From c326293eddae1bf7b74911e274f0456a0129b881 Mon Sep 17 00:00:00 2001
From: Sriraman M S <45987684+msbemba@users.noreply.github.com>
Date: Tue, 24 Jan 2023 18:13:24 +0530
Subject: [PATCH 01/16] Update event-4716.md

Made changes to the event ID for password change

fixes#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/11073
---
 windows/security/threat-protection/auditing/event-4716.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md
index 64f3140ad0..5b197088ad 100644
--- a/windows/security/threat-protection/auditing/event-4716.md
+++ b/windows/security/threat-protection/auditing/event-4716.md
@@ -181,7 +181,7 @@ After the event, one more event ID is generated:
 Log Name:      Security
 Source:        Microsoft-Windows-Security-Auditing
 Date:          <time>
-Event ID:      4742
+Event ID:      4724
 Task Category: Computer Account Management
 Level:         Information
 Keywords:      Audit Success
@@ -217,4 +217,4 @@ Subject:
                     Account Name:      U806391a                                              //Users who has modified the attribute.
                     Account Domain:    RED
                     Logon ID:          0x16049916
-```
\ No newline at end of file
+```

From 223068a485f382bd2fca18acf25a3e16223cc589 Mon Sep 17 00:00:00 2001
From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com>
Date: Mon, 27 Feb 2023 15:19:41 +0100
Subject: [PATCH 02/16] Update event-4624.md

add detail the event may not be using "SYSTEM" all the time.
---
 windows/security/threat-protection/auditing/event-4624.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md
index aab983edfc..b6c4228b34 100644
--- a/windows/security/threat-protection/auditing/event-4624.md
+++ b/windows/security/threat-protection/auditing/event-4624.md
@@ -123,6 +123,8 @@ This event generates when a logon session is created (on destination machine). I
 
 - **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
 
+This field may also contain no subject user information, but the NULL Sid "S-1-0-0" adn no user and domain information.
+
   > [!NOTE]
   > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
 

From 63beb1e41ebcac415a19515a6520a688ecf013ac Mon Sep 17 00:00:00 2001
From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com>
Date: Tue, 28 Feb 2023 07:48:39 +0100
Subject: [PATCH 03/16] Update
 windows/security/threat-protection/auditing/event-4624.md

what a typo

Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
 windows/security/threat-protection/auditing/event-4624.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md
index b6c4228b34..be7623e5ac 100644
--- a/windows/security/threat-protection/auditing/event-4624.md
+++ b/windows/security/threat-protection/auditing/event-4624.md
@@ -123,7 +123,7 @@ This event generates when a logon session is created (on destination machine). I
 
 - **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
 
-This field may also contain no subject user information, but the NULL Sid "S-1-0-0" adn no user and domain information.
+    This field may also contain no subject user information, but the NULL Sid "S-1-0-0" and no user or domain information.
 
   > [!NOTE]
   > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).

From 353b86fed7a77a53091f7d4e505f4033d7160677 Mon Sep 17 00:00:00 2001
From: msarcletti <56821677+msarcletti@users.noreply.github.com>
Date: Wed, 8 Mar 2023 17:05:55 +0100
Subject: [PATCH 04/16] Update policy-csp-networklistmanager.md

Adjust the description to reflect changes in the Intune UI. Add additional information on how to test the NLS URLs.
---
 .../mdm/policy-csp-networklistmanager.md      | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index 44eecc6ae9..f70e301d37 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -37,23 +37,25 @@ ms.topic: reference
 
 <!-- AllowedTlsAuthenticationEndpoints-Description-Begin -->
 <!-- Description-Source-DDF -->
-List of URLs (seperated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+List of URLs to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
 <!-- AllowedTlsAuthenticationEndpoints-Description-End -->
 
 <!-- AllowedTlsAuthenticationEndpoints-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
 
-When entering a list of TLS endpoints in Microsoft Intune, use the following format, even in the UI:
+- The HTTPS endpoint must not have any more authentication checks, such as sign-in or multi-factor authentication.
+- The HTTPS endpoint must be an internal address not accessible from outside the organizational network.
+- The client must trust the server certificate. So the CA certificate that the HTTPS server certificate chains to must be present in the client machine's root certificate store.
+- A certificate shouldn't be a public certificate.
+
+Test the URL using this command, it MUST return a HTTP_STATUS_OK 200
+
+`Invoke-webrequest https://nls.corp.contoso.com -Method get -UseBasicParsing -MaximumRedirection 0`
+
+When entering a list of TLS endpoints in Microsoft Intune using a configruation profile with a custom template and the OMA URI, the URLs must be seperated by Unicode character 0xF000. It must be this format:
 
 `<![CDATA[https://nls.corp.contoso.com&#xF000;https://nls.corp.fabricam.com]]>`
 
-- The HTTPS endpoint must not have any more authentication checks, such as sign-in or multi-factor authentication.
-
-- The HTTPS endpoint must be an internal address not accessible from outside the organizational network.
-
-- The client must trust the server certificate. So the CA certificate that the HTTPS server certificate chains to must be present in the client machine's root certificate store.
-
-- A certificate shouldn't be a public certificate.
 <!-- AllowedTlsAuthenticationEndpoints-Editable-End -->
 
 <!-- AllowedTlsAuthenticationEndpoints-DFProperties-Begin -->

From 3081e634b1f8237079d414dac7d4d11cd789bbce Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Wed, 8 Mar 2023 11:32:46 -0500
Subject: [PATCH 05/16] updates

---
 .openpublishing.redirection.json              |  20 ++
 education/breadcrumb/toc.yml                  |   6 +
 education/windows/TOC.yml                     |  20 +-
 education/windows/change-to-pro-education.md  | 303 ------------------
 .../configure-windows-for-education.md        |   4 +-
 .../windows/edu-deployment-recommendations.md |  18 +-
 .../enable-s-mode-on-surface-go-devices.md    | 138 --------
 education/windows/s-mode-switch-to-edu.md     |  67 ----
 education/windows/test-windows10s-for-edu.md  | 232 --------------
 9 files changed, 45 insertions(+), 763 deletions(-)
 delete mode 100644 education/windows/change-to-pro-education.md
 delete mode 100644 education/windows/enable-s-mode-on-surface-go-devices.md
 delete mode 100644 education/windows/s-mode-switch-to-edu.md
 delete mode 100644 education/windows/test-windows10s-for-edu.md

diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index 6b0407617e..9dda6989f1 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -20629,6 +20629,26 @@
       "source_path": "windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md",
       "redirect_url": "/windows/security",
       "redirect_document_id": false
+    },
+    {
+      "source_path": "education/windows/s-mode-switch-to-edu.md",
+      "redirect_url": "/education/windows",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "education/windows/change-to-pro-education.md",
+      "redirect_url": "/education/windows",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "education/windows/test-windows10s-for-edu.md",
+      "redirect_url": "/windows/deployment/s-mode",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "education/windows/enable-s-mode-on-surface-go-devices.md",
+      "redirect_url": "/windows/deployment/s-mode",
+      "redirect_document_id": false
     }
   ]
 }
diff --git a/education/breadcrumb/toc.yml b/education/breadcrumb/toc.yml
index 15833fa467..23a57d2206 100644
--- a/education/breadcrumb/toc.yml
+++ b/education/breadcrumb/toc.yml
@@ -16,3 +16,9 @@ items:
       - name: Windows
         tocHref: /windows/configuration/
         topicHref: /education/windows/index
+      - name: Windows
+        tocHref: /windows/deployment/
+        topicHref: /education/windows/index
+      - name: Windows
+        tocHref: /windows/Security/Application Control for Windows/
+        topicHref: /education/windows/index
diff --git a/education/windows/TOC.yml b/education/windows/TOC.yml
index b732e77d6d..3af062779c 100644
--- a/education/windows/TOC.yml
+++ b/education/windows/TOC.yml
@@ -18,10 +18,12 @@ items:
         href: windows-11-se-faq.yml
     - name: Windows in S Mode
       items:
-      - name: Test Windows 10 in S mode on existing Windows 10 education devices
-        href: test-windows10s-for-edu.md
-      - name: Enable Windows 10 in S mode on Surface Go devices
-        href: enable-s-mode-on-surface-go-devices.md
+      - name: Overview
+        href: /windows/deployment/s-mode
+      - name: Switch Windows edition from S mode
+        href: /windows/deployment/windows-10-pro-in-s-mode
+      - name: Deploy Win32 apps to S Mode devices
+        href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s
     - name: Windows 10 editions for education customers
       href: windows-editions-for-education-customers.md
     - name: Considerations for shared and guest devices
@@ -50,14 +52,8 @@ items:
       href: get-minecraft-for-education.md
     - name: Use the Set up School PCs app
       href: use-set-up-school-pcs-app.md
-    - name: Change Windows edition
-      items: 
-      - name: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode
-        href: s-mode-switch-to-edu.md
-      - name: Change to Windows 10 Pro Education from Windows 10 Pro
-        href: change-to-pro-education.md
-      - name: Upgrade Windows Home to Windows Education on student-owned devices
-        href: change-home-to-edu.md
+    - name: Upgrade Windows Home to Windows Education on student-owned devices
+      href: change-home-to-edu.md
     - name: Migrate from Chromebook to Windows
       items: 
         - name: Chromebook migration guide
diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md
deleted file mode 100644
index a134019d38..0000000000
--- a/education/windows/change-to-pro-education.md
+++ /dev/null
@@ -1,303 +0,0 @@
----
-title: Change to Windows 10 Education from Windows 10 Pro
-description: Learn how IT Pros can opt into changing to Windows 10 Pro Education from Windows 10 Pro.
-ms.topic: how-to
-ms.date: 08/10/2022
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
-ms.collection:
-  - highpri
-  - tier2
-  - education
----
-
-# Change to Windows 10 Pro Education from Windows 10 Pro
-Windows 10 Pro Education is a new offering in Windows 10, version 1607. This edition builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools by providing education-specific default settings.
-
-If you have an education tenant and use devices with Windows 10 Pro, global administrators can opt in to a free change to Windows 10 Pro Education depending on your scenario.
-- [Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode](./s-mode-switch-to-edu.md)
-
-To take advantage of this offering, make sure you meet the [requirements for changing](#requirements-for-changing). For academic customers who are eligible to change to Windows 10 Pro Education, but are unable to use the above methods, contact Microsoft Support for assistance.
-
->[!IMPORTANT]
->If you change a Windows 10 Pro device to Windows 10 Pro Education using Microsoft Store for Education, [subscription activation](/windows/deployment/windows-10-subscription-activation) won't work.
-
-## Requirements for changing
-Before you change to Windows 10 Pro Education, make sure you meet these requirements:
-- Devices must be running Windows 10 Pro, version 1607 or higher.
-- Devices must be Azure Active Directory-joined, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices).
-
-    If you haven't domain joined your devices already, [prepare for deployment of Windows 10 Pro Education licenses](#preparing-for-deployment-of-windows-10-pro-education-licenses).
-
-- The Azure AD tenant must be recognized as an education approved tenant.
-- You must have a Microsoft Store for Education account.
-- The user making the changes must be a member of the Azure AD global administrator group.
-
-## Compare Windows 10 Pro and Pro Education editions
-You can [compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10.
-
-For more info about Windows 10 default settings and recommendations for education customers, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
-
-## Change from Windows 10 Pro to Windows 10 Pro Education
-
-For schools that want to standardize all their Windows 10 Pro devices to Windows 10 Pro Education, a global admin for the school can opt in to a free change through the Microsoft Store for Education.
-
-In this scenario:
-
-- The IT admin of the tenant chooses to turn on the change for all Azure AD-joined devices.
-- Any device that joins the Azure AD will change automatically to Windows 10 Pro Education.
-- The IT admin has the option to automatically roll back to Windows 10 Pro, if desired. See [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro).
-
-See [change using Microsoft Store for Education](#change-using-microsoft-store-for-education) for details on how to turn on the change.
-
-### Change using Intune for Education
-
-1. In Intune for Education, select **Groups** and then choose the group that you want to apply the MAK license key to. 
-
-    For example, to apply the change for all teachers, select **All Teachers** and then select **Settings**.
-    
-2. In the settings page, find **Edition upgrade** and then:
-    1. Select the edition in the **Edition to upgrade to** field
-    2. Enter the MAK license key in the **Product key** field 
-   
-        **Figure 1** - Enter the details for the Windows edition change
-
-        ![Enter the details for the Windows edition change.](images/i4e_editionupgrade.png)
-
-3. The change will automatically be applied to the group you selected.
-
-
-### Change using Windows Configuration Designer
-You can use Windows Configuration Designer to create a provisioning package that you can use to change the Windows edition for your device(s). [Install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22) to create a provisioning package.
-
-1. In Windows Configuration Designer, select **Provision desktop devices** to open the simple editor and create a provisioning package for Windows desktop editions.
-2. In the **Set up device** page, enter the MAK license key in the **Enter product key** field to change to Windows 10 Pro Education.
-
-    **Figure 2** - Enter the license key 
-
-    ![Enter the license key to change to Windows 10 Pro Education.](images/wcd/wcd_productkey.png)
-
-3. Complete the rest of the process for creating a provisioning package and then apply the package to the devices you want to change to Windows 10 Pro Education.
-
-    For more information about using Windows Configuration Designer, see [Set up student PCs to join domain](./set-up-students-pcs-to-join-domain.md). 
-
-
-### Change using the Activation page
-
-1. On the Windows device that you want to change, open the **Settings** app.
-2. Select **Update & security** > **Activation**, and then click **Change product key**.
-3. In the **Enter a product key** window, enter the MAK key for Windows 10 Pro Education and click **Next**.
-
-
-## Education customers with Azure AD-joined devices
-
-Academic institutions can easily move from Windows 10 Pro to Windows 10 Pro Education without using activation keys or reboots. When one of your users enters their Azure AD credentials associated with a Windows 10 Pro Education license, the operating system changes to Windows 10 Pro Education and all the appropriate Windows 10 Pro Education features are unlocked. Previously, only schools or organizations purchasing devices as part of the Shape the Future K-12 program or with a Microsoft Volume Licensing Agreement could deploy Windows 10 Pro Education to their users. Now, if you have an Azure AD for your organization, you can take advantage of the Windows 10 Pro Education features.
-
-When you change to Windows 10 Pro Education, you get the following benefits:
-
-- **Windows 10 Pro Education edition**. Devices currently running Windows 10 Pro, version 1607 or higher, or Windows 10 S mode, version 1703, can get Windows 10 Pro Education Current Branch (CB). This benefit doesn't include Long Term Service Branch (LTSB).
-- **Support from one to hundreds of users**. The Windows 10 Pro Education program doesn't have a limitation on the number of licenses an organization can have.
-- **Roll back options to Windows 10 Pro**
-  - When a user leaves the domain or you turn off the setting to automatically change to Windows 10 Pro Education, the device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 30 days). 
-  - For devices that originally had Windows 10 Pro edition installed, when a license expires or is transferred to another user, the Windows 10 Pro Education device seamlessly steps back down to Windows 10 Pro. 
-
-    See [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro) for more info.
-
-
-### Change using Microsoft Store for Education
-Once you enable the setting to change to Windows 10 Pro Education, the change will begin only after a user signs in to their device. The setting applies to the entire organization or tenant, so you can't select which users will receive the change. The change will only apply to Windows 10 Pro devices.
-
-**To turn on the automatic change to Windows 10 Pro Education**
-
-1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your work or school account.
-
-   If you're signing into the Microsoft Store for Education for the first time, you'll be prompted to accept the Microsoft Store for Education Terms of Use.
-
-2. Click **Manage** from the top menu and then select the **Benefits tile**.
-3. In the **Benefits** tile, look for the **Change to Windows 10 Pro Education for free** link and then click it.
-
-4. In the **Change all your devices to Windows 10 Pro Education for free** page, check box next to **I understand enabling this setting will change all domain-joined devices running Windows 10 Pro in my organization**.
-
-    **Figure 3** - Check the box to confirm
-
-    ![Check the box to confirm.](images/msfe_manage_benefits_checktoconfirm.png)
-
-5. Click **Change all my devices**. 
-
-    A confirmation window pops up to let you know that an email has been sent to you to enable the change. 
-
-6. Close the confirmation window and check the email to proceed to the next step.
-7. In the email, click the link to **Change to Windows 10 Pro Education**. Once you click the link, you are taken back to the Microsoft Store for Education portal.
-
-8. Click **Change now** in the **changing your device to Windows 10 Pro Education for free** page in the Microsoft Store. 
-
-    You'll see a window that confirms you've successfully changed all the devices in your organization to Windows 10 Pro Education, and each Azure AD joined device running Windows 10 Pro will automatically change the next time someone in your organization signs in to the device.
-
-9. Click **Close** in the **Success** window.
-
-Enabling the automatic change also triggers an email message notifying all global administrators in your organization about the change. It also contains a link that enables any global administrators to cancel the change if they choose. For more info about rolling back or canceling the change, see [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro).
-
-
-## Explore the change experience
-
-So what will users experience? How will they change their devices?
-
-### For existing Azure AD-joined devices
-Existing Azure AD domain joined devices will be changed to Windows 10 Pro Education the next time the user logs in. That's it! No other steps are needed.
-
-### For new devices that are not Azure AD joined
-Now that you've turned on the setting to automatically change to Windows 10 Pro Education, the users are ready to change their devices running Windows 10 Pro, version 1607 or higher, version 1703 to Windows 10 Pro Education edition.
-
-#### Step 1: Join users' devices to Azure AD
-
-Users can join a device to Azure AD the first time they start the device (during setup), or they can join a device that they already use running Windows 10 Pro, version 1607 or higher, version 1703.
-
-**To join a device to Azure AD the first time the device is started**
-
-There are different methods you can use to join a device to Azure AD:
-- For multiple devices, we recommend using the [Set up School PCs app](use-set-up-school-pcs-app.md) to create a provisioning package to quickly provision and set up Windows 10 devices for education.
-- For individual devices, you can use the Set up School PCs app or go through the Windows 10 device setup experience. If you choose this option, see the following steps.
-
-**To join a device to Azure AD using Windows device setup**
-
-If the Windows device is running Windows 10, version 1703, follow these steps.
-
-1. During initial device setup, on the **How would you like to set up?** page, select **Set up for an organization**, and then click **Next**.
-
-2. On the **Sign in with Microsoft** page, enter the username and password to use with Office 365 or other services from Microsoft, and then click **Next**.
-
-3. Go through the rest of Windows device setup. Once you're done, the device will be Azure AD joined to your school's subscription.
-
-
-**To join a device to Azure AD when the device already has Windows 10 Pro, version 1703 installed and set up**
-
-If the Windows device is running Windows 10, version 1703, follow these steps.
-
-1.  Go to **Settings > Accounts > Access work or school**.
-
-    **Figure 6** - Go to **Access work or school** in Settings
-
-    ![Go to Access work or school in Settings.](images/settings_workorschool_1.png)
-
-2. In **Access work or school**, click **Connect**.
-3. In the **Set up a work or school account** window, click the **Join this device to Azure Active Directory** option at the bottom.
-
-    **Figure 7** - Select the option to join the device to Azure Active Directory
-
-    ![Select the option to join the device to Azure Active Directory.](images/settings_setupworkorschoolaccount_2.png)
-
-4. On the **Let's get you signed in** window, enter the Azure AD credentials (username and password) and sign in. The device is joined with the school's Azure AD.
-5. To verify that the device was successfully joined to Azure AD, go back to **Settings > Accounts > Access work or school**. You should now see a connection under the **Connect to work or school** section that indicates the device is connected to Azure AD.
-
-    **Figure 8** - Verify the device connected to Azure AD
-
-    ![Verify the device is connected to Azure AD.](images/settings_connectedtoazuread_3.png)
-
-
-#### Step 2: Sign in using Azure AD account
-
-Once the device is joined to your Azure AD subscription, users will sign in by using their Azure AD account. The Windows 10 Pro Education license associated with the user will enable Windows 10 Pro Education edition capabilities on the device.
-
-
-#### Step 3: Verify that Pro Education edition is enabled
-
-You can verify the Windows 10 Pro Education in **Settings &gt; Update & Security &gt; Activation**.
-
-**Figure 9** - Windows 10 Pro Education in Settings
-
-<img src="images/win-10-pro-edu-activated-subscription-active.png" alt="Windows 10 activated and subscription active" />
-
-If there are any problems with the Windows 10 Pro Education license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process.
-
-### Troubleshoot the user experience
-
-In some instances, users may experience problems with the Windows 10 Pro Education change. The most common problems that users may experience are as follows:
-
--   The existing operating system (Windows 10 Pro, version 1607 or higher, or version 1703) isn't activated.
--   The Windows 10 Pro Education change has lapsed or has been removed.
-
-Use the following figures to help you troubleshoot when users experience these common problems:
-
-**Figure 10** - Illustrates a device in a healthy state, where the existing operating system is activated, and the Windows 10 Pro Education change is active.
-
-<img src="images/win-10-pro-edu-activated-subscription-active.png" alt="Windows 10 activated and subscription active" /></br></br>
-
-
-**Figure 11** - Illustrates a device on which the existing operating system isn't activated, but the Windows 10 Pro Education change is active.
-
-<img src="images/win-10-pro-edu-not-activated-subscription-active.png" alt="Windows 10 not activated and subscription active" /></br></br>
-
-
-### Review requirements on devices
-
-Devices must be running Windows 10 Pro, version 1607 or higher, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. You can use the following procedures to review whether a particular device meets requirements.
-
-**To determine if a device is Azure AD joined**
-
-1.  Open a command prompt and type the following command:
-
-    ```
-    dsregcmd /status
-    ```
-
-2.  Review the output under Device State. If the **AzureAdJoined** status is YES, the device is Azure Active Directory-joined.
-
-**To determine the version of Windows 10**
-
--   At a command prompt, type:
-
-    ```
-    winver
-    ```
-
-    A popup window will display the Windows 10 version number and detailed OS build information.
-
-    > [!NOTE]
-    > If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be changed to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license.
-
-### Roll back Windows 10 Pro Education to Windows 10 Pro
-
-If your organization has the Windows 10 Pro to Windows 10 Pro Education change enabled, and you decide to roll back to Windows 10 Pro or to cancel the change, perform the following task:
-
-- Log into Microsoft Store for Education page and turning off the automatic change.
-- Selecting the link to turn off the automatic change from the notification email sent to all global administrators.
-
-Once the automatic change to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were changed will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. Therefore, users whose device was changed may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that a change was enabled and then turned off will never see their device change from Windows 10 Pro.
-
-> [!NOTE]  
-> Devices that were changed from  mode to Windows 10 Pro Education can't roll back to Windows 10 Pro Education S mode.
-
-**To roll back Windows 10 Pro Education to Windows 10 Pro**
-
-1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your school or work account, or follow the link from the notification email to turn off the automatic change.
-2. Select **Manage > Benefits** and locate the section **Windows 10 Pro Education** and follow the link.
-3. In the **Revert to Windows 10 Pro** page, click **Revert to Windows 10 Pro**.
-
-    **Figure 12** - Revert to Windows 10 Pro
-
-    ![Revert to Windows 10 Pro.](images/msfe_manage_reverttowin10pro.png)
-
-4. You'll be asked if you're sure that you want to turn off automatic changes to Windows 10 Pro Education. Click **Yes**.
-5. Click **Close** in the **Success** page.
-
-    All global admins get a confirmation email that a request was made to roll back your organization to Windows 10 Pro. If you, or another global admin, decide later that you want to turn on automatic changes again, you can do this by selecting **change to Windows 10 Pro Education for free** from the **Manage > Benefits** in the Microsoft Store for Education.
-
-
-## Preparing for deployment of Windows 10 Pro Education licenses
-
-If you have on-premises Active Directory Domain Services (AD DS) domains, users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Pro Education to users, you need to synchronize the identities in the on-premises AD DS domain with Azure AD.
-
-You need to synchronize these identities so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Pro Education). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them.
-
-(Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure.
-
-For more information about integrating on-premises AD DS domains with Azure AD, see these resources:
--   [Integrating your on-premises identities with Azure Active Directory](/azure/active-directory/hybrid/whatis-hybrid-identity)
--   [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/)
-
-## Related topics
-
-[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)  
-[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)  
-[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)  
-[Windows 10 subscription activation](/windows/deployment/windows-10-subscription-activation)
\ No newline at end of file
diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md
index 587d279c84..f736b5adc6 100644
--- a/education/windows/configure-windows-for-education.md
+++ b/education/windows/configure-windows-for-education.md
@@ -10,7 +10,7 @@ appliesto:
 
