToCRMJq zci*`__i|%-?YqkF`*&QKKK1v!zk(XTaM>^im@roG%ywor-p8V4vTU;Uxy#m}HJZf> zYEurq5#;SH{$u9GKjrcp(fAWGud}6D3yl{GE!%2eUnsfqYiWzy8!?z|PIN zi&DqaYk!t39eZ2nvxIGrHuk&$7?cZl;^3wUc zYt56z-={;@+RT8rx*3*mKs%)LVcjWTylxk?E5cB01n+-|G{SmYqb!Do(J&Yd17Ox3 zO$Vc404m}~)4^yMjHUxn2#ltK(J%lfgV8c^G%tV?!f4$%S|*N`iKAuW==i~CNjO>( zj+TU@CE;jEI9d{pmV~1v;b=)XS`v Date: Tue, 28 Apr 2020 09:14:19 -0700 Subject: [PATCH 239/249] exact retirement dates Now that change freeze is lifted, providing exact retirement dates --- windows/deployment/update/update-compliance-monitor.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 102ee54ac9..55e6f693d9 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -18,9 +18,9 @@ ms.topic: article # Monitor Windows Updates with Update Compliance > [!IMPORTANT] -> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. A few retirements are planned, noted below, but are placed **on hold** until the current situation stabilizes. -> * The Windows Defender Antivirus reporting feature of Update Compliance will soon be retired. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). -> * As of March 31, 2020, The Perspectives feature of Update Compliance will soon be retired in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. +> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. Two planned feature removals for Update Compliance – Windows Defender Antivirus reporting and Perspectives – are now scheduled to be removed beginning Monday, May 11, 2020. +> * The retirement of Windows Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). +> * The Perspectives feature of Update Compliance will be retired Monday, May 11, 2020. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. ## Introduction From ffd466869c5604457b1c77fec296f8b125b24aaa Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:14:23 -0700 Subject: [PATCH 240/249] Revision --- devices/hololens/hololens-kiosk.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 76a33a3064..10d45db90c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -52,10 +52,10 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | +|   |Start menu |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | |Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | -|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | +|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | > 1 Voice commands that relate to disabled features do not function. > 2 For more information about how to configure these features, see [Select kiosk apps](#plan-kiosk-apps). From 6724a11a055aaef5d03b44cef7958bc8c50a05e7 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:29:14 -0700 Subject: [PATCH 241/249] Revisions --- devices/hololens/hololens-kiosk.md | 25 +------------------------ 1 file changed, 1 insertion(+), 24 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 10d45db90c..51466aaea1 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -72,7 +72,7 @@ For examples of how to use these capabilities, see the following table. |Use a single-app kiosk for: |Use a multi-app kiosk for: | | --- | --- | -|A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | +|A device that runs only a Dynamics 365 Guide for new hires. |A device that runs both Guides and Remote Assistance for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | ### Plan kiosk apps @@ -144,29 +144,6 @@ No matter which user signs on to the device first (and goes through the Out-of-B **Example 2** -You use two groups that have the following members: - -- Group 1: - - User A - - User B -- Group 2: - - User A - - User B - - User C - - Device 1 - -You configure the kiosk configuration profile as follows: - -- **User logon type**: Group 1 -- **Assigned group**: Group 2 - -No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, the user experiences differ as follows: - -- Users A and B can sign in to the device, and they get the kiosk experience. -- User C can sign in to the device, but does not get the kiosk experience. User C can use the device as a typical non-kiosk device. - -**Example 3** - You contract devices out to two different vendors who need different kiosk experiences. Both vendors have users, and you want all of the users to have access to kiosks from both their own vendor and the other vendor. You configure groups as follows: - Device Group 1: From ea588f10f3758f9450e359a7b3cf600dfdad5a15 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:55:39 -0700 Subject: [PATCH 242/249] Revisions --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 51466aaea1..482241ea7f 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -312,7 +312,7 @@ During OOBE, follow these steps: 1. Enroll the device. 1. Wait for any apps that are part of the kiosk configuration profile to download and install, and for policies to be applied. 1. After OOBE finishes, you can install additional apps from the Microsoft store or by sideloading. [Required apps](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the group that the device belongs to install automatically. -1. Restart the device. +1. When finished, restart the device. The next time you sign in to the device by using an account that belongs to the **User logon type**, the kiosk app should automatically launch. From ae23ce79feca0f92eee469a65a46e0b5f030ec4b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 28 Apr 2020 12:19:24 -0700 Subject: [PATCH 243/249] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index c965ddd359..16ae7b5736 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -157,7 +157,10 @@ The advanced commands offer a more robust set of actions that allow you to take For scenarios when you'd like get a file from a device you're investigating, you can use the `getfile` command. This allows you to save the file from the device for further investigation. >[!NOTE] ->There is a file size limit of 750mb. +>The following file size limits apply: +>- `getfile` limit: 3 GB +>- `fileinfo` limit: 10 GB +>- `library` limit: 250 MB ### Download a file in the background From fe83c33355d045562627cbf25af12276eb8a5b99 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 28 Apr 2020 14:31:12 -0700 Subject: [PATCH 244/249] Corrections: punctuation and Acrolinx