diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index c32223b772..e22acdf422 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -74,7 +74,7 @@ Windows 11 SE comes with some preinstalled apps. The following apps can also run |NextUp Talker |1.0.49 |Win32 |NextUp Technologies| |NonVisual Desktop Access |2021.3.1 |Win32 |NV Access| |NWEA Secure Testing Browser |5.4.300.0 |Win32 |NWEA| -|Pearson TestNav |1.10.2.0 |Win32 |Pearson| +|Pearson TestNav |1.10.2.0 |Store |Pearson| |Questar Secure Browser |4.8.3.376 |Win32 |Questar| |ReadAndWriteForWindows |12.0.60.0 |Win32 |Texthelp Ltd.| |Remote Help |3.8.0.12 |Win32 |Microsoft| diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 40ca8b574f..3a3752cebe 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -51,6 +51,8 @@ DMClient ------------Unenroll ------------AADResourceID ------------AADDeviceID +------------AADSendDeviceToken +------------ForceAadToken ------------EnrollmentType ------------EnableOmaDmKeepAliveMessage ------------HWDevID @@ -73,6 +75,21 @@ DMClient ----------------NumberOfRemainingScheduledRetries ----------------PollOnLogin ----------------AllUsersPollOnFirstLogin +------------LinkedEnrollment +----------------Priority +----------------Enroll +----------------Unenroll +----------------EnrollStatus +----------------LastError +------------Recovery +----------------AllowRecovery +----------------RecoveryStatus +----------------InitiateRecovery +------------MultipleSession +----------------NumAllowedConcurrentUserSessionForBackgroundSync +----------------NumAllowedConcurrentUserSessionAtUserLogonSync +----------------IntervalForScheduledRetriesForUserSession +----------------NumberOfScheduledRetriesForUserSession ----Unenroll ----UpdateManagementServiceAddress ``` @@ -326,6 +343,11 @@ Supported operations are Add, Delete, Get, and Replace. Value type is bool. +**Provider/*ProviderID*/ForceAadToken** +The value type is integer/enum. + +The value is "1" and it means client should always send AAD device token during check-in/sync. + **Provider/*ProviderID*/Poll** Optional. Polling schedules must use the DMClient CSP. The Registry paths previously associated with polling using the Registry CSP are now deprecated. @@ -444,6 +466,113 @@ Optional. Boolean value that allows the IT admin to require the device to start Supported operations are Add, Get, and Replace. +**Provider/*ProviderID*/LinkedEnrollment/Priority** +This node is an integer, value is "0" or "1". + +Default is 1, meaning the MDM enrollment is the “winning” authority for conflicting policies/resources. Value 1 means MMP-C enrollment is the “winning” one. +Support operations are Get and Set. + +**Provider/*ProviderID*/LinkedEnrollment/Enroll** +This is an execution node and will trigger a silent MMP-C enrollment, using the AAD device token pulled from the AADJ’ed device. There is no user interaction needed. + +Support operation is Exec. + +**Provider/*ProviderID*/LinkedEnrollment/Unenroll** +This is an execution node and will trigger a silent MMP-C unenroll, there is no user interaction needed. On un-enrollment, all the settings/resources set by MMPC will be rolled back(rollback details will be covered later). + +Support operation is Exec. + +**Provider/*ProviderID*/LinkedEnrollment/EnrollStatus** + +This node can be used to check both enroll and unenroll statuses. +This will return the enroll action status and is defined as a enum class LinkedEnrollmentStatus. The values are aas follows: + +- Undefined = 0 +- EnrollmentNotStarted = 1 +- InProgress = 2 +- Failed = 3 +- Succeeded = 4 +- UnEnrollmentQueued = 5 +- UnEnrollmentSucceeded = 8 + +Support operation is Get only. + +**Provider/*ProviderID*/LinkedEnrollment/LastError** + +This specifies the Hresult to report the enrollment/unenroll results. + +**Provider/*ProviderID*/Recovery/AllowRecovery** + +This node determines whether or not the client will automatically initiate a MDM Recovery operation when it detects issues with the MDM certificate. + +Supported operations are Get, Add, Replace and Delete. + +The supported values for this node are 1-true (allow) and 0-false(not allow). Default value is 0. + +**Provider/*ProviderID*/Recovery/RecoveryStatus** + +This node tracks the status of a Recovery request from the InitiateRecovery node. The values are as follows: + +0 - No Recovery request has been processed. +1 - Recovery is in Process. +2 - Recovery has finished successfully. +3 - Recovery has failed to start because TPM is not available. +4 - Recovery has failed to start because AAD keys are not protected by the TPM. +5 - Recovery has failed to start because the MDM keys are already protected by the TPM. +6 - Recovery has failed to start because the TPM is not ready for attestation. +7 - Recovery has failed because the client cannot authenticate to the server. +8 - Recovery has failed because the server has rejected the client's request. + +Supported operation is Get only. + +**Provider/*ProviderID*/Recovery/InitiateRecovery** + +This node initiates an MDM Recovery operation on the client. + +If initiated with argument 0, it triggers MDM Recovery, no matter the state of the device. + +If initiated with argument 1, it triggers only if the MDM certificate’s private key isn’t already protected by the TPM, if there is a TPM to put the private key into, and if the TPM is ready for attestation. + +Supported operation is Exec only. + +**Provider/*ProviderID*/MultipleSession/NumAllowedConcurrentUserSessionForBackgroundSync** + +Optional. This node specifies maximum number of concurrent user sync sessions in background. Default value is 25. + +The values are : 0= none, 1= sequential, anything else= parallel. + +Supported operations are Get, Add, Replace and Delete. + +Value type is integer. Only applicable for Windows 10 multi-session. + + +**Provider/*ProviderID*/MultipleSession/NumAllowedConcurrentUserSessionAtUserLogonSync** +Optional. This node specifies maximum number of concurrent user sync sessions at User Login. Default value is 25. + +The values are : 0= none, 1= sequential, anything else= parallel. + +Supported operations are Get, Add, Replace and Delete. + +Value type is integer. Only applicable for Windows 10 multi-session. + +**Provider/*ProviderID*/MultipleSession/IntervalForScheduledRetriesForUserSession** +Optional. This node specifies the waiting time (in minutes) for the initial set of retries as specified by the number of retries in `//Poll/NumberOfScheduledRetriesForUserSession`. + +If IntervalForScheduledRetriesForUserSession is not set, then the default value is used. The default value is 1440. If the value is set to 0, this schedule is disabled. + +This configuration is only applicable for Windows Multi-session Editions. + +Supported operations are Get and Replace. + +**Provider/*ProviderID*/MultipleSession/NumberOfScheduledRetriesForUserSession** +Optional. This node specifies the number of times the DM client should retry to connect to the server when the client is initially configured or enrolled to communicate with the server. + +If the value is set to 0 and the IntervalForScheduledRetriesForUserSession value is not 0, then the schedule will be set to repeat an infinite number of times. + +The default value is 0. This configuration is only applicable for Windows Multi-session Editions. + +Supported operations are Get and Replace. + **Provider/*ProviderID*/ConfigLock** Optional. This node enables [Config Lock](config-lock.md) feature. If enabled, policies defined in the Config Lock document will be monitored and quickly remediated when a configuration drift is detected. diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md index 9591465cfc..22ed2a7af6 100644 --- a/windows/client-management/quick-assist.md +++ b/windows/client-management/quick-assist.md @@ -14,7 +14,7 @@ ms.collection: highpri # Use Quick Assist to help users -Quick Assist is a Windows application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. +Quick Assist is a Microsoft Store application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. ## Before you begin @@ -42,7 +42,6 @@ Both the helper and sharer must be able to reach these endpoints over port 443: | `*.api.support.microsoft.com` | API access for Quick Assist | | `*.vortex.data.microsoft.com` | Used for diagnostic data | | `*.channelservices.microsoft.com` | Required for chat services within Quick Assist | -| `*.skype.com` | Skype requests may vary based on geography. If connection issues persist, test this endpoint. | | `*.remoteassistanceprodacs.communication.azure.com` | Azure Communication Services (ACS) technology the Quick Assist app uses. | | `*.turn.azure.com` | Protocol used to help endpoint. | | `browser.pipe.aria.microsoft.com` | Required diagnostic data for client and services used by Quick Assist. | @@ -105,23 +104,7 @@ Either the support staff or a user can start