*.**ms-windows-store-license**, and select the license file.
+
+[Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps)
> [!NOTE]
-> Removing a provisioning package will not remove any apps installed by device context in that provisioning package.
+> Removing a provisioning package will not remove any apps installed by device context in that provisioning package.
+
+
+
+## Add a certificate to your package
+
+1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**.
+
+2. Enter a **CertificateName** and then select **Add**.
+
+2. Enter the **CertificatePassword**.
+
+3. For **CertificatePath**, browse and select the certificate to be used.
+
+4. Set **ExportCertificate** to **False**.
+
+5. For **KeyLocation**, select **Software only**.
+## Add other settings to your package
-## Add a certificate to your package
+For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
-1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**.
+## Build your package
-2. Enter a **CertificateName** and then select **Add**.
+1. When you are done configuring the provisioning package, on the **File** menu, select **Save**.
-2. Enter the **CertificatePassword**.
+2. Read the warning that project files may contain sensitive information, and select **OK**.
-3. For **CertificatePath**, browse and select the certificate to be used.
+ When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location, and delete the project files when they're no longer needed.
-4. Set **ExportCertificate** to **False**.
+3. On the **Export** menu, select **Provisioning package**.
-5. For **KeyLocation**, select **Software only**.
+4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
-
-## Add other settings to your package
-
-For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
-
-## Build your package
-
-1. When you are done configuring the provisioning package, on the **File** menu, select **Save**.
-
-2. Read the warning that project files may contain sensitive information, and select **OK**.
-
- When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location, and delete the project files when they're no longer needed.
-
-3. On the **Export** menu, select **Provisioning package**.
-
-4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
-
-5. Set a value for **Package Version**.
+5. Set a value for **Package Version**.
> [!TIP]
- > You can make changes to existing packages and change the version number to update previously applied packages.
+ > You can make changes to existing packages and change the version number to update previously applied packages.
-6. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
+6. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
- - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
+ - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
- - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package.
+ - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package.
> [!TIP]
- > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently.
+ > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently.
7. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
- Optionally, you can select **Browse** to change the default output location.
+ Optionally, you can select **Browse** to change the default output location.
-8. Select **Next**.
+8. Select **Next**.
9. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
- If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
+ If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
+ If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
- - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build.
+ - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build.
- - If you are done, select **Finish** to close the wizard and go back to the **Customizations Page**.
-11. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
+ - If you are done, select **Finish** to close the wizard and go back to the **Customizations Page**.
- - Shared network folder
+11. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
- - SharePoint site
+ - Shared network folder
- - Removable media (USB/SD)
+ - SharePoint site
- - Email
+ - Removable media (USB/SD)
-**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
+ - Email
-## Related articles
+**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
+
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md
index 400e2a7863..b015e76b55 100644
--- a/windows/configuration/provisioning-packages/provisioning-apply-package.md
+++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md
@@ -1,103 +1,98 @@
---
title: Apply a provisioning package (Windows 10/11)
description: Provisioning packages can be applied to a device during initial setup (OOBE) and after (runtime).
-ms.prod: windows-client
-author: lizgt2000
-ms.author: lizlong
-ms.topic: article
-ms.localizationpriority: medium
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# Apply a provisioning package
+# Apply a provisioning package
-**Applies to**
+**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
-Provisioning packages can be applied to a device during initial setup (out-of-box experience or "OOBE") and after ("runtime").
+Provisioning packages can be applied to a device during initial setup (out-of-box experience or "OOBE") and after ("runtime").
> [!NOTE]
>
> - Applying a provisioning package to a desktop device requires administrator privileges on the device.
-> - You can interrupt a long-running provisioning process by pressing ESC.
+> - You can interrupt a long-running provisioning process by pressing ESC.
> [!TIP]
-> In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation.
+> In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation.
-## During initial setup
+## During initial setup
-To apply a provisioning package from a USB drive during initial setup:
+To apply a provisioning package from a USB drive during initial setup:
-1. Start with a device on the initial setup screen. If the device has gone past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**.
+1. Start with a device on the initial setup screen. If the device has gone past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**.
- :::image type="content" source="../images/oobe.png" alt-text="The first screen when setting up a new PC.":::
+ :::image type="content" source="../images/oobe.png" alt-text="The first screen when setting up a new PC.":::
-2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times.
+2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times.
- If there is only one provisioning package on the USB drive, the provisioning package is applied. See step 5.
- - If there is more than one provisioning package on the USB drive, Windows setup will recognize the drive and ask how you want to provision the device. Select **Install provisioning package** and select **Next**.
+ - If there is more than one provisioning package on the USB drive, Windows setup will recognize the drive and ask how you want to provision the device. Select **Install provisioning package** and select **Next**.
- :::image type="content" source="../images/provisioning-oobe-choice.png" alt-text="What would you like to do?":::
+ :::image type="content" source="../images/provisioning-oobe-choice.png" alt-text="What would you like to do?":::
-3. Select the provisioning package (`.ppkg`) that you want to apply, and select **Yes**.
+3. Select the provisioning package (`.ppkg`) that you want to apply, and select **Yes**.
- :::image type="content" source="../images/provisioning-oobe-choose-package.png" alt-text="Choose a package.":::
+ :::image type="content" source="../images/provisioning-oobe-choose-package.png" alt-text="Choose a package.":::
-4. The selected provisioning package will install and apply to the device.
+4. The selected provisioning package will install and apply to the device.
- :::image type="content" source="../images/provisioning-oobe-installing.png" alt-text="Setting up your PC.":::
+ :::image type="content" source="../images/provisioning-oobe-installing.png" alt-text="Setting up your PC.":::
-5. Wait for the device to load and begin applying the provisioning package. Once you see "You can remove your removable media now!" you can remove your USB drive. Windows will continue provisioning the device.
+5. Wait for the device to load and begin applying the provisioning package. Once you see "You can remove your removable media now!" you can remove your USB drive. Windows will continue provisioning the device.
-## After initial setup
+## After initial setup
-Provisioning packages can be applied after initial setup through Windows settings or by simply double-clicking a provisioning package.
+Provisioning packages can be applied after initial setup through Windows settings or by simply double-clicking a provisioning package.
-### Windows Settings
+### Windows Settings
-1. Insert the USB drive, then navigate to **Settings** > **Accounts** > [**Access work or school**](ms-settings:workplace) > **Add or remove a provisioning package** > **Add a package**.
+1. Insert the USB drive, then navigate to **Settings** > **Accounts** > [**Access work or school**](ms-settings:workplace) > **Add or remove a provisioning package** > **Add a package**.
- :::image type="content" source="../images/provisioning-runtime-manage-packages.png" alt-text="Add or remove a provisioning package.":::
+ :::image type="content" source="../images/provisioning-runtime-manage-packages.png" alt-text="Add or remove a provisioning package.":::
-2. Choose the method you want to use, such as **Removable Media**.
+2. Choose the method you want to use, such as **Removable Media**.
- :::image type="content" source="../images/provisioning-runtime-choose-package.png" alt-text="Choose a method.":::
+ :::image type="content" source="../images/provisioning-runtime-choose-package.png" alt-text="Choose a method.":::
-3. Select the provisioning package (`.ppkg`) that you want to apply, and select **Add**.
+3. Select the provisioning package (`.ppkg`) that you want to apply, and select **Add**.
- :::image type="content" source="../images/provisioning-runtime-add-package.png" alt-text="Select and add a package.":::
+ :::image type="content" source="../images/provisioning-runtime-add-package.png" alt-text="Select and add a package.":::
-4. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you are installing before accepting the UAC prompt. Select **Yes**.
+4. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you are installing before accepting the UAC prompt. Select **Yes**.
- :::image type="content" source="../images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?":::
+ :::image type="content" source="../images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?":::
-5. The provisioning runtime will ask if the package is from a source you trust. Verify that you are applying the correct package and that it is trusted. Select **Yes, add it**.
+5. The provisioning runtime will ask if the package is from a source you trust. Verify that you are applying the correct package and that it is trusted. Select **Yes, add it**.
- :::image type="content" source="../images/provisioning-runtime-trust.png" alt-text="Do you trust this package?":::
+ :::image type="content" source="../images/provisioning-runtime-trust.png" alt-text="Do you trust this package?":::
-### Apply Directly
+### Apply Directly
-To apply a provisioning package directly, such as from a USB drive, folder, network, or SharePoint site:
+To apply a provisioning package directly, such as from a USB drive, folder, network, or SharePoint site:
-1. Navigate to the provisioning package and double-click it to begin the installation.
+1. Navigate to the provisioning package and double-click it to begin the installation.
- :::image type="content" source="../images/provisioning-runtime-click-to-install.png" alt-text="Double-click package to being installation.":::
+ :::image type="content" source="../images/provisioning-runtime-click-to-install.png" alt-text="Double-click package to being installation.":::
-2. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you are installing before accepting the UAC prompt. Select **Yes**.
+2. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you are installing before accepting the UAC prompt. Select **Yes**.
- :::image type="content" source="../images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?":::
+ :::image type="content" source="../images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?":::
-3. The provisioning runtime will ask if the package is from a source you trust. Verify that you are applying the correct package and that it is trusted. Select **Yes, add it**.
+3. The provisioning runtime will ask if the package is from a source you trust. Verify that you are applying the correct package and that it is trusted. Select **Yes, add it**.
