From ffef722259f60c556e12b122b93b88be25a83fd4 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 22 Jul 2024 17:54:13 -0400
Subject: [PATCH 01/49] Update passkeys documentation with information on
Bluetooth-restricted environments
---
.../identity-protection/passkeys/index.md | 24 +++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 44f695a852..14a3589a9d 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -1,11 +1,11 @@
---
title: Support for passkeys in Windows
description: Learn about passkeys and how to use them on Windows devices.
-ms.collection:
+ms.collection:
- tier1
ms.topic: overview
ms.date: 11/07/2023
-appliesto:
+appliesto:
- ✅ Windows 11
- ✅ Windows 10
---
@@ -315,6 +315,26 @@ Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can use the Set
To provide feedback for passkeys, open [**Feedback Hub**][FHUB] and use the category **Security and Privacy > Passkey**.
+## Passkeys and Bluetooth-restricted environments
+
+For passkey cross-device authentication scenarios, both the Windows device and the mobile device must have Bluetooth enabled and connected to the Internet. This allows the user to authorize another device securely over Bluetooth without transferring or copying the passkey itself.
+
+Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](../../../client-management/mdm/policy-csp-bluetooth.md)
+
+| OMA-URI | Data type | Value |
+|--|--|--|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](../../../client-management/mdm/policy-csp-bluetooth.md#allowadvertising)|Integer|`0`
When set to `0`, the device won't send out advertisements.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](../../../client-management/mdm/policy-csp-bluetooth.md#allowdiscoverablemode)|Integer|`0`
When set to `0`, other devices won't be able to detect the device.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](../../../client-management/mdm/policy-csp-bluetooth.md#allowprepiaring)|Integer|`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](../../../client-management/mdm/policy-csp-bluetooth.md#allowpromptedproximalconnections)|Integer|`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](../../../client-management/mdm/policy-csp-bluetooth.md#servicesallowedlist)|String|`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service|
+| `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](../../../client-management/mdm/policy-csp-deviceinstallation.md#preventinstallationofmatchingdeviceids)|String|``
This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint|
+
+For more information see:
+
+- [FIDO CTAP 2.1 standard specification](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#ble-fido-service)
+- [Bluetooth Assigned Numbers document](https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Assigned_Numbers/out/en/Assigned_Numbers.pdf?v=1713387868258)
+
[FHUB]: feedback-hub:?tabid=2&newFeedback=true
From efdb164a8671399f12a5e33d0a1534501aa2e72c Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 07:23:05 -0400
Subject: [PATCH 02/49] updates
---
.../identity-protection/passkeys/index.md | 23 +++++++++++++------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 14a3589a9d..d023c4d13c 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -319,22 +319,31 @@ To provide feedback for passkeys, open [**Feedback Hub**][FHUB] and use the cate
For passkey cross-device authentication scenarios, both the Windows device and the mobile device must have Bluetooth enabled and connected to the Internet. This allows the user to authorize another device securely over Bluetooth without transferring or copying the passkey itself.
-Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](../../../client-management/mdm/policy-csp-bluetooth.md)
+Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](/windows/client-management/mdm/policy-csp-bluetooth.md)
| OMA-URI | Data type | Value |
|--|--|--|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](../../../client-management/mdm/policy-csp-bluetooth.md#allowadvertising)|Integer|`0`
When set to `0`, the device won't send out advertisements.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](../../../client-management/mdm/policy-csp-bluetooth.md#allowdiscoverablemode)|Integer|`0`
When set to `0`, other devices won't be able to detect the device.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](../../../client-management/mdm/policy-csp-bluetooth.md#allowprepiaring)|Integer|`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](../../../client-management/mdm/policy-csp-bluetooth.md#allowpromptedproximalconnections)|Integer|`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](../../../client-management/mdm/policy-csp-bluetooth.md#servicesallowedlist)|String|`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service|
-| `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](../../../client-management/mdm/policy-csp-deviceinstallation.md#preventinstallationofmatchingdeviceids)|String|``
This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising)|Integer|`0`
When set to `0`, the device won't send out advertisements.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth.md#allowdiscoverablemode)|Integer|`0`
When set to `0`, other devices won't be able to detect the device.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth.md#allowprepiaring)|Integer|`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth.md#allowpromptedproximalconnections)|Integer|`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
+| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth.md#servicesallowedlist)|String|`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service|
+| `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation.md#preventinstallationofmatchingdeviceids)|String|``
This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint|
For more information see:
- [FIDO CTAP 2.1 standard specification](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#ble-fido-service)
- [Bluetooth Assigned Numbers document](https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Assigned_Numbers/out/en/Assigned_Numbers.pdf?v=1713387868258)
+| Setting |
+| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+
[FHUB]: feedback-hub:?tabid=2&newFeedback=true
From ca939da78e60a2553d9c4d422562998f7d6a4d2b Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 07:55:01 -0400
Subject: [PATCH 03/49] chore: Update passkeys documentation with
Bluetooth-restricted environments information
---
.../identity-protection/passkeys/index.md | 28 ++++++-------------
1 file changed, 8 insertions(+), 20 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index d023c4d13c..98353e35aa 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -321,31 +321,19 @@ For passkey cross-device authentication scenarios, both the Windows device and t
Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](/windows/client-management/mdm/policy-csp-bluetooth.md)
-| OMA-URI | Data type | Value |
-|--|--|--|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising)|Integer|`0`
When set to `0`, the device won't send out advertisements.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth.md#allowdiscoverablemode)|Integer|`0`
When set to `0`, other devices won't be able to detect the device.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth.md#allowprepiaring)|Integer|`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth.md#allowpromptedproximalconnections)|Integer|`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
-| `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth.md#servicesallowedlist)|String|`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service|
-| `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation.md#preventinstallationofmatchingdeviceids)|String|``
This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint|
-
-For more information see:
-
-- [FIDO CTAP 2.1 standard specification](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#ble-fido-service)
-- [Bluetooth Assigned Numbers document](https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Assigned_Numbers/out/en/Assigned_Numbers.pdf?v=1713387868258)
-
| Setting |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth.md#allowdiscoverablemode)Data type: **Integer** Value:`0`
Details: When set to `0`, other devices won't be able to detect the device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth.md#allowprepiaring)Data type: **Integer** Value:`0`
Details: Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth.md#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Details:Prevents users from using Swift Pair and other proximity-based scenarios. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth.md#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Details: Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation.md#preventinstallationofmatchingdeviceids)Data type: **String** Value:`0`
Details: |`` This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
[FHUB]: feedback-hub:?tabid=2&newFeedback=true
[KB-1]: https://support.microsoft.com/kb/5030310
[MSS-1]: ms-settings:savedpasskeys
+[BT-1]: https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#ble-fido-service
+[BT-2]: https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Assigned_Numbers/out/en/Assigned_Numbers.pdf?v=1713387868258
From 9140cfe0f40ec4671014ac358a8b9620dd492c06 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 07:56:22 -0400
Subject: [PATCH 04/49] chore: Update passkeys documentation with
Bluetooth-restricted environments information
---
.../security/identity-protection/passkeys/index.md | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 98353e35aa..9bde579ab5 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -323,12 +323,12 @@ Some organizations restrict the use of Bluetooth, preventing the use of passkeys
| Setting |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth.md#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth.md#allowdiscoverablemode)Data type: **Integer** Value:`0`
Details: When set to `0`, other devices won't be able to detect the device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth.md#allowprepiaring)Data type: **Integer** Value:`0`
Details: Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth.md#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Details:Prevents users from using Swift Pair and other proximity-based scenarios. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth.md#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Details: Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation.md#preventinstallationofmatchingdeviceids)Data type: **String** Value:`0`
Details: |`` This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode)Data type: **Integer** Value:`0`
Details: When set to `0`, other devices won't be able to detect the device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth#allowprepiaring)Data type: **Integer** Value:`0`
Details: Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Details:Prevents users from using Swift Pair and other proximity-based scenarios. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Details: Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:`0`
Details: |`` This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
From 7b436722f47915fd734b28749cc9e58573721133 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 08:04:56 -0400
Subject: [PATCH 05/49] chore: Update passkeys documentation with
Bluetooth-restricted environments information
---
windows/security/identity-protection/passkeys/index.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 9bde579ab5..7c11a4de1d 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -327,8 +327,8 @@ Some organizations restrict the use of Bluetooth, preventing the use of passkeys
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode)Data type: **Integer** Value:`0`
Details: When set to `0`, other devices won't be able to detect the device. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth#allowprepiaring)Data type: **Integer** Value:`0`
Details: Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Details:Prevents users from using Swift Pair and other proximity-based scenarios. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Details: Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:`0`
Details: |`` This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:``
This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
From b4728ccb73f979f2a20cc3db3dfa92eb780b391c Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 11:00:36 -0400
Subject: [PATCH 06/49] chore: Update passkeys documentation with Bluetooth
service and profile information
---
windows/security/identity-protection/passkeys/index.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 7c11a4de1d..deaf3a8a2c 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -327,8 +327,8 @@ Some organizations restrict the use of Bluetooth, preventing the use of passkeys
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode)Data type: **Integer** Value:`0`
Details: When set to `0`, other devices won't be able to detect the device. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth#allowprepiaring)Data type: **Integer** Value:`0`
Details: Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Details:Prevents users from using Swift Pair and other proximity-based scenarios. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service
- FIDO2 secure client-to-authenticator transport service. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:``
This configuration:
- disables the existing Bluetooth Personal Area Network (PAN) network adapter
- prevents the installation of the Bluetooth Network Adapter that can be used for network connectivity\tethering from a Bluetooth device and the endpoint.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`) |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
From 5f64481ef078c2fa4c1e9fa508a3f210d18b1114 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 11:19:13 -0400
Subject: [PATCH 07/49] chore: Update passkeys documentation with Bluetooth
service and profile information
---
.../identity-protection/passkeys/index.md | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index deaf3a8a2c..d7565dd71a 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -319,21 +319,21 @@ To provide feedback for passkeys, open [**Feedback Hub**][FHUB] and use the cate
For passkey cross-device authentication scenarios, both the Windows device and the mobile device must have Bluetooth enabled and connected to the Internet. This allows the user to authorize another device securely over Bluetooth without transferring or copying the passkey itself.
-Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](/windows/client-management/mdm/policy-csp-bluetooth.md)
+Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](/windows/client-management/mdm/policy-csp-bluetooth)
| Setting |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth#allowadvertising) Data type: **Integer** Value:`0`
Details: When set to `0`, the device won't send out advertisements. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode)Data type: **Integer** Value:`0`
Details: When set to `0`, other devices won't be able to detect the device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth#allowprepiaring)Data type: **Integer** Value:`0`
Details: Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Details:Prevents users from using Swift Pair and other proximity-based scenarios. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`) |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.
For more information see:
- [FIDO CTAP 2.1 standard specification][BT-1]
- [Bluetooth Assigned Numbers document][BT-2]|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth#allowadvertising) Data type: **Integer** Value:`0`
When set to `0`, the device won't send out advertisements.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode)Data type: **Integer** Value:`0`
When set to `0`, other devices won't be able to detect the device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth#allowprepiaring)Data type: **Integer** Value:`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`)
For more information see [FIDO CTAP 2.1 standard specification][BT-1] and [Bluetooth Assigned Numbers document][BT-2]. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.|
+[BT-1]: https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#ble-fido-service
+[BT-2]: https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Assigned_Numbers/out/en/Assigned_Numbers.pdf?v=1713387868258
[FHUB]: feedback-hub:?tabid=2&newFeedback=true
[KB-1]: https://support.microsoft.com/kb/5030310
[MSS-1]: ms-settings:savedpasskeys
-[BT-1]: https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#ble-fido-service
-[BT-2]: https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Assigned_Numbers/out/en/Assigned_Numbers.pdf?v=1713387868258
From 1b67de0714a5a235fbd001cdaeade7979a7ba8fa Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 11:29:52 -0400
Subject: [PATCH 08/49] chore: Update passkeys documentation with corrected
link to Intune custom settings configuration
---
.../credential-guard/configure.md | 2 +-
.../identity-protection/passkeys/index.md | 38 +++++++++++++------
2 files changed, 27 insertions(+), 13 deletions(-)
diff --git a/windows/security/identity-protection/credential-guard/configure.md b/windows/security/identity-protection/credential-guard/configure.md
index fee6dbbc20..b965f14e38 100644
--- a/windows/security/identity-protection/credential-guard/configure.md
+++ b/windows/security/identity-protection/credential-guard/configure.md
@@ -404,4 +404,4 @@ bcdedit /set vsmlaunchtype off
[CSP-1]: /windows/client-management/mdm/policy-csp-deviceguard#enablevirtualizationbasedsecurity
-[INT-1]: /mem/intune/configuration/settings-catalog
+[INT-1]: /mem/intune/configuration/custom-settings-configure
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index d7565dd71a..9424603d81 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -311,24 +311,28 @@ Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can use the Set
> [!NOTE]
> Some passkeys for *login.microsoft.com* can't be deleted, as they're used with Microsoft Entra ID and/or Microsoft Account for signing in to the device and Microsoft services.
-## :::image type="icon" source="../../images/icons/feedback.svg" border="false"::: Provide feedback
-
-To provide feedback for passkeys, open [**Feedback Hub**][FHUB] and use the category **Security and Privacy > Passkey**.
-
-## Passkeys and Bluetooth-restricted environments
+## Passkeys in Bluetooth-restricted environments
For passkey cross-device authentication scenarios, both the Windows device and the mobile device must have Bluetooth enabled and connected to the Internet. This allows the user to authorize another device securely over Bluetooth without transferring or copying the passkey itself.
-Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](/windows/client-management/mdm/policy-csp-bluetooth)
+Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](/windows/client-management/mdm/policy-csp-bluetooth) and the [deviceinstallation policy CSP]/windows/client-management/mdm/policy-csp-deviceinstallation).
+
+The following table provides an example of CSP settings to allow passkeys in a Bluetooth-restricted environment:
| Setting |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising](/windows/client-management/mdm/policy-csp-bluetooth#allowadvertising) Data type: **Integer** Value:`0`
When set to `0`, the device won't send out advertisements.|
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode](/windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode)Data type: **Integer** Value:`0`
When set to `0`, other devices won't be able to detect the device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing](/windows/client-management/mdm/policy-csp-bluetooth#allowprepiaring)Data type: **Integer** Value:`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections](/windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections) Data type: **Integer** Value:`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList](/windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist) Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`)
For more information see [FIDO CTAP 2.1 standard specification][BT-1] and [Bluetooth Assigned Numbers document][BT-2]. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs](/windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids)Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising][CSP-1] Data type: **Integer** Value:`0`
When set to `0`, the device won't send out advertisements.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode][CSP-2] Data type: **Integer** Value:`0`
When set to `0`, other devices won't be able to detect the device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing][CSP-3]Data type: **Integer** Value:`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections][CSP-4] Data type: **Integer** Value:`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList][CSP-5] Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`)
For more information see [FIDO CTAP 2.1 standard specification][BT-1] and [Bluetooth Assigned Numbers document][BT-2]. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs][CSP-6]Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.|
+
+To configure devices with Microsoft Intune, [you can use a Settings catalog policy][INT-1] or a [custom policy][INT-2].
+
+## :::image type="icon" source="../../images/icons/feedback.svg" border="false"::: Provide feedback
+
+To provide feedback for passkeys, open [**Feedback Hub**][FHUB] and use the category **Security and Privacy > Passkey**.