 Privacy is important to us, we want to provide you with ways to customize the OS diagnostic data, consumer experiences, Cortana, search, and some of the preinstalled apps, for usage with [education editions of Windows 10](windows-editions-for-education-customers.md) in education environments. These features work on all Windows 10 editions, but education editions of Windows 10 have the settings preconfigured. We recommend that all Windows 10 devices in an education setting be configured with **[SetEduPolicies](#setedupolicies)** enabled. For more information, see the following table. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305).
 
-We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md).
+We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md).
 
 In Windows 10, version 1703 (Creators Update), it's straightforward to configure Windows to be education ready.
 
@@ -45,7 +45,7 @@ It's easy to be education ready when using Microsoft products. We recommend the
    3. Enroll the PCs in MDM.
       * If you've activated Intune for Education in your Azure AD tenant, enrollment will happen automatically when the PC is joined to Azure AD. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False.
    4. Ensure that needed assistive technology apps can be used.
-      * If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info.
+      * If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info.
 
 4. Distribute the PCs to students.
 
diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md
index 392497fa7d..fc74fcd614 100644
--- a/education/windows/edu-deployment-recommendations.md
+++ b/education/windows/edu-deployment-recommendations.md
@@ -9,9 +9,9 @@ appliesto:
 
 # Deployment recommendations for school IT administrators
 
-Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, and some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we’d like you to be aware of. For more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
+Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, and some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we'd like you to be aware of. For more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
 
-We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md).
+We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md).
 
 ## Deployment best practices
 
@@ -20,16 +20,16 @@ Keep these best practices in mind when deploying any edition of Windows 10 in sc
 * A Microsoft account is only intended for consumer services. Enterprises and educational institutions should use enterprise versions where possible, such as Skype for Business, OneDrive for Business, and so on. For schools, consider using mobile device management (MDM) or Group Policy to block students from adding a Microsoft account as a secondary account
 * If schools allow the use of personal accounts by their students to access personal services, schools should be aware that these accounts belong to individuals, not the school
 * IT administrators, school officials, and teachers should also consider ratings when picking apps from the Microsoft Store
-* If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info
+* If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info
 
 ## Windows 10 Contacts privacy settings
 
-If you’re an IT administrator who deploys Windows 10 in a school or district, we recommend that you review these deployment resources to make informed decisions about how you can configure telemetry for your school or district:
+If you're an IT administrator who deploys Windows 10 in a school or district, we recommend that you review these deployment resources to make informed decisions about how you can configure telemetry for your school or district:
 
 * [Configure Windows telemetry in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) - Describes the types of telemetry we gather and the ways you can manage this data
 * [Manage connections from Windows operating system components to Microsoft services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) - Learn about network connections that Windows components make to Microsoft and also the privacy settings (such as location, camera, messaging, and more) that affect data that is shared with either Microsoft or apps and how you can manage this data
 
-In particular, the **Contacts** area in the **Settings** > **Privacy** section lets you choose which apps can access a student’s contacts list. By default, this setting is turned on.
+In particular, the **Contacts** area in the **Settings** > **Privacy** section lets you choose which apps can access a student's contacts list. By default, this setting is turned on.
 