- :::image type="content" source="../images/provisioning-runtime-trust.png" alt-text="Do you trust this package?":::
+ :::image type="content" source="../images/provisioning-runtime-trust.png" alt-text="Do you trust this package?":::
-## Related articles
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-command-line.md b/windows/configuration/provisioning-packages/provisioning-command-line.md
index 05e6a1da83..98aff52052 100644
--- a/windows/configuration/provisioning-packages/provisioning-command-line.md
+++ b/windows/configuration/provisioning-packages/provisioning-command-line.md
@@ -1,42 +1,38 @@
---
title: Windows Configuration Designer command-line interface (Windows 10/11)
description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command-line interface for Windows10/11 client devices.
-ms.prod: windows-client
-author: lizgt2000
-ms.author: lizlong
-ms.topic: article
-ms.localizationpriority: medium
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# Windows Configuration Designer command-line interface (reference)
+# Windows Configuration Designer command-line interface (reference)
-**Applies to**
+**Applies to**
- Windows 10
-- Windows 11
+- Windows 11
-You can use the Windows Configuration Designer command-line interface (CLI) to automate the building of provisioning packages.
+You can use the Windows Configuration Designer command-line interface (CLI) to automate the building of provisioning packages.
-- IT pros can use the Windows Configuration Designer CLI to require less retooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges.
+- IT pros can use the Windows Configuration Designer CLI to require less retooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges.
-- You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
+- You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
+
-
-## Syntax
+## Syntax
``` cmd
icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath:
+
[/StoreFile:] [/MSPackageRoot:] [/OEMInputXML:]
[/ProductName:] [/Variables::] [[+|-]Encrypted] [[+|-]Overwrite] [/?]
-```
+```
-## Switches and arguments
+## Switches and arguments
| Switch | Required? | Arguments |
| --- | --- | --- |
@@ -48,7 +44,8 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath:
| Overwrite | No | Denotes whether to overwrite an existing provisioning package.Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). |
| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
-## Related articles
+
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
@@ -60,4 +57,5 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath:
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
-
+
+
diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md
index 62d2d239ae..cb8967800a 100644
--- a/windows/configuration/provisioning-packages/provisioning-create-package.md
+++ b/windows/configuration/provisioning-packages/provisioning-create-package.md
@@ -1,62 +1,58 @@
---
title: Create a provisioning package (Windows 10/11)
description: Learn how to create a provisioning package for Windows 10/11, which lets you quickly configure a device without having to install a new image.
-ms.prod: windows-client
-author: lizgt2000
-ms.author: lizlong
-ms.topic: article
-ms.localizationpriority: medium
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# Create a provisioning package
+# Create a provisioning package
-**Applies to**
+**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
-You can use Windows Configuration Designer to create a provisioning package (`.ppkg`) that contains customization settings, and then apply the provisioning package to a device running Windows client.
+You can use Windows Configuration Designer to create a provisioning package (`.ppkg`) that contains customization settings, and then apply the provisioning package to a device running Windows client.
->[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md)
+>[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md)
> [!TIP]
-> We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain.
+> We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain.
-## Start a new project
+## Start a new project
-1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut.
+1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut.
-2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image:
+2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image:
- 
+ 
- - The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices:
+ - The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices:
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard)
- [Instructions for HoloLens wizard](/hololens/hololens-provisioning)
- - [Instructions for Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub)
+ - [Instructions for Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub)
Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards).
- >[!NOTE]
- >To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems.
- - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.)
+ >[!NOTE]
+ >To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems.
+
+ - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.)
>[!TIP]
> You can start a project in the simple wizard editor and then switch the project to the advanced editor.
>
- > 
+ > 
-3. Enter a name for your project, and then select **Next**.
+3. Enter a name for your project, and then select **Next**.
-4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options.
+4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options.
| Windows edition | Settings available for customization | Provisioning package can apply to |
@@ -65,94 +61,96 @@ You can use Windows Configuration Designer to create a provisioning package (`.p
| All Windows desktop editions | Common settings and settings specific to desktop devices | All Windows client desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education) |
| Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices |
| Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic | [Microsoft HoloLens](/hololens/hololens-provisioning) |
- | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](/surface-hub/provisioning-packages-for-surface-hub) |
+ | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](/surface-hub/provisioning-packages-for-surface-hub) |
-5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**.
+5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**.
>[!TIP]
- >**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that includes the settings for your organization's network. Then, import that package into other packages that you create so you don't have to reconfigure those common settings repeatedly.
+ >**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that includes the settings for your organization's network. Then, import that package into other packages that you create so you don't have to reconfigure those common settings repeatedly.
-6. In the **Available customizations** pane, you can now configure settings for the package.
+6. In the **Available customizations** pane, you can now configure settings for the package.
-## Configure settings
+## Configure settings
-For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings.
+For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings.
-
+
-The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md).
+The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md).
-The process for configuring settings is similar for all settings. The following table shows an example.
+The process for configuring settings is similar for all settings. The following table shows an example.
-1. Expand a category:
+1. Expand a category:
- :::image type="content" source="../images/icd-step1.png" alt-text="In Windows Configuration Designer, expand the Certificates category.":::
+ :::image type="content" source="../images/icd-step1.png" alt-text="In Windows Configuration Designer, expand the Certificates category.":::
-2. Select a setting:
+2. Select a setting:
- :::image type="content" source="../images/icd-step2.png" alt-text="In Windows Configuration Designer, select ClientCertificates.":::
+ :::image type="content" source="../images/icd-step2.png" alt-text="In Windows Configuration Designer, select ClientCertificates.":::
-3. Enter a value for the setting. Select **Add** if the button is displayed:
+3. Enter a value for the setting. Select **Add** if the button is displayed:
- :::image type="content" source="../images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate.":::
+ :::image type="content" source="../images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate.":::
-4. Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and more settings are displayed:
+4. Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and more settings are displayed:
- :::image type="content" source="../images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available.":::
+ :::image type="content" source="../images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available.":::
-5. When the setting is configured, it is displayed in the **Selected customizations** pane:
+5. When the setting is configured, it is displayed in the **Selected customizations** pane:
- :::image type="content" source="../images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings.":::
+ :::image type="content" source="../images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings.":::
-For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference article for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image.
+For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference article for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image.
-
+
- ## Build package
+ ## Build package
-1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**.
+1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**.
- 
+ 
2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**:
- **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field.
- **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field.
- - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages).
- - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0.
-3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional:
+ - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages).
+ - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0.
+
+3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional:
- **Encrypt package** - If you select this option, an autogenerated password will be shown on the screen.
- - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package.
+ - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package.
>[!NOTE]
>You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device.
+
>
- >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner.
+ >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner.
-4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location.
+4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location.
-5. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
+5. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
- If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page.
+ If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page.
-6. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
+6. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
- If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
+ If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build.
+ If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build.
-7. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page.
+7. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page.
-**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
+**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
-## Learn more
+## Learn more
-- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Configuration Manager](/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm)
+- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Configuration Manager](/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm)
-## Related articles
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md
index 4f93bfc292..89e2bc9fab 100644
--- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md
+++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md
@@ -1,121 +1,117 @@
---
title: How provisioning works in Windows 10/11
description: Learn more about how provisioning package work on Windows client devices. A provisioning package (.ppkg) is a container for a collection of configuration settings.
-ms.prod: windows-client
-author: lizgt2000
-ms.author: lizlong
-ms.topic: article
-ms.localizationpriority: medium
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# How provisioning works in Windows
+# How provisioning works in Windows
-**Applies to**
+**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
-Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from Microsoft Store.
+Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from Microsoft Store.
-## Provisioning packages
+## Provisioning packages
-A provisioning package contains specific configurations/settings and assets that can be provided through a removable media or downloaded to the device.
+A provisioning package contains specific configurations/settings and assets that can be provided through a removable media or downloaded to the device.
-To enable adding multiple sets of settings or configurations, the configuration data used by the provisioning engine is built out of multiple configuration sources that consist of separate provisioning packages. Each provisioning package contains the provisioning data from a different source.
+To enable adding multiple sets of settings or configurations, the configuration data used by the provisioning engine is built out of multiple configuration sources that consist of separate provisioning packages. Each provisioning package contains the provisioning data from a different source.
-A provisioning package (.ppkg) is a container for a collection of configuration settings. The package has the following format:
+A provisioning package (.ppkg) is a container for a collection of configuration settings. The package has the following format:
-- Package metadata – The metadata contains basic information about the package such as package name, description, version, ranking, and so on.
+- Package metadata - The metadata contains basic information about the package such as package name, description, version, ranking, and so on.
-- XML descriptors – Each descriptor defines a customization asset or configuration setting included in the package.
+- XML descriptors - Each descriptor defines a customization asset or configuration setting included in the package.
-- Asset payloads – The payloads of a customization asset or a configuration setting associated with an app or data asset.
+- Asset payloads - The payloads of a customization asset or a configuration setting associated with an app or data asset.
-You can use provisioning packages for runtime device provisioning by accessing the package on a removable media attached to the device, through near field communication (NFC), or by downloading from a remote source location.
+You can use provisioning packages for runtime device provisioning by accessing the package on a removable media attached to the device, through near field communication (NFC), or by downloading from a remote source location.