@@ -337,3 +341,13 @@ Some organizations restrict the use of Bluetooth, preventing the use of passkeys
[FHUB]: feedback-hub:?tabid=2&newFeedback=true
[KB-1]: https://support.microsoft.com/kb/5030310
[MSS-1]: ms-settings:savedpasskeys
+
+[INT-1]: /mem/intune/configuration/settings-catalog
+[INT-2]: /mem/intune/configuration/custom-settings-configure
+
+[CSP-1]: /windows/client-management/mdm/policy-csp-bluetooth#allowadvertising
+[CSP-2]: /windows/client-management/mdm/policy-csp-bluetooth#allowdiscoverablemode
+[CSP-3]: /windows/client-management/mdm/policy-csp-bluetooth#allowprepairing
+[CSP-4]: /windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections
+[CSP-5]: /windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist
+[CSP-6]: /windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids
From 57aec2a6b9a0c9b980e1f877affc30f29cd10820 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 11:39:16 -0400
Subject: [PATCH 09/49] chore: Update passkeys documentation with
Bluetooth-restricted environments information
---
.../security/identity-protection/passkeys/index.md | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 9424603d81..73a940d66e 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -315,18 +315,18 @@ Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can use the Set
For passkey cross-device authentication scenarios, both the Windows device and the mobile device must have Bluetooth enabled and connected to the Internet. This allows the user to authorize another device securely over Bluetooth without transferring or copying the passkey itself.
-Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP](/windows/client-management/mdm/policy-csp-bluetooth) and the [deviceinstallation policy CSP]/windows/client-management/mdm/policy-csp-deviceinstallation).
+Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP][CSP-8] and the [DeviceInstallation Policy CSP][CSP-7].
The following table provides an example of CSP settings to allow passkeys in a Bluetooth-restricted environment:
| Setting |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising][CSP-1] Data type: **Integer** Value:`0`
When set to `0`, the device won't send out advertisements.|
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode][CSP-2] Data type: **Integer** Value:`0`
When set to `0`, other devices won't be able to detect the device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing][CSP-3]Data type: **Integer** Value:`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections][CSP-4] Data type: **Integer** Value:`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising][CSP-1] Data type: **Integer** Value:`0`
When set to `0`, the device won't send out advertisements.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode][CSP-2] Data type: **Integer** Value:`0`
When set to `0`, other devices won't be able to detect the device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing][CSP-3]Data type: **Integer** Value:`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections][CSP-4] Data type: **Integer** Value:`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList][CSP-5] Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`)
For more information see [FIDO CTAP 2.1 standard specification][BT-1] and [Bluetooth Assigned Numbers document][BT-2]. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs][CSP-6]Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs][CSP-6]Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.|
To configure devices with Microsoft Intune, [you can use a Settings catalog policy][INT-1] or a [custom policy][INT-2].
@@ -351,3 +351,5 @@ To provide feedback for passkeys, open [**Feedback Hub**][FHUB] and use the cate
[CSP-4]: /windows/client-management/mdm/policy-csp-bluetooth#allowpromptedproximalconnections
[CSP-5]: /windows/client-management/mdm/policy-csp-bluetooth#servicesallowedlist
[CSP-6]: /windows/client-management/mdm/policy-csp-deviceinstallation#preventinstallationofmatchingdeviceids
+[CSP-7]: /windows/client-management/mdm/policy-csp-deviceinstallation
+[CSP-8]: /windows/client-management/mdm/policy-csp-bluetooth
From 01c555674f5c146353c15f5f4ad45d61175c6675 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 11:48:42 -0400
Subject: [PATCH 10/49] chore: Update passkeys documentation with
Bluetooth-restricted environments information
---
.../identity-protection/passkeys/index.md | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 73a940d66e..c8a205a479 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -319,14 +319,14 @@ Some organizations restrict the use of Bluetooth, preventing the use of passkeys
The following table provides an example of CSP settings to allow passkeys in a Bluetooth-restricted environment:
-| Setting |
-| ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising][CSP-1] Data type: **Integer** Value:`0`
When set to `0`, the device won't send out advertisements.|
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode][CSP-2] Data type: **Integer** Value:`0`
When set to `0`, other devices won't be able to detect the device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing][CSP-3]Data type: **Integer** Value:`0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections][CSP-4] Data type: **Integer** Value:`0`
Prevents users from using Swift Pair and other proximity-based scenarios.|
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList][CSP-5] Data type: **String** Value:`{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`)
For more information see [FIDO CTAP 2.1 standard specification][BT-1] and [Bluetooth Assigned Numbers document][BT-2]. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs][CSP-6]Data type: **String** Value:``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering.|
+| Setting |
+|--|
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising][CSP-1] Data type: **Integer** Value: `0`
When set to `0`, the device won't send out advertisements. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode][CSP-2] Data type: **Integer** Value: `0`
When set to `0`, other devices won't be able to detect the device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing][CSP-3]Data type: **Integer** Value: `0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections][CSP-4] Data type: **Integer** Value: `0`
Prevents users from using Swift Pair and other proximity-based scenarios. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList][CSP-5] Data type: **String** Value: `{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`)
For more information see [FIDO CTAP 2.1 standard specification][BT-1] and [Bluetooth Assigned Numbers document][BT-2]. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs][CSP-6]Data type: **String** Value: ``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering. |
To configure devices with Microsoft Intune, [you can use a Settings catalog policy][INT-1] or a [custom policy][INT-2].
From 1a42a18297412af6e1aa940bd306fbec0eee6ef3 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 12:13:02 -0400
Subject: [PATCH 11/49] chore: Update passkeys documentation with improved
Bluetooth-restricted environments information
---
windows/security/identity-protection/passkeys/index.md | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index c8a205a479..7b800e3e5e 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -315,7 +315,9 @@ Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can use the Set
For passkey cross-device authentication scenarios, both the Windows device and the mobile device must have Bluetooth enabled and connected to the Internet. This allows the user to authorize another device securely over Bluetooth without transferring or copying the passkey itself.
-Some organizations restrict the use of Bluetooth, preventing the use of passkeys. In this case, organizations can enable the use of passkeys by only allowing Bluetooth pairing with passkey\FIDO2 authenticators. To do so, use the [Bluetooth Policy CSP][CSP-8] and the [DeviceInstallation Policy CSP][CSP-7].
+Some organizations restrict Bluetooth usage, which includes the use of passkeys. In such cases, organizations can allow passkeys by permitting Bluetooth pairing exclusively with passkey-enabled FIDO2 authenticators.
+
+To limit the use of Bluetooth to only passkey use cases, use the [Bluetooth Policy CSP][CSP-8] and the [DeviceInstallation Policy CSP][CSP-7].
The following table provides an example of CSP settings to allow passkeys in a Bluetooth-restricted environment:
From 106690c1d3328c85b7f81569762f09400864615e Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 12:18:25 -0400
Subject: [PATCH 12/49] chore: Exclude aditisrivastava07 from contributors list
---
windows/security/docfx.json | 1 +
1 file changed, 1 insertion(+)
diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 2e3135282a..c7db837e59 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -55,6 +55,7 @@
},
"titleSuffix": "Windows Security",
"contributors_to_exclude": [
+ "aditisrivastava07",
"alekyaj",
"alexbuckgit",
"American-Dipper",
From 9e588119463800b1916860a5519c17be61cc4a69 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Tue, 23 Jul 2024 14:09:10 -0400
Subject: [PATCH 13/49] chore: Update passkeys documentation with improved
Bluetooth-restricted environments information
---
windows/security/identity-protection/passkeys/index.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md
index 7b800e3e5e..7dbd0f3728 100644
--- a/windows/security/identity-protection/passkeys/index.md
+++ b/windows/security/identity-protection/passkeys/index.md
@@ -325,7 +325,7 @@ The following table provides an example of CSP settings to allow passkeys in a B
|--|
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowAdvertising][CSP-1] Data type: **Integer** Value: `0`
When set to `0`, the device won't send out advertisements. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowDiscoverableMode][CSP-2] Data type: **Integer** Value: `0`
When set to `0`, other devices won't be able to detect the device. |
-| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing][CSP-3]Data type: **Integer** Value: `0`
Prevents specific bundled Bluetooth peripherals to automatically pair with the host device. |
+| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPrepairing][CSP-3]Data type: **Integer** Value: `0`
Prevents specific bundled Bluetooth peripherals from automatically pairing with the host device. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[AllowPromptedProximalConnections][CSP-4] Data type: **Integer** Value: `0`
Prevents users from using Swift Pair and other proximity-based scenarios. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/Bluetooth/`[ServicesAllowedList][CSP-5] Data type: **String** Value: `{0000FFFD-0000-1000-8000-00805F9B34FB};{0000FFF9-0000-1000-8000-00805F9B34FB}`
Set a list of allowable Bluetooth services and profiles:
- FIDO Alliance Universal Second Factor Authenticator service (`0000fffd-0000-1000-8000-00805f9b34fb`)
- FIDO2 secure client-to-authenticator transport service (`0000FFF9-0000-1000-8000-00805F9B34FB`)
For more information see [FIDO CTAP 2.1 standard specification][BT-1] and [Bluetooth Assigned Numbers document][BT-2]. |
| OMA-URI: `./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/`[PreventInstallationOfMatchingDeviceIDs][CSP-6]Data type: **String** Value: ``
This configuration disables the existing Bluetooth Personal Area Network (PAN) network adapter, preventing the installation of the Bluetooth Network Adapter that can be used for network connectivity or tethering. |
From 690731ec56a9e8838158c533c5628ec7489ec420 Mon Sep 17 00:00:00 2001
From: Aaron Czechowski
Date: Wed, 14 Aug 2024 10:49:24 -0700
Subject: [PATCH 14/49] retire s-mode articles
---
.openpublishing.redirection.education.json | 4 +-
...ishing.redirection.windows-deployment.json | 10 +++
education/windows/toc.yml | 8 --
windows/deployment/TOC.yml | 4 -
.../deployment/images/s-mode-flow-chart.png | Bin 31386 -> 0 bytes
windows/deployment/images/smodeconfig.png | Bin 65603 -> 0 bytes
windows/deployment/s-mode.md | 57 ------------
.../deployment/windows-10-pro-in-s-mode.md | 85 ------------------
windows/whats-new/windows-11-requirements.md | 2 +-
9 files changed, 13 insertions(+), 157 deletions(-)
delete mode 100644 windows/deployment/images/s-mode-flow-chart.png
delete mode 100644 windows/deployment/images/smodeconfig.png
delete mode 100644 windows/deployment/s-mode.md
delete mode 100644 windows/deployment/windows-10-pro-in-s-mode.md
diff --git a/.openpublishing.redirection.education.json b/.openpublishing.redirection.education.json
index ad621f161f..95ef6b4693 100644
--- a/.openpublishing.redirection.education.json
+++ b/.openpublishing.redirection.education.json
@@ -92,7 +92,7 @@
},
{
"source_path": "education/windows/enable-s-mode-on-surface-go-devices.md",
- "redirect_url": "/windows/deployment/s-mode",
+ "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/index",
"redirect_document_id": false
},
{
@@ -147,7 +147,7 @@
},
{
"source_path": "education/windows/test-windows10s-for-edu.md",
- "redirect_url": "/windows/deployment/s-mode",
+ "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/index",
"redirect_document_id": false
},
{
diff --git a/.openpublishing.redirection.windows-deployment.json b/.openpublishing.redirection.windows-deployment.json
index 76f5946caf..f56266b33f 100644
--- a/.openpublishing.redirection.windows-deployment.json
+++ b/.openpublishing.redirection.windows-deployment.json
@@ -1369,6 +1369,16 @@
"source_path": "windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-signals.md",
"redirect_url": "/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-overview",
"redirect_document_id": true
+ },
+ {
+ "source_path": "windows/deployment/windows-10-pro-in-s-mode.md",
+ "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/switch-edition-from-s-mode",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/deployment/s-mode.md",
+ "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/index",
+ "redirect_document_id": false
}
]
}
diff --git a/education/windows/toc.yml b/education/windows/toc.yml
index 9442e1c3fc..1774ae6103 100644
--- a/education/windows/toc.yml
+++ b/education/windows/toc.yml
@@ -16,14 +16,6 @@ items:
href: windows-11-se-settings-list.md
- name: Frequently Asked Questions (FAQ)
href: windows-11-se-faq.yml
- - name: Windows in S Mode
- items:
- - name: Overview
- href: /windows/deployment/s-mode?context=/education/context/context
- - name: Switch Windows edition from S mode
- href: /windows/deployment/windows-10-pro-in-s-mode?context=/education/context/context
- - name: Deploy Win32 apps to S Mode devices
- href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s?context=/education/context/context
- name: Shared devices and guests access
href: /windows/configuration/shared-devices-concepts?context=/education/context/context
- name: Take tests and assessments in Windows
diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml
index cb3fd2076a..b47e231d25 100644
--- a/windows/deployment/TOC.yml
+++ b/windows/deployment/TOC.yml
@@ -367,10 +367,6 @@
href: do/waas-delivery-optimization-reference.md?context=/windows/deployment/context/context
- name: FoD and language packs for WSUS and Configuration Manager
href: update/fod-and-lang-packs.md
- - name: Windows client in S mode
- href: s-mode.md
- - name: Switch to Windows client Pro or Enterprise from S mode
- href: windows-10-pro-in-s-mode.md
- name: Windows client deployment tools
items:
- name: Windows client deployment scenarios and tools
diff --git a/windows/deployment/images/s-mode-flow-chart.png b/windows/deployment/images/s-mode-flow-chart.png
deleted file mode 100644
index c3c43cc02778fe98866ba519e076d9b3809d09f9..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 31386
zcmeFZc|4Tu+dn=CcM)w!wu+JzqR8GNOGr_vtYy!>4#S|dN%m|BcL_=M-7u!jzBFW?
zF|sqvSjG&-@;hg6-*@-3d_K?b_jz95@Avn8{_wi4aUJJ!9p`Z#$NN~$EBNXajh#CV
z?0`TZJGC^`^dS&taLf4pH%17AL2f@R4*X(p*VniJ$!X!A06(_boYy@Mf#ip?t=y%N
zZg_M|pTd2Rf-ss5*
zbyeY=#seJa*75qvBY^(h12)W|WnSfk(sz7-*4zC-O0pdx#eS0K50TqAGYxV%PS_%iuCqw^q^nSVIX3Iip3{6Q@ybgVkDml^$
zC76XJV-m8%^|X94Y&f+{d|zOcD+xy_B{-F+stTxJEiV}w#?yJ!
