deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-29 21:57:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Added content

Browse Source
This commit is contained in:
ManikaDhiman 2019-07-10 16:59:05 -07:00
parent 42dbc9d9d2
commit 609e77ce9f
3 changed files with 258 additions and 850 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

732
windows/client-management/mdm/applicationcontrol-csp-ddf.md
View File

@ -1,22 +1,22 @@
--- ---
title: EnrollmentStatusTracking CSP title: ApplicationControl CSP
description: EnrollmentStatusTracking CSP description: ApplicationControl CSP
ms.author: dansimp@microsoft.com ms.author: dansimp@microsoft.com
ms.topic: article ms.topic: article
ms.prod: w10 ms.prod: w10
ms.technology: windows ms.technology: windows
author: ManikaDhiman author: ManikaDhiman
ms.date: 05/17/2019 ms.date: 07/10/2019
--- ---
# EnrollmentStatusTracking DDF # ApplicationControl CSP DDF
This topic shows the OMA DM device description framework (DDF) for the **EnrollmentStatusTracking** configuration service provider. DDF files are used only with OMA DM provisioning XML. This topic shows the OMA DM device description framework (DDF) for the **ApplicationControl** configuration service provider. DDF files are used only with OMA DM provisioning XML.
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
### EnrollmentStatusTracking CSP ### ApplicationControl CSP
```xml ```xml
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
@ -26,13 +26,13 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<MgmtTree xmlns:MSFT="http://schemas.microsoft.com/MobileDevice/DM"> <MgmtTree xmlns:MSFT="http://schemas.microsoft.com/MobileDevice/DM">
<VerDTD>1.2</VerDTD> <VerDTD>1.2</VerDTD>
<Node> <Node>
<NodeName>EnrollmentStatusTracking</NodeName> <NodeName>ApplicationControl</NodeName>
<Path>./User/Vendor/MSFT</Path> <Path>./Vendor/MSFT</Path>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
</AccessType> </AccessType>
<Description>These settings are used to communicate what policies the Enrollment Status Page (ESP) should block on. Using these settings, policy providers register themselves and the set of policies that need to be tracked. The ESP will include the counts of these policy sets in the status message to the user, and blocks progress on that page until all policies are provisioned. The policy provider is expected to drive the status updates by updating the appropriate node values, which will then be reflected in the ESP status message.</Description> <Description>Root Node of the ApplicationControl CSP</Description>
<DFFormat> <DFFormat>
<node /> <node />
</DFFormat> </DFFormat>
@ -42,40 +42,17 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<Scope> <Scope>
<Permanent /> <Permanent />
</Scope> </Scope>
<DFType>
<MIME>com.microsoft/1.0/MDM/EnrollmentStatusTracking</MIME>
</DFType>
</DFProperties>
<Node>
<NodeName>Setup</NodeName>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<Description>These settings are read by the Enrollment Status Page (ESP) during the Account Setup phase. Policy providers use these nodes to communicate progress state back to the ESP, which is then displayed to the user through progress message updates.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType> <DFType>
<DDFName></DDFName> <DDFName></DDFName>
</DFType> </DFType>
</DFProperties> </DFProperties>
<Node> <Node>
<NodeName>Apps</NodeName> <NodeName>Policies</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
</AccessType> </AccessType>
<Description>Policy providers use these settings to communicate to the ESP which app installations it should block on and provide progress in the status message to the user.</Description> <Description>Beginning of a Subtree that contains all policies.</Description>
<DFFormat> <DFFormat>
<node /> <node />
</DFFormat> </DFFormat>
@ -85,32 +62,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<Scope> <Scope>
<Permanent /> <Permanent />
</Scope> </Scope>
<CaseSense> <DFTitle>Policies</DFTitle>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>PolicyProviders</NodeName>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<Description>These settings are read by the Enrollment Status Page (ESP) during the Device Setup phase. Policy providers use these nodes to communicate progress state back to the ESP, which is then displayed to the user through progress message updates.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType> <DFType>
<DDFName></DDFName> <DDFName></DDFName>
</DFType> </DFType>
@ -120,11 +72,8 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
<Add />
<Delete />
<Replace />
</AccessType> </AccessType>
<Description>This node represents an app policy provider for the Enrollment Status Page (ESP). Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true.</Description> <Description>The GUID of the Policy</Description>
<DFFormat> <DFFormat>
<node /> <node />
</DFFormat> </DFFormat>
@ -134,26 +83,23 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>Policy GUID</DFTitle>
<CIS />
</CaseSense>
<DFTitle>ProviderName</DFTitle>
<DFType> <DFType>
<DDFName></DDFName> <DDFName></DDFName>
</DFType> </DFType>