spelling --- .../microsoft-defender-atp/live-response.md | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 16ae7b5736..929b9ade09 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -23,24 +23,24 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Live response is a capability that gives your security operations team instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats –- in real time. +Live response is a capability that gives your security operations team instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats — in real time. Live response is designed to enhance investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4qLUW] With live response, analysts can do all of the following tasks: -- Run basic and advanced commands to do investigative work on a device -- Download files such as malware samples and outcomes of PowerShell scripts -- Download files in the background (new!) -- Upload a PowerShell script or executable to the library and run it on a device from a tenant level -- Take or undo remediation actions +- Run basic and advanced commands to do investigative work on a device. +- Download files such as malware samples and outcomes of PowerShell scripts. +- Download files in the background (new!). +- Upload a PowerShell script or executable to the library and run it on a device from a tenant level. +- Take or undo remediation actions. ## Before you begin Before you can initiate a session on a device, make sure you fulfill the following requirements: -- **Verify that you're running a supported version of Windows 10**
      +- **Verify that you're running a supported version of Windows 10**.
      Devices must be running one of the following versions of Windows 10: - [1909](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1909) or later - [1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) @@ -48,29 +48,29 @@ Devices must be running one of the following versions of Windows 10: - [1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) - [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- **Make sure to install appropriate security updates**
      +- **Make sure to install appropriate security updates**.
      - 1903: [KB4515384](https://support.microsoft.com/help/4515384/windows-10-update-kb4515384) - 1809 (RS5): [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818) - 1803 (RS4): [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795) - 1709 (RS3): [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816) -- **Enable live response from the settings page**
      +- **Enable live response from the settings page**.
      You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page. >[!NOTE] >Only users with manage security or global admin roles can edit these settings. -- **Ensure that the machine has an Automation Remediation level assigned to it**
      -You'll need to enable, at least, the minimum Remdiation Level for a given Machine Group. Otherwise you won't be able to establish a Live Response session to a member of that group. +- **Ensure that the machine has an Automation Remediation level assigned to it**.
      +You'll need to enable, at least, the minimum Remediation Level for a given Machine Group. Otherwise you won't be able to establish a Live Response session to a member of that group. -- **Enable live response unsigned script execution** (optional)
      +- **Enable live response unsigned script execution** (optional).
      >[!WARNING] >Allowing the use of unsigned scripts may increase your exposure to threats. Running unsigned scripts is not recommended as it can increase your exposure to threats. If you must use them however, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page. -- **Ensure that you have the appropriate permissions**
      +- **Ensure that you have the appropriate permissions**.
      Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments, see [Create and manage roles](user-roles.md). > [!IMPORTANT] @@ -133,7 +133,7 @@ drivers | Shows all drivers installed on the device. | |`trace` | Sets the terminal's logging mode to debug. | ### Advanced commands -The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). +The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see [Create and manage roles](user-roles.md). | Command | Description | |---|---| @@ -166,9 +166,9 @@ For scenarios when you'd like get a file from a device you're investigating, you To enable your security operations team to continue investigating an impacted device, files can now be downloaded in the background. -- To download a file in the background, in the live response command console, type `download &` +- To download a file in the background, in the live response command console, type `download &`. - If you are waiting for a file to be downloaded, you can move it to the background by using Ctrl + Z. -- To bring a file download to the foreground, in the live response command console, type `fg ` +- To bring a file download to the foreground, in the live response command console, type `fg `. Here are some examples: @@ -176,7 +176,7 @@ Here are some examples: |Command |What it does | |---------|---------| |`"C:\windows\some_file.exe" &` |Starts downloading a file named *some_file.exe* in the background. | -|`fg 1234` |Returns a download with command ID *1234* to the foreground | +|`fg 1234` |Returns a download with command ID *1234* to the foreground. | ### Put a file in the library @@ -280,11 +280,11 @@ Each command is tracked with full details such as: ## Limitations -- Live response sessions are limited to 10 live response sessions at a time -- Large scale command execution is not supported -- A user can only initiate one session at a time -- A device can only be in one session at a time -- There is a file size limit of 750mb when downloading files from a device +- Live response sessions are limited to 10 live response sessions at a time. +- Large scale command execution is not supported. +- A user can only initiate one session at a time. +- A device can only be in one session at a time. +- There is a file size limit of 750mb when downloading files from a device. ## Related article - [Live response command examples](live-response-command-examples.md) From 43738897bb09fcaa1068303f08c622d499d5d109 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 08:40:38 -0700 Subject: [PATCH 245/249] Update live-response.md --- .../threat-protection/microsoft-defender-atp/live-response.