zSI+y*#AG*4WdU&SQzDyRVLq>k$=&`aCz6bls2m*K!L`Zfeq-}5bS9H5=}+5G%!FNF
zU7F~tao{ra!2;9rDdOc*%M7dWV9Cl6KUy`v2ue!%efmQ}tb8AgO(se#d+v@+q+JNZ
z(Iz`0r)(g|s2=n+bS=HilGkQHXz1F1w`5w5rms
zaFxW=Ue;=>x01tIWKkUGbv|bHH>5=!=)`0?Ztd)Il^8^CF8nmOraDOG9h;d{_(qn>
zKv~qSFs9!6Mdp1gQN@ac28ll;Zi^XZD1o;r=x8793UsR`6HnPik_=4RSxau2*KTH%
z(Yc>&kN(DgZe{-_?^eoCZ3Vfn56JtF?<2Bx9RPnZ8v8R^!-e1rms5M(%wB=DqU_E*
zMr1~omnryJ9dDR_+S;gHdnLTWo*%4T8Pl!X*fJ?;0Ra@7#*>k>pjyfD%?Fy7j`A!v
z6U+LP3bV?>&w30N`1F4>v6#24ZR)>ejI)gwjs7YSsI!06ho`)z`DULIuNBH2>dG4N
z95AeKL0vDdmT*3*EIh*NbgM?fD-)?!j~B+~^E#i)n9k1j#`~x=q@j7|bzUwq`?vQ6
z$iev2hN6!WAo|z(#VY!k{b$D?!&2>%b>s+;3KMfNZfV~{(e_Zq!0Rt5jNva@>(7ME
zVcujPIALgLjrHR=H@aPH?W?9ggIpt3C|5V0)i!aS)GTot%c#%J
z%0tQ@$5Kx~Js$%my9!0_P?gAw@a?*Z53P=|+K}EZhZ2!xW*+Ydphq@Dc54j=7@^Pp
z0|jz7oM%6BfRQzfjsL8K%Rm|G!O;J@A7xc$1HGI)1DG8(K8d52rp0
zl5l_M23qf1V=
z9UTdZrT(oGp7VZ0hk(!7lHos^=OqXS5=Dn1IpM@NH{?gga-E9<)k@+-N7AC%PWtEz
z`b`y^J}p{c5UXEdY$S7rc3_#2Wo=>3?WYLBkANgL%9X5#`zR(8_uF-996iv6aT957
zen)g;{XWgOjxC;Em+1-{Ga1$yxtRO0WaLx%h?mC$Y}VYl|`c%v?aQHhGmk&&dg
zU?SA9SIVZk;sjv@(*fd@%C&&e-dX+UG(mHADi}^1pL|YxdHW_WT_czApg<{B}cl%@R`A_Cw0&H`6;7Hn1p<+Fa%uh7_5Wg}9
z$r)pKJ5ABKxr2+uL%%ZZLj_eRT!L-ccvrcv$A_P9&3JxJ^rX{t9iSFUHg>0J%%AOe
znle-&_f~8^>GQ7~2AYy!NRdR0cU@Xs7>nD~srCWxopd#rl}cBjxMVMydi=?pv-*^E
z5N+drojOoD$h$mw2!6<{Sak_W>+yxgjKD>jF27$*s+G7Xw4SaKle?)v!9?f^)D3b`
z2!6Ht*o99f#_J*HenAb>BaB^yGI0bDLW}+wV0QkAT?!0UWw}ou=k;cqh}TT-Pz|h_
z9b&{88^eLZDd%%ux!zDI4gkT|kJ()#kfZ6N3-%H-$wMk{vHkqKDSSxj5x145_mw2f
zn|b&7<%^}X#hfy$!FSa2p&4EaCVQ`I5Tcp(r&LC^GQ2yI#kSH3g`^T{UENC6GQ`!O)_9vJo2>2nQPa%+W4?sQX`$s7nb|m4
zE&Nea{piv$=^G6*(t2KvlfCMN#j9Pq(8?de1y#latE{aFV4cZeVL%wZ-uPD>%UyIXN@|CJ5{QtYwb1#=ggqvvN13n{UC|gRXyp
zkqZ*y@fM}4jDO$k{iWtyXzY6Pka
z`;iMHkrh3^8#PJE=8{7d+ZD|)uXY>vlg9aS$#q78T^tq#V>Pa|X0oOn<`d`U&XJc|
zRvQTqR+hfsf>Yf~jtBPX50>ytIh95(u0^XonQfH2L#P@}Q`V>`_RZ_IiQm&dR3ZzfJSDL3di^K
zq<{2O9OW}Cwn==0SEG_7V2pjk?>PGNL7yZ5Shyj4%1vAN`$a1fRV1s17+Q(J%GtTR6oPws`kxqRhhi4N)U
z@$$SjSv1da)DXi;4;$anvu;>5v-eSwp`E&<$2(@cA?tl{hICrcc`)+o5vY*K
znawugYyO{T#3^t;H2q3NzXc==f!wIGe`
zc)v;>tFRi+P5vHw!H}9HNq*+E?{v6$-h1q+eV0-`#Cx-8K2cfz9gLX1TV(kH^P+O#
zPtCaO(eI&Iz280eqXKLH`UkcOK+SWfVT^WCbapYxAQpb%8f`Z`NWj9tCF(AO68>M=
zRp+uglFe=mD;LEiV@{DeQ4b
zIQ=R+ICF^!fasI00tx|Bq;bqj0dLJLc9~20fnyt^o2dZb`O(~qq7v2X!W1nwekFf9
zzqu!;Ly(S%J=s8Tj`6a%tdDPZFfz(bQBYm`9C>%*cY(t7f%5UtxisDyw08eDfoj{5
z-Z*s|%jD-No=R$NI;%d5c9z!R0hZ;NVGSwBtDI~
zE6LQks(_hO#%cCzCF6JJG5`HW1l%d8ihw0&EqLN6`N
zH+0xR8=P9(4iY*}6u`+w!v@11gY(yMnr!?kKDUobi(yC8kdgScuWJ?oi|ZKYoZ=NR
zGnKh<2A_k|2LlAp!pJ$C{x=279ETgfh)UKmX%&qe>`|e%&Duc_tkQuadZic3-=l|~
zBIk8TXR!_ft9Y_hpwJ>&Z}_CUTrBxJ9Pw?Zc`zSpkGw49U}{-AkMDkz>U}8Ze~>#ROIIsS>HK#
zxDgv?T7JxaAn9V)slQ6NyZ<1};w)0H8VKRW(B4THArxoXlfKotC6&>U4E$tb*&
ztZZ|zhR^-_vKr;c5O+!#eXSz}tQ5DPS=1L70
z5kf^R?w6H368t*J_n^%r`Cvf*(%|zIvDUh{Hr98}btz7k4bj3`)8lESO33|=6a9F>
zDcQLiw>f7BA`I^~P(gkNAM3=C-j}$MJ}B`j3yL_Ewm7lo4gbuqS;i+xW~*WE>~W4b
zHoKE0T#-_j!;+^~GxN2#bH8k>Xnl)}r$M3O9^RB3&N5Y@16hdt$u*CZ{f=VcCgksD
zokWieLz%-k2Nvf?X9Hako|n%C9wBslsaz3vT93qX4CuW!!OcU$a2F5^C#dCPq~*@L
z4spg^tVg@#^dyRg&z}yovhYdGLZKZCmADDBIfMPTF8J-u0+6s|+6!Xi!ItEXnbiPL
z%8JC{#+D?7zMgyyGaI*yjv7nqZ=Luem+uw^Rxt|9VVsMOn6{Q&Kvn(nqJ@YI>{8K1
z;vbTrd5(K>(+1K!X_|1NpzS87oh
zi3S;th;oy1L)csBYVsxM+ED$bVt|~db5l!Ioq!(R%=7Z&o^nZas^k$Cm#%TwjM}N{
z74*=R@ScFB!T={c(IoEnKUAuI0;sI)=JI7nG|z{3{r$#H{oDYI^(K}MR}N+FGh?0k
z3Zu?6-&6uXOvkxM?_|j!ARLCl=RaRo6okJy0NUGd8v*zHYpUe+`lXT1RD)1&8jdS!
z^M`ri0~&W-GJDSg`gwqFZZ++GrUAei*#DBIIkmI~;&Mi22eN6mLAgwe`I$AqpAVtY
zh}ygoQmGOQ2VkqUNmiBI3jsDNoG?Y6qAvy3`^e~ZZ5
zXUI|2^f~PbRbvtaPvya6FAMI^USFPXoE>ND7yycNcxfSkL}3FzZyXk12axd;jYuWH
zb!g1LXg?TwCjf_V4QmiDkfl8#Czai%PTJCVF{M~#OeK5JhVxbo4Dib*^XS#kUI;l>
zdp|{C7j52D(~6ta6*S<+{TXLS*V-2*Woc5{m?z@*4wc31e)RNlbKG7V`+&JsI!OUz
zm;caS0U1&pSA};mZq2xKocj%51+lgmw{)*`T>Z`b0(XU1ZAATd4WS=h$5YAL0hKb#
zch0cG=M;<0sN*f;ja=ZZxVeO?u2cei>JU?xmg^?$trYkeVICt;b>)nrld&H=-XP{D
zWrHe4BX_7K&;Qzyeoph>8~%~G{S(jrTTupH#eajb_`@pw)inIOJ1(jRlWvA-p(6>A
zi)_Qe^ewllnQLN{tJiuGQ&!$)TjJ$)Z^Po8t3tm{Gy`#mA|(2~HQVru4eHZI)7q&r
zl2vZA--8?H%xySj={t6{s4p>EMs9>;rs6d_^{pPj>kq}}*622FMqwg7`z8Va>W?3t
zUVA%Em0uha@+E%_(U3I8oO;qsbBBno3Jb*hJ_vTIJfv<`AYpHh-O
z$tvkAm&*}Vio`Qf3GlB<3AEmLpGrR#I4kWSJ05Gxj#!{sJ&b4g*i1d!XafJ+F*B8Z
zcJrPu-_Tm6DT>6kMdErK6%*|YqY_m}Nj4aiKfw9@!r_80eHroDsko!iaJSTBmueio
z3p=sXAaf9|^0ek#2EUQXq7~jVn(F9zoFJ+z-C6K#MaZGy&M$7zlj4^1`cbEivPH>4
z(X4Y51YWs7!!Ft3R$rA>E(&T@EOj-BSguj=03dxNg;QlOPJa#Kj+uyy2;jP}!D+G=R&SBE(VZvDqCxQ=%q>e8UJt5j50;)141r=v%y!a^Pa|aKg<}&c?ge6-D
zLUM@dRdouLqc>?T7v}(*a694vs$e$1Jyp&rXUdWJRut&T4x-J*ui$#S
zKZbDl^Vgk2Q?xap!@KUaqn&k&uRo4Av0w+)iI^2Pgg^`QjZKaulGJdi@O&w7lIRYe
zdTLKpX`-R>b08G==y1=AQdM3Cn_MY-xo;xwD4|vx&3Ub9oQnpW6#Z=+tNhpIUVgM|
zoQ>EBKAct*c%GH-H3n7F6+*f`fl7%Ig!_)zFUIWg;Bjq|w1
zldOGr#m;{*OdsXB31+!LEhN_B=IlluEbfvpPE0mBy=CCHz@xP72w7ht$HNMKe8XE7
zIVcJowy31}I4QaY`0suZg9Q@?WG~jz&!x4OS&HDTG#C8=xc$Xtg7QB7CEnLPntK{lw^iB6Ln>U__G6`
zZ-EErBtqCWI-?0*Nke*{dDMlXiS`oU^O1Ds8~XwhhIx|jEH~IH`|ySd3D%4Dk}{+0
z;a0_~#rey=965Cwem~pP=cM^nWux?pCL-CH@zwnulxjW67SGJEe!ptvyDxmOoqG0{iK!X-q{X`#m
zys;;=xl|=)G+tf_S7D=Z{b#W
zXmF*J%f-VS?Pyn7pq_h~!QU2fb3u9c((iLW%;kHX3M5bx>r)A78W|<`^Zf6lvAiEe31)1-`=*L5PuoxMnQ9o1
zIpu}V30DeUky0*GzQEr#r}=C{!bNZM45auwpyRk)X3*(G5j^8ca3TKj$G~>oN{H`)
zKO`0zJ+;H7v<)90O50mR5d`Ck`UDoey(yNqe}s8=NNIt^H+i>a^u0)q61S43|uL4$7zrqK{N&8HA4nEbG
z3zmg{7`}rLx?9HhI*+6aPwv1CWGX^@1m!{KRdL2I|
zvqP%K;<8GA6FTa|oJMYry?b1g{GF(4$Etj}%^6rAzpwnWmf&?Mc{JO)8UlH!!O+sT
zusk|*83FY$*yfm@FOTdb2w?Y}H*$1r>7c5~UAlD)<%0mu=Kb^@#R{>9vK77lKVgM*
z>U&l2Ve2e#`{*&_>(W#?BM?XP)sVaN{fa~p(yO?iM(<^vxq!6~?MLhG=HB7b@2}Li
zGT+rnr%Fz=_n%u)CyuB8)*I55n1aYdgBG7JFtj9Mn%1bPSyicthiz5k9RLUMv^i0q
zX4X8tlCu!z^gQos;5>OGa=F^ishl>K>7V(_Ns>7v@aT8=(EU}cWG?NVPFBvww>}*F
zjW&fMUrEQ6_KY|fZI%Q?M3zfb#)z^1jo(B^z%-#}9b0O1TWqy^y$$!(UncAonI
zWN&(RNE^v6l{FpOJsa~`(c%EglCtG^zt9AA_oH6yx_c{cML;!yIhhYOaBg~)lXDMt
zw-Q*T8`CN4TA$hBg8>u1yI%KJFXti}zS|%(h-&Aas8A@y0joGDA6(|)IR=Sy(_wD}
zd6&n7Dg+){=lIrs=Y1$g8sqHhUwa^emOFTG-@xbi%$uJbjLxTXs=bl9{@mE9ona6i
zx{H5@%O?!Pq9nV__CuP?^_~{#kCF$k?lb@W#IdSfIqZ0z-wrVEhXgWS4P<~EgZ!i0
zbAildUbQA7WB;+~`!8C`|0U!Z_ubtKvHcFGjrbOxs0kL`arDtQBh>OAqS>v?DDi%W
zlF86f;9CYXSWIwjM?CmdHIV8=5GAH5D?9r3By$4WPVB
z6^^646RisZIjBbEp2gwNZzIM1R^7j18Bs!CUBT;^8zCR9og{L|p(otamQ4>NxylfM
z^Nh(*B2R5kcv#FH-a?Z2g3gZwNT50>E1hqlreX5Q_2x&|ftqHn%mRITtZp||)h)&E
zYoGu8#kpIA8V9>^Xc=VrKn-W42B(8u4R>iMZ||(r
z!Eh6bZOI+Njna!gjWJp6bBic+A;G6KS~NvfaJ^t=;zAfhJq=^jGM*4Ve&EU;XvA#(
zJ^?b)S19t+sQSQOYPeRiiiv;-D^hwY_B`N03-*@VnQjMz
zCu-sYi%obzkEuib-;zv>Iheb@#ryPsiN|SQRzfKLYJze1E4nKtHD55kcB{w^96?zoh;#a{
zS7XN1HNzRFl3gzvg6Q_BLot=3oXfmE2)7peG003A>UrPmZmMZN7?l~2
zz0E|9N$NE>OFIAH8>!rmPxL-TJ_Y-^1t9vg4jJFNgE*_;KK|9}_N(|(_T=}ZNiz;)
zzKA;#iO_Yy&b9{F{6fH~W(OU&X9&V3
zNL!u8;8Y{)DL|3Lg*&do_aq#%s?ZUsl?EhTD>o}_`9+B&XCH*a^>j@4|Z
z%uk4ErafJ(g8@6W3JOVtl|;?iX)UnZwqO`E;%(VA=Y|z=D{o7`E6+z}VlqYKeP?@T
zWl|-D5F#=Tm5@I{nse!mpv3H$j?f-HZ9`FK%_B%DX-5fY?dxhKPnh>$9T|5wIz*6b
zKqRdznB&DT_aBM?$(F#Ire1Q#F}Ud)TsS(jscWynypifzzg22%y>{+iRVA8VqS#Y$
z1u?|}lnuzdUcW~XW*0-DX+_|swZAH{%a$skNav-7%*Z&?o@K*)OKue(@&~28s~=1I
zitroWn#vKkU~IV5yUvD=IF*^Xd=MnB0x^wunAaz>KT?iWh5cQve?5*DNeHmod0M&j
zV7aUNrPy!MW8{;7j_xhC3wKrY+g{F20&&n}BcOGP@`{d^nzhM|GmX5ERgQWCiQY%^
z^s?_!72wBtH*J8fZE;ZYPVsIYYHpR)1)5Cr@W!9R(X{)bWj4U9Us
z$n0GO$AeO4dsX9uJ(v0_z7m8o6D^KTsPk2Pjo;z+tmI78_DTqDmJ~H1Bobol9@n;3
zo(`OM_1{U-(7qC3?q4EP(%Zz|liwuQkKklIW6`!Da+X#+i1*oBr^1>U0<_$kbH1
zq>+f!iT81*d4f`0!$Lp{?losXf(PTW-2u-;bJ6%F#s5u+C~l^nTO+OFLzsYS8@o-pOerR_D_~
zf?29co!zQkm>WA~>7M={3jBD2jmFJBv+7>&)=x2##=YHuVzX^$Uukl(oxjh!H8#DI
zaH}F@)&YlK)+c|vV%wf^@;GX4HzNDf?3Z7{6)|F{
zsNpkb6{KhZkaliKRFp}_z<9T&)1T%U5fNO_k1X!*eWep^lU*!UOt$aCJq%Mhc6Vo3
ziD>zyL?og!o%BH0J%&1JZ85LW?!3=jYwiGl)#JZf-@OTktvHmuQ^oM{CL@^%qntQ>;fyXy
zEVRnSh#{7g{mI&w7B@k-RDWMX%a8|;hA)+goawGS5?DDhdud*$XCquHX5(cspRG5s
zzH6
zD-XCWk<;e4eq}e`$Lh!dt^OXSm^2S
zF_c)w(2lcfme-w98;;9;a3WpC%r-*Y#|FO=@2A$yqgB|#6VA~Fj@??nB-0AQAads}W6E+oqxm%*84A0FJL*;x_
zH_i+jWthJu8=*R+_(IhS`V$IHhq$I3^&#^sbI|=g0X7#u-My>k=^70Etj68<8z(XDKjP?f+%xbPPR){*5F{-a>F8-+*N;us9yj+j^Jw}r$n4r
z?CxV`S8|+nPo=#I8S$>De**~^oT?y-n+NlkOdOJE(;H3;5jVo!m25rP)#6a>%Ok&!