</DFProperties> </DFProperties>
<Node> <Node>
<NodeName>TrackingPoliciesCreated</NodeName> <NodeName>Policy</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
<Replace />
<Add /> <Add />
<Delete /> <Delete />
<Replace />
</AccessType> </AccessType>
<Description>Indicates when the provider has created the required policies for the ESP to use for tracking app installation progress. The policy provider itself is expected to set the value of this node, not the MDM server.</Description> <Description>The policy binary encoded as base64</Description>
<DFFormat> <DFFormat>
<bool /> <b64 />
</DFFormat> </DFFormat>
<Occurrence> <Occurrence>
<One /> <One />
@ -161,411 +107,62 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>Policy</DFTitle>
<CIS />
</CaseSense>
<DFType> <DFType>
<MIME>text/plain</MIME> <DDFName></DDFName>
</DFType> </DFType>
</DFProperties> </DFProperties>
</Node> </Node>
</Node>
</Node>
<Node> <Node>
<NodeName>Tracking</NodeName> <NodeName>PolicyInfo</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
</AccessType> </AccessType>
<Description>This node represents an app policy provider for the Enrollment Status Page (ESP). Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true.</Description> <Description>Information Describing the Policy indicated by the GUID</Description>
<DFFormat> <DFFormat>
<node /> <node />
</DFFormat> </DFFormat>
<Occurrence> <Occurrence>
<One /> <One />
</Occurrence> </Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName></NodeName>
<DFProperties>
<AccessType>
<Get />
<Add />
<Delete />
<Replace />
</AccessType>
<Description>The name of the provider responsible for installing these apps and providing status back to the Enrollment Status Page.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<ZeroOrMore />
</Occurrence>
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>PolicyInfo</DFTitle>
<CIS />
</CaseSense>
<DFTitle>ProviderName</DFTitle>
<DFType> <DFType>
<DDFName></DDFName> <DDFName></DDFName>
</DFType> </DFType>
</DFProperties> </DFProperties>
<Node> <Node>
<NodeName></NodeName> <NodeName>Version</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
<Add />
<Delete />
<Replace />
</AccessType> </AccessType>
<Description>A unique name for the app whose progress should be tracked in the ESP. The app name can be arbitrary as it is not used directly by the ESP, so the value can be defined however the policy provider chooses.</Description> <Description>Version of the Policy indicated by the GUID, as a string. When parsing use a uint64 as the containing data type</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<ZeroOrMore />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFTitle>AppName</DFTitle>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>TrackingUri</NodeName>
<DFProperties>
<AccessType>
<Get />
<Add />
<Delete />
<Replace />
</AccessType>
<Description>An optional URI to another CSP for tracking the apps installation. If this value is not set, installation status is derived from the InstallationState node.</Description>
<DFFormat> <DFFormat>
<chr /> <chr />
</DFFormat> </DFFormat>
<Occurrence> <Occurrence>
<ZeroOrOne /> <One />
</Occurrence> </Occurrence>
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>Version</DFTitle>
<CIS />
</CaseSense>
<DFType> <DFType>
<MIME>text/plain</MIME> <MIME>text/plain</MIME>
</DFType> </DFType>
</DFProperties> </DFProperties>
</Node> </Node>
<Node> <Node>
<NodeName>InstallationState</NodeName> <NodeName>IsEffective</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>The installation state for the app. This node should be updated by the policy providers (not the MDM server) so the ESP can track the installation progress and update the status message. Expected values: 1 = NotInstalled, 2 = InProgress, 3 = Completed, 4 = Error</Description>
<DFFormat>
<int />
</DFFormat>
<Occurrence>
<ZeroOrOne />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
<Node>
<NodeName>RebootRequired</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>An optional node indicating if the app installation requires the ESP to issue a reboot. This node should be set by the policy provider installing the app (not the MDM server). Expected values: 1 = NotRequired, 2 = SoftReboot, 3 = HardReboot. If this node is not set, the ESP will not reboot the device for this app install.</Description>
<DFFormat>
<int />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
</Node>
</Node>
</Node>
</Node>
<Node>
<NodeName>HasProvisioningCompleted</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
</AccessType> </AccessType>
<DefaultValue>false</DefaultValue> <Description>Whether the Policy indicated by the GUID is Effective on the system (loaded by the enforcement engine and in effect)</Description>
<Description>This node is set by the Enrollment Status Page (ESP) when it completes. Providers are able to query this node to determine if the ESP is showing, allowing them to bifurcate their logic accordingly. For instance, when an app install requires a reboot, the policy provider should let the ESP issue the reboot by setting RebootRequired value for that app if and only if the ESP is running, otherwise, the policy provider is responsible for issuing a reboot themselves.</Description>