a Quick Assist session. ## If Quick Assist is missing -If for some reason a user doesn't have Quick Assist on their system or it's not working properly, try to uninstall and reinstall it. - -### Uninstall Quick Assist - -1. Start the Settings app, and then select **Apps**. -2. Select **Optional features**. -3. In the **Installed features** search bar, type *Quick Assist*. -4. Select **Microsoft Quick Assist**, and then select **Uninstall**. - -### Reinstall Quick Assist - -1. Start the Settings app, and then select **Apps**. -2. Select **Optional features**. -3. Select **Add a feature**. -4. In the new dialog that opens, in the **Add an optional feature** search bar, type *Quick Assist*. -5. Select the check box for **Microsoft Quick Assist**, and then select **Install**. -6. Restart the device. +If for some reason a user doesn't have Quick Assist on their system or it's not working properly, try to uninstall and reinstall it. For more information, see [Install Quick Assist](https://support.microsoft.com/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca). ## Next steps diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index 7459c71de0..6aae1788d5 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -134,14 +134,14 @@ Deployment scheduling controls are always available, but to take advantage of th To enroll devices in Windows Update for Business cloud processing, set the **AllowWUfBCloudProcessing** policy using mobile device management (MDM) policy or Group Policy. -| Policy | Sets registry key under **HKLM\\Software** | -|--------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------| -| GPO for Windows 10, version 1809 or later: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow WUfB Cloud Processing** | \\Policies\\Microsoft\\Windows\\DataCollection\\AllowWUfBCloudProcessing | -| MDM for Windows 10, version 1809 or later: ../Vendor/MSFT/ Policy/Config/System/**AllowWUfBCloudProcessing** | \\Microsoft\\PolicyManager\\default\\System\\AllowWUfBCloudProcessing | +| Policy| Sets registry key under `HKLM\Software`| +|--|--| +| GPO for Windows 10, version 1809 or later: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow WUfB Cloud Processing** | `\Policies\Microsoft\Windows\DataCollection\AllowWUfBCloudProcessing` | +| MDM for Windows 10, version 1809 or later: ../Vendor/MSFT/ Policy/Config/System/**AllowWUfBCloudProcessing** | `\Microsoft\PolicyManager\current\device\System\AllowWUfBCloudProcessing` | Following is an example of setting the policy using Microsoft Endpoint Manager: -1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Sign in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Devices** > **Configuration profiles** > **Create profile**. @@ -162,7 +162,7 @@ Following is an example of setting the policy using Microsoft Endpoint Manager: 8. (Optional) To verify that the policy reached the client, check the value of the following registry entry: - **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager \\default\\System\\AllowWUfBCloudProcessing** + `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\System\AllowWUfBCloudProcessing` ## Best practices Follow these suggestions for the best results with the service. diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md index e90960de49..a93c10f142 100644 --- a/windows/deployment/update/wufb-wsus.md +++ b/windows/deployment/update/wufb-wsus.md @@ -57,6 +57,9 @@ To help you better understand the scan source policy, see the default scan behav > [!TIP] > The only two relevant policies for where your updates come from are the specify scan source policy and whether or not you have configured a WSUS server. This should simplify the configuration options. +> [!NOTE] +> If you have devices configured for WSUS and do not configure the scan source policy for feature updates to come from Windows update or set any Windows Update for Business offering policies, then users who select "Check online for updates" on the Settings page may see the optional upgrade to Windows 11. We recommend configuring the scan source policy or a Windows Update for Business offering policy to prevent such. + ## Configure the scan sources The policy can be configured using the following two methods: diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index c6fe58c845..97e466d258 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -7,7 +7,7 @@ - name: What is Windows Autopatch? href: overview/windows-autopatch-overview.md - name: FAQ - href: overview/windows-autopatch-faq.md + href: overview/windows-autopatch-faq.yml - name: Prepare href: prepare/index.md items: @@ -49,7 +49,7 @@ href: operate/windows-autopatch-edge.md - name: Microsoft Teams href: operate/windows-autopatch-teams.md - - name: Deregister a devices + - name: Deregister a device href: operate/windows-autopatch-deregister-devices.md - name: Submit a support request href: operate/windows-autopatch-support-request.md diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md index 31f250df19..bc01a30400 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md @@ -36,9 +36,10 @@ You must choose what devices to manage with Windows Autopatch by either adding t Windows Autopatch also supports the following Azure AD nested group scenarios: -- Azure AD groups synced up from: - - On-premises Active Directory groups (Windows server type). - - [Configuration Manager collections](/mem/configmgr/core/clients/manage/collections/create-collections#bkmk_aadcollsync). +Azure AD groups synced up from: + +- On-premises Active Directory groups (Windows server type). +- [Configuration Manager collections](/mem/configmgr/core/clients/manage/collections/create-collections#bkmk_aadcollsync). > [!IMPORTANT] > The **Windows Autopatch Device Registration** Azure AD group only supports one level of Azure AD nested groups. @@ -52,17 +53,17 @@ To be eligible for Windows Autopatch management, devices must meet a minimum set - Windows 10/11 64-bit Enterprise edition 1809+. - Either hybrid or Azure AD joined (personal devices aren't supported). -- Managed by Microsoft Endpoint Manager - - Microsoft Endpoint Manager-Intune or Microsoft Endpoint Manager-Configuration Manager Co-management. - - Microsoft Endpoint Manager-Configuration Manager Co-management workloads swung over to Microsoft Endpoint Manager-Intune (either set to Pilot Intune or Intune). - - Windows Updates policies - - Device configuration - - Office Click-to-run +- Managed by Microsoft Endpoint Manager. + - Microsoft Endpoint Manager-Intune or Microsoft Endpoint Manager-Configuration Manager Co-management. + - Microsoft Endpoint Manager-Configuration Manager Co-management workloads swung over to Microsoft Endpoint Manager-Intune (either set to Pilot Intune or Intune). + - Windows updates policies + - Device configuration + - Office Click-to-run - Last Intune device check-in completed within the last 28 days. For more details on each prerequisite check, see the [Prerequisites](../prepare/windows-autopatch-prerequisites.md) article. -## About Devices Ready and Not ready tabs +## About the Ready and Not ready tabs Windows Autopatch introduces a new user interface to help IT admins manage devices and troubleshoot device readiness statuses seamlessly with actionable in-UI device readiness reports for unregistered devices or unhealthy devices. diff --git a/windows/deployment/windows-autopatch/index.yml b/windows/deployment/windows-autopatch/index.yml index 888ce01b0c..b99aeb0317 100644 --- a/windows/deployment/windows-autopatch/index.yml +++ b/windows/deployment/windows-autopatch/index.yml @@ -27,7 +27,7 @@ landingContent: - text: What is Windows Autopatch? url: ./overview/windows-autopatch-overview.md - text: Windows Autopatch FAQ - url: ./overview/windows-autopatch-faq.md + url: ./overview/windows-autopatch-faq.yml # Card (optional) - title: Articles and blog posts diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md index b9661b4170..658420e146 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-microsoft-365-apps-enterprise.md @@ -77,7 +77,7 @@ Windows Autopatch will either: > [!NOTE] > Windows Autopatch doesn't currently allow customers to force their devices to stay on a previous version or rollback to a previous version. -Since Windows quality updates are bundled together into a single release in the [Monthly Enterprise Channel](/deployoffice/overview-update-channels#monthly-enterprise-channel-overview), we can't roll back only a portion of the update for Microsoft 365 Apps for enterprise. +Since quality updates are bundled together into a single release in the [Monthly Enterprise Channel](/deployoffice/overview-update-channels#monthly-enterprise-channel-overview), we can't roll back only a portion of the update for Microsoft 365 Apps for enterprise. ## Conflicting and unsupported policies diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md index