z7O~Bb;L0=pD0;7&8JiDjWV|k`SpGe#)-B@*>!`n}z0+5$h1N<(81pUiiRd5?uF`&N
zxnA4_SePGoR4N^?;=*kQO4DE>o#)W3&N
z-UAZg*MPXNTX4Z*TprBO>~4wZU!tr;k&pnk3MlA)L$_$I;vN!=;Ey*l3tPraR9Zfr
z8gOya2!6@Wm*zbnG%4#(UcOrf2XJWNgsm|V5n|HW>q0J3lj3iuwSa0RO3;3O20!VE
zjxD2^ae4G6B~kGj!Ba)rMiOi5UD`+eJ;~+e=_?79pcikNvzMVOL8YG;h_$43@QWR6J!e1P
zsqTw!H956m!dQj}yZRENOvsEC=NbNFk@jZ3>)*hOjcISC(za&tUm%yZC3wTMXqhv5
zQj6YGr`XTySKaoROWQsP%e8Bdd$QqR(ZPzsk=HvehcW7~G{cOHkV>G{$9aSBllN&!
zJIyFiDaZAapE;iWfFp$#p)Y6&ejH0n&jpFx*60%mrbXNDjvm?LNQnZGcxhevjE6Ka
zuNrINF)TuB*8nJYI&HNkRsKqp$z?@)S5v2~)ic=ce1)B96ePTy)zJMC`Bi3OF?~+&Dbsh10WNLNVLU|0%
z*E8Ruxmv0_q`*P%-yuwptB`-$?O1kskLa{6b`NBi6bQbLP9|0r_P%8_{Osml2%W@)
z+z2XX#_=j#cn{**e5Q7kmIZ~>>^(JIy;X(Xzl&afNPFtkaPbmI68uce?oYVoj0ds$
z%x^b|I?mts9{>3nqz%f%IJub5I_ou`_8n{6(e8Al(xs|LF*S?y=<->&!VX2u%csvl
zc7UjJ8aCE+PaDMD1(WWRT9&L}7mg??_e}|G4zMb`&@T^*wkzF3PaTNzjBk&bp=A!_
z3)S>~+Y5$BsR9WC)*Lxc5bh6&!&kZ6Cex@--ytR$f?4bXBmrx^Fye}LETi%E6s2mk
zVrw%ROw*l57B+Utsey_1BA@^cpH!QE0EF+!;80uD{4hJ1G&mBt(C_mkaqiqTkXRsw
z=a5^Vxz_^4?~X6tA+DH5C12exq)^_exQ^2G`5kbJS_%>jEnT^tw8?Ox|@Atp9!7>+vLbuEb>eZ+E6y<$P^$@=o85
z{}fWK_^y~Tn67kn-#}%@+Nc9@N>Mrsq+W`1!^kbjy)=erlcy*8d!Vq}8%dC?)se=k
zLgM2rz{Q(XyaBlXUIdaL9mvxdMXG6e4m}A1IvcF-@1YEZ(8+#00QW2LG%}TdA}G1a
zLzmuL&w=IT$lj+&8FLS_-?XP&1&K*;Ju@0ddTUcAlHjeTo%H0<=o2K#51hTu8yhzr
zD1VbH_yIm+#H3DnocCjGm^}{Nnm3U~`f7{*hwbf$8`dD%*I0k;7
z7~mbjuIzFSx~=tEpu03F4wt)HBkIKk7iE+t8S4G;r@H$-LkhilzuLk>iG4%$|A+`&
zKZaW3UH-cMVRc?rYd@Uxp$sX3*s<0TfW1LV0uwe{r(mte-2-x+)ps33l^+0^mtw^y
z%j%`-zdun~Ywnd?b^Sc$uEM{lGf3#4UYhKBFXHrV;49+6qe(s`kki?3u?zG3)0^d+JDB$$V?Jtp_Bw9z
zU#w|=eB9yjyau}jqG_Z2Wsk`0smQ7;vfq&>qO~*3Sr6cJkU-Im{|HZ8zI;9=@dMV2sf$$y3mSllX%#^Wcu=L)6oM2>tg}2pDo`$$Wf#;-J*&gi
z6#LBo4Ytw>MW;D&cnAxREgNe$JC&O*xb)H%CT3%7aPSZaAH0DmN^fr{Z)_VI?#V(s
z=cmUfo$!P&7I+kJ2cyJP~+B|od;(Raw>M;z~i(tnPCK;-ex0~R>w2mmI}+%
zPlWd7n%g2O{fH4-La`h#t@q>ry_g4N(YOXE@I^Ml%-fFE$=({t_0E(A8QN*NMwu@b
zbBnZ`-0ZX!M!of=ypgDvqG4dJE)KJ7FQOqiwZc6(5PUyRhfvTG+j<9Vd0sOWEXZ4a
zRs8ZZn#Z!3)I!0`e}^VV;{8F1u~K>A(?u@mjJi9O6$PYZL`7^NQ7X=RC-SrckjTqb
z=%#5E2O9?2p*scGJw}*4J?zuoaxUQkGd~XX3|OoaFy{lgG`^pp{3L*}QeFBKB)wf);mpk9`k=1}$3n?9$yw
zI7!G~v5WnY_DW(HLZ7aOF@tt6oG9d1qb&AC-^p#{yoZcQ6pwmc9LMXh*klgt%bGxA&$5evtLu6|hp5%4#h4%xizZ2_k%MX^7yOnI4jz
z74{XxRYbEH`5lRuj2ml5ZU!FF53-tzxipi8PWU!*=Jsm*&W4D^9o?YD$7$_n&)$OH
z{1-4CnLUp~VLohmyuH34US+l-x2|>P7Ww9fiO(ib5jBt#7huaVL)
z8k}C-<~@bfOAKOd6u)J0z{HXqg*~Z|jMpGYF-Kh=QIVG|-yOETC)PKw5TgBdIsmWg
z-==IpO94;2iKF!4@Fh@82I4C{8v{8pFFpVRy>~v3&+M-lQFpCnTv;Fz<91>cI@lcz
z0!L;+BER5MOYq^f?$x(9NhafSIy`RsHGz|<4`L8HD$LzC%q0D{i!Y8pt~ODj1w*DP
zBg{TumK#lOsx8BZJ=!SttR21@XtJ;{l6#0*2#N)zkTR?Gn%5Ri4(A?9(zpx}>IO%@(`As(xGsl0GG
zc0J`SJIDv`6hrl_8oVsMfqS?ncKH`lEveLX-itU8bD+m-0~E!c@~*b-U%qK}mtJMJ
z6~GQqlv_%tRtxLs!!H#n*PrYql}6(a8)^`~w5{THAI(G_UgQ324QOAzL$}UCKwU~6
zh;g83p=aFr$$J&+7uOzj7^?lExN+x4zk=hh*PJzZWAByc6&>B{iUS8l4u89G`6Kmb
zzBsBrEBBcYAFcW{Nz?PCcyWoTnJHGYn-$nW@EwVY6tg<`t?Pl&hGx43_-HfRLL{O_
z21BFiI+6OpM+%M-_{6%U*BcJhtxkU2XKo0$I($VR{&>SGBf1@hB0|LF9BJ9(fY9j$
z+*=$7lKd^K9;A~ltpO@yG(cRXc76K1Av{e`G!yxG15t@ZhS>XutbGEKbvcVz=K)yy
zYdR!D&H4ry9K|2
zbKSzF_cES}0?ZJq*9_2?2yN2zvZO6e!7O3fa<2-yK^8i;LXi&LfVJzyuXo;X-Y5>%
z3pchc$LI&84T4eV*sTZ2q)p=>J&nDE*00yI_c@fjV|V_MIG3Sx{<~Z@h8L>aQ6u+`bv8VuCG|P8ihx8g=@=8S(1`(u(NjQvbD4pI?2ke_b@`
zfBOB`h3LR%8jn9<2K_-GzwfyP*8hM0@jv|dKSvx~u7V@|AT3S=-(Ktb*#QdGmlk+#
z-Ume%Uqfs~)epq)cvg+R^5V1<*RFunr2TaeHgh6YReya+G_L96`DaixM`+c(;|K4m
zDV`=j&kTIDd;0r1mRk_&<>Rjt#D1Gq=q=3G)?pUOvu&-BIK>r#daKMw>tlTdorSj!
zJ17!pyRLo@5Y+v7WsycPc8jXMvU}C@Aj14@75{cAu86?YKd-b7oM|N*Iy)ad+BZEu
z{uB%>@aL62fd>j255vixq_5Y{{q=f~=|rHiRB^uDQRWMuL%g6Kwb##m*fmWU56cX^
zeyA7wfISaFMtz?>BO|tJk7*GiRWY4W|FJDp1FFOPZU>scVHwDr$GWK66@6R{p;%#Y
z{NRmefA&Hf*%#IH+oNr~pv#t`{fEx011g!5>Y5Q-ZJS=4qx}dY=!ERvV@VsK{T`kE
z|A@wfH_ctqXEtXn2v%O?n=O=;wqi`y>IcCxLMcx%qq4oF+q
zQa;rsS#j7o_usL{R#dk6e`q(!)#j!kM}>deF5Qb|-7A#W^EfjwV(KkcfF|9X@w^Wr
z4yIz^dc!yM*SR`FoAZmCBRj}3FNC4_Pe+ZwQ3@rc&PDwUglU`y5#HRgoz@NI5$MAF
z?_E#^*LUD?CiZ^dFonGZuZGItWala&DAh=He!{g2AJtiv+jEk}M=IeI*RDPKfAZ$~
zac6%AS1${9Pr_(8}#h9d_({A8XkA?YA+IO#B
zYo=2~Z^XM}G8t}fEX(!dNXbC(jomnL?*W($Y&0&QV5KeeCWIM$+O!{OWCX1$T^BxW
zU24^Mkb<-}d}pE1!tNwuecD8-slD0D26rZ%u{!D=b6ncM&!wB-BfY+y*{|X*=w2G-
z@9KMS0&MZXgx$wulurcWz=y?#FKG8UQTyJGimDPZ)s?-yezu^HXNdMqu%3=HSe<00
z!gtOAUO7wPE5Ad;n7Xypo$m(wRrPV@x-T`3mXIaE=l(<$hhBM}#%J(#O(DKrA25tM5s2WzFJ9;hRS`yVOqmoQ
zbeYlf(w=HUC!N>3?Mt(ze5;j_=VIc8ecVP%_}HCJdes!OL@?83|3cc}{dcE74=;D(
zrk>ka7N2abZL}e2Ys?}#aH>daS@#&NUDc8Us~lQE3N+V
z$*bYc2>;bd$KpZ_tt@Y2@#)wMAjgO*${A--f%e&&-c^*yfl9Q*xEh_gXeY;aI|1<^b&-nVCB{Xq|f~<9zTc>
zc%vOPgh@EwBv07(C*uWiBC?VT$E0#h)y0hr5{!-S%HZ@utI^YD$kQFm;G307cF)af
zS4Km`(G+OVdd;-p;2rByaFiVf1b(rK=TL-EfBAN8uiEhO*~%rf{ah)+mtDRNd_iM<
zuzY0P$LS>OYtp_y_^V&S>{7c*JWj}C#p!wXOyUtdD3ja}4Ap;juBIzj*8enCsr1Jk
z2M4FsCts$Uj5KSfmTDB1_}k>z=g$wqsB}qJ4mY6GJYpL_T1YMJ=(K8O8#q?I*c3(m
znXM=b#3wmN?kT^1aGiULSSfJg7aT%`L<_B(eK`ZS~<}LY8ZH)x|t>
z{0Nxsk=8vy<^)*4a{jk%6wya_A`gyvNWh*V6bME6@2dU@E2f)%hEgnj~>$ip7mX*n?{Z-}`B^+NCU+
zs<39}3D-}Pf0*tFQb)f@}2OEkNT1aRfi
zHtxUoR^-{$*UN9>sH)hvGU`3_06o{gz~NSnj~CcOvmnGhz%V`dn_;37ie;To%F0US
z6s08EuVIU8z&D1?`p2RxAXiONRcyxr5WAQKuJalhCG5!WT>eK$~A*
z$@g$+I5OaLb8qoA_bZd=H+QbrnweV06n~nJkU=ud5$}gbkKWY5AQBS$#Jr=Z67Z$0M
z;u5)gAT(m;^YuWTe43fs_uF!`Ucw@IQd|e^X#}Ip7cMlIJT)v%O%-bQ0AiQ^a9F2(_a6QD
z9T7}4Q)9q%=+m%jifNZ=*ft&f?mas3JG{OX2_E|NC=;?o*IkOc_M8I+KNHp#28gp!