<DFFormat>
<bool />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
</Node>
</Node>
<Node>
<NodeName>EnrollmentStatusTracking</NodeName>
<Path>./Device/Vendor/MSFT</Path>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<Description>These settings are used to communicate what policies the Enrollment Status Page (ESP) should block on. Using these settings, policy providers register themselves and the set of policies that need to be tracked. The ESP will include the counts of these policy sets in the status message to the user, and blocks progress on that page until all policies are provisioned. The policy provider is expected to drive the status updates by updating the appropriate node values, which will then be reflected in the ESP status message.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<DFType>
<MIME>com.microsoft/1.0/MDM/EnrollmentStatusTracking</MIME>
</DFType>
</DFProperties>
<Node>
<NodeName>DevicePreparation</NodeName>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<Description>These settings are read by the Enrollment Status Page (ESP) during the Device Preparation phase. These setting are used to orchestrate any setup activities prior to provisioning the device in the Device Setup phase of the ESP.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>PolicyProviders</NodeName>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<Description>These nodes indicate to the Enrollment Status Page (ESP) that it should wait in the Device Preparation phase until all PolicyProviders are installed or marked as not required.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName></NodeName>
<DFProperties>
<AccessType>
<Get />
<Add />
<Delete />
<Replace />
</AccessType>
<Description>This node represents a policy provider for the Enrollment Status Page (ESP). The node should be given a unique name for the policy provider. Registration of a policy provider indicates to the Enrollment Status Page that it should block in the Device Preparation phase until the provider sets its InstallationState node to 1 (not required) or 2 (complete). Once all registered policy providers have been marked as completed (or not required), the Enrollment Status Page will progress to the Device Setup phase.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<ZeroOrMore />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<DFTitle>ProviderName</DFTitle>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>InstallationState</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>This node communicates the policy provider installation state back to the Enrollment Status Page. Expected values: 1 = NotInstalled, 2 = NotRequired, 3= Completed, 4 = Error. </Description>
<DFFormat>
<int />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
<Node>
<NodeName>LastError</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>If a policy provider fails to install, it can optionally set an HRESULT error code that the Enrollment Status Page can display in an error message to the user. This node will only be read by the Enrollment Status Page when the provider's InstallationState node is set to 3 (Error). This node is only intended to be set by the policy provider itself, not the MDM server. </Description>
<DFFormat>
<int />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
<Node>
<NodeName>Timeout</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>An optional timeout (in minutes) for provider installation to complete before the Enrollment Status Page shows an error. Provider installation is considered complete when the InstallationState node is set to 2 (NotRequired) or 3 (Complete). If no timeout value is supplied the ESP will choose a default timeout value of 15 minutes.</Description>
<DFFormat>
<int />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
<Node>
<NodeName>TrackedResourceTypes</NodeName>
<DFProperties>
<AccessType>
<Get />
<Add />
<Delete />
<Replace />
</AccessType>
<Description>This node's children registers which resource types the policy provider supports for provisioning. Only registered providers for a particular resource type will have their policies incorporated with Enrollment Status Page tracking message. </Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>Apps</NodeName>
<DFProperties>
<AccessType>
<Get />
<Add />
<Delete />
<Replace />
</AccessType>
<DefaultValue>false</DefaultValue>
<Description>This node registers the policy provider for App provisioning. </Description>
<DFFormat> <DFFormat>
<bool /> <bool />
</DFFormat> </DFFormat>
@ -575,124 +172,19 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>IsEffective</DFTitle>
<CIS />
</CaseSense>
<DFType> <DFType>
<MIME>text/plain</MIME> <MIME>text/plain</MIME>
</DFType> </DFType>
</DFProperties> </DFProperties>
</Node> </Node>
</Node>
</Node>
</Node>
</Node>
<Node> <Node>
<NodeName>Setup</NodeName> <NodeName>IsDeployed</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
</AccessType> </AccessType>