-## Precedence for provisioning packages
+## Precedence for provisioning packages
-When multiple provisioning packages are available for device provisioning, the combination of package owner type and package rank level defined in the package manifest is used to resolve setting conflicts. The pre-defined package owner types are listed below in the order of lowest to highest owner type precedence:
+When multiple provisioning packages are available for device provisioning, the combination of package owner type and package rank level defined in the package manifest is used to resolve setting conflicts. The pre-defined package owner types are listed below in the order of lowest to highest owner type precedence:
-1. Microsoft
+1. Microsoft
-2. Silicon Vendor
+2. Silicon Vendor
-3. OEM
+3. OEM
-4. System Integrator
+4. System Integrator
-5. Mobile Operator
+5. Mobile Operator
-6. IT Admin
+6. IT Admin
-The valid value range of package rank level is 0 to 99.
+The valid value range of package rank level is 0 to 99.
-When setting conflicts are encountered, the final values provisioned on the device are determined by the owner type precedence and the rank level of the packages containing the settings. For packages with the same owner type, the package rank level determines the package from which the setting values get provisioned on the device.
+When setting conflicts are encountered, the final values provisioned on the device are determined by the owner type precedence and the rank level of the packages containing the settings. For packages with the same owner type, the package rank level determines the package from which the setting values get provisioned on the device.
-## Windows provisioning XML
+## Windows provisioning XML
-Windows provisioning XML is the framework that allows Microsoft and OEM components to declare end-user configurable settings and the on-device infrastructure for applying the settings with minimal work by the component owner.
+Windows provisioning XML is the framework that allows Microsoft and OEM components to declare end-user configurable settings and the on-device infrastructure for applying the settings with minimal work by the component owner.
-Settings for each component can be declared within that component's package manifest file. These declarations are turned into settings schema that are used by Windows Configuration Designer to expose the potential settings to users to create customizations in the image or in provisioning packages. Windows Configuration Designer translates the user configuration, which is declared through Windows provisioning answer file(s), into the on-device provisioning format.
+Settings for each component can be declared within that component's package manifest file. These declarations are turned into settings schema that are used by Windows Configuration Designer to expose the potential settings to users to create customizations in the image or in provisioning packages. Windows Configuration Designer translates the user configuration, which is declared through Windows provisioning answer file(s), into the on-device provisioning format.
-When the provisioning engine selects a configuration, the Windows provisioning XML is contained within the selected provisioning data and is passed through the configuration manager and then to the [Windows provisioning CSP](/windows/client-management/mdm/provisioning-csp). The Windows provisioning CSP then takes and applies the provisioning to the proper location for the actual component to use.
+When the provisioning engine selects a configuration, the Windows provisioning XML is contained within the selected provisioning data and is passed through the configuration manager and then to the [Windows provisioning CSP](/windows/client-management/mdm/provisioning-csp). The Windows provisioning CSP then takes and applies the provisioning to the proper location for the actual component to use.
-## Provisioning engine
+## Provisioning engine
-The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10/11.
+The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10/11.
-The provisioning engine provides the following functionality:
+The provisioning engine provides the following functionality:
- Provisioning configuration at any time when the device is running including first boot and setup or OOBE. It is also extensible to other points during the run-time of the device.
- Reading and combining settings from multiple sources of configuration that may be added to an image by Microsoft, the OEM, or system integrator, or added by IT/education administrators or users to the device at run-time. Configuration sources may be built into the image or from provisioning packages added to the device.
- Responding to triggers or events and initiating a provisioning stage.
- Authenticating the provisioning packages.
- Selecting a set of configuration based on the stage and a set of keys—such as the SIM, MCC/MNC, IMSI range, and so on—that map to a specific configuration then passing this configuration to the configuration management infrastructure to be applied.
-- Working with OOBE and the control panel UI to allow user selection of configuration when a specific match cannot be determined.
+- Working with OOBE and the control panel UI to allow user selection of configuration when a specific match cannot be determined.
-## Configuration manager
+## Configuration manager
-The configuration manager provides the unified way of managing Windows 10/11 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings.
+The configuration manager provides the unified way of managing Windows 10/11 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings.
-The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied.
+The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied.
-Underneath the configuration manager are the CSPs. Each section of configuration translates to a particular CSP to handle interpreting into an action on the device. Each CSP translates the instructions in the configuration and calls into the appropriate APIs and components to perform the requested provisioning actions.
+Underneath the configuration manager are the CSPs. Each section of configuration translates to a particular CSP to handle interpreting into an action on the device. Each CSP translates the instructions in the configuration and calls into the appropriate APIs and components to perform the requested provisioning actions.
-## Policy and resource manager
+## Policy and resource manager
-The policy, resource, and context manager components manage the enrollment and unenrollment of devices into enterprise environments. The enrollment process into an enterprise is essentially the provisioning of configuration and device management policies that the enterprise wants to enforce on the device. This is usually done through the explicit signing up of the device to an enterprise's device management server over a network connection. This provides the user with the ability to access the enterprise's resources through the device and the enterprise with a means to manage and control access and manage and control the device itself.
+The policy, resource, and context manager components manage the enrollment and unenrollment of devices into enterprise environments. The enrollment process into an enterprise is essentially the provisioning of configuration and device management policies that the enterprise wants to enforce on the device. This is usually done through the explicit signing up of the device to an enterprise's device management server over a network connection. This provides the user with the ability to access the enterprise's resources through the device and the enterprise with a means to manage and control access and manage and control the device itself.
The key differences between enterprise enrollment and the configuration performed by the provisioning engine are:
+
- Enrollment enforces a limited and controlled set of policies on the device that the user may not have full control over. The provisioning engine exposes a larger set of settings that configure more aspects of the device and are generally user adjustable.
- The policy manager manages policy settings from multiple entities and performs a selection of the setting based on priority of the entities. The provisioning engine applies the settings and does not offer a means of prioritizing settings from different sources. The more specific provisioning is the last one applied and the one that is used.
-- Individual policy settings applied from different enrollment entities are stored so they can be removed later during unenrollment. This enables the user to remove enterprise policy and return the device to a state without the enterprise restrictions and any sensitive data. The provisioning engine does not maintain individual provisioning settings or a means to roll back all applied settings.
+- Individual policy settings applied from different enrollment entities are stored so they can be removed later during unenrollment. This enables the user to remove enterprise policy and return the device to a state without the enterprise restrictions and any sensitive data. The provisioning engine does not maintain individual provisioning settings or a means to roll back all applied settings.
-In Windows 10, the application of policy and enrollment through provisioning is required to support cases where an enterprise or educational institution does not have a DM server for full device management. The provisioning engine supports provisioning enrollment and policy through its configuration and integrates with the existing policy and resource manager components directly or through the configuration manager.
+In Windows 10, the application of policy and enrollment through provisioning is required to support cases where an enterprise or educational institution does not have a DM server for full device management. The provisioning engine supports provisioning enrollment and policy through its configuration and integrates with the existing policy and resource manager components directly or through the configuration manager.
-## Triggers and stages
+## Triggers and stages
-Triggers are events during the lifetime of the system that start a provisioning stage. Some examples of triggers are: boot, OOBE, SIM change, user added, administrator added, user login, device update, and various manual triggers (such as deployment over USB or launched from an email attachment or USB flash drive).
+Triggers are events during the lifetime of the system that start a provisioning stage. Some examples of triggers are: boot, OOBE, SIM change, user added, administrator added, user login, device update, and various manual triggers (such as deployment over USB or launched from an email attachment or USB flash drive).
When a trigger occurs, provisioning is initiated for a particular provisioning stage. The stages are grouped into sets based on the scope of the settings:
- **Static**: First stage run for provisioning to apply configuration settings to the system to set up OOBE or apply device-wide settings that cannot be done when the image is being created.
- **System**: Run during OOBE and configure system-wide settings.
- **UICC**: UICC stages run for each new UICC in a device to handle configuration and branding based on the identity of the UICC or SIM card. This enables the runtime configuration scenarios where an OEM can maintain one image that can be configured for multiple operators.
- **Update**: Runs after an update to apply potential updated settings changes.
-- **User**: runs during a user account first run to configure per-user settings.
+- **User**: runs during a user account first run to configure per-user settings.
-## Device provisioning during OOBE
+## Device provisioning during OOBE
-The provisioning engine always applies provisioning packages persisted in the `C:\Recovery\Customizations` folder on the OS partition. When the provisioning engine applies provisioning packages in the `%ProgramData%\Microsoft\Provisioning` folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect.
+The provisioning engine always applies provisioning packages persisted in the `C:\Recovery\Customizations` folder on the OS partition. When the provisioning engine applies provisioning packages in the `%ProgramData%\Microsoft\Provisioning` folder, certain runtime setting applications, such as the setting to install and configure Windows apps, may be extended past the OOBE pass and continually be processed in the background when the device gets to the desktop. Settings for configuring policies and certain crucial system configurations are always be completed before the first point at which they must take effect.
-Device users can apply a provisioning package from a remote source when the device first boots to OOBE. The device provisioning during OOBE is only triggered after the language, locale, time zone, and other settings on the first OOBE UI page are configured. When device provisioning is triggered, the provisioning UI is displayed in the OOBE page. The provisioning UI allows users to select a provisioning package acquired from a remote source, such as through NFC or a removable media.
+Device users can apply a provisioning package from a remote source when the device first boots to OOBE. The device provisioning during OOBE is only triggered after the language, locale, time zone, and other settings on the first OOBE UI page are configured. When device provisioning is triggered, the provisioning UI is displayed in the OOBE page. The provisioning UI allows users to select a provisioning package acquired from a remote source, such as through NFC or a removable media.