zryMmkA$N~=Gqpc?v~5>9<8Uy5%uW2~pLLakTIlDP{`gptuXri0sRTQ%3zZxO40E+K
z_?Uk1Yc2Sc+a##%A=^y_+v#8MV>kFTpcB1k&?0`v)r0h@upBzl3i#zc79tLq}6tLrH4)t{5%`rYAwA4go+Wq~~E=Kj6ziU$;;B$`?-?-IWU0-4#z
zX1>jdeo9wRs$efx0MeRWB0Dx2r0(?=!89O`yvA{TCyfM_x;lB!9<|XNT7~qvo2G1T
zDO#ZjNgm=GIoFW~Q6Eq@>}xf1=Gfm8OyCF{JKEW&;Z(x%VoD9ligIt~n>Gl^X80o4
zzz|NOZILWq^Dj8H*#+%9Fswv=^B13qW3@|_y!oQK{J?H*)Nh#J$DM|?lS~_PDwomD
zCYsu_Zw}KUSqkcZHh!I($Om0>^xO9P+F5MQmD14M8K;ilY8=g$ookZKNpHMC4!&Ls
z5T4NH+gEv4ErIjB|4)0@9uDQY_J_4=ElXvURVsz(EUd+0v
zVXR7PRm_^?v}~la5+R4d%%~6w%W?|CCrmDqdPGV9a&ncF*qd1*~D8V2zjZZ<+~V^cA}@^f~V7KnN@PGFVjN-RloyX6PR=}*gZ?9;^~mT_N7
z=0)LJbNI{@SK8bQ*Ks&|ubMRmt{9+awxQ
zkeXDG0#aj>dVe-oM{P0=be?O@oVwt<671OThw?aLVg&7r-}lHIB??k@+6iKKb6!B{
zn=m4$O?Xm2aSF9aMBq0h77qSRL-nDm!p$EdRdyaFiC-+(zr<8wfoXjtllWlbna^?+
z{Y6G~!42Qp=X-3OD-uqNuSJ;#<~Sc}NLq`dHPC%vf9i(xA%BQD@di^*fp
z+Scxo80K-BNqFJJgucVFy!
z{uDDAjl!v0iw3zWN)+3LdRiD4XPHF+s|IWwbc|z~9{AT;+@)ymlP|pp?0pA5{@cPj
z|E6fv|7W+2--J38Gg`g!x@n&3MS(2d$YQyjzZB#|q(0^p?Pd2o{BNjpMTk{!PoZ>Cw0
z4=Mt=*tpEYoHfY_#rQyETE)on>taEE^)SFNMPQ4)CSXkz0M
zzy7LfmjulOsAD#6ePxc=c4+ZN1}fOX5%{hFa5q4zc#Vl(&{$(7%_i#ru&MCx^0Gk|
z`7&f8;ae<5*=&*awQ=bK?m)#Hck-0I{(kPTp0
zR%`Kqje);F>M!FeQ5}Op%n!a(bEqdGbZR8~&}BL<%^l
zL;=-^v|Hs6dnk*osA^zDoEA=&*C$#dh)rZ|4HN_(cfYlg{V{!7$`><_$y9m;W=u
zNdqEZg3~ElJ3ISa3tW%~f=LMIO~8%v7|*O~#@Q?SVII~vJ8H^mnxG?|>agp{O#BR6
zi&qP9OC#WmqFH=V(RWWIoSop1_8CZNBtzeR!>%)m=o%8}I#F?*%}Ze!j)OQLT)b8<
zhy|I*V~7qnbBrQPbadRQ`$3(bg@j>?xI;mJKE4C6ObKjW&KVrMuf8?z@TA8_Jw^rdMV5BEuOcB+80M)iLH7AERNIp+Xd^|gW!R@{+T6GOf~TKZ@Wr2S=QheC
z#UW&-GRir(_4*+5$#i9>r2lJxNUgS+58
zbv#$IVBqW4Hu!n?@?ZWDnGx|ywWVDENS)D^6~oK4DOFv5jJ1`r5^$$=NH&rQLnX0JlUo=;*9rjObIaAuFGKt3aCt1Ez%qM
z;#Rvm8)AM&h(6kx)egLmv0LbavBmqT2+`pkpQ%$KGLbh5^Y{RKhfMqAWZ?R>Pv?yj
zg?%O-3bP+$NtFS?L3
zo_7{du1WCSvsLpQfsDSq*nK##BzIGaZaP3yK>fv`j~oU10>v&ra`*;)O*=8
z_IObOi36(c!LSylk9GsMbff2ro;BPG!XT3%sAwsP53qRJ9LT5DKfYtA*ztX_OYvx}
z!P_;vb!(b;T2j(W`2mnai;utO$P3MBx1_{a58*&)p4vH8yq>{PA)E73kNFeozqez^
zR4$alY{P5Mj2@?I)x67hJ?6*xEvm)g7t(E#?pD&;6T3frMQcJst{Aax()_C(jM$x0GBBu%M=^nZG=!HU(XYQhrYcbUj7pvKME8?{lzOa_i94
zWK@KkjZZk|GV7a}<5f*n`g~U}M7wBT5=N40Kmk8B0<&?L^x)Xp?>Sl9-P3upr=D9z
z=thBU{@OWSBpeX?)xpZGx>Gk4mU37$9M>d*f(4L)#(B?jFh^31I42G*t6jIg;k?3_
zDB(CAbM?pgmtx>q*qeOIkjqN<@y)h
zR=0@I0jprG-F^3k+pRPIfxT-wYZgWz>6g
zbgCHfqHQ||m%KQQ1>@v{=a+D1LcCFXh
zxAuIt`Y}=ghOL>=7JvQ2I&It?ez~=&?qd0_=iU2vNr2?pBo)b|-XV+qZM8!dRXkcZ
z3FTFtcU#!|@UFs&`lOp^@Ofdp{2Q-4ZnUpoh__eJTac3hpM>o)j$}r^a6@n)xBd9t
zmKmh~HADiyNWL2zNWV`NKiza@Vm8s(sQ_EE3-BaAi%?AP8k-9);H?UCiu}l7Qv*Fw
z{_z_@z@=ll>7~XCyynzDtf;V*SCd19VK)8xtlAGT=*rJfU8RNsq-*9uesYyVT@#jJ
zt6@okh@~Ra!34y7n*433OyWM=1}FHy5ZkJH?MIm@Jw}PI+nare?FK{?2uqqaPh3gv
z4Y+j&1yhX_Q80Crng*H-JNgg%48dtLmI>^4_dwS$7k96qzar%Mn^{V*_qK9~X|@(T
zG_#BXk=H4%>$Jwb{)&Qb2cIka;^K)1LvgFRlsBXDu2
z9Cro0!=DBt%mJ8unf`urWpI@cNK$|1DqE_C(%JW`JG{ntHL#g4pP6tSt9x6RgvJKf
zmEU!H?yp;9X}>1%2p90?x#YH^xh@`!IycSh7DSy^9jv@uP`)B$NZqs8Q%ZBw_
z(dh{pztR(HrGeKBg}4k9XlTRqa}8MTidJEr;U&b6FNwM1V;8vqnvI7{`=^*IKL?M^
zKq?4K8=Bn68Lis(&H7?F(hd;k~x;H`^b7Rr0
zZ}jK=BdDJ5sKWUZN{0*E?ac~~P^CHO{-d4{310YnL^7K=|6ed-G;{rb2AKcD9+p8F
zSh1zDE76}v<+j0{%>Vx3zxMb~bO)IN+>ChdK(bv0#&9Kt&K67z2o?Sb-odvpY`a8S(kO|c(2Z#(YqYz_+#}#$MvsanVT2%w+HhlC_NUWgJ?~=SAFsV{{iA6|qp}`S{A<~Ri>iHZ-d%cn
z`r^5ysP9qR%r|Y`*l4p|sBEi?xMz~!j(-0(L&?`~4jOK=e028aC%5oFj_omlgge&p
zK4ZDasrY^3^27HuX0;n4<3gq|w6qY@(Avdh_2EUV_5FKmuU6cOgv_#zW#9WnGv2%z
z{7aVknYGvTt+o=R{CwJLy_~vQ$!
z6-yoUZ6L#+H}QXoY%I(V_5!Iq_<55bXBiQ8mMoHr>#m5V*LLM`F}I=|Lr4Z&QKa^zki2$MF-@*{M%vg-D|zWCbSn9h0o-`-2?-3
zU;Ort_)N$m+%b%2wi>u0lXPOC@OIurj65a5~j
z0w?;gwyUj^Ft_L+{M+9yPn`W+iLG4L;w^3MJUwl#`nS7_i$nFfow2CWWjh&e=&4>U
zqu-yL#ABg&u;;lKgE548*;uWauRsb7J1;DB)lymrp2KxTPKMydiC7^)r)wi>s7buCL_Zfh;bbxN{7}o+mz+9f7$1_GJB)
zZ}Qx#z4KDGzh63Tr--dyR^)w@QE9F>_}$WLE1Y8P1f7GTFQ(oZ$^IwEfl=#)Pu}%b
z*@!jxC(wbBy$GGL;Fa!OmeT+I{u58Ecy7Q%pu#YFR~*X!$u0*@Y4cW?62o;Ni|@`*
zs+QW+;Wn%3sFk}nmI9vqlVQL|#eMEBPLE(oa#kPF+;3>dKr$}AeMcgh98kYPE12ed
z>{j2{Q1H);QO;HcOb^o+CI<_QrGqHtJ_W&(1Lb{WG^{>&;pAvdOdYCv1Sk1{foy)
zHPRiqx{Nd^K7N?c0!_9UU7Jj7=nt_}z0vxA`~>{S!MQ*`-lo;UyHIP<$aS0ftredCU&utvAoHDUvj2Cb+#*A
zEBTe5honkd-W-faHR(L<1OH|3y``|&Z$okTSiPJyW!@xgHRr~WDzRS=IU`_wlb@|@cAeA&LQD_%dJP0!cN7l7^&c*lyKkD9T
z_hW~OasUTZ(|U--Mm38F7t{
z)cMWIs9YRLsH@dg|*&3mYtRb8{`R>--tsrXou%~=jaVIa#?
zIzab^Lyz?!8hU?!5?=MJsz*`*
zWOVh);EU*t)HH+UH18Z;I)7+87g<7i-y_-V1e3`*|Gf;-aE1!nRvg=VXwl
z^jw{j=+vLFTGS@bjqf|`m(-0#LCMNQEAH~lqY+OH!!q;chEU`23O(xO!G`4z;Sok%
z$em7ue&PFX*tdW}9WWGZS*a)_}cJGD{4fBq~&jZp<|2^@Vt;
z!fvzXDH}#V8OzjF3HN+ikl{9?0!uSuA{OOG_TdssX7S-a@Xz^H@jk(pjfKLzt%cUx
zi&A{P)X<{Nt4wPSMnT7f4JUOZ;Vh+BAqAKuH*d^3C0DRPq|qecSQ;6B^aztaN{;Pv9@!I#oA@wWs8nLiIe>3CUd-*IV^?!g
zy(_hLzdbTm=(k56-4xG8r~Xi;eu^;SzEJU$RC(ahZ8E|grcV#ATw|W{zR%yLln)BV
z57;S4i-7PwS>_>bJsJtQyHxZA>}ulJ))BbSn8T>XpnY?2?;_NZTs*uyfo!Me%ym8$
zTJAvUWe1>^B?_>tv2JzPB4KTtG`QCDrfy=qG0RtE8>l>2FrMt%6Ihi6;SHbDZ}d#r
z%JCZ+Tq&O-`2&*|kg~AkJ_?Kn#;JsRhffu*0qE!tfF12Ek$PlFkcu0SUGcL?fFX<0
zaEalk&YM9@wmmj{_1&MR=2BdXcfbp%BLpsV4$kq~6yH!)=?SM;2X(`Ee=y&BoAS5l
zy*q%}JSib281L-b^9IPLV7vv8KBaEgkn{ph=*dx(ydRe~Jkr`z=?SZhx6qUGG?J>{
zqM*EC#W!UQs=#=!`KTaK7UJ4F>^F9`M6nBl|Nf<$(|ib2gTDLE=$D2IPYO0He?lzKHpgI#HXA<
zc*}4el{w}qJ=-W##=)0#uTCwH}3@n!+;X?YF!pMk>;W{g=q+M8t>#m54$vQ^y(g^RG
zk~(X+KRVSu=7YoCswB_l@zA_fPIC%6uUJR%F1yI{6tA#G4l!afmS)G;8}>spJh6bf
zwzCw6bH$!##$@Z|{J6W+HvOn()bHVLf>?$tdL}juxt5B*KM~?U=|JMCr3_i=3nKeuB=6yB1y*+f{IEo#u>3bqTrBtSV
zA${5bY@)G!)z5f`3)_02Z4#0E`Eu6w$?YCx3o=dS5xDM9>M4o!`ZImS;jC@Q7Y-X@
z-n3&q0IbeTk5%TnXvuKCc84#NuafpY*%;^iDa*I6FiSkrK1NGCNapq%JVR$#?lv(z
z%;nUpqf@xmfhuJLqda|FIr?`l2*4L60B(?n$Ve
zIG*G>{TBNe;;rz^H^uO{{f{mx(=E}nNbHAC5jb@Ce2#?6>_CEMtrcZ)bG@z9L~o<;
zfz5|
zRos3Vt$<n3zbyiB6~E91>&LFtpSoo8m$iJ%=a{I;2G@=
zIIPdraT7mnBop;e+%(FUbUCG=RNVCR6mz>Y;;)a4`j$0@@89)ylKN12LsV$xCDLRo
z*){VaWI+yZc-8j=NTsN*kexRw>{lm@&)QvWxYV}=rPS)#
zwaMS2(b4_939xb6KOB5(^i5SY;}tpj2pZ}gpXmJJM0Ze+W(?`(54>c^p~b{_H9Jm|
z@RVO>pZ3&|K~>idT9dE2<15cr=53536o3yrO;<`pCjM*HJ@j^^4K0LCIzHz;j7zrT
zsmfDE`7Yw8I}!)oJ`ztlcR)L8-O$jVR|^ZuorpUPX^K1nT+Nj9OFz;s>yjj{a)x6;
zsSqvXr&CpXo5k?k4;gop^iFyQoharUO4zP)WsalQ`;j-x|9jyg`mZ4u*DeG60%q0N
zd&yqKHED|S&{g5~t-HYw(P*WUO_{>Mqq`z-1bfPUg$+e{vnQm~&#)EroPV@8N>Re?