<Description>These settings are read by the Enrollment Status Page (ESP) during the Device Setup phase. Policy providers use these nodes to communicate progress state back to the ESP, which is then displayed to the user through progress message updates.</Description> <Description>Whether the Policy indicated by the GUID is deployed on the system (on the physical machine)</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>Apps</NodeName>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<Description>These settings are used to communicate what policies the Enrollment Status Page (ESP) should block on. Using these settings, policy providers register themselves and the set of policies that need to be tracked. The ESP will include the counts of these policy sets in the status message to the user, and blocks progress on that page until all policies are provisioned. The policy provider is expected to drive the status updates by updating the appropriate node values, which will then be reflected in the ESP status message.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>PolicyProviders</NodeName>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<Description>App policy providers for this CSP. These are the policy providers the ESP should wait on before showing the tracking message with status to the user. </Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName></NodeName>
<DFProperties>
<AccessType>
<Get />
<Add />
<Delete />
<Replace />
</AccessType>
<Description>This node represents an app policy provider for the Enrollment Status Page (ESP). Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true.</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<ZeroOrMore />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFTitle>ProviderName</DFTitle>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>TrackingPoliciesCreated</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>Indicates when the provider has created the required policies for the ESP to use for tracking app installation progress. The policy provider itself is expected to set the value of this node, not the MDM server.</Description>
<DFFormat> <DFFormat>
<bool /> <bool />
</DFFormat> </DFFormat>
@ -702,169 +194,73 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>IsDeployed</DFTitle>
<CIS />
</CaseSense>
<DFType> <DFType>
<MIME>text/plain</MIME> <MIME>text/plain</MIME>
</DFType> </DFType>
</DFProperties> </DFProperties>
</Node> </Node>
</Node>
</Node>
<Node> <Node>
<NodeName>Tracking</NodeName> <NodeName>IsAuthorized</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
</AccessType> </AccessType>
<Description>These are the set of apps that are being tracked by the Enrollment Status Page.</Description> <Description>Whether the Policy indicated by the GUID is authorized to be loaded by the enforcement engine on the system </Description>
<DFFormat> <DFFormat>
<node /> <bool />
</DFFormat> </DFFormat>
<Occurrence> <Occurrence>
<One /> <One />
</Occurrence> </Occurrence>
<Scope> <Scope>
<Permanent /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>IsAuthorized</DFTitle>
<CIS />
</CaseSense>
<DFType> <DFType>
<DDFName></DDFName> <MIME>text/plain</MIME>
</DFType> </DFType>
</DFProperties> </DFProperties>
</Node>
<Node> <Node>
<NodeName></NodeName> <NodeName>Status</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
<Add />
<Delete />
<Replace />
</AccessType> </AccessType>
<Description>The name of the provider responsible for installing these apps and providing status back to the Enrollment Status Page.</Description> <Description>The Current Status of the Policy Indicated by the Policy GUID</Description>
<DFFormat> <DFFormat>
<node /> <int />
</DFFormat> </DFFormat>
<Occurrence> <Occurrence>
<ZeroOrMore /> <One />
</Occurrence> </Occurrence>
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>Status</DFTitle>
<CIS />
</CaseSense>
<DFTitle>ProviderName</DFTitle>
<DFType> <DFType>
<DDFName></DDFName> <MIME>text/plain</MIME>
</DFType> </DFType>
</DFProperties> </DFProperties>
</Node>
<Node> <Node>
<NodeName></NodeName> <NodeName>FriendlyName</NodeName>
<DFProperties> <DFProperties>
<AccessType> <AccessType>
<Get /> <Get />
<Add />
<Delete />
<Replace />
</AccessType> </AccessType>
<Description>A unique name for the app whose progress should be tracked in the ESP. The app name can be arbitrary as it is not used directly by the ESP, so the value can be defined however the policy provider chooses.</Description> <Description>The FriendlyName of the Policy Indicated by the Policy GUID</Description>
<DFFormat>
<node />
</DFFormat>
<Occurrence>
<ZeroOrMore />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFTitle>AppName</DFTitle>
<DFType>
<DDFName></DDFName>
</DFType>
</DFProperties>
<Node>
<NodeName>TrackingUri</NodeName>
<DFProperties>
<AccessType>
<Get />
<Add />
<Delete />
<Replace />
</AccessType>
<Description>An optional URI to another CSP for tracking the apps installation. If this value is not set, installation status is derived from the InstallationState node.</Description>
<DFFormat> <DFFormat>
<chr /> <chr />
</DFFormat> </DFFormat>
<Occurrence>
<ZeroOrOne />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