 To change the setting, you can:
 * [Turn off access to contacts for all apps](#turn-off-access-to-contacts-for-all-apps)
@@ -78,7 +78,7 @@ If the school allows the use of personal or Microsoft account in addition to org
 
 #### Skype
 
-Skype uses the user’s contact details to deliver important information about the account and it also lets friends find each other on Skype.
+Skype uses the user's contact details to deliver important information about the account and it also lets friends find each other on Skype.
 
 To manage and edit your profile in the Skype UWP app, follow these steps:
 
@@ -101,20 +101,20 @@ To manage and edit your profile in the Skype UWP app, follow these steps:
 
 #### Xbox
 
-A user’s Xbox friends and their friends’ friends can see their real name and profile. By default, the Xbox privacy settings enforce that no personal identifying information of a minor is shared on the Xbox Live network, although adults in the child’s family can change these default settings to allow it to be more permissive.
+A user's Xbox friends and their friends' friends can see their real name and profile. By default, the Xbox privacy settings enforce that no personal identifying information of a minor is shared on the Xbox Live network, although adults in the child's family can change these default settings to allow it to be more permissive.
 
 To learn more about how families can manage security and privacy settings on Xbox, see this [Xbox article on security](https://go.microsoft.com/fwlink/?LinkId=821445).
 
 
 ### Delete an account if username is identifying
 
-If you want to delete either (or both) the Skype and the Xbox accounts, here’s how to do it.
+If you want to delete either (or both) the Skype and the Xbox accounts, here's how to do it.
 
 #### Skype
 
 To delete a Skype account, you can follow the instructions here: [How do I close my Skype account?](https://go.microsoft.com/fwlink/?LinkId=816515)
 
-If you need help with deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you’ve signed in, you can:
+If you need help with deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you've signed in, you can:
 
