From fa5414fdaf14aa9b6f3e29585a0546bd249a10f8 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Mar 2023 14:18:36 -0800 Subject: [PATCH 001/139] ScanBeforeInitialLogonAllowed MAXADO-7679187 --- windows/deployment/update/waas-wu-settings.md | 27 +++++++++++++------ 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index af807a712a..34a121a25d 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -9,17 +9,12 @@ manager: aaroncz ms.topic: article ms.collection: highpri, tier2 ms.technology: itpro-updates -ms.date: 01/06/2023 +ms.date: 03/28/2023 --- # Manage additional Windows Update settings - -**Applies to** - -- Windows 10 -- Windows 11 - +***(Applies to: Windows 11 & Windows 10)*** > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -37,7 +32,9 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location) | [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | All | | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | -| | [Windows Update notifications display organization name](#bkmk_display-name)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | +| | [Windows Update notifications display organization name](#bkmk_display-name)

*Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | +| | [Allow Windows updates to install before initial user sign-in](#allow-windows-update-before-initial-sign-in) | Windows 11 version 22H2 | + >[!IMPORTANT] >Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**. @@ -283,3 +280,17 @@ if (!(Test-Path $registryPath)) New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null ``` + +## Allow Windows updates to install before initial user sign-in +*(Starting in Windows 11, version 22H2)* + +On new devices, Windows Update doesn't begin installing background updates until a user has completed the Out of Box Experience (OOBE) and signs in for the first time. In many cases, the user signs in immediately after completing the OOBE. However, some VM-based solutions provision a device and automate the first user experience. These VMs may not be immediately assigned to a user so they won't see an initial sign-in until several days later. + +In scenarios where initial sign-in is delayed, setting the following registry values allow devices to begin background update work before a user first signs in: + +- **Registry key**: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator +- **DWORD value name**: ScanBeforeInitialLogonAllowed +- **Value data**: 1 + +> [!Warning] +> This value is designed to be used only for scenarios with a deferred initial user sign in. Setting this value on devices where initial user sign in isn't delayed could have a detrimental effect on performance since it may allow update work to occur as the user is signing in for the first time. From 4e070da4362c2e7c2e3b25a0cbd932f73d82a0bd Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Mar 2023 14:25:51 -0800 Subject: [PATCH 002/139] ScanBeforeInitialLogonAllowed MAXADO-7679187 --- windows/deployment/update/waas-wu-settings.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 34a121a25d..fe39eda580 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -47,7 +47,7 @@ Admins have a lot of flexibility in configuring how their devices scan and recei [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) allows admins to point devices to an internal Microsoft update service location, while [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) gives them the option to restrict devices to just that internal update service. [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) controls how frequently devices scan for updates. -You can make custom device groups that'll work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that were not signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location). +You can make custom device groups that will work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that weren't signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location). Finally, to make sure the updating experience is fully controlled by the admins, you can [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) for users. @@ -61,10 +61,10 @@ This setting lets you specify a server on your network to function as an interna To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them. -If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. +If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates isn't disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. -The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server. +The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service doesn't provide download Urls in the update metadata for files that are present on the alternate download server. >[!NOTE] >If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. @@ -109,7 +109,7 @@ Use **Computer Configuration\Administrative Templates\Windows Components\Windows Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service. This allows admins to configure device groups that will receive different updates from sources like WSUS or Configuration Manager. This Group Policy setting can be found under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Enable client-side targeting**. -If the setting is set to **Enabled**, the specified target group information is sent to the intranet Microsoft update service which uses it to determine which updates should be deployed to this computer. +If the setting is set to **Enabled**, the specified target group information is sent to the intranet Microsoft update service, which uses it to determine which updates should be deployed to this computer. If the setting is set to **Disabled** or **Not Configured**, no target group information will be sent to the intranet Microsoft update service. If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified. @@ -123,8 +123,8 @@ This policy setting allows you to manage whether Automatic Updates accepts updat To configure this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location**. -If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location), if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. -If you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft. +If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location), if they're signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. +If you disable or don't configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft. >[!NOTE] >Updates from a service other than an intranet Microsoft update service must always be signed by Microsoft and are not affected by this policy setting. @@ -136,7 +136,7 @@ To configure this policy with MDM, use [AllowNonMicrosoftSignedUpdate](/windows/ To add more flexibility to the update process, settings are available to control update installation. -[Configure Automatic Updates](#configure-automatic-updates) offers four different options for automatic update installation, while [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) makes sure drivers are not installed with the rest of the received updates. +[Configure Automatic Updates](#configure-automatic-updates) offers four different options for automatic update installation, while [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) makes sure drivers aren't installed with the rest of the received updates. ### Do not include drivers with Windows Updates @@ -144,7 +144,7 @@ Allows admins to exclude Windows Update drivers during updates. To configure this setting in Group Policy, use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates**. Enable this policy to not include drivers with Windows quality updates. -If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. +If you disable or don't configure this policy, Windows Update will include updates that have a Driver classification. ### Configure Automatic Updates @@ -156,13 +156,13 @@ Under **Computer Configuration\Administrative Templates\Windows Components\Windo **2 - Notify for download and auto install** - When Windows finds updates that apply to this device, users will be notified that updates are ready to be downloaded. After going to **Settings > Update & security > Windows Update**, users can download and install any available updates. -**3 - Auto download and notify for Install** - Windows finds updates that apply to the device and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to **Settings > Update & security > Windows Update**, users can install them. +**3 - Auto download and notify for Install** - Windows finds updates that apply to the device and downloads them in the background (the user isn't notified or interrupted during this process). When the downloads are complete, users will be notified that they're ready to install. After going to **Settings > Update & security > Windows Update**, users can install them. **4 - Auto download and schedule the install** - Specify the schedule using the options in the Group Policy Setting. For more information about this setting, see [Schedule update installation](waas-restart.md#schedule-update-installation). -**5 - Allow local admin to choose setting** - With this option, local administrators will be allowed to use the settings app to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. This option is not available in any Windows 10 or later versions. +**5 - Allow local admin to choose setting** - With this option, local administrators will be allowed to use the settings app to select a configuration option of their choice. Local administrators won't be allowed to disable the configuration for Automatic Updates. This option isn't available in any Windows 10 or later versions. -**7 - Notify for install and notify for restart** (Windows Server 2016 and later only) - With this option, when Windows finds updates that apply to this device, they will be downloaded, then users will be notified that updates are ready to be installed. Once updates are installed, a notification will be displayed to users to restart the device. +**7 - Notify for install and notify for restart** (Windows Server 2016 and later only) - With this option, when Windows finds updates that apply to this device, they'll be downloaded, then users will be notified that updates are ready to be installed. Once updates are installed, a notification will be displayed to users to restart the device. If this setting is set to **Disabled**, any updates that are available on Windows Update must be downloaded and installed manually. To do this, users must go to **Settings > Update & security > Windows Update**. @@ -173,7 +173,7 @@ If this setting is set to **Not Configured**, an administrator can still configu > [!NOTE] > Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require you to reinstall the operating system. Microsoft cannot guarantee that these problems can be resolved. Modify the registry at your own risk. -In an environment that does not have Active Directory deployed, you can edit registry settings to configure group policies for Automatic Update. +In an environment that doesn't have Active Directory deployed, you can edit registry settings to configure group policies for Automatic Update. To do this, follow these steps: @@ -203,7 +203,7 @@ To do this, follow these steps: * **4**: Automatically download and scheduled installation. - * **5**: Allow local admin to select the configuration mode. This option is not available for Windows 10 or later versions. + * **5**: Allow local admin to select the configuration mode. This option isn't available for Windows 10 or later versions. * **7**: Notify for install and notify for restart. (Windows Server 2016 and later only) @@ -230,7 +230,7 @@ To do this, follow these steps: * NoAutoRebootWithLoggedOnUsers (REG_DWORD): - **0** (false) or **1** (true). If set to **1**, Automatic Updates does not automatically restart a computer while users are logged on. + **0** (false) or **1** (true). If set to **1**, Automatic Updates doesn't automatically restart a computer while users are logged on. > [!NOTE] > This setting affects client behavior after the clients have updated to the SUS SP1 client version or later versions. From e85a6a6a797a6919e5943ecf1829cf3d61d4315b Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 20 Mar 2023 15:27:05 -0400 Subject: [PATCH 003/139] Draft TOC update --- windows/client-management/toc.yml | 70 ++++++++++++++----------------- 1 file changed, 32 insertions(+), 38 deletions(-) diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 74837fc166..2cf74ef48d 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -5,51 +5,48 @@ items: - name: Mobile device management (MDM) expanded: true items: - - name: Overview - items: - - name: MDM overview - href: mdm-overview.md - - name: What's new in MDM enrollment and management - href: new-in-windows-mdm-enrollment-management.md + - name: What is MDM? + href: mdm-overview.md + - name: What's new in MDM enrollment and management + href: new-in-windows-mdm-enrollment-management.md + - name: Transitioning to modern management + href: manage-windows-10-in-your-organization-modern-management.md - name: Azure Active Directory integration with MDM href: azure-active-directory-integration-with-mdm.md + - name: Enroll devices items: - - name: Add an Azure AD tenant and Azure AD subscription - href: add-an-azure-ad-tenant-and-azure-ad-subscription.md - - name: Register your free Azure Active Directory subscription - href: register-your-free-azure-active-directory-subscription.md - - name: Device enrollment - href: mobile-device-enrollment.md + - name: Enrollment overview + href: mobile-device-enrollment.md + - name: Enrollment methods + items: + - name: Manual enrollment + href: mdm-enrollment-of-windows-devices.md + - name: Automatic enrollment via Azure AD + href: azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md + - name: Group Policy enrollment + href: enroll-a-windows-10-device-automatically-using-group-policy.md + - name: Bulk enrollment + href: bulk-enrollment-using-windows-provisioning-tool.md + - name: Federated authentication enrollment + href: federated-authentication-device-enrollment.md + - name: Certificate authentication enrollment + href: certificate-authentication-device-enrollment.md + - name: On-premises authentication enrollment + href: on-premise-authentication-device-enrollment.md + - name: Manage devices items: - - name: MDM enrollment of Windows devices - href: mdm-enrollment-of-windows-devices.md - - name: "Azure AD and Microsoft Intune: Automatic MDM enrollment" - href: azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md - - name: Enroll a Windows 10 device automatically using Group Policy - href: enroll-a-windows-10-device-automatically-using-group-policy.md - - name: Bulk enrollment - href: bulk-enrollment-using-windows-provisioning-tool.md - - name: Federated authentication device enrollment - href: federated-authentication-device-enrollment.md - - name: Certificate authentication device enrollment - href: certificate-authentication-device-enrollment.md - - name: On-premises authentication device enrollment - href: on-premise-authentication-device-enrollment.md - - name: Disconnecting a device from MDM (unenrollment) - href: disconnecting-from-mdm-unenrollment.md - - name: Enterprise settings, policies, and app management - href: windows-mdm-enterprise-settings.md - items: - - name: Enterprise app management + - name: Manage settings + href: windows-mdm-enterprise-settings.md + - name: Manage apps href: enterprise-app-management.md - - name: Deploy and configure App-V apps using MDM - href: appv-deploy-and-config.md - - name: Mobile device management (MDM) for device updates + - name: Manage updates href: device-update-management.md - name: Secured-Core PC Configuration Lock href: config-lock.md - name: Certificate renewal href: certificate-renewal-windows-mdm.md + - name: Disconnecting a device from MDM (unenrollment) + href: disconnecting-from-mdm-unenrollment.md - name: Diagnose MDM failures in Windows 10 href: diagnose-mdm-failures-in-windows-10.md - name: Push notification support for device management @@ -80,10 +77,7 @@ items: href: manage-settings-app-with-group-policy.md - name: What version of Windows am I running href: windows-version-search.md - - name: Transitioning to modern management - href: manage-windows-10-in-your-organization-modern-management.md - name: Windows libraries href: windows-libraries.md - name: Troubleshoot Windows clients href: /troubleshoot/windows-client/welcome-windows-client - From 6ece451d8d822350296e09d6ee7c44dce9671bd2 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 20 Mar 2023 15:49:05 -0400 Subject: [PATCH 004/139] Second draft --- windows/client-management/toc.yml | 33 ++++++++++++++++++------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 2cf74ef48d..b1450dcb92 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -5,15 +5,23 @@ items: - name: Mobile device management (MDM) expanded: true items: - - name: What is MDM? - href: mdm-overview.md - - name: What's new in MDM enrollment and management - href: new-in-windows-mdm-enrollment-management.md - - name: Transitioning to modern management - href: manage-windows-10-in-your-organization-modern-management.md - - name: Azure Active Directory integration with MDM - href: azure-active-directory-integration-with-mdm.md + - name: MDM overview + expanded: true + items: + - name: What is MDM? + href: mdm-overview.md + - name: What's new in MDM enrollment and management + href: new-in-windows-mdm-enrollment-management.md + - name: Transitioning to modern management + href: manage-windows-10-in-your-organization-modern-management.md + - name: Azure Active Directory integration with MDM + href: azure-active-directory-integration-with-mdm.md + - name: Push notification support for device management + href: push-notification-windows-mdm.md + - name: MAM support for device management + href: implement-server-side-mobile-application-management.md - name: Enroll devices + expanded: true items: - name: Enrollment overview href: mobile-device-enrollment.md @@ -21,7 +29,7 @@ items: items: - name: Manual enrollment href: mdm-enrollment-of-windows-devices.md - - name: Automatic enrollment via Azure AD + - name: Automatic enrollment href: azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md - name: Group Policy enrollment href: enroll-a-windows-10-device-automatically-using-group-policy.md @@ -34,6 +42,7 @@ items: - name: On-premises authentication enrollment href: on-premise-authentication-device-enrollment.md - name: Manage devices + expanded: true items: - name: Manage settings href: windows-mdm-enterprise-settings.md @@ -45,14 +54,10 @@ items: href: config-lock.md - name: Certificate renewal href: certificate-renewal-windows-mdm.md - - name: Disconnecting a device from MDM (unenrollment) + - name: Unenroll devices href: disconnecting-from-mdm-unenrollment.md - name: Diagnose MDM failures in Windows 10 href: diagnose-mdm-failures-in-windows-10.md - - name: Push notification support for device management - href: push-notification-windows-mdm.md - - name: MAM support for device management - href: implement-server-side-mobile-application-management.md - name: Configuration service provider reference href: mdm/index.yml - name: Client management tools and settings From 0db214517cba11ca683fa300e4f0f14c4b119d49 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 20 Mar 2023 15:26:09 -0700 Subject: [PATCH 005/139] do-wufbr-MAXADO-7715481 --- windows/deployment/update/wufb-reports-do.md | 23 ++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 windows/deployment/update/wufb-reports-do.md diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md new file mode 100644 index 0000000000..a73d68d43d --- /dev/null +++ b/windows/deployment/update/wufb-reports-do.md @@ -0,0 +1,23 @@ +--- +title: Delivery Optimization data in Windows Update for Business reports +manager: aaroncz +description: Provides information about Delivery Optimization data in Windows Update for Business reports +ms.prod: windows-client +author: mestew +ms.author: mstewart +ms.topic: article +ms.date: 03/27/2023 +ms.technology: itpro-updates +--- + +# Delivery Optimization data in Windows Update for Business reports + +***(Applies to: Windows 11 & Windows 10)*** + +[Delivery Optimization](../do/waas-delivery-optimization.md) (DO) is a Windows feature that can be used to reduce bandwidth consumption by sharing the work of downloading updates among multiple devices in your environment. You can use DO in conjunction with many other deployment methods, but it's a cloud-managed solution, and access to the DO cloud services is a requirement. + +Windows Update for Business reports provides Delivery Optimization information in the following places: +- The Windows Update for Business reports [workbook](wufb-reports-workbook.md) +- [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) +- [UCDOStatus](wufb-reports-schema-ucdostatus.md) + From 2630aef6377b50e4d489df4b86fca081d8dcdd8e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 20 Mar 2023 15:57:32 -0700 Subject: [PATCH 006/139] do-wufbr-MAXADO-7715481 --- windows/deployment/update/wufb-reports-do.md | 21 ++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index a73d68d43d..3104c24466 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -21,3 +21,24 @@ Windows Update for Business reports provides Delivery Optimization information i - [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) - [UCDOStatus](wufb-reports-schema-ucdostatus.md) +## Delivery Optimization terms + +Windows Update for Business reports uses the following Delivery Optimization terms: + +- **Peer**: A device in the solution +- **Peering 'ON'** - Devices where DO peer-to-peer is enabled in one of the following modes: + - LAN (1) + - Group (2) + - Internet (3) +- **Peering 'OFF'**: Devices where DO peer-to-peer is disabled, set to one of the following modes: + - HTTP Only (0) + - Simple Mode (99) + - Bypass (100), deprecated in Windows 11 +**Bandwidth savings**: Out of the total consumed bandwidth, the percentage of bandwidth that was downloaded from either LAN or Group peers, and from Microsoft Connected Cache (MCC) + - If bandwidth savings are <= 60% a *Warning* icon is displayed + - When bandwidth savings is <10% an *Error* icon is displayed. +- **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. + + +Volume from the CDN is calculated with the following formula: +BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache From 5a18cf6d081b19f85faf64954b344c30038fba20 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 20 Mar 2023 16:35:27 -0700 Subject: [PATCH 007/139] do-wufbr-MAXADO-7715481 --- windows/deployment/TOC.yml | 2 ++ windows/deployment/update/wufb-reports-do.md | 36 +++++++++++++++++++- 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 4fc092c907..27db64502d 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -212,6 +212,8 @@ items: - name: Windows Update for Business reports workbook href: update/wufb-reports-workbook.md + - name: Delivery Optimization data in reports + href: update/wufb-reports-do.md - name: Software updates in the Microsoft 365 admin center href: update/wufb-reports-admin-center.md - name: Use Windows Update for Business reports data diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 3104c24466..f6ee5ddcdf 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -14,13 +14,15 @@ ms.technology: itpro-updates ***(Applies to: Windows 11 & Windows 10)*** -[Delivery Optimization](../do/waas-delivery-optimization.md) (DO) is a Windows feature that can be used to reduce bandwidth consumption by sharing the work of downloading updates among multiple devices in your environment. You can use DO in conjunction with many other deployment methods, but it's a cloud-managed solution, and access to the DO cloud services is a requirement. +[Delivery Optimization](../do/waas-delivery-optimization.md) (DO) is a Windows feature that can be used to reduce bandwidth consumption by sharing the work of downloading updates among multiple devices in your environment. You can use DO in conjunction with many other deployment methods, but it's a cloud-managed solution, and access to the DO cloud services is a requirement. Windows Update for Business reports provides Delivery Optimization information in the following places: - The Windows Update for Business reports [workbook](wufb-reports-workbook.md) - [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) - [UCDOStatus](wufb-reports-schema-ucdostatus.md) +Windows Update for Business reports doesn't include Delivery Optimization data for Windows Insider devices. + ## Delivery Optimization terms Windows Update for Business reports uses the following Delivery Optimization terms: @@ -39,6 +41,38 @@ Windows Update for Business reports uses the following Delivery Optimization ter - When bandwidth savings is <10% an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. +## Calculations for Delivery Optimization Volume from the CDN is calculated with the following formula: BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache + + +## Determine GroupID + +In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded hash. You can determine the **GroupID** from the hash, or determine the hash for a given **GroupID**. + +Determine the **GroupID** from the hash: + +Determine the hash for a **GroupID**: + + +## Sample queries + +You can use the data in [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) +and [UCDOStatus](wufb-reports-schema-ucdostatus.md) to create your own queries. Create your custom queries using [Kusto Query Lanaguage (KQL)](/azure/data-explorer/kusto/query/), but note that Windows Update for Business reports uses Azure Monitor, so some operators aren't supported. The KQL documentation specifies which operators aren't supported by Azure Monitor or if they have different functionality. For more information about KQL in Azure Monitor, see [Log queries in Azure Monitor](/azure/azure-monitor/logs/log-query-overview). The following queries are examples of how you can use the data: + +### Sample query 1 + +Explanation of what the query displays + +```kusto +UCDOAggregatedStatus +| where Bogus =="SomethingBogus" and Neato =="Something Neat" +| sort by Whatevs +| project Whatevs, Neato, Bogus +``` + + +### Sample query 2 + +Explanation of what the query displays \ No newline at end of file From 06ae5d8b65b8be2408902a824f5a9b509fd0f5f7 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 20 Mar 2023 16:38:09 -0700 Subject: [PATCH 008/139] do-wufbr-MAXADO-7715481 --- windows/deployment/update/wufb-reports-do.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index f6ee5ddcdf..ef32b17518 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -14,7 +14,7 @@ ms.technology: itpro-updates ***(Applies to: Windows 11 & Windows 10)*** -[Delivery Optimization](../do/waas-delivery-optimization.md) (DO) is a Windows feature that can be used to reduce bandwidth consumption by sharing the work of downloading updates among multiple devices in your environment. You can use DO in conjunction with many other deployment methods, but it's a cloud-managed solution, and access to the DO cloud services is a requirement. +[Delivery Optimization](../do/waas-delivery-optimization.md) (DO) is a Windows feature that can be used to reduce bandwidth consumption by sharing the work of downloading updates among multiple devices in your environment. You can use DO with many other deployment methods, but it's a cloud-managed solution, and access to the DO cloud services is a requirement. Windows Update for Business reports provides Delivery Optimization information in the following places: - The Windows Update for Business reports [workbook](wufb-reports-workbook.md) @@ -38,7 +38,7 @@ Windows Update for Business reports uses the following Delivery Optimization ter - Bypass (100), deprecated in Windows 11 **Bandwidth savings**: Out of the total consumed bandwidth, the percentage of bandwidth that was downloaded from either LAN or Group peers, and from Microsoft Connected Cache (MCC) - If bandwidth savings are <= 60% a *Warning* icon is displayed - - When bandwidth savings is <10% an *Error* icon is displayed. + - When bandwidth savings are <10% an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. ## Calculations for Delivery Optimization @@ -59,7 +59,7 @@ Determine the hash for a **GroupID**: ## Sample queries You can use the data in [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) -and [UCDOStatus](wufb-reports-schema-ucdostatus.md) to create your own queries. Create your custom queries using [Kusto Query Lanaguage (KQL)](/azure/data-explorer/kusto/query/), but note that Windows Update for Business reports uses Azure Monitor, so some operators aren't supported. The KQL documentation specifies which operators aren't supported by Azure Monitor or if they have different functionality. For more information about KQL in Azure Monitor, see [Log queries in Azure Monitor](/azure/azure-monitor/logs/log-query-overview). The following queries are examples of how you can use the data: +and [UCDOStatus](wufb-reports-schema-ucdostatus.md) to create your own queries. Create your custom queries using [Kusto Query Language (KQL)](/azure/data-explorer/kusto/query/), but note that Windows Update for Business reports uses Azure Monitor, so some operators aren't supported. The KQL documentation specifies which operators aren't supported by Azure Monitor or if they have different functionality. For more information about KQL in Azure Monitor, see [Log queries in Azure Monitor](/azure/azure-monitor/logs/log-query-overview). The following queries are examples of how you can use the data: ### Sample query 1 From f28e4c0da00603f96024cbf26e2af3bc5fe2128a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 20 Mar 2023 16:40:36 -0700 Subject: [PATCH 009/139] do-wufbr-MAXADO-7715481 --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index ef32b17518..bba06682d2 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -36,7 +36,7 @@ Windows Update for Business reports uses the following Delivery Optimization ter - HTTP Only (0) - Simple Mode (99) - Bypass (100), deprecated in Windows 11 -**Bandwidth savings**: Out of the total consumed bandwidth, the percentage of bandwidth that was downloaded from either LAN or Group peers, and from Microsoft Connected Cache (MCC) +- **Bandwidth savings**: Out of the total consumed bandwidth, the percentage of bandwidth that was downloaded from either LAN or Group peers, and from Microsoft Connected Cache (MCC) - If bandwidth savings are <= 60% a *Warning* icon is displayed - When bandwidth savings are <10% an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. From e401ca44d93761bfac527fc8c4d799fb78876476 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 28 Mar 2023 16:05:22 -0400 Subject: [PATCH 010/139] Update azure-active-directory-integration-with-mdm --- ...ure-ad-tenant-and-azure-ad-subscription.md | 99 ------- ...e-active-directory-integration-with-mdm.md | 251 ++++++------------ windows/client-management/mdm-overview.md | 44 +-- ...ree-azure-active-directory-subscription.md | 43 --- windows/client-management/toc.yml | 4 +- 5 files changed, 104 insertions(+), 337 deletions(-) delete mode 100644 windows/client-management/add-an-azure-ad-tenant-and-azure-ad-subscription.md delete mode 100644 windows/client-management/register-your-free-azure-active-directory-subscription.md diff --git a/windows/client-management/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/add-an-azure-ad-tenant-and-azure-ad-subscription.md deleted file mode 100644 index 160a97cca0..0000000000 --- a/windows/client-management/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Add an Azure AD tenant and Azure AD subscription -description: Here's a step-by-step guide to adding an Azure Active Directory tenant, adding an Azure AD subscription, and registering your subscription. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 06/26/2017 ---- - -# Add an Azure AD tenant and Azure AD subscription - -Here's a step-by-step guide to adding an Azure Active Directory tenant, adding an Azure AD subscription, and registering your subscription. - -> **Note**  If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. For step-by-step guide to register this free subscription, see [Register your free Azure Active Directory subscription.](#register-your-free-azure-active-directory-subscription) - - -1. Sign up for Azure AD tenant from [this website](https://account.windowsazure.com/organization) by creating an administrator account for your organization. - - ![sign up for azure ad tenant.](images/azure-ad-add-tenant1.png) - -2. Enter the information for your organization. Select **check availability** to verify that domain name that you selected is available. - - ![sign up for azure ad.](images/azure-ad-add-tenant2.png) - -3. Complete the login and country information. Enter a valid phone number, then select **Send text message** or **Call me**. - - ![create azure account.](images/azure-ad-add-tenant3.png) - -4. Enter the code that you receive and then select **Verify code**. After the code is verified and the continue button turns green, select **continue**. - - ![add aad tenant.](images/azure-ad-add-tenant3-b.png) - -5. After you finish creating your Azure account, you can add an Azure AD subscription. - - If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to the Office 356 portal at https://portal.office.com/, and then sign in using the admin account that you created in Step 4 (for example, user1@contosoltd.onmicrosoftcom). - - ![login to office 365](images/azure-ad-add-tenant4.png) - -6. Select **Install software**. - - ![login to office 365 portal](images/azure-ad-add-tenant5.png) - -7. In the Microsoft 365 admin center, select **Purchase Services** from the left navigation. - - ![purchase service option in admin center menu.](images/azure-ad-add-tenant6.png) - -8. On the **Purchase services** page, scroll down until you see **Azure Active Directory Premium**, then select to purchase. - - ![azure active directory option in purchase services page.](images/azure-ad-add-tenant7.png) - -9. Continue with your purchase. - - ![azure active directory premium payment page.](images/azure-ad-add-tenant8.png) - -10. After the purchase is completed, you can log on to your Office 365 Admin Portal and you'll see the **Azure AD** option from the Admin drop-down menu along with other services (SharePoint and Exchange). - - ![admin center left navigation menu.](images/azure-ad-add-tenant9.png) - - When you choose Azure AD, it will take you to the Azure AD portal where you can manage your Azure AD applications. - -## Register your free Azure Active Directory subscription - -If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. Here's a step-by-step guide to register your free Azure AD subscription using an Office 365 Premium Business subscription. - -1. Sign in to the Microsoft 365 admin center at using your organization's account. - - ![register in azuread.](images/azure-ad-add-tenant10.png) - -2. On the **Home** page, select on the Admin tools icon. - - ![register in azure-ad.](images/azure-ad-add-tenant11.png) - -3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This option will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. - - ![register azuread](images/azure-ad-add-tenant12.png) - -4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - - ![registration in azure-ad](images/azure-ad-add-tenant13.png) - -5. It may take a few minutes to process the request. - - ![registration in azuread.](images/azure-ad-add-tenant14.png) - -6. You'll see a welcome page when the process completes. - - ![register screen of azuread](images/azure-ad-add-tenant15.png) - - - - - - - - diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 5cd9b9cbb6..228f7aa0bb 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -16,150 +16,82 @@ ms.date: 12/31/2017 # Azure Active Directory integration with MDM -Azure Active Directory is the world's largest enterprise cloud identity management service. It’s used by organizations to access Office 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows 10 experiences for organizational users (such as store access or OS state roaming) use Azure AD as the underlying identity infrastructure. Windows integrates with Azure AD, allowing devices to be registered in Azure AD and enrolled into MDM in an integrated flow. +Azure Active Directory is the world's largest enterprise cloud identity management service. It's used by organizations to access Microsoft 365 and business applications from Microsoft and third-party software as a service (SaaS) vendors. Many of the rich Windows experiences for organizational users (such as store access or OS state roaming) use Azure AD as the underlying identity infrastructure. Windows integrates with Azure AD, allowing devices to be registered in Azure AD and enrolled into MDM in an integrated flow. Once a device is enrolled in MDM, the MDM: - Can enforce compliance with organization policies, add or remove apps, and more. -- Can report a device’s compliance in Azure AD. +- Can report a device's compliance in Azure AD. - Azure AD can allow access to organization resources or applications secured by Azure AD to devices that comply with policies. -To support these rich experiences with their MDM product, MDM vendors can integrate with Azure AD. This article describes the steps involved. - -## Connect to Azure AD - -Several ways to connect your devices: - -For company-owned devices: -- Join Windows to a traditional Active Directory domain -- Join Windows to Azure AD - -For personal devices (BYOD): -- Add a Microsoft work account to Windows - -### Azure AD Join - -Company owned devices are traditionally joined to the on-premises Active Directory domain of the organization. These devices can be managed using Group Policy or computer management software such as Microsoft Configuration Manager. In Windows 10, it’s also possible to manage domain joined devices with an MDM. - -Windows 10 introduces a new way to configure and deploy organization owned Windows devices. This mechanism is called Azure AD Join. Like traditional domain join, Azure AD Join allows devices to become known and managed by an organization. However, with Azure AD Join, Windows authenticates to Azure AD instead of authenticating to a domain controller. - -Azure AD Join also enables company owned devices to be automatically enrolled in, and managed by an MDM. Furthermore, Azure AD Join can be performed on a store-bought PC, in the out-of-box experience (OOBE), which helps organizations streamline their device deployment. An administrator can require that users belonging to one or more groups enroll their devices for management with an MDM. If a user is configured to require automatic enrollment during Azure AD Join, this enrollment becomes a mandatory step to configure Windows. If the MDM enrollment fails, then the device won't be joined to Azure AD. - -> [!IMPORTANT] -> Every user enabled for automatic MDM enrollment with Azure AD Join must be assigned a valid [Azure Active Directory Premium](/previous-versions/azure/dn499825(v=azure.100)) license. - - -### BYOD scenario - -Windows 10 also introduces a simpler way to configure personal devices to access work apps and resources. Users can add their Microsoft work account to Windows and enjoy simpler and safer access to the apps and resources of the organization. During this process, Azure AD detects if the organization has configured an MDM. If that’s the case, Windows attempts to enroll the device in MDM as part of the “add account” flow. In the BYOD case, users can reject the MDM Terms of Use. The device isn't enrolled in MDM and access to organization resources is typically restricted. +To support these rich experiences with their MDM product, MDM vendors can integrate with Azure AD. ## Integrated MDM enrollment and UX -Two Azure AD MDM enrollment scenarios: -- Joining a device to Azure AD for company-owned devices -- Adding a work account to a personal device (BYOD) +There are several ways to connect your devices to Azure AD: -In both scenarios, Azure AD authenticates the user and the device. It provides a verified unique device identifier that can be used for MDM enrollment. +- [Join device to Azure AD](/azure/active-directory/devices/concept-azure-ad-join) +- [Join device to on-premises AD and Azure AD](/azure/active-directory/devices/concept-azure-ad-join-hybrid) +- [Add a Microsoft work account to Windows](/azure/active-directory/devices/concept-azure-ad-register) -In both scenarios, the enrollment flow provides an opportunity for the MDM service to render its own UI, using a web view. MDM vendors should use the UI to render the Terms of Use (TOU), which can be different for company-owned and BYOD devices. MDM vendors can also use the web view to render more UI elements, such as asking for a one-time PIN. +In each scenario, Azure AD authenticates the user and the device. It provides a verified unique device identifier that can be used for MDM enrollment. The enrollment flow provides an opportunity for the MDM service to render its own UI, using a web view. MDM vendors should use the UI to render the Terms of Use (TOU), which can be different for company-owned and bring-your-own-device (BYOD) devices. MDM vendors can also use the web view to render more UI elements, such as asking for a one-time PIN. In the out-of-the-box scenario, the web view is 100% full screen, which gives the MDM vendor the ability to paint an edge-to-edge experience. With great power comes great responsibility! It's important that MDM vendors who integrate with Azure AD respect the Windows design guidelines. This step includes using a responsive web design and respecting the Windows accessibility guidelines. For example, include the forward and back buttons that are properly wired to the navigation logic. More details are provided later in this article. -For Azure AD enrollment to work for an Active Directory Federated Services (AD FS) backed Azure AD account, you must enable password authentication for the intranet on the ADFS service. For more information, see solution \#2 in [Configure Azure MFA as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). +For Azure AD enrollment to work for an Active Directory Federated Services (AD FS) backed Azure AD account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Azure MFA as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). -Once a user has an Azure AD account added to Windows and enrolled in MDM, the enrollment can be managed through **Settings** > **Accounts** > **Work access**. Device management of either Azure AD Join for organization scenarios or BYOD scenarios is similar. +Once a user has an Azure AD account added to Windows and enrolled in MDM, the enrollment can be managed through **Settings** > **Accounts** > **Access work or school**. Device management of either Azure AD Join for organization scenarios or BYOD scenarios is similar. > [!NOTE] -> Users can't remove the device enrollment through the **Work access** user interface because management is tied to the Azure AD or work account. +> Users can't remove the device enrollment through the **Access work or school** user interface because management is tied to the Azure AD or work account. - -### MDM endpoints involved in Azure AD–integrated enrollment +### MDM endpoints involved in Azure AD integrated enrollment Azure AD MDM enrollment is a two-step process: -1. Display the Terms of Use and gather user consent. +1. Display the Terms of Use and gather user consent: This consent is a passive flow where the user is redirected in a browser control (webview) to the URL of the Terms of Use of the MDM. +2. Enroll the device: This step is an active flow where Windows OMA DM agent calls the MDM service to enroll the device. - This consent is a passive flow where the user is redirected in a browser control (webview) to the URL of the Terms of Use of the MDM. +To support Azure AD enrollment, MDM vendors must host and expose a **Terms of Use endpoint** and an **MDM enrollment endpoint**. -2. Enroll the device. +- **Terms of Use endpoint**: Use this endpoint to inform users of the ways in which their device can be controlled by their organization. The Terms of Use page is responsible for collecting user's consent before the actual enrollment phase begins. - This step is an active flow where Windows OMA DM agent calls the MDM service to enroll the device. + It's important to understand the Terms of Use flow is an "opaque box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL. The user should be redirected back after approving or rejecting the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios. For example, different levels of control are applied on BYOD vs. organization-owned devices. Or, implement user/group based targeting, like users in certain geographies may have stricter device management policies. -To support Azure AD enrollment, MDM vendors must host and expose a Terms of Use endpoint and an MDM enrollment endpoint. + The Terms of Use endpoint can implement more business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which can be a degraded user experience. It's not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Azure AD. -**Terms of Use endpoint** -Use this endpoint to inform users of the ways in which their device can be controlled by their organization. The Terms of Use page is responsible for collecting user’s consent before the actual enrollment phase begins. +- **MDM enrollment endpoint**: After the users accepts the Terms of Use, the device is registered in Azure AD. Automatic MDM enrollment begins. -It’s important to understand the Terms of Use flow is an "opaque box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL. The user should be redirected back after approving or rejecting the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios. For example, different levels of control are applied on BYOD vs. organization-owned devices. Or, implement user/group based targeting, like users in certain geographies may have stricter device management policies. + The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Then, the device is enrolled for management with the MDM. This step calls the enrollment endpoint and requests enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is available to the MDM in the form of claims within an access token presented at the enrollment endpoint. -The Terms of Use endpoint can implement more business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which can be a degraded user experience. It’s not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Azure AD. + ![azure ad enrollment flow.](images/azure-ad-enrollment-flow.png) -**MDM enrollment endpoint** -After the users accepts the Terms of Use, the device is registered in Azure AD. Automatic MDM enrollment begins. + The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this article. -The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Then, the device is enrolled for management with the MDM. This step calls the enrollment endpoint and requests enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is available to the MDM in the form of claims within an access token presented at the enrollment endpoint. - -![azure ad enrollment flow.](images/azure-ad-enrollment-flow.png) - -The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this article. - -## Make the MDM a reliable party of Azure AD +## Make MDM a reliable party of Azure AD To participate in the integrated enrollment flow outlined in the previous section, the MDM must consume access tokens issued by Azure AD. To report compliance with Azure AD, the MDM must authenticate itself to Azure AD and obtain authorization in the form of an access token that allows it to invoke the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). -### Add a cloud-based MDM +### Cloud-based MDM A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It's a multi-tenant application. This application is registered with Azure AD in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer. -The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. Here a code sample from GitHub that explains how to add multi-tenant applications to Azure AD, [WepApp-WebAPI-MultiTenant-OpenIdConnect-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613661). +The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. For more information about how to add multi-tenant applications to Azure AD, see the [Integrate an app that authenticates users and calls Microsoft Graph using the multi-tenant integration pattern (SaaS)](https://go.microsoft.com/fwlink/p/?LinkId=613661) code sample on GitHub. > [!NOTE] -> For the MDM provider, if you don't have an existing Azure AD tenant with an Azure AD subscription that you manage, follow the step-by-step guide in [Add an Azure AD tenant and Azure AD subscription](add-an-azure-ad-tenant-and-azure-ad-subscription.md) to set up a tenant, add a subscription, and manage it via the Azure Portal. +> For the MDM provider, if you don't have an existing Azure AD tenant with an Azure AD subscription that you manage, follow the step-by-step guides below: +> +> - [Quickstart: Create a new tenant in Azure Active Directory](/azure/active-directory/fundamentals/active-directory-access-create-new-tenant) to set up a tenant. +> - [Associate or add an Azure subscription to your Azure Active Directory tenant](/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory) to add a subscription, and manage it via the Azure Portal. -The MDM application uses keys to request access tokens from Azure AD. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multi-tenant MDM application to authenticate itself with Azure AD, whatever the customer tenant the managed device belongs. +The MDM application uses keys to request access tokens from Azure AD. These keys are managed within the tenant of the MDM provider and not visible to individual customers. The same key is used by the multi-tenant MDM application to authenticate itself with Azure AD, in the customer tenant where the managed device belongs. > [!NOTE] -> All MDM apps must implement Azure AD V2 tokens before we certify that integration works. Due to changes in the Azure AD app platform, using Azure AD V2 tokens is a hard requirement. For more information, see [Microsoft identity platform access tokens](/azure/active-directory/develop/access-tokens#token-formats-and-ownership). +> All MDM apps must implement Azure AD V2 tokens before we certify that integration works. Due to changes in the Azure AD app platform, using Azure AD V2 tokens is a hard requirement. For more information, see [Microsoft identity platform access tokens](/azure/active-directory/develop/access-tokens#token-formats). -Use the following steps to register a cloud-based MDM application with Azure AD. At this time, you need to work with the Azure AD engineering team to expose this application through the Azure AD app gallery. +### On-premises MDM -1. Log on to the Azure Management Portal using an admin account in your home tenant. - -2. In the left navigation, select **Active Directory**. - -3. Select the directory tenant where you want to register the application. - - Ensure you're logged into your home tenant. - -4. Select the **Applications** tab. - -5. In the drawer, select **Add**. - -6. Select **Add an application my organization is developing**. - -7. Enter a friendly name for the application, such as ContosoMDM, select **Web Application and or Web API**, then select **Next**. - -8. Enter the logon URL for your MDM service. - -9. For the App ID, enter `https:///ContosoMDM`, then select OK. - -10. While still in the Azure portal, select the **Configure** tab of your application. - -11. Mark your application as **multi-tenant**. - -12. Find the client ID value and copy it. - - You'll need this ID later when configuring your application. This client ID is used when obtaining access tokens and adding applications to the Azure AD app gallery. - -13. Generate a key for your application and copy it. - - You need this key to call the Microsoft Graph API to report device compliance. This information is covered in the next section. - -For more information about how to register a sample application with Azure AD, see the steps to register the **TodoListService Web API** in [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667). - -### Add an on-premises MDM - -An on-premises MDM application is different than a cloud MDM. It's a single-tenant application that is present uniquely within the tenant of the customer. Customers must add the application directly within their own tenant. Also, each instance of an on-premises MDM application must be registered separately and has a separate key for authentication with Azure AD. +An on-premises MDM application is different than a cloud MDM. It's a single-tenant application that is present uniquely within the tenant of the customer. Customers must add the application directly within their own tenant. Also, each instance of an on-premises MDM application must be registered separately and have a separate key for authentication with Azure AD. To add an on-premises MDM application to the tenant, use the Azure AD service, specifically under **Mobility (MDM and MAM)** > **Add application**. Administrators can configure the required URLs for enrollment and Terms of Use. @@ -173,19 +105,14 @@ The application keys used by your MDM service are a sensitive resource. They sho For security best practices, see [Windows Azure Security Essentials](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler). -You can roll over the application keys used by a cloud-based MDM service without requiring a customer interaction. There's a single set of keys across all customer tenants that are managed by the MDM vendor in their Azure AD tenant. +For cloud-based MDM, you can roll over the application keys without requiring a customer interaction. There's a single set of keys across all customer tenants that are managed by the MDM vendor in their Azure AD tenant. For the on-premises MDM, the Azure AD authentication keys are within the customer tenant and must be rolled over by the customer's administrator. To improve security, provide guidance to customers about rolling over and protecting the keys. ## Publish your MDM app to Azure AD app gallery - IT administrators use the Azure AD app gallery to add an MDM for their organization to use. The app gallery is a rich store with over 2400 SaaS applications that are integrated with Azure AD. -The following image show how MDM applications show up in the Azure app gallery. - -![azure ad add an app for mdm.](images/azure-ad-app-gallery.png) - ### Add cloud-based MDM to the app gallery > [!NOTE] @@ -201,8 +128,6 @@ The following table shows the required information to create an entry in the Azu |**Description**|A brief description of your MDM app, which must be under 255 characters.| |**Icons**|A set of logo icons for the MDM app. Dimensions: 45 X 45, 150 X 122, 214 X 215| - - ### Add on-premises MDM to the app gallery There are no special requirements for adding on-premises MDM to the app gallery. There's a generic entry for administrators to add an app to their tenant. @@ -215,11 +140,11 @@ The pages rendered by the MDM in the integrated enrollment process must use Wind There are three distinct scenarios: -1. MDM enrollment as part of Azure AD Join in Windows OOBE. -2. MDM enrollment as part of Azure AD Join, after Windows OOBE from **Settings**. -3. MDM enrollment as part of adding a Microsoft work account on a personal device (BYOD). +1. MDM enrollment as part of Azure AD Join in Windows OOBE. +2. MDM enrollment as part of Azure AD Join, after Windows OOBE from **Settings**. +3. MDM enrollment as part of adding a Microsoft work account on a personal device (BYOD). -These scenarios support Windows client Pro, Enterprise, and Education. +These scenarios support Windows Pro, Enterprise, and Education. The CSS files provided by Microsoft contain version information and we recommend that you use the latest version. There are separate CSS files for Windows client devices, OOBE, and post-OOBE experiences. [Download the Windows templates and CSS files (1.1.4)](https://download.microsoft.com/download/0/7/0/0702afe3-dc1e-48f6-943e-886a4876f6ca/MDM-ISV_1.1.4.zip). @@ -267,13 +192,12 @@ The following claims are expected in the access token passed by Windows to the T |TID|A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam.| |Resource|A sanitized URL representing the MDM application. Example: `https://fabrikam.contosomdm.com` | - > [!NOTE] > There's no device ID claim in the access token because the device may not yet be enrolled at this time. To retrieve the list of group memberships for the user, you can use the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). -Here's an example URL. +Here's an example URL: ```http https://fabrikam.contosomdm.com/TermsOfUse?redirect_uri=ms-appx-web://ContosoMdm/ToUResponse&client-request-id=34be581c-6ebd-49d6-a4e1-150eff4b7213&api-version=1.0 @@ -288,8 +212,8 @@ The MDM may do other more redirects as necessary before displaying the Terms of The Terms of Use content should contain the following buttons: -- **Accept** - the user accepts the Terms of Use and proceeds with enrollment. -- **Decline** - the user declines and stops the enrollment process. +- **Accept** - the user accepts the Terms of Use and proceeds with enrollment. +- **Decline** - the user declines and stops the enrollment process. The Terms of Use content must be consistent with the theme used for the other pages rendered during this process. @@ -297,13 +221,13 @@ The Terms of Use content must be consistent with the theme used for the other pa At this point, the user is on the Terms of Use page shown during the OOBE or from the Setting experiences. The user has the following options on the page: -- **User clicks on the Accept button** - The MDM must redirect to the URI specified by the redirect\_uri parameter in the incoming request. The following query string parameters are expected: - - **IsAccepted** - This Boolean value is required, and must be set to true. - - **OpaqueBlob** - Required parameter if the user accepts. The MDM may use this blob to make some information available to the enrollment endpoint. The value persisted here is made available unchanged at the enrollment endpoint. The MDM may use this parameter for correlation purposes. - - Here's an example redirect - `ms-appx-web://MyApp1/ToUResponse?OpaqueBlob=value&IsAccepted=true` -- **User clicks on the Decline button** - The MDM must redirect to the URI specified in redirect\_uri in the incoming request. The following query string parameters are expected: - - **IsAccepted** - This Boolean value is required, and must be set to false. This option also applies if the user skipped the Terms of Use. - - **OpaqueBlob** - This parameter isn't expected to be used. The enrollment is stopped with an error message shown to the user. +- **User clicks on the Accept button** - The MDM must redirect to the URI specified by the redirect\_uri parameter in the incoming request. The following query string parameters are expected: + - **IsAccepted** - This Boolean value is required, and must be set to true. + - **OpaqueBlob** - Required parameter if the user accepts. The MDM may use this blob to make some information available to the enrollment endpoint. The value persisted here is made available unchanged at the enrollment endpoint. The MDM may use this parameter for correlation purposes. + - Here's an example redirect - `ms-appx-web://MyApp1/ToUResponse?OpaqueBlob=value&IsAccepted=true` +- **User clicks on the Decline button** - The MDM must redirect to the URI specified in redirect\_uri in the incoming request. The following query string parameters are expected: + - **IsAccepted** - This Boolean value is required, and must be set to false. This option also applies if the user skipped the Terms of Use. + - **OpaqueBlob** - This parameter isn't expected to be used. The enrollment is stopped with an error message shown to the user. Users skip the Terms of Use when they're adding a Microsoft work account to their device. However, they can't skip it during the Azure AD Join process. Don't show the decline button in the Azure AD Join process. MDM enrollment can't be declined by the user if configured by the administrator for the Azure AD Join. @@ -311,7 +235,7 @@ We recommend that you send the client-request-id parameters in the query string ### Terms Of Use Error handling -If an error occurs during the terms of use processing, the MDM can return two parameters – an error and error\_description parameter in its redirect request back to Windows. The URL should be encoded, and the contents of the error\_description should be in English plain text. This text isn't visible to the end-user. So, localization of the error description text isn't a concern. +If an error occurs during the terms of use processing, the MDM can return two parameters - an `error` and `error_description` parameter in its redirect request back to Windows. The URL should be encoded, and the contents of the `error_description` should be in English plain text. This text isn't visible to the end-user. So, localization of the `error_description` text isn't a concern. Here's the URL format: @@ -334,7 +258,6 @@ The following table shows the error codes. |Azure AD token validation failed|302|unauthorized_client|unauthorized_client| |internal service error|302|server_error|internal service error| - ## Enrollment protocol with Azure AD With Azure integrated MDM enrollment, there's no discovery phase and the discovery URL is directly passed down to the system from Azure. The following table shows the comparison between the traditional and Azure enrollments. @@ -355,41 +278,43 @@ With Azure integrated MDM enrollment, there's no discovery phase and the discove |Enrolled certificate store|My/User|My/System|My/User| |CSR subject name|User Principal Name|Device ID|User Principal Name| |EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL|Not supported|Supported|Supported| -|CSPs accessible during enrollment|Windows 10 support:
- DMClient
- CertificateStore
- RootCATrustedCertificates
- ClientCertificateInstall
- EnterpriseModernAppManagement
- PassportForWork
- Policy
- w7 APPLICATION||| +|CSPs accessible during enrollment|Windows 10 support:
- DMClient
- CertificateStore
- RootCATrustedCertificates
- ClientCertificateInstall
- EnterpriseModernAppManagement
- PassportForWork
- Policy
- w7 APPLICATION||| ## Management protocol with Azure AD There are two different MDM enrollment types that integrate with Azure AD, and use Azure AD user and device identities. Depending on the enrollment type, the MDM service may need to manage a single user or multiple users. -**Multiple user management for Azure AD-joined devices** -In this scenario the MDM enrollment applies to every Azure AD user who signs in to the Azure AD joined device - call this enrollment type a device enrollment or a multi-user enrollment. The management server can determine the user identity, determine what policies are targeted for this user, and send corresponding policies to the device. To allow management server to identify current user that is logged on to the device, the OMA DM client uses the Azure AD user tokens. Each management session contains an extra HTTP header that contains an Azure AD user token. This information is provided in the DM package sent to the management server. However, in some circumstances Azure AD user token isn't sent over to the management server. One such scenario happens immediately after MDM enrollments completes during Azure AD join process. Until Azure AD join process is finished and Azure AD user signs on to the machine, Azure AD user token isn't available to OMA-DM process. Typically, MDM enrollment completes before Azure AD user sign in to machine and the initial management session doesn't contain an Azure AD user token. The management server should check if the token is missing and only send device policies in such case. Another possible reason for a missing Azure AD token in the OMA-DM payload is when a guest user is logged on to the device. +- **Multiple user management for Azure AD-joined devices** -**Adding a work account and MDM enrollment to a device** -In this scenario, the MDM enrollment applies to a single user who initially added their work account and enrolled the device. In this enrollment type, the management server can ignore Azure AD tokens that may be sent over during management session. Whether Azure AD token is present or missing, the management server sends both user and device policies to the device. + In this scenario the MDM enrollment applies to every Azure AD user who signs in to the Azure AD joined device - call this enrollment type a device enrollment or a multi-user enrollment. The management server can determine the user identity, determine what policies are targeted for this user, and send corresponding policies to the device. To allow management server to identify current user that is logged on to the device, the OMA DM client uses the Azure AD user tokens. Each management session contains an extra HTTP header that contains an Azure AD user token. This information is provided in the DM package sent to the management server. However, in some circumstances Azure AD user token isn't sent over to the management server. One such scenario happens immediately after MDM enrollments completes during Azure AD join process. Until Azure AD join process is finished and Azure AD user signs on to the machine, Azure AD user token isn't available to OMA-DM process. Typically, MDM enrollment completes before Azure AD user sign in to machine and the initial management session doesn't contain an Azure AD user token. The management server should check if the token is missing and only send device policies in such case. Another possible reason for a missing Azure AD token in the OMA-DM payload is when a guest user is logged on to the device. -**Evaluating Azure AD user tokens** -The Azure AD token is in the HTTP Authorization header in the following format: +- **Adding a work account and MDM enrollment to a device**: -```console -Authorization:Bearer -``` + In this scenario, the MDM enrollment applies to a single user who initially added their work account and enrolled the device. In this enrollment type, the management server can ignore Azure AD tokens that may be sent over during management session. Whether Azure AD token is present or missing, the management server sends both user and device policies to the device. -More claims may be present in the Azure AD token, such as: +- **Evaluating Azure AD user tokens**: -- User - user currently logged in -- Device compliance - value set the MDM service into Azure -- Device ID - identifies the device that is checking in -- Tenant ID + The Azure AD token is in the HTTP Authorization header in the following format: -Access tokens issued by Azure AD are JSON web tokens (JWTs). A valid JWT token is presented by Windows at the MDM enrollment endpoint to start the enrollment process. There are a couple of options to evaluate the tokens: + ```console + Authorization:Bearer + ``` -- Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JwtSecurityTokenHandler Class](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler). -- Refer to the Azure AD authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667). + More claims may be present in the Azure AD token, such as: + - User - user currently logged in + - Device compliance - value set the MDM service into Azure + - Device ID - identifies the device that is checking in + - Tenant ID + + Access tokens issued by Azure AD are JSON web tokens (JWTs). A valid JWT token is presented by Windows at the MDM enrollment endpoint to start the enrollment process. There are a couple of options to evaluate the tokens: + + - Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JwtSecurityTokenHandler Class](/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler). + - Refer to the Azure AD authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667). ## Device Alert 1224 for Azure AD user token -An alert is sent when the DM session starts and there's an Azure AD user logged in. The alert is sent in OMA DM pkg\#1. Here's an example: +An alert is sent when the DM session starts and there's an Azure AD user logged in. The alert is sent in OMA DM package #1. Here's an example: ```xml Alert Type: com.microsoft/MDM/AADUserToken @@ -401,7 +326,7 @@ Alert sample: 1224 - com.microsoft/MDM/AADUserToken + com.microsoft/MDM/AADUserToken UserToken inserted here @@ -412,14 +337,14 @@ Alert sample: ## Determine when a user is logged in through polling -An alert is sent to the MDM server in DM package\#1. +An alert is sent to the MDM server in DM package \#1. -- Alert type - com.microsoft/MDM/LoginStatus -- Alert format - chr -- Alert data - provide sign-in status information for the current active logged in user. - - Signed-in user who has an Azure AD account - predefined text: user. - - Signed-in user without an Azure AD account- predefined text: others. - - No active user - predefined text:none +- Alert type - com.microsoft/MDM/LoginStatus +- Alert format - chr +- Alert data - provide sign-in status information for the current active logged in user. + - Signed-in user who has an Azure AD account - predefined text: user. + - Signed-in user without an Azure AD account- predefined text: others. + - No active user - predefined text:none Here's an example. @@ -430,7 +355,7 @@ Here's an example. 1224 - com.microsoft/MDM/LoginStatus + com.microsoft/MDM/LoginStatus user @@ -445,8 +370,8 @@ Once a device is enrolled with the MDM for management, organization policies con For a sample that illustrates how an MDM can obtain an access token using OAuth 2.0 client\_credentials grant type, see [Daemon\_CertificateCredential-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613822). -- **Cloud-based MDM** - If your product is a cloud-based multi-tenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Azure AD. -- **On-premises MDM** - If your product is an on-premises MDM, customers must configure your product with the key used to authenticate with Azure AD. This key configuration is because each on-premises instance of your MDM product has a different tenant-specific key. So, you may need to expose a configuration experience in your MDM product that enables administrators to specify the key to be used to authenticate with Azure AD. +- **Cloud-based MDM** - If your product is a cloud-based multi-tenant MDM service, you have a single key configured for your service within your tenant. To obtain authorization, use this key to authenticate the MDM service with Azure AD. +- **On-premises MDM** - If your product is an on-premises MDM, customers must configure your product with the key used to authenticate with Azure AD. This key configuration is because each on-premises instance of your MDM product has a different tenant-specific key. So, you may need to expose a configuration experience in your MDM product that enables administrators to specify the key to be used to authenticate with Azure AD. ### Use Microsoft Graph API @@ -469,16 +394,16 @@ Content-Type: application/json Where: -- **contoso.com** – This value is the name of the Azure AD tenant to whose directory the device has been joined. -- **db7ab579-3759-4492-a03f-655ca7f52ae1** – This value is the device identifier for the device whose compliance information is being reported to Azure AD. -- **eyJ0eXAiO**……… – This value is the bearer access token issued by Azure AD to the MDM that authorizes the MDM to call the Microsoft Graph API. The access token is placed in the HTTP authorization header of the request. -- **isManaged** and **isCompliant** - These Boolean attributes indicates compliance status. -- **api-version** - Use this parameter to specify which version of the graph API is being requested. +- **contoso.com** - This value is the name of the Azure AD tenant to whose directory the device has been joined. +- **db7ab579-3759-4492-a03f-655ca7f52ae1** - This value is the device identifier for the device whose compliance information is being reported to Azure AD. +- **eyJ0eXAiO**……… - This value is the bearer access token issued by Azure AD to the MDM that authorizes the MDM to call the Microsoft Graph API. The access token is placed in the HTTP authorization header of the request. +- **isManaged** and **isCompliant** - These Boolean attributes indicates compliance status. +- **api-version** - Use this parameter to specify which version of the graph API is being requested. Response: -- Success - HTTP 204 with No Content. -- Failure/Error - HTTP 404 Not Found. This error may be returned if the specified device or tenant can't be found. +- Success - HTTP 204 with No Content. +- Failure/Error - HTTP 404 Not Found. This error may be returned if the specified device or tenant can't be found. ## Data loss during unenrollment from Azure Active Directory Join diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index fd9f4c2321..32f8e9cbb9 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -1,7 +1,7 @@ --- title: Mobile Device Management overview description: Windows 10 and Windows 11 provide an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy. -ms.date: 08/04/2022 +ms.date: 03/24/2023 ms.technology: itpro-manage ms.topic: article ms.prod: windows-client @@ -9,6 +9,9 @@ ms.localizationpriority: medium author: vinaypamnani-msft ms.author: vinpa manager: aaroncz +appliesto: + - ✅ Windows 10 and later + - ✅ Windows 11 and later ms.collection: - highpri - tier2 @@ -16,22 +19,27 @@ ms.collection: # Mobile Device Management overview -Windows 10 and Windows 11 provide an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users' privacy on their personal devices. A built-in management component can communicate with the management server. +Windows provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users' privacy on their personal devices. A built-in management component can communicate with the management server. There are two parts to the Windows management component: -- The enrollment client, which enrolls and configures the device to communicate with the enterprise management server. +- The enrollment client, which enrolls and configures the device to communicate with the enterprise management server. For more information, see [Enrollment overview](mobile-device-enrollment.md). - The management client, which periodically synchronizes with the management server to check for updates and apply the latest policies set by IT. -Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a third-party server proxy that supports the protocols outlined in this document to perform enterprise management tasks. The third-party server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. MDM servers don't need to create or download a client to manage Windows 10. For details about the MDM protocols, see [\[MS-MDM\]: Mobile Device Management Protocol](/openspecs/windows_protocols/ms-mdm/33769a92-ac31-47ef-ae7b-dc8501f7104f) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). +Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a third-party server proxy that supports the protocols outlined in this document to perform enterprise management tasks. The third-party server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows users. MDM servers don't need to create or download a client to manage Windows 10. + +For details about the MDM protocols, see + +- [[MS-MDE2]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692) +- [[MS-MDM]: Mobile Device Management Protocol](/openspecs/windows_protocols/ms-mdm/33769a92-ac31-47ef-ae7b-dc8501f7104f) ## MDM security baseline -With Windows 10, version 1809, Microsoft is also releasing a Microsoft MDM security baseline that functions like the Microsoft GP-based security baseline. You can easily integrate this baseline into any MDM to support IT pros' operational needs, addressing security concerns for modern cloud-managed devices. +Starting with Windows 10, version 1809, Microsoft provides MDM security baselines that function like the Microsoft group policy security baseline. You can easily integrate this baseline into any MDM solution to support IT pros' operational needs, addressing security concerns for modern cloud-managed devices. The MDM security baseline includes policies that cover the following areas: -- Microsoft inbox security technology (not deprecated) such as BitLocker, Windows Defender SmartScreen, and Device Guard (virtual-based security), Exploit Guard, Microsoft Defender Antivirus, and Firewall +- Microsoft inbox security technologies (not deprecated) such as BitLocker, Windows Defender SmartScreen, Exploit Guard, Microsoft Defender Antivirus, and Firewall - Restricting remote access to devices - Setting credential requirements for passwords and PINs - Restricting use of legacy technology @@ -47,27 +55,3 @@ For more information about the MDM policies defined in the MDM security baseline - [MDM Security baseline for Windows 10, version 1809](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1809-MDM-SecurityBaseLine-Document-[Preview].zip) For information about the MDM policies defined in the Intune security baseline, see [Windows security baseline settings for Intune](/mem/intune/protect/security-baseline-settings-mdm-all). - -## Learn about device enrollment - -- [Mobile device enrollment](mobile-device-enrollment.md) -- [Federated authentication device enrollment](federated-authentication-device-enrollment.md) -- [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) -- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) - -## Learn about device management - -- [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md) -- [Enterprise app management](enterprise-app-management.md) -- [Mobile device management (MDM) for device updates](device-update-management.md) -- [OMA DM protocol support](oma-dm-protocol-support.md) -- [Structure of OMA DM provisioning files](structure-of-oma-dm-provisioning-files.md) -- [Server requirements for OMA DM](server-requirements-windows-mdm.md) -- [Enterprise settings, policies, and app management](windows-mdm-enterprise-settings.md) - -## Learn about configuration service providers - -- [WMI providers supported in Windows 10](wmi-providers-supported-in-windows.md) -- [Using PowerShell scripting with the WMI Bridge Provider](using-powershell-scripting-with-the-wmi-bridge-provider.md) -- [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) -- [Configuration service provider reference](mdm/index.yml) diff --git a/windows/client-management/register-your-free-azure-active-directory-subscription.md b/windows/client-management/register-your-free-azure-active-directory-subscription.md deleted file mode 100644 index 2d326ac269..0000000000 --- a/windows/client-management/register-your-free-azure-active-directory-subscription.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Register your free Azure Active Directory subscription -description: Paid subscribers to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, have a free subscription to Azure AD. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 06/26/2017 ---- - -# Register your free Azure Active Directory subscription - -If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. Here's a step-by-step guide to register your free Azure AD subscription using an Office 365 Premium Business subscription. - -> **Note**  If you don't have any Microsoft service that comes with a free Azure AD subscription, follow the step-by-step guide in [Add an Azure AD tenant and Azure AD subscription](add-an-azure-ad-tenant-and-azure-ad-subscription.md) to set up a tenant, add a subscription, and manage it via the Azure Portal. - -  -## Register your free Azure Active Directory subscription - -1. Sign in to the Microsoft 365 admin center at using your organization's account. - - ![screen to register azure-ad](images/azure-ad-add-tenant10.png) - -2. On the **Home** page, click on the Admin tools icon. - - ![screen for registering azure-ad](images/azure-ad-add-tenant11.png) - -3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. You're taken to the Azure Active Directory portal. - - ![Azure-AD-updated.](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) - - - -  - - - - - - diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index b1450dcb92..f7050222bd 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -12,10 +12,10 @@ items: href: mdm-overview.md - name: What's new in MDM enrollment and management href: new-in-windows-mdm-enrollment-management.md - - name: Transitioning to modern management - href: manage-windows-10-in-your-organization-modern-management.md - name: Azure Active Directory integration with MDM href: azure-active-directory-integration-with-mdm.md + - name: Transitioning to modern management + href: manage-windows-10-in-your-organization-modern-management.md - name: Push notification support for device management href: push-notification-windows-mdm.md - name: MAM support for device management From c7f5e1124878a982e6d139d3730d6dc74e40dcbc Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 29 Mar 2023 15:50:10 -0400 Subject: [PATCH 011/139] Mo changes --- ...e-active-directory-integration-with-mdm.md | 4 +- ...ver-side-mobile-application-management.png | Bin 65626 -> 20709 bytes ...rver-side-mobile-application-management.md | 27 +++-- ...-in-your-organization-modern-management.md | 75 +++++++------- .../push-notification-windows-mdm.md | 92 ++++++++++-------- 5 files changed, 98 insertions(+), 100 deletions(-) diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 228f7aa0bb..6b68056cbc 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -36,7 +36,7 @@ There are several ways to connect your devices to Azure AD: In each scenario, Azure AD authenticates the user and the device. It provides a verified unique device identifier that can be used for MDM enrollment. The enrollment flow provides an opportunity for the MDM service to render its own UI, using a web view. MDM vendors should use the UI to render the Terms of Use (TOU), which can be different for company-owned and bring-your-own-device (BYOD) devices. MDM vendors can also use the web view to render more UI elements, such as asking for a one-time PIN. -In the out-of-the-box scenario, the web view is 100% full screen, which gives the MDM vendor the ability to paint an edge-to-edge experience. With great power comes great responsibility! It's important that MDM vendors who integrate with Azure AD respect the Windows design guidelines. This step includes using a responsive web design and respecting the Windows accessibility guidelines. For example, include the forward and back buttons that are properly wired to the navigation logic. More details are provided later in this article. +In Windows 10, the web view during the out-of-the-box scenario is displayed as full-screen by default, providing MDM vendors with the capability to create a seamless edge-to-edge user experience. However, in Windows 11 the web view is rendered within an iframe. It's important that MDM vendors who integrate with Azure AD respect the Windows design guidelines. This step includes using a responsive web design and respecting the Windows accessibility guidelines. For example, include the forward and back buttons that are properly wired to the navigation logic. More details are provided later in this article. For Azure AD enrollment to work for an Active Directory Federated Services (AD FS) backed Azure AD account, you must enable password authentication for the intranet on the ADFS service. For more information, see [Configure Azure MFA as authentication provider with AD FS](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa). @@ -93,7 +93,7 @@ The MDM application uses keys to request access tokens from Azure AD. These keys An on-premises MDM application is different than a cloud MDM. It's a single-tenant application that is present uniquely within the tenant of the customer. Customers must add the application directly within their own tenant. Also, each instance of an on-premises MDM application must be registered separately and have a separate key for authentication with Azure AD. -To add an on-premises MDM application to the tenant, use the Azure AD service, specifically under **Mobility (MDM and MAM)** > **Add application**. Administrators can configure the required URLs for enrollment and Terms of Use. +To add an on-premises MDM application to the tenant, use the Azure AD service, specifically under **Mobility (MDM and MAM)** > **Add application** > **Create your own application**. Administrators can configure the required URLs for enrollment and Terms of Use. Your on-premises MDM product must expose a configuration experience where administrators can provide the client ID, app ID, and the key configured in their directory for that MDM application. You can use this client ID and key to request tokens from Azure AD when reporting device compliance. diff --git a/windows/client-management/images/implement-server-side-mobile-application-management.png b/windows/client-management/images/implement-server-side-mobile-application-management.png index 88555f2d3b45a454ecd31b12919cfed6c7d17167..822b7f7ea05711fd86d91e9543b0be3ba7692e53 100644 GIT binary patch literal 20709 zcmd43cT`i`);^5oh#VC>qN38QV4A&**3)HV);-_6N%~5vn%A;)SO>jv>AXyNkIIbnWTV$P z>vJ+Pm5Ez~Zof#+<@_%@KxJg)Ti1Tp5&hoZlaaX=YWe%Qn;|aqW2}-RktpWuJAg zJh1M1aU$Z5QSTpnGIFtw2_uHvkB!2&UmfF@tKXusg3F4Vz0rss7uc%cmuQ=Ta>v?- z1CHLPAP(RXcvd<$85NZl73pwa=Kss^;UGaGVl@i5tY8d59LoI>ryE29O2WCLP*P<@ zspm_;34|TLV#Q;oPv-0T2;;|PmqXy}Zo@`OonJ6eGy`f(1n}PrgltkHP&lFRK*3ct zpLB(q0?rEb897^9XG~LV{-vZh@HFNNsie3E5gBeOM@f~KvhrI1w>$+Zj z2xRo+EF^&dmUnOq1aY@tBT9l2y$PF=gfxaNC5o-N%_u&`uJ&@yyM@4Qf!dE>0CW(} zd@~u9^(`tN4#Pu_p1U9(1`8JmLc$n<$49-788grgv<`$kUV+W9&5ULJH*bW>+*(H5 z;T4L6`A)f7n5CJY*f=L;5a~cZ$%@J_Wyt6#x2T*=5uS7sYa-y8;VBkym&twbK=}g* zaJ!6*lSTyZw-7-Y`cWPDr!P0h4*|8mr>u7&cV`E<_%mS|zKeiAS^K&6%@K8&pSVvw z7{%5rZ$>R+8tq(AJM45`tRVJoFf)+#&j{K~PsH^pgJ7glqj^+u13AY`bTe4wi!>+) zx~F=NJ;=QGwuaOl_FxPiGUChv1C6biLmf$)p!55=2b{2-XXK`rPksN=cb<1D@H~F} z`j!fcj%2}0GL*KQICcp|cM(*hrp1gT>93se!OvA>Oih#Eld(j z@=?iRt3t2iu~_JbB+1eP^D`slY1~~84Y6<4&Z;o z5#Z+76WOsSa`W;48s>+DZJqcw5z+8`-QF!S{tiL%^ul1jTe<$k?Z}Z>_OPqYc_R|V zn|P#(8sE22qrl*}x}@r!Lyp?HV9blqL%Fj@U>SV97r>*R-!QX)$x#&uHzkzBH3#tEla|(0?HmZ;AviT(mQ3*+WrH| z^Q8V9x!K$_LcV#g8Ec(ex*=0|;h9jh%og{0$WcI*YY~Xh2~szdKNkGr%po3Yb3sqF4#gpxXJgJoovTq6a_eZ8#IKF$#JQB0vKA! z#~aWiqX}x#ZHN|7?&^EK^4ECEFYKp*htmtbmvjyrq!ZbnFcDi}uW)os?E51s)yLAg zA7ytKdv2b#CEHU0gCG}fi@Ex#L5fyeYy@s3m{=HLOg$AF{2SQg3$r!JU%d;qC?99$ zmN?P4nLbjZw4;<;Q4n^^5C4{I zOqEQ%4`VCc*o<1@)43FIuqIQJ6olU6)c0CnLHQY2-fmry$-rZuhWu1BQA=u)& zJN;OJ!r=wZMC4Nl;~f@pSBHraFQ(LN`aMiC1=`gWD_yxk37T|3x>BAvymK7MtKNU$ z6w=zA0O}%s#{rhSji(Tw$&cz?dvsCjrI(jJm(L@b4a$-5kh^6Tg%nNTx7!nNlk}1g z+P#&vhat+{B4r2$3%P0A`rhd;M0CSK_&;?Vv^kM8= zwp)pEDnXu|i6;k3=Y_V~=s(<}-W3Kooz~K%fDS$Ou|R>9MRJ?muWO|qNJO}Q9l&f` zmVMSVX#&|yKcJ;R92TA5Ou{rM>}m~y&IgW(U>)H4A{EW9O3}&TO*Z0pHj*@l({hvH z1Qi2;P<`vINH`&iP;oc+74dP-j5~epl$Cu#JR^wkAV?w)NKV^JZn%>~w|0xnmyWbJ zeddR#adX(7JXX?)*4XscjnEl^P$5Rf39A}mysG&NRP;L}@o;u0mv|(bsX0~UjQ!#* zmNR*=M3^M%C*etwSLz=;4yCL2w{3zRIA8|co3=k!V#+fd zN>@buEh55F;0xFzqytpf;0K6WJ_H+h56;kBs!nG2apo0!zS^%?y#iLj(4nFC!T zj$B5k;7=gz`BiHHIlNHiL*8#)>$DC|T*%ewkc3i%vxD~bET;z0U_qn|&m%+QDr zw#huE?PnpD)k2O+E%yujp^VH2eUr(s{nDWR#8qC#=(hA_Yv~7M5_U;nvfWIVdF*~c zPxh6~5hu+!;uuTfe{Jn4!{_0N}ZzT9VAAk!h8)?6R&V!JA8^Sy&&K*Ow3!q#xxhJEs z{=+(y!>>C@MorC9N44_I{R2w8(EKC|nca__Z(Vf{u~44aKPPG&LN@%-L>~KzqwCL zv1&kwM}<{}ts-O9?-k?)U+ssrt8|Oz%5fhyp%`-X9UVa7Vr0$jjtQ06I=rh(hF39V z)m>oh_2&#!Ms4(T>2`(^Y&*FQptG5NKQU_AuZc5NbKB8F57^9H@3ft|8Px5X69PT0 zXft1b*zBCqyiJMQ8JqVs#poq7-iGt`&p<1MA|8K!$G#iplcNC=qbJXa6giJ#C#!PJ zdG}Q)r%YH9iD;e9cwO3A%Xvi$Y?%7ACmLrr>(et6*^qTp^m|iTFpH|2n{0KNd(L_F zB_hB+E`pcwJg;AJ1AT^;54PzUO}{K?TM7Zi$61R^5)J^B`uXq1u`_0U?q{4kyOHw0 z62$>rUCy2}(4l%nsnx?nP@R|9PP5DeIr3o|2;=3JyRTE-rIY>Mq^G8}Kj1uJkeYak z979*TO^<&^-p+bboHe3b_ZGqorHtUF$&XAysx-!TAWQr^%Pu2Hq`x{|><(+*jmP|c zWBjMu?nyz`?Y4fz)A>dT_e{03>RX~G-mcADzJvQ>qP~bdjqUg3SC@mzElNR%(O7no zKs5nvqFbJ9o##|~Djir8X&sd?9_+)zR5!PuG}gon;EWC#f@g zUv-|E&ZlW|B)%!n#?9u7z$)t}?rDDzkAEH^rwosPuHLX6% zc14E7<))Y5z4-U_cXw1etUjm(L9_!0+e>_%UTA0DYMN^JAV-r^0}$(zp_G=M`M z+7x%8BA4n%4C37zZ(J;kS8|E;J;iIdO?=~`ykN}%_!wOrVv}kzOnob6RK$26M+MmX zQNL=c5OHkeuBGZT{vV-@(^xi3c0iDafl$~t1zCmd=jM?s9sGKzC4x_zl^jg0<+teK z2Sw8@-3PP%lsnoUM#A;=de2rx-kNv6nw+%hnMzq_rDBnXELbH(!>Qv{ht{TI^wBeA zov@gb-sJugo1@rm(p9pu(ZD4O0*2+li>^Lw%W}EfQ$$iKAHzHRd>V46mX!ed1&a4V zhBR)1_5t&CGYqY`1w$v=-9cR9SFd+KyYWZWBO%KaPg1p8*I>J~LoPaaWz>^$beU4; zK%Oe(eIkL(!{#}(hqREu$ysHTOGGGQz6I?gei8@gjss=NM7bU<`H-e;x#`HzXIZKN7m`*_iIJV}g z=%ka07*_0CM~QA-cdl1!dRY!7m4UGWTMS=(Nd?roglRj2J&^ktFJ@?TOc7GyO6_tX z8N&0;wR#o`sW&`yi@uxq9CEmTX{&AJV-icyRUYiF|JH?MbK6$GjDIxQ8slA37w2mV zW;qgiMLl|q;aWn<)U3%)$PdyHh(GOi@JX1Y^5Kr2DNOn0v)~;aZN-srmC;q(V%5@= zmO~o?eIG}Y=L_vkUpgWeqo2%ZcHi?$BKNQQYp<$^v!%DHiM79N{B8K;6k`PN&OR3q z{Oxw{YJrxiF(s_A+3`C)4M>4yv^0gx-coL)TZiL;gV=7g7qTk`G4`_;qcp#r9@A6~ z?t^h5hSdvUupia+8d-ATBd_}36#7%)cdPQxP_l!_S%oH%)1CaYA zP4B&Twephv$11ywt}|(ja*t$GQJ=(PxAl5ss;*zFOGLwLnuYoo_sh)z@+ixLTJESC zgtlLzNBeRI{0$x=Hv6`czKyf!{*h!H>bn{AJy7+L@(fOZ%>o-j0;+X^Xfnyp+?;S# zP4j9_C!you)K(0)bBNyPY|$iJ?mWPoN_luEHn2UkpKoX16<|yJ9T&g8PnTox>z%>= zAZS7Z_qROq)M%T5rXtr6ZA&KBv3{6r^_UHtUPvm5Yob#IQwMbUA|&06;zYiQ$}M&` z!vYpsc{dvcFqOKLU!bmrQm+xvcJy$P0;M=)(m=9NH8#K@=@qiixpen^jq^PXJ`_=MD3s5}v2oDdVWD7@zs5h7-dCOvY(8*F4dzR3PHt?8WK_S}0Tg?aTG zm-`)o*V|q6|9t=Bg3=#PdFz|bnNE0b<)OJA6GhtPYVGDhYw#@D!sd#U+}iPPm@U~< zm(Y*k{|s>4AoJbma~QfwR_#~mJ0?W33Lifm25qzd^GNV`$pyd_%+?^DjLcV=|Ha|) zM}dOcqhJ?gkzjmY>7Uc_{A)UoBd%UW1CZH+GBQT;%j24?C$Z=CWUsv_lv0r@Z!Pe$ zJG$2G{11q_?sW7&k!)!@#ZQ#qDEb)O$O>m>wH~DS*ZLS98)Mq!;s_2>7P}d9eC^Z`}@6*-1G=5;uA;zPi&RTWo;)VU`EM?VTR<0R* z$NC0^32EA6c{U9lU@&(iz0*jFV$H9Vi0%XihthsTd>QVpnj68!JzD&Fy~fzll^=b7 z8lZpC@i3J6d*gI?$MaT-oKoKn+0x6HXYyu%bVxfvXXx6A=z~ zspYYPH!Q9YTcvfqVUs~{6tfHk4M7q3*S7UbthT&jF(<%-L;`t zJ?%46w9RC|@ZEl5N!IDU0H$gO>>5|&v`_HV5N?E7ioUcu+)UdIp>3*AF?H4i4%OKS zGM|-_v0sv4rPS4yCKjzVrQ4zb-nRmWYt z??=`r*S!RM(AtghlNDO29^ zGhc8<)v7QLm0=52V>=pB^N@I-U|+=80&Y{m*kse46-{tzX(4o>(D@=~HF$pa;H|NT z=+GaZr40#{m|`B?sIZ(f?^jY<^rhe7W$;9Kk?-o0-0YsQfP#X z*cY~;x~!C8beoQ8Nyu|4vzd+WpTkh6S4ek#n@4<$62$e3nGgFi&alZ<51f<8fmu7b zKFismJ;x}(j{-?G5L#*7?-FGdc!CH-o`n?OAylZXtQyvm+#-ATi zts7al@_4Yr#*FU^0k!ufEY7^(kh8a>@ zND|;aF`x|0tOTsgJPkPT5E?nA!BHW$RYV!z74Q4Vi#0AUWTZYx{*AG|S~8kNAH`+A zy+QRi7uV-D49==3@w|s0I_CiEECWdSHm$}qbG5`yh$;5lWk^=znrpqszM99Qe_6AV z!voqiLK7I_JHXKD0m9J*^cic$q9~*f*I2L^IxMc#?sON`&V+3*x5micXb;hS$h{BE z8Q}Y%GBAE+^A%&!Lj0#!3rrBGGyU{4(~Tedb} zwr*hc3mubZ50sYhRWN7PvFkc(D~X?jW+WnlV~VkP{Q&U z?zsc5mU_h_9+GhGTW(5dCi7YhR!30#m3yHMtOrNWdRRl$NfXTGZXCgvg1IQR4>P|& z87zlPAM!=@i7EZYWu({@e~90EJ#s|I}Xe71$r3ylEsHl zRO+nmOU1?|AEN{c^5YeKvhtxt_*1u7`_y~Vq5>;_xT-0i6d!y+#ZFwzl=tF3&3TK} zF1v3UG#Y>o^(yuY&SCB_EpI4zVxCrZ$)`F1(fH)L?UqsDGGibpqh%Bcu3#~I&15Yc zuv@8&3y?cTAbsQ~p+OWsopukUe3fH#O2BL&k}Rs3ODY4r@{{O{hHtgJdt;$cCcj>s z@|6xB!w;?*28Z1WQzcIsA@CLWZi5nU$G~j`Wgkh!LL@?%03XgRP}nUpx=xH?&jva* zEaM(jTXVmtC=)D9QS#J8204zuA{6cARn0BsxzOuFbYZ+U&cMRAH{O3R-mj+pFbZzA z<=Va{r`E)7X4Jz=!2S9Y{0_v0Vc%NreN;|B^EmR^h+5Cv)!}lWoH4m<;qYWqO;KHq zbG~(4PzFvmB_QA+u^4|EW^VBB2|`mw(7`RLkM4gCfm*j((z2ANSLHC2EOp;&wH)_L z&Z7ahWH+l?2gj_aLJ7@tS1ZSrdIOsMRoRTnd7TyB!$_nlFU>>*_WXAE1zWUS;;!3b zw$gx4oL$NwV)uoS1xvfzee74FPAFDT)jFR~4e(cP0@ay2(waz8Bb)4`-ALHmd3^lz zLuev87VBuo>1HQTF`5vg9u&6QT`-98KstkIwR*&r0;3&$MHx- ziJe11xkGnjT)7+8+P3-l{IQRtv&;i4oLl_vpPAaWE~g*`BOj@nZXGumXh1BB2xZ16 zyu3jEnl-DdJX?aX9YNx(>--Y;4|u7>J)JovdR5+h-_Y2FTifO21qL3&3?eD3-DP~+ zo$cqY7e>$Tz%~XgxrY|ZPh@tSEG#d)_*c3S$bR(J>TP`F{_*6>3GZ#k1V7j5qvYK? z6HLkLx_&R+6gTWLBcn7J;NA6ssTAx&S-9Th*>D@I>ENT>_0nI5s-EUwj!y0j8rHz@ zG^gz`oteq^gg*g|2If80BWG$J9RK6{UHyxhr?UcXcQYDc_6~YPaoJnimCYnj`;k8w zk{)wQqDk3-bn^J;@`WtQEk*U6bHco>rtZ&c?&nOvlxt;UywBv6Z2KB<%( zIJuMe!Vz6++B$C@*TJGmR((}X%s&Kt1om9N-=uS z0j_Rx7_BBOc`z|DM=5ik^5)I-6J8pndK0IHf$-(S8w1rpdNleZJ=OufwGNY`d)199 zFT7n?X1CG*D=P(5X3SLJdgi9LH+_u=BOuGd#5tIJ z1MldTCbXH9pB7s7Z-SC%Y`!R61O4eZS6^5ED>S>XK8a8F6V$ z_MQKndaxw$s70#T#knP78mQv&Y5h~!ycdD(0+qyAU z^Q)2}EXYF;IM0KarqJxcRL@%P#WQHhqb63K)_}szVK&qTr}SX#dHfgstb}iD$P{vt z_6R(Pc+&(TTAt?_j`IT@Pn4ZZk8N>&v}p9?^S#sK!uqm3X7C8P6ScG*!x)xpA%b|) z?|Az!ploFgi&I10u;F!ivR43};m$d_6)^R3^JH`#$ofiPsV*jMzq zMJ{AZEvD#mC?w0w;Zhh@fsO#G@NYV)^NUwB2N-N4j$8MNNU!}a;S}xRwbbkLoxYS& zcwk28!b=f5G+WV!$LGA(B_(`ol6P%>_M#KE3z}#g(ykIzV=TxR(dLeD|R6O@UG8v`ULF_b`5?KrvAd7u#1B>VBBSl^v zFww^}<=MCV*m9~rqU}{;BCMFoxL3kvaKZtNxt&~Ctw$$*)ucVl$k0=8a!l04U~|Q# z>bA?(&3<=kT7Dba+0kYa$+Ivxnl!p@k`Q`!a6|6GemFXiI_fq>;PmY5JfIm^o72UBv4ZzZ2`@BI(SjE&fDeCGBfKjE-#EWa;>AR_6~_!T{+4} zeB~C`Q)>l!MT6}l%WP7a63k!N??~Tt96lzshN=T4fYT8 z5)DIC-UkUnXfR?`zHNNY=>>Pw_hSpPSM?0m%|U;xVB~J$AH=`+1vx8>)3qi7ipydBoK0vAQ)-!Y`?1|*ZA1iJ?FjJ`}t*e57sVO6) z-=#!sp~-l=7@W}P2)Cs@xU04MAKY`LLx$g6EjjTN_t@S#p0}k{fWn{bGc7FIu7(p6 z_LgblL~3^rS56TH>gg-_nMvtbN~s;iZvN15ZkQRi3gy>y8$MPWR%X_420`tE@xyGN zuN%{_ogZWq(~P7<)rrN35_@{s#+;RL2=Reb>jm$c&sSO|yP zjv5Qyx0WKo;bnqvky#gvsArPn2Bd`g-u|=ws&HKE)#SIEGS#=sW*LdRKMp{R(kO;a z1)F}yt3j{o4R&LxpVM}w1s;6raSK~w!hM%vd3hwb7+?hvd~zBDizZGy*rsjlq=!aA zOB2`+f!b>ZdGF=-FkBOBhH~cb(`dh2iSTV+b;RL2Mo;&o^bxzkwj#CUhf^R7Wtqu_ zU&n0YdggbG{z$Kk|MUn^?D6zZCuzm)HH3y6pP$_^(p5(o`l^J0i*YekqUM)X!myWG zMZ%&W=5XcP&N8Yj0wb)<6Su+(X75pkS9INZJjP%gE@qj@y*o;#9&#XYxR^F(k$Tz; zEiq1kVI_5w06mhb1+t~ZuTwSfjeGhNZ|+N*&>cvJE#YAa{VH6A+zr0pHLs?EaQ;YyiOGhuJzDTeB&YOa45ydzvh_=t-qW1v5=Xy>%5e(w!nOl~8nK@F~66xrbC zxwQk&7q2)qhYMntdvVCJCeXK`O}1+rkX^EApRagmF|-zK^OUm;BcW0}W~A1c@}dw0 zRhkQJ{@JGJz11lKO^-}=5%x1xUx9LhJG+(s8WeMz4Fkoe4eS*+|}Z@ zPrnX7l7$MQ$PlkrJsukG&#Bz!hlin!`V2t>d^xz<}D8N$~6nD&s=Z*&c2ur8dnqm*4b!DvvrH57k~;MY!(+j&kyf|pYwcVnzIh!03&o*B=& z(p>d5foGyQqU{vv6DQz>`SPQEt8-Zvd0NnTiod7;yi%)WEEx?I!XNfja?h)K_4u{> zz$N#X$0Qa(T0nJgG?e>L+)Ock*BoU&b~rCDjW-!_rAN{p8}K3 z%{dzF0s?}pW8C&nopbH@#vlxW0^J+a-Pe;h3qz zvTX0~hW6mfw9?fNXtd^B{ukJPNqKO4m-o5A<4(&O4Nu^`PpuBIw5@V~F1yt1>oR6u z)bmqKI*`zHJU3nULsq^b{j^B;?v~tV*a}G6|7Q+%I9@*Cd@g$5D&>uU=j5fBX->$p7&| zM$4|^3*1?-7{Q%o_0E=(aDI{*3{IERS%=CvqpjiL69$leSS3j{q9JN{&$ZYoU3Hjx zp4h$M_055Hm`Y@(1WI&~^oN z5}tj*v2HSa${V}QJqM=xNL1(NCnHs!RJ-fdO%$sQVRyCu*cZWDAg609&`GPD66F4$ zV{aE6+8_peV#@%!Ms zfi$9AciLv@?!Pf8NgNHe4yV772H+X_wGN6}^3E@WYvjnb;D^hi?|6=9=a<)zjqx++lh z$>&bsJ)rNbLu+;2g>(cBS7>k>;%ZsIAoOH0XjReaE2C)>F0XgDJuhhb z8tDpC9y&jFw~Xe1Qr|pxJlap8cOKhNLY1tSF7y#&>`U)B?Fe2-DaPvfrCJ^!f>)84 z>@BsiDh*$(Dz!;Mmm0p~O)LHC;z^;tPP(9?c*A{zbU#J5ri2ZZ*KNej!a3; zL;sllpmmM}$S{~F-%MZPoYYGVANz>=wF5ep{$Yl>J$IE3Q^wC5_x#pnYnp+Phx|&< z%f&&)05dSE25vsSf?yu&SG^p9=uR;S#Y5I6{0SKWmybX8I=W&vK6QKAo~`cRdni{! zwzOcWfQ_Fr5G5_zIVdAf6X6UlMH+x`D(Xh=-)#iVO95bNr48R8OkSyLfH#*Ue80J& z*M=V%SraWsF9NjQ@YbZ9=~d&8dQ=20H+RGdT(6q~u(ACfZxRZw-T|)pex-$;tn?9A z_(`b*8JXAX{;wY5gkmm%wLm3Mo5g(QSe!0?$Xp_1k3mW1#E(^(7x<+s&NHpOY41QA z&Tf%b?63zXrn(KObG}skm}sRCI1k`Yzg=LHqza(LSYW>SW7vzoHTAu9a?>*M@vic& zZ@J@Px@I29g>f4LoD6yk-}zZd)qV0ZYh^(_tM#2ZrolK6fOi-&gF^{g7-JG1nJ_P| zlL+1}poPPz8T?8i!ExXqEEU&j@VQpzJimTT`7ZOP?mbB=4cxek=Ow8SQzRGx70k0X zm@9|B^nT^NAs=IfW_&SzY$4V1y?@1`bO7fWnp4a7;PD`0o%7^KNT^hj=)wn3r5gHS z>FpIyrcEpZXFB^POH?}82g#q4pqpm|CpXD_KPi>aefaNH$;ZdmM3FZxh%b;zesWTZ zE|l-mhSxQUNcfTFC53=_Kk(1D3*IOWr9SXUKC5%j_abAd9Nj_>)t@sSQXEEae;~2# zZeEz2Da0{@JMBomg9(&ov#zk^Nz2WXfT%TMY@IW5lNsFcDC(lkXR_(TbwQLVuy7W| zc_+jy5K;3k0;c2}g3psoi=+Rkh8NC*A4!C0(YFexi|?II$c;&aOiVB~T3)d$`uRHK zZ#zGDjOeF>ndMwJ{-hS<#-F8B+bz8cAc4CtOjA@@sL+RXB`#OIj9OLz3ip?#1RBYj z@zgP&sUf?U)2tp&z$h0Yc!g;0#AxhdOk{%-+a>CnSZRz}Fi@VD?I#>)oblQtSq$aY zVk8%W1x)wNiPF{NvGudP%;U}~s8lW&RuV?1H`iz<6;kT>Wd7^JO}k+P<% zxgWF6qC7k0Kr;eYRx1M0n5{eD@uT&u`1SVP&R}D|@o}=T-IqCCj}nC=H)5H=tTvSX z`zAF&*UgU6_C_vC3Dj{UU+`K-@EQMDLt^(ym}Wmo`gQOl6Kl1ZP6+L99#YWcu@)VF z>q1dQ4FC4YZ>(5Et1TDl-0_D{F$Cc=H6#3Zp&YJzIGv!U`02=V8#C*~bt@b|ask=G zc*hM6f4UCE8OX~XhMu`Ht4l^pOii5h()9PcuanW~lon&%#C{{ATMpDHlq5~uS>5Jl z8{6gFq1^ooJG{xOt`iR3yX1YU)_wi4#?_Rp?H#Z^z<6Neym*8by8+hiDOovij&Ozt zL*JP9K3?TQ(Etsuvlbt`AV%`wsF_o;>^-@+?w@H9Ugy%p(8qtv;Q`8>D(DYHceZ!l z=z@BqQmc2Pc3`*Qx5!84m)ps{3Wt|>MYju*6Rm%DFG#mr?{&eWz7aKYDJGlaR6A_x5peS^+y{zsr!M%^GlgB(ug87> zd*yRe(47i;OEAjr^Ru^e!>(xibS5p0^aVs1H^s@(Mf_o4!V^bXXtTNQEJyfhv?;YU zIG}VRhiz^^1?ws4`wKLGOvu%ts>*UJ1TrSgz8eq~GnNSNF4-+8bLs9$q&c;WMqSwT z2jYd!`uFlA)8xYLO>CFV^~*cMH%|v92sztpqukGIgdUiRbq~Be$RW>CIJLKp>PoFHX!}dQW@r#EaeA|jE_#IyRB&^OSdC$&gMMK@nuF)Q5O{!5 zI!jU~S309-wb(;N+Yo*lb5+^%5%6DmCqmDc-vYi~X=j=`=`l!0)`a;AbaT;8`{(Cy z;(nveV7ZsqaQRL9M8D&8LFW32E%wd3vCr%=%QK=FSGC!>#HU>iqp{DH_Bh9e8){gN_a(d8D=u!0cFT1c%X-=ZSe z5y|V9O<*VeNA2NkyHxm2yvheitdKHk@vg|TN~&Ga|0?u3`#I@6FK#C~eA&`I4HN7% z<*!4=k|i|F+g59m_T1DBQc*j51Ma!2d^RzR)l431fO`GhqP={YX9o6u0DI~E!_qiv zEo}92*L|;&O3}Msp?cF^zd~nkfmdlsJB`Gp-}j;4SpC@rW_IL~2EvJNLRggheoY#f z&b%s&T?Pqu*e~lwt+$K*M~fN!hWz&ze+Ff0T?#lRiE#6PG)#!wtA*9TbE@8l{!7!o z7H`=(fikfd^<*plh*E;%j!I~|c!Yx;w(X4Eu!Lw2gSZukna1AOce;w7*VRNwWjHc2 zryu`s46hf(k+NesY2aCWu;7>7Ye(u^hskEp_yz^39O(6a#lHU`0h=t6f;{5%3)U0q z{_x8`CGP*4x&4O{9(Y`;Y%fI5=FX%gRoBdXZW0ZGa1`C}Izdkz-dL+@+x(i`KVhIF zf+sCMTvXTc%U%TzeEJR-`SNCmyGH^V)0DEuGL5n3i3={w+y=OAne&_2!ZA*vAFR!5 z-2*}%fEF9$_6=qr(BV#gN!tDyu{mwN%6dIc_`FrxBPdf|^>0-Gp<{5fLSL;W{y@l} zH2SqF*Wr@HLw&Ii?o_zLhkuRaP1ZW)mqj*=Ya;LOTj(^7Z1_7G6DOqJBV(8HZxZx7 zTOQ~S<=p=0C77G-hFx(8J6vaU})lB(`< zs-;(U1~TZL!FgOhi}}o9h#2MXLab$>2gv(+(4^lY8=41^--!3((CNggLKfxZ-zs6L zdwy`_`Qr~K$L*43t7x!pVW-X-#yB)iiqcXUHzRmXi{@ZGQmPNenfgf7P{+R-^j~ZL_>gJ&Z)BK$6X#smL6tN&BkBI3djj)4 z0&a#^yWNTVS%G^X)i03InX%x-evZRpOUr^X$*rT~rmH;pCZ+ITzcm>3?Y2(3RQHl| zD4o3488xgUT~4m^hqHCJP2C-9X(}WXA821RR&}-byybwuCEVcHhgCPEkw&s=UG$M? zOU09s(yk+r43ObWZ<0ot^jY@>iBW%qDQiC3fLj7#wH zO6|gmo1=5%+Adb|$lR{~?<($Y{#7vgEz2-S=SA2f(ZbvM^`+Ze!ZG(E>IZVR0f7TK zpLWene@W6j@ItU%hvJd7@eyyY9nmF%H(a)mpv^gMvcKzdH-A3%TAtmLr zx>%HM5>?hcCs$5gt@m#GBz}8WKy9g3df^j*alQMV@@-f4mQG3cS-UjN{1b=GQi`0C zHll@-myv@>euQbmKQ0Ah=FP5O`MXWmNtL;UUK@b=g|Ys08*@ zw3~bI`#1*7%tbLyJm_|G(_>kTf7*C>-L>;>`bUpAjZ5!jXVRyHDQlA-uH_OqS+&|* z55*OWepog{JyP%YP#;#ZYnAFKQzgbI;o}@4L>QEUha9BM}M^`zQb+u~)Q((FD)r-^!JRnG4zm-pzTx90#QC z5=>Nx+R?$NlXHidwX)W$d%{=)l{l9o^;~(#9wKq5AgJm0C36E`GVo4i{6Z14Pw-Cs zf`6;Lq#>)d_^Y~%gz)+V-|>)5B=vR>K03tuO%)21w=E;XhU&OAM} zNyhxQ#H8qqn=1{+6&usDqwb*$m#(NTXAShjf80wM5BCix2=EGfO!nNjrErvAhn-Rx zx#cX-QS|sLa|tl;QSW-E%c$H=js-YBSDZ=0l8BYe_S>^eHXcl4Sy}j{}`;nlbO@aSC?jUQI#N-I+j?#O<`u z42&67ur?Rr_PU!Jdk$$#2`Yb^s%j4_?F{5zug9LD9hn2>5}h`DP5);Xl9p`vo*~iM zRLRJ>qE&-Phq)W$M_EZW3Sjt#{1Y3IUI^W}9cV zA6Q7Lj{%pU-nF@biEQj_b6IT;-b*Y@VRo-H)L3(tMgD!EnA?SmZra)n^Uuzl^x%18 zz?2Z3MgsoQ2M@tq95w2lXO^^EWM7x)1D4YL`gBsF`ghZ0!}r$Nv(^>_my8d;Bkpox z&sXsD`ibs>z|loVvv#N0{x3Cggw%U)7I1Tm)tTYMpyve?f0y}2nr%xqD+8>$)+j^j zs#lu&`M&uHvvL=G;|vMVbktKz14+4t!P|%lt@ht&rDy0}A*wv@bZ{a>FJWL5iPttP z^Rh}zf+55mP8mbS?mvviki!+-U~k8s;TRgJ59&E>h;yk8jq%>c3K%BOF*CA(Tx}5) z??P3IoaKdO%}xm>3OH|iwv2pMIRRwSW~ZJbJ}t0V>i!wX#W)NM80ufWnL&vOtQ>Lm z-Bgw7Iv3@#H{bK5qs#bZ(BX`6PtCY%o*~fB7?8DNmPX$AHDEJFSUUcA`IQDgu<8cU zrfEjDZ8B>*s2>WZM)E%ZKjzwA>r*3h%B+Q|;$EA16XNNJ*)SFL^_ zG5rU|Ep!Y_z~82(W(`&!Ar827lBdCO5H+Sb)F~j5(_BpL%$%qAmz!U@fGX-g#a&lj zW~g=t`;?$j6xWPC)zTDL9{-Q0`t4F7>zr``oo^u;X=m061Oi#7Gk*yMWrKxN+5~Nd zD|;(aDonQicsKPR z#i}Mcxv&#``ybN5U}+!B&(Ji5<9F|N4f0{l7$T0(N=;;%n+HdsIUy-DB73%Sj>uWT zd1L$&nieR5($(7%LF*bFN;;F1aUwQoG$b3XBnZo-=YA2)EYMaV_fhgwCAbWhv;`b0 zR@pG%=b>(kA{S0^mPQbgRjwskSK1q6(Y)3hLj;tu+z@we`W-@mJH@XlBe|3X;4t>X zkyrjYDAKn!$Q7se-ay|LWS z5KP&1xKH#RuCDD$y;B8tmfprk*@8S?|-^pNiF;#dVwSWT7zu*M$O&$751p=T05e%lkLgUg(-?uf2P` zeMd{UVcu9r?5_Iz{3kmfvk#`LSI+{0>tk!5Y0{ORy5f(>MKy}7RAg$NxgwL7?QBDE zQL8F}H`dGinfm?<()%0w{MncCpO|T_XC>;XW$wO;KM$48gMT$t|F7}%(Oh-2>4hfY z4Q?|<_n-6V{(Bz3WTXQSLZdRN5>e$}a$wLlXYts74y^2P6<2KaGv1z>2b#ZQ<~IJW>H5&6*rmoLFTxn$ zH=A{av1FAO-8gw^sqz2ms125=4h3K&UK^AQDE92m}a3 z6bcwhBoN4gtX77gR!CS3GNphZh&Beo5*7=wkP0ILH3?x8#IOkwVt`0*a2coLhjymZ z_vL+f^X~TEJ@=mf{hfn&^@41aOr+XbzM#!bN@@`|Ce0{2DKufamZq}}ExMkFZxQKx ziZdd6Kkg4|GC)mde*QFifCT5uyHS*r4))i?MGY;rS-+@6m&g|Gc2%M}o)pEIGi;uy z?YlhbQ7Lc==z$oU_oM|&1lWW~ZN5~Sxa<|+MsIZaupGZH9&kq*nMPw1WN9p4LD2Q4t4XZi`=<*@O*Sppgn(zgDdNb$fw0*^_K~;37=x!>@_XI=!5-iJmhr@ zJCU)Qy>p+Tae5SxIP12?8`|ctn`Td5z2H#B@I%^HGz|qKLfurQq-i2H~dp^YjB=AFa)8S~Jgl-E9ESCrCQ zQ1JCqHR#&KyZz(a8!s zv>z*!0v~;dF}0O%$Zt=CL#gtzWvj+IG!!SRPS6*sOS1;$%QGi%q?|s&SdtuO&y1{( zdYo&pDz%hELb8@?mx;bzgo8*o|0cb|A{&nW0Bp&55Ve2wSuFQ>IOtF}L37+ffqY6xw^4e#$UBlcevl=J5t)Potr?Dtq@9h zVWu@#BX*l8_-i~eLw)8At4c+5<`^v1N>R5tlWW`7dr+@bas)-w%7!%cP^}*I?-`Rc zbDhn!(BuY^J9XwyHHG{N{^cz+TV^^I63rjM1cc%6VoZ4;s6mfzN8+K=%UzB2TLoSi zf-pSjw0gVVo`;));fcNvq@8Ti6v=wQ{IK=nND`;%+^_zS*~P<<(D;l_&$ES75zsy(%ln!%=w%|`?9EvQsi{}P`o<`IqG zHb!y_%)OQrrxlAJ(0S1%PJwogt7_mD+g2Le>`x+!jYLL5aft3YtRGFW0sI-YQ^OTd zctl?-F4Mj})dsR92BUeY3miis+HM+kFEC)dG*@zg2Ty01VBca(UzT>T<46tMx#ZT` z=ivd~OwY=S`aw8DMq(6h8PCO`fFLw_uPN}YThYOkd$*%3yLbDnLiZL#F3~ufyBBXO zjs(_JS0xRht@n8?!5=MXO>Muhk75-*2 zSs$~hT?UfxfuajBOveC?kljN%$Ovq8r_k-YHCiF1A(w2@Lek77&MkoO>G!n40Y~FM z{!S}=AH>>tAMvK#AQI6KTGTjVO}~NK-r?G>rxOdgf)Q_$5o}lEBG6#|poAt2yyIJDJ%!fR$8^i2){fC%`0R>}cp< zZs%lfYXgP`L-ZZ6!+zKWZSCA0%uUUlz{-)vH~}l-e^v)${f}F}Ihk74)@>S=8lF|`oOIYV2xdM(SRBH!>p?BU}J7$3f6^p5DeJ9 z{NLxD9Sn`ZZr}Y+|96|9t+lnWjT6}2SW+iogZj8l$=u1x7_9hwh71hs8<@Bdzmi+} z-*)qOlEK8xNBsMcCe6x3^+e^wda%zw!Niy&iPNkVBn^Dc;#22H-=}b1iKNJEkv)R;EUzgYXXS1pQ87_~fkemMR5@13L3hH9{-^Fx# zX2{C_?{fh;M0Wp;@bO79c!Xb;{~Lo{-wayo{~bQN8%9uY>*GQHJwOH<7ku%5kFx9e z|NT+d%2->Y0rz2)*yxZ(K^>*wL&-X{vBMn7^-q2K1I*m5pUlo$`v@KSMofSG%!O8X zD|qUkV~n}hd?C2^TruanMavhxK*!=UzD3c5pd{1{NgeN?9&3nCIP-Kno_?NNg!X#G zc%Za{Eq!qI2k&^HEyZ^J`LkMAzoessT^SM)Mac41fCbv3S>vJ969FZa*w)!$amz`t zWW5Hwu;ZIe4kuI7VoGL$lUTy#B$|$C9kDn8WlJG8dUVN=KR8tMV8G%x^xnTrOwTP0 z^(ruvX%dfX^T(+w1sNoavmlwMY)+pUdh98=FhOq7!c}|BtfVh|RNV15xZHk&J4GuJ z)oucW`C{sMe~Pw7Um@p+-} ziwak{s#E^SXNpJ9AU7TUQWV~TPw-Y)=2FV*xjAXz!^7>b=%zl|HDqa+A5^7TJo!uR z0qI|I^b6ePL~gdXsceFmBay1nz5o^rX0Q(1&F!Tkaz?`@=hpbAkaB6|dEoBi;6FJ* znn{f+TMjjHAzXF){^i^`%!ieoyes$T;Hi~FM*i$^eRC^AMNEpACK!^$Yfg4Z)jR!z z-N1ops&i`Da9t3s8!m+B3Xk&h8+;mm2{xbgDij&2VpX(5!pz!McuxtjUDv-=oeGGw zdNCF=J7T%W3XRsHde$FFbD}0LGh*1JA~U_aM}0~fx+)ZU3T%}!32Z!d-e);z-mu*< z*Zn8-`thkn3b{&(vC0*9X;yn=MdgX4to^f6wW9H|zGlNkg4tGu+`st$EK&T%)tJ`_%v{neA;mw2+Rm>A6SJANG3B#)8H^Jmd3k4Gw4irT;m*Y#Md!|O(h z#p#MOs^5OjakwliX_eui2HXGqYc%#O>aESbi0!p9YwPBqyF8XLuCj_FP5DG<1+{B{t zI1VhI^2AB07`1$M8LQm#q;@3~LdOKKkwaUs#AdCT*(*aJbc8t*eyAZXtB{4wmdhBQ zU=B7t4vK>a8>uUiGql+iPm12*>4QZdpYBb!<#9(*mnE%>Og)NCWfYcmI>C~IhAayE z+SJ!?LJX9~If>T&dQU$?yPVM?=toS=Y0yxhw>K~m0L{nIf>22 z-5%BDwOfn3zD|GPi5&e({D&YyUV}ZGedmX>7yeZ`GHprx;UxI7x}CBqV591As=`<)lYT5p_jD`{;#i<70soP0jYFSy0djn8Uk$1TqmG+|-v5Yom` z$kOt}&T;klLOlT?>Rz8hv0Y41QqgfMKbb-%6z?cB!nS;4SBzZJV>LIPChr`fL_7nd zo4KsyIjCD}WZmF&`!wHP$BWk|bt)rY74g1*ZsHqoB`P+yA%5RNeLElKGldT|sp%%wc(m;+1=_Oo}_x%1`x^xpxOKg|ZoZ z9ln#~sE+(KvZX(&Vv{(Ba}pg4HiQlh(Z+JV51N4DdG1eXWE7FWUaBSL{$wMeQK&x& zeySBswVU4Rq?SF8!d;f`5eiKT87Yy%keV&w?u5L^cfzEDXfRn#RoH*PLxbdqKmUs0 zppahO;g=Lv>XnjVz&u3wj2Ukn;k`sx9fM+0yrMRsQBZhn3#y*`Eak;<*#8@*`d0p5 zStFAubs9sY#jURMagl-eqAqTB9r0;EcBo99@a>djHk{K>Aye4-El6T0Z<|YQyHe=% z(xk8IM+e*leF+x7M5#Jcp~z5#<-ZYw#G5LVF?6G922v<;58A63b^7)-!b_aJ#Mj9> z=Q))J$V+?LBc*Nlydq{H$>{I=8nBj<1A6+@L$cb*MffvzGUC)E<8a$l2i$+%OO$2k z31LSHgneDGb+Q5i8E3U;9qq6qr+;^ti3LykmXzVQWS zC}hh}M+iY7hIlVGq`tUMt88B~$)ksQ5G>l1-N6kb{YLCJ!y2B${hc=~s*0+r+7RPh zYh0TwBV$*9nwp_le85^H4q}j-GiV`>gu;MEr~47ya^!E-Mm$9SH!<&0#Mp1^7@yfM zAaInsSM?5VbBM?t_=Uyg+J2&iGeME@V|eh~Z&S;6EHctt zB+g(JMnay6ZgOoi(ZKBT+HfyEKSZ94(^Wt;+4t?xf5|J{z79 z|6Wz7*U=P`+|L7dyx19BHI@$sauc`v;m4bzVOOtP!cC9X$lCp)`_;&`Q=$n3CL4Q4 z3S$oI;+gx75(@jFVK5pO2#s@n#PrV0bPb9OVqvAI)TZ`ir8cHzH&EfLifSq9EU&V> zs)9f}6UrQxT3St0UEgE4sk(N0FIO}Jt5-*{YLbRUIcEWV{q?*g70bn)o4S{pd}FDM z^si#P=s{dw${5^Ux$R_697F4y6OUv#M;M&2RFGk@1d6i@MtA79-#;xA^S_f@glw_I z^g~hzu3H%Y#vFmRKz)K2Et#4>QLl2ciZ?U(r$9PDDJ}zDgvb4a`k8J!MKC*BKaU>Y zs==+MdXSxN33ZfoOBz;@hM-DNj-{5l_Zgff{=nm~8_xXq&tF&UgN4>YsOeOfyWk?Y z(CVmTbAhf~k_9UP&;9O%Q3YYxf(8f!l$3_0Q>3xi^!Nwgg5yw}s)3&63HS$QUAky*f;$IWjNn$35Iak)jF5n-etBh$@ z&|~uFgE1L#>Wz;f)1r!{JL*Z1n{1e6?nhnUou z@;e0mqdejPDe_!I_BneORv1oXwM;CxiUoW`3b~@Orn!_V2{tva$1(+WRreTq>~Hrr zI(mh^Kal#TO92*4^(3 zcMrJ-{oVlyvwU~jBteLXOC*2T5+o;?WHb0f%udDrRX;rrmmj3xwmKNX7hN-_C? zif0wBNO#UpmZnimfRSy#?E{8IJDY6S* zz|5pM)MtTN(w7C|(S(H1rKlGl@lMKXB9G=ad_`Czm%j54X0! z=C>Ai+l$t1YMYwG;y~Dje-;RcEktR!REqCI3Pu?1xnN{YVr7<&^mK@Eb=p5sg^7^- zRTMyPtA_s-3^C|Gj&g=hTV7|b-n;Q*dHL(~1oZ+r`sZ**oc4zPm~SGIHHtIzh9UMZ z(=CTu)YUThyVBxo&ZjHQr|=OiOk2nBQa^O)4MDy^(89Bg+P{BsQT z?Ni|nC;zO$kz5P?qUwMSNbMjl@YNdbmH1>!e8*7jf(H|i-b02h{W(-X$1AT~iL$&K zg}IM+sxiqQWUPxIysV=0Elwm4ZTAm9!wE8>j#T?-s->$M*Cwg-c6UZPS=#EDvu1e( z9sM;-Gywwp(S@RPD8;aMoLZYl1ndGSyE8jmE;+iSNL-=XF1Z~2ncN*Ed}mVi0rQ&O z!xXCy!$Q()MU0raU1JRCKAf7Nfc4ZCntdts+T3$3Lw>$n4_>26hVHC>x>6t2VY;cQ zY4B>JZEa(tDgtKSbc{+_f5EM@%4BB2;^}9M%5-zKvZ)M^QjowjrEoJ#kV_H+Wtap` zs8ccWRJ8Pu_u)f42+ywZb|Tx?s^_us0NI`nJ?@J`w=Z+4^&|G$^^f$rCEhLhD} zUce=JQf#)Q*VI71Q)L{s%V#l}u4uLBE%Vx0@vQaiY1XZ3YgAxPa189q7i1Qwhr6^! z-bZm|$F(A(IvIyZD;383}dv(1r{1ZzaSa-#wCd zI_1jE?9vNZ46P$s0k6ECefF$bn?^8y#b6Bnc7>)~#+=AOLyUT z^#&s~`M&e^ZpX+}g;xiyw|j>Xo2DP4pESE&5m%H8%cEyQD$_nCe(kjw@X8LRbOGh$EJb!1+)FD@dy7H7(J0)Ev;nmgsk-x320~K#?E)r-qLd@7gkkd>bRRX zh>XLjLa&_>cW;ctIPnR7LW9Y&SeM>IBx6i@lcETRA_#wyd~6xs$2Irg4MQ`E1I=YV zJ83*K_iY!bI!d3hdx(O|ALYvilj|M#X|jsiS;5knooBX{t^0s?G)vD+uHAWrF#Osk zc5Q8%VZ@Y;W*cR1&dizm!bD+;($Y%snRS1egUg1ad-qJeIX%VT7zV1=pdVj46e+vE z9-i6uF}+HcBn}lFY1HCOv@F#o+bzK%9Eea6{!6|omb&z|1JtYWXt$RDo3cvz;8Bb+ z)6SYhT0LCZ7+nJnyaOw1!}9uS-lBDFP0Np>^?r=ZbsGKWVOI4ddlU1h=0FY?2e-os z+Ao1}2{n1YAuDzohVtK)b)Sg+iU*O$HcAomL^lI(d5gR4MVwedWO0}}S`a$Kfc%jx z_D%JbKTEUG#{Tg9YsY>2MRkosln}M>c9ZKnVl)BI&P;(M*vkQ1=l0X>>Az?1iA
BD#1D&X*}Q?Zb>!pYqafl{sm7y;u%otj zVSdP#1YhifH#6?^u~Xqf|86N|ufAMz9H_e)8G=fBR(77ZT1q`BrxYFvV&%-mSxUJg z>QNnf=O!q`jvm|Y{ao8-vtxW>0Y6Hb`#r}L^d_03X{Q_xTR3&fq~{vnQM_KzoY`{xJAI{%ZITW%dR7--c?D_1pF+p zNWZ5zOqzjt)@9t-ElzW_O3c_?UH(wl3b2Q5)zGWR$R$g>YkIFa`4@aUto@xV1|Q%jfN!2Fkl&T_)DSK)5o=W%2S0Tp7G5 z4&k~ZK0KUOtfRS{UM;JtCk{n}fjt-L;D@yTj+_Fg z*|#$>&PyGR4U&^}wSKfuZTfrJ1m3$Msi|x1jXa@NRO)N$Ro3^dE(Tj!og2;u)XgH2 zp7-PoB%EkI`iYmYdi==60MT9a-_5NrZ9(!o#l_`EyplH%*-gR~g>}J57z9L~S#P}b zr@dS!cN(}hPIf-k^5rd_*_{p`yq#3N*)}vbKDxf2Z(i*Uqxn4a64un#3RW%do;7Zo z0EvO`{f19e=t1`Vn6J9MeZ2Gi{yo$2aN^US`ucv~2c-93I#q+6uZ{0X{r$pWx!L5f zHPmI$8X#R~RHgg&(lT>#ocI!(jc^b>=i0po57@vigRuP6@!YE~qM?d@8CpjZcU+@d zP?HTaZmjV#LwX5CM37)Zrd3UCy|g^~zqkMus$L@s!11i647hQtYa2&5-afUQh?jp> zH5uoo44z`(=lLgeiBTpWujda(tJDWZ&@D^(U?EP!Eb^}lR>^9Cg>dBF6lO%(Zd(<< zFrT3Ne$;(w{j|2VQ?kdp8>Pb5QDh+3Q0_3F%)S6tpW>& zOli&r+I;VWC#pS7If8jDI#rSos#LQSbo>`m`$K~XWfHd?^*PARrNnxSungY&tiRO^ zL$P(^1C=wJizeO${dWzA=Rt>g()vDoOV=YSiS9EXLr>Gb8HZq%#cLzeF+mK1bNI*g zc55-TIgab;Pn#N=y;HO>PSU1vaVcSgK_Ja71Qo@VA8=yI)f>T~kcIy=(P@-vC=x3# zRU>jPqx5-6<%y(GHA0Cdx3}|9{LdJYCnjpWSV;&eZLHMP)Ip<+HXW}h&#&4Ox>}~U zW9kDL3GNI-yjHwx#&vuLf3Hzb*9nr7R?6?;cacX^YaL-Sg#L8=NY`tFNMziN{7lhX zEW{^(9svib_H`oSN@OI|c-CyL5iNk6CYb>PkDCt&XGJF{@mp=CmX_gZjW$;|S)Id3 zZ+l;yTE7zTdJV0&-dC#}-FmFGxuae1@I7=RJ;d`pqHTEHNN;#v@N9UT(&)Hte}?k^ zMCf(->7wlhaj{YxNPXAcUkL3^7icE3_@eJSh;{tCf3~__?4%pIyK_JeQ~QBt;ddikBsjTD4KY7o;TllH=h<7-5xH9Iv>Yvkx?qOTL7_U6GR+!-mJ~6wQEe@Oal&$p`gyxRmyhvC*jz5QgPu-LvmEdzeC5f za`$L(A=BF)Ln= z@$rp+mTgIA2{&5U4rj>o`m%<77z|xO5m%g0YT(THi6y=^yhMtT7!sU<$kQZZEd?61 zp%)H$>JP5^4aA7IC_majkKQFF_%ptldVl2+gEn3BVBjt$`uw71e$ynylU9p&^06Rb zY|rWf3)>-rt-Rvy;b33b;S1qo`pqZ~6&#K`uZTSA>Cj)^iVbeKb=t$Vlt&{WyaEjK zvZOQWsF*{2=si9BDOe(Dvo95Lcl0iJ{=x;C6KElItXfxQNh+TXVZ*k6>OiS;k(g_y zcfECoe7R>kG74JMIo}@4)ZbJ@hq9!eFt$2l_mCVJaVL^S7=Ui|{9d`~)N0q9HTx)x(wH!Qr9%RX^79%F539dMmfbzYriY1{3-W6-Xw# zz1}WT&F0l7O`G*;+O~i0y6=4V20~$@%{sBP;>RAD^nG(wQBi4f*oQ?T;NBXD#QQJz z-<_?pA09bzzMQCb?tFyV0n4iP4<9zK*N7N2-0*p}etW8V|DBQX^=+B&*)#;Y^J%{7 zVH?R8y6fqQbN4D`^X;zjWqtGYE3hR5l!tH9Ef*{8FE)7Ic70!>-7eI1bOtme8&~&N z>MdV(usXLIJ6~zOeECvdQ89gb%kFvix0)$SWUo>$;c!ow|F`j&vqw2K&31cD0p1aP zussUY)i!oA)>I`$j=dgt=KM4E*pr*EgHb8yPQF{QnAnZ}x$%WSnCg=k%8a3MdUvnc z7Pb}ApWSpUl>@a-kEr!mTDEf@qdM0vT0|y->Lu~vVeI?Cd~_C0ma9d|jC_m0D)&Km zMJlWGHDr^8fiWnUm#h}0xe zn1&Ig#{45K;=l9*7zIX-aj@lve3IkX~gEP3#<5kVn+|d7aCvfU>DOv ziij)|AT+(X#WP{8lvhA|nhcFU3+iaM3`xEpft$J{UpDl+eBzQhGQl)W;Nd0}KO*ay z;tKO7k?m4nLR%V3Bro6RF_%mk;jEOe<-K)eOss4=!Zk}JlhFI5=^qdAss6zL zeuqA5CbFozs289gPZGbac_t+#JpkUoNWit>ec|1wp~ZVJQ{XI;M}&ummv27ucymZK zYmj72O+&*#5KX0UJ0rQ`id6YOEdX8hpFdrm7wxJj^~pLOp+H8DJ>+oDG^{Y@CUAUz z^9FoTO-pNUqurC+?eb^szSYp$hg03|_+#btPe;et$)h`R?<*JHU#m0yw%rkfV5)E!8Y*h1)pFc$+X8Bu z$?7%B?+bGOTBwaN#nCuTlieo<}zE94Y=i zb96UG;bEFQ?>M~L^=?2E`Fn1f{rP@wYC@qV$8`6K6bA=uP}1pu$pxL@f?dQP{|d@d zLC$~HZZM24i;kg~PLP!%B$;v|(?f7a+AI%>47bt=m7amz(NR1LP6p$bBx*SJs2%;@ zR`#TpZPdgv2k*<#_clt~wl`eMGAeF2J0we*-WmMH&dy0Q<{e^aImzx zx_iApn$F{y^!~{APL?+v!nWb&59HW}h6ZfJV8srbbsH>8nrMJzn8@I=vbMe&p{n{* zQ_}| zbv?fIz?k+tt6x;p(AWV+WIt?jI!4`mJ$GGRTQf2=^xw7v@F%Tihd^7On>4TI)y>L; zzV>z=0&ce-aiFou$#@V(F|LRka(~z}T4i+Q&1{1%aGi{6C`ZN$b@3SgQ zpx*9p)}`4GQsacXabprK`uw=$kF6kI$293>GMo*&M3osgL_TdVZOT5Z zlwpJ_0$MN@kf<*d<}dxmKp{9jLXB(U9TbWbQ`ocL?|z_j%;+RxDRbmRZGhm9uj8Sg zm=VZv88n}mU}MtV+wXX2W-JirG8M@2gB+ctX>PWQFLY`HL< zdgsOxtyGC3S66DI11k7~G!*w+tyAsxESR@&Jf0!3+4TIufLq?G#@THs3?rKNa zX1zsOIslBaziRWs(ax^x;DFRU(-F83!LZipn??BkFsRk;k$7`BIeU8BYp4?iN^O!$jc`pR8=Sa~4nZ+88%a{?s)MJ*~K_B&mu?xj_n0g8Zxc zCArM~#kBR|!hUb{2PDXiQL1#C{^6BWG>tA`K_!{Rlt~i+NNs{WE#&x>b@7=SZiIXD zBuHPb&@Zzhim)Q4Od*m**v3Mx15Iy7d5lw}~8m0{#$HBR7~3*MzIcf!Vs z5r2?ctv0;MU1rN)E|pp{MkD!gkh9O73NAw~<)=bqOKcB!P-b_7*$pyhGNWN!+1!8I z)s7q6@eUfMe&#j&!!%HUGprT7-3|8chLw7+N7KR=1TuEi75u@ynTxFnB`ibqwN2b@ z?!M{F`r1BfoHN3)e+iNWM#ehD$Y6vTZzFjk3iC3=LkNNh6LK2)q46q(a~b-A%$_pw z%WE6QGcGp*(0>b4Q&ZcW6<8MIF3@QkBzQjg^PZlbnlT)Vr81>+xkdq9^M?E3*A4Ic z|3DTvy0)&Yx8tm9AfjCY{rE>;^pQQ6YfT?(`JS18lzKRkk+*qqb5d4SQ&R&TfTMJC zbJKR&1K0L^-U@VB@j%t-+WD;gvHUmVY|TEeoInyz=Wq&j{?3{dkzQ=)w0uUu2 z@m6)daZYdms3tOWdVSLCt2Zkv>(cV_Ht=#!`wO0?@hHd^vC$i%ptdJ5E#c?nAmPo4Gj3T7u38|hS^2{v`Xa!n?KB6{sb-bRR zkj_=UejH;pP?NSaD>{sM22e@y*#sa>1OBwSy88F;-xv^#rKKe>nv07I&^Z~i|Xsz8dnM^iw%BE3WTiX~2tAIlSZWHVnHJVJv#K$)o?fYWr z^Lna#6KU(^f8lk=1^Ac!-QVTXjkL5hz@veZSWQQ#aPjnOD>89+UEwdIVgrZCw*ySJ zjrWkVNV1f*SoP7JHSW{J%IYQ`BGA#DvDoU|j zuawIEGedrY&iDS)uGZs1_-Q%aq`ch3N`P#+ZbT1ZM{up=nJ%_Y0sOc;rF|c|aza61 zN(S@5Azgc}L>y{^IOPaxiD^b#KTaJ{li1MNH)ADE?Bd;b?^7(Jc8-q688$WX)qMKI zcV!8>t|$9~f28>I;MCTfdv5q)dQ=d`3JZ=$aM$t^0H5AHYNO}i|6G{u??bdg~1v7>)y3TU0eP4SG-?Hv6><1}!Hy8yu(c|VUjQojJ zf2S7Ic^>YfnE(D(`rs9SBHNm%fNp3fKy}Q>jlC;>fO&9?1hvreqlY zQwG}=lRG>(KbMc+etvS(P?@ng6iii-eOG**EX+1&;ca=t zKjJ}QME4TDKymB;MQp*q**vw`MZ^M}zqp38SOpYSQx}_#+3|y3O|6aIHbcrtaMAse!?(5n;9Yehkh++EExkIlf=<)UT?q|RpIA8sz5r(EM&b9 zD&6=9;XXJ@mxq1peRXYDUk3~(RK%D$W_fC%(87_%FszAqFa##vaZX>Z978L1SDBvl zyK7ijOoPI;{X~;pzPiM3lBV3Tqi;~(3kcKhjl_dEg~P$q)TB(XTOiWW#l-d6Z`dI% zN4GY4^G9HFbfv!8(H7^2{*;D4w4Qjs3O;g^|4bnvy^N z{D14qn1hQ3fh0Aw3T!D@S;Z8gd{_(5xt8TkUC3dM6YMNjM9sC1Fh`X)nb`zY9rw?N z`0F-}3bzpqKa$mm57u`;zThc#VTpkFV?L|K&53b7dE z^kIpBog2hU3do))323sGguB7VhsTM8ZEy`*%I~F3Is@%Jd$|bpTY=}1juFq{{-VOG za=2wII3SHh9_RjEZGszRNU6c%*x*oTqJw;m-3U&Bb1>39wZnO;2Y(*~De8t6MRrog z8v47`3}koZNq-^bP()PaQnZ_EJnnMzOYf!2vJQJB9`brb0n#* z;aD|Oqz`VyTx{9*{uxR%i`@hR-w?uRF{v=~dI7m<59Xj56-?!}BNOj6^rjYH9R;l7 zY=te-&gpeKS4%&E|l@PS0j~~zt1Gs-_!>wXMfolgA zES=Ax%NDMF?cve)a{p@K%xoN3YRtseJzJ>?YFE51`Yps=zbk*AcmfK5gQWdC5=<+d zO=dUUQ_5p}(z6IzofS5jI_h)RwHVP$@h( zG1GTTp~$|H)J*(`E2ujbtL5I5bGeffx&3PfWA18p@%nN!$Tl@CwSGQrM>7-a;(8z z%J|Ow;&$2ER5$e0*>|Pkwx+da%HUgK=yQ*~#~Us;UV=te9xik`*#9Z;=Sz#k%{_5* zVdgw_OKf8Q2zR!`m-gT=#4qQSHswOsl31sDtS7sac{uDlByf1x@$wd<0a^`tZF5ri z;UmGqSs3w9m_0=a@P}qN40B_SH0Oq^69#_7oFsjs!igCtk6m>Y_R+N+3JchThnYs} zq;lW2KyL}nkRK=9CC~`eZXF^2xk38$U4@CvH3OQ5qHgGyK*(Hp*LPs=(l%y&7vWlCQ;<6WZ znedJAD$YFd?Zqh4NSOA^q4=vGC=-HdW+w%aK~y)1!N*g$S)U1{_*34?6opYAAn}|c zX$L=XLETlzHD1g^`4ohaQ?oSJg)x~r3Cu))Q>>k$sF7b45|EKi1TO%+*F#8|9Ek|G zQs+TBFi&Iq|6=GjXyb3AFx;jH5iF0xRisqpckUeqY1q5R)(TY@j4uv^bSd7Zkw~K4 zrum96m5VK+Kq3l;G-#1o$`4kYHph0&%cy&2(atInmM1J`;$E9Zr+P`-Ha?Bbi!GcS%-s`?V{v6NQ|GNT*D{Q|&errw~Y8%us;OQk$TUi}qWI zObXR1lfXct_!z77ca3p=L#K?jA5ExA$+>ykq~+jmmRp&|L!$%A0t41%-zRoO1b%pl zYi8_n(tYN2u`O<*Z<^oy!*a-#OFW8W?ZV=Ol1LOPC?YXpXI3trCT8i1<7X_*9PN#{ z`ky5A>Zj4#MP3XjVKRt4S$bTL(mO0zKDQw)Ql(F*45nD2jKAJqv$2bl7xjG$pdRah zAD-O`9|TH_V0ufK;{LBsEe5RcA*DViF`z-5dFnwmzU;2uHmKn9->LI*czM}{CiZ^^ zqKeF^&>U4C>*0I#Lmyela+o5-Qo%NM^B>y&A@pVQQuIEb5OvlJRpj6CB(X10pzF%- zUZD;NEfo`78lDsrLCW>yZ5l>qnIu|DK@`-lNOUk5LAdhgnjr zrQMTZ!%t(r6mZ_hN+IZ#kS>j{fA?dVegn=BF0ZB@HQQLSKxx!Ef)P_RYA_})E=WO) z`zGJIXp~;v1HBI4s4NJXCM)MUh*G+Ya$EVET0I$LrHmO(Vd=%5pX{vR_l|`g=Tfcd z2azg{Zh(x?fIB`*JAGWUql8&gI=pKZt&aC^Il=T@eBIuHjAy4g#p?Nq7N1QeAunSC zEx%dB6;EGG&yq(=aM5?mm8<;llxBCweg4lt{W-oH>LTjpcsHk#7X4Uk?mzq$R+S-M!q2A`?7*i&&eA1R37#)6CJ; zt?kjs@@*HU^c{ZBzovwdu2(hYpq(_e=77+k^lwOlO@zfJJkdmc*>ivog2a&2-Y@56 zwUn38ZgE{oE1oeryDIv|Sv4VQykN@|hpjKlJhA;ihc z;FME`Xu4B}-5JuR)UeF?51C`%n^WOl+4BsXm2?if_6Tdwnyuf8x^e z=^V0Li4G%!xr$LmTZqO?d0uFE!awKShW;HH_~BqUx&j0DrfR-V^TKh*EsHdfu?6Da zSk%wp6@vhVDi>u4xyK2gi3P-KJ#Y{^&Re^^o#U)RmO-8Ty<`49&h%Jd)cVAz)+c=K zc3ifvcCBsjA(c1EO(Xj*&uT1!yYx^|w+8++@H{R5tQ1W_s^y>A2PJCa zI~?dKJoC}|YP9Fly1I?ehN}#iKet6X&AqZaN-+fUpcV}mClpS2oEevrAkJ1ChJR1n zS6`JV9CcNqD;KRuSwF|oVV9l0yleipe{=r`lRk*%Zz_oay~>Jz-keQjr)UPfCO%NR zF+!$m?#0eylT!DB$7rsd@<}7Rx^Tp!!{JH#!LQfi7GIRJX{}BuUG$Mt zt~5GL$>TTk-tX$Fm?KBZc@Lt0bem89e0uu!S5y=?=0HZlWq!aVnsl_;Z0WaSPj8bZ)Ysr; z@j*lASa<*-6nEEd*Vg5Q$f18;)bU9T?C)2oF1t|fpl8L}Y5wn6qgUj|$pwL;S^cw~ z&k+of-(7+8j2&{=D4E1i#;tZ`3W0ePKl8D1-Na?GQ8@>YPKjxW??5k@V}FlTj2wO(}@_~ zJgq*<#6@#aOfeH2rMh}xZg0^=A#gqV&3KAEK%U>aro)tW#2?IX_Kn8&LDgA@^BQaV@ znaXj|jk|J41mh_O1d9E+=N?rWXN-ev0>N?kXThMNpF>n0J>Og-1456R0Ak9b9x=l= z$xN8|Kuhdek*@JR^FP$yNS(EQQjb1+-9{1p^8j`Yb+2c%W2Hsb@=b|_a%V0%a_mV{ zHU8~d#g%KH)z_e2B7l-L0H~%bw}{dj0IdZ`R7pumWo;7}Ybh#|Gf>|D9ZF@#y$W2y z_NPPZQ3h3_yk}7Xl!qg*5}yp0*Vp$4#!u6=wfA2hZ$hd8r9n4;7Vs{Os|A3RwYhn? zLbGvcW212P*bYF37Zw-A;{vYS#>UgwI2;e)%gV|yKH(t-e_$a1DF?80awwI-NQ4fr zPXM=vk|7h!EUm7tzTFcDrz}yXz5}jQQc3I{4iXfioWTrL0cG0bNDU1G^9G&h80FKc z`zXE+j1(D(fQg0G?Dfc~o}>&SP5MrpL^E0wW+z-@R#C8emRqW50#GM4Ev<@kbPnqdixX%6UzG~ z(tFnzLa(ko(P%X_wd{Eddw{j{`IkrdA!Dl4X_o+`aKKk`-Ske*diz)O&w~eGFa3HC zClD_>o@w7-JKtU34s73oJ|IgZz87Rec)HFPhXRF97@;8t!w>7&iY1ETaoK<-&OhuD z$FOw2_IdCR>J@kF&rs+OhTiu5&h~Nr!bh}m)!5s+U15Y+oq0eCrRQPzrj1iY`)fEM ziatBO!_9$orEcfM+8RE9!v4LuxM|&djq>-008q8ZNr2wE*(H2Wx!?570@#5VW1P{^ z(U+&i&VybgzCB=x$HvE%55Gil>vnDeurHTZr%%TCxOB@pEihPw$aexhpD{gpFhB6+ zGZ!kBdK*OE;SR?QPhPKgZ>7Zkf&w({WMEg~%Z5Nd1NxI-L7g_2NS&%L0n`J^EqsaM z6Ps04izBLGiUnOHEXpU_y{q4=@g4i00LH=NRbaA!o|J& zzatc2Zm8+#Zh+9?-S{a|yuY0R0EhC;1BZ=WETqz(|0$^K69$6BDz^ zeisT*O&HkQ$9{0+F0BZVH|GFNbJ2cJ04xU}LrMiU?%8T1Rh;MH#8&`M{}5ZaUv7N@ z`0DMQ{_qb--tB@S3_OMPabWZ6w@7YFYwIW=q|BR!M#%xlqr!vrb!`B12T;q(xvmxu zjxr6_|BkPl3O_n%L!p@q1o7zt@+#Ac3LQvD{q*RModM8FZEk0{z%vd2dB_KekeG-8 z5CiKr$-Ymr?-agIMZOZP>j#~0i|-?8wjIL&><&x{v$Xrm1H=9K`ffq8jsg2-vd{mt z0QA^@nwvTHvkFTAf4f?-tg;6PGT_?`V0XN~Ueq=;3;-nQO0VnfiA2a@;d#SHy0oK9odJpDf9soz!r+eF>TUuJ$vIVxB8!$hc zfVkx`kMHR_unnldU4fPNdD$g&1Y#VmR#VscIjw5t%lpSaE5KV!E%eTa$8*WPqr_C# z0?8-UFW2-}dknZZ-M6hrr93k78NLa>=R~DM9bMs_g@i_#Yc{l=EjEBG3&ico!s{Ud zX_6f`kW$HFf8-1iD-)}iJ2HfUp*E*Wfu*``Oma-teyC}h0gb_jdr?zwxf6)TeYhg; z^IxV9S+4!T7!L2_9vWpL?7l_vKRX|KiO~=llKp#A#J0 zVm^4~5xj_epB?+y^8!Udu@dFj*qGgR&u837sBsg3q7kiH%+shi(4Pf~4=5O;uQ!3j zp?m2s2+0dT(BP%>l=|2TRf|AO1%fkbkbZ|ZT2cmj5N3G4fjer%PYCN$_9X&}P23`h zE`E(E9dhY*`9pv)pR-^ADCsV&EZ+%WXE-{Vzn4iA2*iN^`^Y|HyAGXnR7;%@x-fv0 z0}#DxrPlU`*aG-Alf2InK#YHR;ZCO2Hqh7CKLPtPD?9G2?a@xq32@~fac=PKjkn`s z_nFspGIRe!Bm~esa9FeeSpNv@t`e29556Fc%~qj8rDWdXWuMM>`(QlngVhH%IN(el zvOa*Rdgz$6WB-5Hdh4jFqHb?k5RsBDk?s;{4&B`$0us_8(jnd5-QB5lhop2$cO%^( zAn!Up_xbMq;~PWAP|i7f@3YoibI$dP1(Z_<_e3Fsvu?Y>ZE0zNYMpYlnb_Fax>MLp zf$E46&<#>-f2^&n&bO2F>;Nm8IzkN!P{F)qbz|etzCH=!zbM_&dXK+9K&4T+vj^+< z0-#WX1TkgCem?%CPOCtx0uv49*-?nv-+a%MG@(_~(V>VA2Ur#mJ&*HfFbx- zub^`UXc^B_KN6eGzKEsAW+3N(0vfQv>uXMAWaI~+e}vAfixrT}A4AowOjsT_)Ue#Y;>f0;@il{H?C-5*N4{I->#Ijw}aNXzG+YxKe z?l!lZuUEf5TzEPjIi;zW1)SXX*bal60g_z1*#U9&2IwhWygEn`fPBKh+#Hb%4sKR6z|M*qk$M`oIy&{ibUAY?30_;axyi7D(iP`2tlQk4akyLAXS1L-4Wa zsV9NqL!;}J1+hZpW-_ny@hQ-^WPn1BfU?&_P@NRpnXbcOmR=m1(l_Jb12(1?OAa8NCPY$sZ!8dM6< zCxS!@CmbDgBPYmA23M!`cC35GjQuMpnoto#gY_!B%51srw_S6oXCTpmMkZc{3WVat zUmXx$^YfbEhoEhQiW=O3oU-+9C#^|#8>F4l^z{+0)veXPN2|BLzIlqb>Fy3DFqBtT z+TCA&ktvweK;^~qy!6OY6ntbKb4j8^1eXI^$FsZLEc?F?E>NlO-wUt5V}O^m0iS?! zh1%Nry5F9cbZP;*5ws+$Pk(Qq_XRl$jP>o`n+}kx^3}_r@}g7l7rme5Up53S8(1=i zV3|H$b^OKC^Sq-v>39;b?s(*^si`r{b9}X}l5&@#xllm_5~#A5(6?o>-)J@*>_FZ` z@K&pir$FV;YqJ8WSp0Q}R6fzQ6^MJutxvUGs5)QO)9GP$r9yB?3x*Do^h}+c5&@qM zo>fzqTeN1r>s`WE-Z$RkX6(0TQC`EK6oaK^Q8x%G{5ksC_D~Y2#72&e3E(r(A+5y$ zf@^abU61Dx7BW2LW?>A89EUCxASA3eIN;e`~;@$@Q@MIgMlfX*0a7h&|WPi z;-5n=&FcGhm0pW3tbi&0)FI;aK^Ol0fT%*R@-iluq5 zklwt(W(JHcbhfJ7+cS6j+&~IJ^!0{b0CZ$fwN?N!-nm#88i@cHVzAGN4$28Yhc+N! zcp+$-ALwzQ!Uzyp(6%2WwVZj&4G1cTP(wOZCf(MbP(O-#SZ{AHOAdEpFhn`tBg2ox%+_;xcBrmK+MdqSToc4W8lHl2X~*y(4d`R?D(@e7U&t=$2DMVn#(CNxQSGXs-Lccj?H1H^VpaC{Moq;h1B0+$yF)2D7n>7eUS8gZOR$3}*xr`wlpY>umSo5uto#;< zW4j7pH0Z--=Ab3O5H)Ek-T{M;$Qk#iD;R@A23|H0^M?6(iPx%u2 zU>IkXKV)9LN~L?tEp7;J_Z?D^`9{T@WO*|B9AQ~5DVB)bTRP5)qqr{H>OqmSGuvD> zh}9o5nc{jAjSw7LAS-FP!N2^&p8CpHg&W6urP!o6nzT-=4bJhwADt7<5|qx@akCIw z6n*rR&jxqu5FJ$dmI6{v?si_{JJh4R$D-tst2&9J$Y)1){V&?2pExKFyLro0J?k3VqyJwl!K@gpgD zY6bPL6l%B^wkes$lh>+*;*P9UR%yKkRq3b-N!~*&Nx!8jMZ$S`SGRn>YTTCM2WDWC z+l;%orU$2~uRVTO!;iCCFiIn?>zGr)jUQ&T~ z6B~n>WbUSa%AE^6TSZskur2Q026a%(hS9a3Z1+Hl;XcH?Ly_S(Bkm9jYeiZZ`X+^< zqAU9*rOj`+^yIIMZxBZp8#`E$mw=f*wYiytEyl}4XOxfM7FN#qVnD~ZtsKkg()m?n{3)V`SY^A@1{9sE3P=$ zv}}ITIF%;s?DiC!>RDF~P_bpo&hkoHZv&< zC<-3a`as}kU$ATWVG_K(l#OeUGUkQ{{b5DKD>pna^^qC1Nuk3p*EKWIiY%~8Z8fTO zwd4Yo>);Deab>*XMV-`8kp*|Yq~W8V{V`vGN_J-qbd&d z69lF#ZI-(~%DMK{B$*A2?~S6kWEuc&n?YK z2_pA(<4fnr%_+C*?P$JR76X@YaT)11yT9b%$3ss)bdHi{LF zmFu5qcW)_~T?o+*&TTMnM$X++u9sa?PbT!2$%r||C}(`!>NQ@Do=++{ObvflPLJl# zqFx-?lukPBRqmNO&dlmFek^oe?r(dLc7%!Ksa`a2QHk7iV|U4On6yq+c&^^5sY_3- z_%Vv-2)kEn!iRT&eAGdR3H8|9_Dr3S48$hm=^pyuxXb=}KHhTgnpXB?Wi`cSxwEr; zwv?$8TZ)Lcpj)zid{^<+jRh>CbCt86qU3JuRav`A`s+GY<4N!5zutl6y}wOMHd*u< zTmQ}p`Zhb3d5mM)i*_;mn4RWL!7nk}?`yh7zy?AW6?zvwK54S{{*VSNt*%bUmlj^$ zC^;DLB4fV~eCe;!Hg0!R4H#44a+33x4{b0vIQF+7?zauj4c2>HeHyZX@RhXagG<@4 z=fzWbJ?cF%)Y#jPwMZ95s?x00!p9xgnaP>G64`6DP@Je^zFG+lm<>ZzrV09pr>B^h zM6a$3u{0XXs>vMq+QY@vs|L=QG zPmJ)~U`QmQ?i}}l~YXFKOVE+_WTB5&q|^*lu;Sj z-=hfVG?%_nc(iNfy{8^VUW`PZI&TO~!}gxc?%lgWlrZU^z3@;U%Wzv60Ym(bY|^&T z?Vj_<*L!N-{L(*5L=gq-qf_!LCs_)TCSjN9rNwcz!V$x1Lr?k8R&UPuq9~;S;@K3< z5L#^j@9u{|8z(Z*=(59KpvF`iu0dbf&4o z7oj8{3paMrx725#>`K<7QBr8Y8+N5g6Hx4;i=ABf81-h}L9Ky_h$>;G{DZVsjV`jj zjCD3UBtWd)zw-XMi{GRr zo@11rYf$Jm>v$1eh@l&Itf?F=k0oSFxC>jb=YZ24S-7KPyDXvh`iBO#gfceFnv1T$ zHw;UOt=CE8;aXt45179=5C%aa(QvfH$xIVDzOWuB%S6cYMq;9E?vf9!p6UO0GRi#2{t4Lx)6ELrk$3>RXn~nX558htRmu%FIL`*7a>p0P7FO zy$*_tLSPV4|3E;hX5Zx-#`<~2r`mu-lAy`LcZLgD$|jXso^r@uuqru8V}hlQ)?jjR zhr&inFl}UtKHREx8s#V;Mk?Ir(Y;cMB&6DGeIXqEEpN|89;p%%8L|n%GZc?eBZLFE z0khpVBVj&VRYB|*#uF?Ip%w0{)%B@Yl2H5x?q_$Wxa|ic)zY`Jhl{SA5Fk>C93||2aiR; zR%FbKj~)p2+MPFTwP-1uzR@6}|81yOR&+V7gLhp(2fXcT1>Pl&ksw3mT<5+zCYmUW z9^Ry=j6Gr10FK6ZnXUV6%968RB!XF{nTO6Y)VFkQb~u=(X2q^4{Gb^C*4hxXT^yu50jHi)&`5!;dJKp}bXd97P+{cts=NqZkasMnSt#0cUhSw0C0eX5(D(G01|?Vk=t~mOlk)HnJH2JttG5NDft4%#RMu4F-_%ci<`6*dPaHqWu5SN!Ql0CyM0at8jdyc`28?FE0EZ zWjPh2sQ1Skz*GPW{(3VL*jL=PD;7K^ zTrQ{!R6+of&A)nM?K_$J_fu!zH7D5aIPlz~zEqr!@h0*tu;HBh5BtJrto zF{>z%2{)!ea-9#B6H~20hc0lQ`lH3OV|&^2NebG{Ix3jv=e`x0jTWG(+Y$K z)HBi0Ac+nKB|ZwlRuJHOrdb{m;NmZqxE{6hASR#P!qW6sKY2XD(8`x+_u1?GX=D2M zG0oxHNw}9WLlf)_$pePr1&v@)1D@q4SpUOGeE@)@zz~p#iXaSz5LnjKKELP5KpmN3 z%y3F`yEz7H34oS|M@Q=rRKdr6#XAs_U4VoGMq$rxV7`!qLS%ps1a3M2c?1FU2kd}> zvj~LC_Hp9=t_i$2*cCJBwGS^^cZ`6YxGmwuylEDIEcE^(VBXGfUdaLA0RU5M0p9TY ziU&X#IaB+m&{G`z^?w40;VS^1Kz;cS96Yr@esBeN3n;$=2&rhmpaIIKAMDJtJpa(O zpIpp(Jg9Y9SE%K(;Q4ufi8@qm7c+eMM3YVm# zn*E%~32-s~PbwY)sW_6NW+EuGV4KSG>$ZnlEcBuIW&x_r%El&Ip>D{GPg<}AeA4bW zEvrzo4T$mVx*afEP}d=#HJ~nAK#@W@6#$_DyFw~R9$-i+4|bZiNRRO9fh_?rGEl(i z^v6pOcu#*YsVsh${1tmf# zQA7cWq^YO38zlHZ1`-Mw*<9M(#iO0aE$!I?Z6;NwB>Nn#3U#`qAs2#JaC@i?{XaMv zba4Ru6+e)j;FWi4RJP`cQD#$rPMry0paEx_%S?Id?mkO%>dx0s6@rx?Ek!ne;;?sk zG?A4-g&`@L8Q*ah$#!n1+`ibh3;4xW=D!{durF|6Lqs$xfW=+5;o|Z} z!r>w|At$ms_W~jaOghbC;E)Gs@&zOkU<5!Ur(3gz(hET0!N_EsxCcRrRp`1AQ|@`XC3$*2>-aAMB}qJbKqzSfN_N6*%UnK})&LwK z0+=RtAlT25gRr) zf&4FloN>Qb7cHNpFOH;;-bkiJX#y}V$ifeR2ctw11*V+m`4kM@%=v)S|IdLLz%Rab zF(zmVj0+%gftw5<+|Ymn$>!|j>F)`Y0s>!nsf5*KT`n{lBvU9R>3Lm~1?Ahin2iAZ ze&Y3X4~16&69vr%s6o&L51eK8U<3hjS9vgL#tx-N7#J9yf!fMSh*D{oA&cJx#{`YPdn)?8&18zi@AOk1d37l|VH_l%Dt51)sn~;A8H7r|!Xn`_l zfXKOYZL699(?KNVd`|0+&ThdW(?0fn)pYy_1ACjF`gokpZ z7v2g=JfjC&S^$^sJtwy>C2XXOjHwKx(0L%up0_yfdt?2*p`qWiVQ6CmGs1+;annCr zjUJSYBs5FFDUu?h;AW-AG=vz3iyFge;43pfHf5qO^M8&M)k67Khk&=C|3^@1+gFW zJQ6_3133#wJ09-Fymqpl?y^8rAxf7J)(5k3iJ@jdLCCefCq!RTA@+_ zP+bAI+X$2!V9E_Ejaep6^U@(?a93Ip>NUbtShhToF*2Lv(e(P`N4_#<>Sb!O#_p@( zgYV4}vN3`ghndQ;ptMRN9{w)L-*xcEg=<4I#t1ci23@j5)Zy;jnKl6yuvad?{(9bO z2?7LsS=-INS0GYFTb2v8nJ%D5VSv@n<(va*7=U>}hiZGg#0?zcv`Iq%E1#THAx272 znLN3HQedE!12IG6Tm&dbzyyHt14IVkr2vn=O`(E^hX>LiR0jd2g&$7@Zr7dzFc}~V zAoH)?3xtJ*HN~ly{hEwPRAJ@flFXa<1lVcN5kM_%U;zNk)2ss8k%5{4E)AOF`vGnR z0`*GuvZg!;s4009KQC6BDu)1v?0m9PFtx7)3IP-=2T2L^H!h(ufa(SnMOkLTq7Lk+ zLAM2jEVKzS(7yZeH1tY^=JOzNpdTq}P>;UZy*twfb)%^w(5Bi>-0!L#w{f(Jp%;9q<4tBQHp#1OX{<5g! zi}@xkfviNIaQ*`>&QX=@u^J8jIXJTCqTK)#EvaTX4=!4Mx+Ym=z(UeRCAPSUb$wW4QZWyQ1_#EhaW1J(o3Ou z*b!6x9iI6OKMAIwynOz5dsk2r;m1M%@>mNuz+I@sWCq$=oXt;;&Kf}086F+UVeiq* zFfYMTp~c?xCy7JruHXWnrfF(FkO4170e`#^dkX=>No zRGIcc3lPDNkB_Yz&zY|@Qm#>hL^mLXS``WzrVzr&_eQjyRAI&q#BVp${=m>65s5q0 zb2i!EbM}OGUP$HQ=WrmGmDQ?`c^^bmxj%>Dk=-hr6rx8R4Y^taFpvi0DyMoUzn4PB zw~|=60?b-msTkaJ#aMp`qB8wJ8FjJ`Of)#!3*}-`voGa02;LGpKMYC}_CgF!ef;W< z4#C8m;qX@WG5P(s6zD#!Yi%yeCpY#noE6hr2M-zUD+t(9DJ?R)~g;5zU-}VYq zX8Yz@x#xy?MlQ_1a1N#JNW%FddmWRHQjXGY z!qGX7^(Q#k?ky*au|Jn7;8tgqUs=?<)DEH)@^}!S;!OUim^G`Y%#{(ajUU(6_O~0b z3|AI+OZm2GOrK-iQws){kgM5TbZyCwN7Rs?+QU^qwKI=4I%iaPk%22u~37g7H@hCs@!D(-59^|bT>bioR%f|oJI4- zVDaVg$K7de8|u~e?QPNB-0(xuQ8+DJ^k4IoF&(DV;ksFuCxJ~QX?hx@k+~CR$;thJ zf?&YnSY1|_F)*>rtN1=DWITUqvK8pKrpp=m=e=i2Zx~{QV&Jd-9c85c9ph?%XNEhj zWxg#M^{LU&H9?j2cuwK-x%VFp<9?X3WZ)7)8wt-e6U&i<3XP*yLICv|xD3$lU@)?# zw9bRb%Ji4yen>Qp!m$A$Q%~*XyP!5G&Lg>Pe9Y^v0%bLzZ=Yh=dFvnJUE@3n&ArwC z`7v|uh}t}Jo=R3RWlFCB_j@^N`7A~Z&2%S?S2ja6y-1KDSwH@i@IOtxw&_Vivav>T z(>Npm?S1j{rNI1~wm83k_mrsmTaH-NXUpg0{8-Fq3zE{MGGmCw)^`}?dcmWM{>65}{kG3kzB+@iX+aot znA@~+nY@wY)0QsnyWMoSHd94_j(p894ThMjAersl)~rJKpnRsbtx!PraDD~aXqlRmFj2>~zr{E&2yl`0Kw&hh7@o8}a{p zQzBL%7@PlmfClCN=k`_U%>R8x18#i)W&h`5Zwytt_&@&lm2`gUC^Ql#A2Ds2!k^m1Qh*}`8eZV(GlZaXe+eBPxpN3 znUj6L6wU}w_Yp^HTPSjAw*GtzJH-5P{3OuO*nY7KuqRTS zFE0|vjI5#yPE4$lqs`PjopUe{V%iz}rCwt#N z5|50ZF-r>$7b{HhQblPA`BJC|x0Wo=!gT4c(EECxFHWn^k_|pyjbfc@>aLD>|2VCj6E|Q z!0qstmiR6?v|-q1h)Wp(Wd~Q2{!#)rMJOjG1wt4_MbN_F_)5IJ&X$|z{1rAhH6^p` zvWb!LJs+jGEth<&G^uc$(LKb)s5hS3#AGERz(aCFm6Y{0cYRwww~^}V2MXD7XhpCe!i$(In4!%E7eZ(3#bG?0JN30}32Yww$u*&Hb)zrD+<_LBcjg{v)KTf_ z$(es_R5u3mUMK%CQEtFZn!q~2!+4oV=x)Bu1zkny&lGaJ*$gZwze@Z~VhTp&FrFXS z4Vo9@xtNqdO+oL&pqMf)xu=${-VHR`%6si5ha)K{_gT?)wfYryul5SJg7-|5lwSyX z>He5Wp*$CZs&eWhP7;?J%iBvHEhoDVh5lkBblE-AMHEF7wMK(7;o@I=e*I_QbM1Iu zq?0-qQvcc8m1Fx#eV-}sMmX{jzek9A3$+Kqkts1$H+%Gf7fV}gk50?B%YbK?dop~5 z8O;D&}Fd&QXg09=p#f-27e=qo)d9GCSRYRy^J;ANN+Fc|{6GG;)(O)`XHhgHevYrry6w1mU!RmXhhU^B;fs z4}R0BHu#$_nY0Q+RT1%@b(cS-r&Y}2MfapC6<|@JOWFP4JY*o3#QaK%UF_3^M%jf! zix>i%!(NF^`QrK88FOnPe<5SoX_&6VxzBHd6AHHq^)`~(vob!5W&4VKZe(Gi})V5e-9$_?>U*9w)xM#z`TV4))N z$L>L-eQUF%jLK0#r5sO6^orGS6x)|s8fz_)5~7le6%xv!u$GfR9o{v4YL}g478pZq zBO%H_&Vp3jm+$*lnHgU~%{}CVCtFot9VM<$BG~v_f^UwD4#(`kLziW5Bs>k)_qLo| zBJp4$^mzBU0RQ&DA4*f$zB12Z&=09XAAJfdsV=Ba355v}7LdB|f1}33h8z^&5M5&_ zv9PzQrK4`DIZ&CAzfzI0nd0>A6K5Vr4jbRZ2l$zQjjV2TsLuh)3^K{jUk zP+aN!ukyBzLxp00sL)g4f-)XCXRVh^oe}tHvNgZi+g2(l-JqlT4@k{DL!d)&{5_t) zFPzJjiOrA{RT z&U*}UL`}9%~-5B2uS3_2N5;iyC$Jb0yGi?_G^}A-QqLk+kNdz zQLPGs3fGhsW+TIIq6OL%#c)fl4Wq{jZ@BCQ7<5BUw6zSrO;JVaTh&Xw0~_echv7+)x~hvNW2Hv zyzC$9ol@<$DVvLs&k)@{WR*KNcf=CUgyzhP!t+HYfo)nl=n)R{Rc2afZ%c*%iPssP zP;S|)OJs?jhPFqT#q zcgMJ_a~P;(F6`5-)xR=_-`)P@tcqnEdFjs|^mH;qJnQ-;HNx8>`*shUogTS$rPcXs zS?BN3P+DuXU0~mvU5!i128t1qV{4X1HxlO~!lYUC;`fs|RBu|`mKtxO>yS;&W`y+;;2>id8xAQ^@BFNdVNHL3!|{}ADy91L^Q1_MIU)-yzCC6_ zdIHC&?B5rkTE^;vc+++G6;~_l8i*!NP%&8bOWx;hxz@Ib!YZ<^BF*gwTwZhNmhVyf zX6Sc~_Te6U{0PxHeGJ1h)79$3@ExBxlwjelGMOW>`8K6rsG0NX(4S@bIJ)95V;5R* zt9R1{kO>EHkHXHj>2Nv+E}it3OQyCgdtA=oqWv)i8or`58^eYm5(zO8Z#Dvri7>2s zH&K)BWHR(-;=ym<=l5#}`w=?ijO%;O2VcA1d(?B*&q-5$;d|($xaJG&R5B;Ftk>*l zi3~TKQ6KwWKbW29#SVXZF**65-dZU;rX-gnz-%JgLrtDnRn5^v_-UJE9U^_ zW1Gi<8wPR#!Qi_bWwA;ld*+@A-*#-V6#JlWubVL&IJ$*;%F#r2DCBu@{k1T~35aMw znA#P{NlH-K`fl=afkwMKQi4oCg%;%dOkiYdR_Cq zwR7BlZuyNJNLs+2kVUIiDOsjYE+f(`{G#X=Y4S}>d-q|%P;2!b`4a05c~GB42(mp> zhSb@w-G;Ao$oupGrL!qIsd=m)H-0N5SvhxVmjq%n@#+s-;j_`WUk9@2EiG^T6*}wN zHvX;OW7=@Dw`T7~v;N1A2)tIO716#)mXN(t%-rIX`9}u1VLjUz@qI~6hoF!c%hj`3 zy8y^(u=ZY0s6u)1XK6iT@^{&Mi}?chO7C6{XQYTC3rle-b=lg!VY_WNp_z7faYoyR z8?N0+c}FuGUwRuNQ3|JsEE9Ywi^CvREFDPDpl0BykLXoAw_=8MbXTh*Ua^u}nuFI@ z%qT8RPN|>-)6k<-^c<_!TcZ(@06*zCQ7Oq4xNa3>vYf-s8)ZY8gO1`aswm{=@JYtF zUV1#U`xj!DY{zk7mO&!R_Sz@-Hv)CgO(`-|?%@Z~*F%iojcybOV_=9+G?Au%A2?{} z_Dq@bb+f?anbI$wzj9$JLp0~Vzs3v^qY9JbH=>G;8L!^h@CD^;vYt}ew!vZeXDV*V z=Jt@4Oc&P@sL7x=qY|-mtmbKzC|z}aZoKqq_s%)MxJ#Y0M=Uj7()sb%M(X`%^8Q}B zS=zBttoT8-gIEjs>MV98pZ?=#PS=JD%5ook-We=~`U`h@!lhwY2C~SQW76&QrTS2$ zSSOgFn9|-6E6fk6+EEJ862|Kla(7JJPl<<15}e=33)tKi+F#G;&@p8akV0(c%+S6j z3-N}}A6%aez6y*KdTBhGF4(;!_Zo-$&>`^W5vFL7uN}WrLScChC7dt?Y4L}U1tO3o zhNp*yU+&L(GFoU26I%WQYk<-WWN`a}e8w02uX$W*W#=fxw5V6%VzRI<`3_@b6z?%%> zv?G{OFv1ng9~oHYFvK2FrJIHiwc|{v)RxL-4eQdCGWb7$`ejUk>Z?(kp1q zlPT}pTK(du_xWV+5ho}{mhsm+TWx0}1s4aATt=hxURz++$dG2ersW3VbJ(7~n44+b zdZZDBjoJIMVlkGbMT%qReJ4VAKX_J~e%3vl$;S-ZP`V7X-RKP0B?HASTcU=gyNALE z-afQ*NMu~HlQpyEXCnh2I-OyTknl4N{0qeZDW|Z8Vpwd(dkNa7rQ!a*)(be^QY2*HSK1 zhqR1;%K6RQqP?5`CQnVIqB8mBM-1x7Hhq|}^amt$T-ZRzh|R{~hSKyiqEvh0vRpaB zz#ax{4`Jots9>LUMH-(F<7dRw4az;CxX^ zi-JLe`J4^chrK$N$`f<=?&#EmDsY&@VXh*&cj`C0%AIPpq_21cD7f0C_Eea9-|MwZ zB@kdG5^4$2R(N@bBzkjr@nhrNN6Sa6*f%#3PIoLIuqN?^>b^4!@}(S6quE^wG}Ne~ z{?TgjUBWd>r5m;M?4NOV_=CJ1uq|?KyNj6)kV6Y0Ga`7ZTzHvmy3cVZw>;w<^^0CD ze8m{wbVK}Pfs1FdkxiHy?qX^z99baWUqcYrC7FkDXH&`;;iNucd>P>|-e{h&VcF3q z_^Ye>9ZEmd+9bILr)*yD`B(p$KjM4|UcA_YykzV$ol0~fIl?@Ulq?MTNy=7{H3+M` ze;G%&elP<^gq=`0sfzh)TFHEK-e+AJSOH`sv03V$e=3aj*5WAV0#QChMG0w8itZfg zRaKxEok2nHdtV14_kMZBzXXA{VzHEsk$$_bQY?e^xOuPrS(FLaU6`oG#!fb|Dx|v* z6s5pBlZNVF(`6)n3yrId_1z_PNd2l|Qcxn-@AZxs*R~u%`{g@^037IW z?TO+-)#xl!14ia^?F>X^=i3YO%tnKaB{2qVvKlOF*8!ZnnoB0WNJDhkS#C35i|OLX zy}96@>{}(ZB1klE*D@={EGejk%@gVv5}fW{2$eZ_QHQmP)>m1|8&D$p-+f~iW{8kc zv8C%N{-Q-!J85oSW!XHF5~RdP{_%m2I&4&d7`dQYQ*1@9M(Qu0U?aJnMBY@raaKw+ z>*7gV$eluJYQ02bO2>qDG|84EV&i7(ElI!rh_f(}wyEyZ2UF|UV-tsN6YA_83wT35 zvIlR9z9jYp&=1?{XAyOZZsyw5D7rXUvFws(eB0l)Uz@B8ciBwD^2f0mOPpd@8z;q< z684q&?1Kqgi=ToQRBqz1Fn!l6Ca29Se!Zf9Fdks+c${uDCElEGTY*^-ErM(GNng|q zGlMkxr>~H-;t9_p2}@~2>R2?=o1bvYSix^9RAGY9Q}(vAA@uYWG}*U~d;`7*jVyZ0 zmwg+|FkDU17&g_njsxxGeMdZ*_44p6Bpk#>3#58J&yFIIsoAEIz0;OLN11LdEM2dU zyn0Sf&W`xot@Zwdl*mO#WE$rvU1Z>)u4PwqhaNH4g^s{+%>2gl+2q#Zv~dOO!126Y z>7Py_$_|k&EBW8L11!6A9mu05Nq6&JTSz6oh_N%+^2>$hMH;Hc9BmKzBJ_?C)i-SV zlo(BHf#bn+MO@;|XJRy@s(8vqPqi}RS_QAh;Ic>k(=yR*&JhXe$>1g(r#1`J1V$LG zXWk;gp3u@3^ew1ajwv6r`J->1g9#*M+eiSt{nm1`yI?+D6mOi#55l&smKi<(+t z`^>}m{jT_vX;sC}wb8<_k8FQ3i0As-#9g&*u}TxIhWm1jkZ4zmea;s zb)a^u{Jpm>Wn>wD)ACoj1Hc{`0NV~jY?D?mn~CenPm$bkUKA6pv))_2eK<1I%-ak3 z*bo$!_KeGc+t;#r(y{EHb|CZU2o-EJUnud7iT@Hd>6!FSvLlSk=AF}G zP>L<=68 zFV>lAQDo+uGivsi@JqOh2EN0q`5bW_I^DIKtS*)KUe@lb=Z3TrS@IJ<*cM69(oF1A zzu)#mY}@ZPdOGcND$;8Lipm>I3Ux(Y6>|}yQ}|e>U??NIl+)RG$?cR#KD?Ilgz@_5 zb0)mI(7vTyK6m=V{ZZny@IuVL!%_rC|@Z@HjwLY);KGomQ z#;9YfL{Z=*$vIv|Hlt2uO2gdLl3Pytq~Wf3+(Gc|*di76Be#VR|_!0uX$`hqT1a~R&A3W?q@3S=7I*vi{h-X`o+ke zcEqHw(YeA|z#2XQMduF(1D6~pz{afuV;3r_E)HubIaAFbYNLT+PMWVvlAhFgS+qhK zk{lvgVNTIRFi*|<3JwvvpM*E##y_HNmeEb zkeX0im)jM}v2RF{Y>e~MH67?Wv_{%!pU=+AOxlb63CZs;;N}dQS7%x|7y8_FTa>iI zPM!S7z`3LR%411^kn?G4;OM(!*EHG|B1^vnad$Id3o@o?)=+k~Xod$^vk(X|BeC+3 z2Xe?iohP~uK1fL6@cvP3)-%j_s#8!jw{!Q1bf9K>X7FI4g|1eO@5Jp-gTXmUA%TPQ zl8rBthG_4!(UE`PASuE?W)&_NE5c#&5+{$)t|VD1z*m{uHFPRp+J261x6O{wonm>zSf&`-`yOE$6a z14kk82J${g1i3bZ!L(n(h%0o5uXi;~(Ir-|cxf`JQlgH9LO!Har z^p3O2de0-c+hDE2{hV(%%*6vpi6&AjPHiKTT=>+`_scz|QYlbvsgX_uWiuN-vF6Sp zYz`RyVMS<^HZ9$27Pk0HKiM;)pNp8Te4e7l6CLoNztoknQ!Ix?-fJALG4x(>y)K2* zr6f~Lj0Y>8dPqmvBJyPO76v_B!mPzxC=5RuVVzY5j<*RdNYj)cN4`-dJaPmE`S|;$ z-JC;B`M`Z5kA*Lz&y_}()(f$0*X+$&N<;#iU}aLu{Z9xl(N3Z{<;p9+;?u198OkO( z8=)>%Rs~X-XG*hoP3%V$rEC{Cj=xPT+PvKM8M3yh2@5B@dNp{m9JLutILo~Q5zI(> zXytnQYGBBznrpVh+^xWeR(h&MMlyP@yi_t4osJ_hw+karS7P;&p|GDoZI6?g)sHwt znlMBCUg{%VwA9<^l*Kr-m7jz=Vnqp(q!qZib)Sl-^2dnDaSWs8PJb>AiX^%~CR?+b zYzfE4B#Gv+(B+sS`!`JwgT zFZCOALfMyuLs%?ybGkEFkNO+(qPlo8-N2pK5MQbnFOk=6Bzb+m#ix zl$G6B9cl~vJd>Z)VvG_qA9bP9n@ikv66kj)S-m$Iby+oxc&o`)i#vtw9FmWK2{$3+ zoOjcfs7<~@&RSiK^a?$e7W31tJ?i-TroPyOyRC~=gIc8?c-Kjakl#isnphw8uNkJA z#`H}5Il5n){^|PrHn=uhNy$O?OE$CWjxZ;=Vw|BrXm_;(*(joUXslf9z8F)g(D}#b z!>fD|l2%)r+IQS9KvaH9jt!qdNFmQUdHloF@4ah!i1H3M_VSuV#XvQqqW9aA`KOD1 zi?4;+=f>frI0AI~x?g_ao~lxJ)8t`DRoBWUQsIvk74gLieV=E$ZTGXB(WFYT85M z1%xXURuLi#a!y`jmRv|S*VIK&zjPUA^^uML{NhVSQSHDl>@PzI)H=56vTrQd6eDn=|4RogY!KW6fx@QBb-({} z{dl+Ce$r{%xXAx!gzNM4%f~R3)UVT@zL&=LrEaJg?olBQq5+MIe&Mpn8!3Ov3$@B@ zegrhiRx8D6DQz13DN;p4RgVUyWu{3`J-laFc8YX3qr)-2|;p;kYu%6+W%~Ax%mC8Oe;m{CM z#XklT4r+zyH)aR15LCPp#%JMY8!&J~@p+thIaivd*JC!9Zc>jkh*6iTV?s;SvuEgX z8s=BNWxIp<1)|9B?C&7V^v}sD1gEFaz>Y|-oB)73+btGG>luJxq+oA9vD(H`| ziq;&)0J@P2iMAl43)`K0@IzXD)E2%lgHO~!s-j%bG9yJ;-~Q|y%9|s-%0JtodrBE5 zs?9<8qJ;C9>+0-rJ%bhQY~PU*4APMg@_(P72$zpg zrWNPRmO}j{2{X2JmVRgJPAcoC)a+?q|0s`|)pWe})TM0*A!5g1L1BENt5E%$7}(J&MTQGh6lw+1cWG zU-$R-{L$-m=gwzb*Lj`eJ&xm}JcSB-(PA=(z(gO{l-aUeL~x_$tpYJQcE1xLY_&2u zd8|v>+V731RQ6^w`p(Nq6S-HdU;EDLZ$9hfdXH7aAl2n}o*tpqk9F&UJ4G1%74=3C za}k@hy}zd{-uOvCbGqBqi3uC~md#h^5|I(zQ|WqTk*Z_es7et+Khd^__AN>ug=WeB zw0x|HpA!EqGQTSFItsI!$hi+kvhS8cn$Kw5V()WdU8@gq?1oxoO)~Omd!skYc0crK z9b0kk99)$dB978Fcytz{g7TscWSwolI`GxH;SF~nLlx(mD2>XD*O$CO>f?Xj&f>E+ zp^{1&-OGRC9=+w{xAXR=-Ny;`>ya_OGr&Vz5Hi3;CvW`z&^1xn=aiU`y>$VazGVlvfHOYtt=Hsq+lyX$&V$jR-kQ)nwR+o{~TAp8EB_vq`Y`>fxb)> zKT385vm~9|HBvP;pwt16@tW-Qf3|*m7+9jWt?6d7Zexi_*$M?dz02{Hpo*gm%hq|f%Nc45eQIW}BHR=6EoAEc)q3h}2rxtUk9m0<7TQtz-_yK6jgzu+sY8r&WB)@ADTz zi!%S(U~-hBcL`p4NA%5HCHW8(Qe7DBmnwDNZj+Slmp z(K*N-NXAOdv6uyGCyjs0Wo>9&QjTNjeA+dG|5JhJ?G^OkQ8L+2QCP8ij_5g^6+eY> zWL}w61>93q_2c;HS^WyPUfxO&F6yrvKd*Gr81m zSPXtYqzji+JcWUo7UlPbL3ThFs8_0T(F~$2fvQ+VJh~ehVt=z-B+Zo2sUPo|-#JbV zDe2-k4pnpuW|x|RQk4$ikY2wI;Rp%&r!Pb{LFgW<2NEP)u2k*wt0A&b20a$kfu?^R!!Z)WI(m>%dC1Bz~|i#K0n%un*I zU<#$D1uP#t7MfR6^E>|i=5Ak)eJ&Yo_T!?UZX&ZyN2&3tsCx%Ih7u7S6H4+|(pdTL zh`q_93&=MLW97Z$N5O!D(n*LhG0_&7T>PhOSL);@G4OKma7CM#C-)k6nD6k%Hys}| z@AoMB%Ni_VqMCjccauKiYrBp~ilbxxa$1#^&4G#~L&N?F3%(SA47C+EdLVIGji|L% z2fA#-_#o3gDou_1wcJh7>}9cN!C_|#%EQMiIqx4X?le*xUzB`nZ3=wYBmC3wyS3Zp zqMqPcvYY6SaqSp}5og>;R5O$AllWW-(EyI58I>E(a`&-<&)?uE78i5oO1*8t7R%oI zeK*NF$#?IMm&VlaLs#6Z18+a4XJBB^F?6e{o(kmxNQXw7rS0@-*hnQ$ zT8(pXYmQ{$Ku*%Z!A%6vr>kpdZeCSGB+H_b=Eas{6{6lnn9oo9GfB5dD&Fj`;A79( zc08|zaaI}8xkVN;OkHm_W!AmbJ61`PlLc~gflvqU;Os1cj{z_?^jT??Xv3^Dg*ZM2 za}Gxve!Ii2Ui^9q6*V<|4#043sU$m4(nIfNvvkA{Uk$1=tEQQ)2hbq$=cO&-kqMfD zxvYHyWD5>{L%OE7SIv%huU_V!eB5xiG;R*t;Z|c&=LmPZV#)e@v{MI)jljr<4)A9CbBXEeO)zfr3<^K91iGr^#cUn{;Kx+b9_8b%AlG_IP|!{qJc zq}cZXZ-|Y!x@^yLZpXfsrR7XYp$Q(kEhSSCWhzC?V|XLG*QLd_XwVd;N~{-CIw3OG z(Vb9NBjfQRi5Z78!}RL-w9t~Jb-EOO8UMq^1ql=(Z&jqg_@g$GftONm3|HsS=G{|L z?SB6CwB2^8`R*Wt@7`0L+`~in!kFV?c}9nhbtja^wc!4rFQVC`?43XJvt@+jM^kQ2 z+^m{P9AkEGk~C<;9&@XYHpqPj$qKJbnb0l83G`S@j1}zPiaL z67z@Zz$%<4A%V2{=&`dg|76S`JDWjuvhpJG@Z5f*mo=3I6OSWgYsu$tSTZF1`b2we zQm;X<+W>=y>EUtHxH^}h_&Sb}-+bQ_$r)C4{wpANGP8QS=M{mAhxCm0ZUDJUu=jYj z{?hB5V{U6w?;_pjlFzlO>Ll-SF&*jPNnJDnB;&b(=jmD=LNo%KX zv+3>X;6^*Ad`ub-y3`flrvuycMd#|DUK`_!O@&|%2_8>PVzJtV+7#ixrHg!K z`=C{Zn+jUhY!hissqa7JX4M+F!$ba*ktE5GgF(C2>AR*hYvbV-uTgoYx(E8TbEBho z8}}YLN05tYDV;mSkhYVSJzndD83Zy z_;tSiThYd+xATJ1tR(RX|82+J#A{WrT%&?Gdz&99j|s*1^*-cT%@TXJ!Ex8qc6wrU z!8jb7WM#;7)`_FDMv5sDS{QgC^J?(AOA=?}sQ60r-Z1y@-^BM4^8dy6vEU z7!Yv?chAJc1P!!#{(Q5ZF&rqj!#%KhiSz?05Me($P&xrg6KQ>gE+A+gyzHHsp@K%Y zy5oh=3SB6o|A5FAEi7*25Ch_n4f;(Ppraa^|A=jB;o0dm-ygiMVul0H5VS3?xe7AK zhIDe#i9nZWNp-n=ytyUU;j35tLJ5_)Q}uTHZ-P^rFr6~f7qmjS9L^|%2Tl^Ee7@ol zT{V00l>{+iUOV%j8=Y}e}U z%CDE$^g_JVaCm*m^-$BKJWGdH*y9!6iSr_w5cPC8=c^;PZ;wOw#D$2KVi>ODhGjp& zVY(jU$14*zkGT`p$j2%CSSU*tvqRz~X3BmtWA%n0>jSkN<5Ss4{>Ng&Or2si-+!)J z7B&yN`Ij%oxD_bBI8{*MNg&_XF_8ouJ-R0UbuHcZ#+C0Y$X0h}R z#JWWl0FZH0S*xVv^wmU*G(;s2ZPQQe-P}5smKcCuz<~n|WYG1;!Nb!!K28coCxCY% zYDNU^HZ(*CJ*&{+S_Xp;V5VZI+`K$!l?R=tSGsL=H#F*h^*DOKUblm;Ypw6|&joq| zp?B~%&}V!5_J0y*#NZ80ir|a9f?yQNiC=8Cnd zW&be@DDT|a-7vUJLYhs1d=0#E=mF&t#TPP+Z4e|i8ITPbO!{%O8<2ThDlDAGiZ>}h z^iA>S^(ZD5os^}u+h{iUA<~gG0|a5V4^^@zL+PBr(&yNTJ9^fgwA5|r@ysVf<31v7$?Uq zRcL?UFls*-`lXtiLNoZafajj&_#3=iS18}`-mPt}MY~G<+iJ(`$Ityxh3ZxJqfx4R zg^x(%209JPc={Hc!*#Dl#0bkq)8U6H_c%Hf1QHM=iu5+AOB5RM|N5P^``bBU?Et4& z^D4U~VF;SSO=rV@V`0(+fi#RVvxg&Yyrx$OqSOo3*xmZWwFp-A<4i;gTAPf`NR~{x*mQ#ZXKNEwpe{(~YxS6!t8GNz zE~l2c6IxD)$!&e3F9CakE8v>vovxqWyWETJ5VLV^y2OI0#9YSoHfc)=t(Gr8(;?d-XxW=QScmjeVjc$7HJ7TB56Y~i74L5N&N~8uK@)r=l+A-}uPBS0v5gfQ;?nVB^q{*ZSCz=)lU_OX?ujgSu(k%_EI>8|3=-vA$beOMTFqrB{ zQMN<(dz$B-EHV&)#;UEO12mG7y1E_^56$%G@0 zEaHF%04goO$^rimTLi>|jQEiGBi!MYVEEMmbU^52Ddsa$3?tFkY% z?Awz~hBNbbc4IP$$>wkmnZ09V*UJZ@cpsz`+wqwSr4)+Rzy@-HyPiL z|04aOW!uUzL8*=R{nv@t$60Oc<<1IqYng|>#Xqt!)4jhn?sbuies3jG)-!aaHT4?X znYT!$oE84DZ`g*-|47AxiO@8INr6W$H^n+zVdN?ogQL)#0>j!hstMB{7xPyx9OUML z++GY_fA)?}KNp|u#*+Lpreo2Qu^Yx$g7LGt*wYvp2&sLa{1$x@^vLgrrl3sa+k9MB zb8F>NPZHDTLHWI#o3XRr#7?ffOXXQqg~{#C&rI0Z!d21>oD!N2U7KDQI65yu=abI1 zMS=v4D^bMZqnBi@nOK+`Aw3^n7G<}TiWM+*VG}g9n-+XGSDlqY)hhgGi$m}3on-2! zf5*7YeeV{ldW{I;u#k|E364S+!4Y_ML3!_ZU`X!(I>2 z7%+BWo7qN+z_43dFc9)M0A>pcSP&Wwtp5&_<#lz>G5GkYfhh~;7yykN9=eu7gZpYx z^^7r4Zo#_D1;tzll%Cz^L>{5A0La(TF&gls0r&{H0>QPzCSt*z3SsZeZj)r&K>I$x z{0p9vQp=)5%O?z7&EGcvgF_r{)K|h!55tundiK+YykP5N=ir&BveJ2b+?dt%i&8kq zC|)L?=YB}$%9?!_CYA0Qex~}kp6&v{iHoiYRmOlDk1U!(Ab#rpS`Jl4#f#KlOQQkZ zp--~b@%Okz{oj+b;GpnKgf`li)xR|f^e2)R)g}#NOqQzX{R84zr6&{WO6K7mKbuGkgLMn*Y2y5Z2igaY zUS~HF1jnPuXeDo=*d{o07<&6+Ss!wxmc9Bs5LW8I&|%BSO}|YY^Z#oBVwFV_%p06~ zX2Kr}kB5vuQW)Q0`aJ#Em}^%htzU&5ws+~nq)F{qPALP*UKk;dlJ6YiMPMGjR@gkS z;@%)FZu6d{Cs5qE=0?Thr*5iwN8-un#{IpI43(+d@jsS~A)J&OE=Ktf%g9j9U5>WgzYx6v?iDb~Yg{+UVK=t6W(8*AS)(wP z`gAbI)1X2O{b4XM-Mt%>DfYPE1gI?VR|F}H2E&eoU4LnA?hP!X4Kin(A|lG*OMvq) zLb(B&I|3VrO{#1(hp;g2((}qPvoGze+x3kzEkZUsT>f^?KM{v#8mP`m{Vp8j zwJO504Di#{ZYJU(#3-m@kbf8Z&;?JWkahs0sX2j4CxwHGMPX8$E-I?b?5jkiL=Gw@ z)AWY~4X2x_n{(%%QcgE_x3};81xn1H%3D>Gm~RtXAM%n0$h`l%6GlfQ$k+NBhhajM z!=FHAR{Skhr~Zu$u~WIysYYDVc)ORgQ(9qW%&k_p`s^=I)Yyjg{r1U(m=pJ$m=2 zV*Y_sPXG;pA6sN!(bJ43e+SqHc8ye*uJHHk*W-{jaTpsrMl&eE5Hn58)h{M7&4=a8 zk{b;c$4mf*$H$)3D+8GXW*V@ws}+s_LI<%C^L}{tMLjr$A6X2a*L#wgAb>qMCB&)% zR9}Rqn=3arHz74uQckvf!W4MpFqVLwLSPTa?zhovqc3=n(=m|i;J3;x`azWpm@WXK zSB$zZOj^}LkO?-5vfzn=hXJ5g$WjW2B4k2_sSXYs;6Iu0GrU+7xuA!`6oBR7?cQZd zKWZ_M5q0wP3srue$-~(=*qFid>@M)coXlYpJE6mrm-pT`l{&^OzFhVM6;mB!UrfH* z<2d?3FQx_4iYX*oF(hT@S97!yR~s%mD!^X$(H|~G3_0DK9ZRNJDVd`*r~oli-yFM~ z*SSsNA$4?eTh5nH7TVqvVPdkDy9hq+U$;(e8F)(e`>J1sWH^f2k>b-_wu7n|K2|U> z70S8_KE{1Uvg_dt+@q^F&r3oryvCh{lgRP)_2cDLC>zU0D(g-?AW9vH{@0Jld+337OJn1aogib>0fgNo)kidQ=7yqcuA zr*MYQW8bKol(kGod5N08H1fzqBQkaM;MP~y9@Ka_h zYpM7{pKQY)W}_pSDatp6=u_3NHfhTIme-CXy4c844pysq?GPMV#FXay?Rasxy5B!X z=DHer1(E-axAl>%CSNUn1!H`v$a=%y8^?!dY*?J@W`BVSBrVjcY;YrV$XHLj@}<$jugWx%Zzht7ANUz3i$dr+^!f6y1#lLSu>i)7ZI zo9Rz~AvPQ){ep`GSrfJwA0%NHTL1D>et(@Z&{i27Zz$kyaX)|A`{ZNMgch2v7#l4SO~w7d4~zqmwBepr zVW#`}%1n$Idngxb_O(SzHx+lfyK;eaL7h`pBJsib&QYyP?tcTGkZw?fRee3Y&e@I2 zYdYFn&2e}vexxEQ{J~WL+mY?h*VwYPxH7iZBVw*w2?|rQIfrCwWJW@v+?Ar#P%&Un zhwSe7PnIwKGCMpF8{HRzlVYWAkz2PH@kWX;+vld=R06z$cE)9a9B+en9iq97UN~Z{ zo%ydubBYfQ(96wUXZ{nB6aVeEpJyrkoiu!j`k>&mm!EANV*flD8?fUY-(l2KKA*to zV>}?GlM^6&$n_yTgq$Sn&Y-{VgQ{+ee#KC-32B*VHgRTOEKlPsS+3q0hqqC0r#7S| z3{fDug?^MO#lMC5I z#<0A*l}#9+5})Ip>%kpaA zL@jzVGRE~Lri8Oa=}2c@*Ue5=G~(`)@G6^3tj?=RM`f2B7>7qOGrmW6W|C3!Re#HJ zZ9n5jcmKwgWE=||(>xqLDdaQWBg%CCN%o6y%V+;W&}cYz{e3PkT~FNk>tA!HW?`Zo zLg}%b3B#xBsQI33<0o?!_lp@~4}6@?x-+uNBGFO=6vpWeth^Zuf8~V`-&;292%y#U z6K5HhQ$56s+*K7VvO`rceBskk8#s_74?g2~L3f^FwpA+px3F_;?d&{ONp<~t5OM2e ztBFqlk>yn}(L@gh!R^orOe?eNc=8H20#=1vit5G_Z(_T;qc8KtW87Sltc|;UU74au zfym0Ai{-j_=Evd^mE^?655iH0MbjF-mQB8XHdY!f*lMB`{63nw%xyWgS*n&U|0?=G&iY#KLl0S(FT-cQo0lG-|k1u2M6! zyE&)4f1ybD+RazF`-n7|@-EtXB2CL)ox9O~Xm~^?wfG#HJJAtg4MD7~j^`_%pw1M% z1?FELNk?}Euend&y#C_7Ypx*9koGlcy0_o#MSA~u+y9GhT}#dUjZS<$@T)?`*~%r} zu3+92X0|VWpxqOKkAnaL7Dz*B!;=zEk_s=COkUV_L)4ViD{ zFy>wDJ5rR>VOG$Izm*<{ADOoISNccJ^EX4i--UXm@OmU{GrUxBs7&#m8rQ4FUQ0W( zG5H+*+k;RjkoUSW%F~EmlpgQAPQsU+C#izLY1$*L|CxDV_GCwkM@$@!aPnS#+aOoS z54GBG(HKJ+r>tD&;m0vCrF)%&&zr%q$~rY=Q$F|WVZcz<2qS5y7r35 z#-vPFW-fDVQuZ%O(C<HI=|N3uke6A_ahgb(K}y^Kw>PsK!ah~YlN1p zmhSJDEU*=11@8BUvb_Duz2e_*w!ka5&=oWvV0M?~H7?;92TP%AZiPzX4Bw z+!VjJZ+Puv!i&Z?J!CkOiE;8>y;*@b>YSI9ol~(3lnW$lHX*x5Grpg znOs^hRt)AyXiOLTPGPR1WK!O#XEVdCqdIea;RC(60GBWK=m+^1DjjC3t4W4BwoZAE zqfWlvyeawM2W^|0(%g54mtm&JQZ;g-4Wixksnz{ZtdLA<92Zo* zAHcREot)A#z1sdNM93TBjL+dbb0h00P~~b<)=|d=oeGnEU%w(tAbt}Q&#i?hwy1-W zl7JqvSu{r<-lc)U@B2aGIOfl-O?tnm&izYlSz*7f_QF2HWTO8`qpHFMgL+q@fRkjm ztZw3)x*x~sH?NFlG_)j0D80qNLBB=$)1l}=GUa`%r|z!bGBxnZj?DbGnOaX<1S0f* zjXY1|erPG4s2DQnFKE_#(7NLM@T5{T^Yz`xX3Ws%Ie~0;Wj{vQHPD8dQIanzpK=kC zy(h~}PgFGKkn>C!I^tPG5Lb#4|6K91`# zWB^QK+~T3WD7eXz-9_uaj8eHbSa$Z3eb1SK(fc)fHEZhFl0;7%w)TXS>GFP((4dVl zhZF~8NP%>O0Nq)_Jn!vamKAGwZ{$a{`c4!+BRr5cLc(+97b3)Gi zs=3Bu{GRYp>wJLqH-!Z1F^i_LJ9(^FBj0^jt}||Zzbf>kws@x_Ywo(w%7xFCLp=`8 zq&BOS-RE!b&}cOrzGFKEa`rwI%M?mHdz&m$oNhM6(N#jK$0vu9^7fFro&6_m#D{Q# z`)d5$kREY6K2F{hvWfnQyZaJVM`1(FxRcCl&eYgkmX6&e%)@t&&}lnQR=sdvbV5mt1$u1-Vi6v&8Yn!mGboZuK2 z9~!eQF+!|yJoMhcKZ_-|tI_t!{39n}C< zkOJB~oH+EO`?_JZrsiksZP zB}VBEE4o%j(-;o=ju-W^I|RABM|un33^|4`h5~f*Z%S$s0mfcTPK{d^j{L0{TcI)m z8W~Ml*GME+KG|@$x7DvRY2-hhw?-8Z-?(u@!@gPTotpgIA8{p-lEYP5$(U}u_Q8Yn zqv>0b4YLB>j73V5E7{at|2z|=nj593)V6}2@xA^$xTl-dF0|&BH5F;AC0s=jI#?Ck z?=j>+eSP^Ng`52-wB+?KuV$(C&TuEl#Ibq~=66hKg|=5ao}|Co%Q1JBiZ}NsyniBc z*8aeWz{^ZS+**%K`DaB(+iB(b>zwNS%Z1ljIGgZjD8sXTpg-M+)i=MZtFNwk4+-Z`o$7J?>wPv@}cXqvG1FP?tv7`f(x(L(CKeTJfaw@BK*{}jr5 z97;DW4_`>*WXHDF+dh*1UB)KP0;pH+2^2ApLU zJ;S*BTC2lRplrx+3p9GinM>m$icj3`e0EYVl8q66M%vCPh7#((x1Rsj=v{2t@z$XW ztn3W3eyX4HTh~WxFTOggyCT{4CJu&>%p0sZxJq9sidJ;uMzIJXfsy|GIuC_1rRl=4jaKiinlE@?F27Jm@PBi%E(-OIn_54e zN3lF*jyD_9p&}ZqXAZ$K2DM}e-RVE!f8GtGWBv3RS)F%(a_2xybQRCf@EuyMcYN`+ zyr%HzA24E&JD}18Nr^O76h@on;UO;n_$*-7xp;+@=5D@n!N2ZNZflOg#&=x zS0M2G=cy?vO90pnxh|b}Py!%P;@)0P zUS8M8&f?E+!dd0vv(Y?O8gZQRNaI_2v=Xr_qvrmdo)>NtBsh%20F#>5+1W|-?}CzY z4FhYWC#srTF=+HEfKFim9=yKOzt7PIgDYhJRjnQXm?2X_*UbecG{o*_l{B>JN=8lX z!+h<_uebWe?Tw9BrfsV^GUQki6B3wLb{H-jR2a+Q9>Mo_BSvCE(RA#8ZdTi|L!57x z9g50V+krxgAu5r?glOXaGZxf)CPFwF(*y@mog(0HaFQVoMYuA!xVXo_Y}X0^eLWQW zKmZcd&5#zf5IG}*X!in;;!Poyr{F6As|XSEqC2Q%7M5bS0eFL zsDIkuG(Dz^GJ_A#wiR;B%(mLXDG;lz>5CU3+YtSPH+@4(C_rvG*B6&- zC5q+i!HOos0<|5hfHj9i_U^Ena+Dbvkc1(03IR^w^PaEzT-=3l5dg^3JhlYN*s{P& z4LN$4@xXZK#jL?5O9-L=iJ2K-l9xZlJNqXL$~o6sWJ-jKnWtZj7o|70+U1E%mk&OD7GKX9OAQt;e}NBKmsR- z+WVbqNCSAH^QLY0k%Z;wGdq>Sk^fwa5Br7Gj^m3UC%#@-j9|ZkfQ|(Bi|h8VV2~im zBUT{JOiQ5}ySlJIPRWVnj6h2P6;EJxFe2SsNw(YTd$f)4xDnR1FLTI$0#h*ZMyQ4q zY8CGxC~HU#J=(JBf=MWC_0|i$yq^f}e&YZzzmQMbgA^B0J0~p7fRAsOg%L#_-X>mP z*T-E8=5~-nOG`_`9iF<&GBG{1xU=&fvIUTVO-xE6SH-&r(y*l`%b; z#jA1NC0txIK|CmH;mS3&RZ>}lbL%68aQQR-6CEH(`#`~cuwWop3|{N2<1!YE(f@OW zf8o#*hN>-CrEWzPM$kZ-Et8owQxOsx5I{!K6)+V4ml30rB}7c)aA{^wN2{Ss2GN5c zc3&tbM9N!0`Kv-)3XFZY2_2BbKs>l0yI+9f93z-NIB>2M%6$hP!LM&Fh*hyE#SJXT z@Bqvoxx(W?_s$rky$JLlVCKii{Gi1^`18EHZD3`6uL`ze0e=2DWIj5qZdiuY3I`4% zP(dbMC|S7Qc0Ys;3cs+Z`ANP{zNjRnrd}0+NHx?rRwpDSEj*e%!9{$;S&_oVHa115 zGB?ti`me;S2U185hr(*ZgVKzpJr#HQ3sAjCXkcyf*I+kfu zVKhEw`U>fFetvK~G|-U3S42?!Kw^ir3arg=8_|%=5LoKHU`G0PG`k8@_)_u3dhxNl z?Wq?C(vevlTjL8Xh)}W7(jqaaoTHwBTcvy7`?#4pngJ7%Z)Dxv^7PdAu zi4iEwPtLsL1vw^6P%vH9fM@{nQw)k~aK&IE_`lr#?KN4L9kA3GwMA+mA^KgP{e0!Q zVPLm3pNNQvMCOZ1T>`ef64Mv>H5r_fbFz|;!z`s-aD}Kw>54Drk3TeWSrSA9?sV$t{e=mk_LFUj9$(gjj+E)ryBZwoQykCE%XJY@?_u4jC zE|F&riV5oe4#^`Bc#vPimiPEic|WA`VGV{t0VooL>XsXCz~hhvYCcL1}!=G_>d(SQg={F1Cv=oa&p$l3&j2c#Rf1Tg+)e|L(LZ0 z;$aelLM{;Xf-e_djoF|t^2^u;=i|q{$H#62YilW|sh9#GbcpC?ex4R)IjD9ZmIRql zFzoF#wX{G8(RkzqnLy4q4lqm)4-+H9qTwzRlO=C5lGFo9J$4ZfsA<){a~%$>BP*s285} zJC#q`$PPFqr?KCiqp?V;)Usc#K%-wadDh>bV{_%x=Oko%wZqc}yDN0xMk!mtCP;w< zbD&_!nE!RMpYqrvO~3z>Gz=4%FeAPH(j)os>DpKBNb!!45F2W=HI#%vtmNCbE+|?5 zpHl`}S2S5#VYz8bXyPk^Wv1R<6#r@A2&`_UrKNNQ#q{i8kJ@yFN|8VlZ+r}x!eD!Z zf^w1-}<`xzuF^2xsnmP5J;jw_jNUG5!N_Q5EGf|v_UFl)3ug^x?1->w_9l5(p{ZVb_dFg54B?lbfG9 zu7>m=N1LXx+f6B%T8I9NxM_Ru&?6Zlu85Nc=5%3EP1{DoqqAgMn6F5VAu4M7{Jx?z z)ANY}E~)*jxI)32J)H*)NmF2RfkgPxKf2?O&vEL{$12C-(j9Rxz!s)o926VPffGcv zk~KnL_*A1w5aMGY^OlcNCzlT$%xd6l)}Txm8E*; ztE;y?%zAFuN5{6x$}1%&Bdta$6cnoRm8*XAMqXjT&_z)hbp7|B+)|=|Gb*+hH3sVH z5@RLWkkH2`a(Foms*^z;iD*}@4LV4`mWim{fgoV6?BWq|?sw1Wd@N1P(XN7flsYUi zp`RWA<4}cC1IISRnkfk|A)_8jNn4* zLeP87K7jtqm$Y|l-oYsH^PJl_!=|s}%L}n>H`kIcQaWw_~f3j+K2O{hY+Eyz<%i-?ipkR|&};j`{&3Mb7o?2ThwZrz@>tmwnG>&d<0N z?}`47%-iC+6WJbz_SY2UH;;_lwUF_%oSV^>sr+iY|zPpevL#ANH-!p>%Y zp&MIe*2f3Ofl`ap(YwjtKqMsdlg(x7<&2#HiHA#fme2Ot;&h8kchYRGFqOAR{Y{^g z8M@z*S$LVsA5B=dGhhj1p)NaD9K5`fTTtF%UBt3i_f0_Muvk#psEg1bop|Yf@4-I5qFUzA zP^7ADrb;iCUhLw$#mh5wX(Q5T3!Q_K54kLoWVspEqt-<(2UDkuz1S7`-}TM*GMcqL!p9L?k`<8mMnP~^kepy#m`S_0~%k>{_g=+@sC}G@KNrmT+-LZ(%&nF*O za!^_CI8Ys-nSyreoAXno{w!y!{Y4*zZi{SPY}4%=MNGPAScgCGaWd(VP#>$KaF357 zxn^Xen&eZnlfffO`fc`m9o4C5=s!%MXJf6{$uFuP|TqQuE% zxy({_{J#9$^!6=`+c86Cp}5O^KD;9CK%S9mImKF03zO=)xdg9;{91$WF8SUn#ZJ1v z-ZaQ~n5SE=@0uK39E;?}Os43q-1l(tT^`%lAU?1E$2FUGdb4}G!B#Zomh(Yk?!h>} zi1=Z)$(K-JAEV+(GcV(gm#tu>>Aa$$J2&vjob$>ypO&0rC?8L0ZEx+!&8{1PG;@1# z_t4-3tA&Rxs`x`CWfmyNJpNU!AT~1oqH{g4^B6HYp5o?>oM~xfl56n$*So=ZVh&q%}HAf+*HT z(zmoaWO&ao`F;E!v=3ryunX4x?kUH~;ZY$KYSC@c*-0x#poyV!vEjY0G(NqJ1ReHvhXi`If5g zhFrk0wQJfc@v^@YvE<0-%dTWqEK>G4=6>K9VK%+b{57*}A}8@-HCm+FQ#*o0y~?%c ziOa=F!$Z4&e|@k&{RtiYMrc((U2=#&FUd8kiT>sF#{=}f$xhxJjS@n8VP#AAnc@4T z7fD6dN8BRuk@Xin4M)al{AyMbb#*(pYhrG;$NVg&3O%SOcs5zzBiN6vY{RDfC|P-L zD!+4KqTDF$=R1@ijSx0l%?&FCC=s1g(3ulv?^h*#+*iLUTH~Hp;O4(5s<{8q*^dV0 zXCHQQ^N=8*zuP2)Z_pKf(zG9;Jr__OC}^8sSgU-iJi=KNA4Amb0{_b0x?_c2UY7(l zO`>@?DADv>T@bsak3(g`+LzUm46jAgLqs0qX($pzaE?Bo8I;=NP4tbq?VDf3Pe11$mbOd|g zO!w0P7PbMYMm(O=+JXvm7?0ZWSMI!QzefdSZ7EpP*7w1gczNV=X;)T8RRq^aE3h*D zas$G@W-bRhuaXE(aHeG4C0Byx`uz^t+C>>dWOzmuE~X%2R9CkY01omLNR%KZH; zrsE!VClcAKDWl?926HMyW0P)~xV-vpwQK9r__0fD-o;n*Rddtgvt}h$brA}2-m{Ae z@5i$1et)wa3ZAhm6RO<3Gxotu6X$jJvXu!3>_@!PER-Ix!>vvucC>LnOkufV5thNs z=BpXt>y)Np+(8hYtGn_t}rvM=N!zS4jvs?*3~OdeIcP zT8Ph}|D#bNY&7x_%8zAm{eGe-J~U-lzI08gf0=&nEtIDyA+WjdaC_nAi-t>Vdo~!r zcvV!UY@W;Tu3Ei9*M2B!5BSz5CTB8VU1It&^zB-EXw^3gXV=tI?*;xe$Kuh3{VDg1 zefLv?SG#FUyz6J@tk*jKNQ8YeE7@}Vf<5&O`&bs6UxX!dYvzKj@L4K}Xx$Zz8A2B2 z4tUVm*(~IK2sAE5&+1q=lB>Iv^O0H)>Jr43K66hqDPqKF?rMrP(=kijFTWekx#S)( z`Yq(lFZkn*?{c{qq`f~Xhx$BXIovF~P46PV^m(9nKZOG)?{qzKHgt{#mD{#1`?Qz$ zvC(Mpw$t>fYxHr7$7e>q=v^iJ01MxQxiltt^ONU>?rEIl;ZH~3b0^zYnSN9mO?A_U zOqupqIj^VnuP)skR>$^@zffh{h0((2NlnOQ0q>j%>`mY(Dx!rI9-|seEU6MKEwZs+ z7{d7|m|Kx7Tne&>(F{xOeTE#+F9I#X&GYZ!w8!}tYG%p9uS=?^XX3dTi+$PZf}JEZ zk7%4JMF*Id%T`Y@%0{c1TwlF|9cTUQc|Ocx8f=;KX>{;O-Q_hJM3xRWlW~Hs_7xR7 zK|kL@b|e2Cr^^}KpdfG;6eH2$kj%LlWnm-eNrae(10-99xR>Fe51~FN^L0BI(SoYl zY-TKox79$51R|405S1+Zc87{;@8WD53D#!BB5k+Tv);+@3SJo|EFpfN%PSrOqpdn! z*`Ot~3|e`%uF;=sQ&CYN{aYZ;Tx zf4_q~k+!y>3zN?PNvh08B&GJhlmenPrHp-;4H9OgSqySd;o;$V3&!3|%#y$Fe}_pH z9yue}2iT^VwWvr$t)9>S6WKxJx9vzE>0;jJANxXf=a#>o_ipHA5Cxy`G9n{J%%*VZ zXQ6rLzy6(ekqgcb>;}2aScsnSKcjT9&%X^wSp0+x8qRe@)VzX7sYT8v`j3+vPLkzl zK%~5DcX?=sn7fexQ62>NNO6?@tS+Jwm_wj67NnP#NTl7i8n7D>I(FQgtdzDjc;%jJ zrK@wxLQ*j)7vf!p9EPu6kreTO9+p8CHsw&`e6bTGV!t`bgR~(Ta?By(QTNr4AHCh$9OoYH_Os*BVp+wgDG4q~6s^Id3J^j{|`^uM};Jo*G$4`d+x55i>Vqu0#QTwkCMvDRzzVf zl|=yYJ%}AO2jP{DI>Nx$cVE5*qX*i{R*__-Z1hf%omVKRXpy)x7}g;nV2o&JAufd|x+Q%r{1U+>~KNB>aOIY_J zZA<^xx&(I+GHei!J{~FdZteHEaH{`*&Anw*lyCGdOd}-?10qTYGvp8o2vP#l&A?DH zjC6xYOG}q@mmu9O-O?b8v`Q)^@k0br&pn?1I$zG$_kGvP;sfhp;(qSfdq4ZSuDws< zT)R4%Yjdz?z`u6Kb(9d1||GPZgI7=rP>y?S)fUH)m7@z*LwMEm?BJ)3Vu!zy@Seu&IiYoY z!x{!_DOR9$N0f{xe`s4O@P^KE-AfOE~=;$pTUylL&12xF2e{I9TJb=ek zEbxcj_uf*V%98Y-pXhbJ?~g!|8(5oEdRNdy7UavZMiAI^u#(mQ%jDZ*OXS- z@o#X_fjOZW5dwzf#CyU5UKam>tZljiC?mi&p1x(nV`QDPZN!IRo;%6FYIeb4J_EhQ zkH7c)p&Z^6%4QU7XlfdC72n#K%*Kk=_{M?qw=8TLG{y#cr+e{e>=2SlVLew1wSXS5 zwJ{U}I?p%oRVt|H(53F5gEqkeGC%t$v5NM}|2VNY8uk*_oPPtHlwSeB+hLCnNJ?Y% z#bCb(m~{*;RAQZ6)tr@gp#-pCY74-&f=|8%l^GskHS3`G0;p<|jMXYPH#hUVbOx9h z>1nOW5cW76W7|vv=+;0)K@c=w1}dz@)zvB*$S-6QHgk{d-|qi25!hE?3Bdxyj-Y|) z^dHEJZAuLcP`>{u379X?%pH6!RvOB}Vo_bKU;%Du)X#K0LpPdJg@=0IW(P>00Dprw zroii5n$+zrDRxRFZN~6y;`;U)*zwXd-wgnGcM98f++wEqgL7j;$1v#q8+bYX6gVAT z!O z176){w*m04tqK4!^vV4G0Dc>f20zFXcQhPtA(dV$_#ZmdQWLN-3OF7c2A+eN7!N~@{!_+d zRmA`S#kR5r2ppXv&{kGiqs_sF1GWo%D|Sy|QO$8-a9b6owkQbAE9?XVVD^#%d;G;& zu;>TC{s27%6dBQP6qL*bRYMv9?jBCYSh3Z1$Nv~N@OtwO79juL{YwCR4LJ7=;Qv_2 zM3fmDpV&8pRRZtEnbK_ms8u`tQ&1ZM4DIX1FVF*=5={@bT4t zEm+||0MKfyx`8+YEbuS{h$Ds}SU?e|tV4ue0e~>ZCGgiu>OGHufZW=ELx)svGZ3Ny zstOi^2NVmyKLVf%wog5$O2tyax^L$0B^tTW53j090!hsgAuw7H-vG-7>>uFi)R=dT z0SXN`pn7;GG3t3h7kLWaeO*txsHQgEAsKSFGYDFOC6-9Bo{d%3&N(*M1?fodRw!P+ zaTON%!z;HWvL$$WNtjDtG2$&{>1h?-^!(#}W{o+~O%Oqf$5(E3Nvl*hrvXeE>~p{* z`QmCc+eVn;~O5@A5^50Mm3TRjXhMSP$fn!Gd9oK@lQg zxh=uM)YtccHGmHTW{@(=h;22%A>Yi}>Ng79iX-yLOD=`QDHTTxIy}gxQ|z0X0)ch} zI4OW|0G4vl%`{#y^owhx&@1OwwX9MsBLR$VQ6_K?#0>yq1@~CADFe|15>yt<=m(#X#ArN|C%YJ|7{5|}nt$H%IQ29S|YFpjzw|g^!nD~0@``^6O1%udd)AmI^ zCyHeTi~CZA?os`s;3@2LtIDz-JrG>?mq$G{A5WOJJJ%*gW9Lmiq>T_g1S7?pc5jBHVDH^f1j!(O5Hk>8X)c@Ba!9Ixa?i1DPlo<6;7 z$lV+or*rQzUo*XoNYec2D)Zs7v$6(+=LzEJ1K!v@=9LT73nsY1ltas>Mo&4L&CY9~ zU*GrhwW3L~bA|Q@OBp+K=yG{je+%U!Y+trCVbC&Yx-?n4qiq#kl= zM}tBZ58Yy*s$=K5Mr2Jy)k5l3O@goZox9EYKvdC_&uVKgoAFvp1PRu`QlXv&px4d>&4Cm+|`l}nOUBPx%x8mWThWkB+J)693OsEv|nSF zSaHeUJ!(Q{neCugS)0EvStZ<)=c{?1(p(^_vuaWDZnV2YYxWk60(F#uf^Dnwk>uN% zhrQ5Jf}Fo%-+wX<0E?#ey5r-hhxMw@GznN?x!<^7ewK3$N7v@n&a=O9;F*wLb!=#_ zmwUU!PR;?O^BGyD9m*68@P5T!pT|3u z6GUtNj1Ec`j$1Ml7gln{Xk=A=oTp1rl_rRf9S_3Jl8J=f%qdPqWCNgJ8SD&C{FPnVt>=~nMtV)K3d7WGzH z8TP@CHw6?hth6qI%+d@)#EcOrqwSxSWGzdEa#T|f{# zJAZZO=`kAa+O$btS^k;3YAMr`yJu&YQRLlkRvh!><*33wm=@=AQ=}e0r^dc%G4ld} z6dm)yts3HCyk#ghGr99J^zy;fx^^1af5_x_I6hQeSg_^zLG^-@oVd z-;M+e3-#yAMvzvAL{;e7(W0fu0tPg zN)?m$o$PB48=j_jy$*NxBezr^Mi;nQ(Zo~#{c(Taprt)#a5kOxk{LTC&l|aTbDq6V zw>Q?Jq;~Bmi%8h`$;XW{Yx6O*5BTLXX!6)Z zi=*Q|?la`Ef;=iCk&E0fsdSo0XL~D|hSx)e4gq`)zK?{sN6Gc&s95q1JbV$oljf2N zgO6@0^pXg&~7W3NFHR#E>{Rtg|W#a{5{?v*3EF)QU+rKq^<7G2gQ*@lE%1 zyoiCS8pz~Qh1C+lO3t5W?s_|6lfzVDB2ieYh5bw7F+tA15cz4OFI`%5z93o9@itgw zY}6bAw*hkxUPU06Ap(Ysy>xeiiT(4xOH@1L)UN+7-SBwze|=m(cJ8s?K!BS1fBWOU zkQJs>bP=CNdWLhy{GX9<_+xH+S3t-h+C-JTMbI0gIz~BJ6m@Mbq88d^r&02_E&gxE z_{XeTx@if=EP^rxyYE)$FI8OIjO8u6Q*!fHo)29t@uWzKl2RZqGg5HIaKe8%;*T~t z2;s=Yrh_3(`ET9|Hz*2ckNqP z;G$q8|Ak(Bvy|$;*coP{)(gXL!EyA-$3RK%R&6Em5bE7qc03etUej2!Bk8#&=qpg2 zeVZ4ASGJ7c?yjKi$vz@W33y*YNxS{0DL$EO z{I?r(j)qq9OxvwR`Mamzv3j3b=fo)BJ$1aw;9E}J7dfV2-RDW$Q}ENN%w|Gzc93S zgXUp|>8%|jwd5mSM>`2o^*d>Sf@xT21jQ=;4sWWbHKpE(R1{*+xSA5O)1=)(%Q!8N zV?gp2`QHI7f8m?kWpr}3WVOj3@y^7o2H}OPfMu_3Dh*^mkAq3I$XLg8bSC@(m!%5= zn)`y>Tv?N1x}4Zi8*(7@D>FMqxPDxtG<@RbyMIRvA8e2EtTijuk#D+CBsoTF^!i{& zvwd@a`R`l(zG8J%ZlkN5fsbi_AFW$+|7bkWC|JEl3Vtq#y{s&U2#$76=!i(>(U_NL zpMBrYo##ffJGEbjY34usT17TAEu~4;as7MsMGMV_^NNZ>UcY|NY!#!a0@e(`DRcO7 z#bS8w^{14TX}p)R7S1-`(ew8Hn4`6)BgMvKG2S(QFDGlS%CC0Zh5JRxd#{vF?HsNR z8c0R$>K*)#TmcA7EwV*NPdD{^Jk4?uGyJxpKXrWUJ$ntsHbE2rq1}sy#;dZ9wfTg> zJDHU3*-&|hOwOd7m$(iN3?s?6i$$_L?ER?Sfm!K4n^>ZCWq_*UQWN}~a2fOcSfsdw zH?N>T_h7_GtpG3O^mOWdd_Mz}&KP#F&eL>LXiJ?l@|RY+e1Fgz1v%(UtWEH5fSvS+h?!>DtoIHyt*SHUBYYBgL9T?|2C`Ud>L%2ez-h ziW;yxBPH5|UyE=kRQJb<=;#WcorTAXaj{fwJA3#zH@@+k--blof6H%R>gIi}c_sWvNj$3mS# zS}6>KboE6AJj_T!@xR!Rd;a4=`+D_koM5D6B2d2UzkkE8<~g7Q8K!_8>e37^|4iMg-c ztU|v&_06od(fp(w(%Vr)dya)tK}0QqYhw^}k8{L;5Q5LKN+DCnplACW(sAq0qWJl1 zXyjwV7dZQ-u9>s~4~{?JsRmjU-qjj+W}D0%v{wJfb2mc~_sOPajo zI?%_TF40-gymAe0D;mB6yeb2_j@8np-ni2cc2~q`zdd_()N>pJDy2yKXhG#kOnr0{ zJeK5!fovIFd$5k&J<9>x*QEo{Q8#uSd{w0Uc8?)czDd_gY;8VjY_2R9+DN*gq#Vq< zmdX@!Q?wrMw(aSuc6Fx0J^TIP-ZTc~Nlx99|Mc0;7p4BW_5QPQkor~pl9S98#5OZd z!9j=KcK#_>U<(U>pKA~ceZf9yuO9F531;)3P8?SU`8|^?YaGdDNN~X4k=biHF;Y{#iYjT zdUG-4V*C_I%ABqWjViqq0c(N0~q2_h#*rIR-s>uq*r>AP&S+PU-lRPnZJNB`n4GAx|_; z-TH2+QM>TBM$(0`5fpkHSus6pr@c#HHSrQots|kmHMRNC74%D}>aSBBKsEOh3Dl^= z;Kr!vtP}Ni3HoR|w-!lAqlb8D^NeLVEsb#07CyK3OZm5(Mx^TP%K}Jh-u${J6 zOt&^I(V8*y?bX5ds}(%x8VTS#qB})9j#;DrJaR@X*9atldfZnDG!v%SE(?=h7zPc)) z_{MX?G-;@`eOu86(GM8|j8Znm%IS27Mtv&FpxC(bi^Q%viFiq_hXDRfC8pLF7j0{| zl3E^a*#%Ff8#yLHcv^O$W|JuSK_DhH# z8jV+t_s~uD4Sn&%>m5QB7AjacKVN1&9fCS68fvj|iog3>ox;w!y*;3JtqXsOINQ`d zf}mtbkk4S%mE7xxpJ`9)z$=5TaWiI2yW>g}yMTsHrss&0S|t)5k~<*ewe6om1Ccdq)Dh`@Z~PtL^$j zTHD>x=bZvzA=XRp2}`<@=5&OeDEjDtrM@+A6pV50MNFSXudBGyw;;{d_o`y0X2xSm zy?^f7T%hv5xDFn6MI6|`GV6^92T*c7=`>H+COIudN83GJ2iMpiN8s|`PNWo$k0*M* zLNXph6094m`=&eSpt!zphob%5 zB4KEXxr?Q!*WIReIxZJKt(XBVe>2!Ge7kRyD*nq4^Rc~-dt~$x;oDQ@38sVxR_Qai ztB)Y=`=|u?_}AUU^qOg*I+=+!FZi=>raK$!xA;nVPC{w_sxVo}Z(vB&rW|v-lIoeh2XUapTHV(9$PyUu^CD}ahFf(uO=-bg% z$6?uW-L)P35&DQ|llon;5R#)bUBMCGi6dU6CwKPO*p??z7F|_QJi`|V{Z)ctxYlLVFoXNhuCPCh9Kx$eJ+w8P$TQhzJNN|^?aXgspv)p> zJDg~uR)MEZ^%`%bI7jAF_sDuEagK?(g^y1ZdfR^$zQ* z+oQficfSnaPFjbKr!%yBiEa${x{3-PyzCgCU8gSA89TNOQsD==WBA+C;~ z^-*^?OMQT=GV2IPg3k$(HWb~Rr}it3t;Z0!Ma+)6vk9A;o3KMauP&3iRl%8waNK&A z$9URFgdXmMn)sD*qFC-nGDy~~K3mm2_~CJM#8MaNJqnM7-2P!}8rjyFQLs#rHdRf# zA0*>+$CC6hvjU%)_!D8)`D$JaKt^sT5mn|L$Lb)gy(?Ls^;)IV}4rxY? zf0!5|9brXEWW}_?W5{ab;@4aqv+VYsUt3m0Lp~d^`5jg&X?x^GXJDWA^Uwf>6xlvd zb7E_VE&p6DAY5wD5+k80}SrJtubK@dVGEyBo>x zR=!$?mc-p3t|-XgUcDphl7Ws+5x;R`lj;`l(RYeEw+Wp1l32gZ(fSZDVy!~;>G zFL;C3sd+R=#_=elFwZwKl$qjv16~k~{}%y!5<$$VqE6Q#%ALJ$1~Rh5l$7w_(gSS+ z;=GVujvud>)|3YAc`aS-Xv0hEB>W;Ccep9=k^++L=_mbo@$W|T|FSGnBjAzChObop z{wz6u+B>J^hechB&kD8w`vrTHT;JZ(zdjIA=0CB#C+tvpTV2S)RWw9SRmLz@l2}(NPN!t_bl2p}edeVD(D43B?<4PsbR=7%p`LB%r=WI#-S_G!qK6d`1XH@Y&4ku{eGg zSzYJ4$zS~C!Cnwyk049}%nfE+TMbNmSa~d!d z?N@U&V&smW7E5m5E9?Ah;gz7JuJrJ0LyiLZ6vlu_BVpKo zS4~LPh3zSc%tM&p)X1#HhVI^$+b6Dng9sm$=5in0 zCTEgaEk=>6RTFj~Xq(yl*_tLYlsK&2V5J}Lz%@r4`I^1$%2irvXVo5NNWCrjT(X_9 zm8x;`X2R%Pijq(fDtnN?mJp?e!ep(o{*Vy&mn~LCni%g`7U}57Hs12EWnZS4v?t)V zKyEj2Jl2P#HE)dRDy%9;nrJX&<35C!X{!G{zCrrfi*4sxUV(*~fx(g)6&dd_)r!`R zhN?x`Qt=qs+tyTh*|k_Qq_cNaxdQoo`R&&P)W5Yqe1H3lD2>6ykx!A6IlhP?KYnD3 zQ1ljwTbZ2~jnZV8IY-e-TvRH10v#`f2J$?H%E&Ry)YR;=#p2uiAG6_R`eR|;pL5E%xQKG2HPahzPTs54NF1FkxIL%t)abkwZRH^n+<_gSf|L)Sf%(ubF&Lf+QInkiIcUWqvJaJGeNNV<|F zCJ+%8Q#UPVg_pYf90jfSYS72Mdwaxa&|!ZRT}lfZc0jzfdN;s;(9)`Nfo)J2Lo& z7kj)b16#fnV`;7f^VjX8(oZ){Kl>wOY1E0|hthHl8(VHG3%+#&`gSq#) z4zqx7K%119`j=00o?sXj+m=%;KIN{CQZB+Np$iuZlhaNcb>D8Esre6)cdKDlJh;HD z@1ma>kG>#v*yynl7cE8>MS(HKyKPAp+DBu*tEzFvf+j~n+KWzWex<^NtVkjX==j0~ z#Y)uJ^hw)0^<|`=R0mQ7ln{|2A988Gf|8m_u`ugl{54|w%Y~|Q%XniL1{Ea`;ck0y z9xvOf6+5G=3NlHRmYsmKHfbG*&1<0A(zwS;Mi+)#!S_AYBvhUjsuAS5d6P3(DZQj) z7-J@N{c^y)EZ}+w-AQs;b%9FG?lD*`d|m!Mav%eqt?K5^fM$m`2*}lrZxv zD7pX+)cqMIZ|~zDTHi`v@+m&OXf&2kyE}5|koKNXiL2m$XeR2t61zq3+_X$H+l2^> zX%`408wlyBzMX#SGloX*9o1BMRw#do?p+C)f!*2V7-TAWURdByQ|}WT&-J*b>I{~} z?p32$S*J*Z3#CuJ;u4IhmCP^Z<#sWZrmLb=g^Y@{ev(a>uj%CpFOen2Eu4!zBQL@4 zhq}vaw4dWCA`6=N9tZRM&KYB@b{%o%m-`ys#cWk4eGx%a>~7QipEr!M1V+p=WQu zQFjefb-1lsc;3V|lS}{M^(6a`e{}rIodXha6VjBq4O+{n`jXV~qJcU($C82*Pp}2A z_14X7RYkOxN)c8ChIW>Eq}86y4&1S2gn>x-FtSJ923PepK}l|1g8BD8THwYD$57i8R>y$vNFVx6639nGK}UPu<*Pq?x3mcCB@|Jw83xj(2Fe%41In}ZPCl6! z#LdpbF&hi<#4SsD=D*z}K9=cDEi)9A@g!fJRCyLlDM5Dzlv5 zk#kqgBrjmy(TIZO=R5(M2|VHt@*`_4p3R*Mx9|IH*7nF8dbV65ozBG9vMwEYC4^?( z7A_KmX${5$GG00*Wg&I&A7mKoJMC4YMt&6cB=)+E6qLUocTe9-LW`~u8u(@Yrk-d@ zl*9xni(u{89|;qnOSF+bZ5OcbA6+|Lh*iBRnrAO#U08)-O0R6jzcC*-)#UBmoL`5F ztwc=K(8{hOiFkq+1?#}1>UsM( z>$lrgV&`pMf0+2))IH{<^XIp!R=zhm=W-(VzBuQ{&|(a&& zoxYPYrqrj(e!k~tR`iLKA0-vTbGI_{hPW;A$kQ$!O|zWG3LU+v`ADgjQ}sVNe8Bq4 zr0hMp)iM25rrH0+5{Zzj>OxaL3~yI-&EvJ=QB#O!0*!BD{D2*wY9yo$QP zg=C<_HA@`r@+q6c2)|p)RZqCRaJW+H)gi&hZ#I#wSN81d*j3!kZRGy!e^`+z>Dkq} zK#M}eE%@g)p0QZZihO@N_!-@SW78CGQtH?~9fkAofzW3o$q%Q91!Windows 10 and later + - ✅ Windows 11 and later --- @@ -16,13 +19,15 @@ manager: aaroncz The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10, version 1703. +[!INCLUDE [Deprecate Windows Information Protection](includes/wip-deprecation.md)] + ## Integration with Azure AD MAM on Windows is integrated with Azure Active Directory (Azure AD) identity service. The MAM service supports Azure AD-integrated authentication for the user and the device during enrollment and the downloading of MAM policies. MAM integration with Azure AD is similar to mobile device management (MDM) integration. See [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md). MAM enrollment is integrated with adding a work account flow to a personal device. If both MAM and Azure AD-integrated MDM services are provided in an organization, a user's personal devices will be enrolled to MAM or MDM, depending on the user's actions. If a user adds their work or school Azure AD account as a secondary account to the machine, their device will be enrolled to MAM. If a user joins their device to Azure AD, it will be enrolled to MDM. In general, a device that has a personal account as its primary account is considered a personal device and should be enrolled to MAM. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices. -On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD-integrated application, such as the next update of Microsoft Office 365 or Microsoft Office Mobile. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**. +On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD-integrated application, such as the next update of Microsoft 365 apps. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**. Regular non-admin users can enroll to MAM. @@ -34,15 +39,15 @@ To make applications WIP-aware, app developers need to include the following dat ``` syntax // Mark this binary as Allowed for WIP (EDP) purpose - MICROSOFTEDPAUTOPROTECTIONALLOWEDAPPINFO EDPAUTOPROTECTIONALLOWEDAPPINFOID - BEGIN - 0x0001 - END +MICROSOFTEDPAUTOPROTECTIONALLOWEDAPPINFO EDPAUTOPROTECTIONALLOWEDAPPINFOID + BEGIN + 0x0001 + END ``` ## Configuring an Azure AD tenant for MAM enrollment -MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. With Azure AD in Windows 10, version 1703, onward, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you've already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration. +MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Windows 10, version 1703 and later, the same cloud-based Management MDM app in Azure AD will support both MDM and MAM enrollments. If you've already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration. :::image type="content" alt-text="Mobile application management app." source="images/implement-server-side-mobile-application-management.png"::: @@ -127,13 +132,3 @@ In the process of changing MAM enrollment to MDM, MAM policies will be removed f - EDP CSP RevokeOnMDMHandoff is set to false. If the MAM device is properly configured for MDM enrollment, then the Enroll only to device management link will be displayed in **Settings > Accounts > Access work or school**. The user can select this link, provide their credentials, and the enrollment will be changed to MDM. Their Azure AD account won't be affected. - -## Skype for Business compliance with MAM - -We've updated Skype for Business to work with MAM. The following table explains Office release channels and release dates for Skype for Business compliance with the MAM feature. - -|Update channel|Primary purpose|LOB Tattoo availability|Default update channel for the products| -|--- |--- |--- |--- | -|[Current channel](/deployoffice/overview-update-channels#BKMK_CB)|Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.|March 9 2017|Visio Pro for Office 365