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 929b9ade09..3cac9327c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -284,7 +284,6 @@ Each command is tracked with full details such as: - Large scale command execution is not supported. - A user can only initiate one session at a time. - A device can only be in one session at a time. -- There is a file size limit of 750mb when downloading files from a device. ## Related article - [Live response command examples](live-response-command-examples.md) From 2307dd3c116f660911c57fe99b63f76ae5ae86e8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 09:02:37 -0700 Subject: [PATCH 246/249] Update live-response.md --- .../threat-protection/microsoft-defender-atp/live-response.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 3cac9327c0..8ab5475888 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -284,6 +284,10 @@ Each command is tracked with full details such as: - Large scale command execution is not supported. - A user can only initiate one session at a time. - A device can only be in one session at a time. +- The following file size limits apply: + - `getfile` limit: 3 GB + - `fileinfo` limit: 10 GB + - `library` limit: 250 MB ## Related article - [Live response command examples](live-response-command-examples.md) From f88df254db72eef46d349f7ba102c925ba8caae1 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Wed, 29 Apr 2020 12:13:54 -0700 Subject: [PATCH 247/249] Updates to Pro X --- .../surface/enroll-and-configure-surface-devices-with-semm.md | 2 +- devices/surface/surface-pro-arm-app-management.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 0147596761..80367c8e53 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -24,7 +24,7 @@ For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Manage A streamlined method of managing firmware from the cloud on Surface Pro 7,Surface Pro X and Surface Laptop 3 is now available via public preview. For more information,refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). > [!NOTE] -> SEMM is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). +> SEMM is supported on Surface Pro X via the UEFI Manager only. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). #### Download and install Microsoft Surface UEFI Configurator The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md index f3d922c048..488eeca1a2 100644 --- a/devices/surface/surface-pro-arm-app-management.md +++ b/devices/surface/surface-pro-arm-app-management.md @@ -139,10 +139,10 @@ The following tables show the availability of selected key features on Surface P | Endpoint Configuration Manager | Yes | Yes | | | Power on When AC Restore | Yes | Yes | | | Surface Diagnostic Toolkit (SDT) for Business | Yes | Yes | | -| Surface Dock Firmware Update | Yes | Yes | | +| Surface Dock Firmware Update | Yes | No | | | Asset Tag Utility | Yes | Yes | | | Surface Enterprise management Mode (SEMM) | Yes | Partial | No option to disable hardware on Surface Pro X at the firmware level. | -| Surface UEFI Configurator | Yes | | No option to disable hardware. on Surface Pro X at the firmware level. | +| Surface UEFI Configurator | Yes | No | No option to disable hardware. on Surface Pro X at the firmware level. | | Surface UEFI Manager | Yes | Partial | No option to disable hardware on Surface Pro X at the firmware level. | From 9d82bfa6dca671e99de8826d753a05048d6fc425 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 29 Apr 2020 14:05:08 -0700 Subject: [PATCH 248/249] Applied [!NOTE] style --- .../monitor-the-use-of-removable-storage-devices.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index ee4ffad617..30ed1af8fc 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -49,7 +49,8 @@ After you configure the settings to monitor removable storage devices, use the f 1. Sign in to the computer that hosts the resources that you want to monitor. Press the Windows key + R, and then type **cmd** to open a Command Prompt window. - >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + > [!NOTE] + > If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 2. Type **gpupdate /force**, and press ENTER. 3. Connect a removable storage device to the targeted computer and attempt to copy a file that is protected with the Removable Storage Audit policy. @@ -59,7 +60,8 @@ After you configure the settings to monitor removable storage devices, use the f Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted. - >**Note:**  We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. + > [!NOTE] + > We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. ### Related resource From 89777310578af1b4a1e59a5fe39606e90a1f512d Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 29 Apr 2020 14:17:20 -0700 Subject: [PATCH 249/249] Deleted duplicated text, indent content in a second-level list item --- .../enroll-and-configure-surface-devices-with-semm.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 80367c8e53..fd8f4626e5 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -107,11 +107,11 @@ To enroll a Surface device in SEMM with a Surface UEFI configuration package, fo 3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so. 4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows: * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate. - * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8. + * Surface UEFI will prompt you to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8. - ![SEMM enrollment requires last two characters of certificate thumbprint](images/surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint") - - *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint* + ![SEMM enrollment requires last two characters of certificate thumbprint](images/surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint") + + *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint* * Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file.