<Node>
<NodeName>InstallationState</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>The installation state for the app. This node should be updated by the policy providers (not the MDM server) so the ESP can track the installation progress and update the status message. Expected values: 1 = NotInstalled, 2 = InProgress, 3 = Completed, 4 = Error</Description>
<DFFormat>
<int />
</DFFormat>
<Occurrence>
<ZeroOrOne />
</Occurrence>
<Scope>
<Dynamic />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
<Node>
<NodeName>RebootRequired</NodeName>
<DFProperties>
<AccessType>
<Get />
<Replace />
<Add />
<Delete />
</AccessType>
<Description>An optional node indicating if the app installation requires the ESP to issue a reboot. This node should be set by the policy provider installing the app (not the MDM server). Expected values: 1 = NotRequired, 2 = SoftReboot, 3 = HardReboot. If this node is not set, the ESP will not reboot the device for this app install.</Description>
<DFFormat>
<int />
</DFFormat>
<Occurrence> <Occurrence>
<One /> <One />
</Occurrence> </Occurrence>
<Scope> <Scope>
<Dynamic /> <Dynamic />
</Scope> </Scope>
<CaseSense> <DFTitle>FriendlyName</DFTitle>
<CIS />
</CaseSense>
<DFType> <DFType>
<MIME>text/plain</MIME> <MIME>text/plain</MIME>
</DFType> </DFType>
@ -874,33 +270,5 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
</Node> </Node>
</Node> </Node>
</Node> </Node>
<Node>
<NodeName>HasProvisioningCompleted</NodeName>
<DFProperties>
<AccessType>
<Get />
</AccessType>
<DefaultValue>false</DefaultValue>
<Description>This node is set by the Enrollment Status Page (ESP) when it completes. Providers are able to query this node to determine if the ESP is showing, allowing them to bifurcate their logic accordingly. For instance, when an app install requires a reboot, the policy provider should let the ESP issue the reboot by setting RebootRequired value for that app if and only if the ESP is running, otherwise, the policy provider is responsible for issuing a reboot themselves.</Description>
<DFFormat>
<bool />
</DFFormat>
<Occurrence>
<One />
</Occurrence>
<Scope>
<Permanent />
</Scope>
<CaseSense>
<CIS />
</CaseSense>
<DFType>
<MIME>text/plain</MIME>
</DFType>
</DFProperties>
</Node>
</Node>
</Node>
</MgmtTree> </MgmtTree>
``` ```

213
windows/client-management/mdm/applicationcontrol-csp.md
View File

@ -50,14 +50,14 @@ This subtree has nodes containing information which describes the policy indicat
Scope is dynamic. Supported operation is Get. Scope is dynamic. Supported operation is Get.
<a href="" id="applicationcontrol-policies-policyguid-policyinfo-version"></a>**EApplicationControl/Policies/_Policy GUID_/PolicyInfo/Version** <a href="" id="applicationcontrol-policies-policyguid-policyinfo-version"></a>**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/Version**
This node provides the version of the policy indicated by the GUID. Stored as a string, but when parsing use a uint64 as the containing data type. This node provides the version of the policy indicated by the GUID. Stored as a string, but when parsing use a uint64 as the containing data type.
Scope is dynamic. Supported operation is Get. Scope is dynamic. Supported operation is Get.
Value type is char. Value type is char.
<a href="" id="applicationcontrol-policies-policyguid-policyinfo-iseffective"></a>**EApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsEffective** <a href="" id="applicationcontrol-policies-policyguid-policyinfo-iseffective"></a>**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsEffective**
This node specifies whether a policy is actually loaded by the enforcement engine and is in effect on a system. This node specifies whether a policy is actually loaded by the enforcement engine and is in effect on a system.
Scope is dynamic. Supported operation is Get. Scope is dynamic. Supported operation is Get.
@ -67,7 +67,7 @@ Value type is bool. Supported values are as follows:
- False — Indicates that the policy is not loaded by the enforcement engine and is not in effect on a system. This is the default. - False — Indicates that the policy is not loaded by the enforcement engine and is not in effect on a system. This is the default.
<Verify> <Verify>
<a href="" id="applicationcontrol-policies-policyguid-policyinfo-isdeployed"></a>**EApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsDeployed** <a href="" id="applicationcontrol-policies-policyguid-policyinfo-isdeployed"></a>**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsDeployed**
This node specifies whether a policy is on the system and is present on the physical machine. This node specifies whether a policy is on the system and is present on the physical machine.
Scope is dynamic. Supported operation is Get. Scope is dynamic. Supported operation is Get.
@ -77,7 +77,7 @@ Value type is bool. Supported values are as follows:
- False — Indicates that the policy is not on the system and is not present on the physical machine. This is the default. - False — Indicates that the policy is not on the system and is not present on the physical machine. This is the default.