 1. Select a help topic (**Account and Password**)
 1. Select a related problem (**Deleting an account**)
diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md
deleted file mode 100644
index 6fa45fd3e7..0000000000
--- a/education/windows/enable-s-mode-on-surface-go-devices.md
+++ /dev/null
@@ -1,138 +0,0 @@
----
-title: Enable S mode on Surface Go devices for Education
-description: Learn how to enable S mode on Surface Go devices.
-ms.date: 08/10/2022
-ms.topic: how-to
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
----
-
-# Surface Go for Education - Enabling S mode
-
-Surface Go devices are available with both Windows 10 Home in S mode and Windows 10 Pro configurations. Education customers who purchase Surface Go devices with Windows 10 Pro may wish to take advantage of S mode on their Pro devices. These customers can create their own S mode image for Surface Go or enable S mode on a per-device basis.
-
-## Prerequisites
-
-Here are some things you’ll need before attempting any of these procedures:
-
--   A Surface Go device or Surface Go device image based on Windows 10 Pro
-    (1803)
--   General understanding of [Windows deployment scenarios and related
-    tools](/windows/deployment/windows-deployment-scenarios-and-tools)
--   [Windows ADK for Windows 10
-    1803](/windows/deployment/windows-adk-scenarios-for-it-pros)
--   [Bootable Windows Preinstall Environment
-    (WinPE)](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive)
-
-## Enabling S Mode – Windows Image (WIM)
-
-Like enterprise administrators performing large-scale deployment of customized Windows images, education customers can create their own customized Windows images for deployment to multiple classroom devices. An education customer who plans to follow [a traditional image-based deployment
-process](/windows/deployment/windows-10-deployment-scenarios#traditional-deployment) using a Windows 10 Pro (1803) image for Surface Go devices can enable S mode as follows:
-
-1. Use DISM to mount your offline Windows 10 Pro (1803) image.
-
-   ```
-   dism /Mount-image /imagefile:\<path_to_Image_file\> {/Index:\<image_index\> | /Name:\<image_name\>} /MountDir:\<local_target_directory\>
-   ```
-
-2. Create an unattend.xml answer file, adding the
-   amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing
-   and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”.
-   The resulting xml should look like this…
-
-   Copy
-   ```
-   <settings pass="offlineServicing">
-    <component name="Microsoft-Windows-CodeIntegrity"
-             processorArchitecture="amd64"
-             publicKeyToken="31bf3856ad364e35"
-             language="neutral"
-             versionScope="nonSxS"
-             xmlns:wcm="https://schemas.microsoft.com/WMIConfig/2002/State"
-             xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">
-        <SkuPolicyRequired>1</SkuPolicyRequired>
-     </component>
-    </settings>
-   ```
-3. Save the answer file in the **Windows\Panther** folder of your mounted image as unattend.xml.
-4. Use DISM to apply the unattend.xml file and enable S Mode:
-
-   Copy
-      ```
-         dism /image:C:\mount\windows /apply-unattend:C:\mount\windows\windows\panther\unattend.xml
-      ```
-
-   >   Note: in the above example, C:\\mount\\ is the local directory used to mount
-   >   the offline image.
-5. Commit the image changes and unmount the image
-
-   Copy
-      ```
-         dism /Unmount-image /MountDir:C:\\mount /Commit
-      ```
-   >Note: don’t forget the /Commit parameter to ensure you don’t lose your
-    changes.
-
-Your Windows 10 Pro (1803) image now has S mode enabled and is ready to deploy to Surface Go devices.
-
-## Enabling S Mode – Per Device
-
-Education customers who wish to avoid the additional overhead associated with Windows image creation, customization, and deployment can enable S mode on a per-device basis. Performing the following steps on a Surface Go device will enable S mode on an existing installation of Windows 10 Pro (1803).
-
-1.  Create a bootable WinPE media. See [Create a bootable Windows PE USB
-    drive](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) for details.
-
-2. Create an unattend.xml answer file, adding the
-    amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing
-    and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”. The resulting xml should look like this…
-
-   Copy
-   ```
-      <settings pass="offlineServicing">
-        <component name="Microsoft-Windows-CodeIntegrity"
-              processorArchitecture="amd64"
-              publicKeyToken="31bf3856ad364e35"
-              language="neutral"
-              versionScope="nonSxS"
-              xmlns:wcm="https://schemas.microsoft.com/WMIConfig/2002/State"
-              xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">
-         <SkuPolicyRequired>1</SkuPolicyRequired>
-     </component>
-   </settings>
-   ```
-
-3. Attach your bootable WinPE USB drive to a Surface Go device and perform a USB boot (hold the **volume down** button while powering on the device… continue to hold until the Surface logo appears)
-4. Wait for WinPE to launch a command window     (*X:\\windows\\system32\\cmd.exe*).
-5. Apply the unattend.xml created in step 2 using DISM.
-
-   Copy
-   ```
-      dism /image:C:\ /apply-unattend:D:\unattend.xml
-   ```
-   >  Note: in the above example, C:\\ is the local OS drive (offline). D:\ is where the S mode unattend.xml file (from Step 2) resides.
-
-6.  Once DISM has successfully applied the unattend.xml, reboot the Surface Go device.
-Upon reboot, you should find your Surface Go device now is now in S mode.
-
-## Troubleshooting
-
-|ISSUE | RESOLUTION |
-|------------------------ |-----------------------|
-|DISM fails to apply the unattend.xml because the OS drive is encrypted. | This is one reason why it’s best to enable S mode before setting up and configuring a device. If the OS drive has already been encrypted, you’ll need to fully decrypt the drive before you can enable S mode. |
-|Unattend.xml has been applied and dism reports success. However, when I boot the device, it’s not in S mode. This can happen when a device was booted to Windows 10 Pro before S mode was enabled. To resolve this issue, do the following: | 1.  **Run** “shutdown.exe -p -f” to force a complete shutdown. <br> 2.  Hold the **vol-up** button while pressing the **power** button to power on the device. Continue to hold **vol-up** until you see the Surface UEFI settings. <br> 3.  Under **Security** find the **Secure Boot** option and disable it. <br> 4.  With SecureBoot disabled choose **exit** -\> **restart now** to exit UEFI settings and reboot the device back to Windows. <br> 5.  Confirm that S mode is now properly enabled. <br> 6.  Once you’ve confirmed S mode, you should re-enable Secure Boot… repeat the above steps, choosing to **Enable** Secure Boot from the UEFI securitysettings.
-
-## Additional Info
-
-[Windows 10 deployment scenarios](/windows/deployment/windows-10-deployment-scenarios)
-
-[Windows 10 deployment scenarios and tools](/windows/deployment/windows-deployment-scenarios-and-tools)
-
-[Download and install the Windows ADK](/windows-hardware/get-started/adk-install)
-
-[Windows ADK for Windows 10 scenarios for IT Pros](/windows/deployment/windows-adk-scenarios-for-it-pros)
-
-[Modify a Windows Image Using DISM](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism)
-
-[Service a Windows Image Using DISM](/windows-hardware/manufacture/desktop/service-a-windows-image-using-dism)
-
-[DISM Image Management Command-Line Options](/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14)
\ No newline at end of file
diff --git a/education/windows/s-mode-switch-to-edu.md b/education/windows/s-mode-switch-to-edu.md
deleted file mode 100644
index fafc2716c8..0000000000
--- a/education/windows/s-mode-switch-to-edu.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-title: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode
-description: Learn how to switch out of Windows 10 Pro in S mode to Windows 10 Pro Education.
-ms.topic: how-to
-ms.date: 08/10/2022
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
----
-
-# Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode
-The S mode switch motion enables users to switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode. This gives users access to the Microsoft Store for Education and to other Education offers.
-
-## Benefits of Windows 10 Pro in S mode for Education
-
-S mode is an enhanced security mode of Windows 10 – streamlined for security and superior performance. With Windows 10 in S mode, everyone can download and install Microsoft-verified apps from the Microsoft Store for Education – this mode keeps devices running fast and secure day in and day out. 
-
-- **Microsoft-verified security** - It reduces risk of malware and exploitations that harm students and educators, because only Microsoft-verified apps can be installed.
-- **Performance that lasts** - Provides all-day battery life to keep students on task and not tripping over cords. Also, verified apps won’t degrade device performance over time.
-- **Streamlined for Speed** - Offers faster log-in times so teachers spend less time waiting and more time teaching. 
-
-
-|  |Home  |S mode  |Pro/Pro Education  |Enterprise/Education |
-|:---------|:---:|:---:|:---:|:---:|
-|**Start Menu/Hello/Cortana/<BR>Windows Ink/Microsoft Edge** | X | X | X | X |
-|**Store apps (including Windows <BR>desktop bridge apps)** | X | X | X | X |
-|**Windows Update** | X | X | X | X |
-|**Device Encryption** | X | X | X | X |
-|**BitLocker** | | X | X | X |
-|**Windows Update for Business** |  | X | X | X |
-|**Microsoft Store for Education** | | X | X | X |
-|**Mobile Device Management**<BR> **and Azure AD join** | | X | X | X |
-|**Group Policy management and** <BR>**Active Directory Domain Services** | | | X | X |
-|**Desktop (Windows 32) Apps** | X | | X | X |
-|**Change App Defaults**<BR>**Search/Browser/Photos/etc.** | X | | X | X |
-|**Credential Guard** | | | | X |
-|**Device Guard** | | | | X |
-
-### Windows 10 in S mode is safe, secure, and fast.  
-However, in some limited scenarios, you might need to switch to Windows 10 Education. You can switch devices running Windows 10, version 1709 or later. Use the following information to switch to Windows 10 Pro through the Microsoft Store. 
-
-## How to switch
-
-### Devices running Windows 10, version 1803
-
-**Switch using the Microsoft Store for Education**<BR>
-There are two switch options available using the Microsoft Store for Education:
-
-Tenant-wide Windows 10 Pro in S mode > Pro Education in S mode <BR>
-Tenant-wide Windows 10 Pro > Pro Education
-
-> [!IMPORTANT]
-> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to roll back this kind of switch is through a [bare metal recovery (BMR)](/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset.
-
-### Devices running Windows 10, version 1709
-
-1. **Bulk switch through Microsoft Store for Education** - In this scenario, the global admin for the Azure AD education tenant can use Microsoft Store to switch all Windows 10 Pro in S mode devices on the tenant to Windows 10 Pro Education. (Devices running Windows 10, version 1803 will switch to Windows 10 Pro EDU in S mode.)
-
-2. **Key acquisition options** - For schools with **active Microsoft Volume Licensing** agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education.
-
-> [!NOTE]
-> There is currently no "bulk-switch" option for devices running Windows 10, version 1803. 
-
-## Related Topics
-[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)<br>
-[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)<BR> 
-[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md) <BR>
-[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
\ No newline at end of file
diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md
deleted file mode 100644
index eaeda25979..0000000000
--- a/education/windows/test-windows10s-for-edu.md
+++ /dev/null
@@ -1,232 +0,0 @@
----
-title: Test Windows 10 in S mode on existing Windows 10 education devices
-description: Provides guidance on downloading and testing Windows 10 in S mode for existing Windows 10 education devices.
-ms.topic: conceptual
-ms.date: 08/10/2022
-appliesto:
-  - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
-ms.collection:
-  - highpri
-  - education
-  - tier2
----
-
-# Test Windows 10 in S mode on existing Windows 10 education devices
-
-The Windows 10 in S mode self-installer will allow you to test Windows 10 in S mode on various individual Windows 10 devices (except Windows 10 Home) with a genuine, activated license<sup>[1](#footnote1)</sup>. Test Windows 10 in S mode on various devices in your school and share your feedback with us.
-
-Windows 10 in S mode is built to give schools the familiar, robust, and productive experiences you count on from Windows in an experience that's been streamlined for security and performance in the classroom, and built to work with Microsoft Education<sup>[2](#footnote2)</sup>.
-
-Windows 10 in S mode is different from other editions of Windows 10 as everything that runs on the device is verified by Microsoft for security and performance. Therefore, Windows 10 in S mode works exclusively with apps from the Microsoft Store. Some accessories and apps compatible with Windows 10 may not work and performance may vary. Certain default settings, features, and apps can't be changed. When you install Windows 10 in S mode, your existing applications and settings will be deleted, and you'll only be able to install apps from the Microsoft Store.
-
-**Configuring Windows 10 in S mode for school use is easy:** Education customers must configure **SetEduPolicies** for use in K-12 schools. For more information on how to do these configurations, see [Use the Set up School PCs app](use-set-up-school-pcs-app.md) and [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
-
-**Installing Office 365 for Windows 10 in S mode (Education preview)**: To install the Office applications in a school environment, you must use the free Setup School PCs app, which is available on the Microsoft Store for Education and from the Microsoft Store.
-
-As we finalize development of Office 365 for Windows 10 in S mode (Education preview), the applications will be updated automatically. You must have an Office license to activate the applications once they're installed. For more information about Office 365 for Education plans, see [Office on Windows 10 in S mode](https://support.microsoft.com/office/office-on-windows-10-in-s-mode-717193b5-ff9f-4388-84c0-277ddf07fe3f?ui=en-us&rs=en-us&ad=us).
-
-## Before you install Windows 10 in S mode
-
-### Important information
-
-Before you install Windows 10 in S mode, understand that non-Microsoft Store apps won't work, peripherals that require custom drivers may not work, and other errors may occur. In particular, this release of Windows 10 in S mode:
-
-- Is intended for education customers to test compatibility with existing hardware