-The following table shows how device provisioning can be initiated when a user first boots to OOBE.
+The following table shows how device provisioning can be initiated when a user first boots to OOBE.
| Package delivery | Initiation method | Supported device |
@@ -123,27 +119,28 @@ The following table shows how device provisioning can be initiated when a user f
| Removable media - USB drive or SD card (Packages must be placed at media root) | Five fast taps on the Windows key to launch the provisioning UI |All Windows devices |
| From an administrator device through machine-to-machine NFC or NFC tag(The administrator device must run an app that can transfer the package over NFC) | Five fast taps on the Windows key to launch the provisioning UI | Windows IoT Core devices |
-The provisioning engine always copies the acquired provisioning packages to the `%ProgramData%\Microsoft\Provisioning` folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device.
-When the provisioning engine applies provisioning packages during OOBE, it applies only the runtime settings from the package to the device. Runtime settings can be system-wide configuration settings, including security policy, Windows app install/uninstall, network configuration, bootstrapping MDM enrollment, provisioning of file assets, account and domain configuration, Windows edition upgrade, and more. The provisioning engine also checks for the configuration settings on the device, such as region/locale or SIM card, and applies the multivariant settings with matching condition(s).
+The provisioning engine always copies the acquired provisioning packages to the `%ProgramData%\Microsoft\Provisioning` folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device.
-## Device provisioning at runtime
+When the provisioning engine applies provisioning packages during OOBE, it applies only the runtime settings from the package to the device. Runtime settings can be system-wide configuration settings, including security policy, Windows app install/uninstall, network configuration, bootstrapping MDM enrollment, provisioning of file assets, account and domain configuration, Windows edition upgrade, and more. The provisioning engine also checks for the configuration settings on the device, such as region/locale or SIM card, and applies the multivariant settings with matching condition(s).
-At device runtime, stand-alone provisioning packages can be applied by user initiation. The following table shows when provisioning at device runtime can be initiated.
+## Device provisioning at runtime
+
+At device runtime, stand-alone provisioning packages can be applied by user initiation. The following table shows when provisioning at device runtime can be initiated.
| Package delivery | Initiation method | Supported device |
| --- | --- | --- |
| Removable media - USB drive or SD card(Packages must be placed at media root) | **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** | All Windows devices |
| Downloaded from a network connection and copied to a local folder | Double-click the package file | Windows client for desktop editions devices |
-| From an administrator device connected to the target device through USB tethering | Drag and drop the package file onto the target device | Windows IoT Core devices |
+| From an administrator device connected to the target device through USB tethering | Drag and drop the package file onto the target device | Windows IoT Core devices |
-When applying provisioning packages from a removable media attached to the device, the Settings UI allows viewing contents of a package before selecting the package for provisioning. To minimize the risk of the device being spammed by applying provisioning packages from unknown sources, a provisioning package can be signed and encrypted. Partners can also set policies to limit the application of provisioning packages at device runtime. Applying provisioning packages at device runtime requires administrator privilege. If the package is not signed or trusted, a user must provide consent before the package is applied to the device. If the package is encrypted, a valid password is needed to decrypt the package before it can be applied to the device.
+When applying provisioning packages from a removable media attached to the device, the Settings UI allows viewing contents of a package before selecting the package for provisioning. To minimize the risk of the device being spammed by applying provisioning packages from unknown sources, a provisioning package can be signed and encrypted. Partners can also set policies to limit the application of provisioning packages at device runtime. Applying provisioning packages at device runtime requires administrator privilege. If the package is not signed or trusted, a user must provide consent before the package is applied to the device. If the package is encrypted, a valid password is needed to decrypt the package before it can be applied to the device.
-When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device.
+When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device.
-After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**.
+After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**.
-## Related articles
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md
index 2f6782646c..c5318fcbc6 100644
--- a/windows/configuration/provisioning-packages/provisioning-install-icd.md
+++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md
@@ -1,83 +1,82 @@
---
title: Install Windows Configuration Designer
description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11.
-author: lizgt2000
-ms.author: lizlong
ms.topic: article
ms.reviewer: kevinsheehan
ms.date: 12/31/2017
----
+---
-# Install Windows Configuration Designer, and learn about any limitations
+# Install Windows Configuration Designer, and learn about any limitations
-**Applies to**
+**Applies to**
- Windows 10
-- Windows 11
+- Windows 11
-Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
+Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
-## Supported platforms
+## Supported platforms
-Windows Configuration Designer can create provisioning packages for Windows client desktop, including Windows IoT Core, Microsoft Surface Hub, and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems:
+Windows Configuration Designer can create provisioning packages for Windows client desktop, including Windows IoT Core, Microsoft Surface Hub, and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems:
-**Client OS**:
+**Client OS**:
- Windows 11
- Windows 10 - x86 and amd64
- Windows 8.1 Update - x86 and amd64
- Windows 8.1 - x86 and amd64
- Windows 8 - x86 and amd64
-- Windows 7 - x86 and amd64
+- Windows 7 - x86 and amd64
-**Server OS**:
+**Server OS**:
- Windows Server 2016
- Windows Server 2012 R2 Update
- Windows Server 2012 R2
- Windows Server 2012
-- Windows Server 2008 R2
+- Windows Server 2008 R2
>[!WARNING]
->You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards.
+>You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards.
-## Install Windows Configuration Designer
+## Install Windows Configuration Designer
-On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store.
+On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store.
-## Current Windows Configuration Designer limitations
+## Current Windows Configuration Designer limitations
- When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-).
-- Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step will display oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons won't be displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled.
-- You can only run one instance of Windows Configuration Designer on your computer at a time.
+- Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step will display oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons won't be displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled.
-- When adding apps and drivers, all files stored in the same folder are imported, and may cause errors during the build process.
+- You can only run one instance of Windows Configuration Designer on your computer at a time.
-- The Windows Configuration Designer UI doesn't support multivariant configurations. Instead, you must use the Windows Configuration Designer command-line interface to configure multivariant settings. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
+- When adding apps and drivers, all files stored in the same folder are imported, and may cause errors during the build process.
-- In Windows Configuration Designer, you can only build one project at a time. You can open multiple projects at the same time, but you can only build one at a time.
+- The Windows Configuration Designer UI doesn't support multivariant configurations. Instead, you must use the Windows Configuration Designer command-line interface to configure multivariant settings. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
-- To enable the simplified authoring jscripts to work on a server SKU running Windows Configuration Designer, you must enable **Allow websites to prompt for information using scripted windows**:
+- In Windows Configuration Designer, you can only build one project at a time. You can open multiple projects at the same time, but you can only build one at a time.
+
+- To enable the simplified authoring jscripts to work on a server SKU running Windows Configuration Designer, you must enable **Allow websites to prompt for information using scripted windows**:
1. Open Internet Explorer.
2. Go to **Settings** > **Internet Options** > **Security** > **Custom level**.
- 3. Select **Allow websites to prompt for information using scripted windows** > **Enable**.
+ 3. Select **Allow websites to prompt for information using scripted windows** > **Enable**.
-- If you copy a Windows Configuration Designer project from one PC to another PC, then:
+- If you copy a Windows Configuration Designer project from one PC to another PC, then:
- Copy all the associated files for the deployment assets with the project, including apps and drivers.
- - Copy all the files to the same path as the original PC.
+ - Copy all the files to the same path as the original PC.
- For example, when you add a driver to a provisioned package, you must copy the `.INF` file to a local directory on the PC that's running Windows Configuration Designer. If you don't copy the `.INF` file, and use a copied version of this project on a different PC, then Windows Configuration Designer might resolve the file paths to the original PC.
+ For example, when you add a driver to a provisioned package, you must copy the `.INF` file to a local directory on the PC that's running Windows Configuration Designer. If you don't copy the `.INF` file, and use a copied version of this project on a different PC, then Windows Configuration Designer might resolve the file paths to the original PC.
-- **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer. Don't use external sources, like network shares or removable drives. Using local files reduces the risk of interrupting the build process from a network issue, or from disconnecting the USB device.
+- **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer. Don't use external sources, like network shares or removable drives. Using local files reduces the risk of interrupting the build process from a network issue, or from disconnecting the USB device.
-**Next step**: [How to create a provisioning package](provisioning-create-package.md)
+**Next step**: [How to create a provisioning package](provisioning-create-package.md)
-## Related articles
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md
index f6bda1fbba..79cf698297 100644
--- a/windows/configuration/provisioning-packages/provisioning-multivariant.md
+++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md
@@ -1,54 +1,49 @@
---
title: Create a provisioning package with multivariant settings (Windows 10/11)
description: Create a provisioning package with multivariant settings to customize the provisioned settings for defined conditions.
-ms.prod: windows-client
-author: lizgt2000
-ms.topic: article
-ms.localizationpriority: medium
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.author: lizlong
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# Create a provisioning package with multivariant settings
+# Create a provisioning package with multivariant settings
-**Applies to**
+**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
-In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese.
+In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese.
-To provision multivariant settings, you use Windows Configuration Designer to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices.
+To provision multivariant settings, you use Windows Configuration Designer to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices.
-Let's begin by learning how to define a **Target**.
+Let's begin by learning how to define a **Target**.