Project Desktop Client
Microsoft 365 Apps for business (the version of Office that comes with some Microsoft 365 plans, such as Business Premium.)| -|[Deferred channel](/deployoffice/overview-update-channels#BKMK_CBB)|Provide users with new features of Office only a few times a year.|October 10 2017|Microsoft 365 Apps for enterprise| -|[First release for deferred channel](/deployoffice/overview-update-channels#BKMK_FRCBB)|Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.|June 13 2017|| diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 37aae00014..b3940204c7 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -1,6 +1,6 @@ --- -title: Manage Windows 10 in your organization - transitioning to modern management -description: This article offers strategies for deploying and managing Windows 10, including deploying Windows 10 in a mixed environment. +title: Manage Windows devices in your organization - transitioning to modern management +description: This article offers strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. ms.prod: windows-client ms.localizationpriority: medium ms.date: 06/03/2022 @@ -10,15 +10,16 @@ ms.reviewer: manager: aaroncz ms.topic: overview ms.technology: itpro-manage +appliesto: + - ✅ Windows 10 and later + - ✅ Windows 11 and later --- -# Manage Windows 10 in your organization - transitioning to modern management +# Manage Windows devices in your organization - transitioning to modern management -Use of personal devices for work, and employees working outside the office, may be changing how your organization manages devices. Certain parts of your organization might require deep, granular control over devices, while other parts might seek lighter, scenario-based management that empowers the modern workforce. Windows 10 offers the flexibility to respond to these changing requirements, and can easily be deployed in a mixed environment. You can shift the percentage of Windows 10 devices gradually, following the normal upgrade schedules used in your organization. +Use of personal devices for work, and employees working outside the office, may be changing how your organization manages devices. Certain parts of your organization might require deep, granular control over devices, while other parts might seek lighter, scenario-based management that empowers the modern workforce. Windows offers the flexibility to respond to these changing requirements, and can easily be deployed in a mixed environment. You can shift the percentage of Windows devices gradually, following the normal upgrade schedules used in your organization. -Your organization might have considered bringing in Windows 10 devices and downgrading them to an earlier version of Windows until everything is in place for a formal upgrade process. This downgrade may appear to save costs due to standardization. But, you typically save more if you don't downgrade, and immediately taking advantage of the cost reductions Windows 10 can provide. Because Windows 10 devices can be managed using the same processes and technology as other previous Windows versions, it's easy for versions to coexist. - -Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as Microsoft Configuration Manager, Microsoft Intune, or other third-party products. This "managed diversity" enables you to empower your users to benefit from the productivity enhancements available on their new Windows 10 devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows 10 much faster. +Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as Microsoft Configuration Manager, Microsoft Intune, or other third-party products. This "managed diversity" enables you to empower your users to benefit from the productivity enhancements available on their new Windows devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows much faster. This six-minute video demonstrates how users can bring in a new retail device and be up and working with their personalized settings and a managed experience in a few minutes, without being on the corporate network. It also demonstrates how IT can apply policies and configurations to ensure device compliance. @@ -27,7 +28,7 @@ This six-minute video demonstrates how users can bring in a new retail device an > [!NOTE] > The video demonstrates the configuration process using the classic Azure portal, which is retired. Customers should use the new Azure portal. [Learn how use the new Azure portal to perform tasks that you used to do in the classic Azure portal.](/information-protection/deploy-use/migrate-portal) -This article offers guidance on strategies for deploying and managing Windows 10, including deploying Windows 10 in a mixed environment. It covers [management options](#reviewing-the-management-options-with-windows-10) plus the four stages of the device lifecycle: +This article offers guidance on strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. It covers [management options](#reviewing-the-management-options-with-windows-10) plus the four stages of the device lifecycle: - [Deployment and Provisioning](#deployment-and-provisioning) - [Identity and Authentication](#identity-and-authentication) @@ -36,55 +37,49 @@ This article offers guidance on strategies for deploying and managing Windows 10 ## Reviewing the management options with Windows 10 -Windows 10 offers a range of management options, as shown in the following diagram: +Windows offers a range of management options, as shown in the following diagram: :::image type="content" source="images/windows-10-management-range-of-options.png" alt-text="Diagram of the path to modern IT." lightbox="images/windows-10-management-range-of-options.png"::: -As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like group Policy, Active Directory, and Configuration Manager. It also delivers a "mobile-first, cloud-first" approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, Office 365, and the Microsoft Store for Business. +As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like group Policy, Active Directory, and Configuration Manager. It also delivers a "mobile-first, cloud-first" approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, and Microsoft 365. ## Deployment and provisioning -With Windows 10, you can continue to use traditional OS deployment, but you can also "manage out of the box." To transform new devices into fully configured, fully managed devices, you can: +With Windows, you can continue to use traditional OS deployment, but you can also "manage out of the box". To transform new devices into fully configured, fully managed devices, you can: -- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management service such as [Windows Autopilot](/mem/autopilot/windows-autopilot) or [Microsoft Intune](/mem/intune/fundamentals/). +- Avoid re-imaging by using dynamic provisioning, enabled by a cloud-based device management service such as [Windows Autopilot](/mem/autopilot/windows-autopilot) or [Microsoft Intune](/mem/intune/fundamentals/). - Create self-contained provisioning packages built with the Windows Configuration Designer. For more information, see [Provisioning packages for Windows](/windows/configuration/provisioning-packages/provisioning-packages). - Use traditional imaging techniques such as deploying custom images using [Configuration Manager](/mem/configmgr/core/understand/introduction). -You have multiple options for [upgrading to Windows 10](/windows/deployment/windows-10-deployment-scenarios). For existing devices running Windows 8.1, you can use the robust in-place upgrade process for a fast, reliable move to Windows 10 while automatically preserving all the existing apps, data, and settings. This process usage can mean lower deployment costs, and improved productivity as end users can be immediately productive - everything is right where they left it. You can also use a traditional wipe-and-load approach if you prefer, using the same tools that you use today. +You have multiple options for [upgrading to Windows 10 and Windows 11](/windows/deployment/windows-10-deployment-scenarios). For existing devices running Windows 10, you can use the robust in-place upgrade process for a fast, reliable move to Windows 11 while automatically preserving all the existing apps, data, and settings. This process usage can mean lower deployment costs, and improved productivity as end users can be immediately productive - everything is right where they left it. You can also use a traditional wipe-and-load approach if you prefer, using the same tools that you use today. ## Identity and authentication -You can use Windows 10 and services like [Azure Active Directory](/azure/active-directory/fundamentals/active-directory-whatis) in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **"bring your own device" (BYOD)** or to **"choose your own device" (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them. +You can use Windows and services like [Azure Active Directory](/azure/active-directory/fundamentals/active-directory-whatis) in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **"bring your own device" (BYOD)** or to **"choose your own device" (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them. You can envision user and device management as falling into these two categories: -- **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows 10, your employees can self-provision their devices: +- **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows, your employees can self-provision their devices: - - For corporate devices, they can set up corporate access with [Azure AD join](/azure/active-directory/devices/overview). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud. + - For corporate devices, they can set up corporate access with [Azure AD join](/azure/active-directory/devices/overview). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud. Azure AD join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. - - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](/azure/active-directory/devices/overview) to add their work account to Windows, then access work resources on the device. + - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](/azure/active-directory/devices/overview) to add their work account to Windows, then access work resources on the device. - **Domain joined PCs and tablets used for traditional applications and access to important resources.** These applications and resources may be traditional ones that require authentication or accessing highly sensitive or classified resources on-premises. - With Windows 10, if you have an on-premises [Active Directory](/windows-server/identity/whats-new-active-directory-domain-services) domain that's [integrated with Azure AD](/azure/active-directory/devices/hybrid-azuread-join-plan), when employee devices are joined, they automatically register with Azure AD. This registration provides: + With Windows, if you have an on-premises [Active Directory](/windows-server/identity/whats-new-active-directory-domain-services) domain that's [integrated with Azure AD](/azure/active-directory/devices/hybrid-azuread-join-plan), when employee devices are joined, they automatically register with Azure AD. This registration provides: - - Single sign-on to cloud and on-premises resources from everywhere + - Single sign-on to cloud and on-premises resources from everywhere + - [Enterprise roaming of settings](/azure/active-directory/devices/enterprise-state-roaming-enable) + - [Conditional access](/azure/active-directory/conditional-access/overview) to corporate resources based on the health or configuration of the device + - [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-identity-verification) + - Windows Hello - - [Enterprise roaming of settings](/azure/active-directory/devices/enterprise-state-roaming-enable) - - - [Conditional access](/azure/active-directory/conditional-access/overview) to corporate resources based on the health or configuration of the device - - - [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-identity-verification) - - - Windows Hello - - Domain joined PCs and tablets can continue to be managed with the [Configuration Manager](/mem/configmgr/core/understand/introduction) client or group policy. - -For more information about how Windows 10 and Azure AD optimize access to work resources across a mix of devices and scenarios, see [Using Windows 10 devices in your workplace](/azure/active-directory/devices/overview). + Domain joined PCs and tablets can continue to be managed with [Configuration Manager](/mem/configmgr/core/understand/introduction) client or group policy. As you review the roles in your organization, you can use the following generalized decision tree to begin to identify users or devices that require domain join. Consider switching the remaining users to Azure AD. @@ -92,19 +87,19 @@ As you review the roles in your organization, you can use the following generali ## Settings and configuration -Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. With Windows 10, you can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer. +Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. You can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer. -**MDM**: MDM gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, group policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using group policy that requires on-premises domain-joined devices. This provision makes MDM the best choice for devices that are constantly on the go. +- **MDM**: MDM gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, group policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using group policy that requires on-premises domain-joined devices. This provision makes MDM the best choice for devices that are constantly on the go. -**Group policy** and **Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer's 1,500 configurable group policy settings. If so, group policy and Configuration Manager continue to be excellent management choices: +- **Group policy** and **Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level using group policy settings. If so, group policy and Configuration Manager continue to be excellent management choices: -- Group policy is the best way to granularly configure domain joined Windows PCs and tablets connected to the corporate network using Windows-based tools. Microsoft continues to add group policy settings with each new version of Windows. + - **Group policy** is the best way to granularly configure domain joined Windows PCs and tablets connected to the corporate network using Windows-based tools. Microsoft continues to add group policy settings with each new version of Windows. -- Configuration Manager remains the recommended solution for granular configuration with robust software deployment, Windows updates, and OS deployment. + - **Configuration Manager** remains the recommended solution for granular configuration with robust software deployment, Windows updates, and OS deployment. ## Updating and servicing -With Windows as a Service, your IT department no longer needs to perform complex imaging (wipe-and-load) processes with each new Windows release. Whether on current branch (CB) or current branch for business (CBB), devices receive the latest feature and quality updates through simple - often automatic - patching processes. For more information, see [Windows 10 deployment scenarios](/windows/deployment/windows-10-deployment-scenarios). +With Windows as a Service, your IT department no longer needs to perform complex imaging (wipe-and-load) processes with each new Windows release. Whether on General Availability Channel or Long-Term Servicing Channel, devices receive the latest feature and quality updates through simple - often automatic - patching processes. For more information, see [Windows deployment scenarios](/windows/deployment/windows-10-deployment-scenarios). MDM with Intune provide tools for applying Windows updates to client computers in your organization. Configuration Manager allows rich management and tracking capabilities of these updates, including maintenance windows and automatic deployment rules. @@ -116,9 +111,9 @@ There are various steps you can take to begin the process of modernizing device **Assess the different use cases and management needs in your environment.** Are there groups of devices that could benefit from lighter, simplified management? BYOD devices, for example, are natural candidates for cloud-based management. Users or devices handling more highly regulated data might require an on-premises Active Directory domain for authentication. Configuration Manager and EMS provide you the flexibility to stage implementation of modern management scenarios while targeting different devices the way that best suits your business needs. -**Review the decision trees in this article.** With the different options in Windows 10, plus Configuration Manager and Enterprise Mobility + Security, you have the flexibility to handle imaging, authentication, settings, and management tools for any scenario. +**Review the decision trees in this article.** With the different options in Windows, plus Configuration Manager and Enterprise Mobility + Security, you have the flexibility to handle imaging, authentication, settings, and management tools for any scenario. -**Take incremental steps.** Moving towards modern device management doesn't have to be an overnight transformation. New operating systems and devices can be brought in while older ones remain. With this "managed diversity," users can benefit from productivity enhancements on new Windows 10 devices, while you continue to maintain older devices according to your standards for security and manageability. The CSP policy [MDMWinsOverGP](./mdm/policy-csp-controlpolicyconflict.md#mdmwinsovergp) allows MDM policies to take precedence over group policy when both group policy and its equivalent MDM policies are set on the device. You can start implementing MDM policies while keeping your group policy environment. For more information, including the list of MDM policies with equivalent group policies, see [Policies supported by group policy](./mdm/policy-configuration-service-provider.md). +**Take incremental steps.** Moving towards modern device management doesn't have to be an overnight transformation. New operating systems and devices can be brought in while older ones remain. With this "managed diversity," users can benefit from productivity enhancements on modern Windows devices, while you continue to maintain older devices according to your standards for security and manageability. The CSP policy [MDMWinsOverGP](./mdm/policy-csp-controlpolicyconflict.md#mdmwinsovergp) allows MDM policies to take precedence over group policy when both group policy and its equivalent MDM policies are set on the device. You can start implementing MDM policies while keeping your group policy environment. For more information, including the list of MDM policies with equivalent group policies, see [Policies supported by group policy](./mdm/policies-in-policy-csp-supported-by-group-policy.md). **Optimize your existing investments**. On the road from traditional on-premises management to modern cloud-based management, take advantage of the flexible, hybrid architecture of Configuration Manager and Intune. Co-management enables you to concurrently manage Windows 10 devices by using both Configuration Manager and Intune. For more information, see the following articles: @@ -130,5 +125,5 @@ There are various steps you can take to begin the process of modernizing device ## Related articles - [What is Intune?](/mem/intune/fundamentals/what-is-intune) -- [Windows 10 policy CSP](./mdm/policy-configuration-service-provider.md) -- [Windows 10 configuration service providers](./mdm/index.yml) +- [Policy CSP](./mdm/policy-configuration-service-provider.md) +- [Configuration service providers reference](./mdm/index.yml) diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index 712795c303..5e90998e48 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -1,10 +1,10 @@ --- title: Push notification support for device management description: The DMClient CSP supports the ability to configure push-initiated device management sessions. -MS-HAID: - - 'p\_phdevicemgmt.push\_notification\_support\_for\_device\_management' - - 'p\_phDeviceMgmt.push\_notification\_windows\_mdm' -ms.reviewer: +MS-HAID: + - 'p\_phdevicemgmt.push\_notification\_support\_for\_device\_management' + - 'p\_phDeviceMgmt.push\_notification\_windows\_mdm' +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -14,7 +14,6 @@ author: vinaypamnani-msft ms.date: 09/22/2017 --- - # Push notification support for device management The [DMClient CSP](mdm/dmclient-csp.md) supports the ability to configure push-initiated device management sessions. Using the [Windows Notification Services (WNS)](/previous-versions/windows/apps/hh913756(v=win.10)), a management server can request a device to establish a management session with the server through a push notification. A device is provided with a PFN for an application. This provision results in the device getting configured, to support a push to it by the management server. Once the device is configured, it registers a persistent connection with the WNS cloud (Battery Sense and Data Sense conditions permitting). @@ -27,58 +26,67 @@ Because a device may not always be connected to the internet, WNS supports cachi The following restrictions are related to push notifications and WNS: -- Push for device management uses raw push notifications. This restriction means that these raw push notifications don't support or utilize push notification payloads. -- Receipt of push notifications is sensitive to the Battery Saver and Data Sense settings on the device. For example, if the battery drops below certain thresholds, the persistent connection of the device with WNS will be terminated. Additionally, if the user is utilizing Data Sense and has exceeded their monthly allotment of data, the persistent connection of the device with WNS will also be terminated. -- A ChannelURI provided to the management server by the device is only valid for 30 days. The device automatically renews the ChannelURI after 15 days and triggers a management session on successful renewal of the ChannelURI. It's strongly recommended that, during every management session, the management server queries the ChannelURI value to ensure that it has received the latest value. This will ensure that the management server won't attempt to use a ChannelURI that has expired. -- Push isn't a replacement for having a polling schedule. -- WNS reserves the right to block push notifications to your PFN if improper use of notifications is detected. Any devices being managed using this PFN will cease to have push initiated device management support. -- On Windows 10, version 1511 as well as Windows 8 and 8.1, MDM Push may fail to renew the WNS Push channel automatically causing it to expire. It can also potentially hang when setting the PFN for the channel. +- Push for device management uses raw push notifications. This restriction means that these raw push notifications don't support or utilize push notification payloads. +- Receipt of push notifications is sensitive to the Battery Saver and Data Sense settings on the device. For example, if the battery drops below certain thresholds, the persistent connection of the device with WNS will be terminated. Additionally, if the user is utilizing Data Sense and has exceeded their monthly allotment of data, the persistent connection of the device with WNS will also be terminated. +- A ChannelURI provided to the management server by the device is only valid for 30 days. The device automatically renews the ChannelURI after 15 days and triggers a management session on successful renewal of the ChannelURI. It's strongly recommended that, during every management session, the management server queries the ChannelURI value to ensure that it has received the latest value. This will ensure that the management server won't attempt to use a ChannelURI that has expired. +- Push isn't a replacement for having a polling schedule. +- WNS reserves the right to block push notifications to your PFN if improper use of notifications is detected. Any devices being managed using this PFN will cease to have push initiated device management support. +- On Windows 10, version 1511 as well as Windows 8 and 8.1, MDM Push may fail to renew the WNS Push channel automatically causing it to expire. It can also potentially hang when setting the PFN for the channel. - To work around this issue, when a 410 is returned by the WNS server when attempting to send a Push notification to the device the PFN should be set during the next sync session. To prevent the push channel from expiring on older builds, servers can reset the PFN before the channel expires (~30 days). If they’re already running Windows 10, there should be an update available that they can install that should fix the issue. + To work around this issue, when a 410 is returned by the WNS server when attempting to send a Push notification to the device the PFN should be set during the next sync session. To prevent the push channel from expiring on older builds, servers can reset the PFN before the channel expires (~30 days). If they’re already running Windows 10, there should be an update available that they can install that should fix the issue. -- On Windows 10, version 1511, we use the following retry logic for the DMClient: - - If ExpiryTime is greater than 15 days, a schedule is set for when 15 days are left. - - If ExpiryTime is between now and 15 days, a schedule set for 4 +/- 1 hours from now. - - If ExpiryTime has passed, a schedule is set for 1 day +/- 4 hours from now. +- On Windows 10, version 1511, we use the following retry logic for the DMClient: + - If ExpiryTime is greater than 15 days, a schedule is set for when 15 days are left. + - If ExpiryTime is between now and 15 days, a schedule set for 4 +/- 1 hours from now. + - If ExpiryTime has passed, a schedule is set for 1 day +/- 4 hours from now. -- On Windows 10, version 1607, we check for network connectivity before retrying. We don't check for internet connectivity. If network connectivity isn't available, we'll skip the retry and set schedule for 4+/-1 hours to try again. - +- On Windows 10, version 1607, we check for network connectivity before retrying. We don't check for internet connectivity. If network connectivity isn't available, we'll skip the retry and set schedule for 4+/-1 hours to try again. ## Get WNS credentials and PFN for MDM push notification To get a PFN and WNS credentials, you must create a Microsoft Store app. -1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. +1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. - ![mdm push notification1.](images/push-notification1.png) -2. Create a new app. + ![mdm push notification1.](images/push-notification1.png) - ![mdm push notification2.](images/push-notification2.png) -3. Reserve an app name. +1. Create a new app. - ![mdm push notification3.](images/push-notification3.png) -4. Click **Services**. + ![mdm push notification2.](images/push-notification2.png) - ![mdm push notification4.](images/push-notification4.png) -5. Click **Push notifications**. +1. Reserve an app name. - ![mdm push notification5.](images/push-notification5.png) -6. Click **Live Services site**. A new window opens for the **Application Registration Portal** page. + ![mdm push notification3.](images/push-notification3.png) - ![mdm push notification6.](images/push-notification6.png) -7. In the **Application Registration Portal** page, you'll see the properties for the app that you created, such as: - - Application ID - - Application Secrets - - Microsoft Store Package SID, Application Identity, and Publisher. +1. Click **Services**. - ![mdm push notification7.](images/push-notification7.png) -8. Click **Save**. -9. Close the **Application Registration Portal** window and go back to the Windows Dev Center Dashboard. -10. Select your app from the list on the left. -11. From the left nav, expand **App management** and then click **App identity**. + ![mdm push notification4.](images/push-notification4.png) - ![mdm push notification10.](images/push-notification10.png) -12. In the **App identity** page, you'll see the **Package Family Name (PFN)** of your app. +1. Click **Push notifications**. -  + ![mdm push notification5.](images/push-notification5.png) + +1. Click **Live Services site**. A new window opens for the **Application Registration Portal** page. + + ![mdm push notification6.](images/push-notification6.png) + +1. In the **Application Registration Portal** page, you'll see the properties for the app that you created, such as: + +- Application ID +- Application Secrets +- Microsoft Store Package SID, Application Identity, and Publisher. + + ![mdm push notification7.](images/push-notification7.png) + +1. Click **Save**. + +1. Close the **Application Registration Portal** window and go back to the Windows Dev Center Dashboard. + +1. Select your app from the list on the left. + +1. From the left nav, expand **App management** and then click **App identity**. + + ![mdm push notification10.](images/push-notification10.png) + +1. In the **App identity** page, you'll see the **Package Family Name (PFN)** of your app. From c58dbeeadc4c621a88248f6b4d00439c5adbee38 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 29 Mar 2023 16:21:26 -0400 Subject: [PATCH 012/139] Mo changes --- .../azure-active-directory-integration-with-mdm.md | 2 ++ .../implement-server-side-mobile-application-management.md | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 6b68056cbc..4063a64e10 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -118,6 +118,8 @@ IT administrators use the Azure AD app gallery to add an MDM for their organizat > [!NOTE] > You should work with the Azure AD engineering team if your MDM application is cloud-based and needs to be enabled as a multi-tenant MDM application +To publish your application, [submit a request to publish your application in Azure Active Directory application gallery](/azure/active-directory/manage-apps/v2-howto-app-gallery-listing) + The following table shows the required information to create an entry in the Azure AD app gallery. |Item|Description| diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index 9ca937ac05..702e05c056 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -19,7 +19,7 @@ appliesto: The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10, version 1703. -[!INCLUDE [Deprecate Windows Information Protection](includes/wip-deprecation.md)] +[!INCLUDE [Deprecate Windows Information Protection](../security/information-protection/windows-information-protection/includes/wip-deprecation.md)] ## Integration with Azure AD From aa70cdd108fadfff4bdedc07cfe231e70d8cf577 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 30 Mar 2023 13:29:46 -0400 Subject: [PATCH 013/139] Add appliesto --- .../mobile-device-enrollment.md | 52 +++++++++++-------- 1 file changed, 30 insertions(+), 22 deletions(-) diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index 361556d8dd..1b82a7ca7f 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -8,7 +8,10 @@ ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 08/11/2017 +ms.date: 03/29/2023 +appliesto: + - ✅ Windows 10 and later + - ✅ Windows 11 and later ms.collection: - highpri - tier2 @@ -20,17 +23,17 @@ Mobile device enrollment is the first phase of enterprise management. The device The enrollment process includes the following steps: -1. Discovery of the enrollment endpoint +1. Discovery of the enrollment endpoint - This step provides the enrollment endpoint configuration settings. + This step provides the enrollment endpoint configuration settings. -2. Certificate installation +1. Certificate installation - This step handles user authentication, certificate generation, and certificate installation. The installed certificates will be used in the future to manage client/server Secure Sockets Layer (SSL) mutual authentication. + This step handles user authentication, certificate generation, and certificate installation. The installed certificates will be used in the future to manage client/server Secure Sockets Layer (SSL) mutual authentication. -3. DM Client provisioning +1. DM Client provisioning - This step configures the Device Management (DM) client to connect to a Mobile Device Management (MDM) server after enrollment via DM SyncML over HTTPS (also known as Open Mobile Alliance Device Management (OMA DM) XML). + This step configures the Device Management (DM) client to connect to a Mobile Device Management (MDM) server after enrollment via DM SyncML over HTTPS (also known as Open Mobile Alliance Device Management (OMA DM) XML). ## Enrollment protocol @@ -39,28 +42,33 @@ There are many changes made to the enrollment protocol to better support various The enrollment process involves the following steps: ### Discovery request - The discovery request is a simple HTTP post call that returns XML over HTTP. The returned XML includes the authentication URL, the management service URL, and the user credential type. + +The discovery request is a simple HTTP post call that returns XML over HTTP. The returned XML includes the authentication URL, the management service URL, and the user credential type. ### Certificate enrollment policy + The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in \[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](/openspecs/windows_protocols/ms-xcep/08ec4475-32c2-457d-8c27-5a176660a210) ### Certificate enrollment + The certificate enrollment is an implementation of the MS-WSTEP protocol. ### Management configuration + The server sends provisioning XML that contains a server certificate (for SSL server authentication), a client certificate issued by enterprise CA, DM client bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. The following topics describe the end-to-end enrollment process using various authentication methods: -- [Federated authentication device enrollment](federated-authentication-device-enrollment.md) -- [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) -- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) +- [Federated authentication device enrollment](federated-authentication-device-enrollment.md) +- [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) +- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) -> [!Note] +> [!NOTE] > As a best practice, don't use hardcoded server-side checks on values such as: -> - User agent string -> - Any fixed URIs that are passed during enrollment -> - Specific formatting of any value unless otherwise noted, such as the format of the device ID. +> +> - User agent string +> - Any fixed URIs that are passed during enrollment +> - Specific formatting of any value unless otherwise noted, such as the format of the device ID. ## Enrollment support for domain-joined devices @@ -112,7 +120,7 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma ``` -**Sample error messages** +**Sample error messages**: - **Namespace**: `s:` - **Subcode**: MessageFormat @@ -156,7 +164,7 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma - **Description**: The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator. - **HRESULT**: 80180007 -In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here's an example: +In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here's an example: ```xml @@ -188,7 +196,7 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. ``` -**Sample error messages** +**Sample error messages**: - **Subcode**: DeviceCapReached - **Error**: MENROLL_E_DEVICECAPREACHED @@ -229,7 +237,7 @@ TraceID is a freeform text node that is logged. It should identify the server si ## Related topics -- [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) -- [Federated authentication device enrollment](federated-authentication-device-enrollment.md) -- [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) -- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) +- [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) +- [Federated authentication device enrollment](federated-authentication-device-enrollment.md) +- [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) +- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) From 2e369df59a80ef0d8363961de22a38ef273cd531 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 11:28:39 -0600 Subject: [PATCH 014/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index bba06682d2..4793bed70f 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -42,6 +42,8 @@ Windows Update for Business reports uses the following Delivery Optimization ter - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. ## Calculations for Delivery Optimization +There are sevaral calculated values that appear on the Delivery Optimization report. Here is a list of them with the associated formula. +Bandwidth Savings (BW SAV%): Volume from the CDN is calculated with the following formula: BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache @@ -75,4 +77,4 @@ UCDOAggregatedStatus ### Sample query 2 -Explanation of what the query displays \ No newline at end of file +Explanation of what the query displays From f369472d8f51768e2236e2cbd10206c7c3c94f41 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 14:37:36 -0600 Subject: [PATCH 015/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 35 ++++++++++++++++---- 1 file changed, 29 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 4793bed70f..d7ce172121 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -40,14 +40,31 @@ Windows Update for Business reports uses the following Delivery Optimization ter - If bandwidth savings are <= 60% a *Warning* icon is displayed - When bandwidth savings are <10% an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. +- **P2P Device Count**: The device count is determined by the number of devices that have received bytes from peers, for supported content types. +- **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. [Learn more] (https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache) +- **MCC Device Count**: The device count is determined by the number of devices that have received bytes from the cache server, for supported content types. +- **Total # of Devices**: The total number of devices with activity in last 28 days! +**LAN Bytes**: Bytes delivered from LAN peers. +**Group Bytes**: Bytes from Group peers. If a device is using Group DownloadMode, Delivery Optimization will first look for peers on the LAN and then in the Group. Therefore, if bytes are delivered from LAN peers, they will be calculated in 'LAN Bytes'. +**CDN Bytes**: Bytes delivered from Content Delivery Network (CDN). +**City**: City is determined based on the location of the device where the maximum amount of data is downloaded. +**Country**: Country is determined based on the location of the device where the maximum amount of data is downloaded. +**ISP**: ISP is determined based on the ISP delivering the maximum bytes to the device. ## Calculations for Delivery Optimization -There are sevaral calculated values that appear on the Delivery Optimization report. Here is a list of them with the associated formula. -Bandwidth Savings (BW SAV%): - -Volume from the CDN is calculated with the following formula: -BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache - +There are sevaral calculated values that appear on the Delivery Optimization report. +- Bandwidth Savings (BW SAV%) = BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ +(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) * 100.0 (UCDOAggregatedStatus table) +- % P2P Efficiency = (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) +- % MCC Efficiency = BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) +- TotalBytes = BytesFromCDN + BytesFromEnterpriseCache + BytesFromPeers + BytesFromGroupPeers (UCDOAggregatedStatus table) +- BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache (UCDOAggregatedStatus table) +- BytesFromPeers = BytesFromLAN (UCDOAggregatedStatus table) +- BytesFromGroupPeers = BytesFromGroupPeers (UCDOAggregatedStatus table) +- BytesFromCache = BytesFromCache (UCDOAggregatedStatus table) +- Volume by P2P = BytesFromPeers + BytesFromGroupPeers (UCDOStatus table) +- Volume by MCC = BytesFromCache ((UCDOStatus table) +- Volume by CDN = BytesFrom CDN (UCDOStatus table) ## Determine GroupID @@ -78,3 +95,9 @@ UCDOAggregatedStatus ### Sample query 2 Explanation of what the query displays + + +### Frequency Asked Questions + +**Data is showing as 'Unknown', what does that mean?** +You may see data in the report listed as 'Unknown'. This indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. From 8d20454eedf352910b86733540cf790cb4e8374c Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 14:41:11 -0600 Subject: [PATCH 016/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index d7ce172121..daefc53d19 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -43,25 +43,28 @@ Windows Update for Business reports uses the following Delivery Optimization ter - **P2P Device Count**: The device count is determined by the number of devices that have received bytes from peers, for supported content types. - **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. [Learn more] (https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache) - **MCC Device Count**: The device count is determined by the number of devices that have received bytes from the cache server, for supported content types. -- **Total # of Devices**: The total number of devices with activity in last 28 days! -**LAN Bytes**: Bytes delivered from LAN peers. -**Group Bytes**: Bytes from Group peers. If a device is using Group DownloadMode, Delivery Optimization will first look for peers on the LAN and then in the Group. Therefore, if bytes are delivered from LAN peers, they will be calculated in 'LAN Bytes'. -**CDN Bytes**: Bytes delivered from Content Delivery Network (CDN). -**City**: City is determined based on the location of the device where the maximum amount of data is downloaded. -**Country**: Country is determined based on the location of the device where the maximum amount of data is downloaded. -**ISP**: ISP is determined based on the ISP delivering the maximum bytes to the device. +- **Total # of Devices**: The total number of devices with activity in last 28 days. +- **LAN Bytes**: Bytes delivered from LAN peers. +- **Group Bytes**: Bytes from Group peers. If a device is using Group DownloadMode, Delivery Optimization will first look for peers on the LAN and then in the Group. Therefore, if bytes are delivered from LAN peers, they will be calculated in 'LAN Bytes'. +- **CDN Bytes**: Bytes delivered from Content Delivery Network (CDN). +- **City**: City is determined based on the location of the device where the maximum amount of data is downloaded. +- **Country**: Country is determined based on the location of the device where the maximum amount of data is downloaded. +- **ISP**: ISP is determined based on the ISP delivering the maximum bytes to the device. ## Calculations for Delivery Optimization There are sevaral calculated values that appear on the Delivery Optimization report. +**% Effiency Calculations** - Bandwidth Savings (BW SAV%) = BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ (BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) * 100.0 (UCDOAggregatedStatus table) - % P2P Efficiency = (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) - % MCC Efficiency = BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) +**Bytes Calculations** - TotalBytes = BytesFromCDN + BytesFromEnterpriseCache + BytesFromPeers + BytesFromGroupPeers (UCDOAggregatedStatus table) - BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache (UCDOAggregatedStatus table) - BytesFromPeers = BytesFromLAN (UCDOAggregatedStatus table) - BytesFromGroupPeers = BytesFromGroupPeers (UCDOAggregatedStatus table) - BytesFromCache = BytesFromCache (UCDOAggregatedStatus table) +**Volume Calculations** - Volume by P2P = BytesFromPeers + BytesFromGroupPeers (UCDOStatus table) - Volume by MCC = BytesFromCache ((UCDOStatus table) - Volume by CDN = BytesFrom CDN (UCDOStatus table) From 6d6be15d29fb35a957befd9800be8249e374fb92 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 14:42:29 -0600 Subject: [PATCH 017/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index daefc53d19..c9429c6563 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -53,17 +53,20 @@ Windows Update for Business reports uses the following Delivery Optimization ter ## Calculations for Delivery Optimization There are sevaral calculated values that appear on the Delivery Optimization report. -**% Effiency Calculations** + +**Effiency (%) Calculations** - Bandwidth Savings (BW SAV%) = BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ (BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) * 100.0 (UCDOAggregatedStatus table) - % P2P Efficiency = (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) - % MCC Efficiency = BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) + **Bytes Calculations** - TotalBytes = BytesFromCDN + BytesFromEnterpriseCache + BytesFromPeers + BytesFromGroupPeers (UCDOAggregatedStatus table) - BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache (UCDOAggregatedStatus table) - BytesFromPeers = BytesFromLAN (UCDOAggregatedStatus table) - BytesFromGroupPeers = BytesFromGroupPeers (UCDOAggregatedStatus table) - BytesFromCache = BytesFromCache (UCDOAggregatedStatus table) + **Volume Calculations** - Volume by P2P = BytesFromPeers + BytesFromGroupPeers (UCDOStatus table) - Volume by MCC = BytesFromCache ((UCDOStatus table) From c1c00f74c23315aa5bae94664959c92582b6e927 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 14:44:04 -0600 Subject: [PATCH 018/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index c9429c6563..1cd4e75799 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -69,7 +69,7 @@ There are sevaral calculated values that appear on the Delivery Optimization rep **Volume Calculations** - Volume by P2P = BytesFromPeers + BytesFromGroupPeers (UCDOStatus table) -- Volume by MCC = BytesFromCache ((UCDOStatus table) +- Volume by MCC = BytesFromCache (UCDOStatus table) - Volume by CDN = BytesFrom CDN (UCDOStatus table) ## Determine GroupID From 645bb7965ba3ea8e2378d4f44324fb81abccdaad Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 15:07:55 -0600 Subject: [PATCH 019/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 1cd4e75799..3a91654ec4 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -74,13 +74,18 @@ There are sevaral calculated values that appear on the Delivery Optimization rep ## Determine GroupID -In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded hash. You can determine the **GroupID** from the hash, or determine the hash for a given **GroupID**. +In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded SHA256 hash. You can create a mapping of decoded to encoded GroupIDs using the following PowerShell example: -Determine the **GroupID** from the hash: - -Determine the hash for a **GroupID**: +```powershell +$text = "65f64d93-a6c1-446b-95c2-c6117378002c`0" ; +$hashObj = [System.Security.Cryptography.HashAlgorithm]::Create('sha256') ; $dig = $hashObj.ComputeHash([System.Text.Encoding]::Unicode.GetBytes($text)) ; $digB64 = [System.Convert]::ToBase64String($dig) ; Write-Host "$text ==> $digB64" +``` +In addition, you can see the both the encoded and decoded GroupIDs in the Delivery Optimization logs. +```powershell +powershell Get-DeliveryOptimizationLog -Flush | Set-Content C:\dosvc.log +``` ## Sample queries You can use the data in [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) From 4261214df88639bc4acb8c6ddda48ecbfc5d30ec Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 15:24:18 -0600 Subject: [PATCH 020/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 3a91654ec4..7f3c12c953 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -110,5 +110,8 @@ Explanation of what the query displays ### Frequency Asked Questions -**Data is showing as 'Unknown', what does that mean?** +- **What time period does the Delivery Optimization data include?** +Data is available for the last 28 days. + +- **Data is showing as 'Unknown', what does that mean?** You may see data in the report listed as 'Unknown'. This indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. From 3b6cb1f94b93861b46540aecfe7f51a408a43034 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 15:56:51 -0600 Subject: [PATCH 021/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 7f3c12c953..4615b52f79 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -52,7 +52,7 @@ Windows Update for Business reports uses the following Delivery Optimization ter - **ISP**: ISP is determined based on the ISP delivering the maximum bytes to the device. ## Calculations for Delivery Optimization -There are sevaral calculated values that appear on the Delivery Optimization report. +There are sevaral calculated values that appear on the Delivery Optimization report. The table used for each calculation is listed for each, in parenthesis. **Effiency (%) Calculations** - Bandwidth Savings (BW SAV%) = BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ From 9a453c0fc5f6d5dd75ec124d6562c941f4323331 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 16:14:50 -0600 Subject: [PATCH 022/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 4615b52f79..ae6bce2542 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -41,7 +41,7 @@ Windows Update for Business reports uses the following Delivery Optimization ter - When bandwidth savings are <10% an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. - **P2P Device Count**: The device count is determined by the number of devices that have received bytes from peers, for supported content types. -- **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. [Learn more] (https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache) +- **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. [Learn more](https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache) - **MCC Device Count**: The device count is determined by the number of devices that have received bytes from the cache server, for supported content types. - **Total # of Devices**: The total number of devices with activity in last 28 days. - **LAN Bytes**: Bytes delivered from LAN peers. From fc8477dda8ec5465f4676b5124213942a494a463 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 16:23:23 -0600 Subject: [PATCH 023/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index ae6bce2542..be38540a6e 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -77,7 +77,7 @@ There are sevaral calculated values that appear on the Delivery Optimization rep In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded SHA256 hash. You can create a mapping of decoded to encoded GroupIDs using the following PowerShell example: ```powershell -$text = "65f64d93-a6c1-446b-95c2-c6117378002c`0" ; +$text = "" ; $hashObj = [System.Security.Cryptography.HashAlgorithm]::Create('sha256') ; $dig = $hashObj.ComputeHash([System.Text.Encoding]::Unicode.GetBytes($text)) ; $digB64 = [System.Convert]::ToBase64String($dig) ; Write-Host "$text ==> $digB64" ``` From bd0545683cea9e04675af11490e7b60058eca0db Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 31 Mar 2023 16:27:46 -0600 Subject: [PATCH 024/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index be38540a6e..b84046f9ac 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -86,6 +86,16 @@ In addition, you can see the both the encoded and decoded GroupIDs in the Delive ```powershell powershell Get-DeliveryOptimizationLog -Flush | Set-Content C:\dosvc.log ``` +```code + +These two lines are together in verbose logs: + +2023-02-15T12:33:11.3811337Z 1514  1F4          {CGlobalConfigManager::GetGroupId} Using groupID = **** +2023-02-15T12:33:11.3811432Z 1514  1F4          {CGlobalConfigManager::GetGroupId} Hashed groupID = **** +``` + +  + ## Sample queries You can use the data in [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) From b813bf46d4ba379936af7de4a8a0308cdc5e4795 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 3 Apr 2023 11:43:04 -0400 Subject: [PATCH 025/139] Update enrollment --- .../mobile-device-enrollment.md | 153 ++++++------------ 1 file changed, 45 insertions(+), 108 deletions(-) diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index 1b82a7ca7f..863f8db087 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -1,7 +1,7 @@ --- title: Mobile device enrollment description: Learn how mobile device enrollment verifies that only authenticated and authorized devices can be managed by their enterprise. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -9,12 +9,12 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 03/29/2023 -appliesto: - - ✅ Windows 10 and later - - ✅ Windows 11 and later ms.collection: - - highpri - - tier2 +- highpri +- tier2 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Mobile device enrollment @@ -23,21 +23,16 @@ Mobile device enrollment is the first phase of enterprise management. The device The enrollment process includes the following steps: -1. Discovery of the enrollment endpoint - - This step provides the enrollment endpoint configuration settings. - -1. Certificate installation - - This step handles user authentication, certificate generation, and certificate installation. The installed certificates will be used in the future to manage client/server Secure Sockets Layer (SSL) mutual authentication. - -1. DM Client provisioning - - This step configures the Device Management (DM) client to connect to a Mobile Device Management (MDM) server after enrollment via DM SyncML over HTTPS (also known as Open Mobile Alliance Device Management (OMA DM) XML). +1. **Discovery of the enrollment endpoint**: This step provides the enrollment endpoint configuration settings. +1. **Certificate installation**: This step handles user authentication, certificate generation, and certificate installation. The installed certificates will be used in the future to manage client/server Secure Sockets Layer (SSL) mutual authentication. +1. **DM Client provisioning**: This step configures the Device Management (DM) client to connect to a Mobile Device Management (MDM) server after enrollment via DM SyncML over HTTPS (also known as Open Mobile Alliance Device Management (OMA DM) XML). ## Enrollment protocol -There are many changes made to the enrollment protocol to better support various scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](/openspecs/windows_protocols/ms-mdm/33769a92-ac31-47ef-ae7b-dc8501f7104f) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). +There are many changes made to the enrollment protocol to better support various scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see: + +- [[MS-MDM]: Mobile Device Management Protocol](/openspecs/windows_protocols/ms-mdm/33769a92-ac31-47ef-ae7b-dc8501f7104f). +- [[MS-MDE2]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). The enrollment process involves the following steps: @@ -47,7 +42,9 @@ The discovery request is a simple HTTP post call that returns XML over HTTP. The ### Certificate enrollment policy -The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in \[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](/openspecs/windows_protocols/ms-xcep/08ec4475-32c2-457d-8c27-5a176660a210) +The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in [MS-XCEP]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). + +For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](/openspecs/windows_protocols/ms-xcep/08ec4475-32c2-457d-8c27-5a176660a210) ### Certificate enrollment @@ -72,19 +69,7 @@ The following topics describe the end-to-end enrollment process using various au ## Enrollment support for domain-joined devices -Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in **Settings**. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device. - -## Disable MDM enrollments - -In Windows 10 and Windows 11, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. With the GP editor being used, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. - -![Disable MDM enrollment policy in GP Editor.](images/mdm-enrollment-disable-policy.png) - -Here's the corresponding registry key: - -HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM - -Value: DisableRegistration +Devices that are joined to an on-premises Active Directory can enroll into MDM via **Settings** > **Access work or school**. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device. ## Enrollment scenarios not supported @@ -93,6 +78,15 @@ The following scenarios don't allow MDM enrollments: - Built-in administrator accounts on Windows desktop can't enroll into MDM. - Standard users can't enroll in MDM. Only admin users can enroll. +## Disable MDM enrollments + +In Windows 10 and Windows 11, IT admin can disable MDM enrollments for domain-joined PCs using the **Disable MDM Enrollment** group policy. + +Group Policy Path: **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. +Corresponding registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM\DisableRegistration (REG_DWORD)` + +![Disable MDM enrollment policy in GP Editor.](images/mdm-enrollment-disable-policy.png) + ## Enrollment error messages The enrollment server can decline enrollment messages using the SOAP Fault format. Errors created can be sent as follows: @@ -122,49 +116,17 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma **Sample error messages**: -- **Namespace**: `s:` - - **Subcode**: MessageFormat - - **Error**: MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR - - **Description**: Invalid message from the Mobile Device Management (MDM) server. - - **HRESULT**: 80180001 +| Namespace | Subcode | Error | Description | HRESULT | +|-----------|----------------------|-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|----------| +| s: | MessageFormat | MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR | Invalid message from the Mobile Device Management (MDM) server. | 80180001 | +| s: | Authentication | MENROLL_E_DEVICE_AUTHENTICATION_ERROR | The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator. | 80180002 | +| s: | Authorization | MENROLL_E_DEVICE_AUTHORIZATION_ERROR | The user isn't authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator. | 80180003 | +| s: | CertificateRequest | MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR | The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator. | 80180004 | +| s: | EnrollmentServer | MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR | The Mobile Device Management (MDM) server encountered an error. Try again or contact your system administrator. | 80180005 | +| a: | InternalServiceFault | MENROLL_E_DEVICE_INTERNALSERVICE_ERROR | There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator. | 80180006 | +| a: | InvalidSecurity | MENROLL_E_DEVICE_INVALIDSECURITY_ERROR | The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator. | 80180007 | -- **Namespace**: `s:` - - **Subcode**: Authentication - - **Error**: MENROLL_E_DEVICE_AUTHENTICATION_ERROR - - **Description**: The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator. - - **HRESULT**: 80180002 - -- **Namespace**: `s:` - - **Subcode**: Authorization - - **Error**: MENROLL_E_DEVICE_AUTHORIZATION_ERROR - - **Description**: The user isn't authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator. - - **HRESULT**: 80180003 - -- **Namespace**: `s:` - - **Subcode**: CertificateRequest - - **Error**: MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR - - **Description**: The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator. - - **HRESULT**: 80180004 - -- **Namespace**: `s:` - - **Subcode**: EnrollmentServer - - **Error**: MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR - - **Description**: The Mobile Device Management (MDM) server encountered an error. Try again or contact your system administrator. - - **HRESULT**: 80180005 - -- **Namespace**: `a:` - - **Subcode**: InternalServiceFault - - **Error**: MENROLL_E_DEVICE_INTERNALSERVICE_ERROR - - **Description**: There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator. - - **HRESULT**: 80180006 - -- **Namespace**: `a:` - - **Subcode**: InvalidSecurity - - **Error**: MENROLL_E_DEVICE_INVALIDSECURITY_ERROR - - **Description**: The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator. - - **HRESULT**: 80180007 - -In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here's an example: +In Windows 10, version 1507, `deviceenrollmentserviceerror` element was added. Here's an example: ```xml @@ -198,40 +160,15 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. **Sample error messages**: -- **Subcode**: DeviceCapReached - - **Error**: MENROLL_E_DEVICECAPREACHED - - **Description**: The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error. - - **HRESULT**: 80180013 - -- **Subcode**: DeviceNotSupported - - **Error**: MENROLL_E_DEVICENOTSUPPORTED - - **Description**: The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device. - - **HRESULT**: 80180014 - -- **Subcode**: NotSupported - - **Error**: MENROLL_E_NOT_SUPPORTED - - **Description**: Mobile Device Management (MDM) is generally not supported for this device. - - **HRESULT**: 80180015 - -- **Subcode**: NotEligibleToRenew - - **Error**: MENROLL_E_NOTELIGIBLETORENEW - - **Description**: The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device. - - **HRESULT**: 80180016 - -- **Subcode**: InMaintenance - - **Error**: MENROLL_E_INMAINTENANCE - - **Description**: The Mobile Device Management (MDM) server states your account is in maintenance, try again later. - - **HRESULT**: 80180017 - -- **Subcode**: UserLicense - - **Error**: MENROLL_E_USER_LICENSE - - **Description**: There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator. - - **HRESULT**: 80180018 - -- **Subcode**: InvalidEnrollmentData - - **Error**: MENROLL_E_ENROLLMENTDATAINVALID - - **Description**: The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly. - - **HRESULT**: 80180019 +| Subcode | Error | Description | HRESULT | +|-----------------------|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|----------| +| DeviceCapReached | MENROLL_E_DEVICECAPREACHED | The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error. | 80180013 | +| DeviceNotSupported | MENROLL_E_DEVICENOTSUPPORTED | The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device. | 80180014 | +| NotSupported | MENROLL_E_NOT_SUPPORTED | Mobile Device Management (MDM) is generally not supported for this device. | 80180015 | +| NotEligibleToRenew | MENROLL_E_NOTELIGIBLETORENEW | The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device. | 80180016 | +| InMaintenance | MENROLL_E_INMAINTENANCE | The Mobile Device Management (MDM) server states your account is in maintenance, try again later. | 80180017 | +| UserLicense | MENROLL_E_USER_LICENSE | There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator. | 80180018 | +| InvalidEnrollmentData | MENROLL_E_ENROLLMENTDATAINVALID | The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly. | 80180019 | TraceID is a freeform text node that is logged. It should identify the server side state for this enrollment attempt. This information may be used by support to look up why the server declined the enrollment. From 461d252405412ced616350147e45bc2a8eae97a2 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 3 Apr 2023 20:47:23 -0600 Subject: [PATCH 026/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index b84046f9ac..4139eeb730 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -113,9 +113,20 @@ UCDOAggregatedStatus ``` -### Sample query 2 +### Sample UCDOStatus table query -Explanation of what the query displays +The following is the query used to display the Top 10 GroupIDs: + +```kusto +UCDOStatus | where TimeGenerated == _SnapshotTime +| summarize sum(BytesFromCDN) , sum(BytesFromGroupPeers) , sum(BytesFromPeers) , sum(BytesFromCache) , +DeviceCount = count_distinct(GlobalDeviceId) by GroupID | top 10 by DeviceCount desc +| extend TotalBytes = (sum_BytesFromPeers + sum_BytesFromGroupPeers+sum_BytesFromCDN+sum_BytesFromCache) +| extend P2PPercentage = ((0.0 + sum_BytesFromPeers + sum_BytesFromGroupPeers)/TotalBytes ) * 100.0 +| extend MCCPercentage = ((0.0 + sum_BytesFromCache)/ TotalBytes) * 100.0 , + VolumeBytesFromPeers = sum_BytesFromPeers + sum_BytesFromGroupPeers +| extend VolumeBytesFromMCC = sum_BytesFromCache , VolumeByCDN = sum_BytesFromCDN +| project GroupID , P2PPercentage , MCCPercentage , VolumeBytesFromPeers , VolumeBytesFromMCC ,VolumeByCDN , DeviceCount ### Frequency Asked Questions @@ -125,3 +136,6 @@ Data is available for the last 28 days. - **Data is showing as 'Unknown', what does that mean?** You may see data in the report listed as 'Unknown'. This indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. + +-**How is the 'Top 10' groups identified?** +The top groups are represented by the number of devices in a particular group, for any of the four group types (GroupID, City, Country, and ISP). From bbc778f057df6c6cfb0066b1769be920f4585c09 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 3 Apr 2023 20:50:21 -0600 Subject: [PATCH 027/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 4139eeb730..b05a1354b5 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -101,19 +101,19 @@ These two lines are together in verbose logs: You can use the data in [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) and [UCDOStatus](wufb-reports-schema-ucdostatus.md) to create your own queries. Create your custom queries using [Kusto Query Language (KQL)](/azure/data-explorer/kusto/query/), but note that Windows Update for Business reports uses Azure Monitor, so some operators aren't supported. The KQL documentation specifies which operators aren't supported by Azure Monitor or if they have different functionality. For more information about KQL in Azure Monitor, see [Log queries in Azure Monitor](/azure/azure-monitor/logs/log-query-overview). The following queries are examples of how you can use the data: -### Sample query 1 +### Example UCDOAggregatedStatus table query -Explanation of what the query displays +The following is the query used to display the total bandwidth savings % value: ```kusto -UCDOAggregatedStatus -| where Bogus =="SomethingBogus" and Neato =="Something Neat" -| sort by Whatevs -| project Whatevs, Neato, Bogus +UCDOAggregatedStatus| where TimeGenerated == _SnapshotTime +| extend LocalSourceBytes = BytesFromCache + BytesFromGroupPeers + BytesFromPeers +| summarize LocalSources_BWSAV = round((sum(0.0 + LocalSourceBytes)/ sum(LocalSourceBytes+BytesFromCDN)) * 100.0 ,2) +| extend Title = "BW SAV%" , SubTitle = "Local Sources" ``` -### Sample UCDOStatus table query +### Example UCDOStatus table query The following is the query used to display the Top 10 GroupIDs: @@ -127,7 +127,7 @@ DeviceCount = count_distinct(GlobalDeviceId) by GroupID | top 10 by DeviceCount VolumeBytesFromPeers = sum_BytesFromPeers + sum_BytesFromGroupPeers | extend VolumeBytesFromMCC = sum_BytesFromCache , VolumeByCDN = sum_BytesFromCDN | project GroupID , P2PPercentage , MCCPercentage , VolumeBytesFromPeers , VolumeBytesFromMCC ,VolumeByCDN , DeviceCount - +``` ### Frequency Asked Questions From 993d209a99b1e842a52caedc87c4684c943f2fc9 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 3 Apr 2023 20:53:40 -0600 Subject: [PATCH 028/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index b05a1354b5..2fc966007e 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -72,7 +72,7 @@ There are sevaral calculated values that appear on the Delivery Optimization rep - Volume by MCC = BytesFromCache (UCDOStatus table) - Volume by CDN = BytesFrom CDN (UCDOStatus table) -## Determine GroupID +## Mapping GroupID In the **Efficiency By Group** subsection, the **GroupID** is displayed as an encoded SHA256 hash. You can create a mapping of decoded to encoded GroupIDs using the following PowerShell example: @@ -137,5 +137,8 @@ Data is available for the last 28 days. - **Data is showing as 'Unknown', what does that mean?** You may see data in the report listed as 'Unknown'. This indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. --**How is the 'Top 10' groups identified?** +- **How is the 'Top 10' groups identified?** The top groups are represented by the number of devices in a particular group, for any of the four group types (GroupID, City, Country, and ISP). + +- **The GroupIDs don't look familiar, why are they different?** +The GroupID values are encoded for data protection telemetry requirements. You can find more information in the 'Mapping GroupIDs' section above. From a01a1e82d131dae4ed921eb106feb6a92df500ef Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 3 Apr 2023 20:56:21 -0600 Subject: [PATCH 029/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 2fc966007e..6237b36a34 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -93,9 +93,6 @@ These two lines are together in verbose logs: 2023-02-15T12:33:11.3811337Z 1514  1F4          {CGlobalConfigManager::GetGroupId} Using groupID = **** 2023-02-15T12:33:11.3811432Z 1514  1F4          {CGlobalConfigManager::GetGroupId} Hashed groupID = **** ``` - -  - ## Sample queries You can use the data in [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) @@ -111,8 +108,6 @@ UCDOAggregatedStatus| where TimeGenerated == _SnapshotTime | summarize LocalSources_BWSAV = round((sum(0.0 + LocalSourceBytes)/ sum(LocalSourceBytes+BytesFromCDN)) * 100.0 ,2) | extend Title = "BW SAV%" , SubTitle = "Local Sources" ``` - - ### Example UCDOStatus table query The following is the query used to display the Top 10 GroupIDs: From 91a9f4d4a8d7cbf997f3edc1176782310c8dcb60 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 3 Apr 2023 21:05:27 -0600 Subject: [PATCH 030/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 6237b36a34..a094098042 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -124,7 +124,7 @@ DeviceCount = count_distinct(GlobalDeviceId) by GroupID | top 10 by DeviceCount | project GroupID , P2PPercentage , MCCPercentage , VolumeBytesFromPeers , VolumeBytesFromMCC ,VolumeByCDN , DeviceCount ``` -### Frequency Asked Questions +## Frequency Asked Questions - **What time period does the Delivery Optimization data include?** Data is available for the last 28 days. From 9a34494e3daa6a6f970c652a2329f7be69cc1db1 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 3 Apr 2023 21:07:47 -0600 Subject: [PATCH 031/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index a094098042..563f5f1490 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -41,7 +41,7 @@ Windows Update for Business reports uses the following Delivery Optimization ter - When bandwidth savings are <10% an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. - **P2P Device Count**: The device count is determined by the number of devices that have received bytes from peers, for supported content types. -- **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. [Learn more](https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache) +- **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. [Learn more](https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache) about Microsoft Connected Cache. - **MCC Device Count**: The device count is determined by the number of devices that have received bytes from the cache server, for supported content types. - **Total # of Devices**: The total number of devices with activity in last 28 days. - **LAN Bytes**: Bytes delivered from LAN peers. From cc8cad7ff9fc74b98b181bbfc5b595a6dbdb5a11 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Tue, 4 Apr 2023 12:03:20 -0600 Subject: [PATCH 032/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 563f5f1490..65d7d75edd 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -137,3 +137,12 @@ The top groups are represented by the number of devices in a particular group, f - **The GroupIDs don't look familiar, why are they different?** The GroupID values are encoded for data protection telemetry requirements. You can find more information in the 'Mapping GroupIDs' section above. + +- **How can I see data for device in the office vs. out of the office?** +Today, we don't have a distinction for data that was downloaded by location. + +- **What does the data in UCDOStatus table represent?** +A row in UCDOStatus represents data downloaded by a combination of a single device ID (AzureADDeviceId) by content type (ContentType). + +- **What does the data in UCDOAggregatedStatus table represent?** +A row in UCDOAggregatedStatus represents data summarized at the tenant level (AzureADTenantID) for each content type (ContentType). From a44ba87186a79a5e4037468dce053dc3e05a00a7 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 4 Apr 2023 17:46:00 -0400 Subject: [PATCH 033/139] Set appliesto --- .../administrative-tools-in-windows-10.md | 12 +- .../appv-deploy-and-config.md | 5 +- ...e-active-directory-integration-with-mdm.md | 25 +- ...omatic-mdm-enrollment-in-the-new-portal.md | 9 +- ...ollment-using-windows-provisioning-tool.md | 130 +++--- ...ficate-authentication-device-enrollment.md | 34 +- .../certificate-renewal-windows-mdm.md | 44 +- ...t-removal-policy-external-storage-media.md | 24 +- windows/client-management/config-lock.md | 6 +- .../connect-to-remote-aadj-pc.md | 8 +- .../device-update-management.md | 407 ++++++++---------- .../diagnose-mdm-failures-in-windows-10.md | 43 +- .../disconnecting-from-mdm-unenrollment.md | 52 +-- .../enable-admx-backed-policies-in-mdm.md | 21 +- ...device-automatically-using-group-policy.md | 81 ++-- .../enterprise-app-management.md | 143 +++--- .../esim-enterprise-management.md | 4 + ...erated-authentication-device-enrollment.md | 66 +-- ...s-for-enterprise-and-education-editions.md | 12 +- ...rver-side-mobile-application-management.md | 7 +- .../manage-corporate-devices.md | 21 +- ...e-device-installation-with-group-policy.md | 253 ++++++----- .../manage-settings-app-with-group-policy.md | 14 +- ...-in-your-organization-modern-management.md | 6 +- .../mandatory-user-profile.md | 17 +- .../mdm-enrollment-of-windows-devices.md | 150 +++---- windows/client-management/mdm-overview.md | 8 +- ...ew-in-windows-mdm-enrollment-management.md | 35 +- .../new-policies-for-windows-10.md | 38 +- .../oma-dm-protocol-support.md | 22 +- ...remise-authentication-device-enrollment.md | 27 +- .../push-notification-windows-mdm.md | 10 +- windows/client-management/quick-assist.md | 8 +- .../server-requirements-windows-mdm.md | 25 +- .../structure-of-oma-dm-provisioning-files.md | 14 +- .../understanding-admx-backed-policies.md | 15 +- ...-scripting-with-the-wmi-bridge-provider.md | 14 +- ...and-centennial-app-policy-configuration.md | 14 +- .../client-management/windows-libraries.md | 23 +- .../windows-mdm-enterprise-settings.md | 23 +- .../windows-version-search.md | 19 +- .../wmi-providers-supported-in-windows.md | 18 +- 42 files changed, 920 insertions(+), 987 deletions(-) diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 095188a9ba..33c89a2952 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -9,18 +9,16 @@ ms.localizationpriority: medium ms.date: 03/28/2022 ms.topic: article ms.collection: - - highpri - - tier2 +- highpri +- tier2 ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Windows Tools/Administrative Tools -**Applies to** - -- Windows 11 -- Windows 10 - **Windows Tools** is a folder in the Windows 11 Control Panel. **Administrative Tools** is a folder in the Windows 10 Control Panel. These folders contain tools for system administrators and advanced users. ## Windows Tools folder (Windows 11) diff --git a/windows/client-management/appv-deploy-and-config.md b/windows/client-management/appv-deploy-and-config.md index f0c9843f27..6b89d95acc 100644 --- a/windows/client-management/appv-deploy-and-config.md +++ b/windows/client-management/appv-deploy-and-config.md @@ -9,6 +9,9 @@ author: vinaypamnani-msft ms.date: 06/26/2017 ms.reviewer: manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Deploy and configure App-V apps using MDM @@ -482,4 +485,4 @@ EnterpriseAppVManagement -``` \ No newline at end of file +``` diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 4063a64e10..5d78440379 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -1,7 +1,7 @@ --- title: Azure Active Directory integration with MDM description: Azure Active Directory is the world's largest enterprise cloud identity management service. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -9,9 +9,12 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.collection: - - highpri - - tier2 +- highpri +- tier2 ms.date: 12/31/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Azure Active Directory integration with MDM @@ -50,7 +53,7 @@ Once a user has an Azure AD account added to Windows and enrolled in MDM, the en Azure AD MDM enrollment is a two-step process: 1. Display the Terms of Use and gather user consent: This consent is a passive flow where the user is redirected in a browser control (webview) to the URL of the Terms of Use of the MDM. -2. Enroll the device: This step is an active flow where Windows OMA DM agent calls the MDM service to enroll the device. +1. Enroll the device: This step is an active flow where Windows OMA DM agent calls the MDM service to enroll the device. To support Azure AD enrollment, MDM vendors must host and expose a **Terms of Use endpoint** and an **MDM enrollment endpoint**. @@ -143,8 +146,8 @@ The pages rendered by the MDM in the integrated enrollment process must use Wind There are three distinct scenarios: 1. MDM enrollment as part of Azure AD Join in Windows OOBE. -2. MDM enrollment as part of Azure AD Join, after Windows OOBE from **Settings**. -3. MDM enrollment as part of adding a Microsoft work account on a personal device (BYOD). +1. MDM enrollment as part of Azure AD Join, after Windows OOBE from **Settings**. +1. MDM enrollment as part of adding a Microsoft work account on a personal device (BYOD). These scenarios support Windows Pro, Enterprise, and Education. @@ -183,7 +186,7 @@ The following parameters are passed in the query string: Azure AD issues a bearer access token. The token is passed in the authorization header of the HTTP request. Here's a typical format: -**Authorization: Bearer** CI6MTQxmCF5xgu6yYcmV9ng6vhQfaJYw… +**Authorization: Bearer** CI6MTQxmCF5xgu6yYcmV9ng6vhQfaJYw... The following claims are expected in the access token passed by Windows to the Terms of Use endpoint: @@ -333,7 +336,7 @@ Alert sample: UserToken inserted here - … other XML tags … + ... other XML tags ... ``` @@ -362,7 +365,7 @@ Here's an example. user - … other XML tags … + ... other XML tags ... ``` @@ -386,7 +389,7 @@ The following sample REST API call illustrates how an MDM can use the Microsoft Sample Graph API Request: PATCH https://graph.windows.net/contoso.com/devices/db7ab579-3759-4492-a03f-655ca7f52ae1?api-version=beta HTTP/1.1 -Authorization: Bearer eyJ0eXAiO……… +Authorization: Bearer eyJ0eXAiO......... Accept: application/json Content-Type: application/json { "isManaged":true, @@ -398,7 +401,7 @@ Where: - **contoso.com** - This value is the name of the Azure AD tenant to whose directory the device has been joined. - **db7ab579-3759-4492-a03f-655ca7f52ae1** - This value is the device identifier for the device whose compliance information is being reported to Azure AD. -- **eyJ0eXAiO**……… - This value is the bearer access token issued by Azure AD to the MDM that authorizes the MDM to call the Microsoft Graph API. The access token is placed in the HTTP authorization header of the request. +- **eyJ0eXAiO**......... - This value is the bearer access token issued by Azure AD to the MDM that authorizes the MDM to call the Microsoft Graph API. The access token is placed in the HTTP authorization header of the request. - **isManaged** and **isCompliant** - These Boolean attributes indicates compliance status. - **api-version** - Use this parameter to specify which version of the graph API is being requested. diff --git a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index cc058826be..ad2ed3b4a8 100644 --- a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -9,6 +9,9 @@ author: vinaypamnani-msft ms.date: 12/18/2020 ms.reviewer: manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Azure AD and Microsoft Intune: Automatic MDM enrollment in the Intune admin center @@ -21,8 +24,8 @@ Microsoft Intune can be accessed directly using its own admin center. For more i If you use the Azure portal, then you can access Intune using the following steps: 1. Go to your Azure AD Blade. -2. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. -3. Select **Microsoft Intune** and configure the blade. +1. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. +1. Select **Microsoft Intune** and configure the blade. ![How to get to the Blade.](images/azure-mdm-intune.png) @@ -30,4 +33,4 @@ Configure the blade ![Configure the Blade.](images/azure-intune-configure-scope.png) -You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). +You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index c85858a2d0..199bd846e9 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,9 +1,6 @@ --- title: Bulk enrollment -description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. In Windows 10 and Windows 11. -MS-HAID: - - 'p\_phdevicemgmt.bulk\_enrollment' - - 'p\_phDeviceMgmt.bulk\_enrollment\_using\_Windows\_provisioning\_tool' +description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. In Windows 10 and Windows 11. ms.reviewer: manager: aaroncz ms.author: vinpa @@ -12,39 +9,43 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Bulk enrollment -Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. In Windows 10 and 11 desktop devices, you can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join (Cloud Domain Join) enrollment scenario. +Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. In Windows 10 and 11 desktop devices, you can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join (Cloud Domain Join) enrollment scenario. ## Typical use cases -- Set up devices in bulk for large organizations to be managed by MDM. -- Set up kiosks, such as ATMs or point-of-sale (POS) terminals. -- Set up school computers. -- Set up industrial machinery. -- Set handheld POS devices. +- Set up devices in bulk for large organizations to be managed by MDM. +- Set up kiosks, such as ATMs or point-of-sale (POS) terminals. +- Set up school computers. +- Set up industrial machinery. +- Set handheld POS devices. On the desktop, you can create an Active Directory account, such as "enrollment@contoso.com" and give it only the ability to join the domain. Once the desktop is joined with that admin account, then standard users in the domain can sign in to use it. This account is especially useful in getting a large number of desktop ready to use within a domain. On the desktop and mobile devices, you can use an enrollment certificate or enrollment username and password, such as `enroll@contoso.com` and `enrollmentpassword`. These credentials are used in the provisioning package, which you can use to enroll multiple devices to the MDM service. Once the devices are joined, many users can use them. > [!NOTE] -> - Bulk-join is not supported in Azure Active Directory Join. -> - Bulk enrollment does not work in Intune standalone environment. -> - Bulk enrollment works in Microsoft Intune where the ppkg is generated from the Configuration Manager console. -> - To change bulk enrollment settings, login to **AAD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. -> - Bulk Token creation is not supported with federated accounts. +> +> - Bulk-join is not supported in Azure Active Directory Join. +> - Bulk enrollment does not work in Intune standalone environment. +> - Bulk enrollment works in Microsoft Intune where the ppkg is generated from the Configuration Manager console. +> - To change bulk enrollment settings, login to **AAD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. +> - Bulk Token creation is not supported with federated accounts. ## What you need -- Windows 10 devices. -- Windows Configuration Designer (WCD) tool. +- Windows 10 devices. +- Windows Configuration Designer (WCD) tool. To get the WCD tool, download from the [Microsoft Store](https://www.microsoft.com/store/productId/9NBLGGH4TX22). For more information about the WCD tool, see [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) and [Getting started with Windows WCD](/windows/configuration/provisioning-packages/provisioning-install-icd). -- Enrollment credentials (domain account for enrollment, generic enrollment credentials for MDM, enrollment certificate for MDM.). -- Wi-Fi credentials, computer name scheme, and anything else required by your organization. +- Enrollment credentials (domain account for enrollment, generic enrollment credentials for MDM, enrollment certificate for MDM.). +- Wi-Fi credentials, computer name scheme, and anything else required by your organization. Some organizations require custom APNs to be provisioned before talking to the enrollment endpoint or custom VPN to join a domain. @@ -53,52 +54,52 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro Using the WCD, create a provisioning package using the enrollment information required by your organization. Ensure that you have all the configuration settings. 1. Open the WCD tool. -2. Select **Advanced Provisioning**. +1. Select **Advanced Provisioning**. ![icd start page.](images/bulk-enrollment7.png) -3. Enter a project name and select **Next**. -4. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then select **Next**. -5. Skip **Import a provisioning package (optional)** and select **Finish**. -6. Expand **Runtime settings** > **Workplace**. -7. Select **Enrollments**, enter a value in **UPN**, and then select **Add**. +1. Enter a project name and select **Next**. +1. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then select **Next**. +1. Skip **Import a provisioning package (optional)** and select **Finish**. +1. Expand **Runtime settings** > **Workplace**. +1. Select **Enrollments**, enter a value in **UPN**, and then select **Add**. The UPN is a unique identifier for the enrollment. For bulk enrollment, this UPN must be a service account that is allowed to enroll multiple users, such as "enrollment@contoso.com". -8. On the left navigation pane, expand the **UPN** and then enter the information for the rest of the settings for enrollment process. +1. On the left navigation pane, expand the **UPN** and then enter the information for the rest of the settings for enrollment process. Here's the list of available settings: - - **AuthPolicy** - Select **OnPremise**. - - **DiscoveryServiceFullUrl** - specify the full URL for the discovery service. - - **EnrollmentServiceFullUrl** - Optional and in most cases, it should be left blank. - - **PolicyServiceFullUrl** - Optional and in most cases, it should be left blank. - - **Secret** - Password + - **AuthPolicy** - Select **OnPremise**. + - **DiscoveryServiceFullUrl** - specify the full URL for the discovery service. + - **EnrollmentServiceFullUrl** - Optional and in most cases, it should be left blank. + - **PolicyServiceFullUrl** - Optional and in most cases, it should be left blank. + - **Secret** - Password For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). Here's the screenshot of the WCD at this point. ![bulk enrollment screenshot.](images/bulk-enrollment.png) -9. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). -10. When you're done adding all the settings, on the **File** menu, select **Save**. -11. On the main menu, select **Export** > **Provisioning package**. +1. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). +1. When you're done adding all the settings, on the **File** menu, select **Save**. +1. On the main menu, select **Export** > **Provisioning package**. ![icd menu for export.](images/bulk-enrollment2.png) -12. Enter the values for your package and specify the package output location. +1. Enter the values for your package and specify the package output location. ![enter package information.](images/bulk-enrollment3.png) ![enter additional information for package information.](images/bulk-enrollment4.png) ![specify file location.](images/bulk-enrollment6.png) -13. Select **Build**. +1. Select **Build**. ![icb build window.](images/bulk-enrollment5.png) -14. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). -15. Apply the package to your devices. +1. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). +1. Apply the package to your devices. ## Create and apply a provisioning package for certificate authentication Using the WCD, create a provisioning package using the enrollment information required by your organization. Ensure that you have all the configuration settings. 1. Open the WCD tool. -2. Select **Advanced Provisioning**. -3. Enter a project name and select **Next**. -4. Select **Common to all Windows editions**, since Provisioning CSP is common to all Windows editions. -5. Skip **Import a provisioning package (optional)** and select **Finish**. -6. Specify the certificate. +1. Select **Advanced Provisioning**. +1. Enter a project name and select **Next**. +1. Select **Common to all Windows editions**, since Provisioning CSP is common to all Windows editions. +1. Skip **Import a provisioning package (optional)** and select **Finish**. +1. Specify the certificate. 1. Go to **Runtime settings** > **Certificates** > **ClientCertificates**. 2. Enter a **CertificateName** and then select **Add**. 3. Enter the **CertificatePasword**. @@ -107,42 +108,42 @@ Using the WCD, create a provisioning package using the enrollment information re 6. For **KeyLocation**, select **Software only**. ![icd certificates section.](images/bulk-enrollment8.png) -7. Specify the workplace settings. +1. Specify the workplace settings. 1. Got to **Workplace** > **Enrollments**. 2. Enter the **UPN** for the enrollment and then select **Add**. The UPN is a unique identifier for the enrollment. For bulk enrollment, this UPN must be a service account that is allowed to enroll multiple users, such as "enrollment@contoso.com". 3. On the left column, expand the **UPN** and then enter the information for the rest of the settings for enrollment process. Here's the list of available settings: - - **AuthPolicy** - Select **Certificate**. - - **DiscoveryServiceFullUrl** - specify the full URL for the discovery service. - - **EnrollmentServiceFullUrl** - Optional and in most cases, it should be left blank. - - **PolicyServiceFullUrl** - Optional and in most cases, it should be left blank. - - **Secret** - the certificate thumbprint. + - **AuthPolicy** - Select **Certificate**. + - **DiscoveryServiceFullUrl** - specify the full URL for the discovery service. + - **EnrollmentServiceFullUrl** - Optional and in most cases, it should be left blank. + - **PolicyServiceFullUrl** - Optional and in most cases, it should be left blank. + - **Secret** - the certificate thumbprint. For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). -8. Configure the other settings, such as the Wi-Fi connection so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). -9. When you're done adding all the settings, on the **File** menu, select **Save**. -10. Export and build the package (steps 10-13 in the procedure above). -11. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). -12. Apply the package to your devices. +1. Configure the other settings, such as the Wi-Fi connection so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). +1. When you're done adding all the settings, on the **File** menu, select **Save**. +1. Export and build the package (steps 10-13 in the procedure above). +1. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). +1. Apply the package to your devices. ## Apply a provisioning package Here's the list of articles about applying a provisioning package: -- [Apply a package on the first-run setup screen (out-of-the-box experience)](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment#apply-package) -- [Apply a package to a Windows desktop edition image](/windows/configuration/provisioning-packages/provisioning-create-package#to_apply_a_provisioning_package_to_a_desktop_image) -- [Apply a package from the Settings menu](#apply-a-package-from-the-settings-menu) - article below +- [Apply a package on the first-run setup screen (out-of-the-box experience)](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment#apply-package) +- [Apply a package to a Windows desktop edition image](/windows/configuration/provisioning-packages/provisioning-create-package#to_apply_a_provisioning_package_to_a_desktop_image) +- [Apply a package from the Settings menu](#apply-a-package-from-the-settings-menu) - article below ## Apply a package from the Settings menu -1. Go to **Settings** > **Accounts** > **Access work or school**. -2. Select **Add or remove a provisioning package**. -3. Select **Add a package**. +1. Go to **Settings** > **Accounts** > **Access work or school**. +1. Select **Add or remove a provisioning package**. +1. Select **Add a package**. ## Validate that the provisioning package was applied -1. Go to **Settings** > **Accounts** > **Access work or school**. -2. Select **Add or remove a provisioning package**. +1. Go to **Settings** > **Accounts** > **Access work or school**. +1. Select **Add or remove a provisioning package**. You should see your package listed. ## Retry logic if there's a failure @@ -159,6 +160,5 @@ In addition, provisioning will be restarted in a SYSTEM context after a sign in Here are links to step-by-step provisioning articles: -- [Provision PCs with apps and certificates for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-with-apps) -- [Provision PCs with common settings for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment) - +- [Provision PCs with apps and certificates for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-with-apps) +- [Provision PCs with common settings for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment) diff --git a/windows/client-management/certificate-authentication-device-enrollment.md b/windows/client-management/certificate-authentication-device-enrollment.md index 2f5129ba9b..526ac9e52c 100644 --- a/windows/client-management/certificate-authentication-device-enrollment.md +++ b/windows/client-management/certificate-authentication-device-enrollment.md @@ -9,22 +9,25 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Certificate authentication device enrollment -This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). +This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). -> [!Note] +> [!NOTE] > To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package). ## In this topic -- [Discovery service](#discovery-service) -- [Enrollment policy web service](#enrollment-policy-web-service) -- [Enrollment web service](#enrollment-web-service) +- [Discovery service](#discovery-service) +- [Enrollment policy web service](#enrollment-policy-web-service) +- [Enrollment web service](#enrollment-web-service) -For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery Service @@ -135,7 +138,7 @@ Cache-Control: no-cache https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - B64EncodedSampleBinarySecurityToken @@ -296,14 +299,13 @@ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrol http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary" xmlns= http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd - wsu:Id=”29801C2F-F26B-46AD-984B-AFAEFB545FF8”> + wsu:Id="29801C2F-F26B-46AD-984B-AFAEFB545FF8"> B64EncodedSampleBinarySecurityToken - + @@ -312,13 +314,13 @@ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrol SignedMessageBlob/ds:SignatureValue> - + - + @@ -443,7 +445,7 @@ The following example shows the encoded provisioning XML. - + @@ -487,7 +489,7 @@ The following example shows the encoded provisioning XML. - + @@ -498,4 +500,4 @@ The following example shows the encoded provisioning XML. -``` \ No newline at end of file +``` diff --git a/windows/client-management/certificate-renewal-windows-mdm.md b/windows/client-management/certificate-renewal-windows-mdm.md index 8b44256d9e..64e6ecdcb0 100644 --- a/windows/client-management/certificate-renewal-windows-mdm.md +++ b/windows/client-management/certificate-renewal-windows-mdm.md @@ -1,9 +1,6 @@ --- title: Certificate Renewal description: Learn how to find all the resources that you need to provide continuous access to client certificates. -MS-HAID: - - 'p\_phdevicemgmt.certificate\_renewal' - - 'p\_phDeviceMgmt.certificate\_renewal\_windows\_mdm' ms.reviewer: manager: aaroncz ms.author: vinpa @@ -12,29 +9,32 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Certificate Renewal The enrolled client certificate expires after a period of use. The expiration date of the certificate is specified by the server. To ensure continuous access to enterprise applications, Windows supports a user-triggered certificate renewal process. The user is prompted to provide the current password for the corporate account. The enrollment client gets a new client certificate from the enrollment server, and deletes the old certificate. The client generates a new private/public key pair, generates a PKCS\#7 request, and signs the PKCS\#7 request with the existing certificate. In Windows, automatic MDM client certificate renewal is also supported. -> [!Note] +> [!NOTE] > Make sure that the EntDMID in the DMClient configuration service provider is set before the certificate renewal request is triggered. ## Automatic certificate renewal request Windows supports automatic certificate renewal, also known as Renew On Behalf Of (ROBO), that doesn't require any user interaction. For auto renewal, the enrollment client uses the existing MDM client certificate to do client Transport Layer Security (TLS). The user security token isn't needed in the SOAP header. As a result, the MDM certificate enrollment server is required to support client TLS for certificate-based client authentication for automatic certificate renewal. -> [!Note] +> [!NOTE] > Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. Auto certificate renewal is the only supported MDM client certificate renewal method for the device that's enrolled using WAB authentication. Meaning, the AuthPolicy is set to Federated. It also means if the server supports WAB authentication, then the MDM certificate enrollment server MUST also support client TLS to renew the MDM client certificate. -For Windows devices, during the MDM client certificate enrollment phase or during MDM management section, the enrollment server or MDM server could configure the device to support automatic MDM client certificate renewal using [CertificateStore CSP’s](mdm/certificatestore-csp.md) ROBOSupport node under CertificateStore/My/WSTEP/Renew URL. +For Windows devices, during the MDM client certificate enrollment phase or during MDM management section, the enrollment server or MDM server could configure the device to support automatic MDM client certificate renewal using [CertificateStore CSP's](mdm/certificatestore-csp.md) ROBOSupport node under CertificateStore/My/WSTEP/Renew URL. -With automatic renewal, the PKCS\#7 message content isn’t b64 encoded separately. With manual certificate renewal, there's an additional b64 encoding for PKCS\#7 message content. +With automatic renewal, the PKCS\#7 message content isn't b64 encoded separately. With manual certificate renewal, there's an additional b64 encoding for PKCS\#7 message content. -During the automatic certificate renewal process, if the root certificate isn’t trusted by the device, the authentication will fail. Use one of device pre-installed root certificates, or configure the root cert over a DM session using the [CertificateStore CSP](mdm/certificatestore-csp.md). +During the automatic certificate renewal process, if the root certificate isn't trusted by the device, the authentication will fail. Use one of device pre-installed root certificates, or configure the root cert over a DM session using the [CertificateStore CSP](mdm/certificatestore-csp.md). During the automatic certificate renew process, the device will deny HTTP redirect request from the server. It won't deny the request if the same redirect URL that the user accepted during the initial MDM enrollment process is used. @@ -94,28 +94,28 @@ The following example shows the details of an automatic renewal request. ## Certificate renewal schedule configuration -In Windows, the renewal period can only be set during the MDM enrollment phase. Windows supports a certificate renewal period and renewal failure retry. They're configurable by both MDM enrollment server and later by the MDM management server using CertificateStore CSP’s RenewPeriod and RenewInterval nodes. The device could retry automatic certificate renewal multiple times until the certificate expires. For manual certificate renewal, the Windows device reminds the user with a dialog at every renewal retry time until the certificate is expired. +In Windows, the renewal period can only be set during the MDM enrollment phase. Windows supports a certificate renewal period and renewal failure retry. They're configurable by both MDM enrollment server and later by the MDM management server using CertificateStore CSP's RenewPeriod and RenewInterval nodes. The device could retry automatic certificate renewal multiple times until the certificate expires. For manual certificate renewal, the Windows device reminds the user with a dialog at every renewal retry time until the certificate is expired. For more information about the parameters, see the CertificateStore configuration service provider. Unlike manual certificate renewal, the device will not do an automatic MDM client certificate renewal if the certificate is already expired. To make sure the device has enough time to automatically renew, we recommend you set a renewal period a couple months (40-60 days) before the certificate expires. And, set the renewal retry interval to every few days, like every 4-5 days instead every 7 days (weekly). This change increases the chance that the device will try to connect at different days of the week. -> [!Note] -> For PCs that were previously enrolled in MDM in Windows 8.1 and then upgraded to Windows 10, renewal will be triggered for the enrollment certificate. Thereafter, renewal will happen at the configured ROBO interval. +> [!NOTE] +> For PCs that were previously enrolled in MDM in Windows 8.1 and then upgraded to Windows 10, renewal will be triggered for the enrollment certificate. Thereafter, renewal will happen at the configured ROBO interval. ## Certificate renewal response When RequestType is set to Renew, the web service verifies the following (in additional to initial enrollment): -- The signature of the PKCS\#7 BinarySecurityToken is correct -- The client’s certificate is in the renewal period -- The certificate was issued by the enrollment service -- The requester is the same as the requester for initial enrollment -- For standard client’s request, the client hasn’t been blocked +- The signature of the PKCS\#7 BinarySecurityToken is correct +- The client's certificate is in the renewal period +- The certificate was issued by the enrollment service +- The requester is the same as the requester for initial enrollment +- For standard client's request, the client hasn't been blocked After validation is completed, the web service retrieves the PKCS\#10 content from the PKCS\#7 BinarySecurityToken. The rest is the same as initial enrollment, except that the Provisioning XML only needs to have the new certificate issued by the CA. -> [!Note] +> [!NOTE] > The HTTP server response must not be chunked; it must be sent as one message. The following example shows the details of a certificate renewal response. @@ -145,14 +145,14 @@ The following example shows the details of a certificate renewal response. ``` -> [!Note] +> [!NOTE] > The client receives a new certificate, instead of renewing the initial certificate. The administrator controls which certificate template the client should use. The templates may be different at renewal time than the initial enrollment time. ## Configuration service providers supported during MDM enrollment and certificate renewal The following configuration service providers are supported during MDM enrollment and certificate renewal process. See Configuration service provider reference for detailed descriptions of each configuration service provider. -- CertificateStore -- w7 APPLICATION -- DMClient -- EnterpriseAppManagement +- CertificateStore +- w7 APPLICATION +- DMClient +- EnterpriseAppManagement diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md index d3410f5068..f598797aba 100644 --- a/windows/client-management/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -6,14 +6,16 @@ author: vinaypamnani-msft ms.author: vinpa ms.date: 11/25/2020 ms.topic: article -ms.custom: - - CI 111493 - - CI 125140 - - CSSTroubleshooting -audience: ITPro +ms.custom: +- CI 111493 +- CI 125140 +- CSSTroubleshooting ms.localizationpriority: medium manager: kaushika ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Change in default removal policy for external storage media in Windows 10, version 1809 @@ -39,20 +41,20 @@ You can use the storage device policy setting to change the manner in which Wind To change the policy for an external storage device: 1. Connect the device to the computer. -2. Right-click **Start**, then select **File Explorer**. -3. In File Explorer, identify the letter or label that is associated with the device (for example, **USB Drive (D:)**). -4. Right-click **Start**, then select **Disk Management**. -5. In the lower section of the Disk Management window, right-click the label of the device, and then select **Properties**. +1. Right-click **Start**, then select **File Explorer**. +1. In File Explorer, identify the letter or label that is associated with the device (for example, **USB Drive (D:)**). +1. Right-click **Start**, then select **Disk Management**. +1. In the lower section of the Disk Management window, right-click the label of the device, and then select **Properties**. ![In Disk Management, right-click the device and click Properties.](./images/change-def-rem-policy-1.png) -6. Select **Policies**. +1. Select **Policies**. > [!NOTE] > Some recent versions of Windows may use a different arrangement of tabs in the disk properties dialog box. > > If you do not see the **Policies** tab, select **Hardware**, select the removable drive from the **All disk drives** list, and then select **Properties**. The **Policies** tab should now be available. -7. Select the policy that you want to use. +1. Select the policy that you want to use. ![Policy options for disk management.](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/config-lock.md b/windows/client-management/config-lock.md index 56b72cdf0a..a901d37738 100644 --- a/windows/client-management/config-lock.md +++ b/windows/client-management/config-lock.md @@ -8,14 +8,12 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 05/24/2022 +appliesto: +- ✅ Windows 11 --- # Secured-core PC configuration lock -**Applies to** - -- Windows 11 - In an enterprise organization, IT administrators enforce policies on their corporate devices to keep the devices in a compliant state and protect the OS by preventing users from changing configurations and creating config drift. Config drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Windows 11 with config lock enables IT administrators to prevent config drift and keep the OS configuration in the desired state. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. Secured-core configuration lock (config lock) is a new [secured-core PC (SCPC)](/windows-hardware/design/device-experiences/oem-highly-secure) feature that prevents configuration drift from secured-core PC features caused by unintentional misconfiguration. In short, it ensures a device intended to be a secured-core PC remains a secured-core PC. diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 2abfcd2135..9fdc0d93bf 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -9,11 +9,11 @@ ms.date: 01/18/2022 manager: aaroncz ms.topic: article appliesto: - - ✅ Windows 10 and later - - ✅ Windows 11 and later +- ✅ Windows 11 +- ✅ Windows 10 ms.collection: - - highpri - - tier2 +- highpri +- tier2 ms.technology: itpro-manage --- diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index 4c730c626d..40e3b7efcc 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -1,7 +1,7 @@ --- title: Mobile device management MDM for device updates description: Windows 10 provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -10,8 +10,11 @@ ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 11/15/2017 ms.collection: - - highpri - - tier2 +- highpri +- tier2 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Mobile device management (MDM) for device updates @@ -19,24 +22,24 @@ ms.collection: >[!TIP] >If you're not a developer or administrator, you'll find more helpful information in the [Windows Update: Frequently Asked Questions](https://support.microsoft.com/help/12373/windows-update-faq). -With PCs, tablets, phones, and IoT devices, Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. In Windows 10, we're investing heavily in extending the management capabilities available to MDMs. One key feature we're adding is the ability for MDMs to keep devices up to date with the latest Microsoft updates. +With PCs, tablets, phones, and IoT devices, Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. In Windows 10, we're investing heavily in extending the management capabilities available to MDMs. One key feature we're adding is the ability for MDMs to keep devices up to date with the latest Microsoft updates. -In particular, Windows 10 provides APIs to enable MDMs to: +In particular, Windows 10 provides APIs to enable MDMs to: -- Ensure machines stay up to date by configuring Automatic Update policies. -- Test updates on a smaller set of machines by configuring which updates are approved for a given device. Then, do an enterprise-wide rollout. -- Get compliance status of managed devices. IT can understand which machines still need a security patch, or how current is a particular machine. +- Ensure machines stay up to date by configuring Automatic Update policies. +- Test updates on a smaller set of machines by configuring which updates are approved for a given device. Then, do an enterprise-wide rollout. +- Get compliance status of managed devices. IT can understand which machines still need a security patch, or how current is a particular machine. -This article provides independent software vendors (ISV) with the information they need to implement update management in Windows 10. +This article provides independent software vendors (ISV) with the information they need to implement update management in Windows 10. -In Windows 10, the MDM protocol has been extended to better enable IT admins to manage updates. In particular, Windows has added configuration service providers (CSPs) that expose policies and actions for MDMs to: +In Windows 10, the MDM protocol has been extended to better enable IT admins to manage updates. In particular, Windows has added configuration service providers (CSPs) that expose policies and actions for MDMs to: -- Configure automatic update policies to ensure devices stay up to date. -- Get device compliance information (the list of updates that are needed but not yet installed). -- Enter a per-device update approval list. The list makes sure devices only install updates that are approved and tested. -- Approve end-user license agreements (EULAs) for the end user so update deployment can be automated even for updates with EULAs. +- Configure automatic update policies to ensure devices stay up to date. +- Get device compliance information (the list of updates that are needed but not yet installed). +- Enter a per-device update approval list. The list makes sure devices only install updates that are approved and tested. +- Approve end-user license agreements (EULAs) for the end user so update deployment can be automated even for updates with EULAs. -The OMA DM APIs for specifying update approvals and getting compliance status refer to updates by using an Update ID. The Update ID is a GUID that identifies a particular update. The MDM will want to show IT-friendly information about the update, instead of a raw GUID, including the update’s title, description, KB, update type, like a security update or service pack. For more information, see [\[MS-WSUSSS\]: Windows Update Services: Server-Server Protocol](/openspecs/windows_protocols/ms-wsusss/f49f0c3e-a426-4b4b-b401-9aeb2892815c). +The OMA DM APIs for specifying update approvals and getting compliance status refer to updates by using an Update ID. The Update ID is a GUID that identifies a particular update. The MDM will want to show IT-friendly information about the update, instead of a raw GUID, including the update's title, description, KB, update type, like a security update or service pack. For more information, see [\[MS-WSUSSS\]: Windows Update Services: Server-Server Protocol](/openspecs/windows_protocols/ms-wsusss/f49f0c3e-a426-4b4b-b401-9aeb2892815c). For more information about the CSPs, see [Update CSP](mdm/update-csp.md) and the update policy area of the [Policy CSP](mdm/policy-configuration-service-provider.md). @@ -46,9 +49,9 @@ The following diagram provides a conceptual overview of how this works: The diagram can be roughly divided into three areas: -- The Device Management service syncs update information (title, description, applicability) from Microsoft Update using the Server-Server sync protocol (top of the diagram). -- The Device Management service sets automatic update policies, obtains update compliance information, and sets approvals via OMA DM (left portion of the diagram). -- The device gets updates from Microsoft Update using client/server protocol. It only downloads and installs updates that apply to the device and are approved by IT (right portion of the diagram). +- The Device Management service syncs update information (title, description, applicability) from Microsoft Update using the Server-Server sync protocol (top of the diagram). +- The Device Management service sets automatic update policies, obtains update compliance information, and sets approvals via OMA DM (left portion of the diagram). +- The device gets updates from Microsoft Update using client/server protocol. It only downloads and installs updates that apply to the device and are approved by IT (right portion of the diagram). ## Getting update metadata using the Server-Server sync protocol @@ -60,38 +63,37 @@ This section describes this setup. The following diagram shows the server-server MSDN provides much information about the Server-Server sync protocol. In particular: -- It's a SOAP-based protocol, and you can get the WSDL in [Server Sync Web Service](/openspecs/windows_protocols/ms-wsusss/8a3b2470-928a-4bd1-bdcc-8c2bf6b8e863). The WSDL can be used to generate calling proxies for many programming environments, which will simplify your development. -- You can find code samples in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). The sample code shows raw SOAP commands, which can be used. Although it’s even simpler to make the call from a programming language like .NET (calling the WSDL-generated proxies). The stub generated by the Server Sync WSDL from the MSDN link above generates an incorrect binding URL. The binding URL should be set to `https://fe2.update.microsoft.com/v6/ServerSyncWebService/serversyncwebservice.asmx`. +- It's a SOAP-based protocol, and you can get the WSDL in [Server Sync Web Service](/openspecs/windows_protocols/ms-wsusss/8a3b2470-928a-4bd1-bdcc-8c2bf6b8e863). The WSDL can be used to generate calling proxies for many programming environments, which will simplify your development. +- You can find code samples in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). The sample code shows raw SOAP commands, which can be used. Although it's even simpler to make the call from a programming language like .NET (calling the WSDL-generated proxies). The stub generated by the Server Sync WSDL from the MSDN link above generates an incorrect binding URL. The binding URL should be set to `https://fe2.update.microsoft.com/v6/ServerSyncWebService/serversyncwebservice.asmx`. Some important highlights: -- The protocol has an authorization phase (calling GetAuthConfig, GetAuthorizationCookie, and GetCookie). In [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a), the **Sample 1: Authorization** code shows how authorization is done. Even though it's called the authorization phase, the protocol is completely open (no credentials are needed to run this phase of the protocol). This sequence of calls needs to be done to obtain a cookie for the main part of the sync protocol. As an optimization, you can cache the cookie and only call this sequence again if your cookie has expired. -- The protocol allows the MDM to sync update metadata for a particular update by calling GetUpdateData. For more information, see [GetUpdateData](/openspecs/windows_protocols/ms-wsusss/c28ad30c-fa3f-4bc6-a747-788391d2d964) in MSDN. The LocURI to get the applicable updates with their revision numbers is `./Vendor/MSFT/Update/InstallableUpdates?list=StructData`. Because not all updates are available via S2S sync, make sure you handle SOAP errors. -- For mobile devices, you can sync metadata for a particular update by calling GetUpdateData. Or, for a local on-premises solution, you can use Windows Server Update Services (WSUS) and manually import the mobile updates from the Microsoft Update Catalog site. For more information, see [Process flow diagram and screenshots of server sync process](#process-flow-diagram-and-screenshots-of-server-sync-process). +- The protocol has an authorization phase (calling GetAuthConfig, GetAuthorizationCookie, and GetCookie). In [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a), the **Sample 1: Authorization** code shows how authorization is done. Even though it's called the authorization phase, the protocol is completely open (no credentials are needed to run this phase of the protocol). This sequence of calls needs to be done to obtain a cookie for the main part of the sync protocol. As an optimization, you can cache the cookie and only call this sequence again if your cookie has expired. +- The protocol allows the MDM to sync update metadata for a particular update by calling GetUpdateData. For more information, see [GetUpdateData](/openspecs/windows_protocols/ms-wsusss/c28ad30c-fa3f-4bc6-a747-788391d2d964) in MSDN. The LocURI to get the applicable updates with their revision numbers is `./Vendor/MSFT/Update/InstallableUpdates?list=StructData`. Because not all updates are available via S2S sync, make sure you handle SOAP errors. +- For mobile devices, you can sync metadata for a particular update by calling GetUpdateData. Or, for a local on-premises solution, you can use Windows Server Update Services (WSUS) and manually import the mobile updates from the Microsoft Update Catalog site. For more information, see [Process flow diagram and screenshots of server sync process](#process-flow-diagram-and-screenshots-of-server-sync-process). > [!NOTE] -> On Microsoft Update, metadata for a given update gets modified over time (updating descriptive information, fixing bugs in applicability rules, localization changes, and so on). Each time such a change is made that doesn’t affect the update itself, a new update revision is created. The identity of an update revision is a compound key containing both an UpdateID (GUID) and a RevisionNumber (int). The MDM should not expose the notion of an update revision to IT. Instead, for each UpdateID (GUID) the MDM should just keep the metadata for the later revision of that update (the one with the highest revision number). - +> On Microsoft Update, metadata for a given update gets modified over time (updating descriptive information, fixing bugs in applicability rules, localization changes, and so on). Each time such a change is made that doesn't affect the update itself, a new update revision is created. The identity of an update revision is a compound key containing both an UpdateID (GUID) and a RevisionNumber (int). The MDM should not expose the notion of an update revision to IT. Instead, for each UpdateID (GUID) the MDM should just keep the metadata for the later revision of that update (the one with the highest revision number). ## Examples of update metadata XML structure and element descriptions The response of the GetUpdateData call returns an array of ServerSyncUpdateData that contains the update metadata in the XmlUpdateBlob element. The schema of the update xml is available at [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). Some of the key elements are described below: -- **UpdateID** – The unique identifier for an update -- **RevisionNumber** – Revision number for the update in case the update was modified. -- **CreationDate** – the date on which this update was created. -- **UpdateType** – The type of update, which could include the following: - - **Detectoid** – if this update identity represents a compatibility logic - - **Category** – This element could represent either of the following: - - A Product category the update belongs to. For example, Windows, MS office, and so on. - - The classification the update belongs to. For example, drivers, security, and so on. - - **Software** – If the update is a software update. - - **Driver** – if the update is a driver update. -- **LocalizedProperties** – represents the language the update is available in, title and description of the update. It has the following fields: - - **Language** – The language code identifier (LCID). For example, en or es. - - **Title** – Title of the update. For example, “Windows SharePoint Services 3.0 Service Pack 3 x64 Edition (KB2526305)” - - **Description** – Description of the update. For example, “Windows SharePoint Services 3.0 Service Pack 3 (KB2526305) provides the latest updates to Windows SharePoint Services 3.0. After you install this item, you may have to restart your computer. After you've installed this item, it can't be removed.” -- **KBArticleID** – The KB article number for this update that has details about the particular update. For example, `https://support.microsoft.com/kb/2902892`. +- **UpdateID** - The unique identifier for an update +- **RevisionNumber** - Revision number for the update in case the update was modified. +- **CreationDate** - the date on which this update was created. +- **UpdateType** - The type of update, which could include the following: + - **Detectoid** - if this update identity represents a compatibility logic + - **Category** - This element could represent either of the following: + - A Product category the update belongs to. For example, Windows, MS office, and so on. + - The classification the update belongs to. For example, drivers, security, and so on. + - **Software** - If the update is a software update. + - **Driver** - if the update is a driver update. +- **LocalizedProperties** - represents the language the update is available in, title and description of the update. It has the following fields: + - **Language** - The language code identifier (LCID). For example, en or es. + - **Title** - Title of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 x64 Edition (KB2526305)" + - **Description** - Description of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 (KB2526305) provides the latest updates to Windows SharePoint Services 3.0. After you install this item, you may have to restart your computer. After you've installed this item, it can't be removed." +- **KBArticleID** - The KB article number for this update that has details about the particular update. For example, `https://support.microsoft.com/kb/2902892`. ## Recommended Flow for Using the Server-Server Sync Protocol @@ -103,17 +105,16 @@ First some background: - A metadata sync service can then be implemented. The service periodically calls server-server sync to pull in metadata for the updates IT cares about. - The MDM component that uses OMA DM to control devices (described in the next section) should send the metadata sync service the list of needed updates it gets from each client, if those updates aren't already known to the device. - The following procedure describes a basic algorithm for a metadata sync service: -- Initialization uses the following steps: - a. Create an empty list of “needed update IDs to fault in”. This list will get updated by the MDM service component that uses OMA DM. We recommend not adding definition updates to this list, since they're temporary. For example, Defender can release new definition updates many times per day, each of which is cumulative. -- Sync periodically (we recommend once every 2 hours - no more than once/hour). - 1. Implement the authorization phase of the protocol to get a cookie if you don’t already have a non-expired cookie. See **Sample 1: Authorization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). +- Initialization uses the following steps: + a. Create an empty list of "needed update IDs to fault in". This list will get updated by the MDM service component that uses OMA DM. We recommend not adding definition updates to this list, since they're temporary. For example, Defender can release new definition updates many times per day, each of which is cumulative. +- Sync periodically (we recommend once every 2 hours - no more than once/hour). + 1. Implement the authorization phase of the protocol to get a cookie if you don't already have a non-expired cookie. See **Sample 1: Authorization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). 2. Implement the metadata portion of the protocol (see **Sample 2: Metadata and Deployments Synchronization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a)), and: - - Call GetUpdateData for all updates in the "needed update IDs to fault in" list if the update metadata hasn't already been pulled into the DB. - - If the update is a newer revision of an existing update (same UpdateID, higher revision number), replace the previous update metadata with the new one. - - Remove updates from the "needed update IDs to fault in" list once they've been brought in. + - Call GetUpdateData for all updates in the "needed update IDs to fault in" list if the update metadata hasn't already been pulled into the DB. + - If the update is a newer revision of an existing update (same UpdateID, higher revision number), replace the previous update metadata with the new one. + - Remove updates from the "needed update IDs to fault in" list once they've been brought in. These steps get information about the set of Microsoft Updates that IT needs to manage, so the information can be used in various update management scenarios. For example, at update approval time, you can get information so IT can see what updates they're approving. Or, for compliance reports to see what updates are needed but not yet installed. @@ -121,22 +122,22 @@ These steps get information about the set of Microsoft Updates that IT needs to An MDM can manage updates via OMA DM. The details of how to use and integrate an MDM with the Windows OMA DM protocol, and how to enroll devices for MDM management, is documented in [Mobile device management](mobile-device-enrollment.md). This section focuses on how to extend that integration to support update management. The key aspects of update management include the following information: -- Configure automatic update policies to ensure devices stay up to date. -- Get device compliance information (the list of updates that are needed but not yet installed) -- Specify a per-device update approval list. The list makes sure devices only install updates that are approved and tested. -- Approve EULAs for the end user so update deployment can be automated, even for updates with EULAs +- Configure automatic update policies to ensure devices stay up to date. +- Get device compliance information (the list of updates that are needed but not yet installed) +- Specify a per-device update approval list. The list makes sure devices only install updates that are approved and tested. +- Approve EULAs for the end user so update deployment can be automated, even for updates with EULAs The following list describes a suggested model for applying updates. -1. Have a "Test Group" and an "All Group". -2. In the Test group, just let all updates flow. -3. In the All Group, set up Quality Update deferral for seven days. Then, Quality Updates will be auto approved after the seven days. Definition Updates are excluded from Quality Update deferrals, and will be auto approved when they're available. This schedule can be done by setting Update/DeferQualityUpdatesPeriodInDays to seven, and just letting updates flow after seven days or pushing Pause if any issues. +1. Have a "Test Group" and an "All Group". +1. In the Test group, just let all updates flow. +1. In the All Group, set up Quality Update deferral for seven days. Then, Quality Updates will be auto approved after the seven days. Definition Updates are excluded from Quality Update deferrals, and will be auto approved when they're available. This schedule can be done by setting Update/DeferQualityUpdatesPeriodInDays to seven, and just letting updates flow after seven days or pushing Pause if any issues. Updates are configured using a combination of the [Update CSP](mdm/update-csp.md), and the update portion of the [Policy CSP](mdm/policy-configuration-service-provider.md). ### Update policies -The enterprise IT can configure auto-update policies via OMA DM using the [Policy CSP](mdm/policy-configuration-service-provider.md) (this functionality isn't supported in Windows 10 Home). Here's the CSP diagram for the Update node in Policy CSP. +The enterprise IT can configure auto-update policies via OMA DM using the [Policy CSP](mdm/policy-configuration-service-provider.md) (this functionality isn't supported in Windows 10 Home). Here's the CSP diagram for the Update node in Policy CSP. The following information shows the Update policies in a tree format. @@ -181,13 +182,12 @@ Policy **Update/ActiveHoursEnd** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education Added in Windows 10, version 1607. When used with **Update/ActiveHoursStart**, it allows the IT admin to manage a range of active hours where update reboots aren't scheduled. This value sets the end time. There's a 12-hour maximum from start time. > [!NOTE] -> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** in this article. +> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** in this article. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, and so on. @@ -195,9 +195,9 @@ The default is 17 (5 PM). **Update/ActiveHoursMaxRange** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. -Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time. +Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time. Supported values are 8-18. @@ -205,13 +205,12 @@ The default value is 18 (hours). **Update/ActiveHoursStart** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. - +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. Added in Windows 10, version 1607. When used with **Update/ActiveHoursEnd**, it allows the IT admin to manage a range of hours where update reboots aren't scheduled. This value sets the start time. There's a 12-hour maximum from end time. > [!NOTE] -> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** in this article. +> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** in this article. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, and so on. @@ -219,8 +218,7 @@ The default value is 8 (8 AM). **Update/AllowAutoUpdate** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. - +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. Enables the IT admin to manage automatic update behavior to scan, download, and install updates. @@ -228,35 +226,32 @@ Supported operations are Get and Replace. The following list shows the supported values: -- 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end users to manage data usage. With this option, users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. -- 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart time. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that don't shutdown properly on restart. -- 2 (default) – Auto install and restart. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device isn't actively being used. This behavior is the default behavior for unmanaged devices. Devices are updated quickly. But, it increases the risk of accidental data loss caused by an application that doesn't shutdown properly on restart. -- 3 – Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. -- 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device isn't actively being used. This setting option also sets the end-user control panel to read-only. -- 5 – Turn off automatic updates. +- 0 - Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end users to manage data usage. With this option, users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. +- 1 - Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart time. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that don't shutdown properly on restart. +- 2 (default) - Auto install and restart. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device isn't actively being used. This behavior is the default behavior for unmanaged devices. Devices are updated quickly. But, it increases the risk of accidental data loss caused by an application that doesn't shutdown properly on restart. +- 3 - Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. +- 4 - Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device isn't actively being used. This setting option also sets the end-user control panel to read-only. +- 5 - Turn off automatic updates. > [!IMPORTANT] > This option should be used only for systems under regulatory compliance, as you will not get security updates as well. - If the policy isn't configured, end users get the default behavior (Auto install and restart). **Update/AllowMUUpdateService** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update. +Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update. The following list shows the supported values: -- 0 – Not allowed or not configured. -- 1 – Allowed. Accepts updates received through Microsoft Update. +- 0 - Not allowed or not configured. +- 1 - Allowed. Accepts updates received through Microsoft Update. **Update/AllowNonMicrosoftSignedUpdate** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise and Windows 10 Education. - +> This policy is available on Windows 10 Pro, Windows 10 Enterprise and Windows 10 Education. Allows the IT admin to manage if Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third-party software and patch distribution. @@ -264,15 +259,14 @@ Supported operations are Get and Replace. The following list shows the supported values: -- 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. -- 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they're signed by a certificate in the "Trusted Publishers" certificate store of the local computer. +- 0 - Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. +- 1 - Allowed. Accepts updates received through an intranet Microsoft update service location, if they're signed by a certificate in the "Trusted Publishers" certificate store of the local computer. This policy is specific to desktop and local publishing using WSUS for third-party updates (binaries and updates not hosted on Microsoft Update). It allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. **Update/AllowUpdateService** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft. @@ -282,19 +276,17 @@ Enabling this policy will disable that functionality, and may cause connection t The following list shows the supported values: -- 0 – Update service isn't allowed. -- 1 (default) – Update service is allowed. +- 0 - Update service isn't allowed. +- 1 (default) - Update service is allowed. > [!NOTE] -> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. - +> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. **Update/AutoRestartNotificationSchedule** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications. +Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications. Supported values are 15, 30, 60, 120, and 240 (minutes). @@ -302,51 +294,47 @@ The default value is 15 (minutes). **Update/AutoRestartRequiredNotificationDismissal** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto restart required notification is dismissed. +Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto restart required notification is dismissed. The following list shows the supported values: -- 1 (default) – Auto Dismissal. -- 2 – User Dismissal. +- 1 (default) - Auto Dismissal. +- 2 - User Dismissal. **Update/BranchReadinessLevel** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. +Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. The following list shows the supported values: -- 16 (default) – User gets all applicable upgrades from Current Branch (CB). -- 32 – User gets upgrades from Current Branch for Business (CBB). +- 16 (default) - User gets all applicable upgrades from Current Branch (CB). +- 32 - User gets upgrades from Current Branch for Business (CBB). **Update/DeferFeatureUpdatesPeriodInDays** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days. +Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days. Supported values are 0-180. **Update/DeferQualityUpdatesPeriodInDays** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days. +Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days. Supported values are 0-30. **Update/DeferUpdatePeriod** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education > -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. - +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. Allows IT Admins to specify update delays for up to four weeks. @@ -383,10 +371,9 @@ If the **Allow Telemetry** policy is enabled and the Options value is set to 0, **Update/DeferUpgradePeriod** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. > -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. - +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. Allows IT Admins to enter more upgrade delays for up to eight months. @@ -398,10 +385,9 @@ If the **Allow Telemetry** policy is enabled and the Options value is set to 0, **Update/EngagedRestartDeadline** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, then the restart won't be automatically executed. It will remain Engaged restart (pending user scheduling). +Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, then the restart won't be automatically executed. It will remain Engaged restart (pending user scheduling). Supported values are 2-30 days. @@ -409,10 +395,9 @@ The default value is 0 days (not specified). **Update/EngagedRestartSnoozeSchedule** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications. +Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications. Supported values are 1-3 days. @@ -420,10 +405,9 @@ The default value is three days. **Update/EngagedRestartTransitionSchedule** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. +Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. Supported values are 2-30 days. @@ -431,70 +415,67 @@ The default value is seven days. **Update/ExcludeWUDriversInQualityUpdate** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates. +Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates. The following list shows the supported values: -- 0 (default) – Allow Windows Update drivers. -- 1 – Exclude Windows Update drivers. +- 0 (default) - Allow Windows Update drivers. +- 1 - Exclude Windows Update drivers. **Update/IgnoreMOAppDownloadLimit** -Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. The following list shows the supported values: -- 0 (default) – Don't ignore MO download limit for apps and their updates. -- 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates. +- 0 (default) - Don't ignore MO download limit for apps and their updates. +- 1 - Ignore MO download limit (allow unlimited downloading) for apps and their updates. To validate this policy: -1. Enable the policy ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: +1. Enable the policy ensure the device is on a cellular network. +1. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: - `regd delete HKEY_USERS\S-1-5-21-2702878673-795188819-444038987-2781\software\microsoft\windows\currentversion\windowsupdate /v LastAutoAppUpdateSearchSuccessTime /f` - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\Automatic App Update"""" /I""` -3. Verify that any downloads that are above the download size limit will complete without being paused. - +1. Verify that any downloads that are above the download size limit will complete without being paused. **Update/IgnoreMOUpdateDownloadLimit** -Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. The following list shows the supported values: -- 0 (default) – Don't ignore MO download limit for OS updates. -- 1 – Ignore MO download limit (allow unlimited downloading) for OS updates. +- 0 (default) - Don't ignore MO download limit for OS updates. +- 1 - Ignore MO download limit (allow unlimited downloading) for OS updates. To validate this policy: -1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on the devices to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell: +1. Enable the policy and ensure the device is on a cellular network. +1. Run the scheduled task on the devices to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell: - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""` -3. Verify that any downloads that are above the download size limit will complete without being paused. - +1. Verify that any downloads that are above the download size limit will complete without being paused. **Update/PauseDeferrals** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education > -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. - +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. Allows IT Admins to pause updates and upgrades for up to five weeks. Paused deferrals will be reset after five weeks. The following list shows the supported values: -- 0 (default) – Deferrals aren't paused. -- 1 – Deferrals are paused. +- 0 (default) - Deferrals aren't paused. +- 1 - Deferrals are paused. If the **Specify intranet Microsoft update service location** policy is enabled, then the **Defer upgrades by**, **Defer updates by** and **Pause Updates and Upgrades** settings have no effect. @@ -502,51 +483,48 @@ If the **Allow Telemetry** policy is enabled and the Options value is set to 0, **Update/PauseFeatureUpdates** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. +Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. The following list shows the supported values: -- 0 (default) – Feature Updates aren't paused. -- 1 – Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner. +- 0 (default) - Feature Updates aren't paused. +- 1 - Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner. **Update/PauseQualityUpdates** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. +Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. The following list shows the supported values: -- 0 (default) – Quality Updates aren't paused. -- 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. +- 0 (default) - Quality Updates aren't paused. +- 1 - Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. **Update/RequireDeferUpgrade** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education > -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. - +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to CBB train. The following list shows the supported values: -- 0 (default) – User gets upgrades from Current Branch. -- 1 – User gets upgrades from Current Branch for Business. +- 0 (default) - User gets upgrades from Current Branch. +- 1 - User gets upgrades from Current Branch for Business. **Update/RequireUpdateApproval** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education
> [!NOTE] -> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. - +> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only the updates on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update for the end user. EULAs are approved once an update is approved. @@ -554,15 +532,14 @@ Supported operations are Get and Replace. The following list shows the supported values: -- 0 – Not configured. The device installs all applicable updates. -- 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required before deployment. +- 0 - Not configured. The device installs all applicable updates. +- 1 - The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required before deployment. **Update/ScheduleImminentRestartWarning** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications. +Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications. Supported values are 15, 30, or 60 (minutes). @@ -570,8 +547,7 @@ The default value is 15 (minutes). **Update/ScheduledInstallDay** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education Enables the IT admin to schedule the day of the update installation. @@ -581,19 +557,18 @@ Supported operations are Add, Delete, Get, and Replace. The following list shows the supported values: -- 0 (default) – Every day -- 1 – Sunday -- 2 – Monday -- 3 – Tuesday -- 4 – Wednesday -- 5 – Thursday -- 6 – Friday -- 7 – Saturday +- 0 (default) - Every day +- 1 - Sunday +- 2 - Monday +- 3 - Tuesday +- 4 - Wednesday +- 5 - Thursday +- 6 - Friday +- 7 - Saturday **Update/ScheduledInstallTime** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education Enables the IT admin to schedule the time of the update installation. @@ -607,10 +582,9 @@ The default value is 3. **Update/ScheduleRestartWarning** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto restart warning reminder notifications. +Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto restart warning reminder notifications. Supported values are 2, 4, 8, 12, or 24 (hours). @@ -618,21 +592,20 @@ The default value is 4 (hours). **Update/SetAutoRestartNotificationDisable** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to disable auto restart notifications for update installations. +Added in Windows 10, version 1703. Allows the IT Admin to disable auto restart notifications for update installations. The following list shows the supported values: -- 0 (default) – Enabled -- 1 – Disabled +- 0 (default) - Enabled +- 1 - Disabled **Update/UpdateServiceUrl** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -> [!Important] +> [!IMPORTANT] > Starting in Windows 10, version 1703 this policy isn't supported in IoT Enterprise. Allows the device to check for updates from a WSUS server instead of Microsoft Update. Using WSUS is useful for on-premises MDMs that need to update devices that can't connect to the Internet. @@ -641,8 +614,8 @@ Supported operations are Get and Replace. The following list shows the supported values: -- Not configured. The device checks for updates from Microsoft Update. -- Set to a URL, such as `http://abcd-srv:8530`. The device checks for updates from the WSUS server at the specified URL. +- Not configured. The device checks for updates from Microsoft Update. +- Set to a URL, such as `http://abcd-srv:8530`. The device checks for updates from the WSUS server at the specified URL. Example @@ -665,7 +638,7 @@ Example **Update/UpdateServiceUrlAlternate** > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. @@ -675,7 +648,7 @@ To use this setting, you must set two server name values: the server from which Value type is string and the default value is an empty string. If the setting isn't configured, and if Automatic Updates isn't disabled by policy or user preference, then the Automatic Updates client connects directly to the Windows Update site on the Internet. -> [!Note] +> [!NOTE] > If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect. > If the "Alternate Download Server" Group Policy isn't set, it will use the WSUS server by default to download updates. > This policy isn't supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. @@ -731,9 +704,7 @@ The MDM must first present the EULA to IT and have them accept it before the upd The update approval list enables IT to approve individual updates and update classifications. Auto-approval by update classifications allows IT to automatically approve Definition Updates (updates to the virus and spyware definitions on devices) and Security Updates (product-specific updates for security-related vulnerability). The update approval list doesn't support the uninstall of updates by revoking approval of already installed updates. Updates are approved based on UpdateID, and an UpdateID only needs to be approved once. An update UpdateID and RevisionNumber are part of the UpdateIdentity type. An UpdateID can be associated to several UpdateIdentity GUIDs because of changes to the RevisionNumber setting. MDM services must synchronize the UpdateIdentity of an UpdateID based on the latest RevisionNumber to get the latest metadata for an update. However, update approval is based on UpdateID. > [!NOTE] -> For the Windows 10 build, the client may need to reboot after additional updates are added. - - +> For the Windows 10 build, the client may need to reboot after additional updates are added. Supported operations are Get and Add. @@ -798,9 +769,9 @@ Supported operation is Get. **InstallableUpdates/*Installable Update Guid*/Type** The UpdateClassification value of the update. Valid values are: -- 0 - None -- 1 - Security -- 2 = Critical +- 0 - None +- 1 - Security +- 2 = Critical Supported operation is Get. @@ -834,40 +805,39 @@ Upgrades deferred until the next period. Supported operation is Get. - ## Windows 10, version 1607 for update management -Here are the new policies added in Windows 10, version 1607 in [Policy CSP](mdm/policy-configuration-service-provider.md). Use these policies for the Windows 10, version 1607 devices. +Here are the new policies added in Windows 10, version 1607 in [Policy CSP](mdm/policy-configuration-service-provider.md). Use these policies for the Windows 10, version 1607 devices. -- Update/ActiveHoursEnd -- Update/ActiveHoursStart -- Update/AllowMUUpdateService -- Update/BranchReadinessLevel -- Update/DeferFeatureUpdatePeriodInDays -- Update/DeferQualityUpdatePeriodInDays -- Update/ExcludeWUDriversInQualityUpdate -- Update/PauseFeatureUpdates -- Update/PauseQualityUpdates +- Update/ActiveHoursEnd +- Update/ActiveHoursStart +- Update/AllowMUUpdateService +- Update/BranchReadinessLevel +- Update/DeferFeatureUpdatePeriodInDays +- Update/DeferQualityUpdatePeriodInDays +- Update/ExcludeWUDriversInQualityUpdate +- Update/PauseFeatureUpdates +- Update/PauseQualityUpdates Here's the list of corresponding Group Policy settings in HKLM\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate. |GPO key|Type|Value| |--- |--- |--- | |BranchReadinessLevel|REG_DWORD|16: systems take Feature Updates on the Current Branch (CB) train