-- May not work with some device drivers, which may not yet be ready for Windows 10 in S mode and may cause some loss in functionality
-- May not be compatible with all peripherals that require custom drivers and, even if compatible, may cause aspects of the peripheral to not function
-- Has software and feature limitations compared to other Windows 10 editions, primarily that Windows 10 in S mode is limited to Store apps only
-
-    > [!WARNING]
-    > You can install Windows 10 in S mode on devices running other editions of Windows 10. For more information, see [Supported devices](#supported-devices). However, we don't recommend installing Windows 10 in S mode on Windows 10 Home devices as you won't be able to activate it.
-
-- Won't run current Win32 software and might result in the loss of any data associated with that software, which might include software already purchased
-
-Due to these reasons, we recommend that you use the installation tool and avoid doing a clean install from an ISO media.
-
-Before you install Windows 10 in S mode on your existing Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise device:
-
-- Make sure that you updated your existing device to Windows 10, version 1703.
-
-    To update your device to Windows 10, version 1703, see [Download Windows 10](https://www.microsoft.com/software-download/windows10). You can verify your current version in **Settings > System > About**.
-
-- Install the latest Windows Update.
-
-    To do this task, go to **Settings > Update & security > Windows Update**.
-
-- Create a system backup in case you would like to return to your previously installed version of Windows 10 after trying Windows 10 in S mode.
-
-  For more information on how to create the system backup, see [Create a recovery drive](#create-a-recovery-drive).
-
-## Supported devices
-
-The Windows 10 in S mode install will install and activate on the following editions of Windows 10 in use by schools:
-
-- Windows 10 Pro
-- Windows 10 Pro Education
-- Windows 10 Education
-- Windows 10 Enterprise
-
-Other Windows 10 editions can't be activated and aren't supported. If your device isn't running one of these supported Windows 10 editions, don't proceed with using the Windows 10 in S mode installer. Windows 10-N editions and running in virtual machines aren't supported by the Windows 10 in S mode installer.
-
-### Preparing your device to install drivers
-
-Make sure all drivers are installed and working properly on your device running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise before installing Windows 10 in S mode.
-
-### Supported devices and drivers
-
-Check with your device manufacturer before trying Windows 10 in S mode on your device to see if the drivers are available and supported by the device manufacturer.
-
-## Kept files
-
-Back up all your data before installing Windows 10 in S mode. Only personal files may be kept during installation. Your settings and apps will be deleted.
-
-> [!NOTE]
-> All existing Win32 applications and data will be deleted. Save any data or installation files in case you may need to access that data again or need to reinstall these applications later.
-
-## Domain join
-
-Windows 10 in S mode doesn't support non-Azure Active Directory domain accounts. Before installing Windows 10 in S mode, you must have at least one of these administrator accounts:
-
-- Local administrator
-- Microsoft account administrator
-- Azure Active Directory administrator
-
-> [!WARNING]
-> If you don't have one of these administrator accounts accessible before migration, you'll not be able to sign in to your device after migrating to Windows 10 in S mode.
-
-We recommend [creating a recovery drive](#create-a-recovery-drive) before migrating to Windows 10 in S mode in case you run into this issue.
-
-## Installing Office applications
-
-After installing Windows 10 in S mode, use the free [Set up School PCs app](use-set-up-school-pcs-app.md) to install Office 365 for Windows 10 in S mode (Education preview). You must have an Office license to activate the applications once they're installed.
-
-## Switch to previously installed Windows 10 editions
-
-If Windows 10 in S mode isn't right for you, you can switch to the Windows 10 edition previously installed on your device(s).
-
-- Education customers can switch devices to Windows 10 Pro Education using the Microsoft Store for Education. For more information, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 in S mode](change-to-pro-education.md).
-- If you try Windows 10 in S mode and decide to switch back to the previously installed edition within 10 days, you can go back to the previously installed edition using the Windows Recovery option in Settings. For more info, see [Go back to your previous edition of Windows 10](#go-back-to-your-previous-edition-of-windows-10).
-
-## Device recovery
-
-Before installing Windows 10 in S mode, we recommend that you create a system backup in case you would like to return to Windows 10 Pro or Windows 10 Pro Education after trying Windows 10 in S mode.
-
-### Create a recovery drive
-
-To create a recovery drive, follow these steps.
-
-1. From the taskbar, search for **Create a recovery drive** and then select it. You might be asked to enter an admin password or confirm your choice.
-2. In the **Recovery drive** tool, make sure **Back up system files to the recovery drive** is selected and then select **Next**.
-3. Connect a USB drive to your PC, select it, and then select **Next > Create**.
-
-    Many files need to be copied to the recovery drive; so this process might take a while.
-
-4. When it's done, you might see a **Delete the recovery partition from your PC** link on the final screen. If you want to free up drive space on your PC, select the link, and then select **Delete**. If not, select **Finish**.
-
-### Go back to your previous edition of Windows 10
-
-Alternatively, for 10 days after you install Windows 10 in S mode, you can go back to your previous edition of Windows 10 from **Settings > Update & security > Recovery**. This revert operation will keep your personal files, but it will remove installed apps and any changes you made to **Settings**.
-
-To go back, you need to:
-
-- Keep everything in the `windows.old` and `$windows.~bt` folders after the upgrade.
-- Remove any user accounts you added after the upgrade.
-
-If going back isn't available:
-
-- Check if you can restore your PC to factory settings. This restoration will reinstall the version of Windows that came with your PC and remove personal files, apps, and drivers you installed and any changes you made to **Settings**. Go to **Settings > Update & security > Recovery > Reset this PC > Get started** and look for **Restore factory settings**.
-- If you've a product key for your previous version of Windows, use the media creation tool. It can create installation media of your previous Windows 10 edition, and do a clean install.
-
-After going back to your previous edition of Windows 10, you may receive the following message when launching Win32 apps:
-
-> For security and performance, this mode of Windows only runs verified apps from the Store.
-
-If you see this message, follow these steps to stop receiving the message:
-
-1. If you've BitLocker enabled, disable it first in the Control Panel. Go to **Manage BitLocker** and select **Turn off BitLocker**.
-2. Open Windows **Settings** and go to **Update & security > Recovery**.
-3. In the **Recovery** page, find **Advanced startup** and select **Restart now** to start your PC.
-4. After restarting, in the **Choose an option** page, select **Troubleshoot**.
-5. In the **Troubleshoot** page, select **Advanced options**, and in the **Advanced options** page select **UEFI Firmware Settings**.
-6. In the **UEFI Firmware Settings** page, select **Restart** to get to the device-specific UEFI/BIOS menu.
-7. Once you've accessed UEFI, look for the menu item labeled **Security** or **Security Settings**, and navigate to it.
-8. Look for an option called **Secure boot configuration**, **Secure boot**, or **UEFI Boot**. If you can't find one of these options, check the **Boot** menu.
-9. Disable the secure boot/UEFI boot option.
-10. Save your settings and then exit UEFI. This exit action will restart your PC.
-11. After Windows is done booting up, confirm that you no longer see the message.
-
-    > [!NOTE]
-    > We recommend following these steps again to re-enable the **Secure boot configuration**, **Secure boot**, or **UEFI Boot** option, which you disabled in step 9, and then subsequently re-enable BitLocker (if you previously had this enabled).
-
-### Use installation media to reinstall Windows 10
-
-> [!WARNING]
-> This will remove all your personal files, apps, and installed drivers. apps and customizations from your PC manufacturer, and changes you made to **Settings**.
-
-To use an installation media to reinstall Windows 10, follow these steps.
-
-1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/software-download/windows10).
-2. Download the Media Creation Tool and then run it.
-3. Select **Create installation media for another PC**.
-4. Choose a language, edition, and architecture (64-bit or 32-bit).
-5. Follow the steps to create an installation media and then select **Finish**.
-6. Connect the installation media that you created to your non-functional PC, and then turn it on.
-7. On the initial setup screen, enter your language and other preferences, and then select **Next**.
-
-    If you're not seeing the setup screen, your PC might not be set up to boot from a drive. Check your PC manufacturer's website for information on how to change your PC's boot order, and then try again.
-
-8. Select **Install now**.
-9. On the **Enter the product key to active Windows** page, enter a product key if you've one. If you upgraded to Windows 10 for free, or bought and activated Windows 10 from the Microsoft Store, select **Skip** and Windows will automatically activate later. For more information, see [Activate Windows](https://support.microsoft.com/windows/activate-windows-c39005d4-95ee-b91e-b399-2820fda32227).
-10. On the **License terms** page, select **I accept the license terms** if you agree, and then select **Next**.
-11. On the **Which type of installation do you want?** page, select **Custom**.
-12. On the **where do you want to install Windows?** page, select a partition, select a formatting option (if necessary), and then follow the instructions.
-13. When you're done formatting, select **Next**.
-14. Follow the rest of the setup instructions to finish installing Windows 10.
-
-## Download Windows 10 in S mode
-
-Ready to test Windows 10 in S mode on your existing Windows 10 Pro or Windows 10 Pro Education device? Make sure you read the [important pre-installation information](#important-information) and all the above information.
-
-When you're ready, you can download the Windows 10 in S mode installer by clicking the **Download installer** button below:
-
-> [!div class="nextstepaction" style="center"]
-> [Download installer](https://go.microsoft.com/fwlink/?linkid=853240)
-
-After you install Windows 10 in S mode, the OS defaults to the English version. To change the UI and show the localized UI, go to **Settings > Time & language > Region & language >** in **Languages**, select **Add a language** to add a new language or select an existing language, and set it as the default.
-
-## Terms and Conditions
-
-Because you're installing Windows 10 in S mode on a running version of Windows 10, you've already accepted the Windows 10 Terms and Conditions. you'ren't required to accept it again and the Windows 10 installer doesn't show a Terms and Conditions page during installation.
-
-## Support
-
-Thank you for testing Windows 10 in S mode. Your best experience will be running on a supported device as mentioned above. However, we invite you to try Windows 10 in S mode on existing devices with an eligible operating system. If you're having difficulty installing or running Windows 10 in S mode, use the Windows **Feedback Hub** to report your experience to Microsoft. This feedback is the best way to help improve Windows 10 in S mode with your feedback.
-
-Common support questions for the Windows 10 in S mode test program:
-
-### How do I activate if I don't have a Windows 10 in S mode product key?
-
-As stated above, devices running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise can install and run Windows 10 in S mode and it will automatically activate. Testing Windows 10 in S mode on a device running Windows 10 Home isn't recommended and supported at this time.
-
-### Will my OEM help me run Windows 10 in S mode?
-
-OEMs typically only support their devices with the operating system that was pre-installed. See [Supported devices](#supported-devices) for OEM devices that are best suited for testing Windows 10 in S mode. When testing Windows 10 in S mode, be ready to restore your own PC back to factory settings without assistance. Steps to return to your previous installation of Windows 10 are covered above.
-
-### What happens when I run Reset or Fresh Start on Windows 10 in S mode?
-
-**Reset** or **Fresh Start** will operate correctly and keep you on Windows 10 in S mode. They also remove the 10-day go back ability. See [Switch to previously installed Windows 10 editions](#switch-to-previously-installed-windows-10-editions) to return to your previous installation of Windows 10 if you wish to discontinue using Windows 10 in S mode.
-
-### What if I want to move from Windows 10 in S mode to Windows 10 Pro?
-
-If you want to discontinue using Windows 10 in S mode, follow the instructions to return to your previous installation of Windows 10. If you already had Windows 10 Pro or Windows 10 Pro Education on the device you're testing on, you should be able to move to Windows 10 Pro or Windows 10 Pro Education at no charge with the instructions in this document. Otherwise, there may be a cost to acquire a Windows 10 Pro license in the Store.
-
-For help with activation issues, select the appropriate link below for support options.
-
-- For Volume Licensing Agreement or Shape the Future program customers, go to the [Microsoft Commercial Support](https://support.microsoft.com/gp/commercialsupport) website and select the country/region in which you're seeking commercial support to contact our commercial support team.
-- If you don't have a Volume Licensing Agreement, go to the [Microsoft Support](https://support.microsoft.com/contactus/) website and choose a support option.
-
-<p>
-<a name="footnote1"></a><sup>1</sup> <small>Internet access fees may apply.</small><br/>
-<a name="footnote2"></a><sup>2</sup> <small>Devices must be configured for educational use by applying <strong><a href="/education/windows/configure-windows-for-education#setedupolicies" data-raw-source="[SetEduPolicies](./configure-windows-for-education.md#setedupolicies)">SetEduPolicies</a></strong> using the Setup School PCs app.</small><br/>
-
-</p>