zIHycFu6y;I6(R}Mr;{dT%Lv)Kk5#noC)Buvi&DtVqy(@ufWqMERCrb`;qEIv=YkUh
z0{Uk3%S?wP1kT}7%(CVLL?~W$T?0sTehbLXrA%rPPkdd#t}<}%sTvO4#$2XB=7K%@
z@+L~$dnBco0UsBSFmi0y#w`aIP9Kt`EXJ3x9DR@R;h+c3s-E3OpI#v=)=u$PaY0`c
z<2Sldz%WV$TKnMk=DAXF(wU|A3P0NK^x9t)GFPnJ%Tn4l~ZY1gTb~3e$
z9mxcC+nAE8y|jwodNGnt5~EaRZs<(mRi~mj)Yk;9$4{dl%-b+3>Jx&VWCZstneo2E
z>iUb|&NpC`V(rR^2#oT;y#-8-G7$=JMMOJz^GUnnusC9fs1Ui}3oGn!NF09^m+)8L
zS?D>FR6E^aZQ})B@C%F`Px;);J1CFZg0&7CF$?FGcN+qjWS{tv@;IfFF*I=3#)O}sQWAl7xINhkf0b96iHI^q7uff7!Rf^d(C=l;~mqBHxEhMgE_H&h@
z0H49Nz2z4an<1p5*n&
z#~2oBCb=BAXe;q@;^C3XPg{QMuWYQ>ehLP)%$_~nM-RzIgI&#U=A%JAr8<2#j*H}E
zcBtvel?~hg>v^ds3k@#Z(esK#bh8kt9q=SMyq>fi+Ae$ia*uHNkZp0fS%O$3t}_C6
z1g*4gNluBS@M3L@`&^>pF=0)Sc|CWk#g$JBB$-U#BgM!G#G6Yyt=le2g;8%03dWN<
zlX#C*%LZU&g7FN`y66J)T$XOLyB0Q@<~TjZ2MmEldU89C;AHNum(Fx+y~i&u2AO<%
zDVD#4i688j4j#yD0f6Jch_eU?sl_i3a=|Ke2A|^int=_RD82%lpM?Q|%e;FLG9r~c
z{oH*hPyRseU7(yIWch;sDJTFJ*|$<}6lnytn;VL?oW8LO8YTiNuUxA()-b*?0R0mu
zgZ}0^m4SO6;z>93Xzew`H3Id8J5cBRh2r_({%eL9EPyx8kFzsp)(VjSdO^ZXZnHX^
z1EiI|O97y)%K;4QT{FxK%~_m=uM~yVhAd9GRtWL2Dm^JQWtug}255Tm)
ztGlyVd&X=7y?naVy+~Eo#V1_W1D^uZsQvepQcy11^{lyq0-2R>$&QP^-C|+`?pJXY
z_*PHu&R2kI8xkSBBNoH48e-uRtF76hG@>RdE-O)KVW8Yy!Ue58*J}98UPoK(8H#X+
zHG?inz^7(#$?BnNtj5pUlP&x8w;Oxt$z^wRrm8FA%JM3`N9sLXPNX~z&X|32YwCFj
zpJbG_$Y2EBBs*OlW@^SQ*J@jFKQeiF?B6XFy8c@|3fUA-YLpy1-zpVb=`~a>>@Mu1
zUvU(zh4<+_EiY8u@o5*k$awnYpbUdrF4!zC(EgqIH}gwN&5V_oQK_Fe>5W-(x?pLk
z%K6XqLu~9toiO%#_66_YFD>2D!2|CS-qNxInW-Z`LYhx=7g5vG@K9=5hI_E>+<-PE
z#NgueH43A_WV%(ZU-o+1)-lt)O;@N0kzGG(RV^;8igFX^$vU!MQ%Epb#y+uZL$!<
z@Tsqzqr(fszmZY>B9hII#Xy+4)zp!d*ZKK$1_kz_%2nfFC~~>S`C<6XMi!R0$m9B%
zm_7rFurCsfpd(d`fyHQFA07M{jEm<5_AExPAaCg#O@9cHgTMssV_J|J@L^^*_Oplt
zP)+3LYrYhW|GY0eOU)I$G1BP!eFjuCMg+u|es}7+$4;hm1Jc?)hDpg>9V}LlYyoJ8
z{Cv?oy`1@InKwX@-jHP;JRY3TEE{RGAywGhXw^VL=N?pfRP#hpGkezCaV55IWZ8#<
z#$MhAvb02=-3EH4zH-{LM?(;J=uRR6EV^5TTC+EKCGl}sBJUAPE#UGn7R4(k=W;=i
zNh2wGu^bVfBF}B|R}ed8Uhy5Hw2-G3iK$@Dnsh-<5fwTnyH^!t>Epe@n^KDmbf-gq
zyzVXU|5Mk=fyWNgQk|xC{lk5ny6kbQ=S_Y-UkIoh6LJHbRLM0dqbh^!^Cl}1JG!s2
z(~?{6st=yZIC$a#w*Vk@m#&|-$aVxLPq!Vc%|o5jdO3}O1wID&)@z5`o|2Gw`w#F-
zU6Xf_(l2WJ{8!9n?KJ}$?Q41l%w&+HLNc*X-LnL{oBGL-k#dw7L~~AVVBTR<7n7)J
z%^2T`6nZAn*1hg~GL4~@O}#gRhlf)ZWK=h{9Q|#oW^Vm^s!GWDP1_=#=k3ou$
z;Zw$;JCPddQ~q(mt?Z6OPHthKDN}LslfoGe8`@3&#sddYVWIE$9xMWQBumSfUce)p
z#nJ%c=W5Rp9bX^}wgbu1ED8h#4@k_5uZnvZwJL9tH4zoC3#i!?rEjj-l!XkV^dw~6
za(J^7;G69kbSfry8kv1H4(YHzz*0|6`6<#}lI%1|qbB>$VIV-Y;rljH(;U0$&dsUh
z*`mmxPJD@)1%*ov0@xTt(sZD`a)vm&j-yyy&&v(R{uk2#aqKtKoJC(PNV!t>`zR=R
zBsSyne5nhG`;SaLPn8qWL);NRQ+H@R(cYm;C*l~_L4vReDw*!4Rs6j^0$0WGQVRB~qN>4%
zLm(A;W9a-RV=FW5*$?i6+TlxMF>tHgT#gsq5^Vw`fo(7kV57SOg!u;+IL1IIJ~jGM
z>Z6UxuNrMn-`hF1C)+d@q@u7belGnkqh4?y>#2Y}0?D*`9aOuST~Gro?*Z2{P2N>0V&ULO3#-c`co^Z>as*gjc)YBuM@ViP;A2mD5lc$r04tKN%yf)ob
zjNx6-pD0){yX`!lsm;rLJ~nnZ<3i89LZ#{aNZgfvLteMeBB{lh>+&{;_lA&FnoCnb
z=MND0enxu$@RgD(f0)^K`$|FqZZrHOyV`T>R79MbEgaSfs5(wJNIDe?OR)=pV_6_W
zqKYg$n=LoRbE?}Fgb)@VxQ7@@#Nq0PKAYL1UkJop1TVG2Ml?yij={Rjwt_D$&^h6A
z%+48~o!tjq5B4+>hCHmKROSxGUn~Vm5g8y;0K7k7M;kB~ury|*3ao@_0F{7qs_n*m
z_=a^k=>#c`>fBir9F_|#c6I2<)Rf~T;6iEr3hok~WgA|DRlI@~5Kfm5)615N&-Zn%
z|6GxY;2S9rKS;Wd5s0W-c`|nN8t)M@%e0^lyfifz^N`TFc$vrOpJ0bRs9j=NT|sf~
zE2{A6_|&XKytba(oBk~zww`RpMeB`i!mS!!`CUo9uT}}V191yYRa+6?Q(nY}nzH)y
zxCYA|EXXvv-mM0Ddgx_WubRc(`!d$UTpuRflT0OxGl0{F$_MB-y&xTw^-+M6EBA>4#?z-4QqPBQw{Jn}v;vv(_{
z|It%rvR(3g`L>!e7*XNvAXZ?5ZqpUqM?^x!cmbu4KS1A$xqXhs`xS-oh3pJEN~#VQ
zu;sU%cw6P{+X$R+-JI2%ugL}&;S9fY;b+%Uo%_4+;%858PPrzc`gV(5z__RK;Q_QV
zr62r<(dp!k*kgFg>iiS@zOV^qp|icM{B-dk#46}SnK-X2zEl-m9wuE$r?AH%$hq2g
zQe@Z8n?Ef2n%B0d)$k8lz6#exjJNIswoUn*BAR`xWWpXb=>x7EPB?|JPns3m?2dgh
zb$?qUaLNQPfqdH0cX`MmqTy=3XaB2JjK9+m_o%SM=H0m)T8`%4TQ$MyrC$lDi>M`;
zy4U9}!;On)(>F}BY4BTu(SyNP^yKEMyl7YN$(xHl(ch4Jq}X#m$M1A`S6~yt-*)}i
z3TOR<&h>|OluR^urX$Z=gh4V=+Fv2(H0TSxL6vWv?Il#YHWgvgW(kTEtl=bUc8uo3M{<)>z^jP9`2+^z~IlS2cy3ONdm
z9iL|n(+_pmEWf#pi?F#L$;lJk8t+rwDZbjU5%gPD#c{8
zeOvu?)d-rIvH8-D{8Ty30=PW31gH3M>?3nNqKK=`U`+klmEdPZmW?oKMRi<*WA_CN
zmb}{09ebsr%tYz^pP}ZteJGdwDFwZ&N_}cSK6CABO1w~qP=zVw|
z8SKyA=hKI1UtSQG0Op=K4u8uf#02ojihb`zfJnP7zg2b*=fK&4L%p$Th_9CrA^btz
zI%iFMjG`b(n0t6~q*y
znSc+SUmHeMM(T>Zz?`G<20(GxEa9xcc4O$a2E6g&IA%=Od#sjI9U`8+a=O@Sv%}{?
zUuR~RfbSqM8n8u=WTR4d!K;Aw&;IkLS`L#_+!SG%!h@BEV3l^V^heBF5P&{dYdfh?
z$MysAE$c+2(aRGZjoZx*=;zx@Y<{}5J^~Ld+42=%it)%RQ4QEo3C&UANLx;Q84+7!TMz3-$-aYCh@MjQg5VLLh
zniejuJQE116o!9qH%-bpH`FVxFeuFpR*@r$Tc`$9{dQW)VjkTI5Hf~movbM&PEb(zu7)GIRj19!N|X@}{9G3CGEm=1r(W=ir02vtwaFE%2Esfob%C(O91_Q
zp-Es$QgRazTOZ#rF!N%DW3Tl(OZ{52#Qkm?uB%W1+y3E&`Z9X`TwnzdODZA{G)*=X
zVX6na40Z8&6|xJ8br$H`icQ^zCKaGOu!_QJ_w5yqzVCy6>~(POGdD${)WN8F%w*n(
z4is3s9KrbRl^Ace=Ee+B85K8_-5m$yIVsD&u%Bf@C!nLYN*q8e)B`L%f2T1gz85@Z
zk?`mG@NZd(4_^t^c1*t>+j_@@p;HrWV=}#;Jk_QFAhUr(DK;QMAddm?Z3yf$_6Tz?
zs1>21ngH%EOpUc(JTzG}nE8=WN(tCcEe?&b@R)mY6Q@aZtS?9mvR)2_gZ30NP!Ak3
zy76t(L#QCuDvZVH^eF*AP<1I#wFPhCJNS|w;zO4BoEYO|C0p|g#F?L8gLLc~4gBd{
z6&4dcfP(ana#dh6LRgbpZ`!FFE(Ql{?T+g$c6}dh5fA~{Gw^YJKPlapul;g!lv-2l
zWF=gB>|S7--_j@*F)bn2-h2tB_nWItPJpux7#zWI;8q|g;{?YQ1jd&?F+thS@h<^WrnVp
z=}FfpaEdJLTo?|m-G$hlZR^op-Z^V7b}L3}t8)UP3a7EZB6q-{5_@T5x2E90M~?7Y
z#MfQr4qbQEpkf0~sFIgD5g(V!JqO0D2Mia8G%c6H8I|`hd3%6#?j5|0PR$|OEE37~c4@uwS_%!(@}Q`b4EBph{(s`?VwaA*S>x#Pq3
z2j_=gNm6S13FqpNla2gMP3Z{zB1+1HQPDJijDzR_O)v(!0`yIv(T=sf=9}5_h?!Go
z?JRA~1|tHrX^Zz?O|JJW+IRfY&8Z@M$KlnR{z1Aj`*;*KuUAB15zvkQDa2K}WnHy}
z_;Xl9(*WD`q{zJy)2VGI4{P}f%pFwm0=_QG7+Gzz<-;E02%`i)Wh}e!|RED=_ncw&raB8{y7S!nPPRjZL821v;v;uLY
z=u3_VMb_A>(BxC^5^6=Lu*D>r($cKihhjIozITtO;QW2gO~lB8iy1L
z!-8#fnH{Huw(VT%6RlT|BeNJpfPPvb(R6S21RkEL*}Zuy#$a}8s3!T9=bI3q3z4XA
z6v}7&79W6xR%Vm=;!5Y}bUtADr;$$phjMaN3P21BCzjmO({#BBKc_z`J|@)rVSyZP
z;@d+daW*nX^)o|0fRjBD1m`%_5G66A3zoO_lNfW>qFXOQ@BtG=cOew8lJ>dy@is=0U!T|
zidA20=KP!a`Io;O@cZLeVZ7EO`afN^*0d`a7Q@eBKS>7X9u2_b)<`T7kRj#rl6*HW
z_eN`g2uKAW>K^j*GtjgF(9V2<3~;-9X&ZR-ts{p?ht!;J!b-!J0d=73@CIP4G{B$(m9^ck%9?L2_|(tRAOugf
z5r{8Tx_3HWEK$NSaBLgL$R`z;1>`|KnFo;XfAK89NY5lZK`nS=hecQkp8yQxOVL^q
z0Rc_)|1I{!e}#nZFh3*!L{YPsy*~)({dYW0juB{U0-gE1XZ;}~spWfN?&``)4g{*xRi~XRUXwza*dssB%gtD%|hw9@{Z_#%Grc
z^z4ht+6y&7_S#*Im**cxo>+b})|V6%S2a)aOWj`izfVeaMyQS^kED4Bo+k}pM{($$
z47S)>cl;=@TF~2r0X=62gTUq30k48g;kSNYllV{F2BOj4BEc>YlvBo+H(x+ISxO5h
z_eSO~0NwM!%^{e-=pA6}OV9l8=d8(3;!wd~{TV>_J^%g!hEQv=!QG1r#73}Y`Gy9t
z|6OR5+orIxEtK^+1D3w09+a-YFblzOTd6#q5b*9bxY0ofsNz
z*Btc+KDrc=n`*C^;Ii^p*PyZt5Xga;pN%zZEt{k1
z4{q*NG1`BnJC=hsG|#TW-7ibi
z(RqHMQgV~jS&uIY99Q*jSx>67?c}w>n7C8a7r@+f1SsV2?4P1@w5JPb@BfLQOrSGu
zjmU(!^5wDbEqrO|Mqt1n8HPR9Fk#1Yp{l0uuUo~1&;q|uTj#~qlBrS*qp
zEMA!{5KkW`&6DWR{eu>hF=dIIJX-068eb9TG!Uv_NJ+*D->aFROw~&EwO44zw*=qF
zan$$~4PJjoLv;q5MnEq2eaF83d4>mo@pQ?qyZ3-?itnoSp?^`CfUDXsfS{%N