-## Define a target
+## Define a target
-In the XML file, you provide an **Id**, or friendly name, for each **Target**. Each **Target** is defined by at least one **TargetState** which contains at least one **Condition**. A **Condition** element defines the matching type between the condition and the specified value.
+In the XML file, you provide an **Id**, or friendly name, for each **Target**. Each **Target** is defined by at least one **TargetState** which contains at least one **Condition**. A **Condition** element defines the matching type between the condition and the specified value.
-A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**.
+A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**.
-
+
-The following information describes the logic for the target definition:
+The following information describes the logic for the target definition:
-- When all **Condition** elements are TRUE, **TargetState** is TRUE:
+- When all **Condition** elements are TRUE, **TargetState** is TRUE:
- :::image type="content" source="../images/icd-multi-targetstate-true.png" alt-text="Target state is true when all conditions are true.":::
+ :::image type="content" source="../images/icd-multi-targetstate-true.png" alt-text="Target state is true when all conditions are true.":::
-- If any of the **TargetState** elements is TRUE, **Target** is TRUE, and the **ID** can be used for setting customizations:
+- If any of the **TargetState** elements is TRUE, **Target** is TRUE, and the **ID** can be used for setting customizations:
- :::image type="content" source="../images/icd-multi-target-true.png" alt-text="Target is true if any target state is true":::
+ :::image type="content" source="../images/icd-multi-target-true.png" alt-text="Target is true if any target state is true":::
-### Conditions
+### Conditions
-The following table shows the conditions supported in Windows client provisioning for a **TargetState**:
+The following table shows the conditions supported in Windows client provisioning for a **TargetState**:
| Condition Name | Condition priority | Windows client for desktop editions | Value type | Value description |
@@ -60,6 +55,7 @@ The following table shows the conditions supported in Windows client provisionin
| GID1 | P0 | Supported | Digit string | Use to target settings based on the Group Identifier (level 1) value. |
| ICCID | P0 | Supported | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. |
| Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). |
+
| UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of the following:- 0 - Empty- 1 - Ready- 2 - Locked |
| UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:- 0 - Slot 0- 1 - Slot 1 |
| ProcessorType | P1 | Supported | String | Use to target settings based on the processor type. |
@@ -70,56 +66,56 @@ The following table shows the conditions supported in Windows client provisionin
| Architecture | P1 | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. |
| Server | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. |
| Region | P1 | Supported | Enumeration | Use to target settings based on country/region, using the 2-digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). |
-| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). |
+| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). |
-The matching types supported in Windows client are:
+The matching types supported in Windows client are:
| Matching type | Syntax | Example |
| --- | --- | --- |
| Straight match | Matching type is specified as-is | <Condition Name="ProcessorName" Value="Barton" /> |
| Regular expression (Regex) match | Matching type is prefixed by "Pattern:" | <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> |
| Numeric range match | Matching type is prefixed by "!Range:" | <Condition Name="MNC" Value="!Range:400, 550" /> |
+
+
+### TargetState priorities
+
+You can define more than one **TargetState** within a provisioning package to apply settings to devices that match device conditions. When the provisioning engine evaluates each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the settings are applied, the system assigns a priority to every **TargetState**.
+
+A setting that matches a **TargetState** with a lower priority is applied before the setting that matches a **TargetState** with a higher priority. This means that a setting for the **TargetState** with the higher priority can overwrite a setting for the **TargetState** with the lower priority.
+
+Settings that match more than one **TargetState** with equal priority are applied according to the order that each **TargetState** is defined in the provisioning package.
+
+The **TargetState** priority is assigned based on the condition's priority (see the [Conditions table](#conditions) for priorities). The priority evaluation rules are as followed:
+
+1. A **TargetState** with P0 conditions is higher than a **TargetState** without P0 conditions.
+
+2. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions.
+
+2. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched.
+
+2. If the number of P0 conditions matched are equivalent, then the **TargetState** with the most matched P1 conditions has higher priority.
+
+3. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority.
+
-### TargetState priorities
+## Create a provisioning package with multivariant settings
-You can define more than one **TargetState** within a provisioning package to apply settings to devices that match device conditions. When the provisioning engine evaluates each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the settings are applied, the system assigns a priority to every **TargetState**.
-
-A setting that matches a **TargetState** with a lower priority is applied before the setting that matches a **TargetState** with a higher priority. This means that a setting for the **TargetState** with the higher priority can overwrite a setting for the **TargetState** with the lower priority.
-
-Settings that match more than one **TargetState** with equal priority are applied according to the order that each **TargetState** is defined in the provisioning package.
-
-The **TargetState** priority is assigned based on the condition's priority (see the [Conditions table](#conditions) for priorities). The priority evaluation rules are as followed:
-
-1. A **TargetState** with P0 conditions is higher than a **TargetState** without P0 conditions.
-
-2. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions.
-
-2. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched.
-
-2. If the number of P0 conditions matched are equivalent, then the **TargetState** with the most matched P1 conditions has higher priority.
-
-3. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority.
+Follow these steps to create a provisioning package with multivariant capabilities.
+1. Build a provisioning package and configure the customizations you want to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md).
-## Create a provisioning package with multivariant settings
+2. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project.
-Follow these steps to create a provisioning package with multivariant capabilities.
+3. Open the project folder and copy the customizations.xml file to any local location.
+4. Use an XML or text editor to open the customizations.xml file.
-1. Build a provisioning package and configure the customizations you want to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md).
+ The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The **Customizations** node of the file contains a **Common** section, which contains the customization settings.
-2. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project.
-
-3. Open the project folder and copy the customizations.xml file to any local location.
-
-4. Use an XML or text editor to open the customizations.xml file.
-
- The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The **Customizations** node of the file contains a **Common** section, which contains the customization settings.
-
- The following example shows the contents of a sample customizations.xml file.
+ The following example shows the contents of a sample customizations.xml file.
```XML
@@ -146,12 +142,14 @@ Follow these steps to create a provisioning package with multivariant capabiliti
- ```
-5. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings.
+ ```
+
+5. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings.
The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
+
```XML
@@ -195,22 +193,24 @@ Follow these steps to create a provisioning package with multivariant capabiliti
- ```
-6. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this:
+ ```
+
+6. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this:
a. Define a child **TargetRefs** element.
- b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings.
- c. Move compliant settings from the **Common** section to the **Variant** section.
+ b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings.
- If any of the **TargetRef** elements matches the **Target**, all settings in the **Variant** are applied.
+ c. Move compliant settings from the **Common** section to the **Variant** section.
+
+ If any of the **TargetRef** elements matches the **Target**, all settings in the **Variant** are applied.
>[!NOTE]
- >You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event.
+ >You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event.
- The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met.
+ The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met.
```XML
@@ -263,35 +263,37 @@ Follow these steps to create a provisioning package with multivariant capabiliti
- ```
-7. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step.
+ ```
+
+7. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step.
-8. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml.
+8. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml.
- For example:
+ For example:
```
icd.exe /Build-ProvisioningPackage /CustomizationXML:"C:\CustomProject\customizations.xml" /PackagePath:"C:\CustomProject\output.ppkg" /StoreFile:C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\Microsoft-Common-Provisioning.dat"
```
-
+
-In this example, the **StoreFile** corresponds to the location of the settings store that will be used to create the package for the required Windows edition.
+In this example, the **StoreFile** corresponds to the location of the settings store that will be used to create the package for the required Windows edition.
>[!NOTE]
->The provisioning package created during this step will contain the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project.
+>The provisioning package created during this step will contain the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project.
-
+
-## Events that trigger provisioning
+## Events that trigger provisioning
-When you install the multivariant provisioning package on a Windows client device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
+When you install the multivariant provisioning package on a Windows client device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
-The following events trigger provisioning on Windows client devices:
+The following events trigger provisioning on Windows client devices:
| Event | Windows client for desktop editions |
| --- | --- |
+
| System boot | Supported |
| Operating system update | Planned |
| Package installation during device first run experience | Supported |
@@ -299,7 +301,8 @@ The following events trigger provisioning on Windows client devices:
| Package installation at runtime | Supported |
| Roaming detected | Not supported |
-## Related articles
+
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
@@ -310,5 +313,5 @@ The following events trigger provisioning on Windows client devices:
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
-- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
+- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md
index aed5ec0d4a..5e87c3d5d5 100644
--- a/windows/configuration/provisioning-packages/provisioning-packages.md
+++ b/windows/configuration/provisioning-packages/provisioning-packages.md
@@ -2,29 +2,28 @@
title: Provisioning packages overview
description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do.
ms.reviewer: kevinsheehan
-author: lizgt2000
-ms.author: lizlong
ms.topic: article
ms.date: 12/31/2017
----
+---
-# Provisioning packages for Windows
+# Provisioning packages for Windows
-**Applies to**
+**Applies to**
- Windows 10
-- Windows 11
+- Windows 11
-Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. When you use Windows provisioning, an IT administrator can easily specify the desired configuration and settings required to enroll the devices into management. Then, apply that configuration to target devices in a matter of minutes. It's best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
+Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. When you use Windows provisioning, an IT administrator can easily specify the desired configuration and settings required to enroll the devices into management. Then, apply that configuration to target devices in a matter of minutes. It's best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
-A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows client, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
+A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows client, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
-Provisioning packages are simple enough that with a short set of written instructions, a student, or non-technical employee can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization.
+Provisioning packages are simple enough that with a short set of written instructions, a student, or non-technical employee can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization.
-Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22).
-
+Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22).
+
+
@@ -32,35 +31,35 @@ Windows Configuration Designer is available as an [app in the Microsoft Store](h
-
+
-## Benefits of provisioning packages
+## Benefits of provisioning packages
-Provisioning packages let you:
+Provisioning packages let you:
-- Quickly configure a new device without going through the process of installing a new image.
+- Quickly configure a new device without going through the process of installing a new image.
-- Save time by configuring multiple devices using one provisioning package.
+- Save time by configuring multiple devices using one provisioning package.
-- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure.
+- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure.
-- Set up a device without the device having network connectivity.
+- Set up a device without the device having network connectivity.
-Provisioning packages can be:
+Provisioning packages can be:
-- Installed using removable media such as an SD card or USB flash drive.
+- Installed using removable media such as an SD card or USB flash drive.
-- Attached to an email.
+- Attached to an email.
-- Downloaded from a network share.
+- Downloaded from a network share.
-- Deployed in NFC tags or barcodes.
+- Deployed in NFC tags or barcodes.
-## What you can configure
+## What you can configure
-### Configuration Designer wizards
+### Configuration Designer wizards
-The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages.
+The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages.
| Step | Description | Desktop wizard | Kiosk wizard | HoloLens wizard |
| --- | --- | --- | --- | --- |
@@ -72,18 +71,18 @@ The following table describes settings that you can configure using the wizards
| Add certificates | Include a certificate file in the provisioning package. | ✔️ | ✔️ | ✔️ |
| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | ✔️ | ❌ |
| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✔️ | ❌ |
-| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✔️ |
+| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✔️ |
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard)
-- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard)
+- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard)
>[!NOTE]
->After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package.
+>After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package.
-### Configuration Designer advanced editor
+### Configuration Designer advanced editor
-The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages.
+The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages.
| Customization options | Examples |
|---|---|
@@ -95,38 +94,41 @@ The following table provides some examples of settings that you can configure us
| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings |
| Data assets | Documents, music, videos, pictures |
| Start menu customization | Start menu layout, application pinning |
-| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on |
+| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on |
-For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
+For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
-
+
-
+
-WCD, simplified common provisioning scenarios.
+WCD, simplified common provisioning scenarios.
-:::image type="content" source="../images/icd.png" alt-text="Configuration Designer options":::
+:::image type="content" source="../images/icd.png" alt-text="Configuration Designer options":::
-WCD supports the following scenarios for IT administrators:
+WCD supports the following scenarios for IT administrators:
-* **Simple provisioning** – Enables IT administrators to define a desired configuration in WCD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner.
+* **Simple provisioning** - Enables IT administrators to define a desired configuration in WCD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner.
- [Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md)
+ [Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md)
-* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices.
+* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** - Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices.
-* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows devices and enroll them into mobile device management (MDM) before handing them to end users in the organization. IT administrators can use WCD to specify the management endpoint and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include:
+* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows devices and enroll them into mobile device management (MDM) before handing them to end users in the organization. IT administrators can use WCD to specify the management endpoint and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include:
- Microsoft Intune (certificate-based enrollment)
+
- AirWatch (password-string based enrollment)
+
- MobileIron (password-string based enrollment)
- - Other MDMs (cert-based enrollment)
+
+ - Other MDMs (cert-based enrollment)
-
+
-## Related articles
+## Related articles
- [How provisioning works in Windows client](provisioning-how-it-works.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md
index 074f0168f1..12f901538f 100644
--- a/windows/configuration/provisioning-packages/provisioning-powershell.md
+++ b/windows/configuration/provisioning-packages/provisioning-powershell.md
@@ -1,93 +1,88 @@
---
title: PowerShell cmdlets for provisioning Windows 10/11 (Windows 10/11)
description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows10/11 client desktop devices.
-ms.prod: windows-client
-author: lizgt2000
-ms.author: lizlong
-ms.topic: article
-ms.localizationpriority: medium
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# PowerShell cmdlets for provisioning Windows client (reference)
+# PowerShell cmdlets for provisioning Windows client (reference)
-**Applies to**
+**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
-Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions.
+Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions.
-## cmdlets
+## cmdlets
-- **Add-ProvisioningPackage**: Applies a provisioning package.
+- **Add-ProvisioningPackage**: Applies a provisioning package.
- Syntax:
+ Syntax:
- - `Add-ProvisioningPackage [-Path] [-ForceInstall] [-LogsFolder ] [-QuietInstall] [-WprpFile ] []`
+ - `Add-ProvisioningPackage [-Path] [-ForceInstall] [-LogsFolder ] [-QuietInstall] [-WprpFile ] []`
-- **Remove-ProvisioningPackage**: Removes a provisioning package.
+- **Remove-ProvisioningPackage**: Removes a provisioning package.
- Syntax:
+ Syntax:
- `Remove-ProvisioningPackage -PackageId [-LogsFolder ] [-WprpFile ] []`
- `Remove-ProvisioningPackage -Path [-LogsFolder ] [-WprpFile ] []`
- - `Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []`
+ - `Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []`
-- **Get-ProvisioningPackage**: Gets information about an installed provisioning package.
+- **Get-ProvisioningPackage**: Gets information about an installed provisioning package.
- Syntax:
+ Syntax:
- `Get-ProvisioningPackage -PackageId [-LogsFolder ] [-WprpFile ] []`
- `Get-ProvisioningPackage -Path [-LogsFolder ] [-WprpFile ] []`
- - `Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []`
+ - `Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []`
-- **Export-ProvisioningPackage**: Extracts the contents of a provisioning package.
+- **Export-ProvisioningPackage**: Extracts the contents of a provisioning package.
- Syntax:
+ Syntax:
- `Export-ProvisioningPackage -PackageId -OutputFolder [-Overwrite] [-AnswerFileOnly] [-LogsFolder ] [-WprpFile ] []`
- - `Export-ProvisioningPackage -Path -OutputFolder [-Overwrite] [-AnswerFileOnly] [-LogsFolder ] [-WprpFile ] []`
+ - `Export-ProvisioningPackage -Path -OutputFolder [-Overwrite] [-AnswerFileOnly] [-LogsFolder ] [-WprpFile ] []`
-- **Install-TrustedProvisioningCertificate**: Adds a certificate to the Trusted Certificate store.
+- **Install-TrustedProvisioningCertificate**: Adds a certificate to the Trusted Certificate store.
- Syntax:
+ Syntax:
- - `Install-TrustedProvisioningCertificate `
+ - `Install-TrustedProvisioningCertificate `
-- **Get-TrustedProvisioningCertificate**: Lists all installed trusted provisioning certificates. Use this cmdlet to get the certificate thumbprint to use with the `Uninstall-TrustedProvisioningCertificate` cmdlet.
+- **Get-TrustedProvisioningCertificate**: Lists all installed trusted provisioning certificates. Use this cmdlet to get the certificate thumbprint to use with the `Uninstall-TrustedProvisioningCertificate` cmdlet.
- Syntax:
+ Syntax:
- - `Get-TrustedProvisioningCertificate`
+ - `Get-TrustedProvisioningCertificate`
-- **Uninstall-TrustedProvisioningCertificate**: Removes a previously installed provisioning certificate.
+- **Uninstall-TrustedProvisioningCertificate**: Removes a previously installed provisioning certificate.
- Syntax:
+ Syntax:
- - `Uninstall-TrustedProvisioningCertificate `
+ - `Uninstall-TrustedProvisioningCertificate `
>[!NOTE]
-> You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage`
+> You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage`
-Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes:
+Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes:
- ProvTrace.<timestamp>.ETL - ETL trace file, unfiltered
- ProvTrace.<timestamp>.XML - ETL trace file converted into raw trace events, unfiltered
- ProvTrace.<timestamp>.TXT - TEXT file containing trace output formatted for easy reading, filtered to only show events logged by providers in the WPRP file
-- ProvLogReport.<timestamp>.XLS - Excel file containing trace output, filtered to only show events logged by providers in WPRP file
-
+- ProvLogReport.<timestamp>.XLS - Excel file containing trace output, filtered to only show events logged by providers in WPRP file
+
>[!NOTE]
->When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts.
+>When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts.
-## Related articles
+## Related articles
- [How provisioning works in Windows client](provisioning-how-it-works.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
@@ -97,5 +92,5 @@ Trace logs are captured when using cmdlets. The following logs are available in
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
-- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
index e766825729..55921ffd19 100644
--- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
+++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
@@ -1,136 +1,155 @@
---
title: Use a script to install a desktop app in provisioning packages (Windows 10/11)
-description: With Windows 10/11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
-ms.prod: windows-client
-author: lizgt2000
-ms.author: lizlong
-ms.topic: article
-ms.localizationpriority: medium
+description: With Windows 10/11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# Use a script to install a desktop app in provisioning packages
+# Use a script to install a desktop app in provisioning packages
-**Applies to**
+**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
-This walkthrough describes how to include scripts in a Windows client provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed. However, some care is needed to avoid unintended behavior during script execution (see [Remarks](#remarks) below).
+This walkthrough describes how to include scripts in a Windows client provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed. However, some care is needed to avoid unintended behavior during script execution (see [Remarks](#remarks) below).