<Verify> <Verify>
<a href="" id="applicationcontrol-policies-policyguid-policyinfo-isauthorized"></a>**EApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsAuthorized** <a href="" id="applicationcontrol-policies-policyguid-policyinfo-isauthorized"></a>**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsAuthorized**
This node specifies whether the policy is authorized to be loaded by the enforcement engine on the system. If not authorized, a policy cannot take effect on the system. This node specifies whether the policy is authorized to be loaded by the enforcement engine on the system. If not authorized, a policy cannot take effect on the system.
Scope is dynamic. Supported operation is Get. Scope is dynamic. Supported operation is Get.
@ -87,105 +87,140 @@ Value type is bool. Supported values are as follows:
- False — Indicates that the policy is not authorized to be loaded by the enforcement engine on the system. This is the default. - False — Indicates that the policy is not authorized to be loaded by the enforcement engine on the system. This is the default.
<Verify> <Verify>
The following table provides the policy output based on different combinations of PolicyInfo nodes values: The following table provides the result of this policy based on different values of IsAuthorized, IsDeployed, and IsEffective nodes:
|IsAuthorized|IsDeployed|IsEffective|Resultant|
|------------|----------|-----------|---------|
|True|True|True|Policy is currently running and in effect.|
|True|True|False|Policy requires a reboot to take effect.|
|True|False|True|Policy requires a reboot to unload from CI.|
|False|True|True|Not Reachable.|
|True|False|False|*Not Reachable.|
|False|True|False|*Not Reachable.|
|False|False|True|Not Reachable.|
|False|False|False|*Not Reachable.|
```*``` denotes a valid intermediary state; however, if an MDM transaction results in this state configuration, the END_COMMAND_PROCESSING will result in a fail.
<a href="" id="enrollmentstatustracking-devicepreparation-policyproviders-providername-trackedresourcetypes"></a>**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/*ProviderName*/TrackedResourceTypes** <a href="" id="applicationcontrol-policies-policyguid-policyinfo-status"></a>**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/Status**
Required. This node is supported only in device context. This node specifies whether the deployment of the policy indicated by the GUID was successful.
This node's children register which resource types the policy provider supports for provisioning. Only registered providers for a particular resource type will have their policies incorporated with ESP tracking message.
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. Scope is dynamic. Supported operation is Get.
<a href="" id="enrollmentstatustracking-devicepreparation-policyproviders-providername-trackedresourcetypes-Apps"></a>**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/*ProviderName*/TrackedResourceTypes/Apps** Value type is integer. Default value is 0 == OK.
Required. This node is supported only in device context.
This node specifies if the policy provider is registered for app provisioning.
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. <a href="" id="applicationcontrol-policies-policyguid-policyinfo-friendlyname"></a>**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/FriendlyName**
This node provides the friendly name of the policy indicated by the policy GUID.
Value type is boolean. Expected values are as follows: Scope is dynamic. Supported operation is Get.
- false — Indicates that the policy provider is not registered for app provisioning. This is the default.
- true — Indicates that the policy provider is registered for app provisioning.
<a href="" id="enrollmentstatustracking-setup"></a>**EnrollmentStatusTracking/Setup** Value type is char.
Required. This node is supported in both user context and device context.
Provides the settings that ESP reads during the account setup phase in the user context and device setup phase in the device context. Policy providers use this node to communicate progress status back to the ESP, which is then displayed to the user through progress messages.
Scope is permanent. Supported operation is Get. ## ApplicationControl CSP usage guidance
<a href="" id="enrollmentstatustracking-setup-apps"></a>**EnrollmentStatusTracking/Setup/Apps** To use this CSP:
Required. This node is supported in both user context and device context. - Know a generated policy’s GUID, which can be found in the policy xml as ```<PolicyTypeID>```.
Provides the settings to communicate to the ESP which app installations it should block on and provide progress in the status message to the user. - Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned.
- Create a policy node (a Base64-encoded blob of the binary policy representation) using the certutil -encode command line tool.
Scope is permanent. Supported operation is Get. Sample certutil invocation:
```
certutil -encode WinSiPolicy.p7b WinSiPolicy.cer
```
Alternatively, you can use the following PowerShell invocation:
```
[Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path <bin file>))
```
If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you use Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy.
<a href="" id="enrollmentstatustracking-setup-apps-policyproviders"></a>**EnrollmentStatusTracking/Setup/Apps/PolicyProviders** - Deploy the policy:
Required. This node is supported in both user context and device context. - To deploy a new base policy using the CSP, perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy** using the Base64-encoded policy node as {Data}. Refer to the the Format section in the Example 1 snippet).