z8t2xM`?qsAcGm<j*X(K<+>7`A_)g|BQD4Ax?L`$DkmS$Ii4`)4f6l2d}^u5wHOEEnms-
z6+9}GwG%eGvjDzy7v8g;GR~BfVV~tgq!nY9Y$UD{yE+LVq=T92MKnq7k8Un-3MHSO
zz(+A+ZYw3gzWY23Q0!`h0kKSxFQow!q&W5GSeKDb7-s3>hVQWd!Yh`R0gC{e
zX)F^qKOUJ=J}sHPZ`#642U%MD$5}!?_Dm!W3m_dN(9QcwJ=Exz769O8AP@ka7oxAy
zq!qs1wGVoj7@wS#7*?KkJC0njc`N!T0Jn!M`Fm_;;_oO8Knwxhhg}b*kWE#?gy_uDqz`^coPR_#ra&T7+We}=y_^N~_{MWjjhQ2zZNh!FQgIx>s
zsbsrKueya(77MueeFc2sp8yg96ifi&0F!wFpoV*ZWUK2Uckh8`#NjqSsfb*#+H8um
zEz9p=`9T4D<>3KTxhmB|z#kLmd?YptLZ^&EnkxE>_)Jfs2L4Dp?fhU+sy`!?ibx38
zP-y$+>?KuN@qRvS4gygO(q&j*W&t@0V19S>UJ{8-;vKu3Mc7Y*rCK>lxyF{}?!XggrtMtHc{PS)nQ>s!2GAi+=J_hzMwLEj>_?_gA{G=73k&n5{Xcl&-7CT^rdumkI~Bp#8Uj+_ThapJxf&
z_lP?n(@AVwR%wRWWO2nHJx28z$T`HwX
zEXuAOx1ZyF)2iTaeRRl4hVNjSh5Lp6*Z*x$9OeqM8{YB#5}VPIGy2bRYW>+`-HdS)
zeQ4`+=`3{egMXRH{@pHx`$dkn;}1-hHx*sLwPP`;xOJsZD_@#QTY*zKXl56AEYz=o
zpy}OqEzLZ+>nR(B4&>coTzE>*?~al68FIhOoQy$MG$n#@h8
zLk=ean|98s{guJ^8OQ?B-)_}or^@(i+GTu#M|a_qzo_%fpJiN?%!*XJ^Vqa2DedPO
zTj-xXZw9sim4i0l-+g9(ir^fl@9?AHE30QaE1OH6y_G(sEDaJ)=@o`co~
zPTJH>hfUKhGMAJ1jVPgbt>Mz;7Whg_yIE}W%pI}Nt1QZ6Ge?rnt6W8iOg=C2oHJjx
zvV@1#Tcng6pAMyIg?US!1u|x45Opscbb4^60Don
z9)QeR>btduyZ$4A^MCO>X|wm`Gpuz0(x@{mb*X8qqJ8MqS#Ni2!dMPkH`vL2L~V`~
zLeI;6&IvYwYmeA*%CM;&0ktUYMG~TORkQHF7X1Ktnd;FaU!K`1F|~5~;-Wch!|lXK
zqpo;}iybRLkC27eoUhPDi|$oXPPpQL!_^ZIis-P%qsL#u288YK#=No5$b*;L@lM?s
zoigA_+TBkDe|?UF$6%S7nM>mYBe`_DtwlHH_-kd!d_vd
z&$Tjve6eB!gn9snXUmwB7*{n}&-71yyC%B0_l-}N$>7aZTX&qKUHA7qBJMDOXvR>r
z#PL+}PD*wI`U#A*ycNBKlP~PotOscDyUTL#CMn9G#kvrd9lfxdFXhi68w#
z*^#)a)3iufGD6%m#oS;!-5i$8Qo{L)NDQ0cnzYOG3k-nMIzADqA2eTzzb;!~JyNv>
zso)TmMaNyrENBUn1_A*L{WoE8?rn$2I)Y@?8Wq>;b$RWWzQy{2NA=0N0gJ$)EG`Dc
zcd0lZ
zbgto*7*SB-)?v`Q4~8LifyJ`MI%*Y|+f-|hO@2YB`9>_%ek>-@UcT}Rh)D{X(P+A-
zlxghm;M(Ymk%|jr)w;=u#~JQRBlnhCtXk!@r`RFxeY)uhBidb(9}r{MTiq%k+z+R#
zv0e-js(WerWp;yh@^~tgmgXu4s4VV-tp5J4?ieJZiA!L+rVbF5yWMpXCNZ-J
zu6cq7zTRPAsLa&k{T}m50y@ZM?)iOH8pM;zY$9Eeh8I=76eU1t%rW0Wl<+ptV*5}{
zfEEAr>=1K*C?(N2x^~?J3F!Il_S6C173$udaf%fbrHv0PijQ8SWr2D~E40U2v4Xit
zN#YaKBU{`1Jq$jBHw@4@OuQdE-JhVDWO!8^>33UipD)4WIqS0P{EWe
z_=MU9YtlA$l7_d2Qi6RmRJV^=({XB?yyR}Ii)V*7_yN(=Q>|2#y>ZYSMu~XjWQj0%ha=x_AVG9Ac|Crt%232J?f4mJB!ZQ6Idb8LmZsL5ih8WRSET|`}GWXONDMKjx1jqJ+36SC7*O@OYV
z0?nsu!z4HaM)O-jwXcb2c@cj|{4jg_)YG7jIh~2fglbIpu
zu>?|75)INqR-)#*q_=xyytm!Mh$+;CbdP-2WZ;qtotp>D3g8t-X};l8Woe+rq@Zv*
zGtPe;(+DLnUwVb>_IXlL@@Q7`I^~&u3q)u;74z(Ia9N)+H5SjnWzr5-xQC1#p7gSd
zL7=%xgg2~O?{gtY?h$f-e}?<d(EKyKVu}mOb%H
zmM`pW%_%jl&kjDoP6Y%%zfiv^u7Wevm1qt1p@exbBiD1tO}cMg3N^v|JSzt9RYzze
zd73GM-LhwU(Y{6@zV>QO4>Y@we)dsE=O1s3txoU6PvD(0GA~?T0TY!o?F!7UXHapL
zjHpk>1>sLM-x??std=dir20vBcOEy54*{Hn%#NI`jimuTM0T?&5M^czzNONF6mmVL
zs+7>B<**Kf#>AspB9z`Y^%}WUDQyr&@$ERy+{v+1_NSM}RnP_=%pF2rOT{OZ(@$k+
zidg~2FTzK~)_tf}^nIyxhq?Ept2Pnv>L1;QvsLFv`!@Z9yoTNjgUHva1h+~`%>O8s
zXzPuST_vc^8EnGO1=2U@(9hidoFB<<(jK^0BPg2G$85#1jZh{pb*M4;vdoRi-zxhY
zbtMw+t2KGzB78H-)07ul)WQg=jhaPB%=8L%jA%YN@TrC>SF#
zPAp1!_RY4;nlLUi*s@3(E)@9kgDIhU-S%Y#7Mqrd)t;Ll3pLsb>P7-djMI$B(S=jN
z-wT%hwYJwng$c1YD>ke5C$~f3KPoE{$;{H;kAuFS62v!b_n~;cbij!ZwyIGfU&2q4
zuj$4>k>_pb1jM~{vif)Wi^v6@%6sBGaeZ5!T
zhFMp3LS@@5TauCz%0=#TA1t%zR!#VbC#pVIraPsN1SWjCsbEZ}G4lpnXMInsmUY1@
zrJO$^2_I9SuT^pO1Wj~po!3e$SF>Jv(#uw!aA={W>c~wk>UFP4cg|O9p@I7qO2k_%
zb*mUuo&@Kc)`C-6A_J@s#PZCK_ucgiV4Lx?sMAru7GA77emV5nW7_bMU*H*NkZUzm
zk^!-r)D`a8NqlFGW4xTBHelj{lVsQHGhU>wJ4(M=zvm}dmVMI(m*S-+`VS7
z_hZ;4_3Q8sR__3wi-Eoh8vsl}vHA}o1Jf4!f+k3FY0`fHqb~W_B9FR${h&rJ(0hPz
z;3u_`d9kfyN3vD_HQqPQf22SpN=6@Prh;V8yJyl%s};&V96}P#%}DBf2lPdfj0x6D
z>of879Rvsvr+?a04xN4gDM~SvtH_4?ztCrl;diJggYAcNXlwYmMy?v
z3C43K_$9r&&P2LafP#C%Mw;ri9${JqP}XxIX@7)quLu3MrSd7pNq|`szP{A>t{l$l
zCk6CK;-yX2c>_44Dt3Z@27n>$hz$>WGg9|-Yz5e%$I<{Je6cfWW0=R8Cfb!oHIE^`
zl{kQ5*L&UsyG?1iYO8Gn6(<0^rekPJ0?Ig=h-=kz_7MfrT%alm`13d>N{+myYXLa$
zm*UlR=$8^L3Fu(||Jk;MMc`ENN!pD&U0=e(c=Fg_2zF&~pg0VW;s1k*i(?Ike4l84
zpB@w3i>0rdd=F>0_XX5*+z{|3{yAMDjyP9{U6z+{u4fIR{7Y9;;VTPgiNo9$P>d%in>e+6~QR@0G6i$tm
z0Gg@coUTR3!QmKSp`OqV&Hzw;fyF;6P`_ALU=~KV0My=MrqpyGo-To!m0069g>+}`
z^gTAy4H9?z_PxD@Ca*htpQ@{K62_fH%c!^l<vt3+>J0+)GC4H{(%^&2ezqV!FVeMpkaq@2l&*A&>y8gPbEZ(>Gp$@
z^QB{A#_tG8yCxW0qMJQ|@5Dk+m2QeZd-kk#{{VjI{tud{A<&H2&|4n{AXzxD{siFc
z!79BBxYc~Y7eMdTU8T=U`p`ZrI5ib5Sq_%+U8mU8dkQ$i92I2|wnO<{=E#@+YWLZT
zcanfzM5nhpqu@WQoK+achBR>2Y>L+AJ0p+J_N%i(#MJZb(m@uXh0o`f91_YeEEl5A
zzuvu}E1gIhdKl`Edi&HUgnWx7{w`BXB{BuQjKB4*GC?P;I`VOG%6r8MJ96ss1E_LB
zXy}uLy%rg?SF}h3GvahQq5eeJ1|D@TQ2K)m_alpLuSCtGjebVZOO5#7oAg%`#cxzF
z7||oSUbthmg;Jmo&>IjYbXn->G;|mOukNj#1iW
z8^x9GcAO-4xD=MSPt|7amNehPc@Zw)J4>u(Kropa(d;Z;`~)m`C+cJkS2j)9+RkbB
zR)La#~9f3
zZc~TmIuO5I{!cv(G0vi(<0ef{3X~%Day=)}+h0cq1i?kcj>@Iw1w@#~Y`^h6=nH(?
z-6QSftEg>0S%U76t}8aj*SV!zby#dugEYyvP9X66X_q38Qj5C8X$IDtf*j>M;vf19
zo-T;K?-U1HCQ(Ce5t(;`>rdu*b6rv)r=?7K$(Tf<;&gj9U5!@O4oZLUpBCKbt)6q#
z-o5(wuM8Ea;cx&=4ICL5-7a^v9bciJ@^B6`aDK1eCDB+{Eg^l9P0FBL#~n?AM$DD3
zpP2`Ip4**@&}?;KBxHNH%I=!%z5T?qD;0&f2cqp8oGe;KgC0fd9nUWG)f4m`
zffJJ&Pv50HK7?}!fTrcV6|5OdGjn%*S5kB#uKe(a$h`d!`b2sAj$>4A(f?>hfQr{t
z_0=2aF7Cop5otLUkV646;=MB|>vD$;qXi6oh4ymttQcioPLG)nCNZb;`=mRhB2}02
zvt@Wj7h3`~M&6jLyRuQ8-g9`y8vq^d`;BTaicuH3b5#{>tcizlh**g4u=w1CzEsU=
zP2K+aG=GO2eoxbX&w2?^SM4jrO{YvEUTCNd9Qa?whrwq}8aWI&J%90{V2vydPA_W!Z)Gc3P&$-KzuN
z>G6@XtMC5h{5@-b9Y3;eUn{~%C-S9%d;0b<`{+DrfvVrOH5X&FCTPw_=wdMH8RPzV
z_yh)?#!6;w<%Hrc?h}*o3=Vs
zi4s}C&$GsaaS07y_P`}KOJPi59G_75-$j_!ukhpXgv&6d|IzdVSr3ojQ@IPm3~FM}
zIxk)BQS;t?ERr&95~m*xQ5s|PDBc#ih*LSxd9So!D(`TsUb5B%8b_Eg%A*&{HOlhw
z^uRREJw!hA6!V0nAh(G8QB3|iwAk%2rv3_Kv)4&e798r^QS|F
zMlTk>rXw*fR`c2a=sKBsRV=LK^;@wVpX{WG&LgRtkx;X6?luI-znZ97_Czug%3NBi0PJ2#k!v5=NfDq2Xq+C{k>%uh=Yv}
zXW(1D1tgv7YjLDAJzdC+g^(QEnM08l!bek}K$Ws=25xo@3LonE}ugMj2d6LI$xJ5;x|)&t1hy#5HnN(#5Kh>g>_7>
z0hrHh0)u*IT4_m_gNF_^J~MX>BxkVVzuRdwjke
zO$^4f^?RrHy8NA^PdHNPbGpv}uI9xnWKrsZWetmRXqqGzOOH&+M|~a%^H=55kuFDy
zWi8n`o;a6*oTARX(7ReQ0VYbcWma_$o)#7;KeG&VKP=85renqT=UMyZC1`YBA4>1R
z&+1@vG7hnO1g|FxNvCSy*4(+{C?zNic=h$DkiAxX-y!l0$|&g_f-rBq2dV!Xy|Ui=
zS)DWHEGYey)dj__H9<2Fu}y8Opf)*ZBbTk_J#L)7%Zxs^NJ
zQ5M7NeQtE#d}p`O!r{FM_0h_{mn%+PG;PIc!x%ukLn_ex-`Mi2OXd+@vf=M<-@t8G
zHIv-wBim@wdd0B+uJ~dYeB>dN>k&=Do!`}(L$2x~^I)HlFbI_p(GumHi!zHzCgaw?RElR9&76r{~Y8)I9Hi_f_6$2HfR9{s9tw=7Xhw
z3I6sZ8R-nga^L$Q&KAoswsWM}H>|t8k|wl@3jrqG*xffz79OCpYRe;?VOLVI;}EaADTcaC7c2M
zQPVqjBL^2sm#>Ik3AhuZ#aQ%%F*F>_ZDX<}|UDGN4pe%apO5HIj=*MS*|)btqt`={7~+U=(U`FAb9@Eg%aBD*mD`{L=N+oBVISG!cwIJ`KUS^fNlSD!_9vtC{P$?Fn%ua
z0l5rmBAl3J*eW7G!%EYaW}PR)TKnDn3oBd)iaEUxb(kUh3Q6z!5Ic`}#d$CX^!)Oy_Q`p=4;1mrknis}-ko7(dh60{r?a)18uY8y
zl*sh!hutmJylfb0mCzPy
z!5I^g^2a1GZf&4D(nJ<&90aC|cDhFe*_*;^uQIV;zi`1=^lsSsZ;d1UF_UdF{l-mC
z39&pmmGULnW72ICEGso7?)vZjV|`y>XI$nK5`&mVR8*>gL#y+IDtaO)x!nWSF^h@Q
zcRdn-%+xH|gdW#!^do6|eoq-FB5#=g=@)wuA?IY?