-## Assemble the application assets
+## Assemble the application assets
-1. On the device where you’re authoring the package, place all of your assets in a known location. Each asset must have a unique filename, because all files will be copied to the same temp directory on the device. It’s common for many apps to have an installer called ‘install.exe’ or similar, and there may be name overlap because of that. To fix this, you can use the technique described in the next step to include a complete directory structure that is then expanded into the temp directory on the device. The most common use for this would be to include a subdirectory for each application.
+1. On the device where you’re authoring the package, place all of your assets in a known location. Each asset must have a unique filename, because all files will be copied to the same temp directory on the device. It’s common for many apps to have an installer called ‘install.exe’ or similar, and there may be name overlap because of that. To fix this, you can use the technique described in the next step to include a complete directory structure that is then expanded into the temp directory on the device. The most common use for this would be to include a subdirectory for each application.
-2. If you need to include a directory structure of files, you will need to cab the assets for easy inclusion in the provisioning packages.
+2. If you need to include a directory structure of files, you will need to cab the assets for easy inclusion in the provisioning packages.
-## Cab the application assets
+## Cab the application assets
-1. Create a `.DDF` file as below, replacing *file1* and *file2* with the files you want to package, and adding the name of file/directory.
+1. Create a `.DDF` file as below, replacing *file1* and *file2* with the files you want to package, and adding the name of file/directory.
```ddf
;*** MSDN Sample Source Code MakeCAB Directive file example
+
;
+
.OPTION EXPLICIT ; Generate errors on variable typos
+
.set DiskDirectoryTemplate=CDROM ; All cabinets go in a single directory
+
.Set MaxDiskFileCount=1000; Limit file count per cabinet, so that
+
; scanning is not too slow
+
.Set FolderSizeThreshold=200000 ; Aim for ~200K per folder
+
.Set CompressionType=MSZIP
+
;** All files are compressed in cabinet files
+
.Set Cabinet=on
+
.Set Compress=on
+
;-------------------------------------------------------------------
+
;** CabinetNameTemplate = name of cab
+
;** DiskDirectory1 = output directory where cab will be created
+
;-------------------------------------------------------------------
+
.Set CabinetNameTemplate=tt.cab
+
.Set DiskDirectory1=.
+
;-------------------------------------------------------------------
+
; Replace with actual files you want to package
+
;-------------------------------------------------------------------
+
+
- ;***
- ```
-2. Use makecab to create the cab files.
+ ;***
+
+ ```
+
+2. Use makecab to create the cab files.
```makecab
Makecab -f
- ```
+ ```
-## Create the script to install the application
+## Create the script to install the application
-Create a script to perform whatever work is needed to install the application(s). The following examples are provided to help get started authoring the orchestrator script that will execute the required installers. In practice, the orchestrator script may reference many more assets than those in these examples.
+Create a script to perform whatever work is needed to install the application(s). The following examples are provided to help get started authoring the orchestrator script that will execute the required installers. In practice, the orchestrator script may reference many more assets than those in these examples.
-You don’t need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package).
+You don’t need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package).
>[!NOTE]
>All actions performed by the script must happen silently, showing no UI and requiring no user interaction.
>
->The scripts will be run on the device in system context.
+>The scripts will be run on the device in system context.
-### Debugging example
+### Debugging example
-Granular logging is not built in, so the logging must be built into the script itself. Here is an example script that logs ‘Hello World’ to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you will see in the following examples, it’s recommended that you log each action that your script performs.
+Granular logging is not built in, so the logging must be built into the script itself. Here is an example script that logs ‘Hello World’ to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you will see in the following examples, it’s recommended that you log each action that your script performs.
```log
set LOGFILE=%SystemDrive%\HelloWorld.log
echo Hello, World >> %LOGFILE%
-```
-### .exe example
+```
-This example script shows how to create a log output file on the system drive, install an app from an `.exe` installer, and echo the results to the log file.
+### .exe example
+
+This example script shows how to create a log output file on the system drive, install an app from an `.exe` installer, and echo the results to the log file.
```exe
set LOGFILE=%SystemDrive%\Fiddler_install.log
echo Installing Fiddler.exe >> %LOGFILE%
fiddler4setup.exe /S >> %LOGFILE%
echo result: %ERRORLEVEL% >> %LOGFILE%
-```
+```
-### .msi example
+### .msi example
-This is the same as the previous installer, but installs the app from an MSI installer. Notice that msiexec is called with the /quiet flag in order to meet the silent requirement of scripts run from within a provisioning package.
+This is the same as the previous installer, but installs the app from an MSI installer. Notice that msiexec is called with the /quiet flag in order to meet the silent requirement of scripts run from within a provisioning package.
```msi
set LOGFILE=%SystemDrive%\IPOverUsb_install.log
echo Installing IpOverUsbInstaller.msi >> %LOGFILE%
msiexec /i IpOverUsbInstaller.msi /quiet >> %LOGFILE%
echo result: %ERRORLEVEL% >> %LOGFILE%
-```
+```
-### PowerShell example
+### PowerShell example
-This is an example script with logging that shows how to run a PowerShell script from the provisioning commands setting. The PowerShell script referenced from this example must also be included in the package, and obey the same requirements as all scripts run from within the provisioning package: it must execute silently, with no user interaction.
+This is an example script with logging that shows how to run a PowerShell script from the provisioning commands setting. The PowerShell script referenced from this example must also be included in the package, and obey the same requirements as all scripts run from within the provisioning package: it must execute silently, with no user interaction.
```powershell
set LOGFILE=%SystemDrive%\my_powershell_script.log
@@ -138,13 +157,13 @@ echo Running my_powershell_script.ps1 in system context >> %LOGFILE%
echo Executing "PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1" >> %LOGFILE%
PsExec.exe -accepteula -i -s cmd.exe /c 'powershell.exe my_powershell_script.ps1' >> %LOGFILE%
echo result: %ERRORLEVEL% >> %LOGFILE%
-```
+```
-
+
-### Extract from a .CAB example
+### Extract from a .CAB example
-This example script shows expansion of a .cab from the provisioning commands script, and installation of the expanded setup.exe
+This example script shows expansion of a .cab from the provisioning commands script, and installation of the expanded setup.exe
```cab
set LOGFILE=%SystemDrive%\install_my_app.log
@@ -154,49 +173,50 @@ echo result: %ERRORLEVEL% >> %LOGFILE%
echo Installing MyApp >> %LOGFILE%
setup.exe >> %LOGFILE%
echo result: %ERRORLEVEL% >> %LOGFILE%
-```
+```
-### Calling multiple scripts in the package
+### Calling multiple scripts in the package
-Your provisioning package can include multiple **CommandFiles**.
+Your provisioning package can include multiple **CommandFiles**.
-You are allowed one **CommandLine** per provisioning package. The batch files shown above are orchestrator scripts that manage the installation and call any other scripts included in the provisioning package. The orchestrator script is what should be invoked from the **CommandLine** specified in the package.
-
-Here’s a table describing this relationship, using the PowerShell example from above:
+You are allowed one **CommandLine** per provisioning package. The batch files shown above are orchestrator scripts that manage the installation and call any other scripts included in the provisioning package. The orchestrator script is what should be invoked from the **CommandLine** specified in the package.
+Here’s a table describing this relationship, using the PowerShell example from above:
+
|ICD Setting | Value | Description |
| --- | --- | --- |
| ProvisioningCommands/DeviceContext/CommandLine | cmd /c PowerShell_Example.bat | The command line needed to invoke the orchestrator script. |
| ProvisioningCommands/DeviceContext/CommandFiles | PowerShell_Example.bat | The single orchestrator script referenced by the command line that handles calling into the required installers or performing any other actions such as expanding cab files. This script must do the required logging. |
-| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example, there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. |
+| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example, there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. |
-### Add script to provisioning package
+### Add script to provisioning package
-When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Windows Configuration Designer.
+When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Windows Configuration Designer.
-Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
+Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
```bat
cmd /c InstallMyApp.bat
-```
+```
-In Windows Configuration Designer, this looks like:
+In Windows Configuration Designer, this looks like:
-
+
-You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files.
+You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files.
-In Windows Configuration Designer, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting.
+In Windows Configuration Designer, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting.
-
+
When you are done, [build the package](provisioning-create-package.md#build-package).
-
+
+
-### Remarks
+### Remarks
1. No user interaction or console output is supported via ProvisioningCommands. All work needs to be silent. If your script attempts to do any of the following it will cause undefined behavior, and could put the device in an unrecoverable state if executed during setup or the Out of Box Experience:
a. Echo to console
@@ -204,22 +224,23 @@ When you are done, [build the package](provisioning-create-package.md#build-pack
c. Prompt the user with a dialog or install wizard
2. When applied at first boot, provisioning runs early in the boot sequence and before a user context has been established; care must be taken to only include installers that can run at this time. Other installers can be provisioned via a management tool.
3. If the device is put into an unrecoverable state because of a bad script, you can reset it using [recovery options in Windows client](https://support.microsoft.com/help/12415/windows-10-recovery-options).
-4. The CommandFile assets are deployed on the device to a temporary folder unique to each package.
+4. The CommandFile assets are deployed on the device to a temporary folder unique to each package.
- 1. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
+ 1. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
- The `0` after `Commands\` refers to the installation order and indicates the first app to be installed. The number will increment for each app in the package.
+ The `0` after `Commands\` refers to the installation order and indicates the first app to be installed. The number will increment for each app in the package.
- 2. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the provisioning package: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
+ 2. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the provisioning package: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands\0`
5. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script.