Specifies the app policy providers for this CSP. These are the policy providers the ESP should wait on before showing the tracking message with the status to the user.
Scope is permanent. Supported operation is Get. - To deploy base policy and supplemental policies:
- Perform an ADD as described above first with the GUID and policy data for the base policy
- Repeat for each base or supplemental policy in turn (with its own GUID and data)
<a href="" id="enrollmentstatustracking-setup-apps-policyproviders-providername"></a>**EnrollmentStatusTracking/Setup/Apps/PolicyProviders**/***ProviderName*** The following example shows the deployment of two base policies and a supplemental policy (which already specifies the base policy it supplements and does not need that reflected in the ADD).
Optional. This node is supported in both user context and device context.
Represents an app policy provider for the ESP. Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true.
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. **Example 1: Add first base policy**
```
<Add>
<CmdID>1</CmdID>
<Item>
<Target>
<LocURI>./Vendor/MSFT/ApplicationControl/Policies/{Base1GUID}/Policy</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">b64</Format>
</Meta>
<Data> {Base1Data} </Data>
</Item>
</Add>
```
**Example 2: Add second base policy**
```
<Add>
<CmdID>1</CmdID>
<Item>
<Target>
<LocURI>./Vendor/MSFT/ApplicationControl/Policies/{Base2GUID}/Policy</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">b64</Format>
</Meta>
<Data> {Base2Data} </Data>
</Item>
</Add>
```
**Example 3: Add supplemental policy**
```
<Add>
<CmdID>1</CmdID>
<Item>
<Target>
<LocURI>./Vendor/MSFT/ApplicationControl/Policies/{Supplemental1GUID}/Policy</LocURI>
</Target>
<Meta>
<Format xmlns="syncml:metinf">b64</Format>
</Meta>
<Data> {Supplemental1Data} </Data>
</Item>
</Add>
```
- Perform a GET operation using a deployed policy’s GUID to interrogate/inspect the policy itself or information about it.
- ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy (raw p7b)
- ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/Version (policy version)
- ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/IsEffective (is the policy in effect)
- ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/IsDeployed (is the policy on the system)
- ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/IsAuthorized (is the policy authorized on the system)
- ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/Status (was the deployment successful)
- ./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/PolicyInfo/FriendlyName (the friendly name per the policy)
<a href="" id="enrollmentstatustracking-setup-apps-policyproviders-providername-trackingpoliciescreated"></a>**EnrollmentStatusTracking/Setup/Apps/PolicyProviders/*ProviderName*/TrackingPoliciesCreated** **Sample Get command**
Required. This node is supported in both user context and device context. ```
Indicates if the provider has created the required policies for the ESP to use for tracking app installation progress. The policy provider itself is expected to set the value of this node, not the MDM server. <Get>
<CmdID>1</CmdID>
<Item>
<Target>
<LocURI>./Vendor/MSFT/ApplicationControl/Policies/{PolicyGUID}/Policy</LocURI>
</Target>
</Item>
</Get>
```
- Delete the policy.
To delete an unsigned policy, perform a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy**.
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. > [!Note]
> Only signed things should be able to update signed policies. Hence, performing a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_PolicyGUID_/Policy** is not sufficient to delete a signed policy.
Value type is boolean. The expected values are as follows: To delete a signed policy, first replace it with a signed update allowing unsigned policy, then deploy another update with unsigned policy, then perform delete.
- true — Indicates that the provider has created the required policies.
- false — Indicates that the provider has not created the required policies. This is the default.
<a href="" id="enrollmentstatustracking-setup-apps-tracking"></a>**EnrollmentStatusTracking/Setup/Apps/Tracking** **Delete a policy**
Required. This node is supported in both user context and device context. ```
Root node for the app installations being tracked by the ESP. <Delete>
<CmdID>1</CmdID>
Scope is permanent. Supported operation is Get. <Item>
<Target>
<a href="" id="enrollmentstatustracking-setup-apps-tracking-providername"></a>**EnrollmentStatusTracking/Setup/Apps/Tracking/_ProviderName_** <LocURI>./Vendor/MSFT/ApplicationControl/Policies/{PolicyGUID}/Policy</LocURI>
Optional. This node is supported in both user context and device context. </Target>
Indicates the provider name responsible for installing the apps and providing status back to ESP. </Item>
</Delete>
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. ```
<a href="" id="enrollmentstatustracking-setup-apps-tracking-providername-appname"></a>**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/_AppName_**
Optional. This node is supported in both user context and device context.
Represents a unique name for the app whose progress should be tracked by the ESP. The policy provider can define any arbitrary app name as ESP does not use the app name directly.