f6e0614363..06eeae4e4d 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md @@ -64,7 +64,7 @@ Once a support request is mitigated, it can no longer be edited. If a request ha ## Microsoft FastTrack -[Microsoft FastTrack](https://www.microsoft.com/en-us/fasttrack) offers Microsoft 365 deployment guidance for customers with 150 or more licenses of an eligible subscription at no additional cost. FastTrack Specialists can help customers work through the Windows Autopatch technical prerequisites described in the [FAQ](../overview/windows-autopatch-faq.md). For more information, visit the [FastTrack website](https://www.microsoft.com/en-ca/fasttrack?rtc=1). +[Microsoft FastTrack](https://www.microsoft.com/en-us/fasttrack) offers Microsoft 365 deployment guidance for customers with 150 or more licenses of an eligible subscription at no additional cost. FastTrack Specialists can help customers work through the Windows Autopatch technical prerequisites described in the [FAQ](../overview/windows-autopatch-faq.yml). For more information, visit the [FastTrack website](https://www.microsoft.com/en-ca/fasttrack?rtc=1). Customers who need help with Microsoft 365 workloads can sign in to https://fasttrack.microsoft.com/ with a valid Azure ID and submit a Request for Assistance. diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.md deleted file mode 100644 index 3fad61cc1f..0000000000 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: FAQ -description: This article answers frequently asked questions about Windows Autopatch -ms.date: 05/30/2022 -ms.prod: w11 -ms.technology: windows -ms.topic: troubleshooting -ms.localizationpriority: medium -author: tiaraquan -ms.author: tiaraquan -manager: dougeby -msreviewer: hathind ---- - -# FAQ - -## General - -| Question | Answer | -| ----- | ----- | -| What Windows versions are supported? | Windows Autopatch works with all [supported versions of Windows 10 and Windows 11 Enterprise edition](/windows/release-health/supported-versions-windows-client). | -| What is the difference between Windows Updates for Business and Windows Autopatch? | Windows Autopatch is a service that removes the need for organizations to plan and operate the update process.

Windows Autopatch moves the burden from your IT to Microsoft. Windows Autopatch uses [Windows Update for Business](/windows/deployment/update/deployment-service-overview) and other service components to update devices. Both are part of Windows Enterprise E3. | -| Is Windows 365 for Enterprise supported with Windows Autopatch? | Windows Autopatch supports Windows 365 for Enterprise. Windows 365 for Business isn't supported.| -| Does Windows Autopatch support Windows Education (A3) or Windows Front Line Worker (F3) licensing? | Autopatch isn't available for 'A' or 'F' series licensing. | -| Will Windows Autopatch support local domain join Windows 10? | Windows Autopatch doesn't support local (on-premise) domain join. Windows Autopatch supports [Hybrid AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or pure [Azure AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid). | -| Will Windows Autopatch be available for state and local government customers? | Windows Autopatch is available for all Windows E3 customers using Azure commercial cloud. However, Autopatch isn't currently supported for government cloud (GCC) customers. | - -## Requirements - -| Question | Answer | -| ----- | ----- | -| What are the prerequisites for Windows Autopatch? |

| -| What are the licensing requirements for Windows Autopatch? | | -| Are there hardware requirements for Windows Autopatch? | No, Windows Autopatch doesn't require any specific hardware. However, general hardware requirements for updates are still applicable. For example, to deliver Windows 11 to your Autopatch devices they must meet [specific hardware requirements](/windows/windows-11-specifications?r=1). Windows devices must be supported by your hardware OEM. | - -## Device registration - -| Question | Answer | -| ----- | ----- | -| Can Autopatch customers individually approve or deny devices? | No you can't individually approve or deny devices. Once a device is registered with Windows Autopatch, updates are rolled out to the devices according to its ring assignment. Individual device level control isn't supported. | - -## Update management - -| Question | Answer | -| ----- | ----- | -| What systems does Windows Autopatch update? |