From d67916a64e9fc51ec608eac9a1f122771a17a255 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Wed, 8 Mar 2023 11:58:59 -0500
Subject: [PATCH 06/16] toc context updates

---
 education/windows/TOC.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/education/windows/TOC.yml b/education/windows/TOC.yml
index 3af062779c..69693b6fdf 100644
--- a/education/windows/TOC.yml
+++ b/education/windows/TOC.yml
@@ -19,11 +19,11 @@ items:
     - name: Windows in S Mode
       items:
       - name: Overview
-        href: /windows/deployment/s-mode
+        href: /windows/deployment/s-mode?context=/education/context/context
       - name: Switch Windows edition from S mode
-        href: /windows/deployment/windows-10-pro-in-s-mode
+        href: /windows/deployment/windows-10-pro-in-s-mode?context=/education/context/context
       - name: Deploy Win32 apps to S Mode devices
-        href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s
+        href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s?context=/education/context/context
     - name: Windows 10 editions for education customers
       href: windows-editions-for-education-customers.md
     - name: Considerations for shared and guest devices

From ea0536a584b367479a880b16ea964ba5658191e3 Mon Sep 17 00:00:00 2001
From: tiaraquan <tiaraquan@microsoft.com>
Date: Wed, 8 Mar 2023 11:10:49 -0800
Subject: [PATCH 07/16] Tiara, you idiot

---
 .../operate/windows-autopatch-windows-update.md                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md
index b0b5b1557f..508c99fa46 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md
@@ -75,7 +75,7 @@ The Scheduled install cadence has two options:
 | Schedule install and restart | Use this option to prevent the service from installing Windows Updates except during the specified start time. You can specify the following occurrence options:<ul><li>Weekly</li><li>Bi-weekly</li><li>Monthly</li></ul><p>Select a time when the device has low activity for the updates to complete. Ensure that the Windows Update has three to four hours to complete the installation and restart the device.</p> |
 
 > [!NOTE]
-> Changes made in one deployment ring won't impact other rings in your tenant.<p>Configured **Active hours** and **Scheduled install and restart** options will apply to bother Windows quality updates and Windows feature updates.</p>
+> Changes made in one deployment ring won't impact other rings in your tenant.<p>Configured **Active hours** and **Scheduled install and restart** options will apply to both Windows quality updates and Windows feature updates.</p>
 
 ### User notifications
 

From c633df3ebb07053843ac7387540e97867e7144a1 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Wed, 8 Mar 2023 14:13:44 -0500
Subject: [PATCH 08/16] Update
 windows/client-management/mdm/policy-csp-networklistmanager.md

---
 windows/client-management/mdm/policy-csp-networklistmanager.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index f70e301d37..c10ddea1d6 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AllowedTlsAuthenticationEndpoints-Description-Begin -->
 <!-- Description-Source-DDF -->
-List of URLs to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+List of URLs (seperated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
 <!-- AllowedTlsAuthenticationEndpoints-Description-End -->
 
 <!-- AllowedTlsAuthenticationEndpoints-Editable-Begin -->

From 3388e82b335a52479354f2d0513be2b10349a729 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Wed, 8 Mar 2023 14:25:58 -0500
Subject: [PATCH 09/16] Update policy-csp-networklistmanager.md

---
 .../mdm/policy-csp-networklistmanager.md            | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index c10ddea1d6..1c4f398a68 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -42,20 +42,19 @@ List of URLs (seperated by Unicode character 0xF000) to endpoints accessible onl
 
 <!-- AllowedTlsAuthenticationEndpoints-Editable-Begin -->
 <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
-
+- When entering a list of TLS endpoints in Microsoft Intune using a configuration profile with a custom template and the OMA URI, use the following format: `<![CDATA[https://nls.corp.contoso.com&#xF000;https://nls.corp.fabricam.com]]>`
 - The HTTPS endpoint must not have any more authentication checks, such as sign-in or multi-factor authentication.
 - The HTTPS endpoint must be an internal address not accessible from outside the organizational network.
 - The client must trust the server certificate. So the CA certificate that the HTTPS server certificate chains to must be present in the client machine's root certificate store.
 - A certificate shouldn't be a public certificate.
 
-Test the URL using this command, it MUST return a HTTP_STATUS_OK 200
+To test the URL, use a PowerShell command similar to below:
 
-`Invoke-webrequest https://nls.corp.contoso.com -Method get -UseBasicParsing -MaximumRedirection 0`
-
-When entering a list of TLS endpoints in Microsoft Intune using a configruation profile with a custom template and the OMA URI, the URLs must be seperated by Unicode character 0xF000. It must be this format:
-
-`<![CDATA[https://nls.corp.contoso.com&#xF000;https://nls.corp.fabricam.com]]>`
+```powershell
+Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing -MaximumRedirection 0
+```
 
+`StatusCode` return by the command must be 200 (`HTTP_STATUS_OK`).
 <!-- AllowedTlsAuthenticationEndpoints-Editable-End -->
 
 <!-- AllowedTlsAuthenticationEndpoints-DFProperties-Begin -->

From 3ae5e81bd80c11b33983dd13991415b2dbfe753e Mon Sep 17 00:00:00 2001
From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com>
Date: Wed, 8 Mar 2023 13:47:34 -0600
Subject: [PATCH 10/16] Update policy-csp-networklistmanager.md

Acro edit.
---
 windows/client-management/mdm/policy-csp-networklistmanager.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md
index 1c4f398a68..4669b6c300 100644
--- a/windows/client-management/mdm/policy-csp-networklistmanager.md
+++ b/windows/client-management/mdm/policy-csp-networklistmanager.md
@@ -37,7 +37,7 @@ ms.topic: reference
 
 <!-- AllowedTlsAuthenticationEndpoints-Description-Begin -->
 <!-- Description-Source-DDF -->
-List of URLs (seperated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
 <!-- AllowedTlsAuthenticationEndpoints-Description-End -->
 
 <!-- AllowedTlsAuthenticationEndpoints-Editable-Begin -->

From a3a015515a1bfab2240f3a1828867da5612b8b76 Mon Sep 17 00:00:00 2001
From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com>
Date: Wed, 8 Mar 2023 13:49:12 -0600
Subject: [PATCH 11/16] Update event-4624.md

Acro edit.
---
 windows/security/threat-protection/auditing/event-4624.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md
index be7623e5ac..9f1c6ce104 100644
--- a/windows/security/threat-protection/auditing/event-4624.md
+++ b/windows/security/threat-protection/auditing/event-4624.md
@@ -121,12 +121,12 @@ This event generates when a logon session is created (on destination machine). I
 
 **Subject:**
 
-- **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
+- **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID can't be resolved, you will see the source data in the event.
 
     This field may also contain no subject user information, but the NULL Sid "S-1-0-0" and no user or domain information.
 
   > [!NOTE]
-  > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
+  > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it can't ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
 
 - **Account Name** [Type = UnicodeString]**:** the name of the account that reported information about successful logon.
 

From e986e3932744be037a307140f517a391f30ca6f4 Mon Sep 17 00:00:00 2001
From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com>
Date: Wed, 8 Mar 2023 13:51:11 -0600
Subject: [PATCH 12/16] Update event-4624.md

Acro edit.
---
 windows/security/threat-protection/auditing/event-4624.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md
index 9f1c6ce104..e081fcb3f0 100644
--- a/windows/security/threat-protection/auditing/event-4624.md
+++ b/windows/security/threat-protection/auditing/event-4624.md
@@ -318,6 +318,6 @@ For 4624(S): An account was successfully logged on.
 
     - If the **Authentication Package** is NTLM. In this case, monitor for **Key Length** not equal to 128, because all Windows operating systems starting with Windows 2000 support 128-bit Key Length.
 
-- If you monitor for potentially malicious software, or software that is not authorized to request logon actions, monitor this event for **Process Name**.
+- If you monitor for potentially malicious software, or software that isn't authorized to request logon actions, monitor this event for **Process Name**.
 
-- If you have a trusted logon processes list, monitor for a **Logon Process** that is not from the list.
+- If you have a trusted logon processes list, monitor for a **Logon Process** that isn't from the list.

From 4c619dbb0c941e1227e544eef3be3bc3d049fa78 Mon Sep 17 00:00:00 2001
From: Denise Vangel-MSFT <deniseb@microsoft.com>
Date: Wed, 8 Mar 2023 11:58:49 -0800
Subject: [PATCH 13/16] Update policy-csp-defender.md

---
 windows/client-management/mdm/policy-csp-defender.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index 298d67d708..b5f8c851b7 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP.
 author: vinaypamnani-msft
 manager: aaroncz
 ms.author: vinpa
-ms.date: 02/10/2023
+ms.date: 03/08/2023
 ms.localizationpriority: medium
 ms.prod: windows-client
 ms.technology: itpro-manage
@@ -700,9 +700,9 @@ Allows or disallows Windows Defender Realtime Monitoring functionality.
 <!-- Description-Source-ADMX -->
 This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting.
 