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
<a href="" id="enrollmentstatustracking-setup-apps-tracking-providername-appname-installationstate"></a>**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/*AppName*/InstallationState**
Optional. This node is supported in both user context and device context.
Represents the installation state for the app. The policy providers (not the MDM server) must update this node for the ESP to track the installation progress and update the status message.
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
Value type is integer. Expected values are as follows:
- 1 — NotInstalled
- 2 — InProgress
- 3 — Completed
- 4 — Error
<a href="" id="enrollmentstatustracking-setup-apps-tracking-providername-appname-rebootrequired"></a>**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/*AppName*/RebootRequired**
Optional. This node is supported in both user context and device context.
Indicates if the app installation requires ESP to issue a reboot. The policy providers installing the app (not the MDM server) must set this node. If the policy providers do not set this node, the ESP will not reboot the device for the app installation.
Scope is dynamic. Supported operations are Get, Add, Delete, and Replace.
Value type is integer. Expected values are as follows:
- 1 — NotRequired
- 2 — SoftReboot
- 3 — HardReboot
<a href="" id="enrollmentstatustracking-setup-hasprovisioningcompleted"></a>**EnrollmentStatusTracking/Setup/HasProvisioningCompleted**
Required. This node is supported in both user context and device context.
ESP sets this node when it completes. Providers can query this node to determine if the ESP is showing, which allows them to determine if they still need to provide status updates for the ESP through this CSP.
Scope is permanent. Supported operation is Get.
Value type is boolean. Expected values are as follows:
- true — Indicates that ESP has completed. This is the default.
- false — Indicates that ESP is displayed, and provisioning is still going.

5
windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
View File

@ -140,6 +140,10 @@ For details about Microsoft mobile device management protocols for Windows 10 s
<td style="vertical-align:top"><a href="enrollmentstatustracking-csp.md" data-raw-source="[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)">EnrollmentStatusTracking CSP</a></td> <td style="vertical-align:top"><a href="enrollmentstatustracking-csp.md" data-raw-source="[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)">EnrollmentStatusTracking CSP</a></td>
<td style="vertical-align:top"><p>Added new CSP in Windows 10, version 1903.</p> <td style="vertical-align:top"><p>Added new CSP in Windows 10, version 1903.</p>
</td></tr> </td></tr>
<tr>
<td style="vertical-align:top"><a href="applicationstatus-csp.md" data-raw-source="[ApplicationStatus CSP](applicationstatus-csp.md)">ApplicationStatus CSP</a></td>
<td style="vertical-align:top"><p>Added new CSP in Windows 10, version 1903.</p>
</td></tr>
</tbody> </tbody>
</table> </table>
@ -1885,6 +1889,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
|New or updated topic | Description| |New or updated topic | Description|
|--- | ---| |--- | ---|
|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.|
|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:<br>Create a custom configuration service provider<br>Design a custom configuration service provider<br>IConfigServiceProvider2<br>IConfigServiceProvider2::ConfigManagerNotification<br>IConfigServiceProvider2::GetNode<br>ICSPNode<br>ICSPNode::Add<br>ICSPNode::Clear<br>ICSPNode::Copy<br>ICSPNode::DeleteChild<br>ICSPNode::DeleteProperty<br>ICSPNode::Execute<br>ICSPNode::GetChildNodeNames<br>ICSPNode::GetProperty<br>ICSPNode::GetPropertyIdentifiers<br>ICSPNode::GetValue<br>ICSPNode::Move<br>ICSPNode::SetProperty<br>ICSPNode::SetValue<br>ICSPNodeTransactioning<br>ICSPValidate<br>Samples for writing a custom configuration service provider| |Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:<br>Create a custom configuration service provider<br>Design a custom configuration service provider<br>IConfigServiceProvider2<br>IConfigServiceProvider2::ConfigManagerNotification<br>IConfigServiceProvider2::GetNode<br>ICSPNode<br>ICSPNode::Add<br>ICSPNode::Clear<br>ICSPNode::Copy<br>ICSPNode::DeleteChild<br>ICSPNode::DeleteProperty<br>ICSPNode::Execute<br>ICSPNode::GetChildNodeNames<br>ICSPNode::GetProperty<br>ICSPNode::GetPropertyIdentifiers<br>ICSPNode::GetValue<br>ICSPNode::Move<br>ICSPNode::SetProperty<br>ICSPNode::SetValue<br>ICSPNodeTransactioning<br>ICSPValidate<br>Samples for writing a custom configuration service provider|