zt*}P-g|#GGrOt|X(ALO4n;Tn6UL5Y+o9r@EVH_#pdkth^=dn)X1=zQZT%@!63K!|%
z9z_7Z4N2y$A+}&%qBqtmkI!K_1%7LhYG2xUoEeY864xK&BH>Fl(nV(0qprpO_WtG3
zH=>eQwZ6NtOUVeC1#lt)=5+0>cS4`0hv$U7Po>A5j|xgI-!X@9%CNkej#3IquRM{^
z!Fc31_n5lg1yOOeI7(0wT#)Xb(U5$hA-OjQTAY^&wdGyUE548n
zr&nBV_eDUI)?=M=`uv@!i5M5eaVJGv7#}Nq4!_x;OuqeMUh=NwCdO;*NVlHMZ#O)Y
zWxnksZtJ0OZe!}cV5=PmCYnrQq9(~6C+bGYJUyLChk=4Q*h*Q}Y}jDEruU>2jFhgf
zooS_3S~6EuGP1d32i^DtU+gP$rk0q>TapbN3dw3Yuj|&_)4@t{C*!nUYY;^UXeJ$h
z*~fH(i@vJ7D)dZ!10aw!-y$xw?JtxW^QCIOaJ&4v0Z)1tBqD{2<%wA(f7i9^)Y})3
z(FUHm``gCeYr-xc3IYvD~
z-jOQxso^=l-(Dyu9uDLt#l_SkoC;l^`zuL(aEK#JVY#XD;v{NCwnTp`rzK<`O^Z!|
zJ}U`Pe;Y}4<_aU?tWmwUh
zxaR4zVX9dgt*Y){sIdY_3W?x~N3^8y;?M8GqtZ1NVWlm!+H-uPgh8G0c_w6XeH2mf
z&DqO3rS<0feUk{|Cxy%X5g~pv)ik91x9X>u^X@A%2F2iEF#-2a@naHU<@0SJS8C=r
zO~z9Hh||L7r;#oUTr>3}()xpd*ZhYK$znV*O)B1(weCsmY^avCF_UqGIgbB)Mac#2
zA-Sf>J{&Po{_y~bpyjC+_nuOQgB_eEN1Q3nI+4&vhI9Mm-jo+{c8;B%#0GJ+aN2FO
zoRQQRO7-YNlzA%$b;pWiN5-;iONd0KuA@dj&?1O3oXsC3i$>)D%_rkmV!O2-zU&5^oLL_|8+RAgYakD~A
zh2X&R<2D!R1kQ4Q0rn}S1N{n1_3*E$Q1&r=6OyA&x}Yl>udtn`wVfAbAj7RI5&hw=
z(lN_Xa$6TC7agb4C~gYD&wu^eBJ~*VHDW;B5K&V-J%97`-JMTqWj47
zQ
zZJbmE^@j$+gLYR{?S{V^$h8)BhN!Em$sU`+5=!B36QwO&$V+x~#HO7;=Gs8aZdKUt
zJ#Mt9di8BdWY#02y-p;kc&yD>0ucxd@RhCmzKJRd-Sn~I7X*s>MW2!Svx@NyfJ+kG
zEBVYBzE$fGx2U`oD9b4I|D9m`zY&@Lm%lS51mXhTi$)XBl6ofrlZC#j;0nz%#qJFl
z_}bq`UkcqXzz1vEJ(!m_A>_e;php0jy(-?cx
z6^?01LBW#2$UMFhhnZqvri8hmr)>;K3s_d`OcQ`
zB;K%QLfCLsCUo&NfQAY$Aj8mEKmyo@uRoFpb|T>1Gm?RS>Z?N@=}n2Xl@L?#t?=WI
z%j_o!<-g=%{(t-vy)j^8!Y|zfupjLO#WWjJ{&!}Bpk#$5zB19UoYG-nH4)N(ot^f|
zYef~Y(v8KG6Kohmq|kQ#Rzz;XS0M;kJ&td(*9JHVh1K(465-!(MZW$`T5_ih?fSawAJv!JBA4;
zc4oh-O-k2F@7}sg;ZG#vBP%TB3WzO!S_s`%{*Je9e)Dkg5|Y{^ycmrDVPd>^x4B4D
zw0%Yu;_EL_MPg?VpVZAdb4mE6=`r=E-FMZESI{_8x|)#}sOa$}q!Ke)?+swqjiqjt
ziHvrRsrMe*3kjQ2^S;{YoyKju5m9%r$O;=2HaN8o?26qBg7~aa#_wdKEz18Blv3~vcQAPZo`2u7HGu?7v
zu6EYwaK0_?JuQGxjA6rkGPRUttZ||g@D|0!bK-SEh9~%+&_-U&!SOOR&u)u8mi|%g
z+(9>(JPR_;utbBp0J#E0gB0NWZJ2*N$Q1enVeuOnctHL|6{$k^jIbRWhFj)AYG~yS
zAChgkbK9YlLn@Un)0jADWLTr}99Oq>QMbQo%K%PmW70(ZGbQ@We3Nh-r<6$59Ou5f
zN%EeA8M9!oPN9b;sN%ekA^O6)c?NaYMGeqSyDD-1jHh~IG}iQk*MIr;EGe_{9qbL=
z_C2I9$qEg8juQ5t3ud-zW^Y4c4>JqSKo$6%2aFc6uXzc`-}~Pq?5PifWKZ~K@wrBn
z-lzOfC4xWF72WTqOSbB4s8E_4Oso&Q39m=G7L?nOfNP1rhjEeAtc8G4MPdaT
zk*l5C?>1Bn%so8_B7qSzWeEycv-96t)UdTdWz;}rnOiY;I85LuThtYm8J#mXjFFQ5
zb)&E4jh!<5wY<-}>hW#$gX(}_8Bb6j$AC&aKa2dj!gQ&XhCTiq-L-f+Q`Nr!)Q
z^R;Xs;2@@*sx9c50L;ky=^b@H?)=w)eXxP~4kNN&JIQ;4V$VJHA!H7AvPbLt2~@O=
zeq2kjVJ2x=p0U-U1Dm)6$yF00pzZi&e#d~)WNHe9@mRr
z?-jflOpOf29)?ZbAf?9us-9&qGHGYx#pL3b*xdB%@%i|a%AHn)ey!fHNA<{XaMfV}
zYjF9qxo<|D#u_OJMvtNQ__OMbK|9rnoDJb`9Klr*8>&uJ(`>=2GAW5`nT~zR9&5(M
zG4m592aC{t2dO2D9q3-IH3JB=A7E@_MmboNs~5&PVO1RX*`U&OhHtW1rVUdZXbbXs
zWqml~|Gh!|kt2|cEY$!P*p?e-C)F;E>LpjGE`;eYUq8dEZaHDs75h7BnTP_x2UI6R
z)6*48pv~&jNwySxvm5ydK^uBAi~NL=>T?s77S3^eeId`E)eCr=%AY^~aSuMGzd8M*
zNhFbgx)RQMmQnV0LvX!!jKXRU@4}|M8WaVpRJD{|=Io7PT!_+!vaC^+1Tvk&iV&U}
zt{v6Cb!l1O6R4)3&-~=h&}y(=Jugg{Ce^PZtu0XbjqE3>3i7Rms9FKst>SRDzeolu
z+{DCpu0s4rktoEeq@Ir;iHJ%oQO@s*L9rrhAiC*>xprCg`3=v>VPOYVoOIpNH+#&M
z;qZkx1K*=WU=SJ8@+^x_x5<2@z#Q!fDU|+=foGOguoJZ`xepCg`5uLsHs|oKfOxsm
zPZ@-B74kZD4SOlY2^t5kcc-))#avd51^P(_zBzX*ipC0nzuq`50|Nn>I2
zGlp`ECK0-Z`smTPJugWNaeipGG7_P=wG^+fa5dbmA+#}T0qzU*L^~E$00j+R722b#
zPnm+%cl8lD^LLZ@c)4GcNgAZkpz%y_wb0PJP7H-e*y;|8s{lj?^qRZd^q>h6;i6fQ
zH7naJ>@%kW!lqmtOmt(uaJq(<*rqOMw&6&P-ZU9Ap^=898_nw*Qf4w}2)}z?GRL;r
zmv)?5fs~qM)Hdw+Bf7$054nY3ZXP4%yK5N|XtZ)s1Ee+rohs&c9C3$FUdr%gH}nSM
znrWc|r0`99hP{|}aku6Iseze#!9#%M+!n`e@#m;^p{>{Jva+dVYz{9+L
zYo3vN3nMnLMP`YsHC}Dh$$ph_qJA(SdRtis4d@tAr&dKd_&8p*(t&XW^vUxv+EDA1
zKdCD{;N5q`fm^YDrvEdN#L~H|EtX0P^Q}!_fs=_!AMi}8o{_`xk7V{0qu231Yb!$I
z{J?Xn2ZU47W~%T*ASm-6&IeuZ!3H6cU86IFL)XGHJ5ZB|pdy-KC8Pf$S>5|2UQ5(M
zJL#qBMl9^swx=g>X$w^7OBsGwczJ|&tz)neew`H4Hkn+qhdqwpwY!xK_a{gmxg%@K
zHtlagQ+4t>RmrM6&fv)!l)AHp%LNVkt_2dbbyk*zDlR->D$A3FnbcPo3#w7W-Cewh)5e+%TM@TJxx18nE+=ZVBZm6DB*ZxwAbu_<^;UF1pZojA
z9!con9ZfoQ6A39F0H;LIgLK(TuDsB<5IXDp=btsp)lJLQMI|eaIZLuWLxX#HA&PXo
z3-2j@Jr@y0dzltxk#LWndXI0G5xYE01?~7;{hY(fc!j2T_(X6696q(2)|PL{KOv&U
z_*JmnnX(c#2Uw8Tr@;0FT9Di^ym4FhgY!@AlB2fFGq$e39;>-4uIs6tZV_o5qjvs1
z<^0vD5Z?{ETS7jk60&b2I{hs59hi37EycF;
za{IlDg0nKLTEv9!cq#_tW`_dEbnw^zX+_}(3Awxt#1H*cu%V$DHOUFu2RhS9;F2(w
z0t$k-nHk^JY3#3xP3LC^iWxIjY1kWG>lOFwk)|&!lr=EfO#No2hNWq!g)?eO+?M?t
zl^36A)Q_c}W7#9JmbI^8!ad$N#LyNj@sR%M)wKr|ZP3;}-FH0-cKIZ|C|Qyal1WV%N_kkk$|`wb<9OYbOJHt0mKtSY9??IvaQu)IpZT=qAGIHOA!#@83K^c^TN^cKY15$oW$QHPDt)~
zDh_;6;Ub37r)_zGnif0PTGz?P8;D@6I&T)+>{e)k;LkKD3~U}QD7{+i(Y~kA1!l@<
zcJ$GwIrU4GGcRtmqV6aD{xXHN%ddx<@sN8*?0R0D*7z$wdSS2iud~bTb7psU_MjR6
zn(tHq=xq*YnguJ8?g1z;USQXw7qvUe?HEgMtJJinN1nUWG4Gd~
zFQpx(ZumpGwf6=VnmoTASDn=O0r{sq%xG^e-PG!Go8l83`jf1?`oOh%XZBT9GP&AB
z*0g*+W3>(c0ag76V=}53p9YczzU&isp)L{jI_sJ!^^?^mgrib;wl03tQ#~DON7HYt
zV=_T^=B9q1+Z9vL)#-L8baSBq3X
z{l>>LySyYcQkEqfeV3<5gobB>OU?VEU9EUeXrRK7cnKOei)zgE*g-3iqs9_$>;>NAUuz-A|KBcL@dl0!&hDA?)
zX5j($Wrq9S2J?zwV`DWHG`#0*-{Tl%OrH=uOsyH72$kFwjFUg+e+|qQBag4!wQe`C
zdZcXh>E7$NRZ05vDfvNU-{xO*zv?zsL-KZvcI)y_twcjm;a2NxMn}A}XgixPl~$hV
z($mgOeeG;2!eqRXwH37LvyTJ;$T@{3?amUY9cam!U?mF%(1glJ>~XTmgKN_=GHeTiFe_6W!@T|cO9JOFkp^-O-pt1WdB#=r=H;yDK(PW*Xh%>-3kiI!w?4wwPPw6Qz
zFL?#t!o?|s=^e+WV2ZD`y-(7Mlk=HltI_LE|Mi?%ItF{GjO}=O88&k9rbxUovFzR;
z8}*pa1_h$g$9SQ8?`s{d)-i3}{>y
z8g-}z1G<=T4i1q<-E-A+?uw!Lt3m5FgYeTXAc%s04mbrcc3Cc+5_f*<-JhoS*IxcNaov|
z5R|q)EZHT048NcZX8kmM5JPKztnhv7^OO6w&jof}Y}Ujh?nW)2f6#oOKl>0hU)8!0
zOsqig$d;(rH)4RL^f8Lo+9z|`c+QNtZj0}Vw9Pw@P7n^Y35)`ehW+vE(u5LE_D!F-
z)V8mtB@5|2v_4>RnFb9nB3J9Du}V4{m}093E(I0>fNq1YDf9bn
zwL7*yA|_RYXiW6Uop@oThH*8HED;kOSt<+aBpmJnBZBy0u
zhv+^7^{J$G_xHnlywl|^d!FJJVLj>cjJfruoOjfUsP^>;i;S0TwG-90C&LFa4bfc=
ziC7l{fwPQWma^c5205W{;vwNpt+lkZr~;XzNgbJ&U7D!nguHZNWjq4Ke(HL86TMx_
z?;EWSdaGu?Z?qn=NQl*WRwuW3YR%gQgolm4Y17jXVR-8Z@%It1Gzp})(vFZVwHM?E
z=F%S=X=h~lW$c~XFU|?0aE^qW^b5t!hxr!6!R9asB@1{?YNctp`Td5(P;1_AfoN2hh?Ay|41O-qnE(
z;LexX>3G2ue78HpE#1`_VVjtN=vHUW8-)`?q7|lt^MfwI48J3Smjl)EnvwK;xSj5k
zSde2v&nmQerYUXb*fYikjRD|dor?KmvFRo;OrQISr*f|<%yls@M;(rZr;kUqJA%`K*jGd=rd^NMAk%UY_PjRA+y&!Pt2S4!Re%XJ
zToqQi)~nVN++px9n1}1>vM8gP#b+
zz0!A~jV}8*o!0kog}LLkfvIy~AoJ!ymBFja2;_rmTbeU-a52yP_>@r*PuDoNwx*W=xi}Gs7#ueho+Y)MmY4`n|aH%SiwPO)87(^Iv;|IKfXc=knN7-lzN{;
z-97AHE^QG)q!|fh9eO+r$uNlpW{5Mbkkl@GRvKNCnAJl0U;6nH82bUZ$YNxL3$9qF
zgbEkds@W+22=qbdkQ;9meJ07C(!`z`g%d6Ax810iI&r^N`!|(-eaWnfR(cUlr79}_
z#(}0Hd%&T{cxvV+%0xl22+}!XL$P{iJjhTZw6q0@D)K?bcNl79r_2%Djb#NP7JM{X
zDqim5sV}{o?e@iy?r%S%Q`h
z6_jptI_)&cNEMTWh8t(13fbc**kcb^TrcI%%StB-4-=c0>96*~TyXQ6WO3e!`HAB?
zMZgjXZjSjuqt6coS2~;ebD8^p5Vb+U0N^3KW@X9urdCCqPhMGdAomAS+JGNIoZD7<
zoTaWCH@Y{aqKQTe{ct4>bK`(X_*B*VMHjX`gJ?H&RXvxOb=wuI3K`eSq)9)_x;YvGtONdDfTo8o
zC=hPp{u>N6D8&+(!;@8Dzx>FF!RxsG6$jk+Ziq~V3~yF$UK|Q7t9#B5TcD+XcOo5;
z@u@H`v;Wp}AnkR6+R~U&h>>Rx_WWV|3Fh(Q*z;uho9TuYLwjfp_q*(51g*gThzyI8
ze`m0&L(3_X90zAE#AX5ufdO!^7i1O)J<{qXtI>YA=^=hK`?P!7#-G*-!fZF
zJ6bj5`UZE|@F87%<@NC2`*Hkj7tf*R43^wvjBw&P1vvPcr#|X1eHq_V`&<^xVD&fC
zZ;DwFmEE;7m->x(1o0bZx~jfH-Y({?Gwmb{U$5!V>J@vN*U41?h*c*b8_Zo2)}()<
zK7?y5N;aH7957sqazZGqRwfV)Gs&$>