-- If you enable this setting, network files will be scanned.
+- If you enable this setting or do not configure this setting, network files will be scanned.
 
-- If you disable or do not configure this setting, network files will not be scanned.
+- If you disable this setting, network files will not be scanned.
 <!-- AllowScanningNetworkFiles-Description-End -->
 
 <!-- AllowScanningNetworkFiles-Editable-Begin -->

From e7de8fbcb5739856eeda91d9da9aa8b46e01d642 Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Wed, 8 Mar 2023 15:01:44 -0500
Subject: [PATCH 14/16] Update event-4716.md

---
 .../threat-protection/auditing/event-4716.md  | 72 +++++++++++--------
 1 file changed, 44 insertions(+), 28 deletions(-)

diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md
index 5b197088ad..3d1ec5f975 100644
--- a/windows/security/threat-protection/auditing/event-4716.md
+++ b/windows/security/threat-protection/auditing/event-4716.md
@@ -175,46 +175,62 @@ Subject:
  Logon ID:  0x3E6
 ```
 
-After the event, one more event ID is generated:
+After event 4716, you may see either event 4724 or event 4742 or both:
 
 ```
 Log Name:      Security
 Source:        Microsoft-Windows-Security-Auditing
 Date:          <time>
 Event ID:      4724
+Task Category: User Account Management
+Level:         Information
+Keywords:      Audit Success
+User:          N/A
+Computer:      <FQDN>
+Description:
+An attempt was made to reset an account's password.
+
+Subject:
+	Security ID:		ANONYMOUS LOGON
+	Account Name:		ANONYMOUS LOGON
+	Account Domain:		NT AUTHORITY
+	Logon ID:		0x3E6
+
+Target Account:
+	Security ID:		CONTOSO\CONTOSOPEERTREE$     //OBJECT representing the TRUST object
+	Account Name:		CONTOSOPEERTREE$
+	Account Domain:		CONTOSO
+```
+
+```
+Log Name:      Security
+Source:        Microsoft-Windows-Security-Auditing
+Date:          <time>
+Event ID:      4742
 Task Category: Computer Account Management
 Level:         Information
 Keywords:      Audit Success
 User:          N/A
-Computer:      <fqdn>
+Computer:      <FQDN>
 Description:
 A computer account was changed.
+
 Subject:
- Security ID:  ANONYMOUS LOGON
- Account Name:  ANONYMOUS LOGON
- Account Domain:  NT AUTHORITY
- Logon ID:  0x3E6
+	Security ID:		ANONYMOUS LOGON
+	Account Name:		ANONYMOUS LOGON
+	Account Domain:		NT AUTHORITY
+	Logon ID:		0x3E6
+
 Computer Account That Was Changed:
- Security ID:  CONTOSO\CONTOSOPEERTREE$     //OBJECT representing the TRUST object
- Account Name:  CONTOSOPEERTREE$
- Account Domain:  CONTOSO
- Password Last Set: 10/9/2019 12:02:08 PM
- 
-Log Name:      Security
-Source:        Microsoft-Windows-Security-Auditing
-Date:          10/1/2019 4:02:43 PM
-Event ID:      4716
-Task Category: Authentication Policy Change
-Level:         Information
-Keywords:      Audit Success
-User:          N/A
-Computer:      W-REDAD-P01.red.lhgroup.de
-Description:
-Trusted domain information was modified.
- 
-Subject:
-                    Security ID:       S-1-5-21-1313371058-2156521407-1595812000-1103        //Shows the respective domain Sid
-                    Account Name:      U806391a                                              //Users who has modified the attribute.
-                    Account Domain:    RED
-                    Logon ID:          0x16049916
+	Security ID:		CONTOSO\CONTOSOPEERTREE$
+	Account Name:		CONTOSOPEERTREE$
+	Account Domain:		CONTOSO
+
+Changed Attributes:
+	...
+	Password Last Set:	<time>
+	...
+
+Additional Information:
+	Privileges:		-
 ```

From 63a1972ce4ec9d7353c76b807a2e978fc51581ce Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Wed, 8 Mar 2023 15:15:16 -0500
Subject: [PATCH 15/16] Update event-4625.md

---
 .../threat-protection/auditing/event-4625.md  | 34 ++-----------------
 1 file changed, 3 insertions(+), 31 deletions(-)

diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md
index 425447b217..45f8a019b0 100644
--- a/windows/security/threat-protection/auditing/event-4625.md
+++ b/windows/security/threat-protection/auditing/event-4625.md
@@ -157,40 +157,12 @@ This event generates on domain controllers, member servers, and workstations.
 
 -   **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event, it typically has "**Account locked out**" value.
 
--   **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event, it typically has "**0xC0000234**" value. The most common status codes are listed in Table 12. Windows logon status codes.
+-   **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event, it typically has "**0xC0000234**" value.
 
-    <span id="_Ref433822658" class="anchor"></span>**Table 12: Windows logon status codes.**
-
-    | Status\\Sub-Status Code | Description                                                                      |
-    |-------------------------|------------------------------------------------------------------------------------------------------|
-    | 0XC000005E              | There are currently no logon servers available to service the logon request.                         |
-    | 0xC0000064              | User logon with misspelled or bad user account                                                       |
-    | 0xC000006A              | User logon with misspelled or bad password                                                           |
-    | 0XC000006D              | The cause is either a bad username or authentication information                                   |
-    | 0XC000006E              | Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions).     |
-    | 0xC000006F              | User logon outside authorized hours                                                                  |
-    | 0xC0000070              | User logon from unauthorized workstation                                                             |
-    | 0xC0000071              | User logon with expired password                                                                     |
-    | 0xC0000072              | User logon to account disabled by administrator                                                      |
-    | 0XC00000DC              | Indicates the Sam Server was in the wrong state to perform the desired operation.                    |
-    | 0XC0000133              | Clocks between DC and other computer too far out of sync                                             |
-    | 0XC000015B              | The user has not been granted the requested logon type (also called the *logon right*) at this machine             |
-    | 0XC000018C              | The logon request failed because the trust relationship between the primary domain and the trusted domain failed.      |
-    | 0XC0000192              | An attempt was made to logon, but the **Netlogon** service was not started.                                            |
-    | 0xC0000193              | User logon with expired account                                                                      |
-    | 0XC0000224              | User is required to change password at next logon                                                    |
-    | 0XC0000225              | Evidently a bug in Windows and not a risk                                                            |
-    | 0xC0000234              | User logon with account locked                                                                       |
-    | 0XC00002EE              | Failure Reason: An Error occurred during Logon                                                       |
-    | 0XC0000413              | Logon Failure: The machine you are logging on to is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |
-    | 0x0                     | Status OK.  |
+-   **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure.
 
 > [!NOTE]
-> To see the meaning of other status or substatus codes, you might also check for status code in the Windows header file ntstatus.h in Windows SDK.
-
-More information: <https://dev.windows.com/en-us/downloads>
-
--   **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure. The most common substatus codes listed in the "Table 12. Windows logon status codes.".
+> For more information about various Status or Sub Status codes, see [NTSTATUS Values](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55).
 
 **Process Information:**
 

From 1dd33bf9cb7c8dba9a7d9549929eb5813a59b377 Mon Sep 17 00:00:00 2001
From: Angela Fleischmann <v-angelaf@microsoft.com>
Date: Wed, 8 Mar 2023 15:09:04 -0700
Subject: [PATCH 16/16] Update policy-csp-defender.md

windows/client-management/mdm/policy-csp-defender.md
[Scorecard]https://microsoft-ce-csi.acrolinx.cloud/api/v1/checking/scorecards/373ed02e-b648-4a8c-816a-12c8aeabbc1b#CORRECTNESS
Line 958: ...a subsample of audit events are collected for ASR rules will the value of not configured.
Should "will" be "with"?
Line 2197: will used. > will be used.
Line 2695: behaviour > behavior
---
 windows/client-management/mdm/policy-csp-defender.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index b5f8c851b7..c5e12804f1 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -955,7 +955,7 @@ After enabling this setting, you can set each rule to the following in the Optio
 - Not Configured: the rule is enabled with default values
 - Warn: the rule will be applied and the end-user will have the option to bypass the block
 
-Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured.
+Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured.
 
 Enabled:
 Specify the state for each ASR rule under the Options section for this setting.
@@ -2194,7 +2194,7 @@ This policy setting allows you to specify the scan type to use during a schedule
 
 - If you enable this setting, the scan type will be set to the specified value.
 
-- If you disable or do not configure this setting, the default scan type will used.
+- If you disable or do not configure this setting, the default scan type will be used.
 <!-- ScanParameter-Description-End -->
 
 <!-- ScanParameter-Editable-Begin -->
@@ -2692,7 +2692,7 @@ This policy setting allows you to specify an interval at which to check for secu
 
 <!-- SubmitSamplesConsent-Description-Begin -->
 <!-- Description-Source-ADMX -->
-This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set.
+This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set.
 
 Possible options are:
 (0x0) Always prompt