-6. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and “please wait” will be displayed on the screen.
+6. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and “please wait” will be displayed on the screen.
>[!NOTE]
>There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time.
-7. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there is no notification that provisioning or script execution has completed
-## Related articles
+7. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there is no notification that provisioning or script execution has completed
+
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
@@ -230,6 +251,6 @@ When you are done, [build the package](provisioning-create-package.md#build-pack
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
-- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
+- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
diff --git a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md
index 1ae2f42140..30810671b9 100644
--- a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md
+++ b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md
@@ -1,37 +1,32 @@
---
title: Uninstall a provisioning package - reverted settings (Windows 10/11)
description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows 10/11 desktop client devices.
-ms.prod: windows-client
-author: lizgt2000
-ms.author: lizlong
-ms.topic: article
-ms.localizationpriority: medium
+ms.topic: article
+
ms.reviewer: gkomatsu
-manager: aaroncz
-ms.technology: itpro-configure
ms.date: 12/31/2017
----
+---
-# Settings changed when you uninstall a provisioning package
+# Settings changed when you uninstall a provisioning package
-**Applies to**
+**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
-When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package.
+When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package.
-As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**.
+As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**.
-When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible.
+When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible.
-Only settings in the following lists are revertible.
+Only settings in the following lists are revertible.
-## Registry-based settings
+## Registry-based settings
-The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Windows Configuration Designer.
+The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Windows Configuration Designer.
- [Wi-Fi Sense](../wcd/wcd-connectivityprofiles.md#wifisense)
@@ -40,43 +35,67 @@ The registry-based settings that are revertible when a provisioning package is u
- UniversalAppInstall / LaunchAppAtLogin
- [Power](/previous-versions//dn953704(v=vs.85))
- [TabletMode](../wcd/wcd-tabletmode.md)
+
- [Maps](../wcd/wcd-maps.md)
+
- [Browser](../wcd/wcd-browser.md)
- [DeviceFormFactor](../wcd/wcd-deviceformfactor.md)
+
- [USBErrorsOEMOverride](/previous-versions/windows/hardware/previsioning-framework/mt769908(v=vs.85))
-- [WeakCharger](../wcd/wcd-weakcharger.md)
+- [WeakCharger](../wcd/wcd-weakcharger.md)
+
-## CSP-based settings
+## CSP-based settings
-Here is the list of revertible settings based on configuration service providers (CSPs).
+Here is the list of revertible settings based on configuration service providers (CSPs).
[ActiveSync CSP](/windows/client-management/mdm/activesync-csp)
+
[AppLocker CSP](/windows/client-management/mdm/applocker-csp)
+
[BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp)
+
[CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp)
+
[ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp)
+
[RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp)
+
[CM_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp)
+
[CM_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp)
+
[CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp)
+
[CMPolicyEnterprise CSP](/windows/client-management/mdm/cmpolicyenterprise-csp)
+
[EMAIL2 CSP](/windows/client-management/mdm/email2-csp)
+
[EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp)
+
[EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp)
+
[EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp)
+
[NAP CSP](/windows/client-management/mdm/nap-csp)
+
[PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp)
+
[Provisioning CSP](/windows/client-management/mdm/provisioning-csp)
+
[SecureAssessment CSP](/windows/client-management/mdm/secureassessment-csp)
+
[VPN CSP](/windows/client-management/mdm/vpn-csp)
+
[VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp)
-[WiFi CSP](/windows/client-management/mdm/wifi-csp)
+[WiFi CSP](/windows/client-management/mdm/wifi-csp)
+
-## Related articles
+## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
diff --git a/windows/configuration/screenshot1.png b/windows/configuration/screenshot1.png
deleted file mode 100644
index ed62740e9262b1fc4c3bdfb1be851296a1c0a7ff..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 2948876
zcmXt&xe?w8q;LXD|Z$YqtHawpe~$!+Aa
zJ3N@}?sboG_Tp6E-Mi1Sv!W#iI(k)__eK#sE5sg?1t7tB
z%sL2y&m66zkr15iQ8WU+yO0TLj^EuLt;6y8+iUm-?CxcI&8o^%?C
z&*r5=teW@O+jtPpkrlT|>PGBsuVvDjhS_9-RV+=Na{|ZXu}I54MF++rBuKkx#2#lY
zjvPDFvL{8{qfc5j^OVYQb0)hlxXe-XU|uw&EuECk7M1w+E1F9u;m}P0T$21eX_X~8
zoet{S%PYqQXkxr>d93ivtq|?3T@=MGC?0q48SSZ0uGT)`J$yQ;naAHn2+!7m5W5la
zxC>i;coJ9>{veSxSw60lWWvpB0dSbqbT-dTL|d0Zriry{6<%puS)=vH=7e)LG!SqO
ze~ks>Pb(cRgWQ-m?hAqhSFrwI@4^cUG`dC63#A&z8+sOegJq>t`%WXN@;c+*BF9
z{N&cl>Iv?`V0RC$oG6?gSP?pjn+4D6;?5g2iu`x-~9*?wV-usih7geR;
znhO4{_Z629Q&lPg4T4j}$M0z%kdFLW*PpFw1^vpP(EttX@J&wB=5f=u(9glmRzP3J
ze3byP;cxFma_-cdn9USC>=X=(0ck4#Rs-#wwe3N8@23mTdO(_o@1b3t5ku1;PQ~#c
zTul+N!aNYRDH~=A+Z~#~lquRlAwja1Pb
zrY3OFA>af^Cy2Chc-+@%cT=0|?ag7u|1
z2>aX=v#)gi`HMz2|2RNTw{D?pr?JNBAa!51RnPYtTz*GQfU^rcT>~5iZ~Pzv%VKuk
zYNAE&D}3!v0XF3Jg_P_@@s9}80<#hqiK`1KO|h!U8I3s8ELcV0xosT(NO8@%=flS*
zi^;1zI-W)ro3yB!{vpYj>v-j`8JIGtL&_;HHKe%)WL>O`*$h#v8~~73u{DwLT+6-1
zj{29@C%TP{a7MUwq9&?%&1dKd@rS>mitmabLXQ~hikoN*gErVBz-sb5E@z(AHy)?0
zt26If(ltxoQMUDU+$+cNAHv|}*`kph)%+{Q_+?I0sY>!(1+yx#UQ~iMfoQCa=IY{R
z_M#|(w@I0l5jhSuI^uPH#7ds=Nb*qJcPGYwmOoH|R|BYG$7`5BpgC;b2s6Q&x;fIi
z6Y^gyXA$?|FW&Y@ojc>nP!PZcS`=og3vvwL2*)+-Y&2z+Ib15Wni`IdaWDODcc0#x
zjYi&BpD)t8o0?-=QzAN7!O3WKb9^K8${}YbfzeOy!5v}n0u`06jHPb90h<_-VqLh@
zAMFl5jFc~w+uCs_?(`9u_(!7-)zTj1E82eoEdw{9qXp+c+HbOn!~8kPk^XxwGk@h>
zAIt`?sT>@HSl!YUY!_FDSp6sE%pmSGQ2Q45M{o*kw-=qs>_e*V8*b8FvZnCakkOx_
z#_)(UxDnsb3&lboD<-m40=f+|%#_b41+>co#Wr8M4Tmd5A+t6#_Kp9;9UkT
zXqa$Wg~obayRUeiWbR~>Y>l<@XQwy!zpJFO9wY2c*c9a7uxDe8{Q>_{!uC$
z?Qg5dZFeuD)HUAm>>hopw>dVi^ban^Z8zK7wv6
z3QnGuMJ=p&Zg!{4*2{h<%k5uT{g#07)08}}PU?TK?`2aB6zqphPvpQOF7Q2@IUY~p
zN2%VnT<8p%gVed-MfJ~>TFrZsG1SWmX2Mj#b&^t-RHDJp<&YzTWnXwzVg09c@J(YtWgXW0t3tN
zEfGV*7kS4eL3DVzP}$Z0J)^)-fuEb;=Bb)LC*_OMg(r9@hgo)VL+B7jg1{*vc+Bx!uGCv43{CG}XV
zV;E%eMV{d?L5j|;`;w9gX9`CWw;5OU1dXi{AEZ5N;!HoWu;UGf>!Vcjb;5_ALSa;^!q5gw;xbF>SKsr1$WgzJwwOy=ym3qW!uteG-u*x#gg+h|3!7gk
z``RJ6SO&Q>mri+nPTZ-+AEH&e6{{`v?ONY-+dCPZNUd8U@a32fesUj2(3XZ3aT5ZO
zkkivmJMr9G29#nyFb19#8Jg!!bo!RM{PNJ_juW+hR{c>gzbdWaSzb>H`zG^;^;jC$(57!bT#U32V
zn)qzZhoSF8WQkifg2oy`$WBr7L7P6SWk_G2edCOdV+dZUAFKngO%C|4#(b>d;p_j(
zfUFRwHw<|aXSgD3?SpRXyM%o48E8xyLZHL{aC-)Mt?xH&_>14EMdRs_uBdn{wGZY9
zQhoebTv!QdBC@8t5Kf3*$zT~L57ib9m!mwmx`2SNd-fsG-eG&|vgrg4w*6!dCfH62
zR5L^%P@Kp;_GDPACn3HSq}AE5KKxvBmG3*^{l~&pVObMxObeNe`Pf7%_1~^