32: systems take Feature Updates on the Current Branch for Business

Other value or absent: receive all applicable updates (CB)| -|DeferQualityUpdates|REG_DWORD|1: defer quality updates

Other value or absent: don’t defer quality updates| +|DeferQualityUpdates|REG_DWORD|1: defer quality updates

Other value or absent: don't defer quality updates| |DeferQualityUpdatesPeriodInDays|REG_DWORD|0-30: days to defer quality updates| -|PauseQualityUpdates|REG_DWORD|1: pause quality updates

Other value or absent: don’t pause quality updates| -|DeferFeatureUpdates|REG_DWORD|1: defer feature updates

Other value or absent: don’t defer feature updates| +|PauseQualityUpdates|REG_DWORD|1: pause quality updates

Other value or absent: don't pause quality updates| +|DeferFeatureUpdates|REG_DWORD|1: defer feature updates

Other value or absent: don't defer feature updates| |DeferFeatureUpdatesPeriodInDays|REG_DWORD|0-180: days to defer feature updates| -|PauseFeatureUpdates|REG_DWORD|1: pause feature updates

Other value or absent: don’t pause feature updates| +|PauseFeatureUpdates|REG_DWORD|1: pause feature updates

Other value or absent: don't pause feature updates| |ExcludeWUDriversInQualityUpdate|REG_DWORD|1: exclude Windows Update drivers

Other value or absent: offer Windows Update drivers| -Here's the list of older policies that are still supported for backward compatibility. You can use these older policies for Windows 10, version 1511 devices. +Here's the list of older policies that are still supported for backward compatibility. You can use these older policies for Windows 10, version 1511 devices. -- Update/RequireDeferUpgrade -- Update/DeferUpgradePeriod -- Update/DeferUpdatePeriod -- Update/PauseDeferrals +- Update/RequireDeferUpgrade +- Update/DeferUpgradePeriod +- Update/DeferUpdatePeriod +- Update/PauseDeferrals ## Update management user experience screenshot @@ -877,7 +847,6 @@ The following screenshots of the administrator console show the list of update t ![mdm update management metadata screenshot.](images/deviceupdatescreenshot2.png) - ## SyncML example Set auto update to notify and defer. diff --git a/windows/client-management/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/diagnose-mdm-failures-in-windows-10.md index 246e8babc9..a2b1c288ba 100644 --- a/windows/client-management/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/diagnose-mdm-failures-in-windows-10.md @@ -1,7 +1,7 @@ --- title: Diagnose MDM failures in Windows 10 description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows 10 devices managed by an MDM server. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -10,8 +10,11 @@ ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/25/2018 ms.collection: - - highpri - - tier2 +- highpri +- tier2 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Diagnose MDM failures in Windows 10 @@ -70,22 +73,22 @@ In this location, the **Admin** channel logs events by default. However, if you ### Collect admin logs 1. Right click on the **Admin** node. -2. Select **Save all events as**. -3. Choose a location and enter a filename. -4. Click **Save**. -5. Choose **Display information for these languages** and then select **English**. -6. Click **Ok**. +1. Select **Save all events as**. +1. Choose a location and enter a filename. +1. Click **Save**. +1. Choose **Display information for these languages** and then select **English**. +1. Click **Ok**. For more detailed logging, you can enable **Debug** logs. Right click on the **Debug** node and then click **Enable Log**. ### Collect debug logs 1. Right click on the **Debug** node. -2. Select **Save all events as**. -3. Choose a location and enter a filename. -4. Click **Save**. -5. Choose **Display information for these languages** and then select **English**. -6. Click **Ok**. +1. Select **Save all events as**. +1. Choose a location and enter a filename. +1. Click **Save**. +1. Choose **Display information for these languages** and then select **English**. +1. Click **Ok**. You can open the log files (.evtx files) in the Event Viewer on a Windows 10 PC running the November 2015 update. @@ -240,32 +243,32 @@ After the logs are collected on the device, you can retrieve the files through t For best results, ensure that the PC or VM on which you're viewing logs matches the build of the OS from which the logs were collected. 1. Open eventvwr.msc. -2. Right-click on **Event Viewer(Local)** and select **Open Saved Log**. +1. Right-click on **Event Viewer(Local)** and select **Open Saved Log**. ![event viewer screenshot.](images/diagnose-mdm-failures9.png) -3. Navigate to the etl file that you got from the device and then open the file. -4. Click **Yes** when prompted to save it to the new log format. +1. Navigate to the etl file that you got from the device and then open the file. +1. Click **Yes** when prompted to save it to the new log format. ![event viewer prompt.](images/diagnose-mdm-failures10.png) ![diagnose mdm failures.](images/diagnose-mdm-failures11.png) -5. The new view contains traces from the channel. Click on **Filter Current Log** from the **Actions** menu. +1. The new view contains traces from the channel. Click on **Filter Current Log** from the **Actions** menu. ![event viewer actions.](images/diagnose-mdm-failures12.png) -6. Add a filter to Event sources by selecting **DeviceManagement-EnterpriseDiagnostics-Provider** and click **OK**. +1. Add a filter to Event sources by selecting **DeviceManagement-EnterpriseDiagnostics-Provider** and click **OK**. ![event filter for Device Management.](images/diagnose-mdm-failures13.png) -7. Now you're ready to start reviewing the logs. +1. Now you're ready to start reviewing the logs. ![event viewer review logs.](images/diagnose-mdm-failures14.png) ## Collect device state data -Here's an example of how to collect current MDM device state data using the [DiagnosticLog CSP](mdm/diagnosticlog-csp.md), version 1.3, which was added in Windows 10, version 1607. You can collect the file from the device using the same FileDownload node in the CSP as you do for the etl files. +Here's an example of how to collect current MDM device state data using the [DiagnosticLog CSP](mdm/diagnosticlog-csp.md), version 1.3, which was added in Windows 10, version 1607. You can collect the file from the device using the same FileDownload node in the CSP as you do for the etl files. ```xml diff --git a/windows/client-management/disconnecting-from-mdm-unenrollment.md b/windows/client-management/disconnecting-from-mdm-unenrollment.md index 371357b658..4e2488f898 100644 --- a/windows/client-management/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/disconnecting-from-mdm-unenrollment.md @@ -1,9 +1,6 @@ --- title: Disconnecting from the management infrastructure (unenrollment) description: Disconnecting is initiated either locally by the user using a phone or remotely by the IT admin using management server. -MS-HAID: - - 'p\_phdevicemgmt.disconnecting\_from\_the\_management\_infrastructure\_\_unenrollment\_' - - 'p\_phDeviceMgmt.disconnecting\_from\_mdm\_unenrollment' ms.reviewer: manager: aaroncz ms.author: vinpa @@ -12,30 +9,31 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Disconnecting from the management infrastructure (unenrollment) The Disconnecting process is done either locally by the user who uses a phone or remotely by the IT administrator using management server. The user-initiated disconnection process is similar to the initial connection, wherein its initiation is from the same location in the Setting Control Panel as creating the workplace account. -The users choose to disconnect for any number of reasons, such as the ones described below: leaving the company or getting a new device or not needing access to their LOB apps on the old device, anymore. When an IT administrator initiates a disconnection, the enrollment client performs the disconnection during the next regular maintenance session. Administrators choose to disconnect users' device after they’ve left the company or because the device is regularly failing to comply with the organization’s security settings policy. +The users choose to disconnect for any number of reasons, such as the ones described below: leaving the company or getting a new device or not needing access to their LOB apps on the old device, anymore. When an IT administrator initiates a disconnection, the enrollment client performs the disconnection during the next regular maintenance session. Administrators choose to disconnect users' device after they've left the company or because the device is regularly failing to comply with the organization's security settings policy. During disconnection, the client executes the following tasks: -- Removes the enterprise application token that allowed installing and running LOB apps. Any business applications associated with this enterprise token are removed as well. -- Removes certificates that are configured by MDM server. -- Ceases enforcement of the settings policies applied by the management infrastructure. -- Removes the device management client configuration and other setting configuration added by MDM server, including the scheduled maintenance task. The client remains dormant unless the user reconnects it to the management infrastructure. -- Reports successfully initiated disassociation to the management infrastructure if the admin initiated the process. In Windows, a user-initiated disassociation is reported to the server as a best effort. - +- Removes the enterprise application token that allowed installing and running LOB apps. Any business applications associated with this enterprise token are removed as well. +- Removes certificates that are configured by MDM server. +- Ceases enforcement of the settings policies applied by the management infrastructure. +- Removes the device management client configuration and other setting configuration added by MDM server, including the scheduled maintenance task. The client remains dormant unless the user reconnects it to the management infrastructure. +- Reports successfully initiated disassociation to the management infrastructure if the admin initiated the process. In Windows, a user-initiated disassociation is reported to the server as a best effort. ## In this topic -- [User-initiated disconnection](#user-initiated-disconnection) -- [Server-initiated disconnection](#server-initiated-disconnection) -- [Unenrollment from Work Access settings page](#unenrollment-from-work-access-settings-page) -- [IT admin–requested disconnection](#it-admin-requested-disconnection) -- [Unenrollment from Azure Active Directory Join](#dataloss) - +- [User-initiated disconnection](#user-initiated-disconnection) +- [Server-initiated disconnection](#server-initiated-disconnection) +- [Unenrollment from Work Access settings page](#unenrollment-from-work-access-settings-page) +- [IT admin-requested disconnection](#it-admin-requested-disconnection) +- [Unenrollment from Azure Active Directory Join](#dataloss) ## User-initiated disconnection @@ -44,9 +42,9 @@ In Windows, after the user confirms the account deletion command and before the This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment may succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. > [!NOTE] -> The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, see the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/). +> The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, see the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/). -  + The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**. After the user elects to unenroll, any active MDM OMA DM sessions are terminated. After that, the DM client starts a DM session, including a user unenroll generic alert in the first package that it sends to the server. @@ -100,7 +98,6 @@ The following sample shows an OMA DM first package that contains a generic alert After the previous package is sent, the unenrollment process begins. - ## Server-initiated disconnection When the server initiates disconnection, all undergoing sessions for the enrollment ID are aborted immediately to avoid deadlocks. The server will not get a response for the unenrollment, instead a generic alert notification is sent with messageid=1. @@ -119,7 +116,6 @@ When the server initiates disconnection, all undergoing sessions for the enrollm ``` - ## Unenrollment from Work Access settings page @@ -127,9 +123,8 @@ If the user is enrolled into MDM using an Azure Active Directory (AAD Join or by You can only use the Work Access page to unenroll under the following conditions: -- Enrollment was done using bulk enrollment. -- Enrollment was created using the Work Access page. - +- Enrollment was done using bulk enrollment. +- Enrollment was created using the Work Access page. ## Unenrollment from Azure Active Directory Join @@ -145,15 +140,8 @@ Before remotely unenrolling corporate devices, you must ensure that there is at In mobile devices, remote unenrollment for Azure Active Directory Joined devices will fail. To remove corporate content from these devices, we recommend you remotely wipe the device. -## IT admin–requested disconnection +## IT admin-requested disconnection -The server requests an enterprise management disconnection by issuing an Exec OMA DM SyncML XML command to the device, using the DMClient configuration service provider’s Unenroll node during the next client-initiated DM session. The Data tag inside the Exec command should be the value of the provisioned DM server ProviderID. For more information, see the Enterprise-specific DMClient configuration topic. +The server requests an enterprise management disconnection by issuing an Exec OMA DM SyncML XML command to the device, using the DMClient configuration service provider's Unenroll node during the next client-initiated DM session. The Data tag inside the Exec command should be the value of the provisioned DM server ProviderID. For more information, see the Enterprise-specific DMClient configuration topic. When the disconnection is completed, the user is notified that the device has been disconnected from enterprise management. - -  - - - - - diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index 67353c881b..553ecce5d4 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -8,18 +8,21 @@ ms.technology: itpro-manage author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 11/01/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Enable ADMX policies in MDM - Here's how to configure Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM). Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of [selected set of Group Policy administrative templates (ADMX policies)](mdm/policies-in-policy-csp-admx-backed.md) for Windows PCs via the [Policy configuration service provider (CSP)](mdm/policy-configuration-service-provider.md). Configuring ADMX policies in Policy CSP is different from the typical way you configure a traditional MDM policy. Summary of steps to enable a policy: + - Find the policy from the list ADMX policies. - Find the Group Policy related information from the MDM policy description. - Use the Group Policy Editor to determine whether there are parameters necessary to enable the policy. @@ -28,20 +31,20 @@ Summary of steps to enable a policy: See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Ingesting-Office-ADMX-Backed-policies-using/ba-p/354824) and [Deploying ADMX policies using Microsoft Intune](/archive/blogs/senthilkumar/intune-deploying-admx-backed-policies-using-microsoft-intune) for a walk-through using Intune. - + ## Enable a policy > [!NOTE] > See [Understanding ADMX policies in Policy CSP](understanding-admx-backed-policies.md). -1. Find the policy from the list [ADMX policies](mdm/policies-in-policy-csp-admx-backed.md). You need the following information listed in the policy description. +1. Find the policy from the list [ADMX policies](mdm/policies-in-policy-csp-admx-backed.md). You need the following information listed in the policy description. - GP Friendly name - GP name - GP ADMX file name - GP path -2. Use the Group Policy Editor to determine whether you need additional information to enable the policy. Run GPEdit.msc +1. Use the Group Policy Editor to determine whether you need additional information to enable the policy. Run GPEdit.msc 1. Click **Start**, then in the text box type **gpedit**. @@ -61,7 +64,7 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ ![Enable App-V client.](images/admx-appv-enableapp-vclient.png) -3. Create the SyncML to enable the policy that doesn't require any parameter. +1. Create the SyncML to enable the policy that doesn't require any parameter. In this example, you configure **Enable App-V Client** to **Enabled**. @@ -89,10 +92,8 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ ``` - ## Enable a policy that requires parameters - 1. Create the SyncML to enable the policy that requires parameters. In this example, the policy is in **Administrative Templates > System > App-V > Publishing**. @@ -113,13 +114,12 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ 4. Search for GP name **Publishing_Server2_policy**. - 5. Under **policy name="Publishing_Server2_Policy"** you can see the \ listed. The *text id* and *enum id* represent the *data id* you need to include in the SyncML data payload. They correspond to the fields you see in the Group Policy Editor. Here's the snippet from appv.admx: ```xml - + @@ -263,7 +263,6 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ ``` - ## Disable a policy The \ payload is \. Here is an example to disable AppVirtualization/PublishingAllowServer2. diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 8bffb182d7..d22d2d0223 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -7,25 +7,24 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 04/30/2022 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.collection: - - highpri - - tier2 +- highpri +- tier2 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Enroll a Windows 10 device automatically using Group Policy -**Applies to:** - -- Windows 11 -- Windows 10 - Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to Mobile Device Management (MDM) for Active Directory (AD) domain-joined devices. The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. Requirements: + - Active Directory-joined PC running Windows 10, version 1709 or later - The enterprise has configured a mobile device management (MDM) service - The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad) @@ -34,11 +33,12 @@ Requirements: > [!TIP] > For more information, see the following topics: +> > - [How to configure automatic registration of Windows domain-joined devices with Azure Active Directory](/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup) > - [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) > - [Azure Active Directory integration with MDM](./azure-active-directory-integration-with-mdm.md) -The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD–registered. +The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD-registered. > [!NOTE] > In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. @@ -58,7 +58,7 @@ The following steps demonstrate required settings using the Intune service: :::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png"::: -2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). +1. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). ![Auto-enrollment activation verification.](images/auto-enrollment-activation-verification.png) @@ -67,9 +67,9 @@ The following steps demonstrate required settings using the Intune service: > > For corporate-owned devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. -3. Verify that the device OS version is Windows 10, version 1709 or later. +1. Verify that the device OS version is Windows 10, version 1709 or later. -4. Auto-enrollment into Intune via Group Policy is valid only for devices that are hybrid Azure AD joined. This condition means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. +1. Auto-enrollment into Intune via Group Policy is valid only for devices that are hybrid Azure AD joined. This condition means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. @@ -83,21 +83,21 @@ The following steps demonstrate required settings using the Intune service: ![Azure AD device list.](images/azure-ad-device-list.png) -5. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc +1. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) -6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. +1. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: -7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. +1. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. -8. Verify that the device isn't enrolled with the old Intune client used on the Intune Silverlight Portal (the Intune portal used before the Azure portal). +1. Verify that the device isn't enrolled with the old Intune client used on the Intune Silverlight Portal (the Intune portal used before the Azure portal). -9. Verify that Microsoft Intune should allow enrollment of Windows devices. +1. Verify that Microsoft Intune should allow enrollment of Windows devices. :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: @@ -106,6 +106,7 @@ You may contact your domain administrators to verify if the group policy has bee This procedure is only for illustration purposes to show how the new auto-enrollment policy works. It's not recommended for the production environment in the enterprise. For bulk deployment, you should use the [Group Policy Management Console process](#configure-the-auto-enrollment-for-a-group-of-devices). Requirements: + - AD-joined PC running Windows 10, version 1709 or later - Enterprise has MDM service already configured - Enterprise AD must be registered with Azure AD @@ -114,17 +115,17 @@ Requirements: ![GPEdit desktop app search result.](images/autoenrollment-gpedit.png) -2. Under **Best match**, select **Edit group policy** to launch it. +1. Under **Best match**, select **Edit group policy** to launch it. -3. In **Local Computer Policy**, select **Administrative Templates** > **Windows Components** > **MDM**. +1. In **Local Computer Policy**, select **Administrative Templates** > **Windows Components** > **MDM**. :::image type="content" alt-text="MDM policies." source="images/autoenrollment-mdm-policies.png" lightbox="images/autoenrollment-mdm-policies.png"::: -4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the **Selected Credential Type to use**. +1. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the **Selected Credential Type to use**. :::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png"::: -5. Select **Enable**, select **User Credential** from the dropdown **Select Credential Type to Use**, then select **OK**. +1. Select **Enable**, select **User Credential** from the dropdown **Select Credential Type to Use**, then select **OK**. > [!NOTE] > In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. The default behavior for older releases is to revert to **User Credential**. @@ -138,28 +139,27 @@ Requirements: ![Two-factor authentication notification.](images/autoenrollment-2-factor-auth.png) - > [!Tip] + > [!TIP] > You can avoid this behavior by using Conditional Access Policies in Azure AD. Learn more by reading [What is Conditional Access?](/azure/active-directory/conditional-access/overview). -6. To verify successful enrollment to MDM, go to **Start** > **Settings** > **Accounts** > **Access work or school**, then select your domain account. +1. To verify successful enrollment to MDM, go to **Start** > **Settings** > **Accounts** > **Access work or school**, then select your domain account. -7. Select **Info** to see the MDM enrollment information. +1. Select **Info** to see the MDM enrollment information. ![Work School Settings.](images/autoenrollment-settings-work-school.png) If you don't see the **Info** button or the enrollment information, enrollment might have failed. Check the status in [Task Scheduler app](#task-scheduler-app). - ### Task Scheduler app 1. Select **Start**, then in the text box type `task scheduler`. ![Task Scheduler search result.](images/autoenrollment-task-schedulerapp.png) -2. Under **Best match**, select **Task Scheduler** to launch it. +1. Under **Best match**, select **Task Scheduler** to launch it. -3. In **Task Scheduler Library**, open **Microsoft > Windows** , then select **EnterpriseMgmt**. +1. In **Task Scheduler Library**, open **Microsoft > Windows** , then select **EnterpriseMgmt**. :::image type="content" alt-text="Auto-enrollment scheduled task." source="images/autoenrollment-scheduled-task.png" lightbox="images/autoenrollment-scheduled-task.png"::: @@ -173,6 +173,7 @@ Requirements: ## Configure the auto-enrollment for a group of devices Requirements: + - AD-joined PC running Windows 10, version 1709 or later - Enterprise has MDM service already configured (with Intune or a third-party service provider) - Enterprise AD must be integrated with Azure AD. @@ -203,9 +204,9 @@ Requirements: - 22H2 --> [Administrative Templates (.admx) for Windows 11 2022 September Update (22H2)](https://www.microsoft.com/download/details.aspx?id=104593) -2. Install the package on the Domain Controller. +1. Install the package on the Domain Controller. -3. Navigate, depending on the version to the folder: +1. Navigate, depending on the version to the folder: - 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2** @@ -227,23 +228,23 @@ Requirements: - 22H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 11 September 2022 Update (22H2)** -4. Rename the extracted Policy Definitions folder to `PolicyDefinitions`. +1. Rename the extracted Policy Definitions folder to `PolicyDefinitions`. -5. Copy the PolicyDefinitions folder to `\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions`. +1. Copy the PolicyDefinitions folder to `\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions`. If this folder doesn't exist, then you'll be switching to a [central policy store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for your entire domain. -6. Wait for the SYSVOL DFSR replication to be completed for the policy to be available. +1. Wait for the SYSVOL DFSR replication to be completed for the policy to be available. This procedure will work for any future version as well. 1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. -2. Create a Security Group for the PCs. +1. Create a Security Group for the PCs. -3. Link the GPO. +1. Link the GPO. -4. Filter using Security Groups. +1. Filter using Security Groups. ## Troubleshoot auto-enrollment of devices @@ -253,12 +254,12 @@ To collect Event Viewer logs: 1. Open Event Viewer. -2. Navigate to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise-Diagnostic-Provider** > **Admin**. +1. Navigate to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise-Diagnostic-Provider** > **Admin**. - > [!Tip] + > [!TIP] > For guidance on how to collect event logs for Intune, see [Collect MDM Event Viewer Log YouTube video](https://www.youtube.com/watch?v=U_oCe2RmQEc). -3. Search for event ID 75, which represents a successful auto-enrollment. Here's an example screenshot that shows the auto-enrollment completed successfully: +1. Search for event ID 75, which represents a successful auto-enrollment. Here's an example screenshot that shows the auto-enrollment completed successfully: :::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png"::: @@ -276,7 +277,7 @@ To collect Event Viewer logs: :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: - > [!Note] + > [!NOTE] > This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task. This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: @@ -313,8 +314,8 @@ To collect Event Viewer logs: - [A Framework for Windows endpoint management transformation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/a-framework-for-windows-endpoint-management-transformation/ba-p/2460684) - [Success with remote Windows Autopilot and Hybrid Azure Active Director join](https://techcommunity.microsoft.com/t5/intune-customer-success/success-with-remote-windows-autopilot-and-hybrid-azure-active/ba-p/2749353) - ### Useful Links + - [Windows 10 Administrative Templates for Windows 10 November 2021 Update (21H2)-v2.0](https://www.microsoft.com/download/details.aspx?id=104042) - [Windows 10 Administrative Templates for Windows 10 May 2021 Update 21H1](https://www.microsoft.com/download/details.aspx?id=103124) - [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591) diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index 6646d4df78..de9278fca0 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -1,6 +1,6 @@ --- title: Enterprise app management -description: This article covers one of the key mobile device management (MDM) features in Windows 10 for managing the lifecycle of apps across all of Windows. +description: This article covers one of the key mobile device management (MDM) features in Windows 10 for managing the lifecycle of apps across all of Windows. ms.reviewer: manager: aaroncz ms.author: vinpa @@ -9,32 +9,35 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 10/04/2021 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Enterprise app management -This article covers one of the key mobile device management (MDM) features in Windows 10. It manages the lifecycle of apps across all of Windows. It's the ability to manage both Store and non-Store apps as part of the native MDM capabilities. New in Windows 10 is the ability to take inventory of all your apps. +This article covers one of the key mobile device management (MDM) features in Windows 10. It manages the lifecycle of apps across all of Windows. It's the ability to manage both Store and non-Store apps as part of the native MDM capabilities. New in Windows 10 is the ability to take inventory of all your apps. ## Application management goals -Windows 10 offers the ability for management servers to: +Windows 10 offers the ability for management servers to: -- Install apps directly from the Microsoft Store for Business -- Deploy offline Store apps and licenses -- Deploy line-of-business (LOB) apps (non-Store apps) -- Inventory all apps for a user (Store and non-Store apps) -- Inventory all apps for a device (Store and non-Store apps) -- Uninstall all apps for a user (Store and non-Store apps) -- Provision apps so they're installed for all users of a device running Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Remove the provisioned app on the device running Windows 10 for desktop editions +- Install apps directly from the Microsoft Store for Business +- Deploy offline Store apps and licenses +- Deploy line-of-business (LOB) apps (non-Store apps) +- Inventory all apps for a user (Store and non-Store apps) +- Inventory all apps for a device (Store and non-Store apps) +- Uninstall all apps for a user (Store and non-Store apps) +- Provision apps so they're installed for all users of a device running Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) +- Remove the provisioned app on the device running Windows 10 for desktop editions ## Inventory your apps -Windows 10 lets you inventory all apps deployed to a user, and inventory all apps for all users of a device on Windows 10 for desktop editions. The [EnterpriseModernAppManagement](mdm/enterprisemodernappmanagement-csp.md) configuration service provider (CSP) inventories packaged apps and doesn't include traditional Win32 apps installed via MSI or executables. When the apps are inventoried, they're separated based on the following app classifications: +Windows 10 lets you inventory all apps deployed to a user, and inventory all apps for all users of a device on Windows 10 for desktop editions. The [EnterpriseModernAppManagement](mdm/enterprisemodernappmanagement-csp.md) configuration service provider (CSP) inventories packaged apps and doesn't include traditional Win32 apps installed via MSI or executables. When the apps are inventoried, they're separated based on the following app classifications: -- Store - Apps that are from the Microsoft Store. Apps can be directly installed from the Store or delivered with the enterprise from the Store for Business -- nonStore - Apps that weren't acquired from the Microsoft Store. -- System - Apps that are part of the OS. You can't uninstall these apps. This classification is read-only and can only be inventoried. +- Store - Apps that are from the Microsoft Store. Apps can be directly installed from the Store or delivered with the enterprise from the Store for Business +- nonStore - Apps that weren't acquired from the Microsoft Store. +- System - Apps that are part of the OS. You can't uninstall these apps. This classification is read-only and can only be inventoried. These classifications are represented as nodes in the EnterpriseModernAppManagement CSP. @@ -150,19 +153,19 @@ Inventory is specific to the package full name and lists bundled packs and resou Here are the nodes for each package full name: -- Name -- Version -- Publisher -- Architecture -- InstallLocation -- IsFramework -- IsBundle -- InstallDate -- ResourceID -- RequiresReinstall -- PackageStatus -- Users -- IsProvisioned +- Name +- Version +- Publisher +- Architecture +- InstallLocation +- IsFramework +- IsBundle +- InstallDate +- ResourceID +- RequiresReinstall +- PackageStatus +- Users +- IsProvisioned For detailed descriptions of each node, see [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md). @@ -206,9 +209,9 @@ You can use the EnterpriseModernAppManagement CSP to query for all app licenses Here are the nodes for each license ID: -- LicenseCategory -- LicenseUsage -- RequestedID +- LicenseCategory +- LicenseUsage +- RequestedID For detailed descriptions of each node, see [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md). @@ -285,11 +288,11 @@ Here are some examples. ### Unlock the device for developer mode -Development of apps on Windows 10 no longer requires a special license. You can enable debugging and deployment of non-packaged apps using ApplicationManagement/AllowDeveloperUnlock policy in Policy CSP. +Development of apps on Windows 10 no longer requires a special license. You can enable debugging and deployment of non-packaged apps using ApplicationManagement/AllowDeveloperUnlock policy in Policy CSP. AllowDeveloperUnlock policy enables the development mode on the device. The AllowDeveloperUnlock isn't configured by default, which means only Microsoft Store apps can be installed. If the management server explicitly sets the value to off, the setting is disabled in the settings panel on the device. -Deployment of apps to Windows 10 for desktop editions requires that there's a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. +Deployment of apps to Windows 10 for desktop editions requires that there's a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. For more information about the AllowDeveloperUnlock policy, see [Policy CSP](mdm/policy-configuration-service-provider.md). @@ -333,10 +336,10 @@ If you purchased an app from the Store for Business and the app is specified for Here are the requirements for this scenario: -- The app is assigned to a user Azure Active Directory (Azure AD) identity in the Store for Business. You can assign directly in the Store for Business or through a management server. -- The device requires connectivity to the Microsoft Store. -- Microsoft Store services must be enabled on the device. The UI for the Microsoft Store can be disabled by the enterprise admin. -- The user must be signed in with their Azure AD identity. +- The app is assigned to a user Azure Active Directory (Azure AD) identity in the Store for Business. You can assign directly in the Store for Business or through a management server. +- The device requires connectivity to the Microsoft Store. +- Microsoft Store services must be enabled on the device. The UI for the Microsoft Store can be disabled by the enterprise admin. +- The user must be signed in with their Azure AD identity. Here are some examples. @@ -357,12 +360,12 @@ Here are some examples. Here are the changes from the previous release: -1. The "{CatID}" reference should be updated to "{ProductID}". This value is acquired as a part of the Store for Business management tool. -2. The value for flags can be "0" or "1" +1. The "{CatID}" reference should be updated to "{ProductID}". This value is acquired as a part of the Store for Business management tool. +1. The value for flags can be "0" or "1" When using "0", the management tool calls back to the Store for Business sync to assign a user a seat of an application. When using "1", the management tool doesn't call back in to the Store for Business sync to assign a user a seat of an application. The CSP will claim a seat if one is available. -3. The `skuid` is a new parameter that is required. This value is acquired as a part of the Store for Business to management tool sync. +1. The `skuid` is a new parameter that is required. This value is acquired as a part of the Store for Business to management tool sync. ### Deploy an offline license to a user @@ -372,8 +375,8 @@ The app license only needs to be deployed as part of the initial installation of In the SyncML, you need to specify the following information in the Exec command: -- License ID - This ID is specified in the LocURI. The License ID for the offline license is referred to as the "Content ID" in the license file. You can retrieve this information from the Base64 encoded license download from the Store for Business. -- License Content - This content is specified in the data section. The License Content is the Base64 encoded blob of the license. +- License ID - This ID is specified in the LocURI. The License ID for the offline license is referred to as the "Content ID" in the license file. You can retrieve this information from the Base64 encoded license download from the Store for Business. +- License Content - This content is specified in the data section. The License Content is the Base64 encoded blob of the license. Here's an example of an offline license installation. @@ -461,8 +464,8 @@ Here's an example of an app installation with dependencies. - - + + @@ -495,13 +498,13 @@ Here's an example of an app installation with dependencies and optional packages - - + + - - @@ -531,7 +534,7 @@ To provision app for all users of a device from a hosted location, the managemen Here's an example of app installation. > [!NOTE] -> This is only supported in Windows 10 for desktop editions. +> This is only supported in Windows 10 for desktop editions. ```xml @@ -560,15 +563,15 @@ Here's an example of app installation. The HostedInstall Exec command contains a Data node that requires an embedded XML. Here are the requirements for the data XML: -- Application node has a required parameter, PackageURI, which can be a local file location, UNC, or HTTPS location. -- Dependencies can be specified if required to be installed with the package. This is optional. +- Application node has a required parameter, PackageURI, which can be a local file location, UNC, or HTTPS location. +- Dependencies can be specified if required to be installed with the package. This is optional. The DeploymentOptions parameter is only available in the user context. Here's an example of app installation with dependencies. > [!NOTE] -> This is only supported in Windows 10 for desktop editions. +> This is only supported in Windows 10 for desktop editions. ```xml @@ -593,7 +596,7 @@ Here's an example of app installation with dependencies. - + @@ -606,14 +609,14 @@ Here's an example of app installation with dependencies. When an app installation is completed, a Windows notification is sent. You can also query the status of using the AppInstallation node. Here's the list of information you can get back in the query: -- Status - indicates the status of app installation. - - NOT\_INSTALLED (0) - The node was added, but the execution wasn't completed. - - INSTALLING (1) - Execution has started, but the deployment hasn't completed. If the deployment completes regardless of success, then this value is updated. - - FAILED (2) - Installation failed. The details of the error can be found under LastError and LastErrorDescription. - - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean up action hasn't completed, then this state may briefly appear. -- LastError - The last error reported by the app deployment server. -- LastErrorDescription - Describes the last error reported by the app deployment server. -- Status - An integer that indicates the progress of the app installation. In cases of an HTTPS location, this status shows the estimated download progress. +- Status - indicates the status of app installation. + - NOT\_INSTALLED (0) - The node was added, but the execution wasn't completed. + - INSTALLING (1) - Execution has started, but the deployment hasn't completed. If the deployment completes regardless of success, then this value is updated. + - FAILED (2) - Installation failed. The details of the error can be found under LastError and LastErrorDescription. + - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean up action hasn't completed, then this state may briefly appear. +- LastError - The last error reported by the app deployment server. +- LastErrorDescription - Describes the last error reported by the app deployment server. +- Status - An integer that indicates the progress of the app installation. In cases of an HTTPS location, this status shows the estimated download progress. Status isn't available for provisioning and only used for user-based installations. For provisioning, the value is always 0. @@ -677,14 +680,13 @@ The Data field value of 0 (zero) indicates success. Otherwise it's an error code > [!NOTE] > At this time, the alert for Store app installation isn't yet available. - ## Uninstall your apps -You can uninstall apps from users from Windows 10 devices. To uninstall an app, you delete it from the AppManagement node of the CSP. Within the AppManagement node, packages are organized based on their origin according to the following nodes: +You can uninstall apps from users from Windows 10 devices. To uninstall an app, you delete it from the AppManagement node of the CSP. Within the AppManagement node, packages are organized based on their origin according to the following nodes: -- AppStore - These apps are for the Microsoft Store. Apps can be directly installed from the store or delivered to the enterprise from the Store for Business. -- nonStore - These apps that weren't acquired from the Microsoft Store. -- System - These apps are part of the OS. You can't uninstall these apps. +- AppStore - These apps are for the Microsoft Store. Apps can be directly installed from the store or delivered to the enterprise from the Store for Business. +- nonStore - These apps that weren't acquired from the Microsoft Store. +- System - These apps are part of the OS. You can't uninstall these apps. To uninstall an app, you delete it under the origin node, package family name, and package full name. To uninstall a XAP, use the product ID in place of the package family name and package full name. @@ -723,13 +725,12 @@ You can remove provisioned apps from a device for a specific version, or for all > [!NOTE] > You can only remove an app that has an inventory value IsProvisioned = 1. - Removing provisioned app occurs in the device context. Here's an example for removing a provisioned app from a device. ```xml - + 1 @@ -821,7 +822,7 @@ To update an app from Microsoft Store, the device requires contact with the stor Here's an example of an update scan. ```xml - + 1 @@ -835,7 +836,7 @@ Here's an example of an update scan. Here's an example of a status check. ```xml - + 1 @@ -863,7 +864,7 @@ Turning off updates only applies to updates from the Microsoft Store at the devi Here's an example. ```xml - + 1 diff --git a/windows/client-management/esim-enterprise-management.md b/windows/client-management/esim-enterprise-management.md index 5acabf7ab8..d51111f943 100644 --- a/windows/client-management/esim-enterprise-management.md +++ b/windows/client-management/esim-enterprise-management.md @@ -8,11 +8,15 @@ ms.author: vinpa ms.topic: conceptual ms.technology: itpro-manage ms.date: 12/31/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # How Mobile Device Management Providers support eSIM Management on Windows The eSIM Profile Management Solution places the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to use an already-existing solution that customers are familiar with and use to manage devices. The expectations from an MDM are that it will use the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and the installation happen in the background without impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. If you are a Mobile Device Management (MDM) Provider and want to support eSIM Management on Windows, perform the following steps: + - Onboard to Azure Active Directory - Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Windows OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this capability to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Windows OMA-DM. This characteristic makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, contact them and learn more about their onboarding. If you would like to integrate and work with only one MDM provider, contact that provider directly. If you would like to offer eSIM management to customers using different MDM providers, contact an orchestrator provider. Orchestrator providers act as proxy handling MDM onboarding and as a mobile operator onboarding. Their role is to make the process as painless and scalable as possible for all parties. Potential orchestrator providers you could contact include: - [HPE Device Entitlement Gateway](https://www.hpe.com/emea_europe/en/solutions/digital-communications-services.html) diff --git a/windows/client-management/federated-authentication-device-enrollment.md b/windows/client-management/federated-authentication-device-enrollment.md index a50c18383c..44ea3c1a36 100644 --- a/windows/client-management/federated-authentication-device-enrollment.md +++ b/windows/client-management/federated-authentication-device-enrollment.md @@ -9,6 +9,9 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 07/28/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Federated authentication device enrollment @@ -34,7 +37,7 @@ The discovery web service provides the configuration information necessary for a > [!NOTE] > The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. -The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: `http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc`. +The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain "enterpriseenrollment" to the domain of the email address, and by appending the path "/EnrollmentServer/Discovery.svc". For example, if the email address is "sample@contoso.com", the resulting URI for first Get request would be: `http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc`. The first request is a standard HTTP GET request. @@ -74,10 +77,10 @@ After the device gets a response from the server, the device sends a POST reques The following logic is applied: -1. The device first tries HTTPS. If the server cert isn't trusted by the device, the HTTPS fails. -2. If that fails, the device tries HTTP to see whether it's redirected: - - If the device isn't redirected, it prompts the user for the server address. - - If the device is redirected, it prompts the user to allow the redirect. +1. The device first tries HTTPS. If the server cert isn't trusted by the device, the HTTPS fails. +1. If that fails, the device tries HTTP to see whether it's redirected: + - If the device isn't redirected, it prompts the user for the server address. + - If the device is redirected, it prompts the user to allow the redirect. The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address @@ -123,31 +126,32 @@ The following example shows the discovery service request. The discovery response is in the XML format and includes the following fields: -- Enrollment service URL (EnrollmentServiceUrl) – Specifies the URL of the enrollment endpoint that is exposed by the management service. The device should call this URL after the user has been authenticated. This field is mandatory. -- Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. -- In Windows, Federated is added as another supported value. This addition allows the server to use the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. +- Enrollment service URL (EnrollmentServiceUrl) - Specifies the URL of the enrollment endpoint that is exposed by the management service. The device should call this URL after the user has been authenticated. This field is mandatory. +- Authentication policy (AuthPolicy) - Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. +- In Windows, Federated is added as another supported value. This addition allows the server to use the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. -> [!Note] +> [!NOTE] > The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. When authentication policy is set to be Federated, Web Authentication Broker (WAB) will be used by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client will call the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage will be used by the enrollment client as the device security secret during the client certificate enrollment request call. -> [!Note] +> [!NOTE] > Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: -> - Parse the OS version from the data sent up during the discovery request. -> - Append the OS version as a parameter in the AuthenticationServiceURL. -> - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. +> +> - Parse the OS version from the data sent up during the discovery request. +> - Append the OS version as a parameter in the AuthenticationServiceURL. +> - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. -> [!Note] +> [!NOTE] > The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. The following are the explicit requirements for the server. -- The ```` element must support HTTPS. -- The authentication server must use a device trusted root certificate. Otherwise, the WAP call will fail. -- WP doesn’t support Windows Integrated Authentication (WIA) for ADFS during WAB authentication. ADFS 2012 R2 if used needs to be configured to not attempt WIA for Windows device. +- The ```` element must support HTTPS. +- The authentication server must use a device trusted root certificate. Otherwise, the WAP call will fail. +- WP doesn't support Windows Integrated Authentication (WIA) for ADFS during WAB authentication. ADFS 2012 R2 if used needs to be configured to not attempt WIA for Windows device. The enrollment client issues an HTTPS request as follows: @@ -236,8 +240,8 @@ This web service implements the X.509 Certificate Enrollment Policy Protocol (MS For Federated authentication policy, the security token credential is provided in a request message using the `` element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows: -- wsse:Security: The enrollment client implements the `` element defined in \[WSS\] section 5. The `` element must be a child of the `` element. -- wsse:BinarySecurityToken: The enrollment client implements the `` element defined in \[WSS\] section 6.3. The `` element must be included as a child of the `` element in the SOAP header. +- wsse:Security: The enrollment client implements the `` element defined in \[WSS\] section 5. The `` element must be a child of the `` element. +- wsse:BinarySecurityToken: The enrollment client implements the `` element defined in \[WSS\] section 6.3. The `` element must be included as a child of the `` element in the SOAP header. As was described in the discovery response section, the inclusion of the `` element is opaque to the enrollment client, and the client doesn't interpret the string, and the inclusion of the element is agreed upon by the security token authentication server (as identified in the `` element of `` and the enterprise server. @@ -386,7 +390,7 @@ The RequestSecurityToken will use a custom TokenType (`http://schemas.microsoft. The RST may also specify many AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. -> [!Note] +> [!NOTE] > The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for federated authentication. @@ -474,15 +478,15 @@ The following example shows the enrollment web service request for federated aut After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR). -> [!Note] +> [!NOTE] > The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (`http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc`), because the token is more than an X.509 v3 certificate. The provisioning XML contains: -- The requested certificates (required) -- The DM client configuration (required) +- The requested certificates (required) +- The DM client configuration (required) The client will install the client certificate, the enterprise root certificate, and intermediate CA certificate if there's one. The DM configuration includes the name and address of the DM server, which client certificate to use, and schedules when the DM client calls back to the server. @@ -558,7 +562,7 @@ The following code shows sample provisioning XML (presented in the preceding pac - + @@ -602,7 +606,7 @@ The following code shows sample provisioning XML (presented in the preceding pac - + @@ -615,14 +619,14 @@ The following code shows sample provisioning XML (presented in the preceding pac > [!NOTE] > -> - `` and `` elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase. +> - `` and `` elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase. > -> - In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML. +> - In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML. > -> - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document. +> - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document. > -> - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. +> - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. > -> - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. +> - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. > -> - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. +> - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. diff --git a/windows/client-management/group-policies-for-enterprise-and-education-editions.md b/windows/client-management/group-policies-for-enterprise-and-education-editions.md index 3f1e0ef47a..540d2b2666 100644 --- a/windows/client-management/group-policies-for-enterprise-and-education-editions.md +++ b/windows/client-management/group-policies-for-enterprise-and-education-editions.md @@ -10,15 +10,13 @@ manager: aaroncz ms.author: vinpa ms.topic: troubleshooting ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Group Policy settings that apply only to Windows 10 Enterprise and Education Editions -**Applies to** -- Windows 10 -- Windows 11 - - In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education. | Policy name | Policy path | Comments | @@ -34,7 +32,3 @@ In Windows 10, version 1607, the following Group Policy settings apply only to W | **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). | | **Only display the private store within the Microsoft Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app

User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app | For more info, see [Manage access to private store](/microsoft-store/manage-access-to-private-store) | | **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) | - - - - diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index 702e05c056..db2ff0f60d 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -7,14 +7,13 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 08/03/2022 -ms.reviewer: +ms.reviewer: manager: aaroncz appliesto: - - ✅ Windows 10 and later - - ✅ Windows 11 and later +- ✅ Windows 11 +- ✅ Windows 10 --- - # Support for mobile application management on Windows The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10, version 1703. diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index 1ed28e0f9b..60014772f7 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -1,40 +1,34 @@ --- title: Manage corporate devices -description: You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. +description: You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. ms.reviewer: manager: aaroncz ms.author: vinpa -keywords: [MDM, device management] ms.prod: windows-client author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 09/14/2021 ms.topic: article ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Manage corporate devices - -**Applies to** - -- Windows 10 -- Windows 11 - -You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10 and Windows 11. +You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10 and Windows 11. ## In this section | Topic | Description | | --- | --- | | [Manage Windows 10 (and Windows 11) in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10 (and Windows 11), including deploying Windows 10 (and Windows 11) in a mixed environment | -| [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | +| [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | | [Manage Windows 10 (and Windows 11) and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | | [New policies for Windows 10 (and Windows 11)](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | | [Group Policies that apply only to Windows Enterprise and Windows Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education | -| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 (and Windows 11) in their organizations | - - +| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 (and Windows 11) in their organizations | ## Learn more @@ -47,4 +41,3 @@ You can use the same management tools to manage all device types running Windows [Windows 10 (and Windows 11) and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) Microsoft Virtual Academy course: [Configuration Manager & Windows Intune](/training/) - diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md index 6f1cf2860e..71760bdd78 100644 --- a/windows/client-management/manage-device-installation-with-group-policy.md +++ b/windows/client-management/manage-device-installation-with-group-policy.md @@ -9,16 +9,14 @@ manager: aaroncz ms.author: vinpa ms.topic: article ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 --- # Manage Device Installation with Group Policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2022 - ## Summary By using Windows operating systems, administrators can determine what devices can be installed on computers they manage. This guide summarizes the device installation process and demonstrates several techniques for controlling device installation by using Group Policy. @@ -26,6 +24,7 @@ By using Windows operating systems, administrators can determine what devices ca ## Introduction ### General + This step-by-step guide describes how you can control device installation on the computers that you manage, including designating which devices users can and can't install. This guide applies to all Windows versions starting with RS5 (1809). The guide includes the following scenarios: - Prevent users from installing devices that are on a "prohibited" list. If a device isn't on the list, then the user can install it. @@ -72,7 +71,7 @@ Group Policy guides: ### Scenario #1: Prevent installation of all printers -In this scenario, the administrator wants to prevent users from installing any printers. Thus is a basic scenario to introduce you to the ‘prevent/allow’ functionality of Device Installation policies in Group Policy. +In this scenario, the administrator wants to prevent users from installing any printers. Thus is a basic scenario to introduce you to the 'prevent/allow' functionality of Device Installation policies in Group Policy. ### Scenario #2: Prevent installation of a specific printer @@ -84,11 +83,11 @@ In this scenario, you'll combine what you learned from both scenario #1 and scen ### Scenario #4: Prevent installation of a specific USB device -This scenario, although similar to scenario #2, brings another layer of complexity – how does device connectivity work in the PnP tree. The administrator wants to prevent standard users from installing a specific USB device. By the end of the scenario, you should understand the way devices are nested in layers under the PnP device connectivity tree. +This scenario, although similar to scenario #2, brings another layer of complexity - how does device connectivity work in the PnP tree. The administrator wants to prevent standard users from installing a specific USB device. By the end of the scenario, you should understand the way devices are nested in layers under the PnP device connectivity tree. ### Scenario #5: Prevent installation of all USB devices while allowing an installation of only an authorized USB thumb drive -In this scenario, combining all previous four scenarios, you'll learn how to protect a machine from all unauthorized USB devices. The administrator wants to allow users to install only a small set of authorized USB devices while preventing any other USB device from being installed. In addition, this scenario includes an explanation of how to apply the ‘prevent’ functionality to existing USB devices that have already been installed on the machine, and the administrator likes to prevent any farther interaction with them (blocking them all together). This scenario builds on the policies and structure we introduced in the first four scenarios and therefore it's preferred to go over them first before attempting this scenario. +In this scenario, combining all previous four scenarios, you'll learn how to protect a machine from all unauthorized USB devices. The administrator wants to allow users to install only a small set of authorized USB devices while preventing any other USB device from being installed. In addition, this scenario includes an explanation of how to apply the 'prevent' functionality to existing USB devices that have already been installed on the machine, and the administrator likes to prevent any farther interaction with them (blocking them all together). This scenario builds on the policies and structure we introduced in the first four scenarios and therefore it's preferred to go over them first before attempting this scenario. ## Technology Review @@ -107,7 +106,7 @@ The four types of identifiers are: - Device Instance ID - Device ID - Device setup classes -- ‘Removable Devices’ device type +- 'Removable Devices' device type #### Device Instance ID @@ -146,12 +145,12 @@ For more information, see [Device Setup Classes](/windows-hardware/drivers/insta This guide doesn't depict any scenarios that use device setup classes. However, the basic principles demonstrated with device identification strings in this guide also apply to device setup classes. After you discover the device setup class for a specific device, you can then use it in a policy to either allow or prevent installation of drivers for that class of devices. -The following two links provide the complete list of Device Setup Classes. ‘System Use’ classes are mostly referred to devices that come with a computer/machine from the factory, while ‘Vendor’ classes are mostly referred to devices that could be connected to an existing computer/machine: +The following two links provide the complete list of Device Setup Classes. 'System Use' classes are mostly referred to devices that come with a computer/machine from the factory, while 'Vendor' classes are mostly referred to devices that could be connected to an existing computer/machine: - [System-Defined Device Setup Classes Available to Vendors - Windows drivers](/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors) - [System-Defined Device Setup Classes Reserved for System Use - Windows drivers](/windows-hardware/drivers/install/system-defined-device-setup-classes-reserved-for-system-use) -#### ‘Removable Device’ Device type +#### 'Removable Device' Device type Some devices could be classified as _Removable Device_. A device is considered _removable_ when the driver for the device to which it's connected indicates that the device is removable. For example, a USB device is reported to be removable by the drivers for the USB hub to which the device is connected. @@ -164,7 +163,7 @@ Device Installation section in Group Policy is a set of policies that control wh The following passages are brief descriptions of the Device Installation policies that are used in this guide. > [!NOTE] -> Device Installation control is applied only to machines (‘computer configuration’) and not users (‘user configuration’) by the nature of the Windows OS design. These policy settings affect all users who log on to the computer where the policy settings are applied. You can't apply these policies to specific users or groups except for the policy Allow administrators to override device installation policy. This policy exempts members of the local Administrators group from any of the device installation restrictions that you apply to the computer by configuring other policy settings as described in this section. +> Device Installation control is applied only to machines ('computer configuration') and not users ('user configuration') by the nature of the Windows OS design. These policy settings affect all users who log on to the computer where the policy settings are applied. You can't apply these policies to specific users or groups except for the policy Allow administrators to override device installation policy. This policy exempts members of the local Administrators group from any of the device installation restrictions that you apply to the computer by configuring other policy settings as described in this section. #### Allow administrators to override Device Installation Restriction policies @@ -219,22 +218,22 @@ To complete each of the scenarios, ensure you have: - A client computer running Windows. -- A USB thumb drive. The scenarios described in this guide use a USB thumb drive as the example device (also known as a “removable disk drive”, "memory drive," a "flash drive," or a "keyring drive"). Most USB thumb drives don't require any manufacturer-provided drivers, and these devices work with the inbox drivers provided with the Windows build. +- A USB thumb drive. The scenarios described in this guide use a USB thumb drive as the example device (also known as a "removable disk drive", "memory drive," a "flash drive," or a "keyring drive"). Most USB thumb drives don't require any manufacturer-provided drivers, and these devices work with the inbox drivers provided with the Windows build. - A USB/network printer pre-installed on the machine. - Access to the administrator account on the testing machine. The procedures in this guide require administrator privileges for most steps. -### Understanding implications of applying ‘Prevent’ policies retroactive +### Understanding implications of applying 'Prevent' policies retroactive -All ‘Prevent’ policies can apply the block functionality to already installed devices—devices that have been installed on the machine before the policy took effect. Using this option is recommended when the administrator isn't sure of the installation history of devices on the machine and would like to make sure the policy applies to all devices. +All 'Prevent' policies can apply the block functionality to already installed devices-devices that have been installed on the machine before the policy took effect. Using this option is recommended when the administrator isn't sure of the installation history of devices on the machine and would like to make sure the policy applies to all devices. -For example: A printer is already installed on the machine, preventing the installation of all printers will block any future printer from being installed while keeping only the installed printer usable. To apply the block retroactive, the administrator should check mark the “apply this policy to already installed devices” option. Marking this option will prevent access to already installed devices in addition to any future ones. +For example: A printer is already installed on the machine, preventing the installation of all printers will block any future printer from being installed while keeping only the installed printer usable. To apply the block retroactive, the administrator should check mark the "apply this policy to already installed devices" option. Marking this option will prevent access to already installed devices in addition to any future ones. This option is a powerful tool, but as such it has to be used carefully. > [!IMPORTANT] -> Applying the ‘Prevent retroactive’ option to crucial devices could render the machine useless/unacceptable! For example: Preventing retroactive all ‘Disk Drives’ could block the access to the disk on which the OS boots with; Preventing retroactive all ‘Net’ could block this machine from accessing network and to fix the issue the admin will have to have a direct connection. +> Applying the 'Prevent retroactive' option to crucial devices could render the machine useless/unacceptable! For example: Preventing retroactive all 'Disk Drives' could block the access to the disk on which the OS boots with; Preventing retroactive all 'Net' could block this machine from accessing network and to fix the issue the admin will have to have a direct connection. ## Determine device identification strings @@ -249,19 +248,19 @@ To find device identification strings using Device Manager 1. Make sure your printer is plugged in and installed. -2. To open Device Manager, click the Start button, type mmc devmgmt.msc in the Start Search box, and then press ENTER; or search for Device Manager as application. +1. To open Device Manager, click the Start button, type mmc devmgmt.msc in the Start Search box, and then press ENTER; or search for Device Manager as application. -3. Device Manager starts and displays a tree representing all of the devices detected on your computer. At the top of the tree is a node with your computers name next to it. Lower nodes represent the various categories of hardware into which your computers devices are grouped. +1. Device Manager starts and displays a tree representing all of the devices detected on your computer. At the top of the tree is a node with your computers name next to it. Lower nodes represent the various categories of hardware into which your computers devices are grouped. -4. Find the “Printers” section and find the target printer +1. Find the "Printers" section and find the target printer ![Selecting the printer in Device Manager.](images/device-installation-dm-printer-by-device.png)
_Selecting the printer in Device Manager_ -5. Double-click the printer and move to the ‘Details’ tab. +1. Double-click the printer and move to the 'Details' tab. - ![‘Details’ tab.](images/device-installation-dm-printer-details-screen.png)
_Open the ‘Details’ tab to look for the device identifiers_ + !['Details' tab.](images/device-installation-dm-printer-details-screen.png)
_Open the 'Details' tab to look for the device identifiers_ -6. From the ‘Value’ window, copy the most detailed Hardware ID – we'll use this value in the policies. +1. From the 'Value' window, copy the most detailed Hardware ID - we'll use this value in the policies. ![HWID.](images/device-installation-dm-printer-hardware-ids.png) @@ -311,24 +310,24 @@ Setting up the environment for the scenario with the following steps: 1. Open Group Policy Editor and navigate to the Device Installation Restriction section. -2. Disable all previous Device Installation policies, except ‘Apply layered order of evaluation’—although the policy is disabled in default, this policy is recommended to be enabled in most practical applications. +1. Disable all previous Device Installation policies, except 'Apply layered order of evaluation'-although the policy is disabled in default, this policy is recommended to be enabled in most practical applications. -3. If there are any enabled policies, changing their status to ‘disabled’, would clear them from all parameters +1. If there are any enabled policies, changing their status to 'disabled', would clear them from all parameters -4. Have a USB/network printer available to test the policy with +1. Have a USB/network printer available to test the policy with -### Scenario steps – preventing installation of prohibited devices +### Scenario steps - preventing installation of prohibited devices Getting the right device identifier to prevent it from being installed: 1. If you have on your system a device from the class you want to block, you could follow the steps in the previous section to find the Device Class identifier through Device Manager or PnPUtil (Class GUID). -2. If you don’t have such device installed on your system or know the name of the class, you can check the following two links: +1. If you don't have such device installed on your system or know the name of the class, you can check the following two links: - [System-Defined Device Setup Classes Available to Vendors - Windows drivers](/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors) - [System-Defined Device Setup Classes Reserved for System Use - Windows drivers](/windows-hardware/drivers/install/system-defined-device-setup-classes-reserved-for-system-use) -3. Our current scenario is focused on preventing all printers from being installed, as such here's the Class GUID for most of printers in the market: +1. Our current scenario is focused on preventing all printers from being installed, as such here's the Class GUID for most of printers in the market: > Printers\ > Class = Printer\ @@ -340,40 +339,40 @@ Getting the right device identifier to prevent it from being installed: Creating the policy to prevent all printers from being installed: -1. Open Group Policy Object Editor—either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search “Group Policy Editor” and open the UI. +1. Open Group Policy Object Editor-either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -2. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions -3. Make sure all policies are disabled (recommended to keep ‘applied layered order of evaluation’ policy enabled). +1. Make sure all policies are disabled (recommended to keep 'applied layered order of evaluation' policy enabled). -4. Open **Prevent installation of devices using drivers that match these device setup classes** policy and select the ‘Enable’ radio button. +1. Open **Prevent installation of devices using drivers that match these device setup classes** policy and select the 'Enable' radio button. -5. In the lower left side, in the ‘Options’ window, click the ‘Show…’ box. This option will take you to a table where you can enter the class identifier to block. +1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the class identifier to block. -6. Enter the printer class GUID you found above with the curly braces (this convention is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} +1. Enter the printer class GUID you found above with the curly braces (this convention is important! Otherwise, it won't work): {4d36e979-e325-11ce-bfc1-08002be10318} ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ -7. Click ‘OK’. +1. Click 'OK'. -8. Click ‘Apply’ on the bottom right of the policy’s window – this option pushes the policy and blocks all future printer installations, but doesn’t apply to existing installs. +1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks all future printer installations, but doesn't apply to existing installs. -9. Optional – if you would like to apply the policy to existing installs: Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the ‘Options’ window mark the checkbox that says ‘also apply to matching devices that are already installed’ +1. Optional - if you would like to apply the policy to existing installs: Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' > [!IMPORTANT] -> Using a Prevent policy (like the one we used in scenario #1 above) and applying it to all previously installed devices (see step #9) could render crucial devices unusable; hence, use with caution. For example: If an IT admin wants to prevent all removable storage devices from being installed on the machine, using ‘Disk Drive’ class for blocking and applying it retroactive could render the internal hard-drive unusable and to break the machine. +> Using a Prevent policy (like the one we used in scenario #1 above) and applying it to all previously installed devices (see step #9) could render crucial devices unusable; hence, use with caution. For example: If an IT admin wants to prevent all removable storage devices from being installed on the machine, using 'Disk Drive' class for blocking and applying it retroactive could render the internal hard-drive unusable and to break the machine. ### Testing the scenario -1. If you haven't completed step #9 – follow these steps: +1. If you haven't completed step #9 - follow these steps: - 1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click “Uninstall device”. - 1. For USB printer – unplug and plug back the cable; for network device – make a search for the printer in the Windows Settings app. + 1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click "Uninstall device". + 1. For USB printer - unplug and plug back the cable; for network device - make a search for the printer in the Windows Settings app. 1. You shouldn't be able to reinstall the printer. -2. If you completed step #9 above and restarted the machine, look for your printer under Device Manager or the Windows Settings app and see that it's no-longer available for you to use. +1. If you completed step #9 above and restarted the machine, look for your printer under Device Manager or the Windows Settings app and see that it's no-longer available for you to use. ## Scenario #2: Prevent installation of a specific printer @@ -385,39 +384,39 @@ Setting up the environment for the scenario with the following steps: 1. Open Group Policy Editor and navigate to the Device Installation Restriction section. -2. Ensure all previous Device Installation policies are disabled except ‘Apply layered order of evaluation’ (this prerequisite is optional to be On/Off this scenario). Although the policy is disabled in default, it's recommended to be enabled in most practical applications. For scenario #2, it's optional. +1. Ensure all previous Device Installation policies are disabled except 'Apply layered order of evaluation' (this prerequisite is optional to be On/Off this scenario). Although the policy is disabled in default, it's recommended to be enabled in most practical applications. For scenario #2, it's optional. -### Scenario steps – preventing installation of a specific device +### Scenario steps - preventing installation of a specific device Getting the right device identifier to prevent it from being installed: -1. Get your printer’s Hardware ID – in this example we'll use the identifier we found previously +1. Get your printer's Hardware ID - in this example we'll use the identifier we found previously ![Printer Hardware ID identifier.](images/device-installation-dm-printer-hardware-ids.png)
_Printer Hardware ID_ -2. Write down the device ID (in this case Hardware ID) – WSDPRINT\CanonMX920_seriesC1A0; Take the more specific identifier to make sure you block a specific printer and not a family of printers +1. Write down the device ID (in this case Hardware ID) - WSDPRINT\CanonMX920_seriesC1A0; Take the more specific identifier to make sure you block a specific printer and not a family of printers Creating the policy to prevent a single printer from being installed: -1. Open Group Policy Object Editor – either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search “Group Policy Editor” and open the UI. +1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -2. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions -3. Open **Prevent installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. +1. Open **Prevent installation of devices that match any of these device IDs** policy and select the 'Enable' radio button. -4. In the lower left side, in the ‘Options’ window, click the ‘Show…’ box. This option will take you to a table where you can enter the device identifier to block. +1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the device identifier to block. -5. Enter the printer device ID you found above – WSDPRINT\CanonMX920_seriesC1A0 +1. Enter the printer device ID you found above - WSDPRINT\CanonMX920_seriesC1A0 ![Prevent Device ID list.](images/device-installation-gpo-prevent-device-id-list-printer.png)
_Prevent Device ID list_ -6. Click ‘OK’. +1. Click 'OK'. -7. Click ‘Apply’ on the bottom right of the policy’s window. This option pushes the policy and blocks the target printer in future installations, but doesn’t apply to an existing install. +1. Click 'Apply' on the bottom right of the policy's window. This option pushes the policy and blocks the target printer in future installations, but doesn't apply to an existing install. -8. Optional – if you would like to apply the policy to an existing install: Open the **Prevent installation of devices that match any of these device IDs** policy again; in the ‘Options’ window mark the checkbox that says ‘also apply to matching devices that are already installed’. +1. Optional - if you would like to apply the policy to an existing install: Open the **Prevent installation of devices that match any of these device IDs** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed'. ### Testing the scenario @@ -425,12 +424,11 @@ If you completed step #8 above and restarted the machine, look for your printer If you haven't completed step #8, follow these steps: -1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click “Uninstall device”. +1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click "Uninstall device". -2. For USB printer – unplug and plug back the cable; for network device – make a search for the printer in the Windows Settings app. - -3. You shouldn't be able to reinstall the printer. +1. For USB printer - unplug and plug back the cable; for network device - make a search for the printer in the Windows Settings app. +1. You shouldn't be able to reinstall the printer. ## Scenario #3: Prevent installation of all printers while allowing a specific printer to be installed @@ -442,67 +440,66 @@ Setting up the environment for the scenario with the following steps: 1. Open Group Policy Editor and navigate to the Device Installation Restriction section. -2. Disable all previous Device Installation policies, and enable ‘Apply layered order of evaluation’. +1. Disable all previous Device Installation policies, and enable 'Apply layered order of evaluation'. -3. If there are any enabled policies, changing their status to ‘disabled’, would clear them from all parameters. +1. If there are any enabled policies, changing their status to 'disabled', would clear them from all parameters. -4. Have a USB/network printer available to test the policy with. +1. Have a USB/network printer available to test the policy with. -### Scenario steps – preventing installation of an entire class while allowing a specific printer +### Scenario steps - preventing installation of an entire class while allowing a specific printer -Getting the device identifier for both the Printer Class and a specific printer – following the steps in scenario #1 to find Class identifier and scenario #2 to find Device identifier you could get the identifiers you need for this scenario: +Getting the device identifier for both the Printer Class and a specific printer - following the steps in scenario #1 to find Class identifier and scenario #2 to find Device identifier you could get the identifiers you need for this scenario: - ClassGuid = {4d36e979-e325-11ce-bfc1-08002be10318} - Hardware ID = WSDPRINT\CanonMX920_seriesC1A0 -First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one: +First create a 'Prevent Class' policy and then create 'Allow Device' one: -1. Open Group Policy Object Editor – either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search “Group Policy Editor” and open the UI. +1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -2. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions -3. Make sure all policies are disabled +1. Make sure all policies are disabled -4. Open **Prevent installation of devices using drivers that match these device setup classes** policy and select the ‘Enable’ radio button. +1. Open **Prevent installation of devices using drivers that match these device setup classes** policy and select the 'Enable' radio button. -5. In the lower left side, in the ‘Options’ window, click the ‘Show…’ box. This option will take you to a table where you can enter the class identifier to block. +1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the class identifier to block. -6. Enter the printer class GUID you found above with the curly braces (this value is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} +1. Enter the printer class GUID you found above with the curly braces (this value is important! Otherwise, it won't work): {4d36e979-e325-11ce-bfc1-08002be10318} ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ -7. Click ‘OK’. +1. Click 'OK'. -8. Click ‘Apply’ on the bottom right of the policy’s window – this option pushes the policy and blocks all future printer installations, but doesn’t apply to existing installs. +1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks all future printer installations, but doesn't apply to existing installs. -9. To complete the coverage of all future and existing printers – Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the ‘Options’ window mark the checkbox that says ‘also apply to matching devices that are already installed’ and click ‘OK’ +1. To complete the coverage of all future and existing printers - Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' and click 'OK' -10. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it – this policy will enable you to override the wide coverage of the ‘Prevent’ policy with a specific device. +1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it - this policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. ![Image of Local Group Policy Editor that shows the policies under "Device Installation Restrictions" and the policy named in this step.](images/device-installation-apply-layered_policy-1.png) ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.".](images/device-installation-apply-layered-policy-2.png)
_Apply layered order of evaluation policy_ -9. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. +1. Now Open **Allow installation of devices that match any of these device IDs** policy and select the 'Enable' radio button. -10. In the lower left side, in the ‘Options’ window, click the ‘Show…’ box. This option will take you to a table where you can enter the device identifier to allow. +1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the device identifier to allow. -11. Enter the printer device ID you found above: WSDPRINT\CanonMX920_seriesC1A0. +1. Enter the printer device ID you found above: WSDPRINT\CanonMX920_seriesC1A0. ![Allow Printer Hardware ID.](images/device-installation-gpo-allow-device-id-list-printer.png)
_Allow Printer Hardware ID_ -12. Click ‘OK’. +1. Click 'OK'. -13. Click ‘Apply’ on the bottom right of the policy’s window – this option pushes the policy and allows the target printer to be installed (or stayed installed). +1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and allows the target printer to be installed (or stayed installed). ## Testing the scenario 1. Look for your printer under Device Manager or the Windows Settings app and see that it's still there and accessible. Or just print a test document. -2. Go back to the Group Policy Editor, disable **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and test again your printer – you shouldn't be bale to print anything or able to access the printer at all. - +1. Go back to the Group Policy Editor, disable **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and test again your printer - you shouldn't be bale to print anything or able to access the printer at all. ## Scenario #4: Prevent installation of a specific USB device @@ -514,67 +511,65 @@ Setting up the environment for the scenario with the following steps: 1. Open Group Policy Editor and navigate to the Device Installation Restriction section -2. Ensure all previous Device Installation policies are disabled except ‘Apply layered order of evaluation’ (this prerequisite is optional to be On/Off this scenario) – although the policy is disabled in default, it's recommended to be enabled in most practical applications. +1. Ensure all previous Device Installation policies are disabled except 'Apply layered order of evaluation' (this prerequisite is optional to be On/Off this scenario) - although the policy is disabled in default, it's recommended to be enabled in most practical applications. -### Scenario steps – preventing installation of a specific device +### Scenario steps - preventing installation of a specific device Getting the right device identifier to prevent it from being installed and its location in the PnP tree: 1. Connect a USB thumb drive to the machine -2. Open Device Manager +1. Open Device Manager -3. Find the USB thumb-drive and select it. +1. Find the USB thumb-drive and select it. ![Selecting the usb thumb-drive in Device Manager.](images/device-installation-dm-usb-by-device.png)
_Selecting the usb thumb-drive in Device Manager_ -4. Change View (in the top menu) to ‘Devices by connections’. This view represents the way devices are installed in the PnP tree. +1. Change View (in the top menu) to 'Devices by connections'. This view represents the way devices are installed in the PnP tree. ![Changing view in Device Manager to see the PnP connection tree.](images/device-installation-dm-usb-by-connection.png)
_Changing view in Device Manager to see the PnP connection tree_ > [!NOTE] - > When blocking\Preventing a device that sits higher in the PnP tree, all the devices that sit under it will be blocked. For example: Preventing a “Generic USB Hub” from being installed, all the devices that lay below a “Generic USB Hub” will be blocked. + > When blocking\Preventing a device that sits higher in the PnP tree, all the devices that sit under it will be blocked. For example: Preventing a "Generic USB Hub" from being installed, all the devices that lay below a "Generic USB Hub" will be blocked. ![Blocking nested devices from the root.](images/device-installation-dm-usb-by-connection-blocked.png)
_When blocking one device, all the devices that are nested below it will be blocked as well_ -5. Double-click the USB thumb-drive and move to the ‘Details’ tab. +1. Double-click the USB thumb-drive and move to the 'Details' tab. -6. From the ‘Value’ window, copy the most detailed Hardware ID—we'll use this value in the policies. In this case Device ID = USBSTOR\DiskGeneric_Flash_Disk______8.07 +1. From the 'Value' window, copy the most detailed Hardware ID-we'll use this value in the policies. In this case Device ID = USBSTOR\DiskGeneric_Flash_Disk______8.07 ![USB device hardware IDs.](images/device-installation-dm-usb-hwid.png)
_USB device hardware IDs_ Creating the policy to prevent a single USB thumb-drive from being installed: -1. Open Group Policy Object Editor – either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search “Group Policy Editor” and open the UI. +1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -2. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions -3. Open **Prevent installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. +1. Open **Prevent installation of devices that match any of these device IDs** policy and select the 'Enable' radio button. -4. In the lower left side, in the ‘Options’ window, click the ‘Show’ box. This option will take you to a table where you can enter the device identifier to block. +1. In the lower left side, in the 'Options' window, click the 'Show' box. This option will take you to a table where you can enter the device identifier to block. -5. Enter the USB thumb-drive device ID you found above – USBSTOR\DiskGeneric_Flash_Disk______8.07 +1. Enter the USB thumb-drive device ID you found above - USBSTOR\DiskGeneric_Flash_Disk______8.07 ![Prevent Device IDs list.](images/device-installation-gpo-prevent-device-id-list-usb.png)
_Prevent Device IDs list_ -6. Click ‘OK’. +1. Click 'OK'. -7. Click ‘Apply’ on the bottom right of the policy’s window – this option pushes the policy and blocks the target USB thumb-drive in future installations, but doesn’t apply to an existing install. - -8. Optional – if you would like to apply the policy to an existing install: Open the **Prevent installation of devices that match any of these device IDs** policy again; in the ‘Options’ window, mark the checkbox that says ‘also apply to matching devices that are already installed’ +1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks the target USB thumb-drive in future installations, but doesn't apply to an existing install. +1. Optional - if you would like to apply the policy to an existing install: Open the **Prevent installation of devices that match any of these device IDs** policy again; in the 'Options' window, mark the checkbox that says 'also apply to matching devices that are already installed' ### Testing the scenario -1. If you haven't completed step #8 – follow these steps: +1. If you haven't completed step #8 - follow these steps: - - Uninstall your USB thumb-drive: Device Manager > Disk drives > right click the target USB thumb-drive > click “Uninstall device”. + - Uninstall your USB thumb-drive: Device Manager > Disk drives > right click the target USB thumb-drive > click "Uninstall device". - You shouldn't be able to reinstall the device. -2. If you completed step #8 above and restarted the machine, look for your Disk drives under Device Manager and see that it's no-longer available for you to use. - +1. If you completed step #8 above and restarted the machine, look for your Disk drives under Device Manager and see that it's no-longer available for you to use. ## Scenario #5: Prevent installation of all USB devices while allowing an installation of only an authorized USB thumb-drive @@ -586,15 +581,15 @@ Setting up the environment for the scenario with the following steps: 1. Open Group Policy Editor and navigate to the Device Installation Restriction section. -2. Disable all previous Device Installation policies, and **enable** ‘Apply layered order of evaluation’. +1. Disable all previous Device Installation policies, and **enable** 'Apply layered order of evaluation'. -3. If there are any enabled policies, changing their status to ‘disabled’, would clear them from all parameters. +1. If there are any enabled policies, changing their status to 'disabled', would clear them from all parameters. -4. Have a USB thumb-drive available to test the policy with. +1. Have a USB thumb-drive available to test the policy with. -### Scenario steps – preventing installation of all USB devices while allowing only an authorized USB thumb-drive +### Scenario steps - preventing installation of all USB devices while allowing only an authorized USB thumb-drive -Getting the device identifier for both the USB Classes and a specific USB thumb-drive – following the steps in scenario #1 to find Class identifier and scenario #4 to find Device identifier you could get the identifiers you need for this scenario: +Getting the device identifier for both the USB Classes and a specific USB thumb-drive - following the steps in scenario #1 to find Class identifier and scenario #4 to find Device identifier you could get the identifiers you need for this scenario: - USB Bus Devices (hubs and host controllers) - Class = USB @@ -610,16 +605,16 @@ Getting the device identifier for both the USB Classes and a specific USB thumb- As mentioned in scenario #4, it's not enough to enable only a single hardware ID in order to enable a single USB thumb-drive. The IT admin has to ensure all the USB devices that preceding the target one aren't blocked (allowed) as well. In Our case the following devices has to be allowed so the target USB thumb-drive could be allowed as well: -- “Intel(R) USB 3.0 eXtensible Host Controller – 1.0 (Microsoft)” -> PCI\CC_0C03 -- “USB Root Hub (USB 3.0)” -> USB\ROOT_HUB30 -- “Generic USB Hub” -> USB\USB20_HUB +- "Intel(R) USB 3.0 eXtensible Host Controller - 1.0 (Microsoft)" -> PCI\CC_0C03 +- "USB Root Hub (USB 3.0)" -> USB\ROOT_HUB30 +- "Generic USB Hub" -> USB\USB20_HUB ![USB devices nested in the PnP tree.](images/device-installation-dm-usb-by-connection-layering.png)
_USB devices nested under each other in the PnP tree_ These devices are internal devices on the machine that define the USB port connection to the outside world. Enabling them shouldn't enable any external/peripheral device from being installed on the machine. > [!IMPORTANT] -> Some device in the system have several layers of connectivity to define their installation on the system. USB thumb-drives are such devices. Thus, when looking to either block or allow them on a system, it's important to understand the path of connectivity for each device. There are several generic Device IDs that are commonly used in systems and could provide a good start to build an ‘Allow list’ in such cases. See below for the list: +> Some device in the system have several layers of connectivity to define their installation on the system. USB thumb-drives are such devices. Thus, when looking to either block or allow them on a system, it's important to understand the path of connectivity for each device. There are several generic Device IDs that are commonly used in systems and could provide a good start to build an 'Allow list' in such cases. See below for the list: > > PCI\CC_0C03; PCI\CC_0C0330; PCI\VEN_8086; PNP0CA1; PNP0CA1&HOST (for Host Controllers)/ > USB\ROOT_HUB30; USB\ROOT_HUB20 (for USB Root Hubs)/ @@ -629,49 +624,49 @@ These devices are internal devices on the machine that define the USB port conne > > Different PC manufacturers sometimes have different ways to nest USB devices in the PnP tree, but in general this is how it's done. -First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one: +First create a 'Prevent Class' policy and then create 'Allow Device' one: -1. Open Group Policy Object Editor – either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search “Group Policy Editor” and open the UI. +1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -2. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions -3. Make sure all policies are disabled +1. Make sure all policies are disabled -4. Open **Prevent installation of devices using drivers that match these device setup classes** policy and select the ‘Enable’ radio button. +1. Open **Prevent installation of devices using drivers that match these device setup classes** policy and select the 'Enable' radio button. -5. In the lower left side, in the ‘Options’ window, click the ‘Show…’ box. This option will take you to a table where you can enter the class identifier to block. +1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the class identifier to block. -6. Enter both USB classes GUID you found above with the curly braces: +1. Enter both USB classes GUID you found above with the curly braces: > {36fc9e60-c465-11cf-8056-444553540000}/ > {88BAE032-5A81-49f0-BC3D-A4FF138216D6} -7. Click ‘OK’. +1. Click 'OK'. -8. Click ‘Apply’ on the bottom right of the policy’s window – this option pushes the policy and blocks all future USB device installations, but doesn’t apply to existing installs. +1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks all future USB device installations, but doesn't apply to existing installs. > [!IMPORTANT] > The previous step prevents all future USB devices from being installed. Before you move to the next step make sure you have as complete list as possible of all the USB Host Controllers, USB Root Hubs and Generic USB Hubs Device IDs available to prevent blocking you from interacting with your system through keyboards and mice. -9. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it – this policy will enable you to override the wide coverage of the ‘Prevent’ policy with a specific device. +1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it - this policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. ![Apply layered order of evaluation policy.](images/device-installation-apply-layered_policy-1.png)
_Apply layered order of evaluation policy_ -10. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. +1. Now Open **Allow installation of devices that match any of these device IDs** policy and select the 'Enable' radio button. -11. In the lower left side, in the ‘Options’ window, click the ‘Show…’ box. This option will take you to a table where you can enter the device identifier to allow. +1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the device identifier to allow. -12. Enter the full list of USB device IDs you found above including the specific USB Thumb-drive you would like to authorize for installation – USBSTOR\DiskGeneric_Flash_Disk______8.07 +1. Enter the full list of USB device IDs you found above including the specific USB Thumb-drive you would like to authorize for installation - USBSTOR\DiskGeneric_Flash_Disk______8.07 ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs.".](images/device-installation-gpo-allow-device-id-list-usb.png)
_Allowed USB Device IDs list_ -13. Click ‘OK’. +1. Click 'OK'. -14. Click ‘Apply’ on the bottom right of the policy’s window. +1. Click 'Apply' on the bottom right of the policy's window. -15. To apply the ‘Prevent’ coverage of all currently installed USB devices – Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the ‘Options’ window mark the checkbox that says ‘also apply to matching devices that are already installed’ and click ‘OK’. +1. To apply the 'Prevent' coverage of all currently installed USB devices - Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' and click 'OK'. ### Testing the scenario diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index 0bb88c2d24..8ef58c88ac 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -9,20 +9,18 @@ manager: aaroncz ms.author: vinpa ms.topic: article ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2016 --- # Manage the Settings app with Group Policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 - You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. ->[!Note] +>[!NOTE] >Each server that you want to manage access to the Settings App must be patched. If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store). @@ -47,4 +45,4 @@ The Group Policy can be configured in one of two ways: specify a list of pages t Here are some examples: - To show only the Ethernet and Proxy pages, set the **Settings App Visibility** textbox to **ShowOnly:Network-Proxy;Network-Ethernet**. -- To hide the Ethernet and Proxy pages, set the **Settings App Visibility** textbox to **Hide:Network-Proxy;Network-Ethernet**. \ No newline at end of file +- To hide the Ethernet and Proxy pages, set the **Settings App Visibility** textbox to **Hide:Network-Proxy;Network-Ethernet**. diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index b3940204c7..5f5eab5ac7 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -6,13 +6,13 @@ ms.localizationpriority: medium ms.date: 06/03/2022 author: vinaypamnani-msft ms.author: vinpa -ms.reviewer: +ms.reviewer: manager: aaroncz ms.topic: overview ms.technology: itpro-manage appliesto: - - ✅ Windows 10 and later - - ✅ Windows 11 and later +- ✅ Windows 11 +- ✅ Windows 10 --- # Manage Windows devices in your organization - transitioning to modern management diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 0771fcc433..b88325b27f 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -5,22 +5,20 @@ ms.prod: windows-client author: vinaypamnani-msft ms.author: vinpa ms.date: 09/14/2021 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.topic: article ms.collection: - - highpri - - tier2 +- highpri +- tier2 ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Create mandatory user profiles -**Applies to** - -- Windows 10 -- Windows 11 - A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. @@ -60,7 +58,7 @@ First, you create a default user profile with the customizations that you want, > [!NOTE] > Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). -1. [Create an answer file (Unattend.xml)](/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) that sets the [CopyProfile](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-copyprofile) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. +1. [Create an answer file (Unattend.xml)](/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) that sets the [CopyProfile](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-copyprofile) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user's profile folder to the default user profile. You can use [Windows System Image Manager](/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. 1. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows 10 Application see [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true). For a list of uninstallable applications, see [Understand the different apps included in Windows 10](/windows/application-management/apps-in-windows-10). @@ -88,7 +86,6 @@ First, you create a default user profile with the customizations that you want, 1. In **User Profiles**, click **Default Profile**, and then click **Copy To**. - ![Example of User Profiles UI.](images/copy-to.png) 1. In **Copy To**, under **Permitted to use**, click **Change**. diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index 7023a7b517..a9010c65c9 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -1,10 +1,7 @@ --- title: MDM enrollment of Windows 10-based devices description: Learn about mobile device management (MDM) enrollment of Windows 10-based devices to simplify access to your organization’s resources. -MS-HAID: - - 'p\_phdevicemgmt.enrollment\_ui' - - 'p\_phDeviceMgmt.mdm\_enrollment\_of\_windows\_devices' -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -12,27 +9,30 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.collection: - - highpri - - tier2 +- highpri +- tier2 ms.date: 12/31/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # MDM enrollment of Windows 10-based devices -In today’s cloud-first world, enterprise IT departments increasingly want to let employees use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization’s resources, such as apps, the corporate network, and email. +In today's cloud-first world, enterprise IT departments increasingly want to let employees use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization's resources, such as apps, the corporate network, and email. > [!NOTE] > When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. -## Connect corporate-owned Windows 10-based devices +## Connect corporate-owned Windows 10-based devices -You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 doesn't require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. +You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 doesn't require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. ![active directory azure ad signin.](images/unifiedenrollment-rs1-1.png) ### Connect your device to an Active Directory domain (join a domain) -Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education can be connected to an Active Directory domain using the Settings app. +Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education can be connected to an Active Directory domain using the Settings app. > [!NOTE] > Mobile devices can't be connected to an Active Directory domain. @@ -41,15 +41,15 @@ Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Educatio Joining your device to an Active Directory domain during the out-of-box-experience (OOBE) isn't supported. To join a domain: -1. On the **Who Owns this PC?** page, select **My work or school owns it**. +1. On the **Who Owns this PC?** page, select **My work or school owns it**. ![oobe creation of a local account](images/unifiedenrollment-rs1-2.png) -2. Next, select **Join a domain**. +1. Next, select **Join a domain**. ![select domain or azure-ad](images/unifiedenrollment-rs1-3.png) -3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. +1. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. ![create pc account.](images/unifiedenrollment-rs1-4.png) @@ -57,27 +57,27 @@ Joining your device to an Active Directory domain during the out-of-box-experien To create a local account and connect the device: -1. Launch the Settings app. +1. Launch the Settings app. ![windows settings screen](images/unifiedenrollment-rs1-5.png) -2. Next, select **Accounts**. +1. Next, select **Accounts**. ![windows settings accounts chosen](images/unifiedenrollment-rs1-6.png) -3. Navigate to **Access work or school**. +1. Navigate to **Access work or school**. ![choose access work or school](images/unifiedenrollment-rs1-7.png) -4. Select **Connect**. +1. Select **Connect**. ![connect to work or to school](images/unifiedenrollment-rs1-8.png) -5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. +1. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. ![join account to active directory domain.](images/unifiedenrollment-rs1-9.png) -6. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. +1. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. ![type in domain name.](images/unifiedenrollment-rs1-10.png) @@ -89,10 +89,8 @@ There are a few instances where your device can't be connected to an Active Dire |-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Your device is already connected to an Active Directory domain. | Your device can only be connected to a single Active Directory domain at a time. | | Your device is connected to an Azure AD domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You can't connect to both simultaneously. | -| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You’ll need to switch to an administrator account to continue. | -| Your device is running Windows 10 Home. | This feature isn't available on Windows 10 Home, so you'll be unable to connect to an Active Directory domain. You'll need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | - - +| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You'll need to switch to an administrator account to continue. | +| Your device is running Windows 10 Home. | This feature isn't available on Windows 10 Home, so you'll be unable to connect to an Active Directory domain. You'll need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | ### Connect your device to an Azure AD domain (join Azure AD) @@ -102,19 +100,19 @@ All Windows devices can be connected to an Azure AD domain. These devices can be To join a domain: -1. Select **My work or school owns it**, then select **Next.** +1. Select **My work or school owns it**, then select **Next.** ![oobe - local account creation](images/unifiedenrollment-rs1-11.png) -2. Select **Join Azure AD**, and then select **Next.** +1. Select **Join Azure AD**, and then select **Next.** ![choose the domain or azure ad](images/unifiedenrollment-rs1-12.png) -3. Type in your Azure AD username. This username is the email address you use to log into Microsoft Office 365 and similar services. +1. Type in your Azure AD username. This username is the email address you use to log into Microsoft Office 365 and similar services. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you'll be able to enter your password directly on this page. If the tenant is part of a federated domain, you'll be redirected to the organization's on-premises federation server, such as Active Directory Federation Services (AD FS) for authentication. - Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to connect your device to MDM. After you complete the flow, your device will be connected to your organization’s Azure AD domain. + Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to connect your device to MDM. After you complete the flow, your device will be connected to your organization's Azure AD domain. ![azure ad signin.](images/unifiedenrollment-rs1-13.png) @@ -122,37 +120,37 @@ To join a domain: To create a local account and connect the device: -1. Launch the Settings app. +1. Launch the Settings app. ![screen displaying windows settings](images/unifiedenrollment-rs1-14.png) -2. Next, navigate to **Accounts**. +1. Next, navigate to **Accounts**. ![choose windows settings accounts](images/unifiedenrollment-rs1-15.png) -3. Navigate to **Access work or school**. +1. Navigate to **Access work or school**. ![choose option of access work or school](images/unifiedenrollment-rs1-16.png) -4. Select **Connect**. +1. Select **Connect**. ![Option of connect to work or school](images/unifiedenrollment-rs1-17.png) -5. Under **Alternate Actions**, select **Join this device to Azure Active Directory**. +1. Under **Alternate Actions**, select **Join this device to Azure Active Directory**. ![option to join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) -6. Type in your Azure AD username. This username is the email address you use to log into Office 365 and similar services. +1. Type in your Azure AD username. This username is the email address you use to log into Office 365 and similar services. ![azure ad sign in.](images/unifiedenrollment-rs1-19.png) -7. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. +1. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to connect your device to MDM. - After you reach the end of the flow, your device should be connected to your organization’s Azure AD domain. You may now sign out of your current account and sign in using your Azure AD username. + After you reach the end of the flow, your device should be connected to your organization's Azure AD domain. You may now sign out of your current account and sign in using your Azure AD username. ![corporate sign in screen](images/unifiedenrollment-rs1-20.png) @@ -165,42 +163,39 @@ There are a few instances where your device can't be connected to an Azure AD do | Your device is connected to an Azure AD domain. | Your device can only be connected to a single Azure AD domain at a time. | | Your device is already connected to an Active Directory domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You can't connect to both simultaneously. | | Your device already has a user connected to a work account. | You can either connect to an Azure AD domain or connect to a work or school account. You can't connect to both simultaneously. | -| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You’ll need to switch to an administrator account to continue. | +| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You'll need to switch to an administrator account to continue. | | Your device is already managed by MDM. | The connect to Azure AD flow will attempt to enroll your device into MDM if your Azure AD tenant has a preconfigured MDM endpoint. Your device must be unenrolled from MDM to be able to connect to Azure AD in this case. | -| Your device is running Windows 10 Home. | This feature isn't available on Windows 10 Home, so you'll be unable to connect to an Azure AD domain. You'll need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | - - +| Your device is running Windows 10 Home. | This feature isn't available on Windows 10 Home, so you'll be unable to connect to an Azure AD domain. You'll need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | ## Connect personally owned devices - -Personally owned devices, also known as bring your own device (BYOD), can be connected to a work or school account, or to MDM. Windows 10 doesn't require a personal Microsoft account on devices to connect to work or school. +Personally owned devices, also known as bring your own device (BYOD), can be connected to a work or school account, or to MDM. Windows 10 doesn't require a personal Microsoft account on devices to connect to work or school. ### Connect to a work or school account -All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. +All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. ### Use the Settings app To create a local account and connect the device: -1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. +1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. ![screen of windows settings](images/unifiedenrollment-rs1-21-b.png) -2. Navigate to **Access work or school**. +1. Navigate to **Access work or school**. ![user's option of access work or school](images/unifiedenrollment-rs1-23-b.png) -3. Select **Connect**. +1. Select **Connect**. ![connect button to access the option of work or school.](images/unifiedenrollment-rs1-24-b.png) -4. Type in your Azure AD username. This username is the email address you use to log into Office 365 and similar services. +1. Type in your Azure AD username. This username is the email address you use to log into Office 365 and similar services. ![sync work or school account to azure ad.](images/unifiedenrollment-rs1-25-b.png) -5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. +1. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. @@ -210,13 +205,13 @@ To create a local account and connect the device: ![corporate sign in - screen and option](images/unifiedenrollment-rs1-26.png) -6. After you complete the flow, your Microsoft account will be connected to your work or school account. +1. After you complete the flow, your Microsoft account will be connected to your work or school account. ![account successfully added.](images/unifiedenrollment-rs1-27.png) ### Connect to MDM on a desktop (enrolling in device management) -All Windows 10-based devices can be connected to MDM. You can connect to an MDM through the Settings app. +All Windows 10-based devices can be connected to MDM. You can connect to an MDM through the Settings app. ### Use the Settings app @@ -226,29 +221,29 @@ To create a local account and connect the device: ![screen that displays windows settings](images/unifiedenrollment-rs1-28.png) -2. Next, navigate to **Accounts**. +1. Next, navigate to **Accounts**. ![windows settings accounts page.](images/unifiedenrollment-rs1-29.png) -3. Navigate to **Access work or school**. +1. Navigate to **Access work or school**. ![access work or school.](images/unifiedenrollment-rs1-30.png) -4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). +1. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). ![connect to work or school screen](images/unifiedenrollment-rs1-31.png) -5. Type in your work email address. +1. Type in your work email address. ![set up work or school account screen](images/unifiedenrollment-rs1-32.png) -6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for more authentication information. +1. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you'll be presented with a new window that will ask you for more authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you'll see the enrollment progress on screen. ![screen to set up your device](images/unifiedenrollment-rs1-33-b.png) - After you complete the flow, your device will be connected to your organization’s MDM. + After you complete the flow, your device will be connected to your organization's MDM. ### Help with connecting personally owned devices @@ -256,25 +251,23 @@ There are a few instances where your device may not be able to connect to work. | Error Message | Description | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Your device is already connected to your organization’s cloud. | Your device is already connected to either Azure AD, a work or school account, or an AD domain. | -| We couldn't find your identity in your organization’s cloud. | The username you entered wasn't found on your Azure AD tenant. | +| Your device is already connected to your organization's cloud. | Your device is already connected to either Azure AD, a work or school account, or an AD domain. | +| We couldn't find your identity in your organization's cloud. | The username you entered wasn't found on your Azure AD tenant. | | Your device is already being managed by an organization. | Your device is either already managed by MDM or Microsoft Configuration Manager. | -| You don’t have the right privileges to perform this operation. Talk to your admin. | You can't enroll your device into MDM as a standard user. You must be on an administrator account. | -| We couldn’t auto-discover a management endpoint matching the username entered. Check your username and try again. If you know the URL to your management endpoint, enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | - +| You don't have the right privileges to perform this operation. Talk to your admin. | You can't enroll your device into MDM as a standard user. You must be on an administrator account. | +| We couldn't auto-discover a management endpoint matching the username entered. Check your username and try again. If you know the URL to your management endpoint, enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | ## Connect your Windows 10-based device to work using a deep link +Windows 10-based devices may be connected to work using a deep link. Users will be able to select or open a link in a particular format from anywhere in Windows 10, and be directed to the new enrollment experience. -Windows 10-based devices may be connected to work using a deep link. Users will be able to select or open a link in a particular format from anywhere in Windows 10, and be directed to the new enrollment experience. - -In Windows 10, version 1607, deep linking will only be supported for connecting devices to MDM. It will not support adding a work or school account, joining a device to Azure AD, and joining a device to Active Directory. +In Windows 10, version 1607, deep linking will only be supported for connecting devices to MDM. It will not support adding a work or school account, joining a device to Azure AD, and joining a device to Active Directory. The deep link used for connecting your device to work will always use the following format. **ms-device-enrollment:?mode={mode\_name}** -| Parameter | Description | Supported Value for Windows 10| +| Parameter | Description | Supported Value for Windows 10| |-----------|--------------------------------------------------------------|----------------------------------------------| | mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory-joined. | |username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string | @@ -297,9 +290,9 @@ The deep link used for connecting your device to work will always use the follow To connect your devices to MDM using deep links: -1. Starting with Windows 10, version 1607, create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm**, and user-friendly display text, such as **Click here to connect Windows to work**: +1. Starting with Windows 10, version 1607, create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm**, and user-friendly display text, such as **Click here to connect Windows to work**: - (This link will launch the flow equivalent to the Enroll into the device management option in Windows 10, version 1511.) + (This link will launch the flow equivalent to the Enroll into the device management option in Windows 10, version 1511.) - IT admins can add this link to a welcome email that users can select to enroll into MDM. @@ -310,13 +303,13 @@ To connect your devices to MDM using deep links: - IT admins can also add this link to an internal web page that users refer to enrollment instructions. -2. After you select the link or run it, Windows 10 launches the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option in Windows 10, version 1511). +1. After you select the link or run it, Windows 10 launches the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option in Windows 10, version 1511). Type in your work email address. ![set up a work or school account screen](images/deeplinkenrollment3.png) -3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for more authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. +1. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you'll be presented with a new window that will ask you for more authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. After you complete the flow, your device will be connected to your organization's MDM. @@ -324,7 +317,6 @@ To connect your devices to MDM using deep links: ## Manage connections - To manage your work or school connections, select **Settings** > **Accounts** > **Access work or school**. Your connections will show on this page and selecting one will expand options for that connection. ![managing work or school account.](images/unifiedenrollment-rs1-34-b.png) @@ -333,11 +325,11 @@ To manage your work or school connections, select **Settings** > **Accounts** > The **Info** button can be found on work or school connections involving MDM. This button is included in the following scenarios: -- Connecting your device to an Azure AD domain that has auto-enroll into MDM configured. -- Connecting your device to a work or school account that has auto-enroll into MDM configured. -- Connecting your device to MDM. +- Connecting your device to an Azure AD domain that has auto-enroll into MDM configured. +- Connecting your device to a work or school account that has auto-enroll into MDM configured. +- Connecting your device to MDM. -Selecting the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You’ll be able to view your organization’s support information (if configured) on this page. You’ll also be able to start a sync session that forces your device to communicate to the MDM server and fetch any updates to policies if needed. +Selecting the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You'll be able to view your organization's support information (if configured) on this page. You'll also be able to start a sync session that forces your device to communicate to the MDM server and fetch any updates to policies if needed. Starting in Windows 10, version 1709, selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here's an example screenshot. @@ -350,24 +342,16 @@ Starting in Windows 10, version 1709, selecting the **Info** button will show a The **Disconnect** button can be found on all work connections. Generally, selecting the **Disconnect** button will remove the connection from the device. There are a few exceptions to this functionality: -- Devices that enforce the AllowManualMDMUnenrollment policy won't allow users to remove MDM enrollments. These connections must be removed by a server-initiated unenroll command. -- On mobile devices, you can't disconnect from Azure AD. These connections can only be removed by wiping the device. +- Devices that enforce the AllowManualMDMUnenrollment policy won't allow users to remove MDM enrollments. These connections must be removed by a server-initiated unenroll command. +- On mobile devices, you can't disconnect from Azure AD. These connections can only be removed by wiping the device. > [!WARNING] > Disconnecting might result in the loss of data on the device. ## Collecting diagnostic logs - You can collect diagnostic logs around your work connections by going to **Settings** > **Accounts** > **Access work or school**, and then selecting the **Export your management logs** link under **Related Settings**. Next, select **Export**, and follow the path displayed to retrieve your management log files. Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you'll see the button to create a report, as shown here. ![collecting enrollment management log files.](images/unifiedenrollment-rs1-37-c.png) - - - - - - - diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index 32f8e9cbb9..efa9cb8b51 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -10,11 +10,11 @@ author: vinaypamnani-msft ms.author: vinpa manager: aaroncz appliesto: - - ✅ Windows 10 and later - - ✅ Windows 11 and later +- ✅ Windows 11 +- ✅ Windows 10 ms.collection: - - highpri - - tier2 +- highpri +- tier2 --- # Mobile Device Management overview diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index aa0fa503b7..c70b4ab1a5 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -1,10 +1,7 @@ --- title: What's new in MDM enrollment and management description: Discover what's new and breaking changes in Windows 10 and Windows 11 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. -MS-HAID: - - 'p\_phdevicemgmt.mdm\_enrollment\_and\_management\_overview' - - 'p\_phDeviceMgmt.new\_in\_windows\_mdm\_enrollment\_management' -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -13,6 +10,9 @@ ms.technology: itpro-manage author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 09/16/2022 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # What's new in mobile device enrollment and management @@ -145,7 +145,7 @@ A production ready deployment must have the appropriate certificate details as p EAP XML must be updated with relevant information for your environment. This task can be done either manually by editing the XML sample below, or by using the step by step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows: -- For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This detail is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags, you'll find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM’s guidance on how to deploy a new Wi-Fi profile. +- For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This detail is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags, you'll find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM's guidance on how to deploy a new Wi-Fi profile. - For VPN, EAP Configuration is a separate field in the MDM Configuration. Work with your MDM provider to identify and update the appropriate Field. For information about EAP Settings, see . @@ -281,28 +281,28 @@ Alternatively you can use the following procedure to create an EAP Configuration 1. Follow steps 1 through 7 in [EAP configuration](mdm/eap-configuration.md). -2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop-down menu (this drop-down menu selects EAP TLS.). +1. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop-down menu (this drop-down menu selects EAP TLS.). :::image type="content" alt-text="vpn selfhost properties window." source="images/certfiltering1.png"::: > [!NOTE] > For PEAP or TTLS, select the appropriate method and continue following this procedure. -3. Click the **Properties** button underneath the drop-down menu. +1. Click the **Properties** button underneath the drop-down menu. -4. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. +1. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. :::image type="content" alt-text="smart card or other certificate properties window." source="images/certfiltering2.png"::: -5. In the **Configure Certificate Selection** menu, adjust the filters as needed. +1. In the **Configure Certificate Selection** menu, adjust the filters as needed. :::image type="content" alt-text="configure certificate selection window." source="images/certfiltering3.png"::: -6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. +1. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. -7. Close the rasphone dialog box. +1. Close the rasphone dialog box. -8. Continue following the procedure in [EAP configuration](mdm/eap-configuration.md) from Step 9 to get an EAP TLS profile with appropriate filtering. +1. Continue following the procedure in [EAP configuration](mdm/eap-configuration.md) from Step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] > You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)). @@ -332,17 +332,16 @@ No. Only one MDM is allowed. ### How do I set the maximum number of Azure Active Directory-joined devices per user? 1. Sign in to the portal as tenant admin: https://portal.azure.com. -2. Select Active Directory on the left pane. -3. Choose your tenant. -4. Select **Configure**. -5. Set quota to unlimited. +1. Select Active Directory on the left pane. +1. Choose your tenant. +1. Select **Configure**. +1. Set quota to unlimited. :::image type="content" alt-text="aad maximum joined devices." source="images/faq-max-devices.png"::: ### What is dmwappushsvc? Entry | Description ---------------- | -------------------- -What is dmwappushsvc? | It's a Windows service that ships in Windows 10 and Windows 11 operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | +--------------- | -------------------- What is dmwappushsvc? | It's a Windows service that ships in Windows 10 and Windows 11 operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further. This service doesn't send telemetry.| How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc) and locating *Device Management Wireless Application Protocol (WAP) Push message Routing Service*. However, since this service is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service will cause your management to fail.| diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 0adc1b4483..30d0863228 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -10,16 +10,13 @@ ms.localizationpriority: medium ms.date: 09/15/2021 ms.topic: reference ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # New policies for Windows 10 - -**Applies to** - -- Windows 10 -- Windows 11 - As of September 2020 This page will no longer be updated. To find the Group Polices that ship in each version of Windows, refer to the Group Policy Settings Reference Spreadsheet. You can always locate the most recent version of the Spreadsheet by searching the Internet for "Windows Version + Group Policy Settings Reference". For example, searching for "Windows 2004" + "Group Policy Settings Reference Spreadsheet" in a web browser will return to you the link to download the Group Policy Settings Reference Spreadsheet for Windows 2004. @@ -41,7 +38,6 @@ The following Group Policy settings were added in Windows 10, version 1903: - System\Storage Sense\Configure Storage Sense Downloads cleanup threshold - System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool\Troubleshooting:Allow users to access recommended troubleshooting for known problems - **Windows Components** - Windows Components\App Privacy\Let Windows apps activate with voice @@ -180,7 +176,7 @@ The following Group Policy settings were added in Windows 10, version 1809: - Windows Components\Microsoft Defender Antivirus\Scan\Configure low CPU priority for scheduled scans - Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard - Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard -- Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user’s device +- Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user's device - Windows Components\Windows Defender Application Guard\Configure additional sources for untrusted files in Windows Defender Application Guard - Windows Components\Windows Hello for Business\Use Windows Hello for Business certificates as smart card certificates - Windows Components\Windows Media Player\Do Not Show First Use Dialog Boxes @@ -238,7 +234,6 @@ The following Group Policy settings were added in Windows 10, version 1809: - Network\Windows Connection Manager\Enable Windows to soft-disconnect a computer from a network - ## New Group Policy settings in Windows 10, version 1803 The following Group Policy settings were added in Windows 10, version 1803: @@ -278,7 +273,6 @@ The following Group Policy settings were added in Windows 10, version 1803: - Windows Components\Windows Defender Security Center\Device security\Hide the Secure boot area - Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Ransomware data recovery area - ## New Group Policy settings in Windows 10, version 1709 The following Group Policy settings were added in Windows 10, version 1709: @@ -347,7 +341,6 @@ The following Group Policy settings were added in Windows 10, version 1709: - Windows Components\Windows Update\Allow updates to be downloaded automatically over metered connections - Windows Components\Windows Update\Do not allow update deferral policies to cause scans against Windows Update - ## New Group Policy settings in Windows 10, version 1703 The following Group Policy settings were added in Windows 10, version 1703: @@ -473,34 +466,33 @@ The following Group Policy settings were added in Windows 10, version 1703: - Windows Components\Windows Update\Turn on recommended updates via Automatic Updates - Windows Components\Shutdown Options\Turn off legacy remote shutdown interface - For a spreadsheet of Group Policy settings included in Windows 10 and Windows Server 2016, see [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=613627). ## New MDM policies Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education include previous Windows Phone settings, and new or enhanced settings for Windows 10, such as: -- Defender (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education only) +- Defender (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education only) -- Enhanced Bluetooth policies +- Enhanced Bluetooth policies -- Passport and Hello +- Passport and Hello -- Device update +- Device update -- Hardware-based device health attestation +- Hardware-based device health attestation -- [Kiosk mode](/windows/configuration/set-up-a-device-for-anyone-to-use), start screen, start menu layout +- [Kiosk mode](/windows/configuration/set-up-a-device-for-anyone-to-use), start screen, start menu layout -- Security +- Security -- [VPN](/windows/security/identity-protection/vpn/vpn-profile-options) and enterprise Wi-Fi management +- [VPN](/windows/security/identity-protection/vpn/vpn-profile-options) and enterprise Wi-Fi management -- Certificate management +- Certificate management -- Windows Tips +- Windows Tips -- Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu +- Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu Windows 10, version 1703, adds a number of [ADMX-backed policies to MDM](./mdm/policy-configuration-service-provider.md). diff --git a/windows/client-management/oma-dm-protocol-support.md b/windows/client-management/oma-dm-protocol-support.md index d87cd9db0c..1c8a92786b 100644 --- a/windows/client-management/oma-dm-protocol-support.md +++ b/windows/client-management/oma-dm-protocol-support.md @@ -9,9 +9,11 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- - # OMA DM protocol support The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf). @@ -32,7 +34,6 @@ The following table shows the OMA DM standards that Windows uses. |WBXML support|Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This dual-format support is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://www.openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.| |Handling of large objects|In Windows 10, version 1511, client support for uploading large objects to the server was added.| - ## OMA DM protocol common elements @@ -68,26 +69,27 @@ A short DM session can be summarized as: A server sends a Get command to a client device to retrieve the contents of one of the nodes of the management tree. The device performs the operation and responds with a Result command that contains the requested contents. A DM session can be divided into two phases: -1. **Setup phase**: In response to a trigger event, a client device sends an initiating message to a DM server. The device and server exchange needed authentication and device information. This phase is represented by steps 1, 2, and 3 in the following table. -2. **Management phase**: The DM server is in control. It sends management commands to the device and the device responds. Phase 2 ends when the DM server stops sending commands and terminates the session. This phase is represented by steps 3, 4, and 5 in the following table. + +1. **Setup phase**: In response to a trigger event, a client device sends an initiating message to a DM server. The device and server exchange needed authentication and device information. This phase is represented by steps 1, 2, and 3 in the following table. +1. **Management phase**: The DM server is in control. It sends management commands to the device and the device responds. Phase 2 ends when the DM server stops sending commands and terminates the session. This phase is represented by steps 3, 4, and 5 in the following table. The following information shows the sequence of events during a typical DM session. -1. DM client is invoked to call back to the management server

Enterprise scenario – The device task schedule invokes the DM client. +1. DM client is invoked to call back to the management server

Enterprise scenario - The device task schedule invokes the DM client. The MO server sends a server trigger message to invoke the DM client. The trigger message includes the server ID and tells the client device to initiate a session with the server. The client device authenticates the trigger message and verifies that the server is authorized to communicate with it.

Enterprise scenario - At the scheduled time, the DM client is invoked periodically to call back to the enterprise management server over HTTPS. -2. The device sends a message, over an IP connection, to initiate the session. +1. The device sends a message, over an IP connection, to initiate the session. This message includes device information and credentials. The client and server do mutual authentication over an SSL channel or at the DM application level. -3. The DM server responds, over an IP connection (HTTPS). The server sends initial device management commands, if any. +1. The DM server responds, over an IP connection (HTTPS). The server sends initial device management commands, if any. -4. The device responds to server management commands. This message includes the results of performing the specified device management operations. +1. The device responds to server management commands. This message includes the results of performing the specified device management operations. -5. The DM server terminates the session or sends another command. The DM session ends, or Step 4 is repeated. +1. The DM server terminates the session or sends another command. The DM session ends, or Step 4 is repeated. The step numbers don't represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each extra message. For more information about MsgID and OMA SyncML protocol, see [OMA Device Management Representation Protocol (DM_RepPro-V1_2-20070209-A)](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/). @@ -97,7 +99,6 @@ If a request includes credentials and the response code to the request is 200, t For more information about Basic or MD5 client authentication, MD5 server authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM_Security-V1_2_1-20080617-A), authentication response code handling and step-by-step samples in OMA Device Management Protocol specification (OMA-TS-DM_Protocol-V1_2_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2_1-20080617-A/). - ## User targeted vs. Device targeted configuration For CSPs and policies that support per user configuration, the MDM server can send user targeted setting values to the device that a MDM-enrolled user is actively logged into. The device notifies the server of the sign-in status via a device alert (1224) with Alert type = in DM pkg\#1. @@ -130,7 +131,6 @@ The following LocURL shows a per user CSP node configuration: `./user/vendor/MSF The following LocURL shows a per device CSP node configuration: `./device/vendor/MSFT/RemoteWipe/DoWipe` - ## SyncML response status codes diff --git a/windows/client-management/on-premise-authentication-device-enrollment.md b/windows/client-management/on-premise-authentication-device-enrollment.md index daf5a628d7..95dce3e717 100644 --- a/windows/client-management/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/on-premise-authentication-device-enrollment.md @@ -9,11 +9,14 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # On-premises authentication device enrollment -This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). +This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). ## In this topic @@ -23,7 +26,7 @@ This section provides an example of the mobile device enrollment protocol using - [Enrollment policy web service](#enrollment-policy-web-service) - [Enrollment web service](#enrollment-web-service) -For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery service @@ -32,7 +35,7 @@ The discovery web service provides the configuration information necessary for a > [!NOTE] > The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. -The device’s automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc +The device's automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain "enterpriseenrollment" to the domain of the email address, and by appending the path "/EnrollmentServer/Discovery.svc". For example, if the email address is "sample@contoso.com", the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc The first request is a standard HTTP GET request. @@ -72,10 +75,10 @@ After the device gets a response from the server, the device sends a POST reques The following logic is applied: -1. The device first tries HTTPS. If the server cert is not trusted by the device, the HTTPS fails. -2. If that fails, the device tries HTTP to see whether it is redirected: - - If the device is not redirected, it prompts the user for the server address. - - If the device is redirected, it prompts the user to allow the redirect. +1. The device first tries HTTPS. If the server cert is not trusted by the device, the HTTPS fails. +1. If that fails, the device tries HTTP to see whether it is redirected: + - If the device is not redirected, it prompts the user for the server address. + - If the device is redirected, it prompts the user to allow the redirect. The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address: @@ -124,9 +127,9 @@ If a domain and user name are provided by the user instead of an email address, The discovery response is in the XML format and includes the following fields: -- Enrollment service URL (EnrollmentServiceUrl) – Specifies the URL of the enrollment endpoint that is exposed by the management service. The device should call this URL after the user has been authenticated. This field is mandatory. -- Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. -- Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. +- Enrollment service URL (EnrollmentServiceUrl) - Specifies the URL of the enrollment endpoint that is exposed by the management service. The device should call this URL after the user has been authenticated. This field is mandatory. +- Authentication policy (AuthPolicy) - Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. +- Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. > [!NOTE] > The HTTP server response must not be chunked; it must be sent as one message. @@ -462,7 +465,7 @@ The following example shows the encoded provisioning XML. - + @@ -505,7 +508,7 @@ The following example shows the encoded provisioning XML. - + diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index 5e90998e48..efc700f21d 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -1,10 +1,7 @@ --- title: Push notification support for device management description: The DMClient CSP supports the ability to configure push-initiated device management sessions. -MS-HAID: - - 'p\_phdevicemgmt.push\_notification\_support\_for\_device\_management' - - 'p\_phDeviceMgmt.push\_notification\_windows\_mdm' -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -12,6 +9,9 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 09/22/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Push notification support for device management @@ -33,7 +33,7 @@ The following restrictions are related to push notifications and WNS: - WNS reserves the right to block push notifications to your PFN if improper use of notifications is detected. Any devices being managed using this PFN will cease to have push initiated device management support. - On Windows 10, version 1511 as well as Windows 8 and 8.1, MDM Push may fail to renew the WNS Push channel automatically causing it to expire. It can also potentially hang when setting the PFN for the channel. - To work around this issue, when a 410 is returned by the WNS server when attempting to send a Push notification to the device the PFN should be set during the next sync session. To prevent the push channel from expiring on older builds, servers can reset the PFN before the channel expires (~30 days). If they’re already running Windows 10, there should be an update available that they can install that should fix the issue. + To work around this issue, when a 410 is returned by the WNS server when attempting to send a Push notification to the device the PFN should be set during the next sync session. To prevent the push channel from expiring on older builds, servers can reset the PFN before the channel expires (~30 days). If they're already running Windows 10, there should be an update available that they can install that should fix the issue. - On Windows 10, version 1511, we use the following retry logic for the DMClient: diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md index 4e59e30993..cd051cbaee 100644 --- a/windows/client-management/quick-assist.md +++ b/windows/client-management/quick-assist.md @@ -10,11 +10,11 @@ ms.author: vinpa manager: aaroncz ms.reviewer: pmadrigal appliesto: - - ✅ Windows 10 and later - - ✅ Windows 11 and later +- ✅ Windows 11 +- ✅ Windows 10 ms.collection: - - highpri - - tier1 +- highpri +- tier1 ms.date: 03/06/2023 --- diff --git a/windows/client-management/server-requirements-windows-mdm.md b/windows/client-management/server-requirements-windows-mdm.md index c0a307103f..30f628af50 100644 --- a/windows/client-management/server-requirements-windows-mdm.md +++ b/windows/client-management/server-requirements-windows-mdm.md @@ -1,9 +1,6 @@ --- title: Server requirements for using OMA DM to manage Windows devices description: Learn about the general server requirements for using OMA DM to manage Windows devices, including the supported versions of OMA DM. -MS-HAID: - - 'p\_phDeviceMgmt.server\_requirements\_for\_oma\_dm' - - 'p\_phDeviceMgmt.server\_requirements\_windows\_mdm' ms.reviewer: manager: aaroncz ms.author: vinpa @@ -12,29 +9,25 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Server requirements for using OMA DM to manage Windows devices The following list shows the general server requirements for using OMA DM to manage Windows devices: -- The OMA DM server must support the OMA DM v1.1.2 or later protocol. +- The OMA DM server must support the OMA DM v1.1.2 or later protocol. -- Secure Sockets Layer (SSL) must be on the OMA DM server, and it must provide server certificate-based authentication, data integrity check, and data encryption. If the certificate isn't issued by a commercial Certification Authority whose root certificate is pre-installed in the device, you must provision the enterprise root certificate in the device's Root store. +- Secure Sockets Layer (SSL) must be on the OMA DM server, and it must provide server certificate-based authentication, data integrity check, and data encryption. If the certificate isn't issued by a commercial Certification Authority whose root certificate is pre-installed in the device, you must provision the enterprise root certificate in the device's Root store. -- To authenticate the client at the application level, you must use either Basic or MD5 client authentication. +- To authenticate the client at the application level, you must use either Basic or MD5 client authentication. -- The server MD5 nonce must be renewed in each DM session. The DM client sends the new server nonce for the next session to the server over the Status element in every DM session. +- The server MD5 nonce must be renewed in each DM session. The DM client sends the new server nonce for the next session to the server over the Status element in every DM session. -- The MD5 binary nonce is sent over XML B64 encoded format, but the octal form of the binary data should be used when the service calculates the hash. +- The MD5 binary nonce is sent over XML B64 encoded format, but the octal form of the binary data should be used when the service calculates the hash. For more information about Basic or MD5 client authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM\_Security-V1\_2\_1-20080617-A), available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900). -- The server must support HTTPS. - -  - - - - - +- The server must support HTTPS. diff --git a/windows/client-management/structure-of-oma-dm-provisioning-files.md b/windows/client-management/structure-of-oma-dm-provisioning-files.md index 5e5008f0eb..b3724368d3 100644 --- a/windows/client-management/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/structure-of-oma-dm-provisioning-files.md @@ -9,6 +9,9 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Structure of OMA DM provisioning files @@ -65,17 +68,16 @@ The following example shows the general structure of the XML document sent by th SyncHdr includes the following information: -- Document Type Definition (DTD) and protocol version numbers +- Document Type Definition (DTD) and protocol version numbers -- Session and message identifiers. Each message in the same DM session must have a different MsgID. +- Session and message identifiers. Each message in the same DM session must have a different MsgID. -- Message source and destination Uniform Resource Identifiers (URIs) +- Message source and destination Uniform Resource Identifiers (URIs) -- Credentials for authentication +- Credentials for authentication This information is used to by the client device to properly manage the DM session. - **Code example** The following example shows the header component of a DM message. In this case, OMA DM version 1.2 is used as an example only. @@ -83,7 +85,7 @@ The following example shows the header component of a DM message. In this case, > [!NOTE] > The `` node value for the `` element in the SyncHdr of the device-generated DM package should be the same as the value of ./DevInfo/DevID. For more information about DevID, see [DevInfo configuration service provider](mdm/devinfo-csp.md). -  + ```xml diff --git a/windows/client-management/understanding-admx-backed-policies.md b/windows/client-management/understanding-admx-backed-policies.md index 344d0eb5a7..1dd76ad9e8 100644 --- a/windows/client-management/understanding-admx-backed-policies.md +++ b/windows/client-management/understanding-admx-backed-policies.md @@ -1,6 +1,6 @@ --- title: Understanding ADMX policies -description: You can use ADMX policies for Windows mobile device management (MDM) across Windows devices. +description: You can use ADMX policies for Windows mobile device management (MDM) across Windows devices. ms.author: vinpa ms.topic: article ms.prod: windows-client @@ -9,6 +9,9 @@ author: vinaypamnani-msft ms.date: 03/23/2020 ms.reviewer: manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Understanding ADMX policies @@ -23,6 +26,7 @@ In addition to standard MDM policies, the Policy CSP can also handle selected se ADMX files can either describe operating system (OS) Group Policies that are shipped with Windows or they can describe settings of applications, which are separate from the OS and can usually be downloaded and installed on a PC. Depending on the specific category of the settings that they control (OS or application), the administrative template settings are found in the following two locations in the Local Group Policy Editor: + - OS settings: Computer Configuration/Administrative Templates - Application settings: User Configuration/Administrative Templates @@ -33,7 +37,7 @@ An ADMX file can either be shipped with Windows (located at `%SystemRoot%\policy Windows maps the name and category path of a Group Policy to an MDM policy area and policy name by parsing the associated ADMX file, finding the specified Group Policy, and storing the definition (metadata) in the MDM Policy CSP client store. When the MDM policy is referenced by a SyncML command and the Policy CSP URI, `.\[device|user]\vendor\msft\policy\[config|result]\\`, this metadata is referenced and determines which registry keys are set or removed. For a list of ADMX policies supported by MDM, see [Policy CSP - ADMX policies](mdm/policy-configuration-service-provider.md). - + ## ADMX files and the Group Policy Editor @@ -42,6 +46,7 @@ To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrat The ADMX file that the MDM ISV uses to determine what UI to display to the IT administrator is the same ADMX file that the client uses for the policy definition. The ADMX file is processed either by the OS at build time or set by the client at OS runtime. In either case, the client and the MDM ISV must be synchronized with the ADMX policy definitions. Each ADMX file corresponds to a Group Policy category and typically contains several policy definitions, each of which represents a single Group Policy. For example, the policy definition for the "Publishing Server 2 Settings" is contained in the appv.admx file, which holds the policy definitions for the Microsoft Application Virtualization (App-V) Group Policy category. Group Policy option button setting: + - If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur: - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. - The MDM client stack receives this data, which causes the Policy CSP to update the device's registry per the ADMX policy definition. @@ -82,12 +87,10 @@ Appv.admx file: ``` - ## ADMX policy examples The following SyncML examples describe how to set an MDM policy that is defined by an ADMX template, specifically the Publishing_Server2_Policy Group Policy description in the application virtualization ADMX file, appv.admx. The functionality that this Group Policy manages isn't important; it's used to illustrate only how an MDM ISV can set an ADMX policy. These SyncML examples illustrate common options and the corresponding SyncML code that can be used for testing your policies. The payload of the SyncML must be XML-encoded; for this XML encoding, you can use favorite online tool. To avoid encoding the payload, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - ### Enabling a policy **Payload** @@ -233,7 +236,7 @@ This section describes sample SyncML for the various ADMX elements like Text, Mu ### How a Group Policy policy category path and name are mapped to an MDM area and policy name -Below is the internal OS mapping of a Group Policy to an MDM area and name. This mapping is part of a set of Windows manifest that when compiled parses out the associated ADMX file, finds the specified Group Policy policy and stores that definition (metadata) in the MDM Policy CSP client store.  ADMX backed policies are organized hierarchically. Their scope can be **machine**, **user**, or have a scope of **both**. When the MDM policy is referred to through a SyncML command and the Policy CSP URI, as shown below, this metadata is referenced and determines what registry keys are set or removed. Machine-scope policies are referenced via .\Device and the user scope policies via .\User. +Below is the internal OS mapping of a Group Policy to an MDM area and name. This mapping is part of a set of Windows manifest that when compiled parses out the associated ADMX file, finds the specified Group Policy policy and stores that definition (metadata) in the MDM Policy CSP client store. ADMX backed policies are organized hierarchically. Their scope can be **machine**, **user**, or have a scope of **both**. When the MDM policy is referred to through a SyncML command and the Policy CSP URI, as shown below, this metadata is referenced and determines what registry keys are set or removed. Machine-scope policies are referenced via .\Device and the user scope policies via .\User. `./[Device|User]/Vendor/MSFT/Policy/Config/[config|result]//` @@ -306,7 +309,7 @@ The `text` element simply corresponds to a string and correspondingly to an edit ### MultiText Element -The `multiText` element simply corresponds to a REG_MULTISZ registry string and correspondingly to a grid to enter multiple strings in a policy panel display by gpedit.msc.  It's expected that each string in the SyncML is to be separated by the Unicode character 0xF000 (encoded version: ``) +The `multiText` element simply corresponds to a REG_MULTISZ registry string and correspondingly to a grid to enter multiple strings in a policy panel display by gpedit.msc. It's expected that each string in the SyncML is to be separated by the Unicode character 0xF000 (encoded version: ``) ```XML Windows 11 +- ✅ Windows 10 --- # Using PowerShell scripting with the WMI Bridge Provider This topic covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, and how to invoke methods through the [WMI Bridge Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal). - ## Configuring per-device policy settings This section provides a PowerShell Cmdlet sample script to configure per-device settings through the [WMI Bridge Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal). If a class supports device settings, there must be a class level qualifier defined for InPartition("local-system"). @@ -84,15 +86,15 @@ class MDM_Policy_User_Config01_Authentication02 }; ``` -> **Note**  If the currently logged on user is trying to access or modify user settings for themselves, it is much easier to use the per-device settings script from the previous section. All PowerShell cmdlets must be executed under an elevated admin command prompt. +> **Note** If the currently logged on user is trying to access or modify user settings for themselves, it is much easier to use the per-device settings script from the previous section. All PowerShell cmdlets must be executed under an elevated admin command prompt. -  + If accessing or modifying settings for a different user, then the PowerShell script is more complicated because the WMI Bridge expects the user SID to be set in MI Custom Context, which isn't supported in native PowerShell cmdlets. -> **Note**   All commands must executed under local system. +> **Note** All commands must executed under local system. -  + A user SID can be obtained by Windows command `wmic useraccount get name, sid`. The following script example assumes the user SID is S-1-5-21-4017247134-4237859428-3008104844-1001. @@ -220,5 +222,3 @@ catch [Exception] ## Related topics [WMI Bridge Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) - -  \ No newline at end of file diff --git a/windows/client-management/win32-and-centennial-app-policy-configuration.md b/windows/client-management/win32-and-centennial-app-policy-configuration.md index 830640d4c2..b07babe5e8 100644 --- a/windows/client-management/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/win32-and-centennial-app-policy-configuration.md @@ -9,16 +9,19 @@ author: vinaypamnani-msft ms.date: 03/23/2020 ms.reviewer: manager: aaroncz +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Win32 and Desktop Bridge app ADMX policy Ingestion ## In this section -- [Overview](#overview) -- [Ingesting an app ADMX file](#ingesting-an-app-admx-file) -- [URI format for configuring an app policy](#uri-format-for-configuring-an-app-policy) -- [ADMX app policy examples](#admx-backed-app-policy-examples) +- [Overview](#overview) +- [Ingesting an app ADMX file](#ingesting-an-app-admx-file) +- [URI format for configuring an app policy](#uri-format-for-configuring-an-app-policy) +- [ADMX app policy examples](#admx-backed-app-policy-examples) - [Enabling an app policy](#enabling-an-app-policy) - [Disabling an app policy](#disabling-an-app-policy) - [Setting an app policy to not configured](#setting-an-app-policy-to-not-configured) @@ -57,7 +60,7 @@ When the ADMX policies are ingested, the registry keys to which each policy is w - software\Microsoft\Edge - Software\Microsoft\EdgeUpdate\ -> [!Warning] +> [!WARNING] > Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still ingest ADMX files and set ADMX policies regardless of whether the device is domain joined or non-domain joined. > [!NOTE] @@ -409,6 +412,7 @@ The policy {AreaName} format is {AppName}~{SettingType}~{CategoryPathFromAdmx}. {CategoryPathFromAdmx} is derived by traversing the parentCategory parameter. In this example, {CategoryPathFromAdmx} is ParentCategoryArea~Category2~Category3. Therefore, {AreaName} is ContosoCompanyApp~ Policy~ ParentCategoryArea~Category2~Category3. Therefore, from the example: + - Class: User - Policy name: L_PolicyPreventRun_1 - Policy area name: ContosoCompanyApp~Policy~ParentCategoryArea~Category2~Category3 diff --git a/windows/client-management/windows-libraries.md b/windows/client-management/windows-libraries.md index 89b5f46cfd..bc71a7b58e 100644 --- a/windows/client-management/windows-libraries.md +++ b/windows/client-management/windows-libraries.md @@ -10,17 +10,20 @@ ms.topic: article author: vinaypamnani-msft description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. ms.date: 09/15/2021 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2016 --- # Windows libraries -> Applies to: Windows 10, Windows 11, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 - -Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location. +Libraries are virtual containers for users' content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location. ## Features for Users Windows libraries are backed by full content search and rich metadata. Libraries offer the following advantages to users: + - Aggregate content from multiple storage locations into a single, unified presentation. - Enable users to stack and group library contents based on metadata. - Enable fast, full-text searches across multiple storage locations, from Windows Explorer or from the Start menu. @@ -30,6 +33,7 @@ Windows libraries are backed by full content search and rich metadata. Libraries ## Features for Administrators Administrators can configure and control Windows libraries in the following methods: + - Create custom libraries by creating and deploying Library Description (*.library-ms) files. - Hide or delete the default libraries. (The Library node itself can't be hidden or deleted from the Windows Explorer navigation pane.) - Specify a set of libraries available to Default User, and then deploy those libraries to users that derive from Default User. @@ -48,6 +52,7 @@ Including a folder in a library doesn't physically move or change the storage lo ### Default Libraries and Known Folders The default libraries include: + - Documents - Music - Pictures @@ -64,16 +69,17 @@ Users or administrators can hide or delete the default libraries, though the lib Each library has a default save location. Files are saved or copied to this location if the user chooses to save or copy a file to a library, rather than a specific location within the library. Known folders are the default save locations; however, users can select a different save location. If the user removes the default save location from a library, the next location is automatically selected as the new default save location. If the library is empty of locations or if all included locations can't be saved to, then the save operation fails. -### Indexing Requirements and “Basic” Libraries +### Indexing Requirements and "Basic" Libraries Certain library features depend on the contents of the libraries being indexed. Library locations must be available for local indexing or be indexed in a manner conforming to the Windows Indexing Protocol. If indexing isn't enabled for one or more locations within a library, the entire library reverts to basic functionality: + - No support for metadata browsing via **Arrange By** views. - Grep-only searches. - Grep-only search suggestions. The only properties available for input suggestions are **Date Modified** and **Size**. - No support for searching from the Start menu. Start menu searches don't return files from basic libraries. - No previews of file snippets for search results returned in Content mode. -To avoid this limited functionality, all locations within the library must be indexable, either locally or remotely. When users add local folders to libraries, Windows adds the location to the indexing scope and indexes the contents. Remote locations that aren't indexed remotely can be added to the local index using Offline File synchronization. This feature gives the user the benefits of local storage even though the location is remote. Making a folder “Always available offline” creates a local copy of the folder’s files, adds those files to the index, and keeps the local and remote copies in sync. Users can manually sync locations that aren't indexed remotely and aren't using folder redirection to gain the benefits of being indexed locally. +To avoid this limited functionality, all locations within the library must be indexable, either locally or remotely. When users add local folders to libraries, Windows adds the location to the indexing scope and indexes the contents. Remote locations that aren't indexed remotely can be added to the local index using Offline File synchronization. This feature gives the user the benefits of local storage even though the location is remote. Making a folder "Always available offline" creates a local copy of the folder's files, adds those files to the index, and keeps the local and remote copies in sync. Users can manually sync locations that aren't indexed remotely and aren't using folder redirection to gain the benefits of being indexed locally. For instructions on enabling indexing, see [How to Enable Indexing of Library Locations](/previous-versions/windows/it-pro/windows-7/ee461108(v=ws.10)#BKMK_EnableIndexLocations). @@ -81,7 +87,7 @@ If your environment doesn't support caching files locally, you should enable the ### Folder Redirection -While library files themselves can't be redirected, you can redirect known folders included in libraries by using [Folder Redirection](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh848267(v=ws.11)). For example, you can redirect the “My Documents” folder, which is included in the default Documents library. When redirecting known folders, you should make sure that the destination is either indexed or always available offline in order to maintain full library functionality. In both cases, the files for the destination folder are indexed and supported in libraries. These settings are configured on the server side. +While library files themselves can't be redirected, you can redirect known folders included in libraries by using [Folder Redirection](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh848267(v=ws.11)). For example, you can redirect the "My Documents" folder, which is included in the default Documents library. When redirecting known folders, you should make sure that the destination is either indexed or always available offline in order to maintain full library functionality. In both cases, the files for the destination folder are indexed and supported in libraries. These settings are configured on the server side. ### Supported storage locations @@ -90,7 +96,7 @@ The following table shows which locations are supported in Windows libraries. |Supported Locations|Unsupported Locations| |---|---| |Fixed local volumes (NTFS/FAT)|Removable drives| -|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)

Network shares that are accessible through DFS Namespaces or are part of a failover cluster| +|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)

Network shares that are accessible through DFS Namespaces or are part of a failover cluster| |Shares that are available offline (redirected folders that use Offline Files)|Network shares that aren't available offline or remotely indexed

Network Attached Storage (NAS) devices| ||Other data sources: SharePoint, Exchange, etc.| @@ -104,6 +110,7 @@ The following table shows which locations are supported in Windows libraries. ### Library Attributes The following library attributes can be modified within Windows Explorer, the Library Management dialog, or the Library Description file (*.library-ms): + - Name - Library locations - Order of library locations @@ -127,4 +134,4 @@ See the [Library Description Schema](/windows/win32/shell/library-schema-entry) ### Other resources - [Folder Redirection, Offline Files, and Roaming User Profiles](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh848267(v=ws.11)) -- [Library Description Schema](/windows/win32/shell/library-schema-entry) \ No newline at end of file +- [Library Description Schema](/windows/win32/shell/library-schema-entry) diff --git a/windows/client-management/windows-mdm-enterprise-settings.md b/windows/client-management/windows-mdm-enterprise-settings.md index c773fbc2ea..7c99b0cc81 100644 --- a/windows/client-management/windows-mdm-enterprise-settings.md +++ b/windows/client-management/windows-mdm-enterprise-settings.md @@ -1,9 +1,6 @@ --- title: Enterprise settings, policies, and app management description: The DM client manages the interaction between a device and a server. Learn more about the client-server management workflow. -MS-HAID: - - 'p\_phdevicemgmt.enterprise\_settings\_\_policies\_\_and\_app\_management' - - 'p\_phDeviceMgmt.windows\_mdm\_enterprise\_settings' ms.reviewer: manager: aaroncz ms.author: vinpa @@ -12,6 +9,9 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Enterprise settings, policies, and app management @@ -26,7 +26,6 @@ The following diagram shows the work flow between server and client. ![windows client and server mdm diagram.](images/enterprise-workflow.png) - ## Management workflow This protocol defines an HTTPS-based client/server communication with DM SyncML XML as the package payload that carries management requests and execution results. The configuration request is addressed via a managed object (MO). The settings supported by the managed object are represented in a conceptual tree structure. This logical view of configurable device settings simplifies the way the server addresses the device settings by isolating the implementation details from the conceptual tree structure. @@ -37,15 +36,7 @@ The DM client configuration, company policy enforcement, business application ma Here's a summary of the DM tasks supported for enterprise management: -- Company policy management: Company policies are supported via the Policy CSP allows the enterprise to manage various settings. It enables the management service to configure device lock related policies, disable/enable the storage card, and query the device encryption status. The RemoteWipe CSP allows IT pros to remotely fully wipe the internal user data storage. -- Enterprise application management: This task is addressed via the Enterprise ModernApp Management CSP and several ApplicationManagement-related policies. It's used to install the enterprise token, query installed business application names and versions, etc. This CSP is only accessible by the enterprise service. -- Certificate management: CertificateStore CSP, RootCACertificate CSP, and ClientCertificateInstall CSP are used to install certificates. -- Basic device inventory and asset management: Some basic device information can be retrieved via the DevInfo CSP, DevDetail CSPs and the DeviceStatus CSP. These provide basic device information such as OEM name, device model, hardware version, OS version, processor types, etc. This information is for asset management and device targeting. The NodeCache CSP enables the device to only send out delta inventory settings to the server to reduce over-the-air data usage. The NodeCache CSP is only accessible by the enterprise service. - -  - - - - - - +- Company policy management: Company policies are supported via the Policy CSP allows the enterprise to manage various settings. It enables the management service to configure device lock related policies, disable/enable the storage card, and query the device encryption status. The RemoteWipe CSP allows IT pros to remotely fully wipe the internal user data storage. +- Enterprise application management: This task is addressed via the Enterprise ModernApp Management CSP and several ApplicationManagement-related policies. It's used to install the enterprise token, query installed business application names and versions, etc. This CSP is only accessible by the enterprise service. +- Certificate management: CertificateStore CSP, RootCACertificate CSP, and ClientCertificateInstall CSP are used to install certificates. +- Basic device inventory and asset management: Some basic device information can be retrieved via the DevInfo CSP, DevDetail CSPs and the DeviceStatus CSP. These provide basic device information such as OEM name, device model, hardware version, OS version, processor types, etc. This information is for asset management and device targeting. The NodeCache CSP enables the device to only send out delta inventory settings to the server to reduce over-the-air data usage. The NodeCache CSP is only accessible by the enterprise service. diff --git a/windows/client-management/windows-version-search.md b/windows/client-management/windows-version-search.md index 0ca2a86f1e..e75721336d 100644 --- a/windows/client-management/windows-version-search.md +++ b/windows/client-management/windows-version-search.md @@ -1,10 +1,7 @@ --- title: What version of Windows am I running? description: Discover which version of Windows you're running to determine whether or not your device is enrolled in the Long-Term Servicing Channel or General Availability Channel. -keywords: Long-Term Servicing Channel, LTSC, LTSB, General Availability Channel, GAC, Windows, version, OS Build ms.prod: windows-client -ms.mktglfcycl: manage -ms.sitesec: library author: vinaypamnani-msft ms.author: vinpa ms.date: 04/30/2018 @@ -12,13 +9,17 @@ ms.reviewer: manager: aaroncz ms.topic: troubleshooting ms.technology: itpro-manage +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # What version of Windows am I running? -To determine if your device is enrolled in the [Long-Term Servicing Channel](/windows/deployment/update/waas-overview#servicing-channels) (LTSC, formerly LTSB) or the [General Availability Channel](/windows/deployment/update/waas-overview#servicing-channels) (SAC) you'll need to know what version of Windows 10 you're running. There are a few ways to figure this out. Each method provides a different set of details, so it’s useful to learn about all of them. +To determine if your device is enrolled in the [Long-Term Servicing Channel](/windows/deployment/update/waas-overview#servicing-channels) (LTSC, formerly LTSB) or the [General Availability Channel](/windows/deployment/update/waas-overview#servicing-channels) (SAC) you'll need to know what version of Windows 10 you're running. There are a few ways to figure this out. Each method provides a different set of details, so it's useful to learn about all of them. ## System Properties + Click **Start** > **Settings** > **System** > click **About** from the bottom of the left-hand menu You'll now see **Edition**, **Version**, and **OS Build** information. Something like this: @@ -26,17 +27,19 @@ You'll now see **Edition**, **Version**, and **OS Build** information. Something ![screenshot of the system properties window for a device running Windows 10.](images/systemcollage.png) ## Using Keyword Search + You can type the following in the search bar and press **ENTER** to see version details for your device. -**“winver”** +**"winver"** ![screenshot of the About Windows display text.](images/winver.png) -**“msinfo”** or **"msinfo32"** to open **System Information**: +**"msinfo"** or **"msinfo32"** to open **System Information**: ![screenshot of the System Information display text.](images/msinfo32.png) ## Using Command Prompt or PowerShell + At the Command Prompt or PowerShell interface, type **"systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"** and then press **ENTER** ![screenshot of system information display text.](images/refcmd.png) @@ -47,6 +50,6 @@ At the Command Prompt or PowerShell, type **"slmgr /dlv"**, and then press ENTER ## What does it all mean? -The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn’t contain many in-box applications, such as Microsoft Edge, Microsoft Store, Cortana (you do have some limited search capabilities), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. It’s important to remember that the LTSC model is primarily for specialized devices. +The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn't contain many in-box applications, such as Microsoft Edge, Microsoft Store, Cortana (you do have some limited search capabilities), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. It's important to remember that the LTSC model is primarily for specialized devices. -In the General Availability Channel, you can set feature updates as soon as Microsoft releases them. This servicing modal is ideal for pilot deployments and to test Windows 10 feature updates and for users like developers who need to work with the latest features immediately. Once you've tested the latest release, you can choose when to roll it out broadly in your deployment. \ No newline at end of file +In the General Availability Channel, you can set feature updates as soon as Microsoft releases them. This servicing modal is ideal for pilot deployments and to test Windows 10 feature updates and for users like developers who need to work with the latest features immediately. Once you've tested the latest release, you can choose when to roll it out broadly in your deployment. diff --git a/windows/client-management/wmi-providers-supported-in-windows.md b/windows/client-management/wmi-providers-supported-in-windows.md index 3d701812c0..1441ff5fcd 100644 --- a/windows/client-management/wmi-providers-supported-in-windows.md +++ b/windows/client-management/wmi-providers-supported-in-windows.md @@ -1,9 +1,6 @@ --- title: WMI providers supported in Windows 10 description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). -MS-HAID: - - 'p\_phdevicemgmt.wmi\_providers\_supported\_in\_windows\_10\_technical\_preview' - - 'p\_phDeviceMgmt.wmi\_providers\_supported\_in\_windows' ms.reviewer: manager: aaroncz ms.author: vinpa @@ -12,11 +9,14 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # WMI providers supported in Windows 10 -Windows Management Infrastructure (WMI) providers (and the classes they support) are used to manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service. The following subsections show the list WMI MDM classes that are supported in Windows 10. +Windows Management Infrastructure (WMI) providers (and the classes they support) are used to manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service. The following subsections show the list WMI MDM classes that are supported in Windows 10. > [!NOTE] > Applications installed using WMI classes are not removed when the MDM account is removed from device. @@ -53,7 +53,7 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw ## MDM WMI classes -|Class|Test completed in Windows 10 for desktop| +|Class|Test completed in Windows 10 for desktop| |--- |--- | |[**MDM_AppInstallJob**](/previous-versions/windows/desktop/mdmappprov/mdm-appinstalljob)|Currently testing.| |[**MDM_Application**](/previous-versions/windows/desktop/mdmappprov/mdm-application)|Currently testing.| @@ -92,7 +92,7 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw ### Parental control WMI classes -| Class | Test completed in Windows 10 for desktop | +| Class | Test completed in Windows 10 for desktop | |--------------------------------------------------------------------------|------------------------------------------| | [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | | [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | @@ -105,11 +105,9 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw | [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | | [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | - - ### Win32 WMI classes -| Class | Test completed in Windows 10 for desktop | +| Class | Test completed in Windows 10 for desktop | |--------------------------------------------------------------------------|------------------------------------------| [**Win32\_1394Controller**](/windows/win32/cimwin32prov/win32-1394controller) | [**Win32\_BaseBoard**](/windows/win32/cimwin32prov/win32-baseboard) | @@ -180,10 +178,10 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw [**Win32\_VideoController**](/windows/win32/cimwin32prov/win32-videocontroller) | **Win32\_WindowsUpdateAgentVersion** | - ## Related topics [Configuration service provider reference](mdm/index.yml) ## Related Links + [CIM Video Controller](/windows/win32/cimwin32prov/cim-videocontroller) From 4684b2222d28ebd3fc6aa2854e9a12bb4f52b8dd Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 10:30:44 -0400 Subject: [PATCH 034/139] Move client-tools --- .../administrative-tools-in-windows-10.md | 0 ...t-removal-policy-external-storage-media.md | 0 .../connect-to-remote-aadj-pc.md | 0 ...s-for-enterprise-and-education-editions.md | 0 ...e-device-installation-with-group-policy.md | 0 .../manage-settings-app-with-group-policy.md | 0 .../mandatory-user-profile.md | 0 .../new-policies-for-windows-10.md | 0 .../{ => client-tools}/quick-assist.md | 0 .../client-management/client-tools/toc.yml | 23 ++++++++++++++++++ .../{ => client-tools}/windows-libraries.md | 0 .../windows-version-search.md | 0 .../mdm-enrollment-of-windows-devices.md | 8 +++---- windows/client-management/toc.yml | 24 +------------------ 14 files changed, 28 insertions(+), 27 deletions(-) rename windows/client-management/{ => client-tools}/administrative-tools-in-windows-10.md (100%) rename windows/client-management/{ => client-tools}/change-default-removal-policy-external-storage-media.md (100%) rename windows/client-management/{ => client-tools}/connect-to-remote-aadj-pc.md (100%) rename windows/client-management/{ => client-tools}/group-policies-for-enterprise-and-education-editions.md (100%) rename windows/client-management/{ => client-tools}/manage-device-installation-with-group-policy.md (100%) rename windows/client-management/{ => client-tools}/manage-settings-app-with-group-policy.md (100%) rename windows/client-management/{ => client-tools}/mandatory-user-profile.md (100%) rename windows/client-management/{ => client-tools}/new-policies-for-windows-10.md (100%) rename windows/client-management/{ => client-tools}/quick-assist.md (100%) create mode 100644 windows/client-management/client-tools/toc.yml rename windows/client-management/{ => client-tools}/windows-libraries.md (100%) rename windows/client-management/{ => client-tools}/windows-version-search.md (100%) diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/client-tools/administrative-tools-in-windows-10.md similarity index 100% rename from windows/client-management/administrative-tools-in-windows-10.md rename to windows/client-management/client-tools/administrative-tools-in-windows-10.md diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md similarity index 100% rename from windows/client-management/change-default-removal-policy-external-storage-media.md rename to windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md similarity index 100% rename from windows/client-management/connect-to-remote-aadj-pc.md rename to windows/client-management/client-tools/connect-to-remote-aadj-pc.md diff --git a/windows/client-management/group-policies-for-enterprise-and-education-editions.md b/windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions.md similarity index 100% rename from windows/client-management/group-policies-for-enterprise-and-education-editions.md rename to windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions.md diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md similarity index 100% rename from windows/client-management/manage-device-installation-with-group-policy.md rename to windows/client-management/client-tools/manage-device-installation-with-group-policy.md diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md similarity index 100% rename from windows/client-management/manage-settings-app-with-group-policy.md rename to windows/client-management/client-tools/manage-settings-app-with-group-policy.md diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/client-tools/mandatory-user-profile.md similarity index 100% rename from windows/client-management/mandatory-user-profile.md rename to windows/client-management/client-tools/mandatory-user-profile.md diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/client-tools/new-policies-for-windows-10.md similarity index 100% rename from windows/client-management/new-policies-for-windows-10.md rename to windows/client-management/client-tools/new-policies-for-windows-10.md diff --git a/windows/client-management/quick-assist.md b/windows/client-management/client-tools/quick-assist.md similarity index 100% rename from windows/client-management/quick-assist.md rename to windows/client-management/client-tools/quick-assist.md diff --git a/windows/client-management/client-tools/toc.yml b/windows/client-management/client-tools/toc.yml new file mode 100644 index 0000000000..518441dd46 --- /dev/null +++ b/windows/client-management/client-tools/toc.yml @@ -0,0 +1,23 @@ +items: + - name: Windows Tools/Administrative Tools + href: administrative-tools-in-windows-10.md + - name: Use Quick Assist to help users + href: quick-assist.md + - name: Connect to remote Azure Active Directory-joined PC + href: connect-to-remote-aadj-pc.md + - name: Create mandatory user profiles + href: mandatory-user-profile.md + - name: New policies for Windows 10 + href: new-policies-for-windows-10.md + - name: Windows 10 default media removal policy + href: change-default-removal-policy-external-storage-media.md + - name: Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education + href: group-policies-for-enterprise-and-education-editions.md + - name: Manage Device Installation with Group Policy + href: manage-device-installation-with-group-policy.md + - name: Manage the Settings app with Group Policy + href: manage-settings-app-with-group-policy.md + - name: What version of Windows am I running + href: windows-version-search.md + - name: Windows libraries + href: windows-libraries.md diff --git a/windows/client-management/windows-libraries.md b/windows/client-management/client-tools/windows-libraries.md similarity index 100% rename from windows/client-management/windows-libraries.md rename to windows/client-management/client-tools/windows-libraries.md diff --git a/windows/client-management/windows-version-search.md b/windows/client-management/client-tools/windows-version-search.md similarity index 100% rename from windows/client-management/windows-version-search.md rename to windows/client-management/client-tools/windows-version-search.md diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index a9010c65c9..ae5405e2db 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -1,7 +1,7 @@ --- title: MDM enrollment of Windows 10-based devices description: Learn about mobile device management (MDM) enrollment of Windows 10-based devices to simplify access to your organization’s resources. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -11,20 +11,20 @@ author: vinaypamnani-msft ms.collection: - highpri - tier2 -ms.date: 12/31/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 --- -# MDM enrollment of Windows 10-based devices +# MDM enrollment of Windows devices In today's cloud-first world, enterprise IT departments increasingly want to let employees use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization's resources, such as apps, the corporate network, and email. > [!NOTE] > When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. -## Connect corporate-owned Windows 10-based devices +## Connect corporate-owned Windows devices You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 doesn't require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index f7050222bd..88b3b3f800 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -61,28 +61,6 @@ items: - name: Configuration service provider reference href: mdm/index.yml - name: Client management tools and settings - items: - - name: Windows Tools/Administrative Tools - href: administrative-tools-in-windows-10.md - - name: Use Quick Assist to help users - href: quick-assist.md - - name: Connect to remote Azure Active Directory-joined PC - href: connect-to-remote-aadj-pc.md - - name: Create mandatory user profiles - href: mandatory-user-profile.md - - name: New policies for Windows 10 - href: new-policies-for-windows-10.md - - name: Windows 10 default media removal policy - href: change-default-removal-policy-external-storage-media.md - - name: Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education - href: group-policies-for-enterprise-and-education-editions.md - - name: Manage Device Installation with Group Policy - href: manage-device-installation-with-group-policy.md - - name: Manage the Settings app with Group Policy - href: manage-settings-app-with-group-policy.md - - name: What version of Windows am I running - href: windows-version-search.md - - name: Windows libraries - href: windows-libraries.md + href: client-tools/toc.yml - name: Troubleshoot Windows clients href: /troubleshoot/windows-client/welcome-windows-client From 213dad9fcbaab8ff599e99eb4898b067f5095f23 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 10:42:48 -0400 Subject: [PATCH 035/139] Move images --- .../{ => client-tools}/images/WinVer.PNG | Bin .../images/admin-tools-folder.png | Bin .../{ => client-tools}/images/admin-tools.png | Bin .../{ => client-tools}/images/allow-rdp.png | Bin .../images/change-def-rem-policy-1.png | Bin .../images/change-def-rem-policy-2.png | Bin .../{ => client-tools}/images/checkmark.png | Bin .../{ => client-tools}/images/copy-to-change.png | Bin .../{ => client-tools}/images/copy-to-path.png | Bin .../{ => client-tools}/images/copy-to.PNG | Bin .../{ => client-tools}/images/crossmark.png | Bin .../device-installation-apply-layered-policy-2.png | Bin .../device-installation-apply-layered_policy-1.png | Bin .../device-installation-dm-printer-by-device.png | Bin ...evice-installation-dm-printer-compatible-ids.png | Bin ...evice-installation-dm-printer-details-screen.png | Bin .../device-installation-dm-printer-hardware-ids.png | Bin ...ce-installation-dm-usb-by-connection-blocked.png | Bin ...e-installation-dm-usb-by-connection-layering.png | Bin .../device-installation-dm-usb-by-connection.png | Bin .../images/device-installation-dm-usb-by-device.png | Bin .../images/device-installation-dm-usb-hwid.png | Bin .../images/device-installation-flowchart.png | Bin ...nstallation-gpo-allow-device-id-list-printer.png | Bin ...ce-installation-gpo-allow-device-id-list-usb.png | Bin .../device-installation-gpo-prevent-class-list.png | Bin ...tallation-gpo-prevent-device-id-list-printer.png | Bin ...-installation-gpo-prevent-device-id-list-usb.png | Bin .../{ => client-tools}/images/msinfo32.png | Bin .../{ => client-tools}/images/quick-assist-flow.png | Bin .../{ => client-tools}/images/quick-assist-get.png | Bin .../{ => client-tools}/images/rdp.png | Bin .../{ => client-tools}/images/refcmd.png | Bin .../{ => client-tools}/images/slmgr_dlv.png | Bin .../{ => client-tools}/images/sysprep-error.png | Bin .../{ => client-tools}/images/systemcollage.png | Bin .../images/win11-control-panel-windows-tools.png | Bin .../images/win11-windows-tools.png | Bin 38 files changed, 0 insertions(+), 0 deletions(-) rename windows/client-management/{ => client-tools}/images/WinVer.PNG (100%) rename windows/client-management/{ => client-tools}/images/admin-tools-folder.png (100%) rename windows/client-management/{ => client-tools}/images/admin-tools.png (100%) rename windows/client-management/{ => client-tools}/images/allow-rdp.png (100%) rename windows/client-management/{ => client-tools}/images/change-def-rem-policy-1.png (100%) rename windows/client-management/{ => client-tools}/images/change-def-rem-policy-2.png (100%) rename windows/client-management/{ => client-tools}/images/checkmark.png (100%) rename windows/client-management/{ => client-tools}/images/copy-to-change.png (100%) rename windows/client-management/{ => client-tools}/images/copy-to-path.png (100%) rename windows/client-management/{ => client-tools}/images/copy-to.PNG (100%) rename windows/client-management/{ => client-tools}/images/crossmark.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-apply-layered-policy-2.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-apply-layered_policy-1.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-printer-by-device.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-printer-compatible-ids.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-printer-details-screen.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-printer-hardware-ids.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-usb-by-connection-blocked.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-usb-by-connection-layering.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-usb-by-connection.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-usb-by-device.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-dm-usb-hwid.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-flowchart.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-gpo-allow-device-id-list-printer.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-gpo-allow-device-id-list-usb.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-gpo-prevent-class-list.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-gpo-prevent-device-id-list-printer.png (100%) rename windows/client-management/{ => client-tools}/images/device-installation-gpo-prevent-device-id-list-usb.png (100%) rename windows/client-management/{ => client-tools}/images/msinfo32.png (100%) rename windows/client-management/{ => client-tools}/images/quick-assist-flow.png (100%) rename windows/client-management/{ => client-tools}/images/quick-assist-get.png (100%) rename windows/client-management/{ => client-tools}/images/rdp.png (100%) rename windows/client-management/{ => client-tools}/images/refcmd.png (100%) rename windows/client-management/{ => client-tools}/images/slmgr_dlv.png (100%) rename windows/client-management/{ => client-tools}/images/sysprep-error.png (100%) rename windows/client-management/{ => client-tools}/images/systemcollage.png (100%) rename windows/client-management/{ => client-tools}/images/win11-control-panel-windows-tools.png (100%) rename windows/client-management/{ => client-tools}/images/win11-windows-tools.png (100%) diff --git a/windows/client-management/images/WinVer.PNG b/windows/client-management/client-tools/images/WinVer.PNG similarity index 100% rename from windows/client-management/images/WinVer.PNG rename to windows/client-management/client-tools/images/WinVer.PNG diff --git a/windows/client-management/images/admin-tools-folder.png b/windows/client-management/client-tools/images/admin-tools-folder.png similarity index 100% rename from windows/client-management/images/admin-tools-folder.png rename to windows/client-management/client-tools/images/admin-tools-folder.png diff --git a/windows/client-management/images/admin-tools.png b/windows/client-management/client-tools/images/admin-tools.png similarity index 100% rename from windows/client-management/images/admin-tools.png rename to windows/client-management/client-tools/images/admin-tools.png diff --git a/windows/client-management/images/allow-rdp.png b/windows/client-management/client-tools/images/allow-rdp.png similarity index 100% rename from windows/client-management/images/allow-rdp.png rename to windows/client-management/client-tools/images/allow-rdp.png diff --git a/windows/client-management/images/change-def-rem-policy-1.png b/windows/client-management/client-tools/images/change-def-rem-policy-1.png similarity index 100% rename from windows/client-management/images/change-def-rem-policy-1.png rename to windows/client-management/client-tools/images/change-def-rem-policy-1.png diff --git a/windows/client-management/images/change-def-rem-policy-2.png b/windows/client-management/client-tools/images/change-def-rem-policy-2.png similarity index 100% rename from windows/client-management/images/change-def-rem-policy-2.png rename to windows/client-management/client-tools/images/change-def-rem-policy-2.png diff --git a/windows/client-management/images/checkmark.png b/windows/client-management/client-tools/images/checkmark.png similarity index 100% rename from windows/client-management/images/checkmark.png rename to windows/client-management/client-tools/images/checkmark.png diff --git a/windows/client-management/images/copy-to-change.png b/windows/client-management/client-tools/images/copy-to-change.png similarity index 100% rename from windows/client-management/images/copy-to-change.png rename to windows/client-management/client-tools/images/copy-to-change.png diff --git a/windows/client-management/images/copy-to-path.png b/windows/client-management/client-tools/images/copy-to-path.png similarity index 100% rename from windows/client-management/images/copy-to-path.png rename to windows/client-management/client-tools/images/copy-to-path.png diff --git a/windows/client-management/images/copy-to.PNG b/windows/client-management/client-tools/images/copy-to.PNG similarity index 100% rename from windows/client-management/images/copy-to.PNG rename to windows/client-management/client-tools/images/copy-to.PNG diff --git a/windows/client-management/images/crossmark.png b/windows/client-management/client-tools/images/crossmark.png similarity index 100% rename from windows/client-management/images/crossmark.png rename to windows/client-management/client-tools/images/crossmark.png diff --git a/windows/client-management/images/device-installation-apply-layered-policy-2.png b/windows/client-management/client-tools/images/device-installation-apply-layered-policy-2.png similarity index 100% rename from windows/client-management/images/device-installation-apply-layered-policy-2.png rename to windows/client-management/client-tools/images/device-installation-apply-layered-policy-2.png diff --git a/windows/client-management/images/device-installation-apply-layered_policy-1.png b/windows/client-management/client-tools/images/device-installation-apply-layered_policy-1.png similarity index 100% rename from windows/client-management/images/device-installation-apply-layered_policy-1.png rename to windows/client-management/client-tools/images/device-installation-apply-layered_policy-1.png diff --git a/windows/client-management/images/device-installation-dm-printer-by-device.png b/windows/client-management/client-tools/images/device-installation-dm-printer-by-device.png similarity index 100% rename from windows/client-management/images/device-installation-dm-printer-by-device.png rename to windows/client-management/client-tools/images/device-installation-dm-printer-by-device.png diff --git a/windows/client-management/images/device-installation-dm-printer-compatible-ids.png b/windows/client-management/client-tools/images/device-installation-dm-printer-compatible-ids.png similarity index 100% rename from windows/client-management/images/device-installation-dm-printer-compatible-ids.png rename to windows/client-management/client-tools/images/device-installation-dm-printer-compatible-ids.png diff --git a/windows/client-management/images/device-installation-dm-printer-details-screen.png b/windows/client-management/client-tools/images/device-installation-dm-printer-details-screen.png similarity index 100% rename from windows/client-management/images/device-installation-dm-printer-details-screen.png rename to windows/client-management/client-tools/images/device-installation-dm-printer-details-screen.png diff --git a/windows/client-management/images/device-installation-dm-printer-hardware-ids.png b/windows/client-management/client-tools/images/device-installation-dm-printer-hardware-ids.png similarity index 100% rename from windows/client-management/images/device-installation-dm-printer-hardware-ids.png rename to windows/client-management/client-tools/images/device-installation-dm-printer-hardware-ids.png diff --git a/windows/client-management/images/device-installation-dm-usb-by-connection-blocked.png b/windows/client-management/client-tools/images/device-installation-dm-usb-by-connection-blocked.png similarity index 100% rename from windows/client-management/images/device-installation-dm-usb-by-connection-blocked.png rename to windows/client-management/client-tools/images/device-installation-dm-usb-by-connection-blocked.png diff --git a/windows/client-management/images/device-installation-dm-usb-by-connection-layering.png b/windows/client-management/client-tools/images/device-installation-dm-usb-by-connection-layering.png similarity index 100% rename from windows/client-management/images/device-installation-dm-usb-by-connection-layering.png rename to windows/client-management/client-tools/images/device-installation-dm-usb-by-connection-layering.png diff --git a/windows/client-management/images/device-installation-dm-usb-by-connection.png b/windows/client-management/client-tools/images/device-installation-dm-usb-by-connection.png similarity index 100% rename from windows/client-management/images/device-installation-dm-usb-by-connection.png rename to windows/client-management/client-tools/images/device-installation-dm-usb-by-connection.png diff --git a/windows/client-management/images/device-installation-dm-usb-by-device.png b/windows/client-management/client-tools/images/device-installation-dm-usb-by-device.png similarity index 100% rename from windows/client-management/images/device-installation-dm-usb-by-device.png rename to windows/client-management/client-tools/images/device-installation-dm-usb-by-device.png diff --git a/windows/client-management/images/device-installation-dm-usb-hwid.png b/windows/client-management/client-tools/images/device-installation-dm-usb-hwid.png similarity index 100% rename from windows/client-management/images/device-installation-dm-usb-hwid.png rename to windows/client-management/client-tools/images/device-installation-dm-usb-hwid.png diff --git a/windows/client-management/images/device-installation-flowchart.png b/windows/client-management/client-tools/images/device-installation-flowchart.png similarity index 100% rename from windows/client-management/images/device-installation-flowchart.png rename to windows/client-management/client-tools/images/device-installation-flowchart.png diff --git a/windows/client-management/images/device-installation-gpo-allow-device-id-list-printer.png b/windows/client-management/client-tools/images/device-installation-gpo-allow-device-id-list-printer.png similarity index 100% rename from windows/client-management/images/device-installation-gpo-allow-device-id-list-printer.png rename to windows/client-management/client-tools/images/device-installation-gpo-allow-device-id-list-printer.png diff --git a/windows/client-management/images/device-installation-gpo-allow-device-id-list-usb.png b/windows/client-management/client-tools/images/device-installation-gpo-allow-device-id-list-usb.png similarity index 100% rename from windows/client-management/images/device-installation-gpo-allow-device-id-list-usb.png rename to windows/client-management/client-tools/images/device-installation-gpo-allow-device-id-list-usb.png diff --git a/windows/client-management/images/device-installation-gpo-prevent-class-list.png b/windows/client-management/client-tools/images/device-installation-gpo-prevent-class-list.png similarity index 100% rename from windows/client-management/images/device-installation-gpo-prevent-class-list.png rename to windows/client-management/client-tools/images/device-installation-gpo-prevent-class-list.png diff --git a/windows/client-management/images/device-installation-gpo-prevent-device-id-list-printer.png b/windows/client-management/client-tools/images/device-installation-gpo-prevent-device-id-list-printer.png similarity index 100% rename from windows/client-management/images/device-installation-gpo-prevent-device-id-list-printer.png rename to windows/client-management/client-tools/images/device-installation-gpo-prevent-device-id-list-printer.png diff --git a/windows/client-management/images/device-installation-gpo-prevent-device-id-list-usb.png b/windows/client-management/client-tools/images/device-installation-gpo-prevent-device-id-list-usb.png similarity index 100% rename from windows/client-management/images/device-installation-gpo-prevent-device-id-list-usb.png rename to windows/client-management/client-tools/images/device-installation-gpo-prevent-device-id-list-usb.png diff --git a/windows/client-management/images/msinfo32.png b/windows/client-management/client-tools/images/msinfo32.png similarity index 100% rename from windows/client-management/images/msinfo32.png rename to windows/client-management/client-tools/images/msinfo32.png diff --git a/windows/client-management/images/quick-assist-flow.png b/windows/client-management/client-tools/images/quick-assist-flow.png similarity index 100% rename from windows/client-management/images/quick-assist-flow.png rename to windows/client-management/client-tools/images/quick-assist-flow.png diff --git a/windows/client-management/images/quick-assist-get.png b/windows/client-management/client-tools/images/quick-assist-get.png similarity index 100% rename from windows/client-management/images/quick-assist-get.png rename to windows/client-management/client-tools/images/quick-assist-get.png diff --git a/windows/client-management/images/rdp.png b/windows/client-management/client-tools/images/rdp.png similarity index 100% rename from windows/client-management/images/rdp.png rename to windows/client-management/client-tools/images/rdp.png diff --git a/windows/client-management/images/refcmd.png b/windows/client-management/client-tools/images/refcmd.png similarity index 100% rename from windows/client-management/images/refcmd.png rename to windows/client-management/client-tools/images/refcmd.png diff --git a/windows/client-management/images/slmgr_dlv.png b/windows/client-management/client-tools/images/slmgr_dlv.png similarity index 100% rename from windows/client-management/images/slmgr_dlv.png rename to windows/client-management/client-tools/images/slmgr_dlv.png diff --git a/windows/client-management/images/sysprep-error.png b/windows/client-management/client-tools/images/sysprep-error.png similarity index 100% rename from windows/client-management/images/sysprep-error.png rename to windows/client-management/client-tools/images/sysprep-error.png diff --git a/windows/client-management/images/systemcollage.png b/windows/client-management/client-tools/images/systemcollage.png similarity index 100% rename from windows/client-management/images/systemcollage.png rename to windows/client-management/client-tools/images/systemcollage.png diff --git a/windows/client-management/images/win11-control-panel-windows-tools.png b/windows/client-management/client-tools/images/win11-control-panel-windows-tools.png similarity index 100% rename from windows/client-management/images/win11-control-panel-windows-tools.png rename to windows/client-management/client-tools/images/win11-control-panel-windows-tools.png diff --git a/windows/client-management/images/win11-windows-tools.png b/windows/client-management/client-tools/images/win11-windows-tools.png similarity index 100% rename from windows/client-management/images/win11-windows-tools.png rename to windows/client-management/client-tools/images/win11-windows-tools.png From ca755e48fe837ab6b47b6c2616adf3bffb1af617 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 10:54:31 -0400 Subject: [PATCH 036/139] Fix some links --- .../images/settings-page-visibility-gp.png | Bin .../new-policies-for-windows-10.md | 18 ++++++++---------- windows/client-management/index.yml | 4 ++-- .../manage-corporate-devices.md | 10 +++++----- 4 files changed, 15 insertions(+), 17 deletions(-) rename windows/client-management/{ => client-tools}/images/settings-page-visibility-gp.png (100%) diff --git a/windows/client-management/images/settings-page-visibility-gp.png b/windows/client-management/client-tools/images/settings-page-visibility-gp.png similarity index 100% rename from windows/client-management/images/settings-page-visibility-gp.png rename to windows/client-management/client-tools/images/settings-page-visibility-gp.png diff --git a/windows/client-management/client-tools/new-policies-for-windows-10.md b/windows/client-management/client-tools/new-policies-for-windows-10.md index 30d0863228..c00dccf24d 100644 --- a/windows/client-management/client-tools/new-policies-for-windows-10.md +++ b/windows/client-management/client-tools/new-policies-for-windows-10.md @@ -1,7 +1,7 @@ --- title: New policies for Windows 10 (Windows 10) description: Learn how Windows 10 includes new policies for management, like Group Policy settings for the Windows system and components. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.prod: windows-client @@ -40,10 +40,10 @@ The following Group Policy settings were added in Windows 10, version 1903: **Windows Components** -- Windows Components\App Privacy\Let Windows apps activate with voice +- Windows Components\App Privacy\Let Windows apps activate with voice - Windows Components\App Privacy\Let Windows apps activate with voice while the system is locked - Windows Components\Data Collection and Preview Builds\Allow commercial data pipeline -- Windows Components\Data Collection and Preview Builds\Configure collection of browsing data for Desktop Analytics +- Windows Components\Data Collection and Preview Builds\Configure collection of browsing data for Desktop Analytics - Windows Components\Data Collection and Preview Builds\Configure diagnostic data upload endpoint for Desktop Analytics - Windows Components\Delivery Optimization\Delay background download Cache Server fallback (in seconds) - Windows Components\Delivery Optimization\Delay Foreground download Cache Server fallback (in seconds) @@ -494,16 +494,14 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Wi - Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu -Windows 10, version 1703, adds a number of [ADMX-backed policies to MDM](./mdm/policy-configuration-service-provider.md). +Windows 10, version 1703, adds a number of [ADMX-backed policies to MDM](../mdm/policy-configuration-service-provider.md). If you use Microsoft Intune for MDM, you can [configure custom policies](/mem/intune/configuration/custom-settings-configure) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](/mem/intune/configuration/custom-settings-windows-10). -No new [Exchange ActiveSync policies](/exchange/mobile-device-mailbox-policies-exchange-2013-help). For more information, see the [ActiveSync configuration service provider](./mdm/activesync-csp.md) technical reference. +No new [Exchange ActiveSync policies](/exchange/mobile-device-mailbox-policies-exchange-2013-help). For more information, see the [ActiveSync configuration service provider](../mdm/activesync-csp.md) technical reference. ## Related topics -[Group Policy Settings Reference Spreadsheet Windows 1803](https://www.microsoft.com/download/details.aspx?id=56946) - -[Manage corporate devices](manage-corporate-devices.md) - -[Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) +- [Group Policy Settings Reference Spreadsheet Windows 1803](https://www.microsoft.com/download/details.aspx?id=56946) +- [Manage corporate devices](../manage-corporate-devices.md) +- [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index d782edc5b3..69d299fb4f 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -37,9 +37,9 @@ landingContent: - text: Enterprise settings, policies, and app management url: windows-mdm-enterprise-settings.md - text: Windows Tools/Administrative Tools - url: administrative-tools-in-windows-10.md + url: client-tools/administrative-tools-in-windows-10.md - text: Create mandatory user profiles - url: mandatory-user-profile.md + url: client-tools/mandatory-user-profile.md - title: Device enrollment linkLists: diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index 60014772f7..301ec1a5f7 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -1,7 +1,7 @@ --- title: Manage corporate devices description: You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.prod: windows-client @@ -23,11 +23,11 @@ You can use the same management tools to manage all device types running Windows | Topic | Description | | --- | --- | -| [Manage Windows 10 (and Windows 11) in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10 (and Windows 11), including deploying Windows 10 (and Windows 11) in a mixed environment | -| [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | +| [Manage Windows 10 (and Windows 11) in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10 (and Windows 11), including deploying Windows 10 (and Windows 11) in a mixed environment | +| [Connect to remote Azure Active Directory-joined PC](client-tools/connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | | [Manage Windows 10 (and Windows 11) and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | -| [New policies for Windows 10 (and Windows 11)](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | -| [Group Policies that apply only to Windows Enterprise and Windows Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education | +| [New policies for Windows 10 (and Windows 11)](client-tools/new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | +| [Group Policies that apply only to Windows Enterprise and Windows Education](client-tools/group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education | | [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 (and Windows 11) in their organizations | ## Learn more From fbda80d424c09eea74c166754517e36b15259296 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 11:13:32 -0400 Subject: [PATCH 037/139] Redirect client-tools --- .openpublishing.redirection.json | 59 ++++++++++++++++++++++++++++++-- 1 file changed, 57 insertions(+), 2 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 723d827b23..3cb6a801a3 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6635,6 +6635,61 @@ "redirect_url": "/education/windows/switch-to-pro-education", "redirect_document_id": false }, + { + "source_path": "windows/client-management/administrative-tools-in-windows-10.md", + "redirect_url": "/windows/client-management/client-tools/administrative-tools-in-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/change-default-removal-policy-external-storage-media.md", + "redirect_url": "/windows/client-management/client-tools/change-default-removal-policy-external-storage-media", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/connect-to-remote-aadj-pc.md", + "redirect_url": "/windows/client-management/client-tools/connect-to-remote-aadj-pc", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/group-policies-for-enterprise-and-education-editions.md", + "redirect_url": "/windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/manage-device-installation-with-group-policy.md", + "redirect_url": "/windows/client-management/client-tools/manage-device-installation-with-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/manage-settings-app-with-group-policy.md", + "redirect_url": "/windows/client-management/client-tools/manage-settings-app-with-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mandatory-user-profile.md", + "redirect_url": "/windows/client-management/client-tools/mandatory-user-profile", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/new-policies-for-windows-10.md", + "redirect_url": "/windows/client-management/client-tools/new-policies-for-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/quick-assist.md", + "redirect_url": "/windows/client-management/client-tools/quick-assist", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/windows-libraries.md", + "redirect_url": "/windows/client-management/client-tools/windows-libraries", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/windows-version-search.md", + "redirect_url": "/windows/client-management/client-tools/windows-version-search", + "redirect_document_id": false + }, { "source_path": "windows/client-management/mdm/policy-admx-backed.md", "redirect_url": "/windows/client-management/mdm/policy-configuration-service-provider", @@ -20734,7 +20789,7 @@ "source_path": "windows/deployment/update/quality-updates.md", "redirect_url": "/windows/deployment/update/release-cycle", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/windows-autopatch/references/windows-autopatch-privacy.md", "redirect_url": "/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy", @@ -20746,4 +20801,4 @@ "redirect_document_id": false } ] -} +} \ No newline at end of file From 2e749cf730f05d01aa4c83f7c424b85f16e0a477 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 5 Apr 2023 10:11:47 -0700 Subject: [PATCH 038/139] edits --- windows/deployment/update/wufb-reports-do.md | 76 ++++++++++++-------- 1 file changed, 47 insertions(+), 29 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 65d7d75edd..8ca32490b4 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -37,40 +37,55 @@ Windows Update for Business reports uses the following Delivery Optimization ter - Simple Mode (99) - Bypass (100), deprecated in Windows 11 - **Bandwidth savings**: Out of the total consumed bandwidth, the percentage of bandwidth that was downloaded from either LAN or Group peers, and from Microsoft Connected Cache (MCC) - - If bandwidth savings are <= 60% a *Warning* icon is displayed - - When bandwidth savings are <10% an *Error* icon is displayed. + - If bandwidth savings are <= 60%, a *Warning* icon is displayed + - When bandwidth savings are <10%, an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. - **P2P Device Count**: The device count is determined by the number of devices that have received bytes from peers, for supported content types. -- **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. [Learn more](https://learn.microsoft.com/windows/deployment/do/waas-microsoft-connected-cache) about Microsoft Connected Cache. +- **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. For more information, see [Microsoft Connected Cache overview](../do/waas-microsoft-connected-cache.md). - **MCC Device Count**: The device count is determined by the number of devices that have received bytes from the cache server, for supported content types. - **Total # of Devices**: The total number of devices with activity in last 28 days. - **LAN Bytes**: Bytes delivered from LAN peers. -- **Group Bytes**: Bytes from Group peers. If a device is using Group DownloadMode, Delivery Optimization will first look for peers on the LAN and then in the Group. Therefore, if bytes are delivered from LAN peers, they will be calculated in 'LAN Bytes'. +- **Group Bytes**: Bytes from Group peers. If a device is using Group DownloadMode, Delivery Optimization will first look for peers on the LAN and then in the Group. Therefore, if bytes are delivered from LAN peers, they'll be calculated in 'LAN Bytes'. - **CDN Bytes**: Bytes delivered from Content Delivery Network (CDN). - **City**: City is determined based on the location of the device where the maximum amount of data is downloaded. - **Country**: Country is determined based on the location of the device where the maximum amount of data is downloaded. - **ISP**: ISP is determined based on the ISP delivering the maximum bytes to the device. ## Calculations for Delivery Optimization -There are sevaral calculated values that appear on the Delivery Optimization report. The table used for each calculation is listed for each, in parenthesis. -**Effiency (%) Calculations** -- Bandwidth Savings (BW SAV%) = BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ -(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) * 100.0 (UCDOAggregatedStatus table) -- % P2P Efficiency = (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) -- % MCC Efficiency = BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 (UCDOStatus table) +There are several calculated values that appear on the Delivery Optimization report. Listed below each calculation is the table that's used for it: -**Bytes Calculations** -- TotalBytes = BytesFromCDN + BytesFromEnterpriseCache + BytesFromPeers + BytesFromGroupPeers (UCDOAggregatedStatus table) -- BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache (UCDOAggregatedStatus table) -- BytesFromPeers = BytesFromLAN (UCDOAggregatedStatus table) -- BytesFromGroupPeers = BytesFromGroupPeers (UCDOAggregatedStatus table) -- BytesFromCache = BytesFromCache (UCDOAggregatedStatus table) +**Efficiency (%) Calculations**: + +- Bandwidth Savings (BW SAV%) = (BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ +(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) * 100.0 + - [UCDOAggregatedStatus](wufb-reports-schema-ucdostatus.md) table +- % P2P Efficiency = (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 + - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table +- % MCC Efficiency = BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 + - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table -**Volume Calculations** -- Volume by P2P = BytesFromPeers + BytesFromGroupPeers (UCDOStatus table) -- Volume by MCC = BytesFromCache (UCDOStatus table) -- Volume by CDN = BytesFrom CDN (UCDOStatus table) +**Bytes Calculations**: + +- TotalBytes = BytesFromCDN + BytesFromEnterpriseCache + BytesFromPeers + BytesFromGroupPeers + - [UCDOAggregatedStatus](wufb-reports-schema-ucdostatus.md) table +- BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache + - [UCDOAggregatedStatus](wufb-reports-schema-ucdostatus.md) table +- BytesFromPeers = BytesFromLAN + - [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) table +- BytesFromGroupPeers = BytesFromGroupPeers + - [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) table +- BytesFromCache = BytesFromCache + - [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) table + +**Volume Calculations**: + +- Volume by P2P = BytesFromPeers + BytesFromGroupPeers + - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table +- Volume by MCC = BytesFromCache + - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table +- Volume by CDN = BytesFrom CDN + - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table ## Mapping GroupID @@ -81,18 +96,20 @@ $text = "" ; $hashObj = [System.Security.Cryptography.HashAlgorithm]::Create('sha256') ; $dig = $hashObj.ComputeHash([System.Text.Encoding]::Unicode.GetBytes($text)) ; $digB64 = [System.Convert]::ToBase64String($dig) ; Write-Host "$text ==> $digB64" ``` -In addition, you can see the both the encoded and decoded GroupIDs in the Delivery Optimization logs. + +In addition, you can see both the encoded and decoded GroupIDs in the Delivery Optimization logs. ```powershell -powershell Get-DeliveryOptimizationLog -Flush | Set-Content C:\dosvc.log +Get-DeliveryOptimizationLog -Flush | Set-Content C:\dosvc.log ``` -```code -These two lines are together in verbose logs: +The below two lines are together in verbose logs: -2023-02-15T12:33:11.3811337Z 1514  1F4          {CGlobalConfigManager::GetGroupId} Using groupID = **** -2023-02-15T12:33:11.3811432Z 1514  1F4          {CGlobalConfigManager::GetGroupId} Hashed groupID = **** +```text +2023-02-15T12:33:11.3811337Z 1514 1F4 {CGlobalConfigManager::GetGroupId} Using groupID = **** +2023-02-15T12:33:11.3811432Z 1514 1F4 {CGlobalConfigManager::GetGroupId} Hashed groupID = **** ``` + ## Sample queries You can use the data in [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) @@ -100,7 +117,7 @@ and [UCDOStatus](wufb-reports-schema-ucdostatus.md) to create your own queries. ### Example UCDOAggregatedStatus table query -The following is the query used to display the total bandwidth savings % value: +The following query is used to display the total bandwidth savings % value: ```kusto UCDOAggregatedStatus| where TimeGenerated == _SnapshotTime @@ -108,9 +125,10 @@ UCDOAggregatedStatus| where TimeGenerated == _SnapshotTime | summarize LocalSources_BWSAV = round((sum(0.0 + LocalSourceBytes)/ sum(LocalSourceBytes+BytesFromCDN)) * 100.0 ,2) | extend Title = "BW SAV%" , SubTitle = "Local Sources" ``` + ### Example UCDOStatus table query -The following is the query used to display the Top 10 GroupIDs: +The following query is used to display the Top 10 GroupIDs: ```kusto UCDOStatus | where TimeGenerated == _SnapshotTime @@ -130,7 +148,7 @@ DeviceCount = count_distinct(GlobalDeviceId) by GroupID | top 10 by DeviceCount Data is available for the last 28 days. - **Data is showing as 'Unknown', what does that mean?** -You may see data in the report listed as 'Unknown'. This indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. +You may see data in the report listed as 'Unknown'. This status indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. - **How is the 'Top 10' groups identified?** The top groups are represented by the number of devices in a particular group, for any of the four group types (GroupID, City, Country, and ISP). From bb9640fe07070ad6637349aa882753304fe2db49 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 5 Apr 2023 10:14:07 -0700 Subject: [PATCH 039/139] edit --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 8ca32490b4..c565661410 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: article -ms.date: 03/27/2023 +ms.date: 04/05/2023 ms.technology: itpro-updates --- From 8c0e7981543053fe2d5972fdf7110d484a350c83 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 5 Apr 2023 11:14:20 -0700 Subject: [PATCH 040/139] edit --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index c565661410..9c8870a1f3 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -150,7 +150,7 @@ Data is available for the last 28 days. - **Data is showing as 'Unknown', what does that mean?** You may see data in the report listed as 'Unknown'. This status indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. -- **How is the 'Top 10' groups identified?** +- **How are the 'Top 10' groups identified?** The top groups are represented by the number of devices in a particular group, for any of the four group types (GroupID, City, Country, and ISP). - **The GroupIDs don't look familiar, why are they different?** From 6cd7023ab84de8b4c1aac60e2a7170ae28be8d1f Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Wed, 5 Apr 2023 13:18:59 -0600 Subject: [PATCH 041/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 9c8870a1f3..bd71d69452 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -36,11 +36,11 @@ Windows Update for Business reports uses the following Delivery Optimization ter - HTTP Only (0) - Simple Mode (99) - Bypass (100), deprecated in Windows 11 -- **Bandwidth savings**: Out of the total consumed bandwidth, the percentage of bandwidth that was downloaded from either LAN or Group peers, and from Microsoft Connected Cache (MCC) +- **Bandwidth savings**: The percentage of bandwidth that was downloaded from alternate sources (Peers or Microsoft Connected Cache (MCC) out of the total amount of data downloaded. - If bandwidth savings are <= 60%, a *Warning* icon is displayed - When bandwidth savings are <10%, an *Error* icon is displayed. - **Configurations**: Based on the DownloadMode configuration set via MDM, Group Policy, or end-user via the user interface. -- **P2P Device Count**: The device count is determined by the number of devices that have received bytes from peers, for supported content types. +- **P2P Device Count**: The device count is determined by the number of devices configured to use peering. - **Microsoft Connected Cache (MCC)**: Microsoft Connected Cache is a software-only caching solution that delivers Microsoft content. For more information, see [Microsoft Connected Cache overview](../do/waas-microsoft-connected-cache.md). - **MCC Device Count**: The device count is determined by the number of devices that have received bytes from the cache server, for supported content types. - **Total # of Devices**: The total number of devices with activity in last 28 days. @@ -57,19 +57,19 @@ There are several calculated values that appear on the Delivery Optimization rep **Efficiency (%) Calculations**: -- Bandwidth Savings (BW SAV%) = (BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ -(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) * 100.0 +- Bandwidth Savings (BW SAV%) = 100 * (BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ +(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) - [UCDOAggregatedStatus](wufb-reports-schema-ucdostatus.md) table -- % P2P Efficiency = (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 +- % P2P Efficiency = 100 * (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table -- % MCC Efficiency = BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) * 100 +- % MCC Efficiency = 100 * BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table **Bytes Calculations**: - TotalBytes = BytesFromCDN + BytesFromEnterpriseCache + BytesFromPeers + BytesFromGroupPeers - [UCDOAggregatedStatus](wufb-reports-schema-ucdostatus.md) table -- BytesFromCDN = BytesFromCDN - BytesFromEnterpriseCache +- BytesFromCDN = BytesFromCDN - [UCDOAggregatedStatus](wufb-reports-schema-ucdostatus.md) table - BytesFromPeers = BytesFromLAN - [UCDOAggregatedStatus](wufb-reports-schema-ucdoaggregatedstatus.md) table @@ -145,7 +145,7 @@ DeviceCount = count_distinct(GlobalDeviceId) by GroupID | top 10 by DeviceCount ## Frequency Asked Questions - **What time period does the Delivery Optimization data include?** -Data is available for the last 28 days. +Data is generated/aggregated for the last 28 days for active devices. - **Data is showing as 'Unknown', what does that mean?** You may see data in the report listed as 'Unknown'. This status indicates that the Delivery Optimization DownloadMode setting is either invalid or empty. From f71d93896e537e2dfeac4d8f9ce468f857d02bbc Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Wed, 5 Apr 2023 13:55:49 -0600 Subject: [PATCH 042/139] Update wufb-reports-do.md --- windows/deployment/update/wufb-reports-do.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index bd71d69452..5cef2d60c9 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -57,12 +57,12 @@ There are several calculated values that appear on the Delivery Optimization rep **Efficiency (%) Calculations**: -- Bandwidth Savings (BW SAV%) = 100 * (BytesFromPeers + BytesFromGroupPeers + BytesFromCache)/ +- Bandwidth Savings (BW SAV%) = 100 * (BytesFromPeers + BytesFromGroupPeers + BytesFromCache) / (BytesFromPeers + BytesFromGroupPeers+BytesFromCDN + BytesFromCache) - [UCDOAggregatedStatus](wufb-reports-schema-ucdostatus.md) table -- % P2P Efficiency = 100 * (BytesFromPeers + BytesFromGroupPeers)/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) +- % P2P Efficiency = 100 * (BytesFromPeers + BytesFromGroupPeers) / (BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table -- % MCC Efficiency = 100 * BytesFromCache/(BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) +- % MCC Efficiency = 100 * BytesFromCache / (BytesFromPeers + BytesFromGroupPeers+BytesFromCDN+BytesFromCache) - [UCDOStatus](wufb-reports-schema-ucdostatus.md) table **Bytes Calculations**: From 3db07a0e829d7728aff5b0f44fa276b7e033f422 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 16:22:39 -0400 Subject: [PATCH 043/139] Mo changes --- ...e-active-directory-integration-with-mdm.md | 4 +- ...omatic-mdm-enrollment-in-the-new-portal.md | 27 +- ...ollment-using-windows-provisioning-tool.md | 103 +++--- ...ficate-authentication-device-enrollment.md | 130 ++++--- ...device-automatically-using-group-policy.md | 323 +++++++----------- ...erated-authentication-device-enrollment.md | 242 +++++++------ ...rver-side-mobile-application-management.md | 4 +- ...-in-your-organization-modern-management.md | 4 +- .../mdm-enrollment-of-windows-devices.md | 30 +- windows/client-management/mdm-overview.md | 4 +- .../mobile-device-enrollment.md | 6 +- ...ew-in-windows-mdm-enrollment-management.md | 6 +- ...remise-authentication-device-enrollment.md | 145 ++++---- .../push-notification-windows-mdm.md | 4 +- windows/client-management/toc.yml | 32 +- 15 files changed, 476 insertions(+), 588 deletions(-) diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 5d78440379..c062325002 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -1,7 +1,7 @@ --- title: Azure Active Directory integration with MDM description: Azure Active Directory is the world's largest enterprise cloud identity management service. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -11,7 +11,7 @@ author: vinaypamnani-msft ms.collection: - highpri - tier2 -ms.date: 12/31/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index ad2ed3b4a8..1c9d410723 100644 --- a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -1,36 +1,29 @@ --- -title: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal -description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new portal +title: Automatic MDM enrollment in the Intune admin center +description: Automatic MDM enrollment in the Intune admin center ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 12/18/2020 -ms.reviewer: +ms.date: 04/05/2023 +ms.reviewer: manager: aaroncz appliesto: - ✅ Windows 11 - ✅ Windows 10 --- -# Azure AD and Microsoft Intune: Automatic MDM enrollment in the Intune admin center +# Automatic MDM enrollment in the Intune admin center -Microsoft Intune can be accessed directly using its own admin center. For more information, go to: - -- [Tutorial: Walkthrough Intune in Microsoft Intune admin center](/mem/intune/fundamentals/tutorial-walkthrough-endpoint-manager) -- Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -If you use the Azure portal, then you can access Intune using the following steps: +Windows devices can be enrolled in to Intune automatically when they join or register with Azure Active Directory. Automatic enrollment can be configured in Azure Portal. 1. Go to your Azure AD Blade. + 1. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. -1. Select **Microsoft Intune** and configure the blade. -![How to get to the Blade.](images/azure-mdm-intune.png) +1. Select **Microsoft Intune** and configure the blade. You can specify settings to allow **All** users to enroll a device, or choose to allow **Some** users (and specify a group). -Configure the blade + ![Configure the Blade.](images/azure-intune-configure-scope.png) -![Configure the Blade.](images/azure-intune-configure-scope.png) - -You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). +1. Select **Save** to configure MDM auto-enrollment for Azure AD joined devices and bring-your-own-device scenarios. diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index 199bd846e9..e3f53846a8 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,22 +1,22 @@ --- title: Bulk enrollment -description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. In Windows 10 and Windows 11. -ms.reviewer: +description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 06/26/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 --- -# Bulk enrollment +# Bulk enrollment using Windows Configuration Designer -Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. In Windows 10 and 11 desktop devices, you can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join (Cloud Domain Join) enrollment scenario. +Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join (Cloud Domain Join) enrollment scenario. ## Typical use cases @@ -26,7 +26,7 @@ Bulk enrollment is an efficient way to set up a large number of devices to be ma - Set up industrial machinery. - Set handheld POS devices. -On the desktop, you can create an Active Directory account, such as "enrollment@contoso.com" and give it only the ability to join the domain. Once the desktop is joined with that admin account, then standard users in the domain can sign in to use it. This account is especially useful in getting a large number of desktop ready to use within a domain. +On the desktop, you can create an Active Directory account, such as `enrollment@contoso.com` and give it only the ability to join the domain. Once the desktop is joined with that admin account, then standard users in the domain can sign in to use it. This account is especially useful in getting a large number of desktop ready to use within a domain. On the desktop and mobile devices, you can use an enrollment certificate or enrollment username and password, such as `enroll@contoso.com` and `enrollmentpassword`. These credentials are used in the provisioning package, which you can use to enroll multiple devices to the MDM service. Once the devices are joined, many users can use them. @@ -35,7 +35,7 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro > - Bulk-join is not supported in Azure Active Directory Join. > - Bulk enrollment does not work in Intune standalone environment. > - Bulk enrollment works in Microsoft Intune where the ppkg is generated from the Configuration Manager console. -> - To change bulk enrollment settings, login to **AAD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. +> - To change bulk enrollment settings, login to **Azure AD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. > - Bulk Token creation is not supported with federated accounts. ## What you need @@ -44,6 +44,7 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro - Windows Configuration Designer (WCD) tool. To get the WCD tool, download from the [Microsoft Store](https://www.microsoft.com/store/productId/9NBLGGH4TX22). For more information about the WCD tool, see [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) and [Getting started with Windows WCD](/windows/configuration/provisioning-packages/provisioning-install-icd). + - Enrollment credentials (domain account for enrollment, generic enrollment credentials for MDM, enrollment certificate for MDM.). - Wi-Fi credentials, computer name scheme, and anything else required by your organization. @@ -55,38 +56,40 @@ Using the WCD, create a provisioning package using the enrollment information re 1. Open the WCD tool. 1. Select **Advanced Provisioning**. - ![icd start page.](images/bulk-enrollment7.png) 1. Enter a project name and select **Next**. 1. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then select **Next**. 1. Skip **Import a provisioning package (optional)** and select **Finish**. -1. Expand **Runtime settings** > **Workplace**. -1. Select **Enrollments**, enter a value in **UPN**, and then select **Add**. - The UPN is a unique identifier for the enrollment. For bulk enrollment, this UPN must be a service account that is allowed to enroll multiple users, such as "enrollment@contoso.com". -1. On the left navigation pane, expand the **UPN** and then enter the information for the rest of the settings for enrollment process. - Here's the list of available settings: +1. Expand **Runtime settings** > **Workplace**. +1. Select **Enrollments**, enter a value in **UPN**, and then select **Add**. The UPN is a unique identifier for the enrollment. For bulk enrollment, this UPN must be a service account that is allowed to enroll multiple users, such as `enrollment@contoso.com`. +1. On the left navigation pane, expand the **UPN** and then enter the information for the rest of the settings for enrollment process. Here's the list of available settings: + - **AuthPolicy** - Select **OnPremise**. - **DiscoveryServiceFullUrl** - specify the full URL for the discovery service. - **EnrollmentServiceFullUrl** - Optional and in most cases, it should be left blank. - **PolicyServiceFullUrl** - Optional and in most cases, it should be left blank. - **Secret** - Password - For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). - Here's the screenshot of the WCD at this point. + + For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). Here's the screenshot of the WCD at this point. ![bulk enrollment screenshot.](images/bulk-enrollment.png) -1. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). + +1. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). 1. When you're done adding all the settings, on the **File** menu, select **Save**. -1. On the main menu, select **Export** > **Provisioning package**. +1. On the main menu, select **Export** > **Provisioning package**. ![icd menu for export.](images/bulk-enrollment2.png) + 1. Enter the values for your package and specify the package output location. ![enter package information.](images/bulk-enrollment3.png) ![enter additional information for package information.](images/bulk-enrollment4.png) ![specify file location.](images/bulk-enrollment6.png) + 1. Select **Build**. ![icb build window.](images/bulk-enrollment5.png) + 1. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). 1. Apply the package to your devices. @@ -99,28 +102,31 @@ Using the WCD, create a provisioning package using the enrollment information re 1. Enter a project name and select **Next**. 1. Select **Common to all Windows editions**, since Provisioning CSP is common to all Windows editions. 1. Skip **Import a provisioning package (optional)** and select **Finish**. -1. Specify the certificate. - 1. Go to **Runtime settings** > **Certificates** > **ClientCertificates**. - 2. Enter a **CertificateName** and then select **Add**. - 3. Enter the **CertificatePasword**. - 4. For **CertificatePath**, browse and select the certificate to be used. - 5. Set **ExportCertificate** to False. - 6. For **KeyLocation**, select **Software only**. +1. Specify the certificate: + + 1. Go to **Runtime settings** > **Certificates** > **ClientCertificates**. + 1. Enter a **CertificateName** and then select **Add**. + 1. Enter the **CertificatePassword**. + 1. For **CertificatePath**, browse and select the certificate to be used. + 1. Set **ExportCertificate** to False. + 1. For **KeyLocation**, select **Software only**. ![icd certificates section.](images/bulk-enrollment8.png) + 1. Specify the workplace settings. - 1. Got to **Workplace** > **Enrollments**. - 2. Enter the **UPN** for the enrollment and then select **Add**. - The UPN is a unique identifier for the enrollment. For bulk enrollment, this UPN must be a service account that is allowed to enroll multiple users, such as "enrollment@contoso.com". - 3. On the left column, expand the **UPN** and then enter the information for the rest of the settings for enrollment process. - Here's the list of available settings: + + 1. Got to **Workplace** > **Enrollments**. + 1. Enter the **UPN** for the enrollment and then select **Add**. The UPN is a unique identifier for the enrollment. For bulk enrollment, this UPN must be a service account that is allowed to enroll multiple users, such as `enrollment@contoso.com`. + 1. On the left column, expand the **UPN** and then enter the information for the rest of the settings for enrollment process. Here's the list of available settings: - **AuthPolicy** - Select **Certificate**. - **DiscoveryServiceFullUrl** - specify the full URL for the discovery service. - **EnrollmentServiceFullUrl** - Optional and in most cases, it should be left blank. - **PolicyServiceFullUrl** - Optional and in most cases, it should be left blank. - **Secret** - the certificate thumbprint. - For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). -1. Configure the other settings, such as the Wi-Fi connection so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). + + For detailed descriptions of these settings, see [Provisioning CSP](mdm/provisioning-csp.md). + +1. Configure the other settings, such as the Wi-Fi connection so that the device can join a network before joining MDM (for example, **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). 1. When you're done adding all the settings, on the **File** menu, select **Save**. 1. Export and build the package (steps 10-13 in the procedure above). 1. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). @@ -128,37 +134,30 @@ Using the WCD, create a provisioning package using the enrollment information re ## Apply a provisioning package -Here's the list of articles about applying a provisioning package: +- [Apply a package during initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#during-initial-setup) +- [Apply a package after initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) +- [Apply a package directly](/windows/configuration/provisioning-packages/provisioning-apply-package#apply-directly) +- [Apply a package from the Settings app](#apply-a-package-from-the-settings-app). -- [Apply a package on the first-run setup screen (out-of-the-box experience)](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment#apply-package) -- [Apply a package to a Windows desktop edition image](/windows/configuration/provisioning-packages/provisioning-create-package#to_apply_a_provisioning_package_to_a_desktop_image) -- [Apply a package from the Settings menu](#apply-a-package-from-the-settings-menu) - article below +## Apply a package from the Settings app -## Apply a package from the Settings menu - -1. Go to **Settings** > **Accounts** > **Access work or school**. +1. Go to **Settings** > **Accounts** > **Access work or school**. 1. Select **Add or remove a provisioning package**. 1. Select **Add a package**. -## Validate that the provisioning package was applied +## Validate that the provisioning package was applied -1. Go to **Settings** > **Accounts** > **Access work or school**. -1. Select **Add or remove a provisioning package**. - You should see your package listed. +1. Go to **Settings** > **Accounts** > **Access work or school**. +1. Select **Add or remove a provisioning package**. You should see your package listed. ## Retry logic if there's a failure -If the provisioning engine receives a failure from a CSP, it will retry to provision three times in a row. +- If the provisioning engine receives a failure from a CSP, it will retry to provision three times in a row. +- If all immediate attempts fail, a delayed task is launched to try provisioning again later. It will retry four times at a decaying rate of 15 minutes -> 1 hr -> 4 hr -> "Next System Start". These attempts will be run from the SYSTEM context. +- It will also retry to apply the provisioning each time it's launched, if started from somewhere else as well. +- In addition, provisioning will be restarted in the SYSTEM context after a sign in and the [system has been idle](/windows/win32/taskschd/task-idle-conditions). -If all immediate attempts fail, a delayed task is launched to try provisioning again later. It will retry four times at a decaying rate of 15 minutes -> 1 hr -> 4 hr -> "Next System Start". These attempts will be run from a SYSTEM context. - -It will also retry to apply the provisioning each time it's launched, if started from somewhere else as well. - -In addition, provisioning will be restarted in a SYSTEM context after a sign in and the system has been idle ([details on idle conditions](/windows/win32/taskschd/task-idle-conditions)). - -## Other provisioning articles - -Here are links to step-by-step provisioning articles: +## Related articles - [Provision PCs with apps and certificates for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-with-apps) - [Provision PCs with common settings for initial deployment](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment) diff --git a/windows/client-management/certificate-authentication-device-enrollment.md b/windows/client-management/certificate-authentication-device-enrollment.md index 526ac9e52c..bf9d1e373f 100644 --- a/windows/client-management/certificate-authentication-device-enrollment.md +++ b/windows/client-management/certificate-authentication-device-enrollment.md @@ -1,14 +1,14 @@ --- title: Certificate authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using certificate authentication policy. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 06/26/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -21,13 +21,8 @@ This section provides an example of the mobile device enrollment protocol using > [!NOTE] > To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package). -## In this topic - -- [Discovery service](#discovery-service) -- [Enrollment policy web service](#enrollment-policy-web-service) -- [Enrollment web service](#enrollment-web-service) - -For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +> [!NOTE] +> For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery Service @@ -40,34 +35,33 @@ User-Agent: Windows Enrollment Client Host: EnterpriseEnrollment.Contoso.com Content-Length: xxx Cache-Control: no-cache - - - + + http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover - - urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 - - http://www.w3.org/2005/08/addressing/anonymous - + + urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 + + http://www.w3.org/2005/08/addressing/anonymous + https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc - - - - - + + + + + user@contoso.com 101 10.0.0.0 - 3.0 + 3.0 10.0.0.0 Certificate - - - + + + ``` @@ -79,7 +73,7 @@ Content-Length: 865 Content-Type: application/soap+xml; charset=utf-8 Server: EnterpriseEnrollment.Contoso.com Date: Tue, 02 Aug 2012 00:32:56 GMT - @@ -90,9 +84,9 @@ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoverySer urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 - - Certificate @@ -120,11 +114,11 @@ User-Agent: Windows Enrollment Client Host: enrolltest.contoso.com Content-Length: xxxx Cache-Control: no-cache - @@ -142,12 +136,12 @@ Cache-Control: no-cache http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> B64EncodedSampleBinarySecurityToken - + - - @@ -193,29 +187,29 @@ Content-Type: application/soap+xml Content-Length: xxxx - http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse - d4335d7c-e192-402d-b0e7-f5d550467e3c urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598 - - - - + - - @@ -271,11 +265,11 @@ Host: enrolltest.contoso.com Content-Length: 3242 Cache-Control: no-cache - @@ -292,7 +286,7 @@ Cache-Control: no-cache 2014-10-16T17:55:13Z 2014-10-16T17:57:13Z - + - - + MessageDigestValue - SignedMessageBlob/ds:SignatureValue> + SignedMessageBlob/ds:SignatureValue> - - + @@ -333,8 +327,8 @@ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrol http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue - DER format PKCS#10 certificate request in Base64 encoding Insterted Here @@ -356,7 +350,7 @@ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrol - 7BA748C8-703E-4DF2-A74A-92984117346A + 7BA748C8-703E-4DF2-A74A-92984117346A 3J4KLJ9SDJFAL93JLAKHJSDFJHAO83HAKSHFLAHSKFNHNPA2934342 @@ -378,8 +372,8 @@ Content-Type: application/soap+xml; charset=utf-8 Server: Microsoft-IIS/7.0 Date: Fri, 03 Aug 2012 00:32:59 GMT - @@ -395,14 +389,14 @@ Date: Fri, 03 Aug 2012 00:32:59 GMT - http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken - - + - - + + - + @@ -482,7 +476,7 @@ The following example shows the encoded provisioning XML. - + @@ -497,7 +491,7 @@ The following example shows the encoded provisioning XML. - ``` diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index d22d2d0223..6f3424abb1 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,5 +1,5 @@ --- -title: Enroll a Windows 10 device automatically using Group Policy +title: Enroll a Windows device automatically using Group Policy description: Learn how to use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. ms.author: vinpa ms.topic: article @@ -7,7 +7,7 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 04/30/2022 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.collection: - highpri @@ -17,18 +17,18 @@ appliesto: - ✅ Windows 10 --- -# Enroll a Windows 10 device automatically using Group Policy +# Enroll a Windows device automatically using Group Policy -Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to Mobile Device Management (MDM) for Active Directory (AD) domain-joined devices. +You can use a Group Policy to trigger auto-enrollment to Mobile Device Management (MDM) for Active Directory (AD) domain-joined devices. The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This cause-and-effect mechanism means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. -Requirements: +**Requirements**: -- Active Directory-joined PC running Windows 10, version 1709 or later -- The enterprise has configured a mobile device management (MDM) service -- The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad) -- The device shouldn't already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) +- The Active Directory joined device must be running Windows 10, version 1709 or later. +- The enterprise has configured a Mobile Device Management (MDM) service. +- The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad). +- The device shouldn't already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`). - The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. For more information, see [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan). > [!TIP] @@ -45,14 +45,100 @@ The auto-enrollment relies on the presence of an MDM service and the Azure Activ When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. -In Windows 10, version 1709 or later, when the same policy is configured in Group Policy and MDM, Group Policy policy takes precedence over MDM. Since Windows 10, version 1803, a new setting allows you to change precedence to MDM. For more information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](/archive/blogs/cbernier/windows-10-group-policy-vs-intune-mdm-policy-who-wins). +- Starting in Windows 10, version 1709, when the same policy is configured in Group Policy and MDM, Group Policy policy takes precedence over MDM. +- Starting in Windows 10, version 1803, a new setting allows you to change precedence to MDM. For more information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](/archive/blogs/cbernier/windows-10-group-policy-vs-intune-mdm-policy-who-wins). For this policy to work, you must verify that the MDM service provider allows Group Policy initiated MDM enrollment for domain-joined devices. +## Configure the auto-enrollment for a group of devices + +To configure auto-enrollment using a group policy, use the following steps: + +1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. +1. Create a Security Group for the PCs. +1. Link the GPO. +1. Filter using Security Groups. + +If you don't see the policy, it may be because you don't have the ADMX for Windows 10, version 1803 or later installed. To fix the issue, use the following procedures. Note that the latest MDM.admx is backwards compatible. + +1. Download the administrative templates for the desired version: + + - [Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) + - [Administrative Templates (.admx) for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) + - [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495) + - [Administrative Templates (.admx) for Windows 10 November 2019 Update (1909)](https://www.microsoft.com/download/confirmation.aspx?id=100591) + - [Administrative Templates (.admx) for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/confirmation.aspx?id=101445) + - [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) + - [Administrative Templates (.admx) for Windows 10 May 2021 Update (21H1)](https://www.microsoft.com/download/details.aspx?id=103124) + - [Administrative Templates (.admx) for Windows 10 November 2021 Update (21H2)-v2.0](https://www.microsoft.com/download/details.aspx?id=104042) + - [Administrative Templates (.admx) for Windows 10 October 2022 Update (22H2)](https://www.microsoft.com/download/104677) + - [Administrative Templates (.admx) for Windows 11 2022 September Update (22H2)](https://www.microsoft.com/download/details.aspx?id=104593) + +1. Install the package on the Domain Controller. + +1. Navigate to `C:\Program Files (x86)\Microsoft Group Policy`, and locate the appropriate sub-directory depending on the installed version. + +1. Copy the PolicyDefinitions folder to `\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions`. + + If this folder doesn't exist, then you'll be switching to a [central policy store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for your entire domain. + +1. Wait for the SYSVOL DFSR replication to be completed for the policy to be available. + +## Configure the auto-enrollment Group Policy for a single PC + +This procedure is only for illustration purposes to show how the new auto-enrollment policy works. It's not recommended for the production environment in the enterprise. + +1. Run `GPEdit.msc`. Choose **Start**, then in the text box type `gpedit`. + +1. Under **Best match**, select **Edit group policy** to launch it. + +1. In **Local Computer Policy**, select **Administrative Templates** > **Windows Components** > **MDM**. + +1. Double-click **Enable automatic MDM enrollment using default Azure AD credentials**. Select **Enable**, select **User Credential** from the dropdown **Select Credential Type to Use**, then select **OK**. + + :::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png"::: + + > [!NOTE] + > In Windows 10, version 1903 and later, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. The default behavior for older releases is to revert to **User Credential**. + > + > **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or [Azure Virtual Desktop multi-session host pools](/mem/intune/fundamentals/azure-virtual-desktop-multi-session) because the Intune subscription is user centric. User credentials are supported for [Azure Virtual Desktop personal host pools](/mem/intune/fundamentals/azure-virtual-desktop). + +When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called **Schedule created by enrollment client for automatically enrolling in MDM from Azure Active Directory**. To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). + +If two-factor authentication is required, you'll be prompted to complete the process. Here's an example screenshot. + +![Two-factor authentication notification.](images/autoenrollment-2-factor-auth.png) + +> [!TIP] +> You can avoid this behavior by using Conditional Access Policies in Azure AD. Learn more by reading [What is Conditional Access?](/azure/active-directory/conditional-access/overview). + +## Verify enrollment + +To verify successful enrollment to MDM, go to **Start** > **Settings** > **Accounts** > **Access work or school**, then select your domain account.Select **Info** to see the MDM enrollment information. + +![Work School Settings.](images/autoenrollment-settings-work-school.png) + +> [!NOTE] +> If you don't see the **Info** button or the enrollment information, enrollment might have failed. Check the status in [Task Scheduler app](#task-scheduler-app). + +## Task Scheduler app + +Select **Start**, then in the text box type `task scheduler`. Under **Best match**, select **Task Scheduler** to launch it. + +In **Task Scheduler Library**, open **Microsoft > Windows** , then select **EnterpriseMgmt**. + +:::image type="content" alt-text="Auto-enrollment scheduled task." source="images/autoenrollment-scheduled-task.png" lightbox="images/autoenrollment-scheduled-task.png"::: + +To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. You can see the logs in the **History** tab. + +The message **0x80180026** is a failure message (`MENROLL_E_DEVICE_MANAGEMENT_BLOCKED`). If the device enrollment is blocked, your IT admin might have enabled the **Disable MDM Enrollment** policy. + +> [!NOTE] +> The GPEdit console doesn't reflect the status of policies set by your IT admin on your device. It's only used by the user to set policies. + ## Verify auto-enrollment requirements and settings -To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. -The following steps demonstrate required settings using the Intune service: +To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. The following steps demonstrate required settings using the Intune service: 1. Verify that the user who is going to enroll the device has a valid [Intune license](/mem/intune/fundamentals/licenses). @@ -83,7 +169,7 @@ The following steps demonstrate required settings using the Intune service: ![Azure AD device list.](images/azure-ad-device-list.png) -1. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc +1. Verify that the MDM discovery URL during auto-enrollment is `https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc`. ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) @@ -91,166 +177,15 @@ The following steps demonstrate required settings using the Intune service: :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: -1. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. - -You may contact your domain administrators to verify if the group policy has been deployed successfully. - -1. Verify that the device isn't enrolled with the old Intune client used on the Intune Silverlight Portal (the Intune portal used before the Azure portal). +1. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. 1. Verify that Microsoft Intune should allow enrollment of Windows devices. :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: -## Configure the auto-enrollment Group Policy for a single PC +## Troubleshoot auto-enrollment -This procedure is only for illustration purposes to show how the new auto-enrollment policy works. It's not recommended for the production environment in the enterprise. For bulk deployment, you should use the [Group Policy Management Console process](#configure-the-auto-enrollment-for-a-group-of-devices). - -Requirements: - -- AD-joined PC running Windows 10, version 1709 or later -- Enterprise has MDM service already configured -- Enterprise AD must be registered with Azure AD - -1. Run `GPEdit.msc`. Choose **Start**, then in the text box type `gpedit`. - - ![GPEdit desktop app search result.](images/autoenrollment-gpedit.png) - -1. Under **Best match**, select **Edit group policy** to launch it. - -1. In **Local Computer Policy**, select **Administrative Templates** > **Windows Components** > **MDM**. - - :::image type="content" alt-text="MDM policies." source="images/autoenrollment-mdm-policies.png" lightbox="images/autoenrollment-mdm-policies.png"::: - -1. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the **Selected Credential Type to use**. - - :::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png"::: - -1. Select **Enable**, select **User Credential** from the dropdown **Select Credential Type to Use**, then select **OK**. - - > [!NOTE] - > In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. The default behavior for older releases is to revert to **User Credential**. - > **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or [Azure Virtual Desktop multi-session host pools](/mem/intune/fundamentals/azure-virtual-desktop-multi-session) because the Intune subscription is user centric. User credentials are supported for [Azure Virtual Desktop personal host pools](/mem/intune/fundamentals/azure-virtual-desktop). - - When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called "Schedule created by enrollment client for automatically enrolling in MDM from Azure Active Directory." - - To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). - - If two-factor authentication is required, you'll be prompted to complete the process. Here's an example screenshot. - - ![Two-factor authentication notification.](images/autoenrollment-2-factor-auth.png) - - > [!TIP] - > You can avoid this behavior by using Conditional Access Policies in Azure AD. - Learn more by reading [What is Conditional Access?](/azure/active-directory/conditional-access/overview). - -1. To verify successful enrollment to MDM, go to **Start** > **Settings** > **Accounts** > **Access work or school**, then select your domain account. - -1. Select **Info** to see the MDM enrollment information. - - ![Work School Settings.](images/autoenrollment-settings-work-school.png) - - If you don't see the **Info** button or the enrollment information, enrollment might have failed. Check the status in [Task Scheduler app](#task-scheduler-app). - -### Task Scheduler app - -1. Select **Start**, then in the text box type `task scheduler`. - - ![Task Scheduler search result.](images/autoenrollment-task-schedulerapp.png) - -1. Under **Best match**, select **Task Scheduler** to launch it. - -1. In **Task Scheduler Library**, open **Microsoft > Windows** , then select **EnterpriseMgmt**. - - :::image type="content" alt-text="Auto-enrollment scheduled task." source="images/autoenrollment-scheduled-task.png" lightbox="images/autoenrollment-scheduled-task.png"::: - - To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. The message **0x80180026** is a failure message (`MENROLL_E_DEVICE_MANAGEMENT_BLOCKED`). You can see the logs in the **History** tab. - - If the device enrollment is blocked, your IT admin might have enabled the **Disable MDM Enrollment** policy. - - > [!NOTE] - > The GPEdit console doesn't reflect the status of policies set by your IT admin on your device. It's only used by the user to set policies. - -## Configure the auto-enrollment for a group of devices - -Requirements: - -- AD-joined PC running Windows 10, version 1709 or later -- Enterprise has MDM service already configured (with Intune or a third-party service provider) -- Enterprise AD must be integrated with Azure AD. -- Ensure that PCs belong to same computer group. - -> [!IMPORTANT] -> If you don't see the policy, it may be because you don't have the ADMX for Windows 10, version 1803, version 1809, or version 1903 installed. To fix the issue, use the following procedures. Note that the latest MDM.admx is backwards compatible. - -1. Download: - - - 1803 --> [Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) - - - 1809 --> [Administrative Templates (.admx) for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) - - - 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495) - - - 1909 --> [Administrative Templates (.admx) for Windows 10 November 2019 Update (1909)](https://www.microsoft.com/download/confirmation.aspx?id=100591) - - - 2004 --> [Administrative Templates (.admx) for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/confirmation.aspx?id=101445) - - - 20H2 --> [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) - - - 21H1 --> [Administrative Templates (.admx) for Windows 10 May 2021 Update (21H1)](https://www.microsoft.com/download/details.aspx?id=103124) - - - 21H2 --> [Administrative Templates (.admx) for Windows 10 November 2021 Update (21H2)-v2.0](https://www.microsoft.com/download/details.aspx?id=104042) - - - 22H2 --> [Administrative Templates (.admx) for Windows 10 October 2022 Update (22H2)](https://www.microsoft.com/download/104677) - - - 22H2 --> [Administrative Templates (.admx) for Windows 11 2022 September Update (22H2)](https://www.microsoft.com/download/details.aspx?id=104593) - -1. Install the package on the Domain Controller. - -1. Navigate, depending on the version to the folder: - - - 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2** - - - 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2** - - - 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3** - - - 1909 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2019 Update (1909)** - - - 2004 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2020 Update (2004)** - - - 20H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2020 Update (20H2)** - - - 21H1 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2021 Update (21H1)** - - - 21H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2021 Update V2 (21H2)** - - - 22H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2022 Update (22H2)** - - - 22H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 11 September 2022 Update (22H2)** - -1. Rename the extracted Policy Definitions folder to `PolicyDefinitions`. - -1. Copy the PolicyDefinitions folder to `\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions`. - - If this folder doesn't exist, then you'll be switching to a [central policy store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for your entire domain. - -1. Wait for the SYSVOL DFSR replication to be completed for the policy to be available. - -This procedure will work for any future version as well. - -1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. - -1. Create a Security Group for the PCs. - -1. Link the GPO. - -1. Filter using Security Groups. - -## Troubleshoot auto-enrollment of devices - -Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device. - -To collect Event Viewer logs: +Investigate the logs if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows device. To collect Event Viewer logs: 1. Open Event Viewer. @@ -263,61 +198,49 @@ To collect Event Viewer logs: :::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png"::: - If you can't find event ID 75 in the logs, it indicates that the auto-enrollment failed. This failure can happen because of the following reasons: +If you can't find event ID 75 in the logs, it indicates that the auto-enrollment failed. This failure can happen because of the following reasons: - - The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here's an example screenshot that shows that the auto-enrollment failed: +- The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here's an example screenshot that shows that the auto-enrollment failed: - :::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png"::: + :::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png"::: - To troubleshoot, check the error code that appears in the event. For more information, see [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors). + To troubleshoot, check the error code that appears in the event. For more information, see [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors). - - The auto-enrollment didn't trigger at all. In this case, you'll not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section. +- The auto-enrollment didn't trigger at all. In this case, you'll not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described below: - The auto-enrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot: + The auto-enrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot: - :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: + :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: - > [!NOTE] - > This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task. + > [!NOTE] + > This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task. - This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: - **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Azure Active Directory is triggered by event ID 107. + This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Azure Active Directory is triggered by event ID 107. - :::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: + :::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: - When the task is completed, a new event ID 102 is logged. + When the task is completed, a new event ID 102 is logged. - :::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png"::: + :::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png"::: - The task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This status-display means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It doesn't indicate the success or failure of auto-enrollment. + The task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This status-display means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It doesn't indicate the success or failure of auto-enrollment. - If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Azure AD is initiated, there's possibly an issue with the group policy. Immediately run the command `gpupdate /force` in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. - One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: + If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Azure AD is initiated, there's possibly an issue with the group policy. Immediately run the command `gpupdate /force` in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. + One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: - :::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: + :::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: - By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs** > **Microsoft** > **Windows** > **Task Scheduler** > **Operational** event log file under event ID 7016. + By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs** > **Microsoft** > **Windows** > **Task Scheduler** > **Operational** event log file under event ID 7016. - A resolution to this issue is to remove the registry key manually. If you don't know which registry key to remove, go for the key that displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: + A resolution to this issue is to remove the registry key manually. If you don't know which registry key to remove, go for the key that displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: - :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: + :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: -### Related topics +## Related topics - [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11)) - [Create and Edit a Group Policy Object](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754740(v=ws.11)) - [Link a Group Policy Object](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732979(v=ws.11)) - [Filter Using Security Groups](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc752992(v=ws.11)) - [Enforce a Group Policy Object Link](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753909(v=ws.11)) -- [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) - [Getting started with Cloud Native Windows Endpoints](/mem/cloud-native-windows-endpoints) -- [A Framework for Windows endpoint management transformation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/a-framework-for-windows-endpoint-management-transformation/ba-p/2460684) -- [Success with remote Windows Autopilot and Hybrid Azure Active Director join](https://techcommunity.microsoft.com/t5/intune-customer-success/success-with-remote-windows-autopilot-and-hybrid-azure-active/ba-p/2749353) - -### Useful Links - -- [Windows 10 Administrative Templates for Windows 10 November 2021 Update (21H2)-v2.0](https://www.microsoft.com/download/details.aspx?id=104042) -- [Windows 10 Administrative Templates for Windows 10 May 2021 Update 21H1](https://www.microsoft.com/download/details.aspx?id=103124) -- [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591) -- [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495) -- [Windows 10 Administrative Templates for Windows 10 October 2018 Update 1809](https://www.microsoft.com/download/details.aspx?id=57576) diff --git a/windows/client-management/federated-authentication-device-enrollment.md b/windows/client-management/federated-authentication-device-enrollment.md index 44ea3c1a36..7ae977249a 100644 --- a/windows/client-management/federated-authentication-device-enrollment.md +++ b/windows/client-management/federated-authentication-device-enrollment.md @@ -1,14 +1,14 @@ --- title: Federated authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using federated authentication policy. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 07/28/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -20,28 +20,23 @@ This section provides an example of the mobile device enrollment protocol using The `` element the discovery response message specifies web authentication broker page start URL. -For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). +For details about the Microsoft mobile device enrollment protocol for Windows, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). -## In this topic - -[Discovery service](#discovery-service) -[Enrollment policy web service](#enrollment-policy-web-service) -[Enrollment web service](#enrollment-web-service) - -For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +> [!NOTE] +> For the list of enrollment scenarios not supported in Windows, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery service The discovery web service provides the configuration information necessary for a user to enroll a phone with a management service. The service is a restful web service over HTTPS (server authentication only). > [!NOTE] -> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. +> The administrator of the discovery service must create a host with the address `enterpriseenrollment..com`. -The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain "enterpriseenrollment" to the domain of the email address, and by appending the path "/EnrollmentServer/Discovery.svc". For example, if the email address is "sample@contoso.com", the resulting URI for first Get request would be: `http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc`. +The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain **enterpriseenrollment** to the domain of the email address, and by appending the path `/EnrollmentServer/Discovery.svc`. For example, if the email address is `sample@contoso.com`, the resulting URI for first Get request would be: `http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc`. The first request is a standard HTTP GET request. -The following example shows a request via HTTP GET to the discovery server given user@contoso.com as the email address. +The following example shows a request via HTTP GET to the discovery server given `user@contoso.com` as the email address. ```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -73,16 +68,16 @@ Content-Type: text/html Content-Length: 0 ``` -After the device gets a response from the server, the device sends a POST request to enterpriseenrollment.*domain\_name*/EnrollmentServer/Discovery.svc. After it gets another response from the server (which should tell the device where the enrollment server is), the next message sent from the device is to enterpriseenrollment.*domain\_name* to the enrollment server. +After the device gets a response from the server, the device sends a POST request to `enterpriseenrollment./EnrollmentServer/Discovery.svc`. After it gets another response from the server (which should tell the device where the enrollment server is), the next message sent from the device is to `enterpriseenrollment.` enrollment server. The following logic is applied: 1. The device first tries HTTPS. If the server cert isn't trusted by the device, the HTTPS fails. 1. If that fails, the device tries HTTP to see whether it's redirected: - - If the device isn't redirected, it prompts the user for the server address. - - If the device is redirected, it prompts the user to allow the redirect. + - If the device isn't redirected, it prompts the user for the server address. + - If the device is redirected, it prompts the user to allow the redirect. -The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address +The following example shows a request via an HTTP POST command to the discovery web service given `user@contoso.com` as the email address ```http https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc @@ -93,34 +88,37 @@ The following example shows the discovery service request. ```xml - - - http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover - - urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 - - http://www.w3.org/2005/08/addressing/anonymous - - - https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc - - - - - - user@contoso.com - 3 - 3.0 - WindowsPhone - 10.0.0.0 - - OnPremise - Federated - - - - + xmlns:s="http://www.w3.org/2003/05/soap-envelope"> + + + http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover + + urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 + + http://www.w3.org/2005/08/addressing/anonymous + + + https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc + + + + + + user@contoso.com + 3 + + 3.0 + + WindowsPhone + + 10.0.0.0 + + OnPremise + Federated + + + + ``` @@ -142,7 +140,7 @@ When authentication policy is set to be Federated, Web Authentication Broker (WA > - Append the OS version as a parameter in the AuthenticationServiceURL. > - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. -A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. +A new XML tag, **AuthenticationServiceUrl**, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. > [!NOTE] > The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. @@ -168,7 +166,7 @@ After authentication is complete, the auth server should return an HTML form doc > To make an application compatible with strict Content Security Policy, it's usually necessary to make some changes to HTML templates and client-side code, add the policy header, and test that everything works properly once the policy is deployed. ```html -HTTP/1.1 200 OK +HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding Content-Length: 556 @@ -200,35 +198,34 @@ The following example shows a response received from the discovery web service t ```xml - - - http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse - - - d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8 - - urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 - - - - - Federated - 3.0 - - https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - https://portal.manage.contoso.com/LoginRedirect.aspx - - - - + xmlns:a="http://www.w3.org/2005/08/addressing"> + + + http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse + + + d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8 + + urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 + + + + + Federated + 3.0 + + https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + https://portal.manage.contoso.com/LoginRedirect.aspx + + + + ``` @@ -245,7 +242,7 @@ For Federated authentication policy, the security token credential is provided i As was described in the discovery response section, the inclusion of the `` element is opaque to the enrollment client, and the client doesn't interpret the string, and the inclusion of the element is agreed upon by the security token authentication server (as identified in the `` element of `` and the enterprise server. -The `` element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the `` element. +The `` element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the `` element. - wsse:BinarySecurityToken/attributes/ValueType: The `` ValueType attribute must be `http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken`. @@ -255,42 +252,39 @@ The following example is an enrollment policy request with a received security t ```xml - - - http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies - - urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 - - http://www.w3.org/2005/08/addressing/anonymous - - - https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - - B64EncodedSampleBinarySecurityToken - - - - - - - - - - - - + xmlns:a="http://www.w3.org/2005/08/addressing" + xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" + xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" + xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" + xmlns:ac="http://schemas.xmlsoap.org/ws/2006/12/authorization"> + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies + + urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 + + http://www.w3.org/2005/08/addressing/anonymous + + + https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + + B64EncodedSampleBinarySecurityToken + + + + + + + + + + + + ``` @@ -499,8 +493,8 @@ Here's a sample RSTR message and a sample of OMA client provisioning XML within The following example shows the enrollment web service response. ```xml - @@ -516,7 +510,7 @@ The following example shows the enrollment web service response. - @@ -524,7 +518,7 @@ The following example shows the enrollment web service response. - @@ -552,7 +546,7 @@ The following code shows sample provisioning XML (presented in the preceding pac - + @@ -618,15 +612,15 @@ The following code shows sample provisioning XML (presented in the preceding pac ``` > [!NOTE] -> +> > - `` and `` elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase. -> +> > - In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML. -> +> > - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document. -> +> > - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. -> +> > - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. -> +> > - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index db2ff0f60d..12f7e3eb21 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -6,8 +6,8 @@ ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 08/03/2022 -ms.reviewer: +ms.date: 04/05/2023 +ms.reviewer: manager: aaroncz appliesto: - ✅ Windows 11 diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 5f5eab5ac7..755bf07aa0 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -3,10 +3,10 @@ title: Manage Windows devices in your organization - transitioning to modern man description: This article offers strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. ms.prod: windows-client ms.localizationpriority: medium -ms.date: 06/03/2022 +ms.date: 04/05/2023 author: vinaypamnani-msft ms.author: vinpa -ms.reviewer: +ms.reviewer: manager: aaroncz ms.topic: overview ms.technology: itpro-manage diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index ae5405e2db..e11560c9bf 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -1,6 +1,6 @@ --- -title: MDM enrollment of Windows 10-based devices -description: Learn about mobile device management (MDM) enrollment of Windows 10-based devices to simplify access to your organization’s resources. +title: MDM enrollment of Windows devices +description: Learn about mobile device management (MDM) enrollment of Windows devices to simplify access to your organization's resources. ms.reviewer: manager: aaroncz ms.author: vinpa @@ -37,7 +37,7 @@ Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education c > [!NOTE] > Mobile devices can't be connected to an Active Directory domain. -### Out-of-box-experience +#### Out-of-box-experience Joining your device to an Active Directory domain during the out-of-box-experience (OOBE) isn't supported. To join a domain: @@ -53,7 +53,7 @@ Joining your device to an Active Directory domain during the out-of-box-experien ![create pc account.](images/unifiedenrollment-rs1-4.png) -### Use the Settings app +#### Use the Settings app To create a local account and connect the device: @@ -81,7 +81,7 @@ To create a local account and connect the device: ![type in domain name.](images/unifiedenrollment-rs1-10.png) -### Help with connecting to an Active Directory domain +#### Help with connecting to an Active Directory domain There are a few instances where your device can't be connected to an Active Directory domain. @@ -96,7 +96,7 @@ There are a few instances where your device can't be connected to an Active Dire All Windows devices can be connected to an Azure AD domain. These devices can be connected during OOBE. Additionally, desktop devices can be connected to an Azure AD domain using the Settings app. -### Out-of-box-experience +#### Out-of-box-experience To join a domain: @@ -116,7 +116,7 @@ To join a domain: ![azure ad signin.](images/unifiedenrollment-rs1-13.png) -### Use the Settings app +#### Use the Settings app To create a local account and connect the device: @@ -154,7 +154,7 @@ To create a local account and connect the device: ![corporate sign in screen](images/unifiedenrollment-rs1-20.png) -### Help with connecting to an Azure AD domain +#### Help with connecting to an Azure AD domain There are a few instances where your device can't be connected to an Azure AD domain. @@ -171,11 +171,9 @@ There are a few instances where your device can't be connected to an Azure AD do Personally owned devices, also known as bring your own device (BYOD), can be connected to a work or school account, or to MDM. Windows 10 doesn't require a personal Microsoft account on devices to connect to work or school. -### Connect to a work or school account - All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. -### Use the Settings app +### Register device in AAD and enroll in MDM To create a local account and connect the device: @@ -209,13 +207,9 @@ To create a local account and connect the device: ![account successfully added.](images/unifiedenrollment-rs1-27.png) -### Connect to MDM on a desktop (enrolling in device management) +### Enroll in device management only -All Windows 10-based devices can be connected to MDM. You can connect to an MDM through the Settings app. - -### Use the Settings app - -To create a local account and connect the device: +All Windows 10-based devices can be connected to MDM. You can connect to an MDM through the Settings app. To create a local account and connect the device: 1. Launch the Settings app. @@ -257,7 +251,7 @@ There are a few instances where your device may not be able to connect to work. | You don't have the right privileges to perform this operation. Talk to your admin. | You can't enroll your device into MDM as a standard user. You must be on an administrator account. | | We couldn't auto-discover a management endpoint matching the username entered. Check your username and try again. If you know the URL to your management endpoint, enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | -## Connect your Windows 10-based device to work using a deep link +## Connect your Windows device to work using a deep link Windows 10-based devices may be connected to work using a deep link. Users will be able to select or open a link in a particular format from anywhere in Windows 10, and be directed to the new enrollment experience. diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index efa9cb8b51..c741f52e64 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -1,7 +1,7 @@ --- title: Mobile Device Management overview -description: Windows 10 and Windows 11 provide an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy. -ms.date: 03/24/2023 +description: Windows provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy. +ms.date: 04/05/2023 ms.technology: itpro-manage ms.topic: article ms.prod: windows-client diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index 863f8db087..cae59a41d2 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -1,14 +1,14 @@ --- title: Mobile device enrollment -description: Learn how mobile device enrollment verifies that only authenticated and authorized devices can be managed by their enterprise. -ms.reviewer: +description: Learn how mobile device enrollment verifies that only authenticated and authorized devices can be managed by their enterprise. +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 03/29/2023 +ms.date: 04/05/2023 ms.collection: - highpri - tier2 diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index c70b4ab1a5..4309b6be4d 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -1,7 +1,7 @@ --- title: What's new in MDM enrollment and management -description: Discover what's new and breaking changes in Windows 10 and Windows 11 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. -ms.reviewer: +description: Discover what's new and breaking changes in mobile device management (MDM) enrollment and management experience across all Windows devices. +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -9,7 +9,7 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.localizationpriority: medium -ms.date: 09/16/2022 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/client-management/on-premise-authentication-device-enrollment.md b/windows/client-management/on-premise-authentication-device-enrollment.md index 95dce3e717..362b0467bb 100644 --- a/windows/client-management/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/on-premise-authentication-device-enrollment.md @@ -1,14 +1,14 @@ --- title: On-premises authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 06/26/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -18,51 +18,44 @@ appliesto: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). -## In this topic - -- [On-premises authentication device enrollment](#on-premises-authentication-device-enrollment) - - [In this topic](#in-this-topic) - - [Discovery service](#discovery-service) - - [Enrollment policy web service](#enrollment-policy-web-service) - - [Enrollment web service](#enrollment-web-service) - -For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +> [!NOTE] +> For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery service The discovery web service provides the configuration information necessary for a user to enroll a device with a management service. The service is a restful web service over HTTPS (server authentication only). > [!NOTE] -> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. +> The administrator of the discovery service must create a host with the address `enterpriseenrollment..com`. -The device's automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain "enterpriseenrollment" to the domain of the email address, and by appending the path "/EnrollmentServer/Discovery.svc". For example, if the email address is "sample@contoso.com", the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc +The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain **enterpriseenrollment** to the domain of the email address, and by appending the path `/EnrollmentServer/Discovery.svc`. For example, if the email address is `sample@contoso.com`, the resulting URI for first Get request would be: `http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc`. The first request is a standard HTTP GET request. The following example shows a request via HTTP GET to the discovery server given user@contoso.com as the email address. -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: unknown Header Byte Count: 153 Body Byte Count: 0 ``` -``` +```http GET /EnrollmentServer/Discovery.svc HTTP/1.1 User-Agent: Windows Phone 8 Enrollment Client Host: EnterpriseEnrollment.contoso.com Pragma: no-cache ``` -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: text/html Header Byte Count: 248 Body Byte Count: 0 ``` -``` +```http HTTP/1.1 200 OK Connection: Keep-Alive Pragma: no-cache @@ -71,18 +64,18 @@ Content-Type: text/html Content-Length: 0 ``` -After the device gets a response from the server, the device sends a POST request to enterpriseenrollment.*domain\_name*/EnrollmentServer/Discovery.svc. After it gets another response from the server (which should tell the device where the enrollment server is), the next message sent from the device is to enterpriseenrollment.*domain\_name* to the enrollment server. +After the device gets a response from the server, the device sends a POST request to `enterpriseenrollment./EnrollmentServer/Discovery.svc`. After it gets another response from the server (which should tell the device where the enrollment server is), the next message sent from the device is to `enterpriseenrollment.` enrollment server. The following logic is applied: 1. The device first tries HTTPS. If the server cert is not trusted by the device, the HTTPS fails. 1. If that fails, the device tries HTTP to see whether it is redirected: - - If the device is not redirected, it prompts the user for the server address. - - If the device is redirected, it prompts the user to allow the redirect. + - If the device is not redirected, it prompts the user for the server address. + - If the device is redirected, it prompts the user to allow the redirect. The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address: -``` +```http https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc ``` @@ -174,42 +167,42 @@ For the OnPremise authentication policy, the UsernameToken in GetPolicies contai The following example shows the policy web service request. ```xml - - - - http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies - - urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 - - http://www.w3.org/2005/08/addressing/anonymous - - - https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - - user@contoso.com - mypassword - - - - - - - - - - - - - + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies + + urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 + + http://www.w3.org/2005/08/addressing/anonymous + + + https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + + user@contoso.com + mypassword + + + + + + + + + + + + + ``` After the user is authenticated, the web service retrieves the certificate template that the user should enroll with and creates enrollment policies based on the certificate template properties. A sample of the response can be found on MSDN. @@ -304,7 +297,7 @@ This web service implements the MS-WSTEP protocol. It processes the RequestSecur The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on match the certificate template), the client can enroll successfully. -The RequestSecurityToken will use a custom TokenType (http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section. +The RequestSecurityToken will use a custom TokenType (`http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken`), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section. The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. @@ -314,11 +307,11 @@ The RST may also specify a number of AdditionalContext items, such as DeviceType The following example shows the enrollment web service request for OnPremise authentication. ```xml - @@ -347,8 +340,8 @@ The following example shows the enrollment web service request for OnPremise aut http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue - DER format PKCS#10 certificate request in Base64 encoding Insterted Here @@ -386,7 +379,6 @@ The following example shows the enrollment web service request for OnPremise aut 7BA748C8-703E-4DF2-A74A-92984117346A - True @@ -399,8 +391,8 @@ The following example shows the enrollment web service request for OnPremise aut The following example shows the enrollment web service response. ```xml - @@ -416,14 +408,15 @@ The following example shows the enrollment web service response. - http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken - - + + B64EncodedSampleBinarySecurityToken - + 0 @@ -443,7 +436,7 @@ The following example shows the enrollment web service response. The following example shows the encoded provisioning XML. -``` +```xml @@ -455,17 +448,17 @@ The following example shows the encoded provisioning XML. - + - - + + - + @@ -516,7 +509,7 @@ The following example shows the encoded provisioning XML. - ``` diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index efc700f21d..e99451394d 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -1,14 +1,14 @@ --- title: Push notification support for device management description: The DMClient CSP supports the ability to configure push-initiated device management sessions. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 09/22/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 88b3b3f800..00104f6638 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -10,7 +10,7 @@ items: items: - name: What is MDM? href: mdm-overview.md - - name: What's new in MDM enrollment and management + - name: What's new in MDM href: new-in-windows-mdm-enrollment-management.md - name: Azure Active Directory integration with MDM href: azure-active-directory-integration-with-mdm.md @@ -25,22 +25,20 @@ items: items: - name: Enrollment overview href: mobile-device-enrollment.md - - name: Enrollment methods - items: - - name: Manual enrollment - href: mdm-enrollment-of-windows-devices.md - - name: Automatic enrollment - href: azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md - - name: Group Policy enrollment - href: enroll-a-windows-10-device-automatically-using-group-policy.md - - name: Bulk enrollment - href: bulk-enrollment-using-windows-provisioning-tool.md - - name: Federated authentication enrollment - href: federated-authentication-device-enrollment.md - - name: Certificate authentication enrollment - href: certificate-authentication-device-enrollment.md - - name: On-premises authentication enrollment - href: on-premise-authentication-device-enrollment.md + - name: Manual enrollment + href: mdm-enrollment-of-windows-devices.md + - name: Automatic enrollment + href: azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md + - name: Group policy enrollment + href: enroll-a-windows-10-device-automatically-using-group-policy.md + - name: Bulk enrollment + href: bulk-enrollment-using-windows-provisioning-tool.md + - name: Federated authentication enrollment + href: federated-authentication-device-enrollment.md + - name: Certificate authentication enrollment + href: certificate-authentication-device-enrollment.md + - name: On-premises authentication enrollment + href: on-premise-authentication-device-enrollment.md - name: Manage devices expanded: true items: From 598dd48973d827e614d07a9b642471644a8bc23e Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 17:44:41 -0400 Subject: [PATCH 044/139] Some Mo changes --- .../device-update-management.md | 776 +-------------- .../enterprise-app-management.md | 925 ++++++++---------- .../mdm-enrollment-of-windows-devices.md | 2 +- windows/client-management/toc.yml | 24 +- .../windows-mdm-enterprise-settings.md | 20 +- 5 files changed, 453 insertions(+), 1294 deletions(-) diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index 40e3b7efcc..d8ebfa7dbd 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -1,14 +1,14 @@ --- title: Mobile device management MDM for device updates -description: Windows 10 provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. -ms.reviewer: +description: Windows provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 11/15/2017 +ms.date: 04/05/2023 ms.collection: - highpri - tier2 @@ -22,26 +22,22 @@ appliesto: >[!TIP] >If you're not a developer or administrator, you'll find more helpful information in the [Windows Update: Frequently Asked Questions](https://support.microsoft.com/help/12373/windows-update-faq). -With PCs, tablets, phones, and IoT devices, Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. In Windows 10, we're investing heavily in extending the management capabilities available to MDMs. One key feature we're adding is the ability for MDMs to keep devices up to date with the latest Microsoft updates. +With PCs, tablets, phones, and IoT devices, Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. In Windows, we're investing heavily in extending the management capabilities available to MDMs. One key feature we're adding is the ability for MDMs to keep devices up to date with the latest Microsoft updates. -In particular, Windows 10 provides APIs to enable MDMs to: +In particular, Windows provides APIs to enable MDMs to: - Ensure machines stay up to date by configuring Automatic Update policies. - Test updates on a smaller set of machines by configuring which updates are approved for a given device. Then, do an enterprise-wide rollout. - Get compliance status of managed devices. IT can understand which machines still need a security patch, or how current is a particular machine. - -This article provides independent software vendors (ISV) with the information they need to implement update management in Windows 10. - -In Windows 10, the MDM protocol has been extended to better enable IT admins to manage updates. In particular, Windows has added configuration service providers (CSPs) that expose policies and actions for MDMs to: - - Configure automatic update policies to ensure devices stay up to date. - Get device compliance information (the list of updates that are needed but not yet installed). - Enter a per-device update approval list. The list makes sure devices only install updates that are approved and tested. - Approve end-user license agreements (EULAs) for the end user so update deployment can be automated even for updates with EULAs. -The OMA DM APIs for specifying update approvals and getting compliance status refer to updates by using an Update ID. The Update ID is a GUID that identifies a particular update. The MDM will want to show IT-friendly information about the update, instead of a raw GUID, including the update's title, description, KB, update type, like a security update or service pack. For more information, see [\[MS-WSUSSS\]: Windows Update Services: Server-Server Protocol](/openspecs/windows_protocols/ms-wsusss/f49f0c3e-a426-4b4b-b401-9aeb2892815c). +This article provides independent software vendors (ISV) with the information they need to implement update management in Windows. For more information, see [Policy CSP - Update](mdm/policy-csp-update.md). -For more information about the CSPs, see [Update CSP](mdm/update-csp.md) and the update policy area of the [Policy CSP](mdm/policy-configuration-service-provider.md). +> [!NOTE] +> The OMA DM APIs for specifying update approvals and getting compliance status refer to updates by using an Update ID. The Update ID is a GUID that identifies a particular update. The MDM will want to show IT-friendly information about the update, instead of a raw GUID, including the update's title, description, KB, update type, like a security update or service pack. For more information, see [[MS-WSUSSS]: Windows Update Services: Server-Server Protocol](/openspecs/windows_protocols/ms-wsusss/f49f0c3e-a426-4b4b-b401-9aeb2892815c). The following diagram provides a conceptual overview of how this works: @@ -53,7 +49,7 @@ The diagram can be roughly divided into three areas: - The Device Management service sets automatic update policies, obtains update compliance information, and sets approvals via OMA DM (left portion of the diagram). - The device gets updates from Microsoft Update using client/server protocol. It only downloads and installs updates that apply to the device and are approved by IT (right portion of the diagram). -## Getting update metadata using the Server-Server sync protocol +## Getting update metadata using the Server-Server sync protocol The Microsoft Update Catalog contains many updates that aren't needed by MDM-managed devices. It includes updates for legacy software, like updates to servers, down-level desktop operating systems, & legacy apps, and a large number of drivers. We recommend MDMs use the Server-Server sync protocol to get update metadata for updates reported from the client. @@ -75,7 +71,7 @@ Some important highlights: > [!NOTE] > On Microsoft Update, metadata for a given update gets modified over time (updating descriptive information, fixing bugs in applicability rules, localization changes, and so on). Each time such a change is made that doesn't affect the update itself, a new update revision is created. The identity of an update revision is a compound key containing both an UpdateID (GUID) and a RevisionNumber (int). The MDM should not expose the notion of an update revision to IT. Instead, for each UpdateID (GUID) the MDM should just keep the metadata for the later revision of that update (the one with the highest revision number). -## Examples of update metadata XML structure and element descriptions +### Examples of update metadata XML structure and element descriptions The response of the GetUpdateData call returns an array of ServerSyncUpdateData that contains the update metadata in the XmlUpdateBlob element. The schema of the update xml is available at [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). Some of the key elements are described below: @@ -83,19 +79,19 @@ The response of the GetUpdateData call returns an array of ServerSyncUpdateData - **RevisionNumber** - Revision number for the update in case the update was modified. - **CreationDate** - the date on which this update was created. - **UpdateType** - The type of update, which could include the following: - - **Detectoid** - if this update identity represents a compatibility logic - - **Category** - This element could represent either of the following: - - A Product category the update belongs to. For example, Windows, MS office, and so on. - - The classification the update belongs to. For example, drivers, security, and so on. - - **Software** - If the update is a software update. - - **Driver** - if the update is a driver update. + - **Detectoid** - if this update identity represents a compatibility logic + - **Category** - This element could represent either of the following: + - A Product category the update belongs to. For example, Windows, MS office, and so on. + - The classification the update belongs to. For example, drivers, security, and so on. + - **Software** - If the update is a software update. + - **Driver** - if the update is a driver update. - **LocalizedProperties** - represents the language the update is available in, title and description of the update. It has the following fields: - - **Language** - The language code identifier (LCID). For example, en or es. - - **Title** - Title of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 x64 Edition (KB2526305)" - - **Description** - Description of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 (KB2526305) provides the latest updates to Windows SharePoint Services 3.0. After you install this item, you may have to restart your computer. After you've installed this item, it can't be removed." + - **Language** - The language code identifier (LCID). For example, en or es. + - **Title** - Title of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 x64 Edition (KB2526305)" + - **Description** - Description of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 (KB2526305) provides the latest updates to Windows SharePoint Services 3.0. After you install this item, you may have to restart your computer. After you've installed this item, it can't be removed." - **KBArticleID** - The KB article number for this update that has details about the particular update. For example, `https://support.microsoft.com/kb/2902892`. -## Recommended Flow for Using the Server-Server Sync Protocol +### Recommended Flow for Using the Server-Server Sync Protocol This section describes a possible algorithm for using the server-server sync protocol to pull in update metadata to the MDM. @@ -107,18 +103,17 @@ First some background: The following procedure describes a basic algorithm for a metadata sync service: -- Initialization uses the following steps: - a. Create an empty list of "needed update IDs to fault in". This list will get updated by the MDM service component that uses OMA DM. We recommend not adding definition updates to this list, since they're temporary. For example, Defender can release new definition updates many times per day, each of which is cumulative. -- Sync periodically (we recommend once every 2 hours - no more than once/hour). - 1. Implement the authorization phase of the protocol to get a cookie if you don't already have a non-expired cookie. See **Sample 1: Authorization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). - 2. Implement the metadata portion of the protocol (see **Sample 2: Metadata and Deployments Synchronization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a)), and: - - Call GetUpdateData for all updates in the "needed update IDs to fault in" list if the update metadata hasn't already been pulled into the DB. - - If the update is a newer revision of an existing update (same UpdateID, higher revision number), replace the previous update metadata with the new one. - - Remove updates from the "needed update IDs to fault in" list once they've been brought in. +1. Create an empty list of "needed update IDs to fault in". This list will get updated by the MDM service component that uses OMA DM. We recommend not adding definition updates to this list, since they're temporary. For example, Defender can release new definition updates many times per day, each of which is cumulative. +1. Sync periodically (we recommend once every 2 hours - no more than once/hour). + 1. Implement the authorization phase of the protocol to get a cookie if you don't already have a non-expired cookie. See **Sample 1: Authorization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). + 1. Implement the metadata portion of the protocol (see **Sample 2: Metadata and Deployments Synchronization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a)), and: + - Call GetUpdateData for all updates in the "needed update IDs to fault in" list if the update metadata hasn't already been pulled into the DB. + - If the update is a newer revision of an existing update (same UpdateID, higher revision number), replace the previous update metadata with the new one. + - Remove updates from the "needed update IDs to fault in" list once they've been brought in. These steps get information about the set of Microsoft Updates that IT needs to manage, so the information can be used in various update management scenarios. For example, at update approval time, you can get information so IT can see what updates they're approving. Or, for compliance reports to see what updates are needed but not yet installed. -## Managing updates using OMA DM +## Managing updates using OMA DM An MDM can manage updates via OMA DM. The details of how to use and integrate an MDM with the Windows OMA DM protocol, and how to enroll devices for MDM management, is documented in [Mobile device management](mobile-device-enrollment.md). This section focuses on how to extend that integration to support update management. The key aspects of update management include the following information: @@ -133,713 +128,9 @@ The following list describes a suggested model for applying updates. 1. In the Test group, just let all updates flow. 1. In the All Group, set up Quality Update deferral for seven days. Then, Quality Updates will be auto approved after the seven days. Definition Updates are excluded from Quality Update deferrals, and will be auto approved when they're available. This schedule can be done by setting Update/DeferQualityUpdatesPeriodInDays to seven, and just letting updates flow after seven days or pushing Pause if any issues. -Updates are configured using a combination of the [Update CSP](mdm/update-csp.md), and the update portion of the [Policy CSP](mdm/policy-configuration-service-provider.md). +Updates are configured using the [Update Policy CSP](mdm/policy-csp-update.md). -### Update policies - -The enterprise IT can configure auto-update policies via OMA DM using the [Policy CSP](mdm/policy-configuration-service-provider.md) (this functionality isn't supported in Windows 10 Home). Here's the CSP diagram for the Update node in Policy CSP. - -The following information shows the Update policies in a tree format. - -```console -./Vendor/MSFT -Policy -----Config ---------Update ------------ActiveHoursEnd ------------ActiveHoursMaxRange ------------ActiveHoursStart ------------AllowAutoUpdate ------------AllowMUUpdateService ------------AllowNonMicrosoftSignedUpdate ------------AllowUpdateService ------------AutoRestartNotificationSchedule ------------AutoRestartRequiredNotificationDismissal ------------BranchReadinessLevel ------------DeferFeatureUpdatesPeriodInDays ------------DeferQualityUpdatesPeriodInDays ------------DeferUpdatePeriod ------------DeferUpgradePeriod ------------EngagedRestartDeadline ------------EngagedRestartSnoozeSchedule ------------EngagedRestartTransitionSchedule ------------ExcludeWUDriversInQualityUpdate ------------IgnoreMOAppDownloadLimit ------------IgnoreMOUpdateDownloadLimit ------------PauseDeferrals ------------PauseFeatureUpdates ------------PauseQualityUpdates ------------RequireDeferUpgrade ------------RequireUpdateApproval ------------ScheduleImminentRestartWarning ------------ScheduledInstallDay ------------ScheduledInstallTime ------------ScheduleRestartWarning ------------SetAutoRestartNotificationDisable ------------UpdateServiceUrl ------------UpdateServiceUrlAlternate -``` - -**Update/ActiveHoursEnd** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. When used with **Update/ActiveHoursStart**, it allows the IT admin to manage a range of active hours where update reboots aren't scheduled. This value sets the end time. There's a 12-hour maximum from start time. - -> [!NOTE] -> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** in this article. - -Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, and so on. - -The default is 17 (5 PM). - -**Update/ActiveHoursMaxRange** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. - -Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time. - -Supported values are 8-18. - -The default value is 18 (hours). - -**Update/ActiveHoursStart** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. - -Added in Windows 10, version 1607. When used with **Update/ActiveHoursEnd**, it allows the IT admin to manage a range of hours where update reboots aren't scheduled. This value sets the start time. There's a 12-hour maximum from end time. - -> [!NOTE] -> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** in this article. - -Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, and so on. - -The default value is 8 (8 AM). - -**Update/AllowAutoUpdate** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. - -Enables the IT admin to manage automatic update behavior to scan, download, and install updates. - -Supported operations are Get and Replace. - -The following list shows the supported values: - -- 0 - Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end users to manage data usage. With this option, users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. -- 1 - Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart time. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that don't shutdown properly on restart. -- 2 (default) - Auto install and restart. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device isn't actively being used. This behavior is the default behavior for unmanaged devices. Devices are updated quickly. But, it increases the risk of accidental data loss caused by an application that doesn't shutdown properly on restart. -- 3 - Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. -- 4 - Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks. They're installed during "Automatic Maintenance" when the device isn't in use, and isn't running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device isn't actively being used. This setting option also sets the end-user control panel to read-only. -- 5 - Turn off automatic updates. - -> [!IMPORTANT] -> This option should be used only for systems under regulatory compliance, as you will not get security updates as well. - -If the policy isn't configured, end users get the default behavior (Auto install and restart). - -**Update/AllowMUUpdateService** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update. - -The following list shows the supported values: - -- 0 - Not allowed or not configured. -- 1 - Allowed. Accepts updates received through Microsoft Update. - -**Update/AllowNonMicrosoftSignedUpdate** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise and Windows 10 Education. - -Allows the IT admin to manage if Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third-party software and patch distribution. - -Supported operations are Get and Replace. - -The following list shows the supported values: - -- 0 - Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. -- 1 - Allowed. Accepts updates received through an intranet Microsoft update service location, if they're signed by a certificate in the "Trusted Publishers" certificate store of the local computer. - -This policy is specific to desktop and local publishing using WSUS for third-party updates (binaries and updates not hosted on Microsoft Update). It allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. - -**Update/AllowUpdateService** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft. - -Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update. - -Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft to stop working. - -The following list shows the supported values: - -- 0 - Update service isn't allowed. -- 1 (default) - Update service is allowed. - -> [!NOTE] -> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. - -**Update/AutoRestartNotificationSchedule** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications. - -Supported values are 15, 30, 60, 120, and 240 (minutes). - -The default value is 15 (minutes). - -**Update/AutoRestartRequiredNotificationDismissal** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto restart required notification is dismissed. - -The following list shows the supported values: - -- 1 (default) - Auto Dismissal. -- 2 - User Dismissal. - -**Update/BranchReadinessLevel** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. - -The following list shows the supported values: - -- 16 (default) - User gets all applicable upgrades from Current Branch (CB). -- 32 - User gets upgrades from Current Branch for Business (CBB). - -**Update/DeferFeatureUpdatesPeriodInDays** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. - -Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days. - -Supported values are 0-180. - -**Update/DeferQualityUpdatesPeriodInDays** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days. - -Supported values are 0-30. - -**Update/DeferUpdatePeriod** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -> -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. - -Allows IT Admins to specify update delays for up to four weeks. - -Supported values are 0-4, which refers to the number of weeks to defer updates. - -If the **Specify intranet Microsoft update service location** policy is enabled, then the **Defer upgrades by**, **Defer updates by**; and **Pause Updates and Upgrades** settings have no effect. - -If the **Allow Telemetry** policy is enabled and the Options value is set to 0, then the **Defer upgrades by**, **Defer updates by** and **Pause Updates and Upgrades** settings have no effect. - -- **Update category**: OS upgrade - - **Maximum deferral**: 8 months - - **Deferral increment**: 1 month - - **Update type/notes**: Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 - -- **Update category**: Update - - **Maximum deferral**: 1 month - - **Deferral increment**: 1 week - - **Update type/notes**: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic. - - - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 - - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 - - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F - - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 - - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB - - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F - - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 - - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 - -- **Update category**: Other/cannot defer - - **Maximum deferral**: No deferral - - **Deferral increment**: No deferral - - **Update type/notes**: Any update category not enumerated above falls into this category. - - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B - -**Update/DeferUpgradePeriod** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -> -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. - -Allows IT Admins to enter more upgrade delays for up to eight months. - -Supported values are 0-8, which refers to the number of months to defer upgrades. - -If the **Specify intranet Microsoft update service location** policy is enabled, then the **Defer upgrades by**, **Defer updates by** and **Pause Updates and Upgrades** settings have no effect. - -If the **Allow Telemetry** policy is enabled and the Options value is set to 0, then the **Defer upgrades by**, **Defer updates by** and **Pause Updates and Upgrades** settings have no effect. - -**Update/EngagedRestartDeadline** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, then the restart won't be automatically executed. It will remain Engaged restart (pending user scheduling). - -Supported values are 2-30 days. - -The default value is 0 days (not specified). - -**Update/EngagedRestartSnoozeSchedule** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications. - -Supported values are 1-3 days. - -The default value is three days. - -**Update/EngagedRestartTransitionSchedule** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. - -Supported values are 2-30 days. - -The default value is seven days. - -**Update/ExcludeWUDriversInQualityUpdate** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. - -Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates. - -The following list shows the supported values: - -- 0 (default) - Allow Windows Update drivers. -- 1 - Exclude Windows Update drivers. - -**Update/IgnoreMOAppDownloadLimit** -Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. - -> [!WARNING] -> Setting this policy might cause devices to incur costs from MO operators. - -The following list shows the supported values: - -- 0 (default) - Don't ignore MO download limit for apps and their updates. -- 1 - Ignore MO download limit (allow unlimited downloading) for apps and their updates. - -To validate this policy: - -1. Enable the policy ensure the device is on a cellular network. -1. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: - - `regd delete HKEY_USERS\S-1-5-21-2702878673-795188819-444038987-2781\software\microsoft\windows\currentversion\windowsupdate /v LastAutoAppUpdateSearchSuccessTime /f` - - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\Automatic App Update"""" /I""` - -1. Verify that any downloads that are above the download size limit will complete without being paused. - -**Update/IgnoreMOUpdateDownloadLimit** -Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. - -> [!WARNING] -> Setting this policy might cause devices to incur costs from MO operators. - -The following list shows the supported values: - -- 0 (default) - Don't ignore MO download limit for OS updates. -- 1 - Ignore MO download limit (allow unlimited downloading) for OS updates. - -To validate this policy: - -1. Enable the policy and ensure the device is on a cellular network. -1. Run the scheduled task on the devices to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell: - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""` - -1. Verify that any downloads that are above the download size limit will complete without being paused. - -**Update/PauseDeferrals** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -> -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. - -Allows IT Admins to pause updates and upgrades for up to five weeks. Paused deferrals will be reset after five weeks. - -The following list shows the supported values: - -- 0 (default) - Deferrals aren't paused. -- 1 - Deferrals are paused. - -If the **Specify intranet Microsoft update service location** policy is enabled, then the **Defer upgrades by**, **Defer updates by** and **Pause Updates and Upgrades** settings have no effect. - -If the **Allow Telemetry** policy is enabled and the Options value is set to 0, then the **Defer upgrades by**, **Defer updates by** and **Pause Updates and Upgrades** settings have no effect. - -**Update/PauseFeatureUpdates** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. - -Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. - -The following list shows the supported values: - -- 0 (default) - Feature Updates aren't paused. -- 1 - Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner. - -**Update/PauseQualityUpdates** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. - -The following list shows the supported values: - -- 0 (default) - Quality Updates aren't paused. -- 1 - Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. - -**Update/RequireDeferUpgrade** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -> -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. - -Allows the IT admin to set a device to CBB train. - -The following list shows the supported values: - -- 0 (default) - User gets upgrades from Current Branch. -- 1 - User gets upgrades from Current Branch for Business. - -**Update/RequireUpdateApproval** - -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -
- -> [!NOTE] -> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. - -Allows the IT admin to restrict the updates that are installed on a device to only the updates on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update for the end user. EULAs are approved once an update is approved. - -Supported operations are Get and Replace. - -The following list shows the supported values: - -- 0 - Not configured. The device installs all applicable updates. -- 1 - The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required before deployment. - -**Update/ScheduleImminentRestartWarning** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications. - -Supported values are 15, 30, or 60 (minutes). - -The default value is 15 (minutes). - -**Update/ScheduledInstallDay** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Enables the IT admin to schedule the day of the update installation. - -The data type is a string. - -Supported operations are Add, Delete, Get, and Replace. - -The following list shows the supported values: - -- 0 (default) - Every day -- 1 - Sunday -- 2 - Monday -- 3 - Tuesday -- 4 - Wednesday -- 5 - Thursday -- 6 - Friday -- 7 - Saturday - -**Update/ScheduledInstallTime** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Enables the IT admin to schedule the time of the update installation. - -The data type is a string. - -Supported operations are Add, Delete, Get, and Replace. - -Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. - -The default value is 3. - -**Update/ScheduleRestartWarning** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto restart warning reminder notifications. - -Supported values are 2, 4, 8, 12, or 24 (hours). - -The default value is 4 (hours). - -**Update/SetAutoRestartNotificationDisable** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -Added in Windows 10, version 1703. Allows the IT Admin to disable auto restart notifications for update installations. - -The following list shows the supported values: - -- 0 (default) - Enabled -- 1 - Disabled - -**Update/UpdateServiceUrl** -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education - -> [!IMPORTANT] -> Starting in Windows 10, version 1703 this policy isn't supported in IoT Enterprise. - -Allows the device to check for updates from a WSUS server instead of Microsoft Update. Using WSUS is useful for on-premises MDMs that need to update devices that can't connect to the Internet. - -Supported operations are Get and Replace. - -The following list shows the supported values: - -- Not configured. The device checks for updates from Microsoft Update. -- Set to a URL, such as `http://abcd-srv:8530`. The device checks for updates from the WSUS server at the specified URL. - -Example - -```xml - - $CmdID$ - - - chr - text/plain - - - ./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl - - http://abcd-srv:8530 - - -``` - -**Update/UpdateServiceUrlAlternate** - -> [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. - -Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. - -This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. - -To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. - -Value type is string and the default value is an empty string. If the setting isn't configured, and if Automatic Updates isn't disabled by policy or user preference, then the Automatic Updates client connects directly to the Windows Update site on the Internet. - -> [!NOTE] -> If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect. -> If the "Alternate Download Server" Group Policy isn't set, it will use the WSUS server by default to download updates. -> This policy isn't supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. - -### Update management - -The enterprise IT can configure the set of approved updates and get compliance status via OMA DM using the [Update CSP](mdm/update-csp.md). The following information shows the Update CSP in tree format. - -```console -./Vendor/MSFT -Update -----ApprovedUpdates ---------Approved Update Guid -------------ApprovedTime -----FailedUpdates ---------Failed Update Guid -------------HResult -------------Status -------------RevisionNumber -----InstalledUpdates ---------Installed Update Guid -------------RevisionNumber -----InstallableUpdates ---------Installable Update Guid -------------Type -------------RevisionNumber -----PendingRebootUpdates ---------Pending Reboot Update Guid -------------InstalledTime -------------RevisionNumber -----LastSuccessfulScanTime -----DeferUpgrade -----Rollback ---------QualityUpdate ---------FeatureUpdate ---------QualityUpdateStatus ---------FeatureUpdateStatus -``` - -**Update** -The root node. - -Supported operation is Get. - -**ApprovedUpdates** -Node for update approvals and EULA acceptance for the end user. - -> [!NOTE] -> When the RequireUpdateApproval policy is set, the MDM uses the ApprovedUpdates list to pass the approved GUIDs. These GUIDs should be a subset of the InstallableUpdates list. - -The MDM must first present the EULA to IT and have them accept it before the update is approved. Failure to present the EULA is a breach of legal or contractual obligations. The EULAs can be obtained from the update metadata and have their own EULA ID. It's possible for multiple updates to share the same EULA. It's only necessary to approve the EULA once per EULA ID, not one per update. - -The update approval list enables IT to approve individual updates and update classifications. Auto-approval by update classifications allows IT to automatically approve Definition Updates (updates to the virus and spyware definitions on devices) and Security Updates (product-specific updates for security-related vulnerability). The update approval list doesn't support the uninstall of updates by revoking approval of already installed updates. Updates are approved based on UpdateID, and an UpdateID only needs to be approved once. An update UpdateID and RevisionNumber are part of the UpdateIdentity type. An UpdateID can be associated to several UpdateIdentity GUIDs because of changes to the RevisionNumber setting. MDM services must synchronize the UpdateIdentity of an UpdateID based on the latest RevisionNumber to get the latest metadata for an update. However, update approval is based on UpdateID. - -> [!NOTE] -> For the Windows 10 build, the client may need to reboot after additional updates are added. - -Supported operations are Get and Add. - -**ApprovedUpdates/***Approved Update Guid* -Specifies the update GUID. - -To auto-approve a class of updates, you can specify the [Update Classifications](/previous-versions/windows/desktop/ff357803(v=vs.85)) GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly. - -Supported operations are Get and Add. - -Sample syncml: - -``` -./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d -``` - -**ApprovedUpdates/*Approved Update Guid*/ApprovedTime** -Specifies the time the update gets approved. - -Supported operations are Get and Add. - -**FailedUpdates** -Specifies the approved updates that failed to install on a device. - -Supported operation is Get. - -**FailedUpdates/***Failed Update Guid* -Update identifier field of the UpdateIdentity GUID that represents an update that failed to download or install. - -Supported operation is Get. - -**FailedUpdates/*Failed Update Guid*/HResult** -The update failure error code. - -Supported operation is Get. - -**FailedUpdates/*Failed Update Guid*/Status** -Specifies the failed update status (for example, download, install). - -Supported operation is Get. - -**InstalledUpdates** -The updates that are installed on the device. - -Supported operation is Get. - -**InstalledUpdates/***Installed Update Guid* -UpdateIDs that represent the updates installed on a device. - -Supported operation is Get. - -**InstallableUpdates** -The updates that are applicable and not yet installed on the device. This information includes updates that aren't yet approved. - -Supported operation is Get. - -**InstallableUpdates/***Installable Update Guid* -Update identifiers that represent the updates applicable and not installed on a device. - -Supported operation is Get. - -**InstallableUpdates/*Installable Update Guid*/Type** -The UpdateClassification value of the update. Valid values are: - -- 0 - None -- 1 - Security -- 2 = Critical - -Supported operation is Get. - -**InstallableUpdates/*Installable Update Guid*/RevisionNumber** -The revision number for the update that must be passed in server to server sync to get the metadata for the update. - -Supported operation is Get. - -**PendingRebootUpdates** -The updates that require a reboot to complete the update session. - -Supported operation is Get. - -**PendingRebootUpdates/***Pending Reboot Update Guid* -Update identifiers for the pending reboot state. - -Supported operation is Get. - -**PendingRebootUpdates/*Pending Reboot Update Guid*/InstalledTime** -The time the update is installed. - -Supported operation is Get. - -**LastSuccessfulScanTime** -The last successful scan time. - -Supported operation is Get. - -**DeferUpgrade** -Upgrades deferred until the next period. - -Supported operation is Get. - -## Windows 10, version 1607 for update management - -Here are the new policies added in Windows 10, version 1607 in [Policy CSP](mdm/policy-configuration-service-provider.md). Use these policies for the Windows 10, version 1607 devices. - -- Update/ActiveHoursEnd -- Update/ActiveHoursStart -- Update/AllowMUUpdateService -- Update/BranchReadinessLevel -- Update/DeferFeatureUpdatePeriodInDays -- Update/DeferQualityUpdatePeriodInDays -- Update/ExcludeWUDriversInQualityUpdate -- Update/PauseFeatureUpdates -- Update/PauseQualityUpdates - -Here's the list of corresponding Group Policy settings in HKLM\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate. - -|GPO key|Type|Value| -|--- |--- |--- | -|BranchReadinessLevel|REG_DWORD|16: systems take Feature Updates on the Current Branch (CB) train

32: systems take Feature Updates on the Current Branch for Business

Other value or absent: receive all applicable updates (CB)| -|DeferQualityUpdates|REG_DWORD|1: defer quality updates

Other value or absent: don't defer quality updates| -|DeferQualityUpdatesPeriodInDays|REG_DWORD|0-30: days to defer quality updates| -|PauseQualityUpdates|REG_DWORD|1: pause quality updates

Other value or absent: don't pause quality updates| -|DeferFeatureUpdates|REG_DWORD|1: defer feature updates

Other value or absent: don't defer feature updates| -|DeferFeatureUpdatesPeriodInDays|REG_DWORD|0-180: days to defer feature updates| -|PauseFeatureUpdates|REG_DWORD|1: pause feature updates

Other value or absent: don't pause feature updates| -|ExcludeWUDriversInQualityUpdate|REG_DWORD|1: exclude Windows Update drivers

Other value or absent: offer Windows Update drivers| - -Here's the list of older policies that are still supported for backward compatibility. You can use these older policies for Windows 10, version 1511 devices. - -- Update/RequireDeferUpgrade -- Update/DeferUpgradePeriod -- Update/DeferUpdatePeriod -- Update/PauseDeferrals - -## Update management user experience screenshot +### Update management user experience screenshot The following screenshots of the administrator console show the list of update titles, approval status, and additional metadata fields. @@ -847,7 +138,7 @@ The following screenshots of the administrator console show the list of update t ![mdm update management metadata screenshot.](images/deviceupdatescreenshot2.png) -## SyncML example +### SyncML example Set auto update to notify and defer. @@ -911,3 +202,8 @@ The following diagram and screenshots show the process flow of the device update ![mdm device update management screenshot8](images/deviceupdatescreenshot8.png) ![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) + +## Related articles + +- [Policy CSP - Update](mdm/policy-csp-update.md) +- [Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index de9278fca0..bde58f70ff 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -1,14 +1,14 @@ --- title: Enterprise app management -description: This article covers one of the key mobile device management (MDM) features in Windows 10 for managing the lifecycle of apps across all of Windows. -ms.reviewer: +description: This article covers one of the key mobile device management (MDM) features for managing the lifecycle of apps across Windows devices. +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 10/04/2021 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -16,11 +16,13 @@ appliesto: # Enterprise app management -This article covers one of the key mobile device management (MDM) features in Windows 10. It manages the lifecycle of apps across all of Windows. It's the ability to manage both Store and non-Store apps as part of the native MDM capabilities. New in Windows 10 is the ability to take inventory of all your apps. +This article will discuss one of the key features of Windows' Mobile Device Management (MDM) capabilities: the ability to manage apps' lifecycle on all Windows devices. This includes both Store and non-Store apps, which can be managed natively through MDM. + +By using Windows MDM to manage app lifecycles, administrators can deploy and manage updates, remove outdated or unused apps, and ensure that all devices have the necessary apps installed to meet the organization's needs. This feature streamlines the app management process and saves time and effort for IT professionals. ## Application management goals -Windows 10 offers the ability for management servers to: +Windows offers the ability for management servers to: - Install apps directly from the Microsoft Store for Business - Deploy offline Store apps and licenses @@ -31,143 +33,19 @@ Windows 10 offers the ability for management servers to: - Provision apps so they're installed for all users of a device running Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) - Remove the provisioned app on the device running Windows 10 for desktop editions -## Inventory your apps +## Inventory apps -Windows 10 lets you inventory all apps deployed to a user, and inventory all apps for all users of a device on Windows 10 for desktop editions. The [EnterpriseModernAppManagement](mdm/enterprisemodernappmanagement-csp.md) configuration service provider (CSP) inventories packaged apps and doesn't include traditional Win32 apps installed via MSI or executables. When the apps are inventoried, they're separated based on the following app classifications: +Windows lets you inventory all apps deployed to a user, and inventory all apps for all users of a Windows device. The [EnterpriseModernAppManagement](mdm/enterprisemodernappmanagement-csp.md) configuration service provider (CSP) inventories packaged apps and doesn't include traditional Win32 apps installed via MSI or executables. When the apps are inventoried, they're separated based on the following app classifications: -- Store - Apps that are from the Microsoft Store. Apps can be directly installed from the Store or delivered with the enterprise from the Store for Business -- nonStore - Apps that weren't acquired from the Microsoft Store. -- System - Apps that are part of the OS. You can't uninstall these apps. This classification is read-only and can only be inventoried. +- **Store**: Apps that have been acquired from the Microsoft Store, either directly or delivered with the enterprise from the Store for Business. +- **nonStore**: Apps that were not acquired from the Microsoft Store. +- **System**: Apps that are part of the operating system and cannot be uninstalled. This classification is read-only and can only be inventoried. -These classifications are represented as nodes in the EnterpriseModernAppManagement CSP. +Each app is identified by one package family name and one or more package full names, and the apps are grouped based on their origin. The EnterpriseModernAppManagement CSP displays these classifications as nodes. -The following information shows the EnterpriseModernAppManagement CSP in a tree format: +Inventory can be run recursively at any level from the AppManagement node through the package full name. You can also choose to inventory specific attributes only. The inventory is specific to the package full name and lists bundled and resource packs as applicable under the package family name. -```console -./Device/Vendor/MSFT -or -./User/Vendor/MSFT -EnterpriseAppManagement -----AppManagement ---------UpdateScan ---------LastScanError ---------AppInventoryResults ---------AppInventoryQuery ---------RemovePackage ---------AppStore -----------PackageFamilyName -------------PackageFullName ---------------Name ---------------Version ---------------Publisher ---------------Architecture ---------------InstallLocation ---------------IsFramework ---------------IsBundle ---------------InstallDate ---------------ResourceID ---------------RequiresReinstall ---------------PackageStatus ---------------Users ---------------IsProvisioned ---------------IsStub -------------DoNotUpdate -------------AppSettingPolicy ---------------SettingValue -------------MaintainProcessorArchitectureOnUpdate -------------NonRemovable -----------ReleaseManagement -------------ReleaseManagementKey ---------------ChannelId ---------------ReleaseId ---------------EffectiveRelease ------------------ChannelId ------------------ReleaseId ---------nonStore -----------PackageFamilyName -------------PackageFullName ---------------Name ---------------Version ---------------Publisher ---------------Architecture ---------------InstallLocation ---------------IsFramework ---------------IsBundle ---------------InstallDate ---------------ResourceID ---------------RequiresReinstall ---------------PackageStatus ---------------Users ---------------IsProvisioned ---------------IsStub -------------DoNotUpdate -------------AppSettingPolicy ---------------SettingValue -------------MaintainProcessorArchitectureOnUpdate -------------NonRemoveable ---------System -----------PackageFamilyName -------------PackageFullName ---------------Name ---------------Version ---------------Publisher ---------------Architecture ---------------InstallLocation ---------------IsFramework ---------------IsBundle ---------------InstallDate ---------------ResourceID ---------------RequiresReinstall ---------------PackageStatus ---------------Users ---------------IsProvisioned ---------------IsStub -------------DoNotUpdate -------------AppSettingPolicy ---------------SettingValue -------------MaintainProcessorArchitectureOnUpdate -------------NonRemoveable -----AppInstallation ---------PackageFamilyName -----------StoreInstall -----------HostedInstall -----------LastError -----------LastErrorDesc -----------Status -----------ProgressStatus -----AppLicenses ---------StoreLicenses -----------LicenseID -------------LicenseCategory -------------LicenseUsage -------------RequesterID -------------AddLicense -------------GetLicenseFromStore -``` - -Each app displays one package family name and 1-n package full names for installed apps. The apps are categorized based on their origin (Store, nonStore, System). - -Inventory can run recursively at any level from the AppManagement node through the package full name. Inventory can also run only for a specific inventory attribute. - -Inventory is specific to the package full name and lists bundled packs and resources packs as applicable under the package family name. - -Here are the nodes for each package full name: - -- Name -- Version -- Publisher -- Architecture -- InstallLocation -- IsFramework -- IsBundle -- InstallDate -- ResourceID -- RequiresReinstall -- PackageStatus -- Users -- IsProvisioned - -For detailed descriptions of each node, see [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md). +For more information on each node, refer to the detailed descriptions provided in the [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md). ### App inventory @@ -175,126 +53,121 @@ You can use the EnterpriseModernAppManagement CSP to query for all apps installe Doing a full inventory of a device can be resource-intensive based on the hardware and number of apps that are installed. The data returned can also be large. You may want to chunk these requests to reduce the impact to clients and network traffic. -Here's an example of a query for all apps on the device. +- Example query for all apps on the device. -```xml - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement?list=StructData - - - -``` + ```xml + + + 1 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement?list=StructData + + + + ``` -Here's an example of a query for a specific app for a user. +- Example query for a specific app for a user. -```xml - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName}?list=StructData - - - -``` + ```xml + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName}?list=StructData + + + + ``` ### Store license inventory You can use the EnterpriseModernAppManagement CSP to query for all app licenses installed for a user or device. The query returns all app licenses, event if they were installed via MDM or other methods. Inventory can run at the user or device level. Inventory at the device level will return information for all users on the device. -Here are the nodes for each license ID: - -- LicenseCategory -- LicenseUsage -- RequestedID - For detailed descriptions of each node, see [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md). > [!NOTE] > The LicenseID in the CSP is the content ID for the license. -Here's an example of a query for all app licenses on a device. +- Here's an example of a query for all app licenses on a device. -```xml - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses?list=StructData - - - -``` + ```xml + + + 1 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses?list=StructData + + + + ``` -Here's an example of a query for all app licenses for a user. +- Here's an example of a query for all app licenses for a user. -```xml - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses/{license id}?list=StructData - - - -``` + ```xml + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses/{license id}?list=StructData + + + + ``` ## Enable the device to install non-Store apps -There are two basic types of apps you can deploy: Store apps and enterprise signed apps. To deploy enterprise signed apps, you must enable a setting on the device to allow trusted apps. The apps can be signed by a Microsoft approved root (such as Symantec), an enterprise deployed root, or apps that are self-signed. This section covers the steps to configure the device for non-store app deployment. +There are two basic types of apps you can deploy: + +- Store apps. +- Enterprise signed apps. + +To deploy enterprise signed apps, you must enable a setting on the device to allow trusted apps. The apps can be signed by a Microsoft approved root (such as Symantec), an enterprise deployed root, or apps that are self-signed. This section covers the steps to configure the device for non-store app deployment. ### Unlock the device for non-Store apps -To deploy apps that aren't from the Microsoft Store, you must configure the ApplicationManagement/AllowAllTrustedApps policy. This policy allows the installation of non-Store apps on the device if there's a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. For more information about deploying user license, see [Deploy an offline license to a user](#deploy-an-offline-license-to-a-user). +To deploy apps that aren't from the Microsoft Store, you must configure the [ApplicationManagement/AllowAllTrustedApps](mdm/policy-csp-applicationmanagement.md) policy. This policy allows the installation of non-Store apps on the device if there's a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. For more information about deploying user license, see [Deploy an offline license to a user](#deploy-an-offline-license-to-a-user). -The AllowAllTrustedApps policy enables the installation apps that are trusted by a certificate in the Trusted People on the device, or a root certificate in the Trusted Root of the device. The policy isn't configured by default, which means only apps from the Microsoft Store can be installed. If the management server implicitly sets the value to off, the setting is disabled in the settings panel on the device. +The AllowAllTrustedApps policy enables the installation of apps that are trusted by a certificate in the Trusted People on the device, or a root certificate in the Trusted Root of the device. The policy isn't configured by default, which means only apps from the Microsoft Store can be installed. If the management server implicitly sets the value to off, the setting is disabled in the settings panel on the device. -For more information about the AllowAllTrustedApps policy, see [Policy CSP](mdm/policy-configuration-service-provider.md). - -Here are some examples. +Here's an example: ```xml - 1 - - +1 + + ./Vendor/MSFT/Policy/Result/ApplicationManagement/AllowAllTrustedApps?list=StructData - - + + - 2 - - +2 + + ./Vendor/MSFT/Policy/Config/ApplicationManagement/AllowAllTrustedApps - - + + int text/plain - - 1 - + + 1 + ``` ### Unlock the device for developer mode -Development of apps on Windows 10 no longer requires a special license. You can enable debugging and deployment of non-packaged apps using ApplicationManagement/AllowDeveloperUnlock policy in Policy CSP. +Development of apps on Windows devices no longer requires a special license. You can enable debugging and deployment of non-packaged apps using [ApplicationManagement/AllowDeveloperUnlock](mdm/policy-csp-applicationmanagement.md) policy in Policy CSP. AllowDeveloperUnlock policy enables the development mode on the device. The AllowDeveloperUnlock isn't configured by default, which means only Microsoft Store apps can be installed. If the management server explicitly sets the value to off, the setting is disabled in the settings panel on the device. -Deployment of apps to Windows 10 for desktop editions requires that there's a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. - -For more information about the AllowDeveloperUnlock policy, see [Policy CSP](mdm/policy-configuration-service-provider.md). +Deployment of apps to Windows devices requires that there's a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. Here's an example. @@ -324,7 +197,7 @@ Here's an example. ``` -## Install your apps +## Install apps You can install apps to a specific user or to all users of a device. Apps are installed directly from the Microsoft Store. Or, they're installed from a host location, such as a local disk, UNC path, or HTTPS location. Use the AppInstallation node of the [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md) to install apps. @@ -341,39 +214,38 @@ Here are the requirements for this scenario: - Microsoft Store services must be enabled on the device. The UI for the Microsoft Store can be disabled by the enterprise admin. - The user must be signed in with their Azure AD identity. -Here are some examples. +Here's an example: ```xml - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/StoreInstall - - - xml - - - + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/StoreInstall + + + xml + + + + + ``` Here are the changes from the previous release: -1. The "{CatID}" reference should be updated to "{ProductID}". This value is acquired as a part of the Store for Business management tool. -1. The value for flags can be "0" or "1" - - When using "0", the management tool calls back to the Store for Business sync to assign a user a seat of an application. When using "1", the management tool doesn't call back in to the Store for Business sync to assign a user a seat of an application. The CSP will claim a seat if one is available. - +1. The `{CatID}` reference should be updated to `{ProductID}`. This value is acquired as a part of the Store for Business management tool. +1. The value for flags can be 0 or 1. + - When using "0", the management tool calls back to the Store for Business sync to assign a user a seat of an application. + - When using "1", the management tool doesn't call back in to the Store for Business sync to assign a user a seat of an application. The CSP will claim a seat if one is available. 1. The `skuid` is a new parameter that is required. This value is acquired as a part of the Store for Business to management tool sync. ### Deploy an offline license to a user -If you purchased an app from the Store for Business, the app license must be deployed to the device. +If you purchased an app from the Store for Business, the app license must be deployed to the device. The app license only needs to be deployed as part of the initial installation of the app. During an update, only the app is deployed to the user. -The app license only needs to be deployed as part of the initial installation of the app. During an update, only the app is deployed to the user. - -In the SyncML, you need to specify the following information in the Exec command: +In the SyncML, you need to specify the following information in the `Exec` command: - License ID - This ID is specified in the LocURI. The License ID for the offline license is referred to as the "Content ID" in the license file. You can retrieve this information from the Base64 encoded license download from the Store for Business. - License Content - This content is specified in the data section. The License Content is the Base64 encoded blob of the license. @@ -395,7 +267,6 @@ Here's an example of an offline license installation. ``` - ### Deploy apps to a user from a hosted location If you purchased an app from the Store for Business and the app is specified for an offline license or the app is a non-Store app, the app must be deployed from a hosted location. @@ -412,106 +283,106 @@ Here are the requirements for this scenario: The Add command for the package family name is required to ensure proper removal of the app at unenrollment. -Here's an example of a line-of-business app installation. +- Here's an example of a line-of-business app installation. -```xml - - - 0 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName} - - - - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall - - - xml - - - - -``` + ```xml + + + 0 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName} + + + + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall + + + xml + + + + + ``` -Here's an example of an app installation with dependencies. +- Here's an example of an app installation with dependencies. -```xml - - - 0 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName - - - - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall - - - xml - - - - - - - - - - - -``` + ```xml + + + 0 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName + + + + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall + + + xml + + + + + + + + + + + + ``` -Here's an example of an app installation with dependencies and optional packages. +- Here's an example of an app installation with dependencies and optional packages. -```xml - - - 0 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName - - - - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall - - - xml - - - - - - - - - - - - - - - -``` + ```xml + + + 0 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName + + + + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall + + + xml + + + + + + + + + + + + + + + + ``` ### Provision apps for all users of a device @@ -531,124 +402,116 @@ To provision app for all users of a device from a hosted location, the managemen > [!NOTE] > When you remove the provisioned app, it will not remove it from the users that already installed the app. -Here's an example of app installation. +- Here's an example of app installation: -> [!NOTE] -> This is only supported in Windows 10 for desktop editions. + ```xml + + + 0 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName + + + + + + 1 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall + + + xml + + + + + ``` -```xml - - - 0 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName - - - - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall - - - xml - - - - -``` + The HostedInstall Exec command contains a Data node that requires an embedded XML. Here are the requirements for the data XML: -The HostedInstall Exec command contains a Data node that requires an embedded XML. Here are the requirements for the data XML: + - Application node has a required parameter, PackageURI, which can be a local file location, UNC, or HTTPS location. + - Dependencies can be specified if required to be installed with the package. This is optional. -- Application node has a required parameter, PackageURI, which can be a local file location, UNC, or HTTPS location. -- Dependencies can be specified if required to be installed with the package. This is optional. + The DeploymentOptions parameter is only available in the user context. -The DeploymentOptions parameter is only available in the user context. +- Here's an example of app installation with dependencies. -Here's an example of app installation with dependencies. - -> [!NOTE] -> This is only supported in Windows 10 for desktop editions. - -```xml - - - 0 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName - - - - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall - - - xml - - - - - - - - - - - -``` + ```xml + + + 0 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName + + + + + + 1 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}/HostedInstall + + + xml + + + + + + + + + + + + ``` ### Get status of app installations When an app installation is completed, a Windows notification is sent. You can also query the status of using the AppInstallation node. Here's the list of information you can get back in the query: - Status - indicates the status of app installation. - - NOT\_INSTALLED (0) - The node was added, but the execution wasn't completed. - - INSTALLING (1) - Execution has started, but the deployment hasn't completed. If the deployment completes regardless of success, then this value is updated. - - FAILED (2) - Installation failed. The details of the error can be found under LastError and LastErrorDescription. - - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean up action hasn't completed, then this state may briefly appear. + - NOT\_INSTALLED (0) - The node was added, but the execution wasn't completed. + - INSTALLING (1) - Execution has started, but the deployment hasn't completed. If the deployment completes regardless of success, then this value is updated. + - FAILED (2) - Installation failed. The details of the error can be found under LastError and LastErrorDescription. + - INSTALLED (3) - Once an install is successful this node is cleaned up. If the clean up action hasn't completed, then this state may briefly appear. - LastError - The last error reported by the app deployment server. - LastErrorDescription - Describes the last error reported by the app deployment server. -- Status - An integer that indicates the progress of the app installation. In cases of an HTTPS location, this status shows the estimated download progress. +- Status - An integer that indicates the progress of the app installation. In cases of an HTTPS location, this status shows the estimated download progress. Status isn't available for provisioning and only used for user-based installations. For provisioning, the value is always 0. - Status isn't available for provisioning and only used for user-based installations. For provisioning, the value is always 0. +When an app is installed successfully, the node is cleaned up and no longer present. The status of the app can be reported under the [AppManagement node](mdm/enterprisemodernappmanagement-csp.md#deviceappmanagement). -When an app is installed successfully, the node is cleaned up and no longer present. The status of the app can be reported under the AppManagement node. +- Here's an example of a query for a specific app installation. -Here's an example of a query for a specific app installation. + ```xml + + + 2 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}?list=StructData + + + + ``` -```xml - - - 2 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation/{PackageFamilyName}?list=StructData - - - -``` +- Here's an example of a query for all app installations. -Here's an example of a query for all app installations. - -```xml - - - 2 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation?list=StructData - - - -``` + ```xml + + + 2 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppInstallation?list=StructData + + + + ``` ### Alert for installation completion @@ -673,12 +536,12 @@ Here's an example of an alert. ``` -For user-based installation, use the ./User path and for provisioning of apps, use the ./Device path. +For user-based installation, use the `./User` path and for provisioning of apps, use the `./Device` path. The Data field value of 0 (zero) indicates success. Otherwise it's an error code. If there's a failure, you can get more details from the AppInstallation node. > [!NOTE] -> At this time, the alert for Store app installation isn't yet available. +> At this time, the alert for Store app installation isn't available. ## Uninstall your apps @@ -690,33 +553,33 @@ You can uninstall apps from users from Windows 10 devices. To uninstall an app, To uninstall an app, you delete it under the origin node, package family name, and package full name. To uninstall a XAP, use the product ID in place of the package family name and package full name. -Here's an example for uninstalling all versions of an app for a user. + Here's an example for uninstalling all versions of an app for a user. -```xml - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName} - - - -``` + ```xml + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName} + + + + ``` -Here's an example for uninstalling a specific version of the app for a user. +-Here's an example for uninstalling a specific version of the app for a user. -```xml - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName}/{PackageFullName} - - - -``` + ```xml + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName}/{PackageFullName} + + + + ``` ### Removed provisioned apps from a device @@ -727,67 +590,67 @@ You can remove provisioned apps from a device for a specific version, or for all Removing provisioned app occurs in the device context. -Here's an example for removing a provisioned app from a device. +- Here's an example for removing a provisioned app from a device. -```xml - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName} - - - -``` + ```xml + + + 1 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName} + + + + ``` -Here's an example for removing a specific version of a provisioned app from a device: +- Here's an example for removing a specific version of a provisioned app from a device: -```xml - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName}/{PackageFullName} - - - -``` + ```xml + + + 1 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/{PackageFamilyName}/{PackageFullName} + + + + ``` ### Remove a store app license You can remove app licenses from a device per app based on the content ID. -Here's an example for removing an app license for a user. +- Here's an example for removing an app license for a user. -```xml - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses/{license id} - - - -``` + ```xml + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses/{license id} + + + + ``` -Here's an example for removing an app license for a provisioned package (device context). +- Here's an example for removing an app license for a provisioned package (device context). -```xml - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses/{license id} - - - -``` + ```xml + + + 1 + + + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppLicenses/StoreLicenses/{license id} + + + + ``` -### Alert for app uninstallation +### Alert for app uninstall Uninstallation of an app can take some time complete. So, the uninstall is run asynchronously. When the Exec command is completed, the client sends a notification to the management server with a status, whether it's a failure or success. @@ -819,33 +682,33 @@ Apps installed on a device can be updated using the management server. Apps can To update an app from Microsoft Store, the device requires contact with the store services. -Here's an example of an update scan. +- Here's an example of an update scan. -```xml - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/UpdateScan - - - -``` + ```xml + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/UpdateScan + + + + ``` -Here's an example of a status check. +- Here's an example of a status check. -```xml - - - 1 - - - ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/LastScanError - - - -``` + ```xml + + + 1 + + + ./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/LastScanError + + + + ``` ### Update apps from a hosted location @@ -890,9 +753,9 @@ The Universal Windows app can share application data between the users of the de > [!NOTE] > This is only applicable to multi-user devices. -The AllowSharedUserAppData policy in [Policy CSP](mdm/policy-configuration-service-provider.md) enables or disables app packages to share data between app packages when there are multiple users. If you enable this policy, applications can share data between packages in their package family. Data can be shared through ShareLocal folder for that package family and local machine. This folder is available through the Windows.Storage API. +The [ApplicationManagement/AllowSharedUserAppData](mdm/policy-csp-applicationmanagement.md) policy enables or disables app packages to share data between app packages when there are multiple users. If you enable this policy, applications can share data between packages in their package family. Data can be shared through ShareLocal folder for that package family and local machine. This folder is available through the Windows.Storage API. -If you disable this policy, applications can't share user application data among multiple users. However, pre-written shared data will persist. The clean pre-written shared data, use DISM ((/Get-ProvisionedAppxPackage to detect if there's any shared data, and /Remove-SharedAppxData to remove it). +If you disable this policy, applications can't share user application data among multiple users. However, pre-written shared data will persist. The clean pre-written shared data, use DISM ((`/Get-ProvisionedAppxPackage` to detect if there's any shared data, and `/Remove-SharedAppxData` to remove it). The valid values are 0 (off, default value) and 1 (on). diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index e11560c9bf..ea1befa0ad 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -223,7 +223,7 @@ All Windows 10-based devices can be connected to MDM. You can connect to an MDM ![access work or school.](images/unifiedenrollment-rs1-30.png) -1. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). +1. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-device-to-work-using-a-deep-link). ![connect to work or school screen](images/unifiedenrollment-rs1-31.png) diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 00104f6638..c33a1ad8a2 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -8,18 +8,18 @@ items: - name: MDM overview expanded: true items: - - name: What is MDM? - href: mdm-overview.md - - name: What's new in MDM - href: new-in-windows-mdm-enrollment-management.md - - name: Azure Active Directory integration with MDM - href: azure-active-directory-integration-with-mdm.md - - name: Transitioning to modern management - href: manage-windows-10-in-your-organization-modern-management.md - - name: Push notification support for device management - href: push-notification-windows-mdm.md - - name: MAM support for device management - href: implement-server-side-mobile-application-management.md + - name: What is MDM? + href: mdm-overview.md + - name: What's new in MDM + href: new-in-windows-mdm-enrollment-management.md + - name: Azure Active Directory integration with MDM + href: azure-active-directory-integration-with-mdm.md + - name: Transitioning to modern management + href: manage-windows-10-in-your-organization-modern-management.md + - name: Push notification support for device management + href: push-notification-windows-mdm.md + - name: MAM support for device management + href: implement-server-side-mobile-application-management.md - name: Enroll devices expanded: true items: diff --git a/windows/client-management/windows-mdm-enterprise-settings.md b/windows/client-management/windows-mdm-enterprise-settings.md index 7c99b0cc81..82d1bf3135 100644 --- a/windows/client-management/windows-mdm-enterprise-settings.md +++ b/windows/client-management/windows-mdm-enterprise-settings.md @@ -1,26 +1,26 @@ --- -title: Enterprise settings, policies, and app management +title: Enterprise settings and policy management description: The DM client manages the interaction between a device and a server. Learn more about the client-server management workflow. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 06/26/2017 +ms.date: 04/05/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 --- -# Enterprise settings, policies, and app management +# Enterprise settings and policy management The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://technical.openmobilealliance.org/). -Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](mdm/index.yml). +Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](mdm/index.yml). -The DM client is configured during the enrollment process to be invoked by the task scheduler to periodically poll the MDM server. +Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. The DM client is configured during the enrollment process to be invoked by the task scheduler to periodically poll the MDM server. The following diagram shows the work flow between server and client. @@ -36,7 +36,7 @@ The DM client configuration, company policy enforcement, business application ma Here's a summary of the DM tasks supported for enterprise management: -- Company policy management: Company policies are supported via the Policy CSP allows the enterprise to manage various settings. It enables the management service to configure device lock related policies, disable/enable the storage card, and query the device encryption status. The RemoteWipe CSP allows IT pros to remotely fully wipe the internal user data storage. -- Enterprise application management: This task is addressed via the Enterprise ModernApp Management CSP and several ApplicationManagement-related policies. It's used to install the enterprise token, query installed business application names and versions, etc. This CSP is only accessible by the enterprise service. -- Certificate management: CertificateStore CSP, RootCACertificate CSP, and ClientCertificateInstall CSP are used to install certificates. -- Basic device inventory and asset management: Some basic device information can be retrieved via the DevInfo CSP, DevDetail CSPs and the DeviceStatus CSP. These provide basic device information such as OEM name, device model, hardware version, OS version, processor types, etc. This information is for asset management and device targeting. The NodeCache CSP enables the device to only send out delta inventory settings to the server to reduce over-the-air data usage. The NodeCache CSP is only accessible by the enterprise service. +- **Company policy management**: Company policies are supported via the Policy CSP allows the enterprise to manage various settings. It enables the management service to configure device lock related policies, disable/enable the storage card, and query the device encryption status. The RemoteWipe CSP allows IT pros to remotely fully wipe the internal user data storage. +- **Enterprise application management**: This task is addressed via the Enterprise ModernApp Management CSP and several ApplicationManagement-related policies. It's used to install the enterprise token, query installed business application names and versions, etc. This CSP is only accessible by the enterprise service. +- **Certificate management**: CertificateStore CSP, RootCACertificate CSP, and ClientCertificateInstall CSP are used to install certificates. +- **Basic device inventory and asset management**: Some basic device information can be retrieved via the DevInfo CSP, DevDetail CSPs and the DeviceStatus CSP. These provide basic device information such as OEM name, device model, hardware version, OS version, processor types, etc. This information is for asset management and device targeting. The NodeCache CSP enables the device to only send out delta inventory settings to the server to reduce over-the-air data usage. The NodeCache CSP is only accessible by the enterprise service. From db3da46a2f4972bea605092da4618b59fdf0c2db Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 17:48:59 -0400 Subject: [PATCH 045/139] Mo redirects --- .openpublishing.redirection.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 3cb6a801a3..0bb5a99366 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6690,6 +6690,16 @@ "redirect_url": "/windows/client-management/client-tools/windows-version-search", "redirect_document_id": false }, + { + "source_path": "windows/client-management/add-an-azure-ad-tenant-and-azure-ad-subscription.md", + "redirect_url": "/azure/active-directory/fundamentals/active-directory-access-create-new-tenant", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management//register-your-free-azure-active-directory-subscription.md", + "redirect_url": "/microsoft-365/compliance/use-your-free-azure-ad-subscription-in-office-365", + "redirect_document_id": false + }, { "source_path": "windows/client-management/mdm/policy-admx-backed.md", "redirect_url": "/windows/client-management/mdm/policy-configuration-service-provider", From bf2fe9442ae3c60cc7df937722ee368c16d26298 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 5 Apr 2023 18:19:07 -0400 Subject: [PATCH 046/139] Fix links --- .../device-update-management.md | 2 +- .../mdm/policy-csp-update.md | 29 ++++++++++++++++--- 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index d8ebfa7dbd..06053d6ba5 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -206,4 +206,4 @@ The following diagram and screenshots show the process flow of the device update ## Related articles - [Policy CSP - Update](mdm/policy-csp-update.md) -- [Policy configuration service provider](policy-configuration-service-provider.md) +- [Policy configuration service provider](mdm/policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 28b396eb2f..ed0e7cb9cf 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -4062,7 +4062,7 @@ If you disable or do not configure this policy, the default method will be used. > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](#changes-in-windows-10-version-1607). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. Allows IT Admins to specify update delays for up to four weeks. Supported values are 0-4, which refers to the number of weeks to defer updates. @@ -4154,7 +4154,7 @@ Allows IT Admins to specify additional upgrade delays for up to 8 months. Suppor - If the **Allow Telemetry** policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](#changes-in-windows-10-version-1607). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. @@ -4813,7 +4813,7 @@ To validate this policy: > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. If the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](#changes-in-windows-10-version-1607). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. If the Specify intranet Microsoft update service location policy is enabled, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. If the Allow Telemetry policy is enabled and the Options value is set to 0, then the Defer upgrades by, Defer updates by and Pause Updates and Upgrades settings have no effect. @@ -4915,7 +4915,7 @@ This policy is deprecated. Use Update/RequireUpdateApproval instead. > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](../device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to Semi-Annual Channel train. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](#changes-in-windows-10-version-1607). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to Semi-Annual Channel train. @@ -5218,6 +5218,27 @@ If you disable or do not configure this policy, the default notification behavio +## Changes in Windows 10, version 1607 + +Here are the new policies added in Windows 10, version 1607. Use these policies for Windows 10, version 1607 devices instead of the older policies + +- ActiveHoursEnd +- ActiveHoursStart +- AllowMUUpdateService +- BranchReadinessLevel +- DeferFeatureUpdatePeriodInDays +- DeferQualityUpdatePeriodInDays +- ExcludeWUDriversInQualityUpdate +- PauseFeatureUpdates +- PauseQualityUpdates + +Here's the list of older policies that are still supported for backward compatibility. You can use these older policies for Windows 10, version 1511 devices. + +- RequireDeferUpgrade +- DeferUpgradePeriod +- DeferUpdatePeriod +- PauseDeferrals + From 0fb307cb96757d5259fee7634648fb418a4adcd4 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 6 Apr 2023 11:10:50 -0400 Subject: [PATCH 047/139] More stuff --- ...ollment-using-windows-provisioning-tool.md | 10 +- .../diagnose-mdm-enrollment.md | 122 ++++++++++++++++++ .../diagnose-mdm-failures-in-windows-10.md | 18 +-- ...device-automatically-using-group-policy.md | 100 -------------- windows/client-management/toc.yml | 8 +- 5 files changed, 141 insertions(+), 117 deletions(-) create mode 100644 windows/client-management/diagnose-mdm-enrollment.md diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index e3f53846a8..763c220611 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -56,7 +56,9 @@ Using the WCD, create a provisioning package using the enrollment information re 1. Open the WCD tool. 1. Select **Advanced Provisioning**. + ![icd start page.](images/bulk-enrollment7.png) + 1. Enter a project name and select **Next**. 1. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then select **Next**. 1. Skip **Import a provisioning package (optional)** and select **Finish**. @@ -137,13 +139,7 @@ Using the WCD, create a provisioning package using the enrollment information re - [Apply a package during initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#during-initial-setup) - [Apply a package after initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) - [Apply a package directly](/windows/configuration/provisioning-packages/provisioning-apply-package#apply-directly) -- [Apply a package from the Settings app](#apply-a-package-from-the-settings-app). - -## Apply a package from the Settings app - -1. Go to **Settings** > **Accounts** > **Access work or school**. -1. Select **Add or remove a provisioning package**. -1. Select **Add a package**. +- [Apply a package from the Settings app](/windows/configuration/provisioning-packages/provisioning-apply-package#windows-settings). ## Validate that the provisioning package was applied diff --git a/windows/client-management/diagnose-mdm-enrollment.md b/windows/client-management/diagnose-mdm-enrollment.md new file mode 100644 index 0000000000..0a2b47a214 --- /dev/null +++ b/windows/client-management/diagnose-mdm-enrollment.md @@ -0,0 +1,122 @@ +--- +title: Diagnose MDM enrollment failures +description: Learn how to diagnose enrollment failures for Windows devices +ms.reviewer: +manager: aaroncz +ms.author: vinpa +ms.topic: article +ms.prod: windows-client +ms.technology: itpro-manage +author: vinaypamnani-msft +ms.date: 06/25/2018 +ms.collection: +- highpri +- tier2 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +--- + +# Diagnose MDM enrollment + +This article provides suggestions for troubleshooting device enrollment issues for MDM. + +## Verify auto-enrollment requirements and settings + +To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. The following steps demonstrate required settings using the Intune service: + +1. Verify that the user who is going to enroll the device has a valid [Intune license](/mem/intune/fundamentals/licenses). + + :::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png"::: + +1. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). + + ![Auto-enrollment activation verification.](images/auto-enrollment-activation-verification.png) + + > [!IMPORTANT] + > For bring-your-own devices (BYOD devices), the Mobile Application Management (MAM) user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. + > + > For corporate-owned devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. + +1. Verify that the device OS version is Windows 10, version 1709 or later. + +1. Auto-enrollment into Intune via Group Policy is valid only for devices that are hybrid Azure AD joined. This condition means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. + + You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. + + ![Auto-enrollment device status result.](images/auto-enrollment-device-status-result.png) + + Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. + + ![Auto-enrollment Azure AD prt verification.](images/auto-enrollment-azureadprt-verification.png) + + This information can also be found on the Azure AD device list. + + ![Azure AD device list.](images/azure-ad-device-list.png) + +1. Verify that the MDM discovery URL during auto-enrollment is `https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc`. + + ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) + +1. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. + + :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: + +1. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. + +1. Verify that Microsoft Intune should allow enrollment of Windows devices. + + :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: + +## Troubleshoot auto-enrollment using group policy + +Investigate the logs if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows device. To collect Event Viewer logs: + +1. Open Event Viewer. + +1. Navigate to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise-Diagnostic-Provider** > **Admin**. + + > [!TIP] + > For guidance on how to collect event logs for Intune, see [Collect MDM Event Viewer Log YouTube video](https://www.youtube.com/watch?v=U_oCe2RmQEc). + +1. Search for event ID 75, which represents a successful auto-enrollment. Here's an example screenshot that shows the auto-enrollment completed successfully: + + :::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png"::: + +If you can't find event ID 75 in the logs, it indicates that the auto-enrollment failed. This failure can happen because of the following reasons: + +- The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here's an example screenshot that shows that the auto-enrollment failed: + + :::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png"::: + + To troubleshoot, check the error code that appears in the event. For more information, see [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors). + +- The auto-enrollment didn't trigger at all. In this case, you'll not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described below: + + The auto-enrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot: + + :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: + + > [!NOTE] + > This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task. + + This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Azure Active Directory is triggered by event ID 107. + + :::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: + + When the task is completed, a new event ID 102 is logged. + + :::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png"::: + + The task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This status-display means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It doesn't indicate the success or failure of auto-enrollment. + + If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Azure AD is initiated, there's possibly an issue with the group policy. Immediately run the command `gpupdate /force` in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. + One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: + + :::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: + + By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs** > **Microsoft** > **Windows** > **Task Scheduler** > **Operational** event log file under event ID 7016. + + A resolution to this issue is to remove the registry key manually. If you don't know which registry key to remove, go for the key that displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: + + :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: diff --git a/windows/client-management/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/diagnose-mdm-failures-in-windows-10.md index a2b1c288ba..1d5fa21e4f 100644 --- a/windows/client-management/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/diagnose-mdm-failures-in-windows-10.md @@ -1,7 +1,7 @@ --- -title: Diagnose MDM failures in Windows 10 -description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows 10 devices managed by an MDM server. -ms.reviewer: +title: Collect MDM logs +description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows devices managed by an MDM server. +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -17,23 +17,25 @@ appliesto: - ✅ Windows 10 --- -# Diagnose MDM failures in Windows 10 +# Collect MDM logs -To help diagnose enrollment or device management issues in Windows 10 devices managed by an MDM server, you can examine the MDM logs collected from the desktop. The following sections describe the procedures for collecting MDM logs. +To help diagnose enrollment or device management issues in Windows devices managed by an MDM server, you can examine the MDM logs collected from the desktop. The following sections describe the procedures for collecting MDM logs. -## Download the MDM Diagnostic Information log from Windows 10 PCs +## Download the MDM Diagnostic Information log from Windows devices 1. On your managed device, go to **Settings** > **Accounts** > **Access work or school**. -1. Click your work or school account, then click **Info.** +1. Click your work or school account, then click **Info**. + ![Access work or school page in Settings.](images/diagnose-mdm-failures15.png) 1. At the bottom of the **Settings** page, click **Create report**. + ![Access work or school page and then Create report.](images/diagnose-mdm-failures16.png) 1. A window opens that shows the path to the log files. Click **Export**. ![Access work or school log files.](images/diagnose-mdm-failures17.png) -1. In File Explorer, navigate to c:\Users\Public\Documents\MDMDiagnostics to see the report. +1. In File Explorer, navigate to `C:\Users\Public\Documents\MDMDiagnostics` to see the report. ## Use command to collect logs directly from Windows 10 PCs diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 6f3424abb1..34a25870dc 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -136,106 +136,6 @@ The message **0x80180026** is a failure message (`MENROLL_E_DEVICE_MANAGEMENT_BL > [!NOTE] > The GPEdit console doesn't reflect the status of policies set by your IT admin on your device. It's only used by the user to set policies. -## Verify auto-enrollment requirements and settings - -To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. The following steps demonstrate required settings using the Intune service: - -1. Verify that the user who is going to enroll the device has a valid [Intune license](/mem/intune/fundamentals/licenses). - - :::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png"::: - -1. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). - - ![Auto-enrollment activation verification.](images/auto-enrollment-activation-verification.png) - - > [!IMPORTANT] - > For bring-your-own devices (BYOD devices), the Mobile Application Management (MAM) user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. - > - > For corporate-owned devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. - -1. Verify that the device OS version is Windows 10, version 1709 or later. - -1. Auto-enrollment into Intune via Group Policy is valid only for devices that are hybrid Azure AD joined. This condition means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. - - You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. - - ![Auto-enrollment device status result.](images/auto-enrollment-device-status-result.png) - - Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. - - ![Auto-enrollment Azure AD prt verification.](images/auto-enrollment-azureadprt-verification.png) - - This information can also be found on the Azure AD device list. - - ![Azure AD device list.](images/azure-ad-device-list.png) - -1. Verify that the MDM discovery URL during auto-enrollment is `https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc`. - - ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) - -1. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. - - :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: - -1. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. - -1. Verify that Microsoft Intune should allow enrollment of Windows devices. - - :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: - -## Troubleshoot auto-enrollment - -Investigate the logs if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows device. To collect Event Viewer logs: - -1. Open Event Viewer. - -1. Navigate to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise-Diagnostic-Provider** > **Admin**. - - > [!TIP] - > For guidance on how to collect event logs for Intune, see [Collect MDM Event Viewer Log YouTube video](https://www.youtube.com/watch?v=U_oCe2RmQEc). - -1. Search for event ID 75, which represents a successful auto-enrollment. Here's an example screenshot that shows the auto-enrollment completed successfully: - - :::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png"::: - -If you can't find event ID 75 in the logs, it indicates that the auto-enrollment failed. This failure can happen because of the following reasons: - -- The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here's an example screenshot that shows that the auto-enrollment failed: - - :::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png"::: - - To troubleshoot, check the error code that appears in the event. For more information, see [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors). - -- The auto-enrollment didn't trigger at all. In this case, you'll not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described below: - - The auto-enrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot: - - :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: - - > [!NOTE] - > This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task. - - This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Azure Active Directory is triggered by event ID 107. - - :::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: - - When the task is completed, a new event ID 102 is logged. - - :::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png"::: - - The task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This status-display means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It doesn't indicate the success or failure of auto-enrollment. - - If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Azure AD is initiated, there's possibly an issue with the group policy. Immediately run the command `gpupdate /force` in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. - One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: - - :::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: - - By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs** > **Microsoft** > **Windows** > **Task Scheduler** > **Operational** event log file under event ID 7016. - - A resolution to this issue is to remove the registry key manually. If you don't know which registry key to remove, go for the key that displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: - - :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: - ## Related topics - [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11)) diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index c33a1ad8a2..13f9e2cfa4 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -54,8 +54,12 @@ items: href: certificate-renewal-windows-mdm.md - name: Unenroll devices href: disconnecting-from-mdm-unenrollment.md - - name: Diagnose MDM failures in Windows 10 - href: diagnose-mdm-failures-in-windows-10.md + - name: Diagnose MDM failures + items: + - name: Collect MDM logs + href: diagnose-mdm-failures-in-windows-10.md + - name: Diagnose MDM enrollment + href: diagnose-mdm-enrollment.md - name: Configuration service provider reference href: mdm/index.yml - name: Client management tools and settings From ed036efbffc86a9157a123ea6a2b59ebaf5e8712 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 6 Apr 2023 11:12:58 -0400 Subject: [PATCH 048/139] Rename includes folder --- .../allow-a-shared-books-folder-shortdesc.md | 0 .../allow-address-bar-drop-down-shortdesc.md | 0 .../{includes => includes.old}/allow-adobe-flash-shortdesc.md | 0 .../allow-clearing-browsing-data-on-exit-shortdesc.md | 0 .../allow-configuration-updates-for-books-library-shortdesc.md | 0 .../{includes => includes.old}/allow-developer-tools-shortdesc.md | 0 .../allow-extended-telemetry-for-books-tab-shortdesc.md | 0 .../{includes => includes.old}/allow-extensions-shortdesc.md | 0 .../{includes => includes.old}/allow-fullscreen-mode-shortdesc.md | 0 .../allow-inprivate-browsing-shortdesc.md | 0 .../allow-microsoft-compatibility-list-shortdesc.md | 0 .../{includes => includes.old}/allow-prelaunch-shortdesc.md | 0 .../{includes => includes.old}/allow-printing-shortdesc.md | 0 .../{includes => includes.old}/allow-saving-history-shortdesc.md | 0 .../allow-search-engine-customization-shortdesc.md | 0 .../allow-sideloading-of-extensions-shortdesc.md | 0 .../{includes => includes.old}/allow-tab-preloading-shortdesc.md | 0 .../allow-web-content-on-new-tab-page-shortdesc.md | 0 .../allow-windows-app-to-share-data-users-shortdesc.md | 0 .../always-show-books-library-shortdesc.md | 0 .../configure-additional-search-engines-shortdesc.md | 0 .../configure-adobe-flash-click-to-run-setting-shortdesc.md | 0 .../{includes => includes.old}/configure-autofill-shortdesc.md | 0 .../configure-browser-telemetry-for-m365-analytics-shortdesc.md | 0 .../{includes => includes.old}/configure-cookies-shortdesc.md | 0 .../configure-do-not-track-shortdesc.md | 0 .../configure-enterprise-mode-site-list-shortdesc.md | 0 .../configure-favorites-bar-shortdesc.md | 0 .../{includes => includes.old}/configure-home-button-shortdesc.md | 0 .../{includes => includes.old}/configure-kiosk-mode-shortdesc.md | 0 .../configure-kiosk-reset-after-idle-timeout-shortdesc.md | 0 .../configure-open-microsoft-edge-with-shortdesc.md | 0 .../configure-password-manager-shortdesc.md | 0 .../configure-pop-up-blocker-shortdesc.md | 0 .../configure-search-suggestions-in-address-bar-shortdesc.md | 0 .../{includes => includes.old}/configure-start-pages-shortdesc.md | 0 .../configure-windows-defender-smartscreen-shortdesc.md | 0 .../disable-lockdown-of-start-pages-shortdesc.md | 0 .../do-not-sync-browser-settings-shortdesc.md | 0 .../keep-favorites-in-sync-between-ie-and-edge-shortdesc.md | 0 .../prevent-access-to-about-flags-page-shortdesc.md | 0 ...vent-bypassing-windows-defender-prompts-for-files-shortdesc.md | 0 ...vent-bypassing-windows-defender-prompts-for-sites-shortdesc.md | 0 .../prevent-certificate-error-overrides-shortdesc.md | 0 .../prevent-changes-to-favorites-shortdesc.md | 0 .../prevent-edge-from-gathering-live-tile-info-shortdesc.md | 0 .../prevent-first-run-webpage-from-opening-shortdesc.md | 0 .../prevent-turning-off-required-extensions-shortdesc.md | 0 .../prevent-users-to-turn-on-browser-syncing-shortdesc.md | 0 .../prevent-using-localhost-ip-address-for-webrtc-shortdesc.md | 0 .../{includes => includes.old}/provision-favorites-shortdesc.md | 0 .../send-all-intranet-sites-to-ie-shortdesc.md | 0 .../set-default-search-engine-shortdesc.md | 0 .../{includes => includes.old}/set-home-button-url-shortdesc.md | 0 .../{includes => includes.old}/set-new-tab-url-shortdesc.md | 0 .../show-message-when-opening-sites-in-ie-shortdesc.md | 0 .../{includes => includes.old}/unlock-home-button-shortdesc.md | 0 57 files changed, 0 insertions(+), 0 deletions(-) rename windows/client-management/{includes => includes.old}/allow-a-shared-books-folder-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-address-bar-drop-down-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-adobe-flash-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-clearing-browsing-data-on-exit-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-configuration-updates-for-books-library-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-developer-tools-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-extended-telemetry-for-books-tab-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-extensions-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-fullscreen-mode-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-inprivate-browsing-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-microsoft-compatibility-list-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-prelaunch-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-printing-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-saving-history-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-search-engine-customization-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-sideloading-of-extensions-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-tab-preloading-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-web-content-on-new-tab-page-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/allow-windows-app-to-share-data-users-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/always-show-books-library-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-additional-search-engines-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-adobe-flash-click-to-run-setting-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-autofill-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-browser-telemetry-for-m365-analytics-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-cookies-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-do-not-track-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-enterprise-mode-site-list-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-favorites-bar-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-home-button-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-kiosk-mode-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-kiosk-reset-after-idle-timeout-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-open-microsoft-edge-with-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-password-manager-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-pop-up-blocker-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-search-suggestions-in-address-bar-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-start-pages-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/configure-windows-defender-smartscreen-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/disable-lockdown-of-start-pages-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/do-not-sync-browser-settings-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-access-to-about-flags-page-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-certificate-error-overrides-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-changes-to-favorites-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-edge-from-gathering-live-tile-info-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-first-run-webpage-from-opening-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-turning-off-required-extensions-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-users-to-turn-on-browser-syncing-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/provision-favorites-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/send-all-intranet-sites-to-ie-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/set-default-search-engine-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/set-home-button-url-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/set-new-tab-url-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/show-message-when-opening-sites-in-ie-shortdesc.md (100%) rename windows/client-management/{includes => includes.old}/unlock-home-button-shortdesc.md (100%) diff --git a/windows/client-management/includes/allow-a-shared-books-folder-shortdesc.md b/windows/client-management/includes.old/allow-a-shared-books-folder-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-a-shared-books-folder-shortdesc.md rename to windows/client-management/includes.old/allow-a-shared-books-folder-shortdesc.md diff --git a/windows/client-management/includes/allow-address-bar-drop-down-shortdesc.md b/windows/client-management/includes.old/allow-address-bar-drop-down-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-address-bar-drop-down-shortdesc.md rename to windows/client-management/includes.old/allow-address-bar-drop-down-shortdesc.md diff --git a/windows/client-management/includes/allow-adobe-flash-shortdesc.md b/windows/client-management/includes.old/allow-adobe-flash-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-adobe-flash-shortdesc.md rename to windows/client-management/includes.old/allow-adobe-flash-shortdesc.md diff --git a/windows/client-management/includes/allow-clearing-browsing-data-on-exit-shortdesc.md b/windows/client-management/includes.old/allow-clearing-browsing-data-on-exit-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-clearing-browsing-data-on-exit-shortdesc.md rename to windows/client-management/includes.old/allow-clearing-browsing-data-on-exit-shortdesc.md diff --git a/windows/client-management/includes/allow-configuration-updates-for-books-library-shortdesc.md b/windows/client-management/includes.old/allow-configuration-updates-for-books-library-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-configuration-updates-for-books-library-shortdesc.md rename to windows/client-management/includes.old/allow-configuration-updates-for-books-library-shortdesc.md diff --git a/windows/client-management/includes/allow-developer-tools-shortdesc.md b/windows/client-management/includes.old/allow-developer-tools-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-developer-tools-shortdesc.md rename to windows/client-management/includes.old/allow-developer-tools-shortdesc.md diff --git a/windows/client-management/includes/allow-extended-telemetry-for-books-tab-shortdesc.md b/windows/client-management/includes.old/allow-extended-telemetry-for-books-tab-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-extended-telemetry-for-books-tab-shortdesc.md rename to windows/client-management/includes.old/allow-extended-telemetry-for-books-tab-shortdesc.md diff --git a/windows/client-management/includes/allow-extensions-shortdesc.md b/windows/client-management/includes.old/allow-extensions-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-extensions-shortdesc.md rename to windows/client-management/includes.old/allow-extensions-shortdesc.md diff --git a/windows/client-management/includes/allow-fullscreen-mode-shortdesc.md b/windows/client-management/includes.old/allow-fullscreen-mode-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-fullscreen-mode-shortdesc.md rename to windows/client-management/includes.old/allow-fullscreen-mode-shortdesc.md diff --git a/windows/client-management/includes/allow-inprivate-browsing-shortdesc.md b/windows/client-management/includes.old/allow-inprivate-browsing-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-inprivate-browsing-shortdesc.md rename to windows/client-management/includes.old/allow-inprivate-browsing-shortdesc.md diff --git a/windows/client-management/includes/allow-microsoft-compatibility-list-shortdesc.md b/windows/client-management/includes.old/allow-microsoft-compatibility-list-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-microsoft-compatibility-list-shortdesc.md rename to windows/client-management/includes.old/allow-microsoft-compatibility-list-shortdesc.md diff --git a/windows/client-management/includes/allow-prelaunch-shortdesc.md b/windows/client-management/includes.old/allow-prelaunch-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-prelaunch-shortdesc.md rename to windows/client-management/includes.old/allow-prelaunch-shortdesc.md diff --git a/windows/client-management/includes/allow-printing-shortdesc.md b/windows/client-management/includes.old/allow-printing-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-printing-shortdesc.md rename to windows/client-management/includes.old/allow-printing-shortdesc.md diff --git a/windows/client-management/includes/allow-saving-history-shortdesc.md b/windows/client-management/includes.old/allow-saving-history-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-saving-history-shortdesc.md rename to windows/client-management/includes.old/allow-saving-history-shortdesc.md diff --git a/windows/client-management/includes/allow-search-engine-customization-shortdesc.md b/windows/client-management/includes.old/allow-search-engine-customization-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-search-engine-customization-shortdesc.md rename to windows/client-management/includes.old/allow-search-engine-customization-shortdesc.md diff --git a/windows/client-management/includes/allow-sideloading-of-extensions-shortdesc.md b/windows/client-management/includes.old/allow-sideloading-of-extensions-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-sideloading-of-extensions-shortdesc.md rename to windows/client-management/includes.old/allow-sideloading-of-extensions-shortdesc.md diff --git a/windows/client-management/includes/allow-tab-preloading-shortdesc.md b/windows/client-management/includes.old/allow-tab-preloading-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-tab-preloading-shortdesc.md rename to windows/client-management/includes.old/allow-tab-preloading-shortdesc.md diff --git a/windows/client-management/includes/allow-web-content-on-new-tab-page-shortdesc.md b/windows/client-management/includes.old/allow-web-content-on-new-tab-page-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-web-content-on-new-tab-page-shortdesc.md rename to windows/client-management/includes.old/allow-web-content-on-new-tab-page-shortdesc.md diff --git a/windows/client-management/includes/allow-windows-app-to-share-data-users-shortdesc.md b/windows/client-management/includes.old/allow-windows-app-to-share-data-users-shortdesc.md similarity index 100% rename from windows/client-management/includes/allow-windows-app-to-share-data-users-shortdesc.md rename to windows/client-management/includes.old/allow-windows-app-to-share-data-users-shortdesc.md diff --git a/windows/client-management/includes/always-show-books-library-shortdesc.md b/windows/client-management/includes.old/always-show-books-library-shortdesc.md similarity index 100% rename from windows/client-management/includes/always-show-books-library-shortdesc.md rename to windows/client-management/includes.old/always-show-books-library-shortdesc.md diff --git a/windows/client-management/includes/configure-additional-search-engines-shortdesc.md b/windows/client-management/includes.old/configure-additional-search-engines-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-additional-search-engines-shortdesc.md rename to windows/client-management/includes.old/configure-additional-search-engines-shortdesc.md diff --git a/windows/client-management/includes/configure-adobe-flash-click-to-run-setting-shortdesc.md b/windows/client-management/includes.old/configure-adobe-flash-click-to-run-setting-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-adobe-flash-click-to-run-setting-shortdesc.md rename to windows/client-management/includes.old/configure-adobe-flash-click-to-run-setting-shortdesc.md diff --git a/windows/client-management/includes/configure-autofill-shortdesc.md b/windows/client-management/includes.old/configure-autofill-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-autofill-shortdesc.md rename to windows/client-management/includes.old/configure-autofill-shortdesc.md diff --git a/windows/client-management/includes/configure-browser-telemetry-for-m365-analytics-shortdesc.md b/windows/client-management/includes.old/configure-browser-telemetry-for-m365-analytics-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-browser-telemetry-for-m365-analytics-shortdesc.md rename to windows/client-management/includes.old/configure-browser-telemetry-for-m365-analytics-shortdesc.md diff --git a/windows/client-management/includes/configure-cookies-shortdesc.md b/windows/client-management/includes.old/configure-cookies-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-cookies-shortdesc.md rename to windows/client-management/includes.old/configure-cookies-shortdesc.md diff --git a/windows/client-management/includes/configure-do-not-track-shortdesc.md b/windows/client-management/includes.old/configure-do-not-track-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-do-not-track-shortdesc.md rename to windows/client-management/includes.old/configure-do-not-track-shortdesc.md diff --git a/windows/client-management/includes/configure-enterprise-mode-site-list-shortdesc.md b/windows/client-management/includes.old/configure-enterprise-mode-site-list-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-enterprise-mode-site-list-shortdesc.md rename to windows/client-management/includes.old/configure-enterprise-mode-site-list-shortdesc.md diff --git a/windows/client-management/includes/configure-favorites-bar-shortdesc.md b/windows/client-management/includes.old/configure-favorites-bar-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-favorites-bar-shortdesc.md rename to windows/client-management/includes.old/configure-favorites-bar-shortdesc.md diff --git a/windows/client-management/includes/configure-home-button-shortdesc.md b/windows/client-management/includes.old/configure-home-button-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-home-button-shortdesc.md rename to windows/client-management/includes.old/configure-home-button-shortdesc.md diff --git a/windows/client-management/includes/configure-kiosk-mode-shortdesc.md b/windows/client-management/includes.old/configure-kiosk-mode-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-kiosk-mode-shortdesc.md rename to windows/client-management/includes.old/configure-kiosk-mode-shortdesc.md diff --git a/windows/client-management/includes/configure-kiosk-reset-after-idle-timeout-shortdesc.md b/windows/client-management/includes.old/configure-kiosk-reset-after-idle-timeout-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-kiosk-reset-after-idle-timeout-shortdesc.md rename to windows/client-management/includes.old/configure-kiosk-reset-after-idle-timeout-shortdesc.md diff --git a/windows/client-management/includes/configure-open-microsoft-edge-with-shortdesc.md b/windows/client-management/includes.old/configure-open-microsoft-edge-with-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-open-microsoft-edge-with-shortdesc.md rename to windows/client-management/includes.old/configure-open-microsoft-edge-with-shortdesc.md diff --git a/windows/client-management/includes/configure-password-manager-shortdesc.md b/windows/client-management/includes.old/configure-password-manager-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-password-manager-shortdesc.md rename to windows/client-management/includes.old/configure-password-manager-shortdesc.md diff --git a/windows/client-management/includes/configure-pop-up-blocker-shortdesc.md b/windows/client-management/includes.old/configure-pop-up-blocker-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-pop-up-blocker-shortdesc.md rename to windows/client-management/includes.old/configure-pop-up-blocker-shortdesc.md diff --git a/windows/client-management/includes/configure-search-suggestions-in-address-bar-shortdesc.md b/windows/client-management/includes.old/configure-search-suggestions-in-address-bar-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-search-suggestions-in-address-bar-shortdesc.md rename to windows/client-management/includes.old/configure-search-suggestions-in-address-bar-shortdesc.md diff --git a/windows/client-management/includes/configure-start-pages-shortdesc.md b/windows/client-management/includes.old/configure-start-pages-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-start-pages-shortdesc.md rename to windows/client-management/includes.old/configure-start-pages-shortdesc.md diff --git a/windows/client-management/includes/configure-windows-defender-smartscreen-shortdesc.md b/windows/client-management/includes.old/configure-windows-defender-smartscreen-shortdesc.md similarity index 100% rename from windows/client-management/includes/configure-windows-defender-smartscreen-shortdesc.md rename to windows/client-management/includes.old/configure-windows-defender-smartscreen-shortdesc.md diff --git a/windows/client-management/includes/disable-lockdown-of-start-pages-shortdesc.md b/windows/client-management/includes.old/disable-lockdown-of-start-pages-shortdesc.md similarity index 100% rename from windows/client-management/includes/disable-lockdown-of-start-pages-shortdesc.md rename to windows/client-management/includes.old/disable-lockdown-of-start-pages-shortdesc.md diff --git a/windows/client-management/includes/do-not-sync-browser-settings-shortdesc.md b/windows/client-management/includes.old/do-not-sync-browser-settings-shortdesc.md similarity index 100% rename from windows/client-management/includes/do-not-sync-browser-settings-shortdesc.md rename to windows/client-management/includes.old/do-not-sync-browser-settings-shortdesc.md diff --git a/windows/client-management/includes/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md b/windows/client-management/includes.old/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md similarity index 100% rename from windows/client-management/includes/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md rename to windows/client-management/includes.old/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md diff --git a/windows/client-management/includes/prevent-access-to-about-flags-page-shortdesc.md b/windows/client-management/includes.old/prevent-access-to-about-flags-page-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-access-to-about-flags-page-shortdesc.md rename to windows/client-management/includes.old/prevent-access-to-about-flags-page-shortdesc.md diff --git a/windows/client-management/includes/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md b/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md rename to windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md diff --git a/windows/client-management/includes/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md b/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md rename to windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md diff --git a/windows/client-management/includes/prevent-certificate-error-overrides-shortdesc.md b/windows/client-management/includes.old/prevent-certificate-error-overrides-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-certificate-error-overrides-shortdesc.md rename to windows/client-management/includes.old/prevent-certificate-error-overrides-shortdesc.md diff --git a/windows/client-management/includes/prevent-changes-to-favorites-shortdesc.md b/windows/client-management/includes.old/prevent-changes-to-favorites-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-changes-to-favorites-shortdesc.md rename to windows/client-management/includes.old/prevent-changes-to-favorites-shortdesc.md diff --git a/windows/client-management/includes/prevent-edge-from-gathering-live-tile-info-shortdesc.md b/windows/client-management/includes.old/prevent-edge-from-gathering-live-tile-info-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-edge-from-gathering-live-tile-info-shortdesc.md rename to windows/client-management/includes.old/prevent-edge-from-gathering-live-tile-info-shortdesc.md diff --git a/windows/client-management/includes/prevent-first-run-webpage-from-opening-shortdesc.md b/windows/client-management/includes.old/prevent-first-run-webpage-from-opening-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-first-run-webpage-from-opening-shortdesc.md rename to windows/client-management/includes.old/prevent-first-run-webpage-from-opening-shortdesc.md diff --git a/windows/client-management/includes/prevent-turning-off-required-extensions-shortdesc.md b/windows/client-management/includes.old/prevent-turning-off-required-extensions-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-turning-off-required-extensions-shortdesc.md rename to windows/client-management/includes.old/prevent-turning-off-required-extensions-shortdesc.md diff --git a/windows/client-management/includes/prevent-users-to-turn-on-browser-syncing-shortdesc.md b/windows/client-management/includes.old/prevent-users-to-turn-on-browser-syncing-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-users-to-turn-on-browser-syncing-shortdesc.md rename to windows/client-management/includes.old/prevent-users-to-turn-on-browser-syncing-shortdesc.md diff --git a/windows/client-management/includes/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md b/windows/client-management/includes.old/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md similarity index 100% rename from windows/client-management/includes/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md rename to windows/client-management/includes.old/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md diff --git a/windows/client-management/includes/provision-favorites-shortdesc.md b/windows/client-management/includes.old/provision-favorites-shortdesc.md similarity index 100% rename from windows/client-management/includes/provision-favorites-shortdesc.md rename to windows/client-management/includes.old/provision-favorites-shortdesc.md diff --git a/windows/client-management/includes/send-all-intranet-sites-to-ie-shortdesc.md b/windows/client-management/includes.old/send-all-intranet-sites-to-ie-shortdesc.md similarity index 100% rename from windows/client-management/includes/send-all-intranet-sites-to-ie-shortdesc.md rename to windows/client-management/includes.old/send-all-intranet-sites-to-ie-shortdesc.md diff --git a/windows/client-management/includes/set-default-search-engine-shortdesc.md b/windows/client-management/includes.old/set-default-search-engine-shortdesc.md similarity index 100% rename from windows/client-management/includes/set-default-search-engine-shortdesc.md rename to windows/client-management/includes.old/set-default-search-engine-shortdesc.md diff --git a/windows/client-management/includes/set-home-button-url-shortdesc.md b/windows/client-management/includes.old/set-home-button-url-shortdesc.md similarity index 100% rename from windows/client-management/includes/set-home-button-url-shortdesc.md rename to windows/client-management/includes.old/set-home-button-url-shortdesc.md diff --git a/windows/client-management/includes/set-new-tab-url-shortdesc.md b/windows/client-management/includes.old/set-new-tab-url-shortdesc.md similarity index 100% rename from windows/client-management/includes/set-new-tab-url-shortdesc.md rename to windows/client-management/includes.old/set-new-tab-url-shortdesc.md diff --git a/windows/client-management/includes/show-message-when-opening-sites-in-ie-shortdesc.md b/windows/client-management/includes.old/show-message-when-opening-sites-in-ie-shortdesc.md similarity index 100% rename from windows/client-management/includes/show-message-when-opening-sites-in-ie-shortdesc.md rename to windows/client-management/includes.old/show-message-when-opening-sites-in-ie-shortdesc.md diff --git a/windows/client-management/includes/unlock-home-button-shortdesc.md b/windows/client-management/includes.old/unlock-home-button-shortdesc.md similarity index 100% rename from windows/client-management/includes/unlock-home-button-shortdesc.md rename to windows/client-management/includes.old/unlock-home-button-shortdesc.md From 1cea6f547550e3c9c3e8065f096b3aad328abd20 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 6 Apr 2023 11:18:31 -0400 Subject: [PATCH 049/139] Remove includes --- .../allow-a-shared-books-folder-shortdesc.md | 11 ---------- .../allow-address-bar-drop-down-shortdesc.md | 11 ---------- .../allow-adobe-flash-shortdesc.md | 11 ---------- ...learing-browsing-data-on-exit-shortdesc.md | 11 ---------- ...ion-updates-for-books-library-shortdesc.md | 11 ---------- .../allow-developer-tools-shortdesc.md | 11 ---------- ...ended-telemetry-for-books-tab-shortdesc.md | 11 ---------- .../allow-extensions-shortdesc.md | 11 ---------- .../allow-fullscreen-mode-shortdesc.md | 11 ---------- .../allow-inprivate-browsing-shortdesc.md | 11 ---------- ...-microsoft-compatibility-list-shortdesc.md | 11 ---------- .../includes.old/allow-prelaunch-shortdesc.md | 11 ---------- .../includes.old/allow-printing-shortdesc.md | 11 ---------- .../allow-saving-history-shortdesc.md | 11 ---------- ...w-search-engine-customization-shortdesc.md | 15 ------------- ...low-sideloading-of-extensions-shortdesc.md | 11 ---------- .../allow-tab-preloading-shortdesc.md | 11 ---------- ...w-web-content-on-new-tab-page-shortdesc.md | 11 ---------- ...ndows-app-to-share-data-users-shortdesc.md | 11 ---------- .../always-show-books-library-shortdesc.md | 11 ---------- ...ure-additional-search-engines-shortdesc.md | 17 --------------- ...be-flash-click-to-run-setting-shortdesc.md | 11 ---------- .../configure-autofill-shortdesc.md | 11 ---------- ...-telemetry-for-m365-analytics-shortdesc.md | 11 ---------- .../configure-cookies-shortdesc.md | 11 ---------- .../configure-do-not-track-shortdesc.md | 11 ---------- ...ure-enterprise-mode-site-list-shortdesc.md | 11 ---------- .../configure-favorites-bar-shortdesc.md | 11 ---------- .../configure-home-button-shortdesc.md | 11 ---------- .../configure-kiosk-mode-shortdesc.md | 21 ------------------- ...iosk-reset-after-idle-timeout-shortdesc.md | 11 ---------- ...gure-open-microsoft-edge-with-shortdesc.md | 11 ---------- .../configure-password-manager-shortdesc.md | 11 ---------- .../configure-pop-up-blocker-shortdesc.md | 12 ----------- ...ch-suggestions-in-address-bar-shortdesc.md | 11 ---------- .../configure-start-pages-shortdesc.md | 11 ---------- ...-windows-defender-smartscreen-shortdesc.md | 11 ---------- ...sable-lockdown-of-start-pages-shortdesc.md | 11 ---------- .../do-not-sync-browser-settings-shortdesc.md | 11 ---------- ...s-in-sync-between-ie-and-edge-shortdesc.md | 11 ---------- ...nt-access-to-about-flags-page-shortdesc.md | 11 ---------- ...ws-defender-prompts-for-files-shortdesc.md | 11 ---------- ...ws-defender-prompts-for-sites-shortdesc.md | 11 ---------- ...t-certificate-error-overrides-shortdesc.md | 11 ---------- .../prevent-changes-to-favorites-shortdesc.md | 11 ---------- ...from-gathering-live-tile-info-shortdesc.md | 11 ---------- ...irst-run-webpage-from-opening-shortdesc.md | 11 ---------- ...rning-off-required-extensions-shortdesc.md | 11 ---------- ...rs-to-turn-on-browser-syncing-shortdesc.md | 11 ---------- ...calhost-ip-address-for-webrtc-shortdesc.md | 11 ---------- .../provision-favorites-shortdesc.md | 20 ------------------ ...send-all-intranet-sites-to-ie-shortdesc.md | 11 ---------- .../set-default-search-engine-shortdesc.md | 11 ---------- .../set-home-button-url-shortdesc.md | 11 ---------- .../includes.old/set-new-tab-url-shortdesc.md | 11 ---------- ...sage-when-opening-sites-in-ie-shortdesc.md | 11 ---------- .../unlock-home-button-shortdesc.md | 11 ---------- 57 files changed, 657 deletions(-) delete mode 100644 windows/client-management/includes.old/allow-a-shared-books-folder-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-address-bar-drop-down-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-adobe-flash-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-clearing-browsing-data-on-exit-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-configuration-updates-for-books-library-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-developer-tools-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-extended-telemetry-for-books-tab-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-extensions-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-fullscreen-mode-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-inprivate-browsing-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-microsoft-compatibility-list-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-prelaunch-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-printing-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-saving-history-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-search-engine-customization-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-sideloading-of-extensions-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-tab-preloading-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-web-content-on-new-tab-page-shortdesc.md delete mode 100644 windows/client-management/includes.old/allow-windows-app-to-share-data-users-shortdesc.md delete mode 100644 windows/client-management/includes.old/always-show-books-library-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-additional-search-engines-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-adobe-flash-click-to-run-setting-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-autofill-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-browser-telemetry-for-m365-analytics-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-cookies-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-do-not-track-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-enterprise-mode-site-list-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-favorites-bar-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-home-button-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-kiosk-mode-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-kiosk-reset-after-idle-timeout-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-open-microsoft-edge-with-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-password-manager-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-pop-up-blocker-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-search-suggestions-in-address-bar-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-start-pages-shortdesc.md delete mode 100644 windows/client-management/includes.old/configure-windows-defender-smartscreen-shortdesc.md delete mode 100644 windows/client-management/includes.old/disable-lockdown-of-start-pages-shortdesc.md delete mode 100644 windows/client-management/includes.old/do-not-sync-browser-settings-shortdesc.md delete mode 100644 windows/client-management/includes.old/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-access-to-about-flags-page-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-certificate-error-overrides-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-changes-to-favorites-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-edge-from-gathering-live-tile-info-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-first-run-webpage-from-opening-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-turning-off-required-extensions-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-users-to-turn-on-browser-syncing-shortdesc.md delete mode 100644 windows/client-management/includes.old/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md delete mode 100644 windows/client-management/includes.old/provision-favorites-shortdesc.md delete mode 100644 windows/client-management/includes.old/send-all-intranet-sites-to-ie-shortdesc.md delete mode 100644 windows/client-management/includes.old/set-default-search-engine-shortdesc.md delete mode 100644 windows/client-management/includes.old/set-home-button-url-shortdesc.md delete mode 100644 windows/client-management/includes.old/set-new-tab-url-shortdesc.md delete mode 100644 windows/client-management/includes.old/show-message-when-opening-sites-in-ie-shortdesc.md delete mode 100644 windows/client-management/includes.old/unlock-home-button-shortdesc.md diff --git a/windows/client-management/includes.old/allow-a-shared-books-folder-shortdesc.md b/windows/client-management/includes.old/allow-a-shared-books-folder-shortdesc.md deleted file mode 100644 index 57b5523dd9..0000000000 --- a/windows/client-management/includes.old/allow-a-shared-books-folder-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge doesn't use a shared folder by default but downloads book files to a per-user folder for each user. With this policy, you can configure Microsoft Edge to store books from the Books Library to a default, shared folder in Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads books to a shared folder after user action to download the book to their device, which allows them to remove downloaded books at any time. For this policy to work correctly, you must also enable the **Allow a Windows app to share application data between users** group policy. Also, the users must be signed in with a school or work account. diff --git a/windows/client-management/includes.old/allow-address-bar-drop-down-shortdesc.md b/windows/client-management/includes.old/allow-address-bar-drop-down-shortdesc.md deleted file mode 100644 index 031d179b36..0000000000 --- a/windows/client-management/includes.old/allow-address-bar-drop-down-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge shows the Address bar drop-down list and makes it available by default, which takes precedence over the Configure search suggestions in Address bar policy. We recommend disabling this policy if you want to minimize network connections from Microsoft Edge to Microsoft service, which hides the functionality of the Address bar drop-down list. When you disable this policy, Microsoft Edge also disables the _Show search and site suggestions as I type_ toggle in Settings. diff --git a/windows/client-management/includes.old/allow-adobe-flash-shortdesc.md b/windows/client-management/includes.old/allow-adobe-flash-shortdesc.md deleted file mode 100644 index 45365c58bd..0000000000 --- a/windows/client-management/includes.old/allow-adobe-flash-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Adobe Flash is integrated with Microsoft Edge and runs Adobe Flash content by default. With this policy, you can configure Microsoft Edge to prevent Adobe Flash content from running. diff --git a/windows/client-management/includes.old/allow-clearing-browsing-data-on-exit-shortdesc.md b/windows/client-management/includes.old/allow-clearing-browsing-data-on-exit-shortdesc.md deleted file mode 100644 index 82ccb5f2ed..0000000000 --- a/windows/client-management/includes.old/allow-clearing-browsing-data-on-exit-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge does not clear the browsing data on exit by default, but users can configure the _Clear browsing data_ option in Settings. Browsing data includes information you entered in forms, passwords, and even the websites visited. With this policy, you can configure Microsoft Edge to clear the browsing data automatically each time Microsoft Edge closes. diff --git a/windows/client-management/includes.old/allow-configuration-updates-for-books-library-shortdesc.md b/windows/client-management/includes.old/allow-configuration-updates-for-books-library-shortdesc.md deleted file mode 100644 index f8b89a8e2e..0000000000 --- a/windows/client-management/includes.old/allow-configuration-updates-for-books-library-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge automatically updates the configuration data for the Books library. Disabling this policy prevents Microsoft Edge from updating the configuration data. If Microsoft receives feedback about the amount of data about the Books library, the data comes as a JSON file. diff --git a/windows/client-management/includes.old/allow-developer-tools-shortdesc.md b/windows/client-management/includes.old/allow-developer-tools-shortdesc.md deleted file mode 100644 index 41176ffb3b..0000000000 --- a/windows/client-management/includes.old/allow-developer-tools-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge allows users to use the F12 developer tools to build and debug web pages by default. With this policy, you can configure Microsoft Edge to prevent users from using the F12 developer tools. diff --git a/windows/client-management/includes.old/allow-extended-telemetry-for-books-tab-shortdesc.md b/windows/client-management/includes.old/allow-extended-telemetry-for-books-tab-shortdesc.md deleted file mode 100644 index 3c9d3f6b42..0000000000 --- a/windows/client-management/includes.old/allow-extended-telemetry-for-books-tab-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, and depending on the device configuration, Microsoft Edge gathers basic diagnostic data about the books in the Books Library and sends it to Microsoft. Enabling this policy gathers and sends both basic and more diagnostic data, such as usage data. diff --git a/windows/client-management/includes.old/allow-extensions-shortdesc.md b/windows/client-management/includes.old/allow-extensions-shortdesc.md deleted file mode 100644 index 8276b06760..0000000000 --- a/windows/client-management/includes.old/allow-extensions-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge allows users to add or personalize extensions in Microsoft Edge by default. With this policy, you can configure Microsoft to prevent users from adding or personalizing extensions. diff --git a/windows/client-management/includes.old/allow-fullscreen-mode-shortdesc.md b/windows/client-management/includes.old/allow-fullscreen-mode-shortdesc.md deleted file mode 100644 index 8c616dedff..0000000000 --- a/windows/client-management/includes.old/allow-fullscreen-mode-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge allows fullscreen mode by default, which shows only the web content and hides the Microsoft Edge UI. To use fullscreen mode, users and extensions must have the proper permissions. Disabling this policy prevents fullscreen mode in Microsoft Edge. diff --git a/windows/client-management/includes.old/allow-inprivate-browsing-shortdesc.md b/windows/client-management/includes.old/allow-inprivate-browsing-shortdesc.md deleted file mode 100644 index 1340e13406..0000000000 --- a/windows/client-management/includes.old/allow-inprivate-browsing-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge allows InPrivate browsing, and after closing all InPrivate tabs, Microsoft Edge deletes the browsing data from the device. With this policy, you can configure Microsoft Edge to prevent InPrivate web browsing. diff --git a/windows/client-management/includes.old/allow-microsoft-compatibility-list-shortdesc.md b/windows/client-management/includes.old/allow-microsoft-compatibility-list-shortdesc.md deleted file mode 100644 index 35a86bfd85..0000000000 --- a/windows/client-management/includes.old/allow-microsoft-compatibility-list-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -During browser navigation, Microsoft Edge checks the Microsoft Compatibility List for websites with known compatibility issues. If found, users are prompted to use Internet Explorer, where the site loads and displays correctly. Periodically during browser navigation, Microsoft Edge downloads the latest version of the list and applies the updates. With this policy, you can configure Microsoft Edge to ignore the compatibility list. You can view the compatibility list at about:compat. diff --git a/windows/client-management/includes.old/allow-prelaunch-shortdesc.md b/windows/client-management/includes.old/allow-prelaunch-shortdesc.md deleted file mode 100644 index a8437f2035..0000000000 --- a/windows/client-management/includes.old/allow-prelaunch-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start Microsoft Edge. You can also configure Microsoft Edge to prevent from pre-launching. diff --git a/windows/client-management/includes.old/allow-printing-shortdesc.md b/windows/client-management/includes.old/allow-printing-shortdesc.md deleted file mode 100644 index 288599efdd..0000000000 --- a/windows/client-management/includes.old/allow-printing-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge allows users to print web content by default. With this policy, you can configure Microsoft Edge to prevent users from printing web content. diff --git a/windows/client-management/includes.old/allow-saving-history-shortdesc.md b/windows/client-management/includes.old/allow-saving-history-shortdesc.md deleted file mode 100644 index 8f5084cda1..0000000000 --- a/windows/client-management/includes.old/allow-saving-history-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge saves the browsing history of visited websites and shows them in the History pane by default. Disabling this policy prevents Microsoft Edge from saving the browsing history. If browsing history existed before disabling this policy, the previous browsing history remains in the History pane. Disabling this policy doesn't stop roaming of existing browsing history or browsing history from other devices. diff --git a/windows/client-management/includes.old/allow-search-engine-customization-shortdesc.md b/windows/client-management/includes.old/allow-search-engine-customization-shortdesc.md deleted file mode 100644 index d7acad8b8d..0000000000 --- a/windows/client-management/includes.old/allow-search-engine-customization-shortdesc.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, users can execute the following tasks in Settings: -- Add new search engines -- Change the default search engine - -With this policy, you can prevent users from customizing the search engine in the Microsoft Edge browser. diff --git a/windows/client-management/includes.old/allow-sideloading-of-extensions-shortdesc.md b/windows/client-management/includes.old/allow-sideloading-of-extensions-shortdesc.md deleted file mode 100644 index 5774f8089e..0000000000 --- a/windows/client-management/includes.old/allow-sideloading-of-extensions-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge allows sideloading, which installs and runs unverified extensions. Disabling this policy prevents sideloading of extensions but doesn't prevent sideloading using Add-AppxPackage via PowerShell. You can only install extensions through Microsoft store (including a store for business), enterprise storefront (such as Company Portal) or PowerShell (using Add-AppxPackage). diff --git a/windows/client-management/includes.old/allow-tab-preloading-shortdesc.md b/windows/client-management/includes.old/allow-tab-preloading-shortdesc.md deleted file mode 100644 index 5008070f5b..0000000000 --- a/windows/client-management/includes.old/allow-tab-preloading-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge allows preloading of the Start and New Tab pages during Windows sign-in, and each time Microsoft Edge closes by default. Preloading minimizes the amount of time required to start Microsoft Edge and load a new tab. With this policy, you can configure Microsoft Edge to prevent preloading of tabs. diff --git a/windows/client-management/includes.old/allow-web-content-on-new-tab-page-shortdesc.md b/windows/client-management/includes.old/allow-web-content-on-new-tab-page-shortdesc.md deleted file mode 100644 index 5d9a75ed5a..0000000000 --- a/windows/client-management/includes.old/allow-web-content-on-new-tab-page-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 11/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge loads the default New Tab page and lets the users make changes. If you disable this policy, a blank page loads instead of the New Tab page and prevents users from changing it. diff --git a/windows/client-management/includes.old/allow-windows-app-to-share-data-users-shortdesc.md b/windows/client-management/includes.old/allow-windows-app-to-share-data-users-shortdesc.md deleted file mode 100644 index 2c63762356..0000000000 --- a/windows/client-management/includes.old/allow-windows-app-to-share-data-users-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -With this policy, you can configure Windows 10 to share application data among multiple users on the system and with other instances of that app. Data shared through the SharedLocal folder is available through the Windows.Storage API. If you previously enabled this policy and now want to disable it, any shared app data remains in the SharedLocal folder. diff --git a/windows/client-management/includes.old/always-show-books-library-shortdesc.md b/windows/client-management/includes.old/always-show-books-library-shortdesc.md deleted file mode 100644 index a9e0bdb003..0000000000 --- a/windows/client-management/includes.old/always-show-books-library-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge shows the Books Library only in countries or regions where supported. With this policy, you can configure Microsoft Edge to show the Books Library regardless of the device’s country or region. diff --git a/windows/client-management/includes.old/configure-additional-search-engines-shortdesc.md b/windows/client-management/includes.old/configure-additional-search-engines-shortdesc.md deleted file mode 100644 index 2560751600..0000000000 --- a/windows/client-management/includes.old/configure-additional-search-engines-shortdesc.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -The Set default search engine policy enables the users to: - -- Set a default search engine -- Configure up to five more search engines, and set any one of them as the default - -If you previously enabled this policy and now want to disable it, doing so results in deletion of all the configured search engines - diff --git a/windows/client-management/includes.old/configure-adobe-flash-click-to-run-setting-shortdesc.md b/windows/client-management/includes.old/configure-adobe-flash-click-to-run-setting-shortdesc.md deleted file mode 100644 index d409c6374c..0000000000 --- a/windows/client-management/includes.old/configure-adobe-flash-click-to-run-setting-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge supports Adobe Flash as a built-in feature rather than as an external add-on and updates automatically via Windows Update. By default, Microsoft Edge prevents Adobe Flash content from loading automatically, requiring action from the user, for example, clicking the **Click-to-Run** button. Depending on how often the content loads and runs, the sites for the content gets added to the auto-allowed list. Disable this policy if you want Adobe Flash content to load automatically. diff --git a/windows/client-management/includes.old/configure-autofill-shortdesc.md b/windows/client-management/includes.old/configure-autofill-shortdesc.md deleted file mode 100644 index 74af7970c6..0000000000 --- a/windows/client-management/includes.old/configure-autofill-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, users can choose to use the Autofill feature to populate the form fields automatically. With this policy, you can configure Microsoft Edge, when enabled to use Autofill or, when disabled to prevent using Autofill. diff --git a/windows/client-management/includes.old/configure-browser-telemetry-for-m365-analytics-shortdesc.md b/windows/client-management/includes.old/configure-browser-telemetry-for-m365-analytics-shortdesc.md deleted file mode 100644 index 935810a840..0000000000 --- a/windows/client-management/includes.old/configure-browser-telemetry-for-m365-analytics-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge doesn't send browsing history data to Microsoft 365 Analytics by default. With this policy though, you can configure Microsoft Edge to send intranet history only, internet history only, or both to Microsoft 365 Analytics for enterprise devices with a configured Commercial ID. diff --git a/windows/client-management/includes.old/configure-cookies-shortdesc.md b/windows/client-management/includes.old/configure-cookies-shortdesc.md deleted file mode 100644 index eeb223000b..0000000000 --- a/windows/client-management/includes.old/configure-cookies-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge allows all cookies from all websites by default. With this policy, you can configure Microsoft to block only 3rd-party cookies or block all cookies. diff --git a/windows/client-management/includes.old/configure-do-not-track-shortdesc.md b/windows/client-management/includes.old/configure-do-not-track-shortdesc.md deleted file mode 100644 index d69135a7e9..0000000000 --- a/windows/client-management/includes.old/configure-do-not-track-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge doesn't send ‘Do Not Track’ requests to websites that ask for tracking information. However, users can choose to send tracking information to sites they visit. With this policy, you can configure Microsoft Edge to send or never send tracking information. diff --git a/windows/client-management/includes.old/configure-enterprise-mode-site-list-shortdesc.md b/windows/client-management/includes.old/configure-enterprise-mode-site-list-shortdesc.md deleted file mode 100644 index f98aa94435..0000000000 --- a/windows/client-management/includes.old/configure-enterprise-mode-site-list-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have sites or apps that use this technology, you can configure Microsoft Edge to check the Enterprise Mode Site List XML file that lists the sites and domains with compatibility issues and switch to IE11 automatically. You can use the same site list for both Microsoft Edge and IE11, or you can use separate lists. By default, Microsoft Edge ignores the Enterprise Mode and the Enterprise Mode Site List XML file. In this case, users might experience problems while using legacy apps. These sites and domains must be viewed using Internet Explorer 11 and Enterprise Mode. diff --git a/windows/client-management/includes.old/configure-favorites-bar-shortdesc.md b/windows/client-management/includes.old/configure-favorites-bar-shortdesc.md deleted file mode 100644 index 661818a582..0000000000 --- a/windows/client-management/includes.old/configure-favorites-bar-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge hides the favorites bar by default but shows it on the Start and New Tab pages. Also, by default, the Favorites Bar toggle, in Settings, is set to Off but enabled letting users make changes. With this policy, you can configure Microsoft Edge to either show or hide the Favorites Bar on all pages. diff --git a/windows/client-management/includes.old/configure-home-button-shortdesc.md b/windows/client-management/includes.old/configure-home-button-shortdesc.md deleted file mode 100644 index 17d1b68784..0000000000 --- a/windows/client-management/includes.old/configure-home-button-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge shows the home button and by clicking it the Start page loads by default. With this policy, you can configure the home button to load the New Tab page or a URL defined in the Set Home Button URL policy. You can also configure Microsoft Edge to hide the home button. diff --git a/windows/client-management/includes.old/configure-kiosk-mode-shortdesc.md b/windows/client-management/includes.old/configure-kiosk-mode-shortdesc.md deleted file mode 100644 index b16c3d18e4..0000000000 --- a/windows/client-management/includes.old/configure-kiosk-mode-shortdesc.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -You can define a behavior for the Microsoft Edge browser, which it shall display when part of many applications running on a kiosk device. - -> [!NOTE] -> You can define the browser's behavior only if you have the assigned access privileges. - -You can also define a behavior when Microsoft Edge serves as a single application. - -You can facilitate the following functionalities in the Microsoft Edge browser: -- Execution of InPrivate full screen -- Execution of InPrivate multi-tab with a tailored experience for kiosks -- Provision for normal browsing diff --git a/windows/client-management/includes.old/configure-kiosk-reset-after-idle-timeout-shortdesc.md b/windows/client-management/includes.old/configure-kiosk-reset-after-idle-timeout-shortdesc.md deleted file mode 100644 index 767c933e7c..0000000000 --- a/windows/client-management/includes.old/configure-kiosk-reset-after-idle-timeout-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -You can configure Microsoft Edge kiosk mode to reset to the configured start experience after a specified amount of idle time in minutes (0-1440). The reset timer begins after the last user interaction. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge kiosk mode resets after 30 seconds. Resetting to the configured start experience deletes the current user’s browsing data. diff --git a/windows/client-management/includes.old/configure-open-microsoft-edge-with-shortdesc.md b/windows/client-management/includes.old/configure-open-microsoft-edge-with-shortdesc.md deleted file mode 100644 index 26dc5e0d88..0000000000 --- a/windows/client-management/includes.old/configure-open-microsoft-edge-with-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge loads a specific page or pages defined in the Configure Start Pages policy and allows users to make changes. With this policy, you can configure Microsoft Edge to load the Start page, New Tab page, or the previously opened pages. You can also configure Microsoft Edge to prevent users from changing or customizing the Start page. For this policy to work correctly, you must also configure the Configure Start Pages. If you want to prevent users from making changes, don’t configure the Disable Lockdown of Start Pages policy. diff --git a/windows/client-management/includes.old/configure-password-manager-shortdesc.md b/windows/client-management/includes.old/configure-password-manager-shortdesc.md deleted file mode 100644 index f0b41c5b0f..0000000000 --- a/windows/client-management/includes.old/configure-password-manager-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge uses Password Manager automatically, allowing users to manager passwords locally. Disabling this policy restricts Microsoft Edge from using Password Manager. Don’t configure this policy if you want to let users choose to save and manage passwords locally using Password Manager. diff --git a/windows/client-management/includes.old/configure-pop-up-blocker-shortdesc.md b/windows/client-management/includes.old/configure-pop-up-blocker-shortdesc.md deleted file mode 100644 index a34c788e1e..0000000000 --- a/windows/client-management/includes.old/configure-pop-up-blocker-shortdesc.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge turns off Pop-up Blocker, which opens pop-up windows. Enabling this policy turns on Pop-up Blocker preventing pop-up windows from opening. If you want users to choose to use Pop-up Blocker, don’t configure this policy. - diff --git a/windows/client-management/includes.old/configure-search-suggestions-in-address-bar-shortdesc.md b/windows/client-management/includes.old/configure-search-suggestions-in-address-bar-shortdesc.md deleted file mode 100644 index 71b3e06d0d..0000000000 --- a/windows/client-management/includes.old/configure-search-suggestions-in-address-bar-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, users can choose to see search suggestions in the Address bar of Microsoft Edge. Disabling this policy hides the search suggestions and enabling this policy shows the search suggestions. diff --git a/windows/client-management/includes.old/configure-start-pages-shortdesc.md b/windows/client-management/includes.old/configure-start-pages-shortdesc.md deleted file mode 100644 index 76e4a07003..0000000000 --- a/windows/client-management/includes.old/configure-start-pages-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge loads the pages specified in App settings as the default Start pages. With this policy, you can configure one or more Start pages when you enable this policy and enable the Configure Open Microsoft Edge With policy. Once you set the Start pages, either in this policy or Configure Open Microsoft Edge With policy, users can't make changes. diff --git a/windows/client-management/includes.old/configure-windows-defender-smartscreen-shortdesc.md b/windows/client-management/includes.old/configure-windows-defender-smartscreen-shortdesc.md deleted file mode 100644 index 1682bc2ca2..0000000000 --- a/windows/client-management/includes.old/configure-windows-defender-smartscreen-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge uses Windows Defender SmartScreen (turned on) to protect users from potential phishing scams and malicious software by default. Also, by default, users can't disable (turn off) Windows Defender SmartScreen. Enabling this policy turns on Windows Defender SmartScreen and prevent users from turning it off. Don’t configure this policy to let users choose to turn Windows defender SmartScreen on or off. diff --git a/windows/client-management/includes.old/disable-lockdown-of-start-pages-shortdesc.md b/windows/client-management/includes.old/disable-lockdown-of-start-pages-shortdesc.md deleted file mode 100644 index 12bcdd34b8..0000000000 --- a/windows/client-management/includes.old/disable-lockdown-of-start-pages-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, the Start pages configured in either the Configure Start Pages policy or Configure Open Microsoft Edge policies can't be changed, and they remain locked down. Enabling this policy unlocks the Start pages, and lets users make changes to either all configured Start pages or any Start page configured with the Configure Start pages policy. diff --git a/windows/client-management/includes.old/do-not-sync-browser-settings-shortdesc.md b/windows/client-management/includes.old/do-not-sync-browser-settings-shortdesc.md deleted file mode 100644 index b269a7f3e3..0000000000 --- a/windows/client-management/includes.old/do-not-sync-browser-settings-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, the “browser” group syncs automatically between user’s devices and allowing users to choose to make changes. The “browser” group uses the _Sync your Settings_ option in Settings to sync information like history and favorites. Enabling this policy prevents the “browser” group from using the Sync your Settings option. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option. diff --git a/windows/client-management/includes.old/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md b/windows/client-management/includes.old/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md deleted file mode 100644 index 0b377e56b6..0000000000 --- a/windows/client-management/includes.old/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge does not sync the user’s favorites between IE and Microsoft Edge. Enabling this policy syncs favorites between Internet Explorer and Microsoft Edge. Changes to favorites in one browser reflect in the other, including additions, deletions, modifications, and ordering of favorites. diff --git a/windows/client-management/includes.old/prevent-access-to-about-flags-page-shortdesc.md b/windows/client-management/includes.old/prevent-access-to-about-flags-page-shortdesc.md deleted file mode 100644 index d5f609cfa6..0000000000 --- a/windows/client-management/includes.old/prevent-access-to-about-flags-page-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, users can access the about:flags page in Microsoft Edge that is used to change developer settings and enable experimental features. Enabling this policy prevents users from accessing the about:flags page. diff --git a/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md b/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md deleted file mode 100644 index f6b222fde2..0000000000 --- a/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge allows users to bypass (ignore) the Windows Defender SmartScreen warnings about potentially malicious files, allowing them to continue downloading the unverified file(s). Enabling this policy prevents users from bypassing the warnings, blocking them from downloading of the unverified file(s). diff --git a/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md b/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md deleted file mode 100644 index d04429bef8..0000000000 --- a/windows/client-management/includes.old/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge allows users to bypass (ignore) the Windows Defender SmartScreen warnings about potentially malicious sites, allowing them to continue to the site. With this policy though, you can configure Microsoft Edge to prevent users from bypassing the warnings, blocking them from continuing to the site. diff --git a/windows/client-management/includes.old/prevent-certificate-error-overrides-shortdesc.md b/windows/client-management/includes.old/prevent-certificate-error-overrides-shortdesc.md deleted file mode 100644 index c73e676517..0000000000 --- a/windows/client-management/includes.old/prevent-certificate-error-overrides-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge, by default, allows overriding of the security warnings to sites that have SSL errors, bypassing or ignoring certificate errors. Enabling this policy prevents overriding of the security warnings. diff --git a/windows/client-management/includes.old/prevent-changes-to-favorites-shortdesc.md b/windows/client-management/includes.old/prevent-changes-to-favorites-shortdesc.md deleted file mode 100644 index b635ee64e8..0000000000 --- a/windows/client-management/includes.old/prevent-changes-to-favorites-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, users can add, import, and make changes to the Favorites list in Microsoft Edge. Enabling this policy locks down the Favorites list in Microsoft Edge, preventing users from making changes. When enabled, Microsoft Edge turns off the Save a Favorite, Import settings, and context menu items, such as Create a new folder. Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. diff --git a/windows/client-management/includes.old/prevent-edge-from-gathering-live-tile-info-shortdesc.md b/windows/client-management/includes.old/prevent-edge-from-gathering-live-tile-info-shortdesc.md deleted file mode 100644 index bba9ec1ad5..0000000000 --- a/windows/client-management/includes.old/prevent-edge-from-gathering-live-tile-info-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge collects the Live Tile metadata and sends it to Microsoft to help provide users a complete experience when they pin Live Tiles to the Start menu. However, with this policy, you can configure Microsoft Edge to prevent Microsoft from collecting Live Tile metadata, providing users with a limited experience. diff --git a/windows/client-management/includes.old/prevent-first-run-webpage-from-opening-shortdesc.md b/windows/client-management/includes.old/prevent-first-run-webpage-from-opening-shortdesc.md deleted file mode 100644 index c156c94126..0000000000 --- a/windows/client-management/includes.old/prevent-first-run-webpage-from-opening-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, when launching Microsoft Edge for the first time, the First Run webpage (a welcome page) hosted on Microsoft.com loads automatically via an FWLINK. The welcome page lists the new features and helpful tips of Microsoft Edge. With this policy, you can configure Microsoft Edge to prevent loading the welcome page on first explicit user-launch. diff --git a/windows/client-management/includes.old/prevent-turning-off-required-extensions-shortdesc.md b/windows/client-management/includes.old/prevent-turning-off-required-extensions-shortdesc.md deleted file mode 100644 index 4209d79579..0000000000 --- a/windows/client-management/includes.old/prevent-turning-off-required-extensions-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -The Microsoft Edge browser allows users to uninstall extensions, by default. When the users work with extensions that come under a policy that is enabled, they can configure options for extensions defined in this policy, such as allowing InPrivate browsing. Any extra permissions requested by future updates of the extension get granted automatically. If - at this stage - you disable the policy, the list of extension package family names (PFNs) defined in this policy get ignored. diff --git a/windows/client-management/includes.old/prevent-users-to-turn-on-browser-syncing-shortdesc.md b/windows/client-management/includes.old/prevent-users-to-turn-on-browser-syncing-shortdesc.md deleted file mode 100644 index 037c535aa8..0000000000 --- a/windows/client-management/includes.old/prevent-users-to-turn-on-browser-syncing-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. With this policy, though, you can prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. For this policy to work correctly, you must enable the Do not sync browser policy. diff --git a/windows/client-management/includes.old/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md b/windows/client-management/includes.old/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md deleted file mode 100644 index fe0bc3c307..0000000000 --- a/windows/client-management/includes.old/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge shows localhost IP address while making calls through usage of the WebRTC protocol. Enabling this policy hides the localhost IP addresses. diff --git a/windows/client-management/includes.old/provision-favorites-shortdesc.md b/windows/client-management/includes.old/provision-favorites-shortdesc.md deleted file mode 100644 index 6f47ca66c4..0000000000 --- a/windows/client-management/includes.old/provision-favorites-shortdesc.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -You can customize the Favorites list in the Microsoft Edge browser. Customization of the favorites list includes: - -- Creating a standard list - - This standard list includes: - - Folders (which you can add) - - the list of favorites that you manually add, after creating the standard list - -This customized favorite is the final version. - - diff --git a/windows/client-management/includes.old/send-all-intranet-sites-to-ie-shortdesc.md b/windows/client-management/includes.old/send-all-intranet-sites-to-ie-shortdesc.md deleted file mode 100644 index 3b17cd7e5f..0000000000 --- a/windows/client-management/includes.old/send-all-intranet-sites-to-ie-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, all websites, including intranet sites, open in Microsoft Edge automatically. Only enable this policy if there are known compatibility problems with Microsoft Edge. Enabling this policy loads only intranet sites in Internet Explorer 11 automatically. diff --git a/windows/client-management/includes.old/set-default-search-engine-shortdesc.md b/windows/client-management/includes.old/set-default-search-engine-shortdesc.md deleted file mode 100644 index 958dd67138..0000000000 --- a/windows/client-management/includes.old/set-default-search-engine-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge uses the search engine specified in App settings, letting users make changes at any time unless the Allow search engine customization policy is disabled, which restricts users from making changes. With this policy, you can either remove or use the policy-set search engine. When you remove the policy-set search engine, Microsoft Edge uses the specified search engine for the market, which lets users make changes to the default search engine. You can use the policy-set search engine specified in the OpenSearch XML, which prevents users from making changes. diff --git a/windows/client-management/includes.old/set-home-button-url-shortdesc.md b/windows/client-management/includes.old/set-home-button-url-shortdesc.md deleted file mode 100644 index 67e62738a6..0000000000 --- a/windows/client-management/includes.old/set-home-button-url-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, Microsoft Edge shows the home button and loads the Start page, and locks down the home button to prevent users from changing what page loads. Enabling this policy loads a custom URL for the home button. When you enable this policy, and enable the Configure Home Button policy with the _Show home button & set a specific page_ option selected, a custom URL loads when the user clicks the home button. diff --git a/windows/client-management/includes.old/set-new-tab-url-shortdesc.md b/windows/client-management/includes.old/set-new-tab-url-shortdesc.md deleted file mode 100644 index a909cbbdc7..0000000000 --- a/windows/client-management/includes.old/set-new-tab-url-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge loads the default New Tab page by default. Enabling this policy lets you set a New Tab page URL in Microsoft Edge, preventing users from changing it. When you enable this policy, and you disable the Allow web content on New Tab page policy, Microsoft Edge ignores any URL specified in this policy and opens about:blank. diff --git a/windows/client-management/includes.old/show-message-when-opening-sites-in-ie-shortdesc.md b/windows/client-management/includes.old/show-message-when-opening-sites-in-ie-shortdesc.md deleted file mode 100644 index 5fda91f3db..0000000000 --- a/windows/client-management/includes.old/show-message-when-opening-sites-in-ie-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -Microsoft Edge does not show a notification before opening sites in Internet Explorer 11. However, with this policy, you can configure Microsoft Edge to display a notification before a site opens in IE11 or let users continue in Microsoft Edge. If you want users to continue in Microsoft Edge, enable this policy to show the _Keep going in Microsoft Edge_ link in the notification. For this policy to work correctly, you must also enable the Configure the Enterprise Mode Site List or Send all intranet sites to Internet Explorer 11, or both. diff --git a/windows/client-management/includes.old/unlock-home-button-shortdesc.md b/windows/client-management/includes.old/unlock-home-button-shortdesc.md deleted file mode 100644 index 722998c5bf..0000000000 --- a/windows/client-management/includes.old/unlock-home-button-shortdesc.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -author: dansimp -ms.author: dansimp -ms.date: 10/02/2018 -ms.reviewer: -manager: dansimp -ms.prod: edge -ms.topic: include ---- - -By default, when you enable the Configure Home Button policy or provide a URL in the Set Home Button URL policy, Microsoft Edge locks down the home button to prevent users from changing the settings. When you enable this policy, users can make changes to the home button even if you enabled the Configure Home Button or Set Home Button URL policies. From 2b78246adee3dce40c41db3db95d0f75a78c8113 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 6 Apr 2023 12:19:17 -0400 Subject: [PATCH 050/139] Add includes and redirects --- .openpublishing.redirection.json | 9 +++- ...e-active-directory-integration-with-mdm.md | 39 +--------------- .../certificate-renewal-windows-mdm.md | 2 +- ...device-automatically-using-group-policy.md | 2 +- .../includes/mdm-enrollment-error-codes.md | 46 +++++++++++++++++++ ...s-in-windows-10.md => mdm-collect-logs.md} | 0 ...rollment.md => mdm-diagnose-enrollment.md} | 6 ++- .../mdm/diagnosticlog-csp.md | 2 +- windows/client-management/toc.yml | 4 +- 9 files changed, 64 insertions(+), 46 deletions(-) create mode 100644 windows/client-management/includes/mdm-enrollment-error-codes.md rename windows/client-management/{diagnose-mdm-failures-in-windows-10.md => mdm-collect-logs.md} (100%) rename windows/client-management/{diagnose-mdm-enrollment.md => mdm-diagnose-enrollment.md} (97%) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 0bb5a99366..74ac00f780 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6696,10 +6696,15 @@ "redirect_document_id": false }, { - "source_path": "windows/client-management//register-your-free-azure-active-directory-subscription.md", + "source_path": "windows/client-management/register-your-free-azure-active-directory-subscription.md", "redirect_url": "/microsoft-365/compliance/use-your-free-azure-ad-subscription-in-office-365", "redirect_document_id": false }, + { + "source_path": "windows/client-management/diagnose-mdm-failures-in-windows-10.md", + "redirect_url": "/windows/client-management/mdm-collect-logs", + "redirect_document_id": false + }, { "source_path": "windows/client-management/mdm/policy-admx-backed.md", "redirect_url": "/windows/client-management/mdm/policy-configuration-service-provider", @@ -19837,7 +19842,7 @@ }, { "source_path": "windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md", - "redirect_url": "/windows/client-management/diagnose-mdm-failures-in-windows-10", + "redirect_url": "/windows/client-management/mdm-collect-logs", "redirect_document_id": false }, { diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index c062325002..6eb05d62cb 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -418,41 +418,4 @@ When a user is enrolled into MDM through Azure Active Directory Join and then di ## Error codes -|Code|ID|Error message| -|--- |--- |--- | -|0x80180001|"idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x80180002|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180003|"idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180004|"idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180005|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x80180006|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x80180007|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180008|"idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x80180009|"idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS|Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.| -|0x8018000A|"idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED|This device is already enrolled. You can contact your system administrator with the error code {0}.| -|0x8018000D|"idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.| -|0x8018000E|"idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| -|0x8018000F|"idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180010|"idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x80180012|"idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180013|"idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.| -|0x80180014|"idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.| -|0x80180015|"idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.| -|0x80180016|"idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW|The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180017|"idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE|The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.| -|0x80180018|"idErrorMDMLicenseError", // MENROLL_E_USERLICENSE|There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.| -|0x80180019|"idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID|Looks like the server isn't correctly configured. You can try to do this again or contact your system administrator with the error code {0}.| -|"rejectedTermsOfUse"|"idErrorRejectedTermsOfUse"|Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.| -|0x801c0001|"idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x801c0002|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| -|0x801c0003|"idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.| -|0x801c0006|"idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x801c000B|"idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED|The server being contacted isn't trusted. Contact your system administrator with the error code {0}.| -|0x801c000C|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x801c000E|"idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.| -|0x801c000F|"idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT|A reboot is required to complete device registration.| -|0x801c0010|"idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR|Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.| -|0x801c0011|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| -|0x801c0012|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| -|0x801c0013|"idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| -|0x801c0014|"idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +[!INCLUDE [Enrollment error codes](includes/mdm-enrollment-error-codes.md)] diff --git a/windows/client-management/certificate-renewal-windows-mdm.md b/windows/client-management/certificate-renewal-windows-mdm.md index 64e6ecdcb0..ad7e9b4500 100644 --- a/windows/client-management/certificate-renewal-windows-mdm.md +++ b/windows/client-management/certificate-renewal-windows-mdm.md @@ -1,7 +1,7 @@ --- title: Certificate Renewal description: Learn how to find all the resources that you need to provide continuous access to client certificates. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 34a25870dc..70ee1d76b6 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -119,7 +119,7 @@ To verify successful enrollment to MDM, go to **Start** > **Settings** > **Accou ![Work School Settings.](images/autoenrollment-settings-work-school.png) > [!NOTE] -> If you don't see the **Info** button or the enrollment information, enrollment might have failed. Check the status in [Task Scheduler app](#task-scheduler-app). +> If you don't see the **Info** button or the enrollment information, enrollment might have failed. Check the status in [Task Scheduler app](#task-scheduler-app) and see [Diagnose MDM enrollment](./mdm-diagnose-enrollment.md). ## Task Scheduler app diff --git a/windows/client-management/includes/mdm-enrollment-error-codes.md b/windows/client-management/includes/mdm-enrollment-error-codes.md new file mode 100644 index 0000000000..017a48153f --- /dev/null +++ b/windows/client-management/includes/mdm-enrollment-error-codes.md @@ -0,0 +1,46 @@ +--- +author: vinaypamnani-msft +ms.author: vinpa +ms.prod: windows +ms.topic: include +ms.date: 04/06/2023 +--- + +|Code|ID|Error message| +|--- |--- |--- | +|0x80180001|"idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x80180002|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180003|"idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180004|"idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180005|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x80180006|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x80180007|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180008|"idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x80180009|"idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS|Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.| +|0x8018000A|"idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED|This device is already enrolled. You can contact your system administrator with the error code {0}.| +|0x8018000D|"idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.| +|0x8018000E|"idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +|0x8018000F|"idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180010|"idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x80180012|"idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180013|"idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.| +|0x80180014|"idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.| +|0x80180015|"idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.| +|0x80180016|"idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW|The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180017|"idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE|The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.| +|0x80180018|"idErrorMDMLicenseError", // MENROLL_E_USERLICENSE|There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.| +|0x80180019|"idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID|Looks like the server isn't correctly configured. You can try to do this again or contact your system administrator with the error code {0}.| +|"rejectedTermsOfUse"|"idErrorRejectedTermsOfUse"|Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.| +|0x801c0001|"idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x801c0002|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +|0x801c0003|"idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.| +|0x801c0006|"idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x801c000B|"idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED|The server being contacted isn't trusted. Contact your system administrator with the error code {0}.| +|0x801c000C|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x801c000E|"idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.| +|0x801c000F|"idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT|A reboot is required to complete device registration.| +|0x801c0010|"idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR|Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.| +|0x801c0011|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +|0x801c0012|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}| +|0x801c0013|"idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| +|0x801c0014|"idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.| diff --git a/windows/client-management/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm-collect-logs.md similarity index 100% rename from windows/client-management/diagnose-mdm-failures-in-windows-10.md rename to windows/client-management/mdm-collect-logs.md diff --git a/windows/client-management/diagnose-mdm-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md similarity index 97% rename from windows/client-management/diagnose-mdm-enrollment.md rename to windows/client-management/mdm-diagnose-enrollment.md index 0a2b47a214..d7f7ab6de7 100644 --- a/windows/client-management/diagnose-mdm-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -70,7 +70,7 @@ To ensure that the auto-enrollment feature is working as expected, you must veri ## Troubleshoot auto-enrollment using group policy -Investigate the logs if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows device. To collect Event Viewer logs: +Investigate the logs if you have issues even after performing all the verification steps. The first log file to investigate is the event log on the target Windows device. To collect Event Viewer logs: 1. Open Event Viewer. @@ -120,3 +120,7 @@ If you can't find event ID 75 in the logs, it indicates that the auto-enrollment A resolution to this issue is to remove the registry key manually. If you don't know which registry key to remove, go for the key that displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: + +## Error codes + +[!INCLUDE [Enrollment error codes](includes/mdm-enrollment-error-codes.md)] diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 34dbe6281b..19f240cd0e 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -498,7 +498,7 @@ For each channel node, the user can: - Enable or disable the channel from Event Log service to allow or disallow event data being written into the channel. - Specify an XPath query to filter events while exporting the channel event data. -For more information about using DiagnosticLog to collect logs remotely from a PC or mobile device, see [Diagnose MDM failures in Windows 10](../diagnose-mdm-failures-in-windows-10.md). +For more information about using DiagnosticLog to collect logs remotely from a PC or mobile device, see [Collect MDM logs](../mdm-collect-logs.md). diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 13f9e2cfa4..3dadcc07b4 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -57,9 +57,9 @@ items: - name: Diagnose MDM failures items: - name: Collect MDM logs - href: diagnose-mdm-failures-in-windows-10.md + href: mdm-collect-logs.md - name: Diagnose MDM enrollment - href: diagnose-mdm-enrollment.md + href: mdm-diagnose-enrollment.md - name: Configuration service provider reference href: mdm/index.yml - name: Client management tools and settings From eb8562c1c746b865982c089d7c2cf2933957da2a Mon Sep 17 00:00:00 2001 From: rekhanr <40372231+rekhanr@users.noreply.github.com> Date: Fri, 7 Apr 2023 15:53:39 -0700 Subject: [PATCH 051/139] Update windows-autopatch-windows-update.md New verbiage proposed per internal discussion. --- .../operate/windows-autopatch-windows-update.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md index 6bc2b3018b..2434233e74 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md @@ -53,9 +53,11 @@ However, if an update has already started for a particular deployment ring, Wind #### Scheduled install > [!NOTE] -> This feature isn't suitable for business critical workloads because Windows Autopatch cannot guarantee that devices will always update and restart in the specified time.

If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective).

+>

If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective).

-While the Windows Autopatch default options will meet the majority of the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. The **Scheduled install** cadence type will prevent forced restarts and interruptions to critical business activities for end users, thereby minimizing disruptions. Upon selecting the **Scheduled install** cadence type, any previously set deadlines and grace periods will be removed. The expectation is that devices would only update and restart according to the time specified. +While the Windows Autopatch default options will meet the majority of the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. The **Scheduled install** cadence type will prevent forced restarts and interruptions to critical business activities for end users, thereby minimizing disruptions. Upon selecting the **Scheduled install** cadence type, any previously set deadlines and grace periods will be removed. The expectation is that devices would only update and restart according to the time specified. + +Scheduled install will ensure that Windows Updates will only cause a device to restart in your specified time windows. If other applications trigger a device restart outside of these windows and a Windows update is pending a restart, the Windows update will complete its installation at this time. For this reason, ensure that you consider your update and restart scenarios for devices running business critical or restart sensitive workloads before using Scheduled Install. > [!NOTE] > The compliance deadline and grace period for Windows quality updates won't be configured for the Scheduled Install cadence type. From a59249e49546a1bff0bc1bc35e863f04765e9ef0 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 10 Apr 2023 11:02:14 -0400 Subject: [PATCH 052/139] Changes --- ...ollment-using-windows-provisioning-tool.md | 2 +- .../client-tools/windows-libraries.md | 4 +- windows/client-management/config-lock.md | 2 +- windows/client-management/mdm-known-issues.md | 247 +++++++++++++++++ windows/client-management/mdm-overview.md | 20 ++ ...ew-in-windows-mdm-enrollment-management.md | 252 ------------------ windows/client-management/toc.yml | 6 +- 7 files changed, 276 insertions(+), 257 deletions(-) create mode 100644 windows/client-management/mdm-known-issues.md diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index 763c220611..c7c6829f18 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -40,7 +40,7 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro ## What you need -- Windows 10 devices. +- Windows devices. - Windows Configuration Designer (WCD) tool. To get the WCD tool, download from the [Microsoft Store](https://www.microsoft.com/store/productId/9NBLGGH4TX22). For more information about the WCD tool, see [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd) and [Getting started with Windows WCD](/windows/configuration/provisioning-packages/provisioning-install-icd). diff --git a/windows/client-management/client-tools/windows-libraries.md b/windows/client-management/client-tools/windows-libraries.md index bc71a7b58e..c2a6a61609 100644 --- a/windows/client-management/client-tools/windows-libraries.md +++ b/windows/client-management/client-tools/windows-libraries.md @@ -1,5 +1,5 @@ --- -ms.reviewer: +ms.reviewer: manager: aaroncz title: Windows Libraries ms.prod: windows-client @@ -13,6 +13,8 @@ ms.date: 09/15/2021 appliesto: - ✅ Windows 11 - ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 - ✅ Windows Server 2016 --- diff --git a/windows/client-management/config-lock.md b/windows/client-management/config-lock.md index a901d37738..2e86f60f6a 100644 --- a/windows/client-management/config-lock.md +++ b/windows/client-management/config-lock.md @@ -75,7 +75,7 @@ Config lock is designed to ensure that a secured-core PC isn't unintentionally m - Can I disable config lock? Yes. You can use MDM to turn off config lock completely or put it in temporary unlock mode for helpdesk activities. -### List of locked policies +## List of locked policies |**CSPs** | |-----| diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md new file mode 100644 index 0000000000..22fe7ba116 --- /dev/null +++ b/windows/client-management/mdm-known-issues.md @@ -0,0 +1,247 @@ +--- +title: Known issues in MDM +description: Learn about known issues for Windows devices in MDM +ms.reviewer: +manager: aaroncz +ms.author: vinpa +ms.topic: article +ms.prod: windows-client +ms.technology: itpro-manage +author: vinaypamnani-msft +ms.date: 04/10/2023 +ms.collection: +- highpri +- tier2 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +--- + +# Known issues + +## Get command inside an atomic command isn't supported + +In Windows 10 and Windows 11, a Get command inside an atomic command isn't supported. + +## Apps installed using WMI classes are not removed + +Applications installed using WMI classes aren't removed when the MDM account is removed from device. + +## Passing CDATA in SyncML does not work + +Passing CDATA in data in SyncML to ConfigManager and CSPs doesn't work in Windows 10 and Windows 11. + +## SSL settings in IIS server for SCEP must be set to "Ignore" + +The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10 and Windows 11. + +![ssl settings.](images/ssl-settings.png) + +## MDM enrollment fails on the Windows device when traffic is going through proxy + +When the Windows device is configured to use a proxy that requires authentication, the enrollment will fail. To work around this issue, the user can use a proxy that doesn't require authentication or remove the proxy setting from the connected network. + +## Server-initiated unenrollment failure + +Server-initiated unenrollment for a device enrolled by adding a work account silently fails to leave the MDM account active. MDM policies and resources are still in place and the client can continue to sync with the server. + +Remote server unenrollment is disabled for mobile devices enrolled via Azure Active Directory Join. It returns an error message to the server. The only way to remove enrollment for a mobile device that is Azure AD joined is by remotely wiping the device. + +## Certificates causing issues with Wi-Fi and VPN + +In Windows 10 and Windows 11, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This dual installation may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We're working to fix this issue. + +## Version information for Windows 11 + +The software version information from **DevDetail/Ext/Microsoft/OSPlatform** doesn't match the version in **Settings** under **System/About**. + +## Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 and Windows 11 + +In your deployment, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned doesn't have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. The solution is to ensure that the Wi-Fi profile provisioned has strict filtering criteria such that it matches only one certificate. + +Enterprises deploying certificate-based EAP authentication for VPN/Wi-Fi can face a situation where there are multiple certificates that meet the default criteria for authentication. This situation can lead to issues such as: + +- The user may be prompted to select the certificate. +- The wrong certificate may get auto selected and cause an authentication failure. + +A production ready deployment must have the appropriate certificate details as part of the profile being deployed. The following information explains how to create or update an EAP Configuration XML such that the extraneous certificates are filtered out and the appropriate certificate can be used for the authentication. + +EAP XML must be updated with relevant information for your environment. This task can be done either manually by editing the XML sample below, or by using the step by step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows: + +- For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This detail is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags, you'll find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM's guidance on how to deploy a new Wi-Fi profile. +- For VPN, EAP Configuration is a separate field in the MDM Configuration. Work with your MDM provider to identify and update the appropriate Field. + +For information about EAP Settings, see . + +For information about generating an EAP XML, see [EAP configuration](mdm/eap-configuration.md). + +For more information about extended key usage, see . + +For information about adding extended key usage (EKU) to a certificate, see . + +The following list describes the prerequisites for a certificate to be used with EAP: + +- The certificate must have at least one of the following EKU (Extended Key Usage) properties: + - Client Authentication. + - As defined by RFC 5280, this property is a well-defined OID with Value 1.3.6.1.5.5.7.3.2. + - Any Purpose. + - An EKU, defined and published by Microsoft, is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that other non-critical or custom EKUs can still be added to the certificate for effective filtering. + - All Purpose. + - As defined by RFC 5280, If a CA includes extended key usages to satisfy some application needs, but doesn't want to restrict usage of the key, the CA can add an Extended Key Usage Value of 0. A certificate with such an EKU can be used for all purposes. +- The user or the computer certificate on the client chains to a trusted root CA. +- The user or the computer certificate doesn't fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy. +- The user or the computer certificate doesn't fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server. +- The Subject Alternative Name (SubjectAltName) extension in the certificate contains the user principal name (UPN) of the user. + +The following XML sample explains the properties for the EAP TLS XML including certificate filtering. + +> [!NOTE] +> For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. + +```xml + + + 13 + + + 0 + 0 + 0 + + + + + + + 13 + + + + + true + + + + + + + false + + + false + false + false + + + + + + ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + + + + + + + + + + + ContostoITEKU + + 1.3.6.1.4.1.311.42.1.15 + + + + + + + + + ContostoITEKU + + + + + Example1 + + + true + + + + + + + + + + + +``` + +> [!NOTE] +> The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** + +Alternatively you can use the following procedure to create an EAP Configuration XML. + +1. Follow steps 1 through 7 in [EAP configuration](mdm/eap-configuration.md). + +1. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop-down menu (this drop-down menu selects EAP TLS.). + + :::image type="content" alt-text="vpn selfhost properties window." source="images/certfiltering1.png"::: + + > [!NOTE] + > For PEAP or TTLS, select the appropriate method and continue following this procedure. + +1. Click the **Properties** button underneath the drop-down menu. + +1. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. + + :::image type="content" alt-text="smart card or other certificate properties window." source="images/certfiltering2.png"::: + +1. In the **Configure Certificate Selection** menu, adjust the filters as needed. + + :::image type="content" alt-text="configure certificate selection window." source="images/certfiltering3.png"::: + +1. Click **OK** to close the windows to get back to the main `rasphone.exe` dialog box. + +1. Close the rasphone dialog box. + +1. Continue following the procedure in [EAP configuration](mdm/eap-configuration.md) from Step 9 to get an EAP TLS profile with appropriate filtering. + +> [!NOTE] +> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)). + +## MDM client will immediately check in with the MDM server after client renews WNS channel URI + +After the MDM client automatically renews the WNS channel URI, the MDM client will immediately check in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. + +## User provisioning failure in Azure Active Directory-joined Windows 10 and Windows 11 devices + +In Azure AD joined Windows 10 and Windows 11, provisioning /.User resources fails when the user isn't logged in as an Azure AD user. If you attempt to join Azure AD from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Azure AD credentials to get your organizational configuration from your MDM server. This behavior is by design. + +## Requirements to note for VPN certificates also used for Kerberos Authentication + +If you want to use the certificate used for VPN authentication also for Kerberos authentication (required if you need access to on-premises resources using NTLM or Kerberos), the user's certificate must meet the requirements for smart card certificate, the Subject field should contain the DNS domain name in the DN or the SAN should contain a fully qualified UPN so that the DC can be located from the DNS registrations. If certificates that don't meet these requirements are used for VPN, users may fail to access resources that require Kerberos authentication. + +## Device management agent for the push-button reset is not working + +The DM agent for [push-button reset](/windows-hardware/manufacture/desktop/push-button-reset-overview) keeps the registry settings for OMA DM sessions, but deletes the task schedules. The client enrollment is retained, but it never syncs with the MDM service. diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index c741f52e64..7136528023 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -55,3 +55,23 @@ For more information about the MDM policies defined in the MDM security baseline - [MDM Security baseline for Windows 10, version 1809](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1809-MDM-SecurityBaseLine-Document-[Preview].zip) For information about the MDM policies defined in the Intune security baseline, see [Windows security baseline settings for Intune](/mem/intune/protect/security-baseline-settings-mdm-all). + +## Frequently Asked Questions + +### Can there be more than one MDM server to enroll and manage devices in Windows 10 or 11? + +No. Only one MDM is allowed. + +### How do I set the maximum number of Azure Active Directory-joined devices per user? + +1. Sign in to the portal as tenant admin: . +1. Navigate to **Azure AD**, then **Devices**, and then click **Device Settings**. +1. Change the number under **Maximum number of devices per user**. + +### What is dmwappushsvc? + +| Entry | Description | +| --------------- | -------------------- | +| What is dmwappushsvc? | It's a Windows service that ships in Windows 10 and Windows 11 operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | +| What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further. This service doesn't send telemetry. | +| How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc) and locating *Device Management Wireless Application Protocol (WAP) Push message Routing Service*. However, since this service is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service will cause your management to fail. | diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index 4309b6be4d..a948e85150 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -93,255 +93,3 @@ For details about Microsoft mobile device management protocols for Windows 10 an | [WindowsDefenderApplicationGuard CSP](mdm/windowsdefenderapplicationguard-csp.md) | Added new settings. | | [WindowsLicensing CSP](mdm/windowslicensing-csp.md) | Added S mode settings and SyncML examples. | | [Win32CompatibilityAppraiser CSP](mdm/win32compatibilityappraiser-csp.md) | New CSP. | - -## Breaking changes and known issues - -### Get command inside an atomic command isn't supported - -In Windows 10 and Windows 11, a Get command inside an atomic command isn't supported. - -### Apps installed using WMI classes are not removed - -Applications installed using WMI classes aren't removed when the MDM account is removed from device. - -### Passing CDATA in SyncML does not work - -Passing CDATA in data in SyncML to ConfigManager and CSPs doesn't work in Windows 10 and Windows 11. - -### SSL settings in IIS server for SCEP must be set to "Ignore" - -The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10 and Windows 11. - -![ssl settings.](images/ssl-settings.png) - -### MDM enrollment fails on the Windows device when traffic is going through proxy - -When the Windows device is configured to use a proxy that requires authentication, the enrollment will fail. To work around this issue, the user can use a proxy that doesn't require authentication or remove the proxy setting from the connected network. - -### Server-initiated unenrollment failure - -Server-initiated unenrollment for a device enrolled by adding a work account silently fails to leave the MDM account active. MDM policies and resources are still in place and the client can continue to sync with the server. - -Remote server unenrollment is disabled for mobile devices enrolled via Azure Active Directory Join. It returns an error message to the server. The only way to remove enrollment for a mobile device that is Azure AD joined is by remotely wiping the device. - -### Certificates causing issues with Wi-Fi and VPN - -In Windows 10 and Windows 11, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This dual installation may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We're working to fix this issue. - -### Version information for Windows 11 - -The software version information from **DevDetail/Ext/Microsoft/OSPlatform** doesn't match the version in **Settings** under **System/About**. - -### Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 and Windows 11 - -In your deployment, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned doesn't have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. The solution is to ensure that the Wi-Fi profile provisioned has strict filtering criteria such that it matches only one certificate. - -Enterprises deploying certificate-based EAP authentication for VPN/Wi-Fi can face a situation where there are multiple certificates that meet the default criteria for authentication. This situation can lead to issues such as: - -- The user may be prompted to select the certificate. -- The wrong certificate may get auto selected and cause an authentication failure. - -A production ready deployment must have the appropriate certificate details as part of the profile being deployed. The following information explains how to create or update an EAP Configuration XML such that the extraneous certificates are filtered out and the appropriate certificate can be used for the authentication. - -EAP XML must be updated with relevant information for your environment. This task can be done either manually by editing the XML sample below, or by using the step by step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows: - -- For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This detail is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags, you'll find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM's guidance on how to deploy a new Wi-Fi profile. -- For VPN, EAP Configuration is a separate field in the MDM Configuration. Work with your MDM provider to identify and update the appropriate Field. - -For information about EAP Settings, see . - -For information about generating an EAP XML, see [EAP configuration](mdm/eap-configuration.md). - -For more information about extended key usage, see . - -For information about adding extended key usage (EKU) to a certificate, see . - -The following list describes the prerequisites for a certificate to be used with EAP: - -- The certificate must have at least one of the following EKU (Extended Key Usage) properties: - - Client Authentication. - - As defined by RFC 5280, this property is a well-defined OID with Value 1.3.6.1.5.5.7.3.2. - - Any Purpose. - - An EKU, defined and published by Microsoft, is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that other non-critical or custom EKUs can still be added to the certificate for effective filtering. - - All Purpose. - - As defined by RFC 5280, If a CA includes extended key usages to satisfy some application needs, but doesn't want to restrict usage of the key, the CA can add an Extended Key Usage Value of 0. A certificate with such an EKU can be used for all purposes. -- The user or the computer certificate on the client chains to a trusted root CA. -- The user or the computer certificate doesn't fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy. -- The user or the computer certificate doesn't fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server. -- The Subject Alternative Name (SubjectAltName) extension in the certificate contains the user principal name (UPN) of the user. - -The following XML sample explains the properties for the EAP TLS XML including certificate filtering. - -> [!NOTE] -> For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. - -```xml - - - 13 - - - 0 - 0 - 0 - - - - - - - 13 - - - - - true - - - - - - - false - - - false - false - false - - - - - - ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff - - - - - - - - - - - ContostoITEKU - - 1.3.6.1.4.1.311.42.1.15 - - - - - - - - - ContostoITEKU - - - - - Example1 - - - true - - - - - - - - - - - -``` - -> [!NOTE] -> The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** - -Alternatively you can use the following procedure to create an EAP Configuration XML. - -1. Follow steps 1 through 7 in [EAP configuration](mdm/eap-configuration.md). - -1. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop-down menu (this drop-down menu selects EAP TLS.). - - :::image type="content" alt-text="vpn selfhost properties window." source="images/certfiltering1.png"::: - - > [!NOTE] - > For PEAP or TTLS, select the appropriate method and continue following this procedure. - -1. Click the **Properties** button underneath the drop-down menu. - -1. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. - - :::image type="content" alt-text="smart card or other certificate properties window." source="images/certfiltering2.png"::: - -1. In the **Configure Certificate Selection** menu, adjust the filters as needed. - - :::image type="content" alt-text="configure certificate selection window." source="images/certfiltering3.png"::: - -1. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. - -1. Close the rasphone dialog box. - -1. Continue following the procedure in [EAP configuration](mdm/eap-configuration.md) from Step 9 to get an EAP TLS profile with appropriate filtering. - -> [!NOTE] -> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)). - -### MDM client will immediately check in with the MDM server after client renews WNS channel URI - -After the MDM client automatically renews the WNS channel URI, the MDM client will immediately check in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. - -### User provisioning failure in Azure Active Directory-joined Windows 10 and Windows 11 devices - -In Azure AD joined Windows 10 and Windows 11, provisioning /.User resources fails when the user isn't logged in as an Azure AD user. If you attempt to join Azure AD from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Azure AD credentials to get your organizational configuration from your MDM server. This behavior is by design. - -### Requirements to note for VPN certificates also used for Kerberos Authentication - -If you want to use the certificate used for VPN authentication also for Kerberos authentication (required if you need access to on-premises resources using NTLM or Kerberos), the user's certificate must meet the requirements for smart card certificate, the Subject field should contain the DNS domain name in the DN or the SAN should contain a fully qualified UPN so that the DC can be located from the DNS registrations. If certificates that don't meet these requirements are used for VPN, users may fail to access resources that require Kerberos authentication. - -### Device management agent for the push-button reset is not working - -The DM agent for [push-button reset](/windows-hardware/manufacture/desktop/push-button-reset-overview) keeps the registry settings for OMA DM sessions, but deletes the task schedules. The client enrollment is retained, but it never syncs with the MDM service. - -## Frequently Asked Questions - -### Can there be more than one MDM server to enroll and manage devices in Windows 10 or 11? - -No. Only one MDM is allowed. - -### How do I set the maximum number of Azure Active Directory-joined devices per user? - -1. Sign in to the portal as tenant admin: https://portal.azure.com. -1. Select Active Directory on the left pane. -1. Choose your tenant. -1. Select **Configure**. -1. Set quota to unlimited. - - :::image type="content" alt-text="aad maximum joined devices." source="images/faq-max-devices.png"::: - -### What is dmwappushsvc? - -Entry | Description ---------------- | -------------------- What is dmwappushsvc? | It's a Windows service that ships in Windows 10 and Windows 11 operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | -What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further. This service doesn't send telemetry.| -How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc) and locating *Device Management Wireless Application Protocol (WAP) Push message Routing Service*. However, since this service is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service will cause your management to fail.| diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 3dadcc07b4..7ebeb6260b 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -52,14 +52,16 @@ items: href: config-lock.md - name: Certificate renewal href: certificate-renewal-windows-mdm.md - - name: Unenroll devices - href: disconnecting-from-mdm-unenrollment.md - name: Diagnose MDM failures items: - name: Collect MDM logs href: mdm-collect-logs.md - name: Diagnose MDM enrollment href: mdm-diagnose-enrollment.md + - name: Known issues + href: mdm-known-issues.md + - name: Unenroll devices + href: disconnecting-from-mdm-unenrollment.md - name: Configuration service provider reference href: mdm/index.yml - name: Client management tools and settings From 155cce259139ff554667e2e40aada77c5eacbccf Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 10 Apr 2023 12:06:39 -0400 Subject: [PATCH 053/139] Update --- .../push-notification-windows-mdm.md | 43 ++++--------------- 1 file changed, 8 insertions(+), 35 deletions(-) diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index e99451394d..5a99aaf004 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -49,44 +49,17 @@ To get a PFN and WNS credentials, you must create a Microsoft Store app. 1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. - ![mdm push notification1.](images/push-notification1.png) - -1. Create a new app. - - ![mdm push notification2.](images/push-notification2.png) +1. Select **Apps and games** under Workspaces. Create a **New product** and select **MSIX or PWA app**. 1. Reserve an app name. - ![mdm push notification3.](images/push-notification3.png) +1. Select **Product Identity** under Product Management to view the **Package Family Name (PFN)** of your app. -1. Click **Services**. +1. Select **WNS/MPNS** under Product Management. - ![mdm push notification4.](images/push-notification4.png) + 1. Click the **App Registration portal** link. A new window opens showing your app in the Azure Portal. + 1. In the Application Registration Portal page, you'll see the properties for the app that you created, such as: -1. Click **Push notifications**. - - ![mdm push notification5.](images/push-notification5.png) - -1. Click **Live Services site**. A new window opens for the **Application Registration Portal** page. - - ![mdm push notification6.](images/push-notification6.png) - -1. In the **Application Registration Portal** page, you'll see the properties for the app that you created, such as: - -- Application ID -- Application Secrets -- Microsoft Store Package SID, Application Identity, and Publisher. - - ![mdm push notification7.](images/push-notification7.png) - -1. Click **Save**. - -1. Close the **Application Registration Portal** window and go back to the Windows Dev Center Dashboard. - -1. Select your app from the list on the left. - -1. From the left nav, expand **App management** and then click **App identity**. - - ![mdm push notification10.](images/push-notification10.png) - -1. In the **App identity** page, you'll see the **Package Family Name (PFN)** of your app. + - Application ID + - Application Secrets + - Redirect URIs From f7d58a151e3aaecd2b84e9bd542a751fbabf362d Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 10 Apr 2023 12:19:40 -0400 Subject: [PATCH 054/139] Add WNS link --- windows/client-management/push-notification-windows-mdm.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index 5a99aaf004..85597ef13b 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -63,3 +63,5 @@ To get a PFN and WNS credentials, you must create a Microsoft Store app. - Application ID - Application Secrets - Redirect URIs + +For more information see, [Windows Push Notification Services (WNS) overview](/windows/apps/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview). From 2808899a5389cd04841ed5c948c612e02619df56 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 10 Apr 2023 12:41:12 -0400 Subject: [PATCH 055/139] Minor changes --- .../push-notification-windows-mdm.md | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index 85597ef13b..b1094d670f 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -16,13 +16,13 @@ appliesto: # Push notification support for device management -The [DMClient CSP](mdm/dmclient-csp.md) supports the ability to configure push-initiated device management sessions. Using the [Windows Notification Services (WNS)](/previous-versions/windows/apps/hh913756(v=win.10)), a management server can request a device to establish a management session with the server through a push notification. A device is provided with a PFN for an application. This provision results in the device getting configured, to support a push to it by the management server. Once the device is configured, it registers a persistent connection with the WNS cloud (Battery Sense and Data Sense conditions permitting). +The [DMClient CSP](mdm/dmclient-csp.md) supports the ability to configure push-initiated device management sessions. Using the [Windows Notification Services (WNS)](/windows/apps/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview), a management server can request a device to establish a management session with the server through a push notification. A device is provided with a PFN for an application. This provision results in the device getting configured, to support a push to it by the management server. Once the device is configured, it registers a persistent connection with the WNS cloud (Battery Sense and Data Sense conditions permitting). To initiate a device management session, the management server must first authenticate with WNS using its SID and client secret. Once authenticated, the server receives a token to initiate a raw push notification for any ChannelURI. When the management server wants to initiate a management session with a device, it can utilize the token and the device ChannelURI, and begin communicating with the device. For more information about how to get push credentials (SID and client secret) and PFN to use in WNS, see [Get WNS credentials and PFN for MDM push notification](#get-wns-credentials-and-pfn-for-mdm-push-notification). -Because a device may not always be connected to the internet, WNS supports caching notifications for delivery to the device once it reconnects. To ensure your notification is cached for delivery, set the X-WNS-Cache-Policy header to Cache. Additionally, if the server wants to send a time-bound raw push notification, the server can use the X-WNS-TTL header that will provide WNS with a time-to-live binding so that the notification will expire after the time has passed. For more information, see [Raw notification overview (Windows Runtime apps)](/previous-versions/windows/apps/jj676791(v=win.10)). +Because a device may not always be connected to the internet, WNS supports caching notifications for delivery to the device once it reconnects. To ensure your notification is cached for delivery, set the X-WNS-Cache-Policy header to Cache. Additionally, if the server wants to send a time-bound raw push notification, the server can use the X-WNS-TTL header that will provide WNS with a time-to-live binding so that the notification will expire after the time has passed. For more information, see [Raw notification overview](/windows/apps/design/shell/tiles-and-notifications/raw-notification-overview). The following restrictions are related to push notifications and WNS: @@ -31,37 +31,28 @@ The following restrictions are related to push notifications and WNS: - A ChannelURI provided to the management server by the device is only valid for 30 days. The device automatically renews the ChannelURI after 15 days and triggers a management session on successful renewal of the ChannelURI. It's strongly recommended that, during every management session, the management server queries the ChannelURI value to ensure that it has received the latest value. This will ensure that the management server won't attempt to use a ChannelURI that has expired. - Push isn't a replacement for having a polling schedule. - WNS reserves the right to block push notifications to your PFN if improper use of notifications is detected. Any devices being managed using this PFN will cease to have push initiated device management support. -- On Windows 10, version 1511 as well as Windows 8 and 8.1, MDM Push may fail to renew the WNS Push channel automatically causing it to expire. It can also potentially hang when setting the PFN for the channel. - To work around this issue, when a 410 is returned by the WNS server when attempting to send a Push notification to the device the PFN should be set during the next sync session. To prevent the push channel from expiring on older builds, servers can reset the PFN before the channel expires (~30 days). If they're already running Windows 10, there should be an update available that they can install that should fix the issue. - -- On Windows 10, version 1511, we use the following retry logic for the DMClient: +- In Windows 10, version 1511, we use the following retry logic for the DMClient: - If ExpiryTime is greater than 15 days, a schedule is set for when 15 days are left. - If ExpiryTime is between now and 15 days, a schedule set for 4 +/- 1 hours from now. - If ExpiryTime has passed, a schedule is set for 1 day +/- 4 hours from now. -- On Windows 10, version 1607, we check for network connectivity before retrying. We don't check for internet connectivity. If network connectivity isn't available, we'll skip the retry and set schedule for 4+/-1 hours to try again. +- In Windows 10, version 1607 and later, we check for network connectivity before retrying. We don't check for internet connectivity. If network connectivity isn't available, we'll skip the retry and set schedule for 4+/-1 hours to try again. ## Get WNS credentials and PFN for MDM push notification To get a PFN and WNS credentials, you must create a Microsoft Store app. 1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. - 1. Select **Apps and games** under Workspaces. Create a **New product** and select **MSIX or PWA app**. - 1. Reserve an app name. - 1. Select **Product Identity** under Product Management to view the **Package Family Name (PFN)** of your app. - 1. Select **WNS/MPNS** under Product Management. - 1. Click the **App Registration portal** link. A new window opens showing your app in the Azure Portal. 1. In the Application Registration Portal page, you'll see the properties for the app that you created, such as: - - Application ID - Application Secrets - Redirect URIs -For more information see, [Windows Push Notification Services (WNS) overview](/windows/apps/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview). +For more information see, [Tutorial: Send notifications to Universal Windows Platform apps using Azure Notification Hubs](/azure/notification-hubs/notification-hubs-windows-store-dotnet-get-started-wns-push-notification). From 395b6619c1f9f0da35d5f19aa11cdda375eac111 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 10 Apr 2023 15:39:35 -0400 Subject: [PATCH 056/139] More updates --- .../mdm-enrollment-of-windows-devices.md | 143 +++++------------- 1 file changed, 42 insertions(+), 101 deletions(-) diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index ea1befa0ad..23b7450366 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -26,71 +26,12 @@ In today's cloud-first world, enterprise IT departments increasingly want to let ## Connect corporate-owned Windows devices -You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 doesn't require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. +You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows doesn't require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. ![active directory azure ad signin.](images/unifiedenrollment-rs1-1.png) -### Connect your device to an Active Directory domain (join a domain) - -Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education can be connected to an Active Directory domain using the Settings app. - > [!NOTE] -> Mobile devices can't be connected to an Active Directory domain. - -#### Out-of-box-experience - -Joining your device to an Active Directory domain during the out-of-box-experience (OOBE) isn't supported. To join a domain: - -1. On the **Who Owns this PC?** page, select **My work or school owns it**. - - ![oobe creation of a local account](images/unifiedenrollment-rs1-2.png) - -1. Next, select **Join a domain**. - - ![select domain or azure-ad](images/unifiedenrollment-rs1-3.png) - -1. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. - - ![create pc account.](images/unifiedenrollment-rs1-4.png) - -#### Use the Settings app - -To create a local account and connect the device: - -1. Launch the Settings app. - - ![windows settings screen](images/unifiedenrollment-rs1-5.png) - -1. Next, select **Accounts**. - - ![windows settings accounts chosen](images/unifiedenrollment-rs1-6.png) - -1. Navigate to **Access work or school**. - - ![choose access work or school](images/unifiedenrollment-rs1-7.png) - -1. Select **Connect**. - - ![connect to work or to school](images/unifiedenrollment-rs1-8.png) - -1. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. - - ![join account to active directory domain.](images/unifiedenrollment-rs1-9.png) - -1. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. - - ![type in domain name.](images/unifiedenrollment-rs1-10.png) - -#### Help with connecting to an Active Directory domain - -There are a few instances where your device can't be connected to an Active Directory domain. - -| Connection issue | Description | -|-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Your device is already connected to an Active Directory domain. | Your device can only be connected to a single Active Directory domain at a time. | -| Your device is connected to an Azure AD domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You can't connect to both simultaneously. | -| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You'll need to switch to an administrator account to continue. | -| Your device is running Windows 10 Home. | This feature isn't available on Windows 10 Home, so you'll be unable to connect to an Active Directory domain. You'll need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | +> For devices joined to on-premises Active Directory, see [Group policy enrollment](enroll-a-windows-10-device-automatically-using-group-policy.md). ### Connect your device to an Azure AD domain (join Azure AD) @@ -112,7 +53,9 @@ To join a domain: If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you'll be able to enter your password directly on this page. If the tenant is part of a federated domain, you'll be redirected to the organization's on-premises federation server, such as Active Directory Federation Services (AD FS) for authentication. - Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to connect your device to MDM. After you complete the flow, your device will be connected to your organization's Azure AD domain. + Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. + + If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to [connect your device to MDM](#enroll-in-device-management-only). After you complete the flow, your device will be connected to your organization's Azure AD domain. ![azure ad signin.](images/unifiedenrollment-rs1-13.png) @@ -144,7 +87,7 @@ To create a local account and connect the device: ![azure ad sign in.](images/unifiedenrollment-rs1-19.png) -1. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. + If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you're redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. @@ -158,20 +101,20 @@ To create a local account and connect the device: There are a few instances where your device can't be connected to an Azure AD domain. -| Connection issue | Description | -|-----------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Your device is connected to an Azure AD domain. | Your device can only be connected to a single Azure AD domain at a time. | -| Your device is already connected to an Active Directory domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You can't connect to both simultaneously. | -| Your device already has a user connected to a work account. | You can either connect to an Azure AD domain or connect to a work or school account. You can't connect to both simultaneously. | -| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You'll need to switch to an administrator account to continue. | -| Your device is already managed by MDM. | The connect to Azure AD flow will attempt to enroll your device into MDM if your Azure AD tenant has a preconfigured MDM endpoint. Your device must be unenrolled from MDM to be able to connect to Azure AD in this case. | -| Your device is running Windows 10 Home. | This feature isn't available on Windows 10 Home, so you'll be unable to connect to an Azure AD domain. You'll need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | +| Connection issue | Description | +|--|--| +| Your device is connected to an Azure AD domain. | Your device can only be connected to a single Azure AD domain at a time. | +| Your device is already connected to an Active Directory domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You can't connect to both simultaneously. | +| Your device already has a user connected to a work account. | You can either connect to an Azure AD domain or connect to a work or school account. You can't connect to both simultaneously. | +| You're logged in as a standard user. | Your device can only be connected to an Azure AD domain if you're logged in as an administrative user. You'll need to switch to an administrator account to continue. | +| Your device is already managed by MDM. | The connect to Azure AD flow will attempt to enroll your device into MDM if your Azure AD tenant has a preconfigured MDM endpoint. Your device must be unenrolled from MDM to be able to connect to Azure AD in this case. | +| Your device is running Home edition. | This feature isn't available on Windows Home edition, so you'll be unable to connect to an Azure AD domain. You'll need to upgrade to Pro, Enterprise, or Education edition to continue. | ## Connect personally owned devices -Personally owned devices, also known as bring your own device (BYOD), can be connected to a work or school account, or to MDM. Windows 10 doesn't require a personal Microsoft account on devices to connect to work or school. +Personally owned devices, also known as bring your own device (BYOD), can be connected to a work or school account, or to MDM. Windows devices don't require a personal Microsoft account on devices to connect to work or school. -All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. +All Windows devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. ### Register device in AAD and enroll in MDM @@ -197,7 +140,7 @@ To create a local account and connect the device: Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to connect your device to MDM. + If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to [connect your device to MDM](#enroll-in-device-management-only). Starting in Windows 10, version 1709, you'll see the status page that shows the progress of your device being set up. @@ -207,9 +150,21 @@ To create a local account and connect the device: ![account successfully added.](images/unifiedenrollment-rs1-27.png) -### Enroll in device management only +### Help with connecting personally owned devices -All Windows 10-based devices can be connected to MDM. You can connect to an MDM through the Settings app. To create a local account and connect the device: +There are a few instances where your device may not be able to connect to work. + +| Error Message | Description | +|--|--| +| Your device is already connected to your organization's cloud. | Your device is already connected to either Azure AD, a work or school account, or an AD domain. | +| We couldn't find your identity in your organization's cloud. | The username you entered wasn't found on your Azure AD tenant. | +| Your device is already being managed by an organization. | Your device is either already managed by MDM or Microsoft Configuration Manager. | +| You don't have the right privileges to perform this operation. Talk to your admin. | You can't enroll your device into MDM as a standard user. You must be on an administrator account. | +| We couldn't auto-discover a management endpoint matching the username entered. Check your username and try again. If you know the URL to your management endpoint, enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | + +## Enroll in device management only + +All Windows devices can be connected to MDM. You can connect to an MDM through the Settings app. To create a local account and connect the device: 1. Launch the Settings app. @@ -223,7 +178,7 @@ All Windows 10-based devices can be connected to MDM. You can connect to an MDM ![access work or school.](images/unifiedenrollment-rs1-30.png) -1. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-device-to-work-using-a-deep-link). +1. Select the **Enroll only in device management** link. ![connect to work or school screen](images/unifiedenrollment-rs1-31.png) @@ -239,33 +194,19 @@ All Windows 10-based devices can be connected to MDM. You can connect to an MDM After you complete the flow, your device will be connected to your organization's MDM. -### Help with connecting personally owned devices - -There are a few instances where your device may not be able to connect to work. - -| Error Message | Description | -|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Your device is already connected to your organization's cloud. | Your device is already connected to either Azure AD, a work or school account, or an AD domain. | -| We couldn't find your identity in your organization's cloud. | The username you entered wasn't found on your Azure AD tenant. | -| Your device is already being managed by an organization. | Your device is either already managed by MDM or Microsoft Configuration Manager. | -| You don't have the right privileges to perform this operation. Talk to your admin. | You can't enroll your device into MDM as a standard user. You must be on an administrator account. | -| We couldn't auto-discover a management endpoint matching the username entered. Check your username and try again. If you know the URL to your management endpoint, enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | - ## Connect your Windows device to work using a deep link -Windows 10-based devices may be connected to work using a deep link. Users will be able to select or open a link in a particular format from anywhere in Windows 10, and be directed to the new enrollment experience. - -In Windows 10, version 1607, deep linking will only be supported for connecting devices to MDM. It will not support adding a work or school account, joining a device to Azure AD, and joining a device to Active Directory. +Windows devices may be connected to work using a deep link. Users will be able to select or open a link in a particular format from anywhere in Windows, and be directed to the new enrollment experience. The deep link used for connecting your device to work will always use the following format. -**ms-device-enrollment:?mode={mode\_name}** +**ms-device-enrollment:?mode={mode\_name}**: -| Parameter | Description | Supported Value for Windows 10| -|-----------|--------------------------------------------------------------|----------------------------------------------| -| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory-joined. | -|username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string | -| servername | Specifies the MDM server URL that will be used to enroll the device. Added in Windows 10, version 1703. | string| +| Parameter | Description | Supported Value for Windows | +|--|--|--| +| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607 | Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory-joined. | +| username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string | +| servername | Specifies the MDM server URL that will be used to enroll the device. Added in Windows 10, version 1703. | string | | accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used as a token to validate the enrollment request. Added in Windows 10, version 1703. | string | | deviceidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to pass in a unique device identifier. Added in Windows 10, version 1703. | GUID | | tenantidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to identify which tenant the device or user belongs to. Added in Windows 10, version 1703. | GUID or string | @@ -284,9 +225,9 @@ The deep link used for connecting your device to work will always use the follow To connect your devices to MDM using deep links: -1. Starting with Windows 10, version 1607, create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm**, and user-friendly display text, such as **Click here to connect Windows to work**: +1. Create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm**, and user-friendly display text, such as **Click here to connect Windows to work**: - (This link will launch the flow equivalent to the Enroll into the device management option in Windows 10, version 1511.) + (This link will launch the flow equivalent to the Enroll into the device management option.) - IT admins can add this link to a welcome email that users can select to enroll into MDM. @@ -297,7 +238,7 @@ To connect your devices to MDM using deep links: - IT admins can also add this link to an internal web page that users refer to enrollment instructions. -1. After you select the link or run it, Windows 10 launches the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option in Windows 10, version 1511). +1. After you select the link or run it, Windows launches the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option). Type in your work email address. From 92ff1941e9d15a4b8bdb1e50ab39209ce96a2f01 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 10 Apr 2023 16:07:56 -0400 Subject: [PATCH 057/139] Add link --- .../client-management/mdm-enrollment-of-windows-devices.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index 23b7450366..0a0234c873 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -287,6 +287,6 @@ The **Disconnect** button can be found on all work connections. Generally, selec You can collect diagnostic logs around your work connections by going to **Settings** > **Accounts** > **Access work or school**, and then selecting the **Export your management logs** link under **Related Settings**. Next, select **Export**, and follow the path displayed to retrieve your management log files. -Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you'll see the button to create a report, as shown here. +Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you'll see the button to create a report. -![collecting enrollment management log files.](images/unifiedenrollment-rs1-37-c.png) +For more information, see [Collect MDM logs](mdm-collect-logs.md). From bde1893813b600750b547b56ae5aa2eaa28f375e Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 11 Apr 2023 18:39:52 +0530 Subject: [PATCH 058/139] Update bypass-traverse-checking.md Made changes as per the author removed users from ### Countermeasure fixes https://github.com/MicrosoftDocs/windows-itpro-docs/issues/9737 --- .../security-policy-settings/bypass-traverse-checking.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md index ccdce7a3f5..f401dbbe3c 100644 --- a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md +++ b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md @@ -89,7 +89,7 @@ The default configuration for the **Bypass traverse checking** setting is to all ### Countermeasure -Organizations that are concerned about security may want to remove the Everyone group, and perhaps the Users group, from the list of groups that have the **Bypass traverse checking** user right. Taking explicit control over traversal assignments can be an effective way to limit access to sensitive information. Access–based enumeration can also be used. If you use access–based enumeration, users can't see any folder or file to which they don't have access. For more info about this feature, see [Access-based Enumeration](/previous-versions/windows/it-pro/windows-server-2003/cc784710(v=ws.10)). +Organizations that are concerned about security may want to remove the Everyone group from the list of groups that have the **Bypass traverse checking** user right. Taking explicit control over traversal assignments can be an effective way to limit access to sensitive information. Access–based enumeration can also be used. If you use access–based enumeration, users can't see any folder or file to which they don't have access. For more info about this feature, see [Access-based Enumeration](/previous-versions/windows/it-pro/windows-server-2003/cc784710(v=ws.10)). ### Potential impact From 9cbdfad6cd6f40ebe77402459df940e41154b172 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 11 Apr 2023 10:43:19 -0400 Subject: [PATCH 059/139] Refreshed PS module --- education/windows/configure-aad-google-trust.md | 5 +++-- education/windows/federated-sign-in.md | 11 ++++++++--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/education/windows/configure-aad-google-trust.md b/education/windows/configure-aad-google-trust.md index d96b7414ca..087db4abca 100644 --- a/education/windows/configure-aad-google-trust.md +++ b/education/windows/configure-aad-google-trust.md @@ -69,10 +69,11 @@ Now that the app is configured, you must enable it for the users in Google Works ## Configure Azure AD as a Service Provider (SP) for Google Workspace The configuration of Azure AD consists of changing the authentication method for the custom DNS domains. This configuration can be done using PowerShell.\ -Using the **IdP metadata** XML file downloaded from Google Workspace, modify the *$DomainName* variable of the following script to match your environment, and then run it in an elevated PowerShell session. When prompted to authenticate to Azure AD, use the credentials of an account with the *Global Administrator* role. +Using the **IdP metadata** XML file downloaded from Google Workspace, modify the *$DomainName* variable of the following script to match your environment, and then run it in a PowerShell session. When prompted to authenticate to Azure AD, use the credentials of an account with the *Global Administrator* role. ```powershell -Install-Module Microsoft.Graph +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force +Install-Module Microsoft.Graph -Scope CurrentUser Import-Module Microsoft.Graph $domainId = "" diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md index 7eccc722a0..326c71ca59 100644 --- a/education/windows/federated-sign-in.md +++ b/education/windows/federated-sign-in.md @@ -1,7 +1,7 @@ --- title: Configure federated sign-in for Windows devices description: Description of federated sign-in feature for the Education SKUs of Windows 11 and how to configure it via Intune or provisioning packages. -ms.date: 04/04/2023 +ms.date: 04/11/2023 ms.topic: how-to appliesto: - ✅ Windows 11 @@ -146,11 +146,16 @@ In a scenario where a user is federated and you want to change the ImmutableId, Here's a PowerShell example to update the ImmutableId for a federated user: ```powershell +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force +Install-Module Microsoft.Graph -Scope CurrentUser +Import-Module Microsoft.Graph +Connect-MgGraph -Scopes 'User.Read.All', 'User.ReadWrite.All' + #1. Convert the user from federated to cloud-only -Get-AzureADUser -SearchString alton@example.com | Set-AzureADUser -UserPrincipalName alton@example.onmicrosoft.com +Update-MgUser -UserId alton@example.com -UserPrincipalName alton@example.onmicrosoft.com #2. Convert the user back to federated, while setting the immutableId -Get-AzureADUser -SearchString alton@example.onmicrosoft.com | Set-AzureADUser -UserPrincipalName alton@example.com -ImmutableId '260051' +Update-MgUser -UserId alton@example.onmicrosoft.com -UserPrincipalName alton@example.com -OnPremisesImmutableId '260051' ``` ## Troubleshooting From 32eb6dcbe479d56d6f24334369fe66f66cdf7fd2 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 11 Apr 2023 08:34:29 -0700 Subject: [PATCH 060/139] Updated with MC538728 --- .../whats-new/windows-autopatch-whats-new-2023.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 576eade6e5..22a90e7d70 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 04/04/2023 +ms.date: 04/11/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -24,6 +24,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Message center post number | Description | | ----- | ----- | +| [MC538728](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Update: Windows Autopatch quality updates release communication | | [MC536881](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Take action: Review Windows Autopatch Tenant management blade for potential action required to prevent inactive status | ## March 2023 From 00af39a1528d2735f648d0a8bea8ff108d2b3988 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 11 Apr 2023 11:36:23 -0400 Subject: [PATCH 061/139] older windows version cleanup --- .openpublishing.redirection.json | 5 + .../appv-deploy-and-config.md | 488 ------------------ ...e-active-directory-integration-with-mdm.md | 2 +- ...ficate-authentication-device-enrollment.md | 4 +- .../certificate-renewal-windows-mdm.md | 3 - .../enable-admx-backed-policies-in-mdm.md | 6 +- ...device-automatically-using-group-policy.md | 8 +- .../enterprise-app-management.md | 6 +- ...rver-side-mobile-application-management.md | 8 +- .../manage-corporate-devices.md | 18 +- ...-in-your-organization-modern-management.md | 4 +- windows/client-management/mdm-collect-logs.md | 14 +- .../mdm-diagnose-enrollment.md | 2 +- .../mdm-enrollment-of-windows-devices.md | 28 +- windows/client-management/mdm-known-issues.md | 14 +- windows/client-management/mdm-overview.md | 8 +- .../mobile-device-enrollment.md | 4 +- ...ew-in-windows-mdm-enrollment-management.md | 10 +- .../oma-dm-protocol-support.md | 8 +- ...remise-authentication-device-enrollment.md | 4 +- .../understanding-admx-backed-policies.md | 103 ++-- ...and-centennial-app-policy-configuration.md | 70 +-- .../wmi-providers-supported-in-windows.md | 244 ++++----- 23 files changed, 285 insertions(+), 776 deletions(-) delete mode 100644 windows/client-management/appv-deploy-and-config.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 74ac00f780..d418d33847 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6700,6 +6700,11 @@ "redirect_url": "/microsoft-365/compliance/use-your-free-azure-ad-subscription-in-office-365", "redirect_document_id": false }, + { + "source_path": "windows/client-management/appv-deploy-and-config.md", + "redirect_url": "/windows/application-management/app-v/appv-for-windows", + "redirect_document_id": false + }, { "source_path": "windows/client-management/diagnose-mdm-failures-in-windows-10.md", "redirect_url": "/windows/client-management/mdm-collect-logs", diff --git a/windows/client-management/appv-deploy-and-config.md b/windows/client-management/appv-deploy-and-config.md deleted file mode 100644 index 6b89d95acc..0000000000 --- a/windows/client-management/appv-deploy-and-config.md +++ /dev/null @@ -1,488 +0,0 @@ ---- -title: Deploy and configure App-V apps using MDM -description: Configure, deploy, and manage Microsoft Application Virtualization (App-V) apps using Microsoft Intune or App-V server. -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 ---- - -# Deploy and configure App-V apps using MDM - -## Executive summary - -

Microsoft Application Virtualization (App-V) apps have typically been configured, deployed, and managed through on-premises group policies or App-V server. In Windows 10, version 1703, App-V apps can be configured, deployed, and managed using mobile device management (MDM), matching their on-premises counterparts.

- -

MDM services can be used to publish App-V packages to clients running Windows 10, version 1703 (or later). All capabilities such as App-V enablement, configuration, and publishing can be completed using the EnterpriseAppVManagement CSP.

- -### EnterpriseAppVManagement CSP node structure - -[EnterpriseAppVManagement CSP reference](mdm/enterpriseappvmanagement-csp.md) - -The following example shows the EnterpriseAppVManagement configuration service provider in tree format. - -```console -./Vendor/MSFT -EnterpriseAppVManagement -----AppVPackageManagement ---------EnterpriseID -------------PackageFamilyName ----------------PackageFullName -------------------Name -------------------Version -------------------Publisher -------------------InstallLocation -------------------InstallDate -------------------Users -------------------AppVPackageID -------------------AppVVersionId -------------------AppVPackageUri -----AppVPublishing ---------LastSync -------------LastError -------------LastErrorDescription -------------SyncStatusDescription -------------SyncProgress ---------Sync -------------PublishXML -----AppVDynamicPolicy ---------ConfigurationId -------------Policy -``` - -

(./User/Vendor/MSFT/EnterpriseAppVManagement) contains the following subnodes.

- -

AppVPublishing - An exec action node that contains the App-V publishing configuration for an MDM device (applied globally to all users for that device) or a specific MDM user.

- -- EnterpriseAppVManagement - - AppVPackageManagement - - **AppVPublishing** - - LastSync - - LastError - - LastErrorDescription - - SyncStatusDescription - - SyncProgress - - Sync - - PublishXML - - AppVDynamicPolicy - -

Sync command:

- -[App-V Sync protocol reference](https://msdn.microsoft.com/enus/library/mt739986.aspx) - -

AppVDynamicPolicy - A read/write node that contains the App-V dynamic configuration for an MDM device (applied globally to all users for that device) or a specific MDM user.

- -- EnterpriseAppVManagement - - AppVPackageManagement - - AppVPublishing - - **AppVDynamicPolicy** - - [ConfigurationId] - - Policy - -

Dynamic policy examples:

- -[Dynamic configuration processing](/windows/application-management/app-v/appv-application-publishing-and-client-interaction#dynamic-configuration-processing) - -

AppVPackageManagement - Primarily read-only App-V package inventory data for MDM servers to query current packages.

- -- EnterpriseAppVManagement - - **AppVPackageManagement** - - [EnterpriseID] - - [PackageFamilyName] - - [PackageFullName] - - Name - - Version - - Publisher - - InstallLocation - - InstallDate - - Users - - AppVPackageID - - AppVVersionId - - AppVPackageUri - - AppVPublishing - - AppVDynamicPolicy - -

The examples in the scenarios section demonstrate how the publishing document should be created to successfully publish packages, dynamic policies, and connection groups.

- -## Scenarios addressed in App-V MDM functionality - -

All App-V group policies will be reflected by having a corresponding CSP that can be set using the Policy CSP. The CSPs match all on-premises App-V configuration capabilities. In addition, new App-V package management capability has been added to closely match the App-V PowerShell functionality.

- -

A complete list of App-V policies can be found here:

- -[ADMX-backed policy reference](mdm/policy-configuration-service-provider.md) - -[EnterpriseAppVManagement CSP reference](mdm/enterpriseappvmanagement-csp.md) - -### SyncML examples - -

The following SyncML examples address specific App-V client scenarios.

- -#### Enable App-V client - -

This example shows how to enable App-V on the device.

- -```xml - - $CmdID$ - - - chr - text/plain - - - ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/AllowAppvClient - - - - -``` - -#### Configure App-V client - -

This example shows how to allow package scripts to run during package operations (publish, run, and unpublish). Allowing package scripts helps package deployments (add and publish of App-V apps).

- -```xml - - $CmdID$ - - - chr - text/plain - - - ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/AllowPackageScripts - - - - -``` - -

Complete list of App-V policies can be found here:

- -[Policy CSP](mdm/policy-configuration-service-provider.md) - -#### SyncML with package published for a device (global to all users for that device) - -

This SyncML example shows how to publish a package globally on an MDM enrolled device for all device users.

- -```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync - - - node - - - - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXM L - - - xml - text/plain - - - - - - - - - - - - - -``` - -

*PackageUrl can be a UNC or HTTP/HTTPS endpoint.

- -#### SyncML with package (with dynamic configuration policy) published for a device (global to all users on that device) - -

This SyncML example shows how to publish a package globally, with a policy that adds two shortcuts for the package, on an MDM enrolled device.

- -```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVDynamicPolicy/38/Policy - - - xml - text/plain - - - - - - - - - - - [{ThisPCDesktopFolder}]\Skype_FromMDM.lnk - [{ProgramFilesX86}]\Skype\Phone\Skype.exe - [{Windows}]\Installer\{FC965A47-4839-40CA-B61818F486F042C6}\SkypeIcon.exe.0.ico - - [{ProgramFilesX86}]\Skype\ - Skype.Desktop.Application - Launch Skype - 1 - [{ProgramFilesX86}]\Skype\Phone\Skype.exe - - - - - [{Common Desktop}]\Skype_FromMDMAlso.lnk - [{ProgramFilesX86}]\Skype\Phone\Skype.exe - [{Windows}]\Installer\{FC965A47-4839-40CA-B61818F486F042C6}\SkypeIcon.exe.0.ico - - [{ProgramFilesX86}]\Skype\ - Skype.Desktop.Application - Launch Skype - 1 - [{ProgramFilesX86}]\Skype\Phone\Skype.exe - - - - - - - - - - - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync - - - node - - - - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXM L - - - xml - text/plain - - - - - - - - - - - - - - -``` - -

*PackageUrl can be a UNC or HTTP/HTTPS endpoint.

- -#### SyncML with package (using user config deployment) published for a specific user - -

This SyncML example shows how to publish a package for a specific MDM user.

- -```xml - - $CmdID$ - - - ./User/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync - - - node - - - - - $CmdID$ - - - ./User/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML< /LocURI> - - - xml - text/plain - - - - - - - - - - - - - -``` - -#### SyncML for publishing mixed-mode connection group containing global and user-published packages - -

This SyncML example shows how to publish a connection group, and group applications and plugins together.

- -> [!NOTE] -> The user connection group has the user-only package as optional in this example, which implies users without the optional package can continue to launch the global package within the same connection group. - -```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync - - - node - - - - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXM L - - - xml - text/plain - - - - - - - - - - - - $CmdID$ - - - ./User/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync - - - node - - - - - $CmdID$ - - - ./User/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML< /LocURI> - - - xml - text/plain - - - - - - - - - - - - - - - - - - - - -``` - -#### Unpublish example SyncML for all global packages - -

This SyncML example shows how to unpublish all global packages on the device by sending an empty package and connection group list in the SyncML.

- -```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync - - - node - - - - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPublishing/Sync/PublishXML - - - xml - text/plain - - - - - - - - - -``` - -#### Query packages on a device - -

These SyncML examples return all global, and user-published packages on the device.

- -```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement?list=StructData - - - -``` - -```xml - - $CmdID$ - - - ./User/Vendor/MSFT/EnterpriseAppVManagement/AppVPackageManagement?list=StructData - - - -``` diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 6eb05d62cb..20a3fc0b42 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -383,7 +383,7 @@ For a sample that illustrates how an MDM can obtain an access token using OAuth The following sample REST API call illustrates how an MDM can use the Microsoft Graph API to report compliance status of a device being managed by it. > [!NOTE] -> This API is only applicable for approved MDM apps on Windows 10 devices. +> This API is only applicable for approved MDM apps on Windows devices. ```console Sample Graph API Request: diff --git a/windows/client-management/certificate-authentication-device-enrollment.md b/windows/client-management/certificate-authentication-device-enrollment.md index bf9d1e373f..6db2ca38a4 100644 --- a/windows/client-management/certificate-authentication-device-enrollment.md +++ b/windows/client-management/certificate-authentication-device-enrollment.md @@ -16,13 +16,13 @@ appliesto: # Certificate authentication device enrollment -This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). +This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows devices, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). > [!NOTE] > To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package). > [!NOTE] -> For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +> For the list of enrollment scenarios not supported in Windows, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery Service diff --git a/windows/client-management/certificate-renewal-windows-mdm.md b/windows/client-management/certificate-renewal-windows-mdm.md index ad7e9b4500..d7c3443131 100644 --- a/windows/client-management/certificate-renewal-windows-mdm.md +++ b/windows/client-management/certificate-renewal-windows-mdm.md @@ -100,9 +100,6 @@ For more information about the parameters, see the CertificateStore configuratio Unlike manual certificate renewal, the device will not do an automatic MDM client certificate renewal if the certificate is already expired. To make sure the device has enough time to automatically renew, we recommend you set a renewal period a couple months (40-60 days) before the certificate expires. And, set the renewal retry interval to every few days, like every 4-5 days instead every 7 days (weekly). This change increases the chance that the device will try to connect at different days of the week. -> [!NOTE] -> For PCs that were previously enrolled in MDM in Windows 8.1 and then upgraded to Windows 10, renewal will be triggered for the enrollment certificate. Thereafter, renewal will happen at the configured ROBO interval. - ## Certificate renewal response When RequestType is set to Renew, the web service verifies the following (in additional to initial enrollment): diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index 553ecce5d4..1983b4f76f 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -8,7 +8,7 @@ ms.technology: itpro-manage author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 11/01/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz appliesto: - ✅ Windows 11 @@ -17,9 +17,7 @@ appliesto: # Enable ADMX policies in MDM -Here's how to configure Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM). - -Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of [selected set of Group Policy administrative templates (ADMX policies)](mdm/policies-in-policy-csp-admx-backed.md) for Windows PCs via the [Policy configuration service provider (CSP)](mdm/policy-configuration-service-provider.md). Configuring ADMX policies in Policy CSP is different from the typical way you configure a traditional MDM policy. +Starting in Windows 10, Mobile Device Management (MDM) policy configuration support was expanded to allow access of [selected set of Group Policy administrative templates (ADMX policies)](mdm/policies-in-policy-csp-admx-backed.md) for Windows PCs via the [Policy configuration service provider (CSP)](mdm/policy-configuration-service-provider.md). Configuring ADMX policies in Policy CSP is different from the typical way you configure a traditional MDM policy. Summary of steps to enable a policy: diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 70ee1d76b6..a81c66fd6c 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -25,7 +25,7 @@ The enrollment into Intune is triggered by a group policy created on your local **Requirements**: -- The Active Directory joined device must be running Windows 10, version 1709 or later. +- The Active Directory joined device must be running a [supported version of Windows](/windows/release-health/supported-versions-windows-client). - The enterprise has configured a Mobile Device Management (MDM) service. - The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad). - The device shouldn't already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`). @@ -38,7 +38,7 @@ The enrollment into Intune is triggered by a group policy created on your local > - [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) > - [Azure Active Directory integration with MDM](./azure-active-directory-integration-with-mdm.md) -The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD-registered. +The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD-registered. > [!NOTE] > In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. @@ -46,7 +46,7 @@ The auto-enrollment relies on the presence of an MDM service and the Azure Activ When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. - Starting in Windows 10, version 1709, when the same policy is configured in Group Policy and MDM, Group Policy policy takes precedence over MDM. -- Starting in Windows 10, version 1803, a new setting allows you to change precedence to MDM. For more information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](/archive/blogs/cbernier/windows-10-group-policy-vs-intune-mdm-policy-who-wins). +- Starting in Windows 10, version 1803, a new setting allows you to change precedence to MDM. For more information, see [Windows Group Policy vs. Intune MDM Policy who wins?](/archive/blogs/cbernier/windows-10-group-policy-vs-intune-mdm-policy-who-wins). For this policy to work, you must verify that the MDM service provider allows Group Policy initiated MDM enrollment for domain-joined devices. @@ -99,7 +99,7 @@ This procedure is only for illustration purposes to show how the new auto-enroll :::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png"::: > [!NOTE] - > In Windows 10, version 1903 and later, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. The default behavior for older releases is to revert to **User Credential**. + > In Windows 10, version 1903 and later, the MDM.admx file was updated to include the **Device Credential** option to select which credential is used to enroll the device. The default behavior for older releases is to revert to **User Credential**. > > **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or [Azure Virtual Desktop multi-session host pools](/mem/intune/fundamentals/azure-virtual-desktop-multi-session) because the Intune subscription is user centric. User credentials are supported for [Azure Virtual Desktop personal host pools](/mem/intune/fundamentals/azure-virtual-desktop). diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index bde58f70ff..f21b883f35 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -30,8 +30,8 @@ Windows offers the ability for management servers to: - Inventory all apps for a user (Store and non-Store apps) - Inventory all apps for a device (Store and non-Store apps) - Uninstall all apps for a user (Store and non-Store apps) -- Provision apps so they're installed for all users of a device running Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Remove the provisioned app on the device running Windows 10 for desktop editions +- Provision apps so they're installed for all users of a device running Windows desktop editions (Home, Pro, Enterprise, and Education) +- Remove the provisioned app on the device running Windows desktop editions ## Inventory apps @@ -545,7 +545,7 @@ The Data field value of 0 (zero) indicates success. Otherwise it's an error code ## Uninstall your apps -You can uninstall apps from users from Windows 10 devices. To uninstall an app, you delete it from the AppManagement node of the CSP. Within the AppManagement node, packages are organized based on their origin according to the following nodes: +You can uninstall apps from users from Windows devices. To uninstall an app, you delete it from the AppManagement node of the CSP. Within the AppManagement node, packages are organized based on their origin according to the following nodes: - AppStore - These apps are for the Microsoft Store. Apps can be directly installed from the store or delivered to the enterprise from the Store for Business. - nonStore - These apps that weren't acquired from the Microsoft Store. diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index 12f7e3eb21..01cff16e92 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -16,7 +16,7 @@ appliesto: # Support for mobile application management on Windows -The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10, version 1703. +The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP). [!INCLUDE [Deprecate Windows Information Protection](../security/information-protection/windows-information-protection/includes/wip-deprecation.md)] @@ -46,7 +46,7 @@ MICROSOFTEDPAUTOPROTECTIONALLOWEDAPPINFO EDPAUTOPROTECTIONALLOWEDAPPINFOID ## Configuring an Azure AD tenant for MAM enrollment -MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Windows 10, version 1703 and later, the same cloud-based Management MDM app in Azure AD will support both MDM and MAM enrollments. If you've already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration. +MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. The same cloud-based Management MDM app in Azure AD will support both MDM and MAM enrollments. If you've already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration. :::image type="content" alt-text="Mobile application management app." source="images/implement-server-side-mobile-application-management.png"::: @@ -87,12 +87,12 @@ MAM on Windows supports the following configuration service providers (CSPs). Al - [AppLocker CSP](mdm/applocker-csp.md) for configuration of Windows Information Protection enterprise allowed apps. - [ClientCertificateInstall CSP](mdm/clientcertificateinstall-csp.md) for installing VPN and Wi-Fi certs. -- [DeviceStatus CSP](mdm/devicestatus-csp.md) required for Conditional Access support (starting with Windows 10, version 1703). +- [DeviceStatus CSP](mdm/devicestatus-csp.md) required for Conditional Access support. - [DevInfo CSP](mdm/devinfo-csp.md). - [DMAcc CSP](mdm/dmacc-csp.md). - [DMClient CSP](mdm/dmclient-csp.md) for polling schedules configuration and MDM discovery URL. - [EnterpriseDataProtection CSP](mdm/enterprisedataprotection-csp.md) has Windows Information Protection policies. -- [Health Attestation CSP](mdm/healthattestation-csp.md) required for Conditional Access support (starting with Windows 10, version 1703). +- [Health Attestation CSP](mdm/healthattestation-csp.md) required for Conditional Access support. - [PassportForWork CSP](mdm/passportforwork-csp.md) for Windows Hello for Business PIN management. - [Policy CSP](mdm/policy-configuration-service-provider.md) specifically for NetworkIsolation and DeviceLock areas. - [Reporting CSP](mdm/reporting-csp.md) for retrieving Windows Information Protection logs. diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index 301ec1a5f7..e40844c3c1 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -1,6 +1,6 @@ --- title: Manage corporate devices -description: You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. +description: You can use the same management tools to manage all device types running Windows. ms.reviewer: manager: aaroncz ms.author: vinpa @@ -17,27 +17,27 @@ appliesto: # Manage corporate devices -You can use the same management tools to manage all device types running Windows 10 or Windows 11 desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10 and Windows 11. +You can use the same management tools to manage all Windows devices. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, and so on, will continue to work for Windows 10 and Windows 11. ## In this section | Topic | Description | | --- | --- | -| [Manage Windows 10 (and Windows 11) in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10 (and Windows 11), including deploying Windows 10 (and Windows 11) in a mixed environment | +| [Manage Windows in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment | | [Connect to remote Azure Active Directory-joined PC](client-tools/connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | -| [Manage Windows 10 (and Windows 11) and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | -| [New policies for Windows 10 (and Windows 11)](client-tools/new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | -| [Group Policies that apply only to Windows Enterprise and Windows Education](client-tools/group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education | -| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 (and Windows 11) in their organizations | +| [Manage Windows and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | +| [New policies for Windows](client-tools/new-policies-for-windows-10.md) | New Group Policy settings added in Windows | +| [Group Policies that apply only to Windows Enterprise and Windows Education](client-tools/group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows Enterprise and Education | +| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows in their organizations | ## Learn more [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Configuration Manager](/mem/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) -[Azure AD, Microsoft Intune and Windows 10 - Using the cloud to modernize enterprise mobility](https://blogs.technet.microsoft.com/enterprisemobility/2015/06/12/azure-ad-microsoft-intune-and-windows-10-using-the-cloud-to-modernize-enterprise-mobility/) +[Azure AD, Microsoft Intune and Windows - Using the cloud to modernize enterprise mobility](https://blogs.technet.microsoft.com/enterprisemobility/2015/06/12/azure-ad-microsoft-intune-and-windows-10-using-the-cloud-to-modernize-enterprise-mobility/) [Microsoft Intune End User Enrollment Guide](/samples/browse/?redirectedfrom=TechNet-Gallery) -[Windows 10 (and Windows 11) and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) +[Windows and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) Microsoft Virtual Academy course: [Configuration Manager & Windows Intune](/training/) diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 755bf07aa0..245a61e862 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -35,7 +35,7 @@ This article offers guidance on strategies for deploying and managing Windows de - [Configuration](#settings-and-configuration) - [Updating and Servicing](#updating-and-servicing) -## Reviewing the management options with Windows 10 +## Reviewing the management options for Windows Windows offers a range of management options, as shown in the following diagram: @@ -115,7 +115,7 @@ There are various steps you can take to begin the process of modernizing device **Take incremental steps.** Moving towards modern device management doesn't have to be an overnight transformation. New operating systems and devices can be brought in while older ones remain. With this "managed diversity," users can benefit from productivity enhancements on modern Windows devices, while you continue to maintain older devices according to your standards for security and manageability. The CSP policy [MDMWinsOverGP](./mdm/policy-csp-controlpolicyconflict.md#mdmwinsovergp) allows MDM policies to take precedence over group policy when both group policy and its equivalent MDM policies are set on the device. You can start implementing MDM policies while keeping your group policy environment. For more information, including the list of MDM policies with equivalent group policies, see [Policies supported by group policy](./mdm/policies-in-policy-csp-supported-by-group-policy.md). -**Optimize your existing investments**. On the road from traditional on-premises management to modern cloud-based management, take advantage of the flexible, hybrid architecture of Configuration Manager and Intune. Co-management enables you to concurrently manage Windows 10 devices by using both Configuration Manager and Intune. For more information, see the following articles: +**Optimize your existing investments**. On the road from traditional on-premises management to modern cloud-based management, take advantage of the flexible, hybrid architecture of Configuration Manager and Intune. Co-management enables you to concurrently manage Windows devices by using both Configuration Manager and Intune. For more information, see the following articles: - [Co-management for Windows devices](/mem/configmgr/comanage/overview) - [Prepare Windows devices for co-management](/mem/configmgr/comanage/how-to-prepare-Win10) diff --git a/windows/client-management/mdm-collect-logs.md b/windows/client-management/mdm-collect-logs.md index 1d5fa21e4f..df8b03a6cc 100644 --- a/windows/client-management/mdm-collect-logs.md +++ b/windows/client-management/mdm-collect-logs.md @@ -37,7 +37,7 @@ To help diagnose enrollment or device management issues in Windows devices manag 1. In File Explorer, navigate to `C:\Users\Public\Documents\MDMDiagnostics` to see the report. -## Use command to collect logs directly from Windows 10 PCs +## Use command to collect logs directly from Windows devices You can also collect the MDM Diagnostic Information logs using the following command: @@ -60,9 +60,9 @@ The zip file will have logs according to the areas that were used in the command - MdmLogCollectorFootPrint.txt: mdmdiagnosticslog tool logs from running the command - *.evtx: Common event viewer logs microsoft-windows-devicemanagement-enterprise-diagnostics-provider-admin.evtx main one that contains MDM events. -## Collect logs directly from Windows 10 PCs +## Collect logs directly from Windows devices -Starting with the Windows 10, version 1511, MDM logs are captured in the Event Viewer in the following location: +MDM logs are captured in the Event Viewer in the following location: - Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider @@ -92,9 +92,9 @@ For more detailed logging, you can enable **Debug** logs. Right click on the **D 1. Choose **Display information for these languages** and then select **English**. 1. Click **Ok**. -You can open the log files (.evtx files) in the Event Viewer on a Windows 10 PC running the November 2015 update. +You can open the log files (.evtx files) in the Event Viewer on a Windows device. -## Collect logs remotely from Windows 10 PCs +## Collect logs remotely from Windows devices When the PC is already enrolled in MDM, you can remotely collect logs from the PC through the MDM channel if your MDM server supports this facility. The [DiagnosticLog CSP](mdm/diagnosticlog-csp.md) can be used to enable an event viewer channel by full name. Here are the Event Viewer names for the Admin and Debug channels: @@ -142,7 +142,7 @@ Example: Export the Debug logs ``` -## Collect logs remotely from Windows 10 Holographic +## Collect logs remotely from Windows Holographic For holographic already enrolled in MDM, you can remotely collect MDM logs through the MDM channel using the [DiagnosticLog CSP](mdm/diagnosticlog-csp.md). @@ -270,7 +270,7 @@ For best results, ensure that the PC or VM on which you're viewing logs matches ## Collect device state data -Here's an example of how to collect current MDM device state data using the [DiagnosticLog CSP](mdm/diagnosticlog-csp.md), version 1.3, which was added in Windows 10, version 1607. You can collect the file from the device using the same FileDownload node in the CSP as you do for the etl files. +Here's an example of how to collect current MDM device state data using the [DiagnosticLog CSP](mdm/diagnosticlog-csp.md). You can collect the file from the device using the same FileDownload node in the CSP as you do for the etl files. ```xml diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index d7f7ab6de7..c800d8d29d 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -38,7 +38,7 @@ To ensure that the auto-enrollment feature is working as expected, you must veri > > For corporate-owned devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. -1. Verify that the device OS version is Windows 10, version 1709 or later. +1. Verify that the device is running a [supported version of Windows](/windows/release-health/supported-versions-windows-client). 1. Auto-enrollment into Intune via Group Policy is valid only for devices that are hybrid Azure AD joined. This condition means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index 0a0234c873..7974866d71 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -142,7 +142,7 @@ To create a local account and connect the device: If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [this blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/). If your tenant isn't configured for auto-enrollment, you'll have to go through the enrollment flow a second time to [connect your device to MDM](#enroll-in-device-management-only). - Starting in Windows 10, version 1709, you'll see the status page that shows the progress of your device being set up. + You'll see the status page that shows the progress of your device being set up. ![corporate sign in - screen and option](images/unifiedenrollment-rs1-26.png) @@ -188,7 +188,7 @@ All Windows devices can be connected to MDM. You can connect to an MDM through t 1. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you'll be presented with a new window that will ask you for more authentication information. - Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you'll see the enrollment progress on screen. + Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. You'll see the enrollment progress on screen. ![screen to set up your device](images/unifiedenrollment-rs1-33-b.png) @@ -204,16 +204,13 @@ The deep link used for connecting your device to work will always use the follow | Parameter | Description | Supported Value for Windows | |--|--|--| -| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607 | Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory-joined. | -| username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string | -| servername | Specifies the MDM server URL that will be used to enroll the device. Added in Windows 10, version 1703. | string | -| accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used as a token to validate the enrollment request. Added in Windows 10, version 1703. | string | -| deviceidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to pass in a unique device identifier. Added in Windows 10, version 1703. | GUID | -| tenantidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to identify which tenant the device or user belongs to. Added in Windows 10, version 1703. | GUID or string | -| ownership | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to determine whether the device is BYOD or Corp Owned. Added in Windows 10, version 1703. | 1, 2, or 3. Where "1" means ownership is unknown, "2" means the device is personally owned, and "3" means the device is corporate-owned | - -> [!NOTE] -> AWA and Azure Active Directory-joined values for mode are only supported on Windows 10, version 1709 and later. +| mode | Describes which mode will be executed in the enrollment app. | Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory-joined. | +| username | Specifies the email address or UPN of the user who should be enrolled into MDM. | string | +| servername | Specifies the MDM server URL that will be used to enroll the device. | string | +| accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used as a token to validate the enrollment request. | string | +| deviceidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to pass in a unique device identifier. | GUID | +| tenantidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to identify which tenant the device or user belongs to. | GUID or string | +| ownership | Custom parameter for MDM servers to use as they see fit. Typically, this parameter's value can be used to determine whether the device is BYOD or Corp Owned. | 1, 2, or 3. Where "1" means ownership is unknown, "2" means the device is personally owned, and "3" means the device is corporate-owned | ### Connect to MDM using a deep link @@ -266,13 +263,10 @@ The **Info** button can be found on work or school connections involving MDM. Th Selecting the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You'll be able to view your organization's support information (if configured) on this page. You'll also be able to start a sync session that forces your device to communicate to the MDM server and fetch any updates to policies if needed. -Starting in Windows 10, version 1709, selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here's an example screenshot. +Selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here's an example screenshot. ![work or school info.](images/unifiedenrollment-rs1-35-b.png) -> [!NOTE] -> Starting in Windows 10, version 1709, the **Manage** button is no longer available. - ### Disconnect The **Disconnect** button can be found on all work connections. Generally, selecting the **Disconnect** button will remove the connection from the device. There are a few exceptions to this functionality: @@ -287,6 +281,6 @@ The **Disconnect** button can be found on all work connections. Generally, selec You can collect diagnostic logs around your work connections by going to **Settings** > **Accounts** > **Access work or school**, and then selecting the **Export your management logs** link under **Related Settings**. Next, select **Export**, and follow the path displayed to retrieve your management log files. -Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you'll see the button to create a report. +You can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you'll see the button to create a report. For more information, see [Collect MDM logs](mdm-collect-logs.md). diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 22fe7ba116..c6f5a15905 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -21,7 +21,7 @@ appliesto: ## Get command inside an atomic command isn't supported -In Windows 10 and Windows 11, a Get command inside an atomic command isn't supported. +A Get command inside an atomic command isn't supported. ## Apps installed using WMI classes are not removed @@ -29,11 +29,11 @@ Applications installed using WMI classes aren't removed when the MDM account is ## Passing CDATA in SyncML does not work -Passing CDATA in data in SyncML to ConfigManager and CSPs doesn't work in Windows 10 and Windows 11. +Passing CDATA in data in SyncML to ConfigManager and CSPs doesn't work. ## SSL settings in IIS server for SCEP must be set to "Ignore" -The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10 and Windows 11. +The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore". ![ssl settings.](images/ssl-settings.png) @@ -49,13 +49,13 @@ Remote server unenrollment is disabled for mobile devices enrolled via Azure Act ## Certificates causing issues with Wi-Fi and VPN -In Windows 10 and Windows 11, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This dual installation may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We're working to fix this issue. +When using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This dual installation may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We're working to fix this issue. ## Version information for Windows 11 The software version information from **DevDetail/Ext/Microsoft/OSPlatform** doesn't match the version in **Settings** under **System/About**. -## Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 and Windows 11 +## Multiple certificates might cause Wi-Fi connection instabilities In your deployment, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned doesn't have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. The solution is to ensure that the Wi-Fi profile provisioned has strict filtering criteria such that it matches only one certificate. @@ -234,9 +234,9 @@ Alternatively you can use the following procedure to create an EAP Configuration After the MDM client automatically renews the WNS channel URI, the MDM client will immediately check in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. -## User provisioning failure in Azure Active Directory-joined Windows 10 and Windows 11 devices +## User provisioning failure in Azure Active Directory-joined devices -In Azure AD joined Windows 10 and Windows 11, provisioning /.User resources fails when the user isn't logged in as an Azure AD user. If you attempt to join Azure AD from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Azure AD credentials to get your organizational configuration from your MDM server. This behavior is by design. +For Azure AD joined devices, provisioning `.\User` resources fails when the user isn't logged in as an Azure AD user. If you attempt to join Azure AD from **Settings** > **System** > **About** user interface, ensure to sign out and sign in with Azure AD credentials to get your organizational configuration from your MDM server. This behavior is by design. ## Requirements to note for VPN certificates also used for Kerberos Authentication diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index 7136528023..ecc058a048 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -26,7 +26,7 @@ There are two parts to the Windows management component: - The enrollment client, which enrolls and configures the device to communicate with the enterprise management server. For more information, see [Enrollment overview](mobile-device-enrollment.md). - The management client, which periodically synchronizes with the management server to check for updates and apply the latest policies set by IT. -Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a third-party server proxy that supports the protocols outlined in this document to perform enterprise management tasks. The third-party server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows users. MDM servers don't need to create or download a client to manage Windows 10. +Third-party MDM servers can manage Windows devices using the MDM protocol. The built-in management client is able to communicate with a third-party server proxy that supports the protocols outlined in this document to perform enterprise management tasks. The third-party server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows users. MDM servers don't need to create or download a client to manage Windows. For details about the MDM protocols, see @@ -35,7 +35,7 @@ For details about the MDM protocols, see ## MDM security baseline -Starting with Windows 10, version 1809, Microsoft provides MDM security baselines that function like the Microsoft group policy security baseline. You can easily integrate this baseline into any MDM solution to support IT pros' operational needs, addressing security concerns for modern cloud-managed devices. +Microsoft provides MDM security baselines that function like the Microsoft group policy security baseline. You can easily integrate this baseline into any MDM solution to support IT pros' operational needs, addressing security concerns for modern cloud-managed devices. The MDM security baseline includes policies that cover the following areas: @@ -58,7 +58,7 @@ For information about the MDM policies defined in the Intune security baseline, ## Frequently Asked Questions -### Can there be more than one MDM server to enroll and manage devices in Windows 10 or 11? +### Can there be more than one MDM server to enroll and manage devices in Windows? No. Only one MDM is allowed. @@ -72,6 +72,6 @@ No. Only one MDM is allowed. | Entry | Description | | --------------- | -------------------- | -| What is dmwappushsvc? | It's a Windows service that ships in Windows 10 and Windows 11 operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | +| What is dmwappushsvc? | It's a Windows service that ships in Windows operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | | What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further. This service doesn't send telemetry. | | How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc) and locating *Device Management Wireless Application Protocol (WAP) Push message Routing Service*. However, since this service is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service will cause your management to fail. | diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index cae59a41d2..1b1fb7c688 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -80,7 +80,7 @@ The following scenarios don't allow MDM enrollments: ## Disable MDM enrollments -In Windows 10 and Windows 11, IT admin can disable MDM enrollments for domain-joined PCs using the **Disable MDM Enrollment** group policy. +IT admin can disable MDM enrollments for domain-joined PCs using the **Disable MDM Enrollment** group policy. Group Policy Path: **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. Corresponding registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM\DisableRegistration (REG_DWORD)` @@ -126,7 +126,7 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma | a: | InternalServiceFault | MENROLL_E_DEVICE_INTERNALSERVICE_ERROR | There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator. | 80180006 | | a: | InvalidSecurity | MENROLL_E_DEVICE_INVALIDSECURITY_ERROR | The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator. | 80180007 | -In Windows 10, version 1507, `deviceenrollmentserviceerror` element was added. Here's an example: +SOAP format also includes `deviceenrollmentserviceerror` element. Here's an example: ```xml diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index a948e85150..194c51ac66 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -17,9 +17,9 @@ appliesto: # What's new in mobile device enrollment and management -This article provides information about what's new in Windows 10 and Windows 11 mobile device management (MDM) enrollment and management experience across all Windows 10 and Windows 11 devices. This article also provides details about the breaking changes and known issues and frequently asked questions. +This article provides information about what's new in mobile device management (MDM) enrollment and management experience across all Windows devices. This article also provides details about the breaking changes and known issues and frequently asked questions. -For details about Microsoft mobile device management protocols for Windows 10 and Windows 11, see [\[MS-MDM\]: Mobile Device Management Protocol](/openspecs/windows_protocols/ms-mdm/33769a92-ac31-47ef-ae7b-dc8501f7104f) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). +For details about Microsoft mobile device management protocols for Windows, see [\[MS-MDM\]: Mobile Device Management Protocol](/openspecs/windows_protocols/ms-mdm/33769a92-ac31-47ef-ae7b-dc8501f7104f) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). ## What's new in MDM for Windows 11, version 22H2 @@ -52,7 +52,7 @@ For details about Microsoft mobile device management protocols for Windows 10 an | New or updated article | Description | |-----|-----| -| [Policy CSP](mdm/policy-configuration-service-provider.md) | Added the following nodes:
  • ApplicationManagement/BlockNonAdminUserInstall
  • Bluetooth/SetMinimumEncryptionKeySize
  • DeliveryOptimization/DOCacheHostSource
  • DeliveryOptimization/DOMaxBackgroundDownloadBandwidth
  • DeliveryOptimization/DOMaxForegroundDownloadBandwidth
  • Education/AllowGraphingCalculator
  • TextInput/ConfigureJapaneseIMEVersion
  • TextInput/ConfigureSimplifiedChineseIMEVersion
  • TextInput/ConfigureTraditionalChineseIMEVersion

    Updated the following policy in Windows 10, version 2004:
  • DeliveryOptimization/DOCacheHost

    Deprecated the following policies in Windows 10, version 2004:
  • DeliveryOptimization/DOMaxDownloadBandwidth
  • DeliveryOptimization/DOMaxUploadBandwidth
  • DeliveryOptimization/DOPercentageMaxDownloadBandwidth | +| [Policy CSP](mdm/policy-configuration-service-provider.md) | Added the following nodes:
  • ApplicationManagement/BlockNonAdminUserInstall
  • Bluetooth/SetMinimumEncryptionKeySize
  • DeliveryOptimization/DOCacheHostSource
  • DeliveryOptimization/DOMaxBackgroundDownloadBandwidth
  • DeliveryOptimization/DOMaxForegroundDownloadBandwidth
  • Education/AllowGraphingCalculator
  • TextInput/ConfigureJapaneseIMEVersion
  • TextInput/ConfigureSimplifiedChineseIMEVersion
  • TextInput/ConfigureTraditionalChineseIMEVersion

    Updated the following policy:
  • DeliveryOptimization/DOCacheHost

    Deprecated the following policies:
  • DeliveryOptimization/DOMaxDownloadBandwidth
  • DeliveryOptimization/DOMaxUploadBandwidth
  • DeliveryOptimization/DOPercentageMaxDownloadBandwidth | | [DevDetail CSP](mdm/devdetail-csp.md) | Added the following new node:
  • Ext/Microsoft/DNSComputerName | | [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md) | Added the following node:
  • IsStub | | [SUPL CSP](mdm/supl-csp.md) | Added the following node:
  • FullVersion | @@ -71,7 +71,7 @@ For details about Microsoft mobile device management protocols for Windows 10 an | [Policy CSP - Audit](mdm/policy-csp-audit.md) | Added the new Audit policy CSP. | | [ApplicationControl CSP](mdm/applicationcontrol-csp.md) | Added the new CSP. | | [Defender CSP](mdm/defender-csp.md) | Added the following new nodes:
  • Health/TamperProtectionEnabled
  • Health/IsVirtualMachine
  • Configuration
  • Configuration/TamperProtection
  • Configuration/EnableFileHashComputation | -| [DiagnosticLog CSP](mdm/diagnosticlog-csp.md)
    [DiagnosticLog DDF](mdm/diagnosticlog-ddf.md) | Added version 1.4 of the CSP in Windows 10, version 1903.
    Added the new 1.4 version of the DDF.
    Added the following new nodes:
  • Policy
  • Policy/Channels
  • Policy/Channels/ChannelName
  • Policy/Channels/ChannelName/MaximumFileSize
  • Policy/Channels/ChannelName/SDDL
  • Policy/Channels/ChannelName/ActionWhenFull
  • Policy/Channels/ChannelName/Enabled
  • DiagnosticArchive
  • DiagnosticArchive/ArchiveDefinition
  • DiagnosticArchive/ArchiveResults | +| [DiagnosticLog CSP](mdm/diagnosticlog-csp.md)
    [DiagnosticLog DDF](mdm/diagnosticlog-ddf.md) | Added version 1.4 of the CSP.
    Added the new 1.4 version of the DDF.
    Added the following new nodes:
  • Policy
  • Policy/Channels
  • Policy/Channels/ChannelName
  • Policy/Channels/ChannelName/MaximumFileSize
  • Policy/Channels/ChannelName/SDDL
  • Policy/Channels/ChannelName/ActionWhenFull
  • Policy/Channels/ChannelName/Enabled
  • DiagnosticArchive
  • DiagnosticArchive/ArchiveDefinition
  • DiagnosticArchive/ArchiveResults | | [EnrollmentStatusTracking CSP](mdm/enrollmentstatustracking-csp.md) | Added the new CSP. | | [PassportForWork CSP](mdm/passportforwork-csp.md) | Added the following new nodes:
  • SecurityKey
  • SecurityKey/UseSecurityKeyForSignin | @@ -80,7 +80,7 @@ For details about Microsoft mobile device management protocols for Windows 10 an | New or updated article | Description | |-----|-----| |[Policy CSP](mdm/policy-configuration-service-provider.md) | Added the following nodes:
  • ApplicationManagement/LaunchAppAfterLogOn
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
  • Authentication/EnableFastFirstSignIn (Preview mode only
  • Authentication/EnableWebSignIn (Preview mode only
  • Authentication/PreferredAadTenantDomainName
  • Browser/AllowFullScreenMode
  • Browser/AllowPrelaunch
  • Browser/AllowPrinting
  • Browser/AllowSavingHistory
  • Browser/AllowSideloadingOfExtensions
  • Browser/AllowTabPreloading
  • Browser/AllowWebContentOnNewTabPage
  • Browser/ConfigureFavoritesBar
  • Browser/ConfigureHomeButton
  • Browser/ConfigureKioskMode
  • Browser/ConfigureKioskResetAfterIdleTimeout
  • Browser/ConfigureOpenMicrosoftEdgeWith
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
  • Browser/PreventCertErrorOverrides
  • Browser/SetHomeButtonURL
  • Browser/SetNewTabPageURL
  • Browser/UnlockHomeButton
  • Defender/CheckForSignaturesBeforeRunningScan
  • Defender/DisableCatchupFullScan
  • Defender/DisableCatchupQuickScan
  • Defender/EnableLowCPUPriority
  • Defender/SignatureUpdateFallbackOrder
  • Defender/SignatureUpdateFileSharesSources
  • DeviceGuard/ConfigureSystemGuardLaunch
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
  • DmaGuard/DeviceEnumerationPolicy
  • Experience/AllowClipboardHistory
  • Experience/DoNotSyncBrowserSettings
  • Experience/PreventUsersFromTurningOnBrowserSyncing
  • Kerberos/UPNNameHints
  • Privacy/AllowCrossDeviceClipboard
  • Privacy/DisablePrivacyExperience
  • Privacy/UploadUserActivities
  • Security/RecoveryEnvironmentAuthentication
  • System/AllowDeviceNameInDiagnosticData
  • System/ConfigureMicrosoft365UploadEndpoint
  • System/DisableDeviceDelete
  • System/DisableDiagnosticDataViewer
  • Storage/RemovableDiskDenyWriteAccess
  • TaskManager/AllowEndTask
  • Update/DisableWUfBSafeguards
  • Update/EngagedRestartDeadlineForFeatureUpdates
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
  • Update/SetDisablePauseUXAccess
  • Update/SetDisableUXWUAccess
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
  • WindowsLogon/DontDisplayNetworkSelectionUI | -| [BitLocker CSP](mdm/bitlocker-csp.md) | Added a new node AllowStandardUserEncryption.
  • Added support for Windows 10 Pro. | +| [BitLocker CSP](mdm/bitlocker-csp.md) | Added a new node AllowStandardUserEncryption.
  • Added support for Pro edition. | | [Defender CSP](mdm/defender-csp.md) | Added a new node Health/ProductStatus. | | [DevDetail CSP](mdm/devdetail-csp.md) | Added a new node SMBIOSSerialNumber. | | [EnterpriseModernAppManagement CSP](mdm/enterprisemodernappmanagement-csp.md) | Added NonRemovable setting under AppManagement node. | diff --git a/windows/client-management/oma-dm-protocol-support.md b/windows/client-management/oma-dm-protocol-support.md index 1c8a92786b..521d15c082 100644 --- a/windows/client-management/oma-dm-protocol-support.md +++ b/windows/client-management/oma-dm-protocol-support.md @@ -1,7 +1,7 @@ --- title: OMA DM protocol support description: See how the OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -32,9 +32,8 @@ The following table shows the OMA DM standards that Windows uses. |Nodes|In the OMA DM tree, the following rules apply for the node name:
  • "." can be part of the node name.
  • The node name can't be empty.
  • The node name can't be only the asterisk (`*`) character.| |Provisioning Files|Provisioning XML must be well formed and follow the definition in [SyncML Representation Protocol](https://www.openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf).

    If an XML element that isn't a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.
    **Note**
    To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.
    | |WBXML support|Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This dual-format support is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://www.openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.| -|Handling of large objects|In Windows 10, version 1511, client support for uploading large objects to the server was added.| +|Handling of large objects|In Windows 10, client support for uploading large objects to the server was added.| - ## OMA DM protocol common elements Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1_1_2-20030613-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/). @@ -52,7 +51,7 @@ Common elements are used by other OMA DM element types. The following table list |MsgID|Specifies a unique identifier for an OMA DM session message.| |MsgRef|Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.| |RespURI|Specifies the URI that the recipient must use when sending a response to this message.| -|SessionID|Specifies the identifier of the OMA DM session associated with the containing message.
    **Note**
    If the server doesn't notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the client returns the SessionID in integer in decimal format. If the server supports DM session sync version 2.0, which is used in Windows 10, the device client returns 2 bytes.
    | +|SessionID|Specifies the identifier of the OMA DM session associated with the containing message.
    **Note**
    If the server doesn't notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the client returns the SessionID in integer in decimal format. If the server supports DM session sync version 2.0, which is used in Windows, the device client returns 2 bytes.
    | |Source|Specifies the message source address.| |SourceRef|Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.| |Target|Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.| @@ -131,7 +130,6 @@ The following LocURL shows a per user CSP node configuration: `./user/vendor/MSF The following LocURL shows a per device CSP node configuration: `./device/vendor/MSFT/RemoteWipe/DoWipe` - ## SyncML response status codes When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you're likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification. diff --git a/windows/client-management/on-premise-authentication-device-enrollment.md b/windows/client-management/on-premise-authentication-device-enrollment.md index 362b0467bb..8e72627af0 100644 --- a/windows/client-management/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/on-premise-authentication-device-enrollment.md @@ -16,10 +16,10 @@ appliesto: # On-premises authentication device enrollment -This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). +This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). > [!NOTE] -> For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +> For the list of enrollment scenarios not supported in Windows, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery service diff --git a/windows/client-management/understanding-admx-backed-policies.md b/windows/client-management/understanding-admx-backed-policies.md index 1dd76ad9e8..dd0861e26c 100644 --- a/windows/client-management/understanding-admx-backed-policies.md +++ b/windows/client-management/understanding-admx-backed-policies.md @@ -7,7 +7,7 @@ ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 03/23/2020 -ms.reviewer: +ms.reviewer: manager: aaroncz appliesto: - ✅ Windows 11 @@ -18,9 +18,9 @@ appliesto: Due to increased simplicity and the ease with which devices can be targeted, enterprise businesses are finding it increasingly advantageous to move their PC management to a cloud-based device management solution. Unfortunately, the modern Windows PC device-management solutions lack the critical policy and app settings configuration capabilities that are supported in a traditional PC management solution. -Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support expanded to allow access of selected set of Group Policy administrative templates (ADMX policies) for Windows PCs via the Policy configuration service provider (CSP). This expanded access ensures that enterprises can keep their devices compliant and prevent the risk on compromising security of their devices managed through the cloud. +Mobile Device Management (MDM) policy configuration support expanded to allow access of selected set of Group Policy administrative templates (ADMX policies) for Windows PCs via the Policy configuration service provider (CSP). This expanded access ensures that enterprises can keep their devices compliant and prevent the risk on compromising security of their devices managed through the cloud. -## Background +## Background In addition to standard MDM policies, the Policy CSP can also handle selected set of ADMX policies. In an ADMX policy, an administrative template contains the metadata of a Windows Group Policy and can be edited in the Local Group Policy Editor on a PC. Each administrative template specifies the registry keys (and their values) that are associated with a Group Policy and defines the policy settings that can be managed. Administrative templates organize Group Policies in a hierarchy in which each segment in the hierarchical path is defined as a category. Each setting in a Group Policy administrative template corresponds to a specific registry value. These Group Policy settings are defined in a standards-based, XML file format known as an ADMX file. For more information, see [Group Policy ADMX Syntax Reference Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753471(v=ws.10)). @@ -39,7 +39,7 @@ Windows maps the name and category path of a Group Policy to an MDM policy area -## ADMX files and the Group Policy Editor +## ADMX files and the Group Policy Editor To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrator must use a UI, such as the Group Policy Editor (gpedit.msc), to gather the necessary data. The MDM ISV console UI determines how to gather the needed Group Policy data from the IT administrator. ADMX Group Policies are organized in a hierarchy and can have a scope of machine, user, or both. The Group Policy example in the next section uses a machine-wide Group Policy named "Publishing Server 2 Settings." When this Group Policy is selected, its available states are **Not Configured**, **Enabled**, and **Disabled**. @@ -48,16 +48,16 @@ The ADMX file that the MDM ISV uses to determine what UI to display to the IT ad Group Policy option button setting: - If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur: - - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. - - The MDM client stack receives this data, which causes the Policy CSP to update the device's registry per the ADMX policy definition. + - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. + - The MDM client stack receives this data, which causes the Policy CSP to update the device's registry per the ADMX policy definition. - If **Disabled** is selected and you click **Apply**, the following events occur: - - The MDM ISV server sets up a Replace SyncML command with a payload set to ``. - - The MDM client stack receives this command, which causes the Policy CSP to either delete the device's registry settings, set the registry keys, or both, per the state change directed by the ADMX policy definition. + - The MDM ISV server sets up a Replace SyncML command with a payload set to ``. + - The MDM client stack receives this command, which causes the Policy CSP to either delete the device's registry settings, set the registry keys, or both, per the state change directed by the ADMX policy definition. - If **Not Configured** is selected and you click **Apply**, the following events occur: - - MDM ISV server sets up a Delete SyncML command. - - The MDM client stack receives this command, which causes the Policy CSP to delete the device's registry settings per the ADMX policy definition. + - MDM ISV server sets up a Delete SyncML command. + - The MDM client stack receives this command, which causes the Policy CSP to delete the device's registry settings per the ADMX policy definition. The following diagram shows the main display for the Group Policy Editor. @@ -77,23 +77,26 @@ For more information about the Group Policy description format, see [Administrat For example, if you search for the string, "Publishing_Server2_Name_Prompt" in both the *Enabling a policy* example and its corresponding ADMX policy definition in the appv.admx file, you'll find the following occurrences: Enabling a policy example: + ```XML `` ``` Appv.admx file: + ```XML ``` -## ADMX policy examples +## ADMX policy examples The following SyncML examples describe how to set an MDM policy that is defined by an ADMX template, specifically the Publishing_Server2_Policy Group Policy description in the application virtualization ADMX file, appv.admx. The functionality that this Group Policy manages isn't important; it's used to illustrate only how an MDM ISV can set an ADMX policy. These SyncML examples illustrate common options and the corresponding SyncML code that can be used for testing your policies. The payload of the SyncML must be XML-encoded; for this XML encoding, you can use favorite online tool. To avoid encoding the payload, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -### Enabling a policy +### Enabling a policy + +**Payload**: -**Payload** ```XML @@ -107,7 +110,9 @@ The following SyncML examples describe how to set an MDM policy that is defined ``` -**Request SyncML** + +**Request SyncML**: + ```XML @@ -141,7 +146,8 @@ The following SyncML examples describe how to set an MDM policy that is defined ``` -**Response SyncML** +**Response SyncML**: + ```XML 2 @@ -152,14 +158,16 @@ The following SyncML examples describe how to set an MDM policy that is defined ``` -### Disabling a policy +### Disabling a policy + +**Payload**: -**Payload** ```XML ``` -**Request SyncML** +**Request SyncML**: + ```XML @@ -180,9 +188,10 @@ The following SyncML examples describe how to set an MDM policy that is defined -'''' +``` + +**Response SyncML**: -**Response SyncML** ```XML 2 @@ -193,13 +202,13 @@ The following SyncML examples describe how to set an MDM policy that is defined ``` -### Setting a policy to not configured +### Setting a policy to not configured -**Payload** +**Payload**: (None) -**Request SyncML** +**Request SyncML**: ```XML @@ -218,7 +227,7 @@ The following SyncML examples describe how to set an MDM policy that is defined ``` -**Response SyncML** +**Response SyncML**: ```XML @@ -230,11 +239,11 @@ The following SyncML examples describe how to set an MDM policy that is defined ``` -## Sample SyncML for various ADMX elements +## Sample SyncML for various ADMX elements This section describes sample SyncML for the various ADMX elements like Text, Multi-Text, Decimal, Boolean, and List. -### How a Group Policy policy category path and name are mapped to an MDM area and policy name +### How a Group Policy policy category path and name are mapped to an MDM area and policy name Below is the internal OS mapping of a Group Policy to an MDM area and name. This mapping is part of a set of Windows manifest that when compiled parses out the associated ADMX file, finds the specified Group Policy policy and stores that definition (metadata) in the MDM Policy CSP client store. ADMX backed policies are organized hierarchically. Their scope can be **machine**, **user**, or have a scope of **both**. When the MDM policy is referred to through a SyncML command and the Policy CSP URI, as shown below, this metadata is referenced and determines what registry keys are set or removed. Machine-scope policies are referenced via .\Device and the user scope policies via .\User. @@ -242,23 +251,19 @@ Below is the internal OS mapping of a Group Policy to an MDM area and name. This The data payload of the SyncML needs to be encoded so that it doesn't conflict with the boilerplate SyncML XML tags. Use this online tool for encoding and decoding the policy data [Coder's Toolbox](https://coderstoolbox.net/string/#!encoding=xml&action=encode&charset=us_ascii). -**Snippet of manifest for AppVirtualization area:** +**Snippet of manifest for AppVirtualization area**: ```XML -. -. -. + ... -. -. -. + ... ``` The **LocURI** for the above GP policy is: @@ -267,11 +272,11 @@ The **LocURI** for the above GP policy is: To construct SyncML for your area/policy using the samples below, you need to update the **data id** and the **value** in the `` section of the SyncML. The items prefixed with an '&' character are the escape characters needed and can be retained as shown. -### Text Element +### Text Element The `text` element simply corresponds to a string and correspondingly to an edit box in a policy panel display by gpedit.msc. The string is stored in the registry of type REG_SZ. -**ADMX file: inetres.admx** +**ADMX file: inetres.admx**: ```XML @@ -283,7 +288,7 @@ The `text` element simply corresponds to a string and correspondingly to an edit ``` -#### Corresponding SyncML: +**Corresponding SyncML**: ```XML @@ -307,7 +312,7 @@ The `text` element simply corresponds to a string and correspondingly to an edit ``` -### MultiText Element +### MultiText Element The `multiText` element simply corresponds to a REG_MULTISZ registry string and correspondingly to a grid to enter multiple strings in a policy panel display by gpedit.msc. It's expected that each string in the SyncML is to be separated by the Unicode character 0xF000 (encoded version: ``) @@ -324,7 +329,7 @@ The `multiText` element simply corresponds to a REG_MULTISZ registry string and ``` -#### Corresponding SyncML: +**Corresponding SyncML**: ```XML @@ -348,7 +353,7 @@ The `multiText` element simply corresponds to a REG_MULTISZ registry string and ``` -### List Element (and its variations) +### List Element (and its variations) The `list` element simply corresponds to a hive of REG_SZ registry strings and correspondingly to a grid to enter multiple strings in a policy panel display by gpedit.msc. How this element is represented in SyncML is as a string containing pairs of strings. Each pair is a REG_SZ name/value key. It's best to apply the policy through gpedit.msc (run as Administrator) and go to the registry hive location and see how the list values are stored. This location will give you an idea of the way the name/value pairs are stored to express it through SyncML. @@ -357,7 +362,7 @@ The `list` element simply corresponds to a hive of REG_SZ registry strings and c Variations of the `list` element are dictated by attributes. These attributes are ignored by the Policy Manager runtime. It's expected that the MDM server manages the name/value pairs. See below for a simple write-up of Group Policy List. -**ADMX file: inetres.admx** +**ADMX file: inetres.admx**: ```XML @@ -369,7 +374,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -#### Corresponding SyncML: +**Corresponding SyncML**: ```XML @@ -392,7 +397,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -### No Elements +### No Elements ```XML @@ -401,7 +406,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -#### Corresponding SyncML: +**Corresponding SyncML**: ```XML @@ -424,7 +429,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -### Enum +### Enum ```XML @@ -458,7 +463,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -#### Corresponding SyncML: +**Corresponding SyncML**: ```XML @@ -480,7 +485,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -### Decimal Element +### Decimal Element ```XML ``` -#### Corresponding SyncML: +**Corresponding SyncML**: ```XML @@ -517,7 +522,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -### Boolean Element +### Boolean Element ```XML @@ -543,7 +548,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ``` -#### Corresponding SyncML: +**Corresponding SyncML**: ```XML diff --git a/windows/client-management/win32-and-centennial-app-policy-configuration.md b/windows/client-management/win32-and-centennial-app-policy-configuration.md index b07babe5e8..5af3714a87 100644 --- a/windows/client-management/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/win32-and-centennial-app-policy-configuration.md @@ -1,13 +1,13 @@ --- title: Win32 and Desktop Bridge app ADMX policy Ingestion -description: Starting in Windows 10, version 1703, you can ingest ADMX files and set those ADMX policies for Win32 and Desktop Bridge apps. +description: Ingest ADMX files and set ADMX policies for Win32 and Desktop Bridge apps. ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 03/23/2020 -ms.reviewer: +ms.reviewer: manager: aaroncz appliesto: - ✅ Windows 11 @@ -16,21 +16,12 @@ appliesto: # Win32 and Desktop Bridge app ADMX policy Ingestion -## In this section +## Overview -- [Overview](#overview) -- [Ingesting an app ADMX file](#ingesting-an-app-admx-file) -- [URI format for configuring an app policy](#uri-format-for-configuring-an-app-policy) -- [ADMX app policy examples](#admx-backed-app-policy-examples) - - [Enabling an app policy](#enabling-an-app-policy) - - [Disabling an app policy](#disabling-an-app-policy) - - [Setting an app policy to not configured](#setting-an-app-policy-to-not-configured) +You can ingest ADMX files (ADMX ingestion) and set those ADMX policies for Win32 and Desktop Bridge apps by using Windows Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. -## Overview +NOTE: Starting from the following Windows versions Replace command is supported: -Starting in Windows 10, version 1703, you can ingest ADMX files (ADMX ingestion) and set those ADMX policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. - -NOTE: Starting from the following Windows 10 version Replace command is supported - Windows 10, version 1903 with KB4512941 and KB4517211 installed - Windows 10, version 1809 with KB4512534 and KB installed - Windows 10, version 1803 with KB4512509 and KB installed @@ -66,11 +57,12 @@ When the ADMX policies are ingested, the registry keys to which each policy is w > [!NOTE] > Settings that cannot be configured using custom policy ingestion have to be set by pushing the appropriate registry keys directly (for example, by using PowerShell script). -## Ingesting an app ADMX file +## Ingesting an app ADMX file The following ADMX file example shows how to ingest a Win32 or Desktop Bridge app ADMX file and set policies from the file. The ADMX file defines eight policies. -**Payload** +**Payload**: + ```XML @@ -204,7 +196,7 @@ The following ADMX file example shows how to ingest a Win32 or Desktop Bridge ap ``` -**Request Syncml** +**Request Syncml**: The ADMX file is escaped and sent in SyncML format through the Policy CSP URI, `./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}/{SettingType}/{FileUid or AdmxFileName}`. When the ADMX file is imported, the policy states for each new policy are the same as those in a regular MDM policy: Enabled, Disabled, or Not Configured. @@ -363,12 +355,13 @@ The following example shows an ADMX file in SyncML format: ``` -**Response Syncml** +**Response Syncml**: + ```XML 21102Add200 ``` -### URI format for configuring an app policy +### URI format for configuring an app policy The following example shows how to derive a Win32 or Desktop Bridge app policy name and policy area name: @@ -397,10 +390,9 @@ The following example shows how to derive a Win32 or Desktop Bridge app policy n ``` -As documented in [Policy CSP](mdm/policy-configuration-service-provider.md), the URI format to configure a policy via Policy CSP is: -'./{user or device}/Vendor/MSFT/Policy/Config/{AreaName}/{PolicyName}'. +As documented in [Policy CSP](mdm/policy-configuration-service-provider.md), the URI format to configure a policy via Policy CSP is: `./{user or device}/Vendor/MSFT/Policy/Config/{AreaName}/{PolicyName}`. -**User or device policy** +**User or device policy**: In the policy class, the attribute is defined as "User" and the URI is prefixed with `./user`. If the attribute value is "Machine", the URI is prefixed with `./device`. @@ -418,20 +410,22 @@ Therefore, from the example: - Policy area name: ContosoCompanyApp~Policy~ParentCategoryArea~Category2~Category3 - URI: `./user/Vendor/MSFT/Policy/Config/ContosoCompanyApp~Policy~ParentCategoryArea~Category2~Category3/L_PolicyPreventRun_1` -## ADMX-backed app policy examples +## ADMX-backed app policy examples The following examples describe how to set an ADMX-ingested app policy. -### Enabling an app policy +### Enabling an app policy + +**Payload**: -**Payload** ```XML ``` -**Request Syncml** +**Request Syncml**: + ```XML @@ -453,19 +447,22 @@ The following examples describe how to set an ADMX-ingested app policy. ``` -**Response SyncML** +**Response SyncML**: + ```XML 21103Replace200 ``` -### Disabling an app policy +### Disabling an app policy + +**Payload**: -**Payload** ```XML ``` -**Request SyncML** +**Request SyncML**: + ```XML @@ -487,18 +484,20 @@ The following examples describe how to set an ADMX-ingested app policy. ``` -**Response SyncML** +**Response SyncML**: + ```XML 21104Replace200 ``` -### Setting an app policy to not configured +### Setting an app policy to not configured -**Payload** +**Payload**: (None) -**Request SyncML** +**Request SyncML**: + ```XML @@ -515,7 +514,8 @@ The following examples describe how to set an ADMX-ingested app policy. ``` -**Response SyncML** +**Response SyncML**: + ```XML 21105Delete200 ``` diff --git a/windows/client-management/wmi-providers-supported-in-windows.md b/windows/client-management/wmi-providers-supported-in-windows.md index 1441ff5fcd..79a3785540 100644 --- a/windows/client-management/wmi-providers-supported-in-windows.md +++ b/windows/client-management/wmi-providers-supported-in-windows.md @@ -1,7 +1,7 @@ --- -title: WMI providers supported in Windows 10 +title: WMI providers supported in Windows description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -14,9 +14,9 @@ appliesto: - ✅ Windows 10 --- -# WMI providers supported in Windows 10 +# WMI providers supported in Windows -Windows Management Infrastructure (WMI) providers (and the classes they support) are used to manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service. The following subsections show the list WMI MDM classes that are supported in Windows 10. +Windows Management Infrastructure (WMI) providers (and the classes they support) are used to manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service. The following subsections show the list WMI MDM classes that are supported in Windows. > [!NOTE] > Applications installed using WMI classes are not removed when the MDM account is removed from device. @@ -53,130 +53,130 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw ## MDM WMI classes -|Class|Test completed in Windows 10 for desktop| -|--- |--- | -|[**MDM_AppInstallJob**](/previous-versions/windows/desktop/mdmappprov/mdm-appinstalljob)|Currently testing.| -|[**MDM_Application**](/previous-versions/windows/desktop/mdmappprov/mdm-application)|Currently testing.| -|[**MDM_ApplicationFramework**](/previous-versions/windows/desktop/mdmappprov/mdm-applicationframework)|Currently testing.| -|[**MDM_ApplicationSetting**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-applicationsetting)|Currently testing.| -|[**MDM_BrowserSecurityZones**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-browsersecurityzones)|Yes| -|[**MDM_BrowserSettings**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-browsersettings)|Yes| -|[**MDM_Certificate**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-certificate)|Yes| -|[**MDM_CertificateEnrollment**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-certificateenrollment)|Yes| -|[**MDM_Client**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-client)|Currently testing.| -|[**MDM_ConfigSetting**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-configsetting)|Yes| -|[**MDM_DeviceRegistrationInfo**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-deviceregistrationinfo)|| -|[**MDM_EASPolicy**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-easpolicy)|Yes| -|[**MDM_MgMtAuthority**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-mgmtauthority)|Yes| -|**MDM_MsiApplication**|| -|**MDM_MsiInstallJob**|| -|[**MDM_RemoteApplication**](/previous-versions/windows/desktop/mdmappprov/mdm-remoteapplication)|Test not started.| -|[**MDM_RemoteAppUseCookie**](/previous-versions/windows/desktop/mdmappprov/mdm-remoteappusercookie)|Test not started.| -|[**MDM_Restrictions**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-restrictions)|Yes| -|[**MDM_RestrictionsUser**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-restrictionsuser)|Test not started.| -|[**MDM_SecurityStatus**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-securitystatus)|Yes| -|[**MDM_SideLoader**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-sideloader)|| -|[**MDM_SecurityStatusUser**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-securitystatususer)|Currently testing.| -|[**MDM_Updates**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-updates)|Yes| -|[**MDM_VpnApplicationTrigger**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-vpnapplicationtrigger)|Yes| -|**MDM_VpnConnection**|| -|[**MDM_WebApplication**](/previous-versions/windows/desktop/mdmappprov/mdm-webapplication)|Currently testing.| -|[**MDM_WirelessProfile**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wirelessprofile)|Yes| -|[**MDM_WirelesssProfileXML**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wirelessprofilexml)|Yes| -|[**MDM_WNSChannel**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnschannel)|Yes| -|[**MDM_WNSConfiguration**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnsconfiguration)|Yes| -|[**MSFT_NetFirewallProfile**](/previous-versions/windows/desktop/wfascimprov/msft-netfirewallprofile)|Yes| -|[**MSFT_VpnConnection**](/previous-versions/windows/desktop/vpnclientpsprov/msft-vpnconnection)|Yes| -|[**SoftwareLicensingProduct**](/previous-versions/windows/desktop/sppwmi/softwarelicensingproduct)|| -|[**SoftwareLicensingService**](/previous-versions/windows/desktop/sppwmi/softwarelicensingservice)|| +| Class | Test completed in Windows 10 | +|-----------------------------------------------------------------------------------------------------------------|------------------------------| +| [**MDM_AppInstallJob**](/previous-versions/windows/desktop/mdmappprov/mdm-appinstalljob) | Currently testing. | +| [**MDM_Application**](/previous-versions/windows/desktop/mdmappprov/mdm-application) | Currently testing. | +| [**MDM_ApplicationFramework**](/previous-versions/windows/desktop/mdmappprov/mdm-applicationframework) | Currently testing. | +| [**MDM_ApplicationSetting**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-applicationsetting) | Currently testing. | +| [**MDM_BrowserSecurityZones**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-browsersecurityzones) | Yes | +| [**MDM_BrowserSettings**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-browsersettings) | Yes | +| [**MDM_Certificate**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-certificate) | Yes | +| [**MDM_CertificateEnrollment**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-certificateenrollment) | Yes | +| [**MDM_Client**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-client) | Currently testing. | +| [**MDM_ConfigSetting**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-configsetting) | Yes | +| [**MDM_DeviceRegistrationInfo**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-deviceregistrationinfo) | | +| [**MDM_EASPolicy**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-easpolicy) | Yes | +| [**MDM_MgMtAuthority**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-mgmtauthority) | Yes | +| **MDM_MsiApplication** | | +| **MDM_MsiInstallJob** | | +| [**MDM_RemoteApplication**](/previous-versions/windows/desktop/mdmappprov/mdm-remoteapplication) | Test not started. | +| [**MDM_RemoteAppUseCookie**](/previous-versions/windows/desktop/mdmappprov/mdm-remoteappusercookie) | Test not started. | +| [**MDM_Restrictions**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-restrictions) | Yes | +| [**MDM_RestrictionsUser**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-restrictionsuser) | Test not started. | +| [**MDM_SecurityStatus**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-securitystatus) | Yes | +| [**MDM_SideLoader**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-sideloader) | | +| [**MDM_SecurityStatusUser**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-securitystatususer) | Currently testing. | +| [**MDM_Updates**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-updates) | Yes | +| [**MDM_VpnApplicationTrigger**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-vpnapplicationtrigger) | Yes | +| **MDM_VpnConnection** | | +| [**MDM_WebApplication**](/previous-versions/windows/desktop/mdmappprov/mdm-webapplication) | Currently testing. | +| [**MDM_WirelessProfile**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wirelessprofile) | Yes | +| [**MDM_WirelesssProfileXML**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wirelessprofilexml) | Yes | +| [**MDM_WNSChannel**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnschannel) | Yes | +| [**MDM_WNSConfiguration**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnsconfiguration) | Yes | +| [**MSFT_NetFirewallProfile**](/previous-versions/windows/desktop/wfascimprov/msft-netfirewallprofile) | Yes | +| [**MSFT_VpnConnection**](/previous-versions/windows/desktop/vpnclientpsprov/msft-vpnconnection) | Yes | +| [**SoftwareLicensingProduct**](/previous-versions/windows/desktop/sppwmi/softwarelicensingproduct) | | +| [**SoftwareLicensingService**](/previous-versions/windows/desktop/sppwmi/softwarelicensingservice) | | ### Parental control WMI classes -| Class | Test completed in Windows 10 for desktop | -|--------------------------------------------------------------------------|------------------------------------------| -| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcRatingsDescriptor**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | | -| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | -| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| Class | Test completed in Windows 10 | +|-----------------------------------------------------------------------------------------|------------------------------| +| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcRatingsDescriptor**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | | +| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | +| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | Yes | ### Win32 WMI classes -| Class | Test completed in Windows 10 for desktop | -|--------------------------------------------------------------------------|------------------------------------------| -[**Win32\_1394Controller**](/windows/win32/cimwin32prov/win32-1394controller) | -[**Win32\_BaseBoard**](/windows/win32/cimwin32prov/win32-baseboard) | -[**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | Yes -[**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | Yes -[**Win32\_CDROMDrive**](/windows/win32/cimwin32prov/win32-cdromdrive) | -[**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | Yes -[**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | Yes -[**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | Yes -[**Win32\_Desktop**](/windows/win32/cimwin32prov/win32-desktop) | -[**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) |Yes -[**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | Yes -[**Win32\_DiskPartition**](/windows/win32/cimwin32prov/win32-diskpartition) | -[**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | Yes -[**Win32\_DMAChannel**](/windows/win32/cimwin32prov/win32-dmachannel) | -[**Win32\_DriverVXD**](/previous-versions//aa394141(v=vs.85)) | -[**Win32\_EncryptableVolume**](/windows/win32/secprov/win32-encryptablevolume) | -[**Win32\_Environment**](/windows/win32/cimwin32prov/win32-environment) | -[**Win32\_IDEController**](/windows/win32/cimwin32prov/win32-idecontroller) | -[**Win32\_InfraredDevice**](/windows/win32/cimwin32prov/win32-infrareddevice) | -[**Win32\_IRQResource**](/windows/win32/cimwin32prov/win32-irqresource) | -[**Win32\_Keyboard**](/windows/win32/cimwin32prov/win32-keyboard) | -[**Win32\_LoadOrderGroup**](/windows/win32/cimwin32prov/win32-loadordergroup) | -[**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | Yes -[**Win32\_LoggedOnUser**](/windows/win32/cimwin32prov/win32-loggedonuser) | -[**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | Yes -[**Win32\_MotherboardDevice**](/windows/win32/cimwin32prov/win32-motherboarddevice) | -[**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | Yes -[**Win32\_NetworkAdapterConfiguration**](/windows/win32/cimwin32prov/win32-networkadapterconfiguration) | -[**Win32\_NetworkClient**](/windows/win32/cimwin32prov/win32-networkclient) | -[**Win32\_NetworkLoginProfile**](/windows/win32/cimwin32prov/win32-networkloginprofile) | -[**Win32\_NetworkProtocol**](/windows/win32/cimwin32prov/win32-networkprotocol) | -[**Win32\_NTEventlogFile**](/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)) | -[**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | Yes -[**Win32\_OSRecoveryConfiguration**](/windows/win32/cimwin32prov/win32-osrecoveryconfiguration) | -[**Win32\_PageFileSetting**](/windows/win32/cimwin32prov/win32-pagefilesetting) | -[**Win32\_ParallelPort**](/windows/win32/cimwin32prov/win32-parallelport) | -[**Win32\_PCMCIAController**](/windows/win32/cimwin32prov/win32-pcmciacontroller) | -[**Win32\_PhysicalMedia**](/previous-versions/windows/desktop/cimwin32a/win32-physicalmedia) | -[**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | Yes -[**Win32\_PnPDevice**](/windows/win32/cimwin32prov/win32-pnpdevice) | -[**Win32\_PnPEntity**](/windows/win32/cimwin32prov/win32-pnpentity) | -[**Win32\_PointingDevice**](/windows/win32/cimwin32prov/win32-pointingdevice) | -[**Win32\_PortableBattery**](/windows/win32/cimwin32prov/win32-portablebattery) | -[**Win32\_PortResource**](/windows/win32/cimwin32prov/win32-portresource) | -[**Win32\_POTSModem**](/windows/win32/cimwin32prov/win32-potsmodem) | -[**Win32\_Printer**](/windows/win32/cimwin32prov/win32-printer) | -[**Win32\_PrinterConfiguration**](/windows/win32/cimwin32prov/win32-printerconfiguration) | -[**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | Yes -[**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | Yes -[**Win32\_Registry**](/windows/win32/cimwin32prov/win32-registry) | -[**Win32\_SCSIController**](/windows/win32/cimwin32prov/win32-scsicontroller) | -[**Win32\_SerialPort**](/windows/win32/cimwin32prov/win32-serialport) | -[**Win32\_SerialPortConfiguration**](/windows/win32/cimwin32prov/win32-serialportconfiguration) | -[**Win32\_ServerFeature**](/windows/win32/wmisdk/win32-serverfeature) | -[**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | Yes -[**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | Yes -[**Win32\_SoundDevice**](/windows/win32/cimwin32prov/win32-sounddevice) | -[**Win32\_SystemAccount**](/windows/win32/cimwin32prov/win32-systemaccount) | -[**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | Yes -[**Win32\_SystemDriver**](/windows/win32/cimwin32prov/win32-systemdriver) | -[**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | Yes -[**Win32\_TapeDrive**](/windows/win32/cimwin32prov/win32-tapedrive) | -[**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | Yes -[**Win32\_UninterruptiblePowerSupply**](/previous-versions//aa394503(v=vs.85)) | -[**Win32\_USBController**](/windows/win32/cimwin32prov/win32-usbcontroller) | -[**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | Yes -[**Win32\_VideoController**](/windows/win32/cimwin32prov/win32-videocontroller) | -**Win32\_WindowsUpdateAgentVersion** | +| Class | Test completed in Windows 10 | +|---------------------------------------------------------------------------------------------------------|------------------------------| +| [**Win32\_1394Controller**](/windows/win32/cimwin32prov/win32-1394controller) | +| [**Win32\_BaseBoard**](/windows/win32/cimwin32prov/win32-baseboard) | +| [**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | Yes | +| [**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | Yes | +| [**Win32\_CDROMDrive**](/windows/win32/cimwin32prov/win32-cdromdrive) | +| [**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | Yes | +| [**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | Yes | +| [**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | Yes | +| [**Win32\_Desktop**](/windows/win32/cimwin32prov/win32-desktop) | +| [**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) | Yes | +| [**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | Yes | +| [**Win32\_DiskPartition**](/windows/win32/cimwin32prov/win32-diskpartition) | +| [**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | Yes | +| [**Win32\_DMAChannel**](/windows/win32/cimwin32prov/win32-dmachannel) | +| [**Win32\_DriverVXD**](/previous-versions//aa394141(v=vs.85)) | +| [**Win32\_EncryptableVolume**](/windows/win32/secprov/win32-encryptablevolume) | +| [**Win32\_Environment**](/windows/win32/cimwin32prov/win32-environment) | +| [**Win32\_IDEController**](/windows/win32/cimwin32prov/win32-idecontroller) | +| [**Win32\_InfraredDevice**](/windows/win32/cimwin32prov/win32-infrareddevice) | +| [**Win32\_IRQResource**](/windows/win32/cimwin32prov/win32-irqresource) | +| [**Win32\_Keyboard**](/windows/win32/cimwin32prov/win32-keyboard) | +| [**Win32\_LoadOrderGroup**](/windows/win32/cimwin32prov/win32-loadordergroup) | +| [**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | Yes | +| [**Win32\_LoggedOnUser**](/windows/win32/cimwin32prov/win32-loggedonuser) | +| [**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | Yes | +| [**Win32\_MotherboardDevice**](/windows/win32/cimwin32prov/win32-motherboarddevice) | +| [**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | Yes | +| [**Win32\_NetworkAdapterConfiguration**](/windows/win32/cimwin32prov/win32-networkadapterconfiguration) | +| [**Win32\_NetworkClient**](/windows/win32/cimwin32prov/win32-networkclient) | +| [**Win32\_NetworkLoginProfile**](/windows/win32/cimwin32prov/win32-networkloginprofile) | +| [**Win32\_NetworkProtocol**](/windows/win32/cimwin32prov/win32-networkprotocol) | +| [**Win32\_NTEventlogFile**](/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)) | +| [**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | Yes | +| [**Win32\_OSRecoveryConfiguration**](/windows/win32/cimwin32prov/win32-osrecoveryconfiguration) | +| [**Win32\_PageFileSetting**](/windows/win32/cimwin32prov/win32-pagefilesetting) | +| [**Win32\_ParallelPort**](/windows/win32/cimwin32prov/win32-parallelport) | +| [**Win32\_PCMCIAController**](/windows/win32/cimwin32prov/win32-pcmciacontroller) | +| [**Win32\_PhysicalMedia**](/previous-versions/windows/desktop/cimwin32a/win32-physicalmedia) | +| [**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | Yes | +| [**Win32\_PnPDevice**](/windows/win32/cimwin32prov/win32-pnpdevice) | +| [**Win32\_PnPEntity**](/windows/win32/cimwin32prov/win32-pnpentity) | +| [**Win32\_PointingDevice**](/windows/win32/cimwin32prov/win32-pointingdevice) | +| [**Win32\_PortableBattery**](/windows/win32/cimwin32prov/win32-portablebattery) | +| [**Win32\_PortResource**](/windows/win32/cimwin32prov/win32-portresource) | +| [**Win32\_POTSModem**](/windows/win32/cimwin32prov/win32-potsmodem) | +| [**Win32\_Printer**](/windows/win32/cimwin32prov/win32-printer) | +| [**Win32\_PrinterConfiguration**](/windows/win32/cimwin32prov/win32-printerconfiguration) | +| [**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | Yes | +| [**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | Yes | +| [**Win32\_Registry**](/windows/win32/cimwin32prov/win32-registry) | +| [**Win32\_SCSIController**](/windows/win32/cimwin32prov/win32-scsicontroller) | +| [**Win32\_SerialPort**](/windows/win32/cimwin32prov/win32-serialport) | +| [**Win32\_SerialPortConfiguration**](/windows/win32/cimwin32prov/win32-serialportconfiguration) | +| [**Win32\_ServerFeature**](/windows/win32/wmisdk/win32-serverfeature) | +| [**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | Yes | +| [**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | Yes | +| [**Win32\_SoundDevice**](/windows/win32/cimwin32prov/win32-sounddevice) | +| [**Win32\_SystemAccount**](/windows/win32/cimwin32prov/win32-systemaccount) | +| [**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | Yes | +| [**Win32\_SystemDriver**](/windows/win32/cimwin32prov/win32-systemdriver) | +| [**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | Yes | +| [**Win32\_TapeDrive**](/windows/win32/cimwin32prov/win32-tapedrive) | +| [**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | Yes | +| [**Win32\_UninterruptiblePowerSupply**](/previous-versions//aa394503(v=vs.85)) | +| [**Win32\_USBController**](/windows/win32/cimwin32prov/win32-usbcontroller) | +| [**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | Yes | +| [**Win32\_VideoController**](/windows/win32/cimwin32prov/win32-videocontroller) | +| **Win32\_WindowsUpdateAgentVersion** | ## Related topics From 2e6b030b43f8c02a642503b4ef11d8f97c93bd71 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Tue, 11 Apr 2023 22:58:15 +0530 Subject: [PATCH 062/139] ExcludeWUDriversInQualityUpdate changed as per user report #11386 and i checked on Windows 11 enterprise 64bit build no 22622.1485, this was **AllowTemporaryEnterpriseFeatureControl** was seen in nregistry --- windows/deployment/update/waas-configure-wufb.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index abf55e970a..2b2f4074ec 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -221,7 +221,7 @@ The features that are turned off by default from servicing updates will be enabl | Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 11, version 22H2 with [kb5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
    Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage end user experience > **Enable features introduced via servicing that are off by default**| \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | +| GPO for Windows 11, version 22H2 with [kb5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
    Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage end user experience > **Enable features introduced via servicing that are off by default**| \Policies\Microsoft\Windows\WindowsUpdate\AllowTemporaryEnterpriseFeatureControl | | MDM for Windows 11, version 22H2 with [kb5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later:
    ../Vendor/MSFT/Policy/Config/Update/
    **[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol)** | \Microsoft\PolicyManager\default\Update\AllowTemporaryEnterpriseFeatureControl | From e544f2a3704b9fb3a6584ffcc0770fec80edbc31 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 11 Apr 2023 15:37:44 -0400 Subject: [PATCH 063/139] Mo changes --- .openpublishing.redirection.json | 6 +- ....md => administrative-tools-in-windows.md} | 6 +- .../client-tools/connect-to-remote-aadj-pc.md | 16 +- ...s-for-enterprise-and-education-editions.md | 34 -- .../client-tools/mandatory-user-profile.md | 58 +- .../new-policies-for-windows-10.md | 507 ------------------ .../client-tools/quick-assist.md | 2 +- .../client-management/client-tools/toc.yml | 4 +- ...-in-your-organization-modern-management.md | 2 +- 9 files changed, 44 insertions(+), 591 deletions(-) rename windows/client-management/client-tools/{administrative-tools-in-windows-10.md => administrative-tools-in-windows.md} (97%) delete mode 100644 windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions.md delete mode 100644 windows/client-management/client-tools/new-policies-for-windows-10.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index d418d33847..6f5a828829 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6637,7 +6637,7 @@ }, { "source_path": "windows/client-management/administrative-tools-in-windows-10.md", - "redirect_url": "/windows/client-management/client-tools/administrative-tools-in-windows-10", + "redirect_url": "/windows/client-management/client-tools/administrative-tools-in-windows", "redirect_document_id": false }, { @@ -6652,7 +6652,7 @@ }, { "source_path": "windows/client-management/group-policies-for-enterprise-and-education-editions.md", - "redirect_url": "/windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions", + "redirect_url": "https://www.microsoft.com/en-us/search/explore?q=Group+Policy+Settings+Reference+Spreadsheet", "redirect_document_id": false }, { @@ -6672,7 +6672,7 @@ }, { "source_path": "windows/client-management/new-policies-for-windows-10.md", - "redirect_url": "/windows/client-management/client-tools/new-policies-for-windows-10", + "redirect_url": "https://www.microsoft.com/en-us/search/explore?q=Group+Policy+Settings+Reference+Spreadsheet", "redirect_document_id": false }, { diff --git a/windows/client-management/client-tools/administrative-tools-in-windows-10.md b/windows/client-management/client-tools/administrative-tools-in-windows.md similarity index 97% rename from windows/client-management/client-tools/administrative-tools-in-windows-10.md rename to windows/client-management/client-tools/administrative-tools-in-windows.md index 33c89a2952..a511db702c 100644 --- a/windows/client-management/client-tools/administrative-tools-in-windows-10.md +++ b/windows/client-management/client-tools/administrative-tools-in-windows.md @@ -6,7 +6,7 @@ author: vinaypamnani-msft ms.author: vinpa manager: aaroncz ms.localizationpriority: medium -ms.date: 03/28/2022 +ms.date: 04/11/2023 ms.topic: article ms.collection: - highpri @@ -21,7 +21,7 @@ appliesto: **Windows Tools** is a folder in the Windows 11 Control Panel. **Administrative Tools** is a folder in the Windows 10 Control Panel. These folders contain tools for system administrators and advanced users. -## Windows Tools folder (Windows 11) +## Windows Tools folder The following graphic shows the **Windows Tools** folder in Windows 11: @@ -31,7 +31,7 @@ The tools in the folder might vary depending on which edition of Windows you use :::image type="content" source="images/win11-windows-tools.png" alt-text="Screenshot of the contents of the Windows Tools folder in Windows 11." lightbox="images/win11-windows-tools.png"::: -## Administrative Tools folder (Windows 10) +## Administrative Tools folder The following graphic shows the **Administrative Tools** folder in Windows 10: diff --git a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md index 0eb9f006f8..85c581ddd4 100644 --- a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md +++ b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md @@ -1,11 +1,11 @@ --- -title: Connect to remote Azure Active Directory joined device (Windows) +title: Connect to remote Azure Active Directory joined device description: Learn how to use Remote Desktop Connection to connect to an Azure AD joined device. ms.prod: windows-client author: vinaypamnani-msft ms.localizationpriority: medium ms.author: vinpa -ms.date: 01/18/2022 +ms.date: 04/11/2023 manager: aaroncz ms.topic: article appliesto: @@ -19,11 +19,11 @@ ms.technology: itpro-manage # Connect to remote Azure Active Directory joined device -From its release, Windows has supported remote connections to devices joined to Active Directory using Remote Desktop Protocol (RDP). Windows 10, version 1607 added the ability to connect to a device that is joined to Azure Active Directory (Azure AD) using RDP. +Windows supports remote connections to devices joined to Active Directory s well as devices joined to Azure Active Directory (Azure AD) using Remote Desktop Protocol (RDP). - Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). - Starting in Windows 10/11, with 2022-10 update installed, you can [use Azure AD authentication to connect to the remote Azure AD device](#connect-with-azure-ad-authentication). - + ## Prerequisites - Both devices (local and remote) must be running a supported version of Windows. @@ -39,20 +39,20 @@ Azure AD Authentication can be used on the following operating systems for both - Windows 11 with [2022-10 Cumulative Updates for Windows 11 (KB5018418)](https://support.microsoft.com/kb/KB5018418) or later installed. - Windows 10, version 20H2 or later with [2022-10 Cumulative Updates for Windows 10 (KB5018410)](https://support.microsoft.com/kb/KB5018410) or later installed. - Windows Server 2022 with [2022-10 Cumulative Update for Microsoft server operating system (KB5018421)](https://support.microsoft.com/kb/KB5018421) or later installed. - + There's no requirement for the local device to be joined to a domain or Azure AD. As a result, this method allows you to connect to the remote Azure AD joined device from: - [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [Hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid) device. - Active Directory joined device. - Workgroup device. - + Azure AD authentication can also be used to connect to Hybrid Azure AD joined devices. To connect to the remote computer: - Launch **Remote Desktop Connection** from Windows Search, or by running `mstsc.exe`. - Select **Use a web account to sign in to the remote computer** option in the **Advanced** tab. This option is equivalent to the `enablerdsaadauth` RDP property. For more information, see [Supported RDP properties with Remote Desktop Services](/windows-server/remote/remote-desktop-services/clients/rdp-files). -- Specify the name of the remote computer and select **Connect**. +- Specify the name of the remote computer and select **Connect**. > [!NOTE] > IP address cannot be used when **Use a web account to sign in to the remote computer** option is used. @@ -129,5 +129,3 @@ Remote Desktop Users group is used to grant users and groups permissions to remo ## Related articles [How to use Remote Desktop](https://support.microsoft.com/windows/how-to-use-remote-desktop-5fe128d5-8fb1-7a23-3b8a-41e636865e8c) - - diff --git a/windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions.md b/windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions.md deleted file mode 100644 index 540d2b2666..0000000000 --- a/windows/client-management/client-tools/group-policies-for-enterprise-and-education-editions.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Group Policy settings that apply only to Windows 10 Enterprise and Education Editions (Windows 10) -description: Use this topic to learn about Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education. -ms.prod: windows-client -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 09/14/2021 -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: troubleshooting -ms.technology: itpro-manage -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 ---- - -# Group Policy settings that apply only to Windows 10 Enterprise and Education Editions - -In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education. - -| Policy name | Policy path | Comments | -| --- | --- | --- | -| **Configure Spotlight on lock screen** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight). Note that an additional **Cloud Content** policy, **Do not suggest third-party content in Windows spotlight**, does apply to Windows 10 Pro. | -| **Turn off all Windows Spotlight features** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) | -| **Turn off Microsoft consumer features** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) | -| **Do not display the lock screen** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) | -| **Do not require CTRL+ALT+DEL**
    combined with
    **Turn off app notifications on the lock screen** | Computer Configuration > Administrative Templates > System > Logon
    and
    Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon | When both of these policy settings are enabled, the combination will also disable lock screen apps ([assigned access](/windows/configuration/set-up-a-device-for-anyone-to-use)) on Windows 10 Enterprise and Windows 10 Education only. These policy settings can be applied to Windows 10 Pro, but lock screen apps will not be disabled on Windows 10 Pro.

    **Important:** The description for **Interactive logon: Do not require CTRL+ALT+DEL** in the Group Policy Editor incorrectly states that it only applies to Windows 10 Enterprise and Education. The description will be corrected in a future release.| -| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) | -| **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) | -| **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | In Windows 10, version 1703, this policy setting can be applied to Windows 10 Pro. For more info, see [Manage Windows 10 Start layout options and policies](/windows/configuration/windows-10-start-layout-options-and-policies) | -| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

    User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). | -| **Only display the private store within the Microsoft Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app

    User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app | For more info, see [Manage access to private store](/microsoft-store/manage-access-to-private-store) | -| **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) | diff --git a/windows/client-management/client-tools/mandatory-user-profile.md b/windows/client-management/client-tools/mandatory-user-profile.md index b88325b27f..170b3ca9d6 100644 --- a/windows/client-management/client-tools/mandatory-user-profile.md +++ b/windows/client-management/client-tools/mandatory-user-profile.md @@ -1,11 +1,11 @@ --- -title: Create mandatory user profiles (Windows 10 and Windows 11) +title: Create mandatory user profiles description: A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. ms.prod: windows-client author: vinaypamnani-msft ms.author: vinpa -ms.date: 09/14/2021 -ms.reviewer: +ms.date: 04/11/2023 +ms.reviewer: manager: aaroncz ms.topic: article ms.collection: @@ -19,26 +19,26 @@ appliesto: # Create mandatory user profiles -A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. +A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to) icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. -User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. +User profiles become mandatory profiles when the administrator renames the `NTuser.dat` file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. ## Profile extension for each Windows version The name of the folder in which you store the mandatory profile must use the correct extension for the operating system it will be applied to. The following table lists the correct extension for each operating system version. -| Client operating system version | Server operating system version | Profile extension | -| --- | --- | --- | -| Windows XP | Windows Server 2003
    Windows Server 2003 R2 | none | -| Windows Vista
    Windows 7 | Windows Server 2008
    Windows Server 2008 R2 | v2 | -| Windows 8 | Windows Server 2012 | v3 | -| Windows 8.1 | Windows Server 2012 R2 | v4 | -| Windows 10, versions 1507 and 1511 | N/A | v5 | -| Windows 10, versions 1607, 1703, 1709, 1803, 1809, 1903 and 1909 | Windows Server 2016 and Windows Server 2019 | v6 | +| Client operating system version | Server operating system version | Profile extension | +|-------------------------------------|-------------------------------------------------|-------------------| +| Windows XP | Windows Server 2003
    Windows Server 2003 R2 | none | +| Windows Vista
    Windows 7 | Windows Server 2008
    Windows Server 2008 R2 | v2 | +| Windows 8 | Windows Server 2012 | v3 | +| Windows 8.1 | Windows Server 2012 R2 | v4 | +| Windows 10, versions 1507 and 1511 | N/A | v5 | +| Windows 10, versions 1607 and later | Windows Server 2016 and Windows Server 2019 | v6 | For more information, see [Deploy Roaming User Profiles, Appendix B](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](/troubleshoot/windows-server/user-profiles-and-logon/roaming-user-profiles-versioning). @@ -48,10 +48,10 @@ First, you create a default user profile with the customizations that you want, ### How to create a default user profile -1. Sign in to a computer running Windows 10 as a member of the local Administrator group. Do not use a domain account. +1. Sign in to a computer running Windows as a member of the local Administrator group. Do not use a domain account. > [!NOTE] - > Use a lab or extra computer running a clean installation of Windows 10 to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. + > Use a lab or extra computer running a clean installation of Windows to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. 1. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. @@ -60,21 +60,21 @@ First, you create a default user profile with the customizations that you want, 1. [Create an answer file (Unattend.xml)](/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) that sets the [CopyProfile](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-copyprofile) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user's profile folder to the default user profile. You can use [Windows System Image Manager](/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. -1. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows 10 Application see [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true). For a list of uninstallable applications, see [Understand the different apps included in Windows 10](/windows/application-management/apps-in-windows-10). +1. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows Application see [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true). For a list of uninstallable applications, see [Understand the different apps included in Windows](/windows/application-management/apps-in-windows-10). > [!NOTE] > It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. 1. At a command prompt, type the following command and press **ENTER**. - ```console + ```cmd sysprep /oobe /reboot /generalize /unattend:unattend.xml ``` - (Sysprep.exe is located at: C:\\Windows\\System32\\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) + (Sysprep.exe is located at: `C:\Windows\System32\sysprep`. By default, Sysprep looks for `unattend.xml` in the same folder.) > [!TIP] - > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\\System32\\Sysprep\\Panther\\setupact.log and look for an entry like the following: + > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open `%WINDIR%\System32\Sysprep\Panther\setupact.log` and look for an entry like the following: > > ![Microsoft Bing Translator package error.](images/sysprep-error.png) > @@ -94,7 +94,7 @@ First, you create a default user profile with the customizations that you want, 1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. -1. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#profile-extension-for-each-windows-version) for the operating system version. For example, the folder name must end with ".v6" to identify it as a user profile folder for Windows 10, version 1607. +1. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#profile-extension-for-each-windows-version) for the operating system version. For example, the folder name must end with `.v6` to identify it as a user profile folder for Windows 10, version 1607 or later. - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. @@ -102,8 +102,6 @@ First, you create a default user profile with the customizations that you want, - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - ![Example of Copy To UI with UNC path.](images/copy-to-path.png) - 1. Click **OK** to copy the default user profile. ### How to make the user profile mandatory @@ -127,7 +125,7 @@ In a domain, you modify properties for the user account to point to the mandator 1. Right-click the user name and open **Properties**. -1. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\\profile.v6, you would enter \\\\*server*\\profile. +1. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is `\\server\share\profile.v6`, you would enter `\\server\share\profile`. 1. Click **OK**. @@ -135,16 +133,16 @@ It may take some time for this change to replicate to all domain controllers. ## Apply policies to improve sign-in time -When a user is configured with a mandatory profile, Windows 10 starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the Group Policy settings shown in the following table. (The table shows which operating system versions each policy setting can apply to.) +When a user is configured with a mandatory profile, Windows starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the Group Policy settings shown in the following table. -| Group Policy setting | Windows 10 | Windows Server 2016 | Windows 8.1 | Windows Server 2012 | -| --- | --- | --- | --- | --- | -| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported.](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +| Group Policy setting | Windows 10 | Windows Server 2016 | +|-----------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|----------------------------------------| +| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported.](images/checkmark.png) | ![not supported](images/crossmark.png) | > [!NOTE] -> The Group Policy settings above can be applied in Windows 10 Professional edition. +> The Group Policy settings above can be applied in Windows Professional edition. ## Related topics diff --git a/windows/client-management/client-tools/new-policies-for-windows-10.md b/windows/client-management/client-tools/new-policies-for-windows-10.md deleted file mode 100644 index c00dccf24d..0000000000 --- a/windows/client-management/client-tools/new-policies-for-windows-10.md +++ /dev/null @@ -1,507 +0,0 @@ ---- -title: New policies for Windows 10 (Windows 10) -description: Learn how Windows 10 includes new policies for management, like Group Policy settings for the Windows system and components. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.prod: windows-client -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 09/15/2021 -ms.topic: reference -ms.technology: itpro-manage -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 ---- - -# New policies for Windows 10 - -As of September 2020 This page will no longer be updated. To find the Group Polices that ship in each version of Windows, refer to the Group Policy Settings Reference Spreadsheet. You can always locate the most recent version of the Spreadsheet by searching the Internet for "Windows Version + Group Policy Settings Reference". - -For example, searching for "Windows 2004" + "Group Policy Settings Reference Spreadsheet" in a web browser will return to you the link to download the Group Policy Settings Reference Spreadsheet for Windows 2004. - -The latest [group policy reference for Windows 10 version 2004 is available here](https://www.microsoft.com/download/101451). - -## New Group Policy settings in Windows 10, version 1903 - -The following Group Policy settings were added in Windows 10, version 1903: - -**System** - -- System\Service Control Manager Settings\Security Settings\Enable svchost.exe mitigation options -- System\Storage Sense\Allow Storage Sense -- System\Storage Sense\Allow Storage Sense Temporary Files cleanup -- System\Storage Sense\Configure Storage Sense -- System\Storage Sense\Configure Storage Sense Cloud content dehydration threshold -- System\Storage Sense\Configure Storage Sense Recycle Bin cleanup threshold -- System\Storage Sense\Configure Storage Sense Downloads cleanup threshold -- System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool\Troubleshooting:Allow users to access recommended troubleshooting for known problems - -**Windows Components** - -- Windows Components\App Privacy\Let Windows apps activate with voice -- Windows Components\App Privacy\Let Windows apps activate with voice while the system is locked -- Windows Components\Data Collection and Preview Builds\Allow commercial data pipeline -- Windows Components\Data Collection and Preview Builds\Configure collection of browsing data for Desktop Analytics -- Windows Components\Data Collection and Preview Builds\Configure diagnostic data upload endpoint for Desktop Analytics -- Windows Components\Delivery Optimization\Delay background download Cache Server fallback (in seconds) -- Windows Components\Delivery Optimization\Delay Foreground download Cache Server fallback (in seconds) -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use WDDM graphics display driver for Remote Desktop Connections -- Windows Components\Windows Logon Options\Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot - -## New Group Policy settings in Windows 10, version 1809 - -The following Group Policy settings were added in Windows 10, version 1809: - -**Start Menu and Taskbar** - -- Start Menu and Taskbar\Force Start to be either full screen size or menu size -- Start Menu and Taskbar\Remove "Recently added" list from Start Menu -- Start Menu and Taskbar\Remove All Programs list from the Start menu -- Start Menu and Taskbar\Remove frequent programs list from the Start Menu - -**System** - -- System\Group Policy\Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services -- System\Group Policy\Configure Applications preference extension policy processing -- System\Group Policy\Configure Data Sources preference extension policy processing -- System\Group Policy\Configure Devices preference extension policy processing -- System\Group Policy\Configure Drive Maps preference extension policy processing -- System\Group Policy\Configure Environment preference extension policy processing -- System\Group Policy\Configure Files preference extension policy processing -- System\Group Policy\Configure Folder Options preference extension policy processing -- System\Group Policy\Configure Folders preference extension policy processing -- System\Group Policy\Configure Ini Files preference extension policy processing -- System\Group Policy\Configure Internet Settings preference extension policy processing -- System\Group Policy\Configure Local Users and Groups preference extension policy processing -- System\Group Policy\Configure Network Options preference extension policy processing -- System\Group Policy\Configure Network Shares preference extension policy processing -- System\Group Policy\Configure Power Options preference extension policy processing -- System\Group Policy\Configure Printers preference extension policy processing -- System\Group Policy\Configure Regional Options preference extension policy processing -- System\Group Policy\Configure Registry preference extension policy processing -- System\Group Policy\Configure Scheduled Tasks preference extension policy processing -- System\Group Policy\Configure Services preference extension policy processing -- System\Group Policy\Configure Shortcuts preference extension policy processing -- System\Group Policy\Configure Start Menu preference extension policy processing -- System\Group Policy\Logging and tracing\Configure Applications preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Data Sources preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Devices preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Drive Maps preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Environment preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Files preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Folder Options preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Folders preference logging and tracing -- System\Group Policy\Logging and tracing\Configure INI Files preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Internet Settings preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Local Users and Groups preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Network Options preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Network Shares preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Power Options preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Printers preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Regional Options preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Registry preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Scheduled Tasks preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Services preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Shortcuts preference logging and tracing -- System\Group Policy\Logging and tracing\Configure Start Menu preference logging and tracing -- System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection -- System\OS Policies\Allow Clipboard History -- System\OS Policies\Allow Clipboard synchronization across devices - -**Windows Components** - -- Windows Components\Data Collection and Preview Builds\Configure Microsoft 365 Update Readiness upload endpoint -- Windows Components\Data Collection and Preview Builds\Disable deleting diagnostic data -- Windows Components\Data Collection and Preview Builds\Disable diagnostic data viewer -- Windows Components\Delivery Optimization\[Reserved for future use] Cache Server Hostname -- Windows Components\Location and Sensors\Windows Location Provider\Turn off Windows Location Provider -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\DFS Management -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\File Server Resource Manager -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Share and Storage Management -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Storage Manager for SANs -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\DFS Management Extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Disk Management Extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\File Server Resource Manager Extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Share and Storage Management Extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Storage Manager for SANS Extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Management Editor -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Starter GPO Editor -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Application snap-ins -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Applications preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Computers) -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Users) -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Data Sources preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Devices preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Drive Maps preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Environment preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Files preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folder Options preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folders preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Ini Files preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Internet Settings preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Local Users and Groups preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Options preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Shares preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Power Options preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Preferences tab -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Printers preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Regional Options preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Registry preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Scheduled Tasks preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Services preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Shortcuts preference extension -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Start Menu preference extension -- Windows Components\OOBE\Don't launch privacy settings experience on user logon -- Windows Components\OOBE\Don't launch privacy settings experience on user logon -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Do not use Remote Desktop Session Host server IP address when virtual IP address is not available -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Select the network adapter to be used for Remote Desktop IP Virtualization -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn off Windows Installer RDS Compatibility -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn on Remote Desktop IP Virtualization -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow remote start of unlisted programs -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Turn off Fair Share CPU Scheduling -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Allow time zone redirection -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow Clipboard redirection -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker\Use RD Connection Broker load balancing -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Allow desktop composition for remote desktop sessions -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Always show desktop on connection -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Do not allow font smoothing -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Remove remote desktop wallpaper -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions -- Windows Components\Microsoft Defender Antivirus\Configure detection for potentially unwanted applications -- Windows Components\Microsoft Defender Antivirus\Scan\Configure low CPU priority for scheduled scans -- Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard -- Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard -- Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user's device -- Windows Components\Windows Defender Application Guard\Configure additional sources for untrusted files in Windows Defender Application Guard -- Windows Components\Windows Hello for Business\Use Windows Hello for Business certificates as smart card certificates -- Windows Components\Windows Media Player\Do Not Show First Use Dialog Boxes -- Windows Components\Windows Media Player\Prevent Automatic Updates -- Windows Components\Windows Media Player\Prevent CD and DVD Media Information Retrieval -- Windows Components\Windows Media Player\Prevent Desktop Shortcut Creation -- Windows Components\Windows Media Player\Prevent Media Sharing -- Windows Components\Windows Media Player\Prevent Music File Media Information Retrieval -- Windows Components\Windows Media Player\Prevent Quick Launch Toolbar Shortcut Creation -- Windows Components\Windows Media Player\Prevent Radio Station Preset Retrieval -- Windows Components\Windows Media Player\Prevent Video Smoothing -- Windows Components\Windows Media Player\Networking\Configure HTTP Proxy -- Windows Components\Windows Media Player\Networking\Configure MMS Proxy -- Windows Components\Windows Media Player\Networking\Configure Network Buffering -- Windows Components\Windows Media Player\Networking\Configure RTSP Proxy -- Windows Components\Windows Media Player\Networking\Hide Network Tab -- Windows Components\Windows Media Player\Networking\Streaming Media Protocols -- Windows Components\Windows Media Player\Playback\Allow Screen Saver -- Windows Components\Windows Media Player\Playback\Prevent Codec Download -- Windows Components\Windows Media Player\User Interface\Do Not Show Anchor -- Windows Components\Windows Media Player\User Interface\Hide Privacy Tab -- Windows Components\Windows Media Player\User Interface\Hide Security Tab -- Windows Components\Windows Media Player\User Interface\Set and Lock Skin -- Windows Components\Windows Security\Account protection\Hide the Account protection area -- Windows Components\Windows Security\App and browser protection\Hide the App and browser protection area -- Windows Components\Windows Security\App and browser protection\Prevent users from modifying settings -- Windows Components\Windows Security\Device performance and health\Hide the Device performance and health area -- Windows Components\Windows Security\Device security\Disable the Clear TPM button -- Windows Components\Windows Security\Device security\Hide the Device security area -- Windows Components\Windows Security\Device security\Hide the Secure boot area -- Windows Components\Windows Security\Device security\Hide the Security processor (TPM) troubleshooter page -- Windows Components\Windows Security\Device security\Hide the TPM Firmware Update recommendation -- Windows Components\Windows Security\Enterprise Customization\Configure customized contact information -- Windows Components\Windows Security\Enterprise Customization\Configure customized notifications -- Windows Components\Windows Security\Enterprise Customization\Specify contact company name -- Windows Components\Windows Security\Enterprise Customization\Specify contact email address or Email ID -- Windows Components\Windows Security\Enterprise Customization\Specify contact phone number or Skype ID -- Windows Components\Windows Security\Enterprise Customization\Specify contact website -- Windows Components\Windows Security\Family options\Hide the Family options area -- Windows Components\Windows Security\Firewall and network protection\Hide the Firewall and network protection area -- Windows Components\Windows Security\Notifications\Hide all notifications -- Windows Components\Windows Security\Notifications\Hide non-critical notifications -- Windows Components\Windows Security\Systray\Hide Windows Security Systray -- Windows Components\Windows Security\Virus and threat protection\Hide the Ransomware data recovery area -- Windows Components\Windows Security\Virus and threat protection\Hide the Virus and threat protection area -- Windows Components\Windows Update\Display options for update notifications -- Windows Components\Windows Update\Remove access to "Pause updates" feature - -**Control Panel** - -- Control Panel\Settings Page Visibility -- Control Panel\Regional and Language Options\Allow users to enable online speech recognition services - -**Network** - -- Network\Windows Connection Manager\Enable Windows to soft-disconnect a computer from a network - -## New Group Policy settings in Windows 10, version 1803 - -The following Group Policy settings were added in Windows 10, version 1803: - -**System** - -- System\Credentials Delegation\Encryption Oracle Remediation -- System\Group Policy\Phone-PC linking on this device -- System\OS Policies\Allow upload of User Activities - -**Windows Components** - -- Windows Components\App Privacy\Let Windows apps access an eye tracker device -- Windows Components\Cloud Content\Turn off Windows Spotlight on Settings -- Windows Components\Data Collection and Preview Builds\Allow device name to be sent in Windows diagnostic data -- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface -- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications -- Windows Components\Delivery Optimization\Maximum Background Download Bandwidth (percentage) -- Windows Components\Delivery Optimization\Maximum Foreground Download Bandwidth (percentage) -- Windows Components\Delivery Optimization\Select the source of Group IDs -- Windows Components\Delivery Optimization\Delay background download from http (in secs) -- Windows Components\Delivery Optimization\Delay Foreground download from http (in secs) -- Windows Components\Delivery Optimization\Select a method to restrict Peer Selection -- Windows Components\Delivery Optimization\Set Business Hours to Limit Background Download Bandwidth -- Windows Components\Delivery Optimization\Set Business Hours to Limit Foreground Download Bandwidth -- Windows Components\IME\Turn on Live Sticker -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow video capture redirection -- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use hardware graphics adapters for all Remote Desktop Services sessions -- Windows Components\Search\Allow Cortana Page in OOBE on an Azure Active Directory account -- Windows Components\Store\Disable all apps from Microsoft Store -- Windows Components\Text Input\Allow Uninstallation of Language Features -- Windows Components\Text Input\Improve inking and typing recognition -- Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard -- Windows Components\Windows Defender Security Center\Account protection\Hide the Account protection area -- Windows Components\Windows Defender Security Center\Device security\Hide the Device security area -- Windows Components\Windows Defender Security Center\Device security\Hide the Security processor (TPM) troubleshooter page -- Windows Components\Windows Defender Security Center\Device security\Hide the Secure boot area -- Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Ransomware data recovery area - -## New Group Policy settings in Windows 10, version 1709 - -The following Group Policy settings were added in Windows 10, version 1709: - -**Control Panel** - -- Control Panel\Allow Online Tips - -**Network** - -- Network\Network Connectivity Status Indicator\Specify global DNS -- Network\WWAN Service\WWAN UI Settings\Set Per-App Cellular Access UI Visibility -- Network\WWAN Service\Cellular Data Access\Let Windows apps access cellular data - -**System** - -- System\Device Health Attestation Service\Enable Device Health Attestation Monitoring and Reporting -- System\OS Policies\Enables Activity Feed -- System\OS Policies\Allow publishing of User Activities -- System\Power Management\Power Throttling Settings\Turn off Power Throttling -- System\Storage Health\Allow downloading updates to the Disk Failure Prediction Model -- System\Trusted Platform Module Services\Configure the system to clear the TPM if it is not in a ready state. - -**Windows Components** - -- Windows Components\App Privacy\Let Windows apps communicate with unpaired devices -- Windows Components\Data Collection and Preview Builds\Limit Enhanced diagnostic data to the minimum required by Windows Analytics -- Windows Components\Handwriting\Handwriting Panel Default Mode Docked -- Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing\Hide the button (next to the New Tab button) that opens Microsoft Edge -- Windows Components\MDM\Auto MDM Enrollment with Azure Active Directory Token -- Windows Components\Messaging\Allow Message Service Cloud Sync -- Windows Components\Microsoft Edge\Always show the Books Library in Microsoft Edge -- Windows Components\Microsoft Edge\Provision Favorites -- Windows Components\Microsoft Edge\Prevent changes to Favorites on Microsoft Edge -- Windows Components\Microsoft FIDO Authentication\Enable usage of FIDO devices to sign on -- Windows Components\OneDrive\Prevent OneDrive from generating network traffic until the user signs in to OneDrive -- Windows Components\Push To Install\Turn off Push To Install service -- Windows Components\Search\Allow Cloud Search -- Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard -- Windows Components\Windows Defender Application Guard\Allow auditing events in Windows Defender Application Guard -- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Network Protection\Prevent users and apps from accessing dangerous websites -- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure Controlled folder access -- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction rules -- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Exclude files and paths from Attack Surface Reduction Rules -- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure allowed applications -- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure protected folders -- Windows Components\Windows Defender Exploit Guard\Exploit Protection\Use a common set of exploit protection settings -- Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Virus and threat protection area -- Windows Components\Windows Defender Security Center\Firewall and network protection\Hide the Firewall and network protection area -- Windows Components\Windows Defender Security Center\App and browser protection\Hide the App and browser protection area -- Windows Components\Windows Defender Security Center\App and browser protection\Prevent users from modifying settings -- Windows Components\Windows Defender Security Center\Device performance and health\Hide the Device performance and health area -- Windows Components\Windows Defender Security Center\Family options\Hide the Family options area -- Windows Components\Windows Defender Security Center\Notifications\Hide all notifications -- Windows Components\Windows Defender Security Center\Notifications\Hide non-critical notifications -- Windows Components\Windows Defender Security Center\Enterprise Customization\Configure customized notifications -- Windows Components\Windows Defender Security Center\Enterprise Customization\Configure customized contact information -- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact company name -- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact phone number or Skype ID -- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact email address or Email ID -- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact website -- Windows Components\Windows Hello for Business\Configure device unlock factors -- Windows Components\Windows Hello for Business\Configure dynamic lock factors -- Windows Components\Windows Hello for Business\Turn off smart card emulation -- Windows Components\Windows Hello for Business\Allow enumeration of emulated smart card for all users -- Windows Components\Windows Update\Allow updates to be downloaded automatically over metered connections -- Windows Components\Windows Update\Do not allow update deferral policies to cause scans against Windows Update - -## New Group Policy settings in Windows 10, version 1703 - -The following Group Policy settings were added in Windows 10, version 1703: - -**Control Panel** - -- Control Panel\Add or Remove Programs\Specify default category for Add New Programs -- Control Panel\Add or Remove Programs\Hide the "Add a program from CD-ROM or floppy disk" option -- Control Panel\Personalization\Prevent changing lock screen and logon image - -**Network** - -- Network\Background Intelligent Transfer Service (BITS)\Limit the maximum network bandwidth for BITS background transfers -- Network\Background Intelligent Transfer Service (BITS)\Allow BITS Peercaching -- Network\Background Intelligent Transfer Service (BITS)\Limit the age of files in the BITS Peercache -- Network\Background Intelligent Transfer Service (BITS)\Limit the BITS Peercache size -- Network\DNS Client\Allow NetBT queries for fully qualified domain names -- Network\Network Connections\Prohibit access to properties of components of a LAN connection -- Network\Network Connections\Ability to Enable/Disable a LAN connection -- Network\Offline Files\Turn on economical application of administratively assigned Offline Files -- Network\Offline Files\Configure slow-link mode -- Network\Offline Files\Enable Transparent Caching -- Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Site-Local Clouds\Set the Seed Server -- Network\Microsoft Peer-to-Peer Networking Services\Disable password strength validation for Peer Grouping - -**System** - -- System\App-V\Streaming\Location Provider -- System\App-V\Streaming\Certificate Filter For Client SSL -- System\Credentials Delegation\Allow delegating default credentials with NTLM-only server authentication -- System\Ctrl+Alt+Del Options\Remove Change Password -- System\Ctrl+Alt+Del Options\Remove Lock Computer -- System\Ctrl+Alt+Del Options\Remove Task Manager -- System\Ctrl+Alt+Del Options\Remove Logoff -- System\Device Installation\Do not send a Windows error report when a generic driver is installed on a device -- System\Device Installation\Prevent Windows from sending an error report when a device driver requests additional software during installation -- System\Locale Services\Disallow user override of locale settings -- System\Logon\Do not process the legacy run list -- System\Logon\Always use custom logon background -- System\Logon\Do not display network selection UI -- System\Logon\Block user from showing account details on sign-in -- System\Logon\Turn off app notifications on the lock screen -- System\User Profiles\Establish timeout value for dialog boxes -- System\Enable Windows NTP Server\Windows Time Service\Enable Windows NTP Client - -**Windows Components** - -- Windows Components\ActiveX Installer Service\Approved Installation Sites for ActiveX Controls -- Windows Components\ActiveX Installer Service\Establish ActiveX installation policy for sites in Trusted zones -- Windows Components\Application Compatibility\Turn off Application Compatibility Engine -- Windows Components\Application Compatibility\Turn off Program Compatibility Assistant -- Windows Components\Application Compatibility\Turn off Steps Recorder -- Windows Components\Attachment Manager\Notify antivirus programs when opening attachments -- Windows Components\Biometrics\Allow the use of biometrics -- Windows Components\NetMeeting\Disable Whiteboard -- Windows Components\Data Collection and Preview Builds\Configure the Commercial ID -- Windows Components\File Explorer\Display the menu bar in File Explorer -- Windows Components\File History\Turn off File History -- Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\Play animations in web pages -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone\Turn on Cross-Site Scripting Filter -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Turn on Cross-Site Scripting Filter -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone\Run ActiveX controls and plugins -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone\Script ActiveX controls marked safe for scripting -- Windows Components\Internet Explorer\Accelerators\Restrict Accelerators to those deployed through Group Policy -- Windows Components\Internet Explorer\Compatibility View\Turn on Internet Explorer 7 Standards Mode -- Windows Components\Location and Sensors\Windows Location Provider\Turn off Windows Location Provider -- Windows Components\Microsoft Account\Block all consumer Microsoft account user authentication -- Windows Components\Microsoft Edge\Configure Autofill -- Windows Components\Microsoft Edge\Allow Developer Tools -- Windows Components\Microsoft Edge\Configure Do Not Track -- Windows Components\Microsoft Edge\Allow InPrivate browsing -- Windows Components\Microsoft Edge\Configure Password Manager -- Windows Components\Microsoft Edge\Configure Pop-up Blocker -- Windows Components\Microsoft Edge\Allow search engine customization -- Windows Components\Microsoft Edge\Configure search suggestions in Address bar -- Windows Components\Microsoft Edge\Set default search engine -- Windows Components\Microsoft Edge\Configure additional search engines -- Windows Components\Microsoft Edge\Configure the Enterprise Mode Site List -- Windows Components\Microsoft Edge\Prevent using Localhost IP address for WebRTC -- Windows Components\Microsoft Edge\Configure Start pages -- Windows Components\Microsoft Edge\Disable lockdown of Start pages -- Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites -- Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files -- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\.Net Framework Configuration -- Windows Components\Windows Installer\Prohibit use of Restart Manager -- Windows Components\Desktop Gadgets\Restrict unpacking and installation of gadgets that are not digitally signed. -- Windows Components\Desktop Gadgets\Turn Off user-installed desktop gadgets -- Windows Components\OneDrive\Prevent the usage of OneDrive for file storage -- Windows Components\OneDrive\Prevent the usage of OneDrive for file storage on Windows 8.1 -- Windows Components\OneDrive\Prevent OneDrive files from syncing over metered connections -- Windows Components\OneDrive\Save documents to OneDrive by default -- Windows Components\Smart Card\Allow certificates with no extended key usage certificate attribute -- Windows Components\Smart Card\Turn on certificate propagation from smart card -- Windows Components\Tablet PC\Pen UX Behaviors\Prevent flicks -- Windows Components\BitLocker Drive Encryption\Choose drive encryption method and cipher strength (Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10 [Version 1507]) -- Windows Components\Microsoft Defender Antivirus\Real-time Protection\Turn on behavior monitoring -- Windows Components\Microsoft Defender Antivirus\Signature Updates\Define file shares for downloading definition updates -- Windows Components\Microsoft Defender Antivirus\Signature Updates\Turn on scan after signature update -- Windows Components\File Explorer\Display confirmation dialog when deleting files -- Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone\Allow OpenSearch queries in File Explorer -- Windows Components\Windows Update\Remove access to use all Windows Update features -- Windows Components\Windows Update\Configure Automatic Updates -- Windows Components\Windows Update\Specify intranet Microsoft update service location -- Windows Components\Windows Update\Automatic Updates detection frequency -- Windows Components\Windows Update\Allow non-administrators to receive update notifications -- Windows Components\Windows Update\Allow Automatic Updates immediate installation -- Windows Components\Windows Update\Turn on recommended updates via Automatic Updates -- Windows Components\Shutdown Options\Turn off legacy remote shutdown interface - -For a spreadsheet of Group Policy settings included in Windows 10 and Windows Server 2016, see [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=613627). - -## New MDM policies - -Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education include previous Windows Phone settings, and new or enhanced settings for Windows 10, such as: - -- Defender (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education only) - -- Enhanced Bluetooth policies - -- Passport and Hello - -- Device update - -- Hardware-based device health attestation - -- [Kiosk mode](/windows/configuration/set-up-a-device-for-anyone-to-use), start screen, start menu layout - -- Security - -- [VPN](/windows/security/identity-protection/vpn/vpn-profile-options) and enterprise Wi-Fi management - -- Certificate management - -- Windows Tips - -- Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu - -Windows 10, version 1703, adds a number of [ADMX-backed policies to MDM](../mdm/policy-configuration-service-provider.md). - -If you use Microsoft Intune for MDM, you can [configure custom policies](/mem/intune/configuration/custom-settings-configure) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](/mem/intune/configuration/custom-settings-windows-10). - -No new [Exchange ActiveSync policies](/exchange/mobile-device-mailbox-policies-exchange-2013-help). For more information, see the [ActiveSync configuration service provider](../mdm/activesync-csp.md) technical reference. - -## Related topics - -- [Group Policy Settings Reference Spreadsheet Windows 1803](https://www.microsoft.com/download/details.aspx?id=56946) -- [Manage corporate devices](../manage-corporate-devices.md) -- [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index cd051cbaee..cc7784c94e 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -1,6 +1,7 @@ --- title: Use Quick Assist to help users description: Learn how IT Pros can use Quick Assist to help users. +ms.date: 04/11/2023 ms.prod: windows-client ms.topic: article ms.technology: itpro-manage @@ -15,7 +16,6 @@ appliesto: ms.collection: - highpri - tier1 -ms.date: 03/06/2023 --- # Use Quick Assist to help users diff --git a/windows/client-management/client-tools/toc.yml b/windows/client-management/client-tools/toc.yml index 518441dd46..cb80088882 100644 --- a/windows/client-management/client-tools/toc.yml +++ b/windows/client-management/client-tools/toc.yml @@ -1,14 +1,12 @@ items: - name: Windows Tools/Administrative Tools - href: administrative-tools-in-windows-10.md + href: administrative-tools-in-windows.md - name: Use Quick Assist to help users href: quick-assist.md - name: Connect to remote Azure Active Directory-joined PC href: connect-to-remote-aadj-pc.md - name: Create mandatory user profiles href: mandatory-user-profile.md - - name: New policies for Windows 10 - href: new-policies-for-windows-10.md - name: Windows 10 default media removal policy href: change-default-removal-policy-external-storage-media.md - name: Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 245a61e862..2a98e5779b 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -28,7 +28,7 @@ This six-minute video demonstrates how users can bring in a new retail device an > [!NOTE] > The video demonstrates the configuration process using the classic Azure portal, which is retired. Customers should use the new Azure portal. [Learn how use the new Azure portal to perform tasks that you used to do in the classic Azure portal.](/information-protection/deploy-use/migrate-portal) -This article offers guidance on strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. It covers [management options](#reviewing-the-management-options-with-windows-10) plus the four stages of the device lifecycle: +This article offers guidance on strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. It covers [management options](#reviewing-the-management-options-for-windows) plus the four stages of the device lifecycle: - [Deployment and Provisioning](#deployment-and-provisioning) - [Identity and Authentication](#identity-and-authentication) From 4a63ab5bc3e919c872280ba8e0eac05b929c3aec Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 11 Apr 2023 13:20:06 -0700 Subject: [PATCH 064/139] removed note --- .../operate/windows-autopatch-support-request.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md index c4a87a93ba..29e95ec21f 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md @@ -39,9 +39,6 @@ If you have a **Premier** or **Unified** support contract, when you submit a new Depending on your support contract, the following severity options are available: -> [!NOTE] -> Selecting either severity **A** or **Critical** issue limits you to a phone support case. This is the fastest support option. - | Support contract | Severity options | | ----- | ----- | | Premier | Severity A, B or C | From 51e7684de225c8146c686d00d9951ec241798ae9 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 11 Apr 2023 16:29:23 -0400 Subject: [PATCH 065/139] More work --- .openpublishing.redirection.json | 5 ++ ...t-removal-policy-external-storage-media.md | 47 +++++++++---------- .../manage-settings-app-with-group-policy.md | 28 +++++------ .../client-tools/mandatory-user-profile.md | 10 ++-- .../client-management/client-tools/toc.yml | 2 - .../client-tools/windows-libraries.md | 27 +++++------ .../client-tools/windows-version-search.md | 39 ++++++++------- .../esim-enterprise-management.md | 12 +++-- windows/client-management/index.yml | 2 +- .../manage-corporate-devices.md | 43 ----------------- 10 files changed, 84 insertions(+), 131 deletions(-) delete mode 100644 windows/client-management/manage-corporate-devices.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 6f5a828829..8160ec3797 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6690,6 +6690,11 @@ "redirect_url": "/windows/client-management/client-tools/windows-version-search", "redirect_document_id": false }, + { + "source_path": "windows/client-management/manage-corporate-devices.md", + "redirect_url": "/windows/client-management/manage-windows-10-in-your-organization-modern-management", + "redirect_document_id": false + }, { "source_path": "windows/client-management/add-an-azure-ad-tenant-and-azure-ad-subscription.md", "redirect_url": "/azure/active-directory/fundamentals/active-directory-access-create-new-tenant", diff --git a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md index f598797aba..2959430065 100644 --- a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md @@ -1,28 +1,22 @@ --- -title: Windows 10 default media removal policy -description: In Windows 10, version 1809, the default removal policy for external storage media changed from Better performance to Quick removal. +title: Windows default media removal policy +description: In Windows 10 and later, the default removal policy for external storage media changed from Better performance to Quick removal. ms.prod: windows-client author: vinaypamnani-msft ms.author: vinpa -ms.date: 11/25/2020 +ms.date: 04/11/2023 ms.topic: article -ms.custom: -- CI 111493 -- CI 125140 -- CSSTroubleshooting ms.localizationpriority: medium -manager: kaushika +manager: aaroncz ms.technology: itpro-manage appliesto: - ✅ Windows 11 - ✅ Windows 10 --- -# Change in default removal policy for external storage media in Windows 10, version 1809 +# Change in default removal policy for external storage media in Windows -Windows defines two main policies, **Quick removal** and **Better performance**, that control how the system interacts with external storage devices such as USB thumb drives or Thunderbolt-enabled external drives. Beginning in Windows 10 version 1809, the default policy is **Quick removal**. - -In earlier versions of Windows, the default policy was **Better performance**. +Windows defines two main policies, **Quick removal** and **Better performance**, that control how the system interacts with external storage devices such as USB thumb drives or Thunderbolt-enabled external drives. Beginning in Windows 10 version 1809, the default policy is **Quick removal**. In earlier versions of Windows, the default policy was **Better performance**. You can change the policy setting for each external device, and the policy that you set remains in effect if you disconnect the device and then connect it again to the same computer port. @@ -30,13 +24,14 @@ You can change the policy setting for each external device, and the policy that You can use the storage device policy setting to change the manner in which Windows manages storage devices to better meet your needs. The policy settings have the following effects: -* **Quick removal**: This policy manages storage operations in a manner that keeps the device ready to remove at any time. You can remove the device without using the Safely Remove Hardware process. However, to do this, Windows cannot cache disk write operations. This may degrade system performance. -* **Better performance**: This policy manages storage operations in a manner that improves system performance. When this policy is in effect, Windows can cache write operations to the external device. However, you must use the Safely Remove Hardware process to remove the external drive. The Safely Remove Hardware process protects the integrity of data on the device by making sure that all cached operations finish. - > [!IMPORTANT] - > If you use the **Better performance** policy, you must use the Safely Remove Hardware process to remove the device. If you remove or disconnect the device without following the safe removal instructions, you risk losing data. +- **Quick removal**: This policy manages storage operations in a manner that keeps the device ready to remove at any time. You can remove the device without using the Safely Remove Hardware process. However, to do this, Windows cannot cache disk write operations. This may degrade system performance. +- **Better performance**: This policy manages storage operations in a manner that improves system performance. When this policy is in effect, Windows can cache write operations to the external device. However, you must use the Safely Remove Hardware process to remove the external drive. The Safely Remove Hardware process protects the integrity of data on the device by making sure that all cached operations finish. - > [!NOTE] - > If you select **Better performance**, we recommend that you also select **Enable write caching on the device**. +> [!IMPORTANT] +> If you use the **Better performance** policy, you must use the Safely Remove Hardware process to remove the device. If you remove or disconnect the device without following the safe removal instructions, you risk losing data. + +> [!NOTE] +> If you select **Better performance**, we recommend that you also select **Enable write caching on the device**. To change the policy for an external storage device: @@ -45,16 +40,16 @@ To change the policy for an external storage device: 1. In File Explorer, identify the letter or label that is associated with the device (for example, **USB Drive (D:)**). 1. Right-click **Start**, then select **Disk Management**. 1. In the lower section of the Disk Management window, right-click the label of the device, and then select **Properties**. - + ![In Disk Management, right-click the device and click Properties.](./images/change-def-rem-policy-1.png) - + 1. Select **Policies**. - - > [!NOTE] - > Some recent versions of Windows may use a different arrangement of tabs in the disk properties dialog box. - > + + > [!NOTE] + > Some recent versions of Windows may use a different arrangement of tabs in the disk properties dialog box. + > > If you do not see the **Policies** tab, select **Hardware**, select the removable drive from the **All disk drives** list, and then select **Properties**. The **Policies** tab should now be available. - + 1. Select the policy that you want to use. - + ![Policy options for disk management.](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md index 8ef58c88ac..c796cf1452 100644 --- a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md +++ b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md @@ -1,10 +1,10 @@ --- -title: Manage the Settings app with Group Policy (Windows 10 and Windows 11) +title: Manage the Settings app with Group Policy description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users. ms.prod: windows-client author: vinaypamnani-msft ms.date: 09/14/2021 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -17,32 +17,28 @@ appliesto: # Manage the Settings app with Group Policy -You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. -To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. +You can manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. ->[!NOTE] ->Each server that you want to manage access to the Settings App must be patched. +> [!NOTE] +> To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. Each server that you want to manage access to the Settings App must be patched. -If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store). +If your organization uses the [Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for Group Policy management, to manage the policies, copy the ControlPanel.admx and ControlPanel.adml file to PolicyDefinitions folder. -This policy is available for both User and Computer depending on the version of the OS. Windows Server 2016 with KB 4457127 applied will have both User and Computer policy. Windows 10, version 1703, added Computer policy for the Settings app. Windows 10, version 1809, added User policy for the Settings app. +This policy is available for both User and Computer configurations. -Policy paths: - -**Computer Configuration** > **Administrative Templates** > **Control Panel** > **Settings Page Visibility**. - -**User Configuration** > **Administrative Templates** > **Control Panel** > **Settings Page Visibility**. +- **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Settings Page Visibility**. +- **User Configuration** > **Administrative Templates** > **Control Panel** > **Settings Page Visibility**. ![Settings page visibility policy.](images/settings-page-visibility-gp.png) ## Configuring the Group Policy -The Group Policy can be configured in one of two ways: specify a list of pages that are shown or specify a list of pages to hide. To do this, add either **ShowOnly:** or **Hide:** followed by a semicolon-delimited list of URIs in **Settings Page Visibility**. For a full list of URIs, see the URI scheme reference section in [Launch the Windows Settings app](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference). +The Group Policy can be configured in one of two ways: specify a list of pages that are shown or specify a list of pages to hide. To do this, add either **ShowOnly:** or **Hide:** followed by a semicolon-delimited list of URIs in **Settings Page Visibility**. For a full list of URIs, see the URI scheme reference section in [Launch the Windows Settings app](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference). ->[!NOTE] +> [!IMPORTANT] > When you specify the URI in the Settings Page Visibility textbox, don't include **ms-settings:** in the string. -Here are some examples: +For example: - To show only the Ethernet and Proxy pages, set the **Settings App Visibility** textbox to **ShowOnly:Network-Proxy;Network-Ethernet**. - To hide the Ethernet and Proxy pages, set the **Settings App Visibility** textbox to **Hide:Network-Proxy;Network-Ethernet**. diff --git a/windows/client-management/client-tools/mandatory-user-profile.md b/windows/client-management/client-tools/mandatory-user-profile.md index 170b3ca9d6..b18445c52a 100644 --- a/windows/client-management/client-tools/mandatory-user-profile.md +++ b/windows/client-management/client-tools/mandatory-user-profile.md @@ -135,11 +135,11 @@ It may take some time for this change to replicate to all domain controllers. When a user is configured with a mandatory profile, Windows starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the Group Policy settings shown in the following table. -| Group Policy setting | Windows 10 | Windows Server 2016 | -|-----------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|----------------------------------------| -| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported.](images/checkmark.png) | ![not supported](images/crossmark.png) | +| Group Policy setting | Windows 10 | Windows Server 2016 | +|-----------------------------------------------------------------------------------------------------------------------------------------------|:----------:|:-------------------:| +| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ✅ | ✅ | +| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ✅ | ✅ | +| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ✅ | ❌ | > [!NOTE] > The Group Policy settings above can be applied in Windows Professional edition. diff --git a/windows/client-management/client-tools/toc.yml b/windows/client-management/client-tools/toc.yml index cb80088882..f40eb9275b 100644 --- a/windows/client-management/client-tools/toc.yml +++ b/windows/client-management/client-tools/toc.yml @@ -9,8 +9,6 @@ items: href: mandatory-user-profile.md - name: Windows 10 default media removal policy href: change-default-removal-policy-external-storage-media.md - - name: Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education - href: group-policies-for-enterprise-and-education-editions.md - name: Manage Device Installation with Group Policy href: manage-device-installation-with-group-policy.md - name: Manage the Settings app with Group Policy diff --git a/windows/client-management/client-tools/windows-libraries.md b/windows/client-management/client-tools/windows-libraries.md index c2a6a61609..12e7efd5db 100644 --- a/windows/client-management/client-tools/windows-libraries.md +++ b/windows/client-management/client-tools/windows-libraries.md @@ -1,15 +1,14 @@ --- -ms.reviewer: -manager: aaroncz title: Windows Libraries +description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. ms.prod: windows-client +author: vinaypamnani-msft ms.author: vinpa -ms.manager: dongill +manager: aaroncz +ms.reviewer: ms.technology: itpro-manage ms.topic: article -author: vinaypamnani-msft -description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. -ms.date: 09/15/2021 +ms.date: 04/11/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -95,14 +94,14 @@ While library files themselves can't be redirected, you can redirect known folde The following table shows which locations are supported in Windows libraries. -|Supported Locations|Unsupported Locations| -|---|---| -|Fixed local volumes (NTFS/FAT)|Removable drives| -|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)

    Network shares that are accessible through DFS Namespaces or are part of a failover cluster| -|Shares that are available offline (redirected folders that use Offline Files)|Network shares that aren't available offline or remotely indexed

    Network Attached Storage (NAS) devices| -||Other data sources: SharePoint, Exchange, etc.| +| Supported Locations | Unsupported Locations | +|--|--| +| Fixed local volumes (NTFS/FAT) | Removable drives | +| Shares that are indexed (departmental servers*, Windows home PCs) | Removable media (such as DVDs)

    Network shares that are accessible through DFS Namespaces or are part of a failover cluster | +| Shares that are available offline (redirected folders that use Offline Files) | Network shares that aren't available offline or remotely indexed

    Network Attached Storage (NAS) devices | +| | Other data sources: SharePoint, Exchange, etc. | -\* For shares that are indexed on a departmental server, Windows Search works well in workgroups or on a domain server that has similar characteristics to a workgroup server. For example, Windows Search works well on a single share departmental server with the following characteristics: +\* For shares that are indexed on a departmental server, Windows Search works well in a workgroup or on a domain server that has similar characteristics to a workgroup server. For example, Windows Search works well on a single share departmental server with the following characteristics: - Expected maximum load is four concurrent query requests. - Expected indexing corpus is a maximum of one million documents. @@ -120,7 +119,7 @@ The following library attributes can be modified within Windows Explorer, the Li The library icon can be modified by the administrator or user by directly editing the Library Description schema file. -See the [Library Description Schema](/windows/win32/shell/library-schema-entry) topic on MSDN for information on creating Library Description files. +See [Library Description Schema](/windows/win32/shell/library-schema-entry) for information on creating Library Description files. ## See also diff --git a/windows/client-management/client-tools/windows-version-search.md b/windows/client-management/client-tools/windows-version-search.md index e75721336d..d6a32eef5f 100644 --- a/windows/client-management/client-tools/windows-version-search.md +++ b/windows/client-management/client-tools/windows-version-search.md @@ -5,7 +5,7 @@ ms.prod: windows-client author: vinaypamnani-msft ms.author: vinpa ms.date: 04/30/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.topic: troubleshooting ms.technology: itpro-manage @@ -16,40 +16,39 @@ appliesto: # What version of Windows am I running? -To determine if your device is enrolled in the [Long-Term Servicing Channel](/windows/deployment/update/waas-overview#servicing-channels) (LTSC, formerly LTSB) or the [General Availability Channel](/windows/deployment/update/waas-overview#servicing-channels) (SAC) you'll need to know what version of Windows 10 you're running. There are a few ways to figure this out. Each method provides a different set of details, so it's useful to learn about all of them. +The [Long-Term Servicing Channel](/windows/deployment/update/waas-overview#servicing-channels) (LTSC, formerly LTSB) build of Windows doesn't contain many in-box applications, such as Microsoft Edge, Microsoft Store, Cortana (you do have some limited search capabilities), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. It's important to remember that the LTSC model is primarily for specialized devices. + +In the [General Availability Channel](/windows/deployment/update/waas-overview#servicing-channels), you can set feature updates as soon as Microsoft releases them. This servicing modal is ideal for pilot deployments and to test Windows feature updates and for users like developers who need to work with the latest features immediately. Once you've tested the latest release, you can choose when to roll it out broadly in your deployment. + +To determine if your device is enrolled in the Long-Term Servicing Channel or the General Availability Channel, you'll need to know what version of Windows you're running. There are a few ways to figure this out. Each method provides a different set of details, so it's useful to learn about all of them. ## System Properties -Click **Start** > **Settings** > **System** > click **About** from the bottom of the left-hand menu - -You'll now see **Edition**, **Version**, and **OS Build** information. Something like this: +Select **Start** > **Settings** > **System**, then select **About**. You'll then see **Edition**, **Version**, and **OS Build** information. ![screenshot of the system properties window for a device running Windows 10.](images/systemcollage.png) ## Using Keyword Search -You can type the following in the search bar and press **ENTER** to see version details for your device. +You can type the following in the search bar and press **ENTER** to see version details for your device. -**"winver"** +- **"winver"**: -![screenshot of the About Windows display text.](images/winver.png) + ![screenshot of the About Windows display text.](images/winver.png) -**"msinfo"** or **"msinfo32"** to open **System Information**: +- **"msinfo"** or **"msinfo32"** to open **System Information**: -![screenshot of the System Information display text.](images/msinfo32.png) + ![screenshot of the System Information display text.](images/msinfo32.png) + +> [!TIP] +> You can also use `winver` or `msinfo32` commands at the command prompt. ## Using Command Prompt or PowerShell -At the Command Prompt or PowerShell interface, type **"systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"** and then press **ENTER** +- At the PowerShell or Command Prompt, type `systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"` and then press **ENTER** -![screenshot of system information display text.](images/refcmd.png) + ![screenshot of system information display text.](images/refcmd.png) -At the Command Prompt or PowerShell, type **"slmgr /dlv"**, and then press ENTER. The /dlv command displays the detailed licensing information. Notice the output displays "EnterpriseS" as seen in the image below: +- At the PowerShell or Command Prompt, type `slmgr /dlv`, and then press ENTER. The /dlv command displays the detailed licensing information. Notice the output displays "EnterpriseS" as seen in the image below: -![screenshot of software licensing manager.](images/slmgr_dlv.png) - -## What does it all mean? - -The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn't contain many in-box applications, such as Microsoft Edge, Microsoft Store, Cortana (you do have some limited search capabilities), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. It's important to remember that the LTSC model is primarily for specialized devices. - -In the General Availability Channel, you can set feature updates as soon as Microsoft releases them. This servicing modal is ideal for pilot deployments and to test Windows 10 feature updates and for users like developers who need to work with the latest features immediately. Once you've tested the latest release, you can choose when to roll it out broadly in your deployment. + ![screenshot of software licensing manager.](images/slmgr_dlv.png) diff --git a/windows/client-management/esim-enterprise-management.md b/windows/client-management/esim-enterprise-management.md index d51111f943..59197ad641 100644 --- a/windows/client-management/esim-enterprise-management.md +++ b/windows/client-management/esim-enterprise-management.md @@ -14,13 +14,15 @@ appliesto: --- # How Mobile Device Management Providers support eSIM Management on Windows + The eSIM Profile Management Solution places the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to use an already-existing solution that customers are familiar with and use to manage devices. The expectations from an MDM are that it will use the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and the installation happen in the background without impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. - If you are a Mobile Device Management (MDM) Provider and want to support eSIM Management on Windows, perform the following steps: + +If you are a Mobile Device Management (MDM) Provider and want to support eSIM Management on Windows, perform the following steps: - Onboard to Azure Active Directory - Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Windows OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this capability to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Windows OMA-DM. This characteristic makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, contact them and learn more about their onboarding. If you would like to integrate and work with only one MDM provider, contact that provider directly. If you would like to offer eSIM management to customers using different MDM providers, contact an orchestrator provider. Orchestrator providers act as proxy handling MDM onboarding and as a mobile operator onboarding. Their role is to make the process as painless and scalable as possible for all parties. Potential orchestrator providers you could contact include: - - [HPE Device Entitlement Gateway](https://www.hpe.com/emea_europe/en/solutions/digital-communications-services.html) - - [IDEMIA The Smart Connect - Hub](https://www.idemia.com/smart-connect-hub) + - [HPE Device Entitlement Gateway](https://www.hpe.com/emea_europe/en/solutions/digital-communications-services.html) + - [IDEMIA The Smart Connect - Hub](https://www.idemia.com/smart-connect-hub) - Assess solution type that you would like to provide your customers - Batch/offline solution - IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. @@ -28,4 +30,6 @@ The eSIM Profile Management Solution places the Mobile Device Management (MDM) P - Real-time solution - MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. - Operator is notified of the status of each eSIM profile and has visibility on which devices are being used -**Note:** End users don't notice the solution type. The choice between the two is made between the MDM and the Mobile Operator. + +> [!NOTE] +> End users don't notice the solution type. The choice between the two is made between the MDM and the Mobile Operator. diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index 69d299fb4f..74bdfba5df 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -37,7 +37,7 @@ landingContent: - text: Enterprise settings, policies, and app management url: windows-mdm-enterprise-settings.md - text: Windows Tools/Administrative Tools - url: client-tools/administrative-tools-in-windows-10.md + url: client-tools/administrative-tools-in-windows.md - text: Create mandatory user profiles url: client-tools/mandatory-user-profile.md diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md deleted file mode 100644 index e40844c3c1..0000000000 --- a/windows/client-management/manage-corporate-devices.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Manage corporate devices -description: You can use the same management tools to manage all device types running Windows. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.prod: windows-client -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 09/14/2021 -ms.topic: article -ms.technology: itpro-manage -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 ---- - -# Manage corporate devices - -You can use the same management tools to manage all Windows devices. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, and so on, will continue to work for Windows 10 and Windows 11. - -## In this section - -| Topic | Description | -| --- | --- | -| [Manage Windows in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment | -| [Connect to remote Azure Active Directory-joined PC](client-tools/connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | -| [Manage Windows and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | -| [New policies for Windows](client-tools/new-policies-for-windows-10.md) | New Group Policy settings added in Windows | -| [Group Policies that apply only to Windows Enterprise and Windows Education](client-tools/group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows Enterprise and Education | -| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows in their organizations | - -## Learn more - -[How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Configuration Manager](/mem/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) - -[Azure AD, Microsoft Intune and Windows - Using the cloud to modernize enterprise mobility](https://blogs.technet.microsoft.com/enterprisemobility/2015/06/12/azure-ad-microsoft-intune-and-windows-10-using-the-cloud-to-modernize-enterprise-mobility/) - -[Microsoft Intune End User Enrollment Guide](/samples/browse/?redirectedfrom=TechNet-Gallery) - -[Windows and Azure Active Directory: Embracing the Cloud](https://go.microsoft.com/fwlink/p/?LinkId=615768) - -Microsoft Virtual Academy course: [Configuration Manager & Windows Intune](/training/) From 070c09ec015f351f2977a132cbfc5c9daf4ff267 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 11 Apr 2023 16:34:06 -0400 Subject: [PATCH 066/139] test TOC --- windows/client-management/toc.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 7ebeb6260b..12a2e704c9 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -65,6 +65,7 @@ items: - name: Configuration service provider reference href: mdm/index.yml - name: Client management tools and settings + expanded: true href: client-tools/toc.yml - name: Troubleshoot Windows clients href: /troubleshoot/windows-client/welcome-windows-client From 7c6db515fe99a7ca73069c2607e5b85aaba9920b Mon Sep 17 00:00:00 2001 From: "Yong Rhee [MSFT]" <56358587+YongRhee-MSFT@users.noreply.github.com> Date: Wed, 12 Apr 2023 06:57:39 -0700 Subject: [PATCH 067/139] Update defender-csp.md Adding info about MDMWinsOverGP not being relevant for the Defender CSP. MDMWinsOverGP only applies to the Windows Client Management CSP. --- windows/client-management/mdm/defender-csp.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index fe160a4fe0..3f2a9eadaa 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -20,6 +20,10 @@ ms.topic: reference +> [!NOTE] +> [ControlPolicyConflict (MDMWinsOverGP)](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict) is not applicable to the Defender CSP. +> If using a MDM, you will want to clean up your current Defender Group Policy (GPO) settings in order to not conflict with your MDM settings. + The following list shows the Defender configuration service provider nodes: From 0ecd9deff88d32decd9ee70d9f85834050445a78 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 12 Apr 2023 10:09:14 -0400 Subject: [PATCH 068/139] Update defender-csp.md Move the note inside editable section --- windows/client-management/mdm/defender-csp.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 3f2a9eadaa..5d33d60e48 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -18,11 +18,9 @@ ms.topic: reference - - > [!NOTE] -> [ControlPolicyConflict (MDMWinsOverGP)](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict) is not applicable to the Defender CSP. -> If using a MDM, you will want to clean up your current Defender Group Policy (GPO) settings in order to not conflict with your MDM settings. +> [ControlPolicyConflict (MDMWinsOverGP)](policy-csp-controlpolicyconflict.md) is not applicable to the Defender CSP. If using MDM, remove your current Defender group policy settings to avoid conflicts with your MDM settings. + The following list shows the Defender configuration service provider nodes: From a86ec42861a2a437e6ba84044ec5151b559361ff Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 12 Apr 2023 10:14:49 -0400 Subject: [PATCH 069/139] Update policy-csp-controlpolicyconflict.md --- .../mdm/policy-csp-controlpolicyconflict.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index b6865f7b07..4d9b9ad115 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -44,15 +44,14 @@ If set to 1 then any MDM policy that is set that has an equivalent GP policy wil > [!NOTE] -> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs. -This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. -The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. +> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs such as the [Defender CSP](defender-csp.md). + +This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. > [!NOTE] > This policy doesn't support the Delete command and doesn’t support setting the value to 0 again after it was previously set to 1. Windows 10 version 1809 will support using the Delete command to set the value to 0 again, if it was previously set to 1. -The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. -This ensures that: +The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that: - GP settings that correspond to MDM applied settings aren't conflicting - The current Policy Manager policies are refreshed from what MDM has set @@ -65,8 +64,7 @@ The [Policy DDF](configuration-service-provider-ddf.md) contains the following t - \ - \ -For the list MDM-GP mapping list, see [Policies in Policy CSP supported by Group Policy -](./policies-in-policy-csp-supported-by-group-policy.md). +For the list MDM-GP mapping list, see [Policies in Policy CSP supported by Group Policy](./policies-in-policy-csp-supported-by-group-policy.md). The MDM Diagnostic report shows the applied configurations states of a device including policies, certificates, configuration sources, and resource information. The report includes a list of blocked GP settings because MDM equivalent is configured, if any. To get the diagnostic report, go to **Settings** > **Accounts** > **Access work or school** > and then click the desired work or school account. Scroll to the bottom of the page to **Advanced Diagnostic Report** and then click **Create Report**. From d4f3b5663416395a485f800eb9b0bae6e5d49d5a Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Wed, 12 Apr 2023 19:49:42 +0530 Subject: [PATCH 070/139] reanmed Password Policy as per user report #11435 , i changed from **Password Policy** to **Account Lockout Policy** --- .../security-policy-settings/account-lockout-duration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md index 969423ed4a..713bd9297b 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md @@ -44,7 +44,7 @@ It's advisable to set **Account lockout duration** to approximately 15 minutes. ### Location -**Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** +**Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy** ### Default values From a1585564c29ed28baead785324ed5234d9f51342 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Wed, 12 Apr 2023 19:59:10 +0530 Subject: [PATCH 071/139] updated link as per user report #11450,so i updated new link **https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines** --- .../windows-security-baselines.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md index 5220f9868b..238193ef00 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md @@ -75,6 +75,6 @@ There are several ways to get and use security baselines: ## See also -- [Microsoft Security Guidance Blog](/archive/blogs/secguide/) +- [Microsoft Security Baselines Blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) - [Microsoft Security Compliance Toolkit](https://www.microsoft.com/download/details.aspx?id=55319) - [Security Baseline Policy Analyzer](https://learn-video.azurefd.net/vod/player?show=defrag-tools&ep=174-security-baseline-policy-analyzer-lgpo) From 309999997aa80fff72cb8c33f9cce33e60df7b90 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Wed, 12 Apr 2023 10:08:31 -0500 Subject: [PATCH 072/139] Update defender-csp.md Acro edits. --- windows/client-management/mdm/defender-csp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 5d33d60e48..7550924275 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -2481,7 +2481,7 @@ Information about the current status of the threat. The following list shows the | 7 | Removed | | 8 | Cleaned | | 9 | Allowed | -| 10 | No Status ( Cleared) | +| 10 | No Status (Cleared) | @@ -3676,7 +3676,7 @@ OfflineScan action starts a Microsoft Defender Offline scan on the computer wher -RollbackEngine action rolls back Microsoft Defender engine to it's last known good saved version on the computer where you run the command. +RollbackEngine action rolls back Microsoft Defender engine to its last known good saved version on the computer where you run the command. From b412f3a0d20cdb11d23a0515e3354a1631e66da3 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 12 Apr 2023 08:36:41 -0700 Subject: [PATCH 073/139] metadata --- windows/deployment/update/wufb-reports-do.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/wufb-reports-do.md b/windows/deployment/update/wufb-reports-do.md index 9c8870a1f3..7171a19511 100644 --- a/windows/deployment/update/wufb-reports-do.md +++ b/windows/deployment/update/wufb-reports-do.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: article -ms.date: 04/05/2023 +ms.date: 04/12/2023 ms.technology: itpro-updates --- From 9216be37617a760feada8a9aa5f3f21c5f074189 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 12 Apr 2023 09:28:02 -0700 Subject: [PATCH 074/139] metadata, links --- windows/deployment/update/wufb-reports-workbook.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-reports-workbook.md b/windows/deployment/update/wufb-reports-workbook.md index 279be81249..53396697ce 100644 --- a/windows/deployment/update/wufb-reports-workbook.md +++ b/windows/deployment/update/wufb-reports-workbook.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: article -ms.date: 11/15/2022 +ms.date: 04/12/2023 ms.technology: itpro-updates --- @@ -173,7 +173,7 @@ The **Device status** group for driver updates contains the following items: ## Delivery Optimization -The **Delivery Optimization** tab provides a summarized view of bandwidth efficiencies. This new revised report also includes [Microsoft Connected Cache](/windows/deployment/do/waas-microsoft-connected-cache) information. +The **Delivery Optimization** tab provides a summarized view of bandwidth efficiencies. This new revised report also includes [Microsoft Connected Cache](/windows/deployment/do/waas-microsoft-connected-cache) information. For more information, see [Delivery Optimization data in Windows Update for Business reports](/windows/deployment/update/waas-delivery-optimization). At the top of the report, tiles display the following information: From f2c1107d369526e73c70ee69e1c1ff877b1cdd9a Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 12 Apr 2023 12:34:25 -0400 Subject: [PATCH 075/139] Edits --- ...rollment-enrollment-of-windows-devices.png | Bin 45286 -> 46713 bytes .../mdm-diagnose-enrollment.md | 6 +++--- windows/client-management/toc.yml | 5 +++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/client-management/images/auto-enrollment-enrollment-of-windows-devices.png b/windows/client-management/images/auto-enrollment-enrollment-of-windows-devices.png index 5f7fb2c44bc0b40a02e6484b237975982cd5c9c6..f35f11cc5dfe38da318232de7e34cd8182d4f2ac 100644 GIT binary patch literal 46713 zcmd?Qc~sKd_cuJ?s0d-}kqkKYzco7K``$u+Ki{?6c3_uf5OV z&nwP$TQ=_72mk=K*k8Kf0syS_1prnb+pu0yljD%&sQ6kH;bM0VP}RSmrFdBzc-HAG z08pL0Y30T`#rtn}FL^}(0Lt%wepYpamD~aV2+H;s&br-)aHOz`qa(SWMUsnT&q}8J zW+9?FETC|Z1Sr_`5%Pd=F@It2?qJpSR8FotY;XDB*S0`{bwR=GWI5zK3{w{4G#G__ z@?drIl6%)@tpn@tHZsP-8;V2Ka(J7kSF7D^0N1I~_x&X>nRhcZ9@)a-+mQKN7cI4% zFW52@JFy79B;}mY*7n1n{GEHXP}{Oa2TqmCg)a>0vIsvE*TM1M!dm)q&kwbHXOFRB zI=*7Sv$YUlMDiprT=Sn&w7?=uX4_wg{P$c?P*hZvt}#GIi?;Ory=%um#kFTCTHYo} zL`cHkU0SVRV&bG4-zcnZfBDy+|CFGirD&Y^+@7D}tSBm7Z7?fiCm(%SY9^n`U^YVK z8ogp0@rHldrD5}0=F!Gjv|K~W?=fGVovQ=@c;0Yb=PP5{v>5GmL~?NSki0maeZ{@N081w#TYKrF*KbODt^d2+Cv)hJN1?@e9P{nh}*7yf}j}Fk+4?kPAH?}5-8*xLlyU{}Oehc5@ z2Ffv)<9cE?OBAz!cN2%@D9P@=wE%k#FaG``VJw)9$|PpZE?Sg*RK>!d3(^Wy{KqpJ z>*U=lL0P#C{X+AuTA(aoUWrfmF0JZ#yGk);_pR~OBw-*rz|_p_{lw18syi0X#dQ7d zl(xnoqWSjqm!HpgqxG^IHU7+~^!x4pN&@0@y@6%X1NQwKlA*r$+`|Xy!Q6)gwDFY6 zwS$0s{{E>RRoxAzxTppOaKvvyG3_@eHngr)S-}ZGHk~0YSy|H;8D}=MraQ$}pK`U? ze$u;Rt?y&g2#v@B>w=`qoSK`f_Bf0}>rAJTPz{Cu#e!f6m{#Horl(lGHdXp85d-yc z0ir^ikqq{H6;rZeo{!x#Orf4P4=daR6#qV8yohHlpGHyDh||AET4!8{Q&MM+qW9 zkh1l8H$Ijry$;=aU1h`c8AIg)KjMgQO&w|9qxJ{fx}trzn5sMennHU_?Gp_@WZm-R zupL#3MtaT!r>uXHUJvJX{~WdWO*BLbQZB@#Z*wih}4?g zGO{oHZym&?ZeVF>D&sP(rohK5rmWIJl3s4t0* zNrlELUp{s5Xp`KU>50B4R$;EVxl=zkpXV+bf2|{MYvj<`NWYgaRNMruHHHAy8Y{Y; zO^Z@?TljsrOlwBh;Yg{C^&98)W7ng_3$OLmS~13R-t6On+R#e>4SyjE>MOiis)b1V zn0p9fRT`rqi<9+ zR;{%v)2@_5qy{~)_s}Qgu4EgpTxr!6ZmLp)ENV%6@ZU{F&;q#bIl8e0cJB=~BwwkR zM?P>Gqx2D}E}oFzK&?z;-uXQF3YaMGF)|OUsnU2;{&e%Jxzf|mqs4_>$jM>Ea2{#o zYQKxOCh}!~@$F02yef(oF!@c~FTRvXFVJzFn@s-j67F*x^O3#fT1T3g zUSJX0RX)_290DB=ymml%9gOsbS zdK|If>YRLUjl#H=dA`*0T_N1N@@dao)Ab86cTcPtTX_1Gw7&7SGlZLBw)c#K*EIc- z%6ISe5=#2yNRVM-=B9*_$``Mn;|o+AuODD7I}sLDwQB`W>p&*E^zPQI5CpUKMWjo6 z>yjuI<()Cr3+v0L?WJKZ>Z+N6nzO~Z!>;wP{3HiK0W`R@`PWaIVm+J)qVI&Vq* z@YPu0xFc1`yE|t_+q-y>n@*^S3~_D9m@m!;MRKT@$E_$LpxL3xn>OPWt=-BC-9Cj2aA6{@Q+)mc7ncREAhI{TwR}Z$G}qb`lR{`qQG+f0CIEq;Cy$A za){QfQ#a2eAPl&Nx`u7wI|`>Qs~ebj52%z;)0SKk#iQeTMHdeB6{w^yv*s>AJ%7lq zOlh`!!xErBko7axP>)+87<&L5K)kf~Z4%h}7)vB`72sE~-?qsAw1@k6<^?VHRgjN{ z#N3&@MYB~eW-M=nziOxs+ALBx=pw;o^F%?73$SU6DqvXB&r3-+^Ei&4QnDN`s|A@X z(*~K@RsNFiTi`Ks!XZcO+YJMrC-GQ$*zfRH6vfMpC!^gGYZv|ZwMY1yV&SCL|f|Bl3VWO?&Erfj% z`5g%yb0fFHCVk44);pvGZZV$w6v2pQbn_;LxOWhu9ynMxEV%r1+lo`!Y?4)m#Kqv1 z6$8dMD&kh7us?e2QQb5n4m7Hacja`{hXNEvkb9@aTv&SfUuE871*m;Cv-O0`!{t{&cQa4k>Cjtpix9 zugZe8{&eUs&jA$h6d10T(t)PFi`&QaK(F5>&pDd8wIz6X~{nU z%(YK$tFlhXMQH5i0@?C7-GnJ5efYPeJInd6ZuNd&Mu%VAlga1~|G-v3@T=Can;G-=*Q6@32zR=MhlYTL== zEH%9}D!vAf+oFH&1zP;PQM}#T4C50v3Q^WidSLpCm+$Lss|`B({@$t+gp10q_josF zUANA6iLJ`9IRHuUq-(Int7|2lw)f%p>;CCIO&1PmZw?=hn?tH%pXxQWPh{F47Z(t< zi}OdAq!udnWEi-nwH1J{kn&F9MIFY{ESMgRj0J|!LVQ50$$u(V?dn-I)DNzzM}3+2Gx`ZTy~%!amu*=`32*!Hied^HW<4DEW9;xC^W5ALm%FVi1;v^Shy zl@&dZlcqus3B6DEXSy^<{h8g#>P8*TxGyJaPgdrSYtVe>5`u zJhFPG39q2P#?NIPd%RjdYg)SJ%GC(?iq{h5->jp+IaR2D1=$t$i3SVmR%+# zulykzb{DW&k=2c2VKO%2hI{qmj8@-B8=SL~9rPH`tNVm&qT#~+Q0!*0#vl-;)}=Z- z#~Gd()i@0BqX`BoAfsId@vumDzE zZW9&jPRABQjXM_P1&!PwFMOaiVZCpEjz9`;f{@r(T5!1iW zjzC^2NycKpGUptL+slRS?{zA_R^gb%hT7b}RjZ||vW}j<*ZHE?CN*{4X3h1!hox&f z-00xfYXGWQD(Wc1W=O0^_QS1LsSl~2pqd|zGi;Csd_r*zHEw5{>hBn({+;m@co&Z- zT{O&F2J|xDn_a_0VU$r2Yo}9pthd@qf%1e;j5G()n9@#x2a`~j4 za{~2YtzBR7yPBs})&45_0~D@wN}hM&3RyIhw&0Lg7pMMnw5`j3oXz5FCjFtNn+k{r1ZdP|_x$zQ)dm{I!TL`yC)JoIsZSX4$UfuU-fY~K9({A) z36J(~FCFi{K7zh^%gK?U_wf?Hkme+Jm~P?W~Gb zLCUh1^3SaGeMk5iQ!7gC;NO_rmJbbR2ja)#DrC;7SQ1zk^d${PetkVqvc{mecid)6 zk7T`JIFHdZP*n=OIz)ePGjVr3VsIkb>5|Y)C3{B#Hz_E~5a5aqshB=;X<$_2Eb&YE zJ@20pykfglYOjO7<|wvIEWj4+RbD~=Q8QZG(Wkp8ahhvX#gO=IS4=nZ?nM;ic0S+XKFnHnwAt~eJ61%&>%c!p{<{HInX0htJl78b-qfnBKD*wI_cc#Z5qN~#kQH*m zO3bl8^y+}>4~ygX#`Gd+4G?2BtgN_jfP8~5RoMR|&?jVj@>DbLk4ArbjxGkQwf1m7 z&N^e|7M!=X_fd1$F@RtHr@C_P>&8!U-)d9!p>*Dup}sD{k?PXHV{(tRq(E6*Dbi6H4QsW<~j*e1=$ zb-p!#Gm@A_l3FW2&3XWVhoxzCZ8skkf2 zVA$Q|ixKn=JqJRM!UBjcEf4Sb*TMAH?pd{GvE82kjl}NDIJ7l_6&Cj~Zslo5Z@VbT z_go;L-9qx(OR}WY$2j!qV96R($V2F5>!<=raDkE_9EdMjgQ@;S$PciNL@5tc)02cnQtHxSaWqI^XH_RKx zE|;(}J2>UFv4TI50Rz@r@AmhyI{HY~Px_2a!oTKO2hewT2mMSfDim+mk+r_d*&U!K zUOnrs6m8z~?A&Tq@6GG`+O~>TWH)}l_KQmA`QRFZa|-R0tzG}`EZ#UVx5sxq+{jDG z`mybpMwa;vWv+cg8eAD|qcT;XaW9pTRG(~yNMm&1_d|Wn zv$tsPnfHV?LhKccg>MP=Tq9QpAMFvS1$=l&poL8YZMQ& zVgW^aH-BdrKiIAD;du{QN(`ZGh`F`u&(UI=R6$K#87%HhzH;g}B!OYgShL3+=*>54 zta_Ag^V@g{Bh;(3!b^Qvl!+{YXJPPDnDl%%;4i)gm7;aNWiQX)C!TZCJN*S54kc~fYi=3g@^C;U725o8m z)LdGpUQceGPbB_g3pkbS0I=1YL2i9@w*AK_#3vZVC>VSd?9dJ+=^k8^z7L>V8;$g^0gnoD zQE}}lfOELy?pqJG-1~Zx~vVtRN0*W1C!Mc{8eNP&o41(}RmYXBt$r@(Ht%6#5` zkk|d6YhIwy5VUp!55DBOUlz0#Ifz?-@Ezswjk3|S_=hppzj?aNNsDNOpp>^S-&>z( zIVuMuk~e~icJeVr?z857fgXS&>qJiwuq180%aDbR(jBXREF@sF-)BH?YFFOQZEJt| zEl{htYWeVOEwG~$TPu{Wkl=@8u2rF1jN5mI5noX4KNV6Qon_-qAV>$3mDz?*N}a*k}gr0s^lLR?-$x?vjfdA+256d9r|gS zULJ&1kH0_ESW)cAzba1Beo+~eH!Ar~NiF?k<%$&Q=DJ9yn#7PzA#EVEn3Daw_Rp7} zbgeqf1MwodY((z5`OQ-HEpOjzVPq*mS?FT; zmX|lMGW2$KyD7@clc_aEkmHZ4n;fqaN%9lX-sYyD(XdH> zJ@SPi8{g6QJ(hhvP-#KqvR^Q>F#7!_hs$}sqQzwNe&!u47R#j3WdzY^1IeGn&*f${ zOvRkkvF{=vala!t_0-CJ@Uo=M|Yd^L4p$ z)(*zo4@1wPCSn!&7n?_oIV(dcYj4Pw!{nnYV>oFxVzEv2eQLTwic5!9Wrd;mSZ1FY z5}iSo^Pn;Z)ib}M(26{TY?amNI_uq6>TVoJgXZRKjZZNaYp?Z$5UD=FP{|L!)b_|# zS&2uQdM~Oj7zLjIxW>Rrn`;81XcnK47uNY+#&fpvw!MZ*%cR@N>{sm>yEgRgh)U~* z-$h1?;o07AzQ|N4|ToILUfj1#Qbhnk572L}(&2>QgVH&3|to(3ePS!F%s0x5#rgqbM z1N+Syknv9zJ!yePSE`sKyq_{8ewsG)=5s_p!p1p2BdD>k)bAPz z#CPk?nwo*K{mAHAdC9PscYC>>0S1D`n|S@LJk zlDwv}VB4CbMj8)Kh|${~?lm+xjCXjWz5e$2(w5fF7>jQ_K2AO%)t86{lTkAY+jxvy z16hF!LTG>}C*dcQ`PmEwUkII{NSYFz&=MXKXVLPJtE_Gs7*wR>NM z$Nsn~dks~OH&->gPc4#+u%#rQR{KYvI|PS55Au&(QV1t8c^Fg~Ck$w^8g?&LerHF{ zS(Q~wii;43(+S-86yLuKw4fjA=&SO{k35uiJW@8@;H8Op&bc-8w^~c6w}ED=;485P zy!oz`VAz!@q03RbK73>|Zeg>+tl`!Phgt1)O`Smafv<84-=mDKho@?MAi*@7UvnlZ z%mNX;E+`xjPy{`@5&ACntDPGB?z^tl2HZRoEe+D-#8P!|Z#|cvRHPn zjmmXm6HQc?EafXo%}Ai3u+>NN5hx2IQ~tIN|AD@zAPo z<;Z1FLtNb*Ul{rKqZ-z!&@+Fz(xO`(B_}T#{;_?{M#InBW*yEZ?TLKe`e+5GbYR9L z8)JO5#bqBN{yZUr{L?GauF2Yc2aXzQAUlaQ@+|UkQr;{G+>1tFAuhqV$*h*FFtZ9ZMB-=!B=Z`oMZaMAAx2*MLbUiw0%yl(B~U|H|#2i z%j_iGJm4>R8@BD?xvP#)t{s7`cJP;9@i!DIl27QsUNl?+db%pJN?}W2609Cz+U9F* z&&1;VVFP0K_6@Be zR&kvZUsl^;nT(F*oRfZAzhyk>-GcG)t&-jP5sK||4Ul&B1#nnzz63Q*EX;PdsAOaE ztV5k&=#fp`0k%NkG0<0^dTJbF%$3Oq)G#t@;ocP1JymH9$+8Q};1U-_h)C|Ph)t~< z5Wh2&Y)Vi|&1PdoT#Ei-gJA?lNv63ubw9yn{7)E%ZIyIxTvg+q*`f4d63|lKS6UJ8wmG<0x zS!movtm%s^+SHnbnbzM5_SHkn`MkO$C_Y3yNZwq^29E_8_l%M{X z@YB@2p;lOXpg#mCGJMQvWjFFv%AB68-U+`(?NQKK>&3*2hs0?%&b`4K`!P&3rD zs08RG;-J-uRax(X755Ny8V0@xJO50XRM>EEWsP6TU4pU9PqGRW${3e?@Zxqy(H9l; z9;Rj*ym-ra`f39N;N0(<#YapLt!GDjpifsl{gE?oho(Bp40ElXZ=>RNx@Bk1m@v;O zW!|!}2;07OXjRsp3#oC;$Q&aU=hx)NLKNZ3%6uZ(ka|Ewe!5E4`X@@uq&9{jht_#3 zw`+y%j$iAZhY|v(g{Gk^pP6^%viX4%a4T{A?31lbY`gu(e z6q4p&^H0p@UC&vy#|ibNM2_Eo!%*Su6j@gNwB$WwteTU(3m|-UTG*quO_zY{Ypbij zkftvx8lxkB<)z~*ub2FjNdmMwU-&1Y0{GtgHv|FL{u^Zd4^^fZKyNINzj}u&{+H#B z&;0|inR3qQ*QDn!#I5~R`#&)Gf7jLjSEwv40JS9f>WD$v^o{<1LEbpE%KMbsm-^Bc z1;~TmZ>@MTR()wIS|eK*Q#Ik@?7r+@)RWf0T0R}BJifAjf76aO&$icgj9yX%)ogNuF&#jFJ&(~ zPLmbN$QqYbx7}J7t>W=TR9kS*js@PjmZA3H6+bmP=8#@rfc@_ z7ORFPoZvj5NMVVd@BZw05O6BrO8&ohx>4HJqA%>@*9gt#_YbN5*6QddTa`7M=5@On zE@w_3{(FoVdSx5N|KZbHUZ1M&eE9x&H-<}+F1NSVp7u>i!%tOR?g=f&_|v*jX|Ro7 zWlKcy7E4yVmrNQXa{`j0uI3frX{iWJU2}9;w2hoQKQJ3y=}a3b9H&0|`%e3!i*~! zCzmh;;5I6FljsiwHK-wDGUH^qJ~`A|jSa+RE`Anw`a6qj$Mr7J4h^3_RR&K#4p`XS7da%O z4JC>0ZJ+g{^CK#A;Kwxu(w7{;CxP}#7IPHjd? z{Yr%~jd2qa7>4Idc9=Zg7PNQB;ybbvUn~bn9_0FDyQzElZ%(x+rHvH3S}emw^XbLZ zgKV~J`v>uc+P1i(_ynUl&R02X+CUK=@8iXJx-8$BbRkvL2Pv#oW&QUi>60%nY=W{X%2Cd+$p}B zj~q{0d`>3>-ybtAJyL3koEY{WU|*v8^R1&0eWD|mUe(U6uY6=XU~#9uDl#+EdENp8 z*_~HruXfceXTWX}5oy=?p?_aM`5F^euYkZ(yG+7exB6D*?`07r3VD)@h){CM#nnB# zHq})tpzt19cyPY(ck#E4pTvTei|gvo%VNee5ls?N0VFbq*zAS7#9yE~%|S+0{QIbI z|Jtys7#j}fIHIC~qk}8wF3VCku;;|^APg@hqb0Qte>-UU4#|riydbaceo;g@p$`qr zq11s-aFkG!qcS~-=!Az*rpD-A9vhc6K6kDG1ECD-o?sX14j!8TTgJyoBV(z% zyTp5&xOZp;PN%%kmuR}Zm^p2(og#@E+>9xS3;iV26QT*o8mHG@VL`dx2uS+qiZ@A_ zT{9=krJkR-HhXo}d@Q+~n?(4n+dotKK}rxvt58J@1mR(b5FPDR#N`vFY6y;V)t>rM zO%-6Cv@Plc2PA~aN#hO9=VUxMoD?ZO6lM>(>>u3Y;lec5ZP9TmcOtZ8j3$~?PY|K~ z&v81)2FQ>dC90F}VVymh0!rc9^u@~KdYZW&7EqL=j7;+vzdc@PsZGwCBnjfQCEOB8 z6|zYVM@6JHRPw$s{j7fgv2_vQI-VA~4&6KXuYRiF00@X@H*q`#tYQCqeD{`F_~llrh%(Fv1LiYiQU%9iZkY=1~YAUU0CRNsk z*InwFY2eOVwjo7v9&GrsA5;Uz;0aO`fqnYGXsS!qcf)A;b<-*k(VQIjF zlD{MwFt+JONiWS*R~Syq)c+#bRkE+$Uahs%BA>gn3;QtAr=cbEgWJ$OA2B@NK3_Ap z>^t+b8)5@bbTq8b=&0l>&-qv+iqae$WWJAm%wKyLdyE#z@R$uAimR+t-^j_Sp!wvb zYX@Uvyh=lY4$OtGcgL|#*u5NuEjY{~&WS7}4n@_WjYuDn8hgDprKCGE-Bqo;SDisU z3KeI)C^}$C(=#bWYw=T`jPAHZLusZr3@5pdS&rLaiYbOT%wR*HPxLud8r&hst4yZG z1?5H}?-W|G;7xPdeRve;BOvQQ3CmY{B%@D5F}9+mC|zkmbgpM#44&PXom9A7iqT>d zX3A591ykQEIDvCY|8_Dz@6S~pnq)fpJhW1D97orMF&PRPTfi9c^CMWva%X&m7d)Q68 zdng$Sg|N_Y9Vw-Q#Hi_Gc!!);`R=5!5H4vl4qu*Uci$q*xJ zI2j8oUh^$2gvn1q!%0o)>K-mD52>OI@yrUbX~j-qXk|Fa;K-M&zE zn|{{kqb(?uw%mTn@)jX)ZnOCF?M_RdS8KXab8Cv854=0;W#QSQRN6_Y6ymA^kLCJA zf4|?E(C(XpVY($}XPalv&UO`6vI%Zg z3sOwCJGa;w?_+ulRO~mEQJNB})A48}00y16ahD<0G9(@|LTc}mOls{%Je=w}q#sMh z{9zS#79NtKr&Nf{NqORmSjwao3NnRqJp|GYzPE`t z_z6Ot{$SBZsdIHHIy3ZJ$C(ysoxpFGxDW!8g*BV`OPn*y{a<&3*o))65xEes28@%5 zDW%5UfWpl+1%6$w5r}lE9W^esp$c^fR?z*q6nO0u;aYbX0XAexTwxL5QzOe6L%}^k z-fIlNTRyvOxwcROxzTix^Ssa2o32lT7s43oRpor=K||g{_hHtI`juJzNxSQ|Cs{Kt z1g6^M9D3b+n^{Vd==v#L{8CJGQxCAr$X^Kto^lx*s*6Ng%=HysRrV^P?@u**9S4oE z+0jiMgBm5mk8uu2?PpuEY->^8>{mv~Mwp@Bc+1}|N0bp97!2+UjMX>kHzTdcMxqdU z!Xp=LUu-9NYL%OW(01kJrDQ#)>wwy1`Ez6-#DRyb9|_b35tForT{}UL1&c74e`pWL zKJRfqbT|_dEmMP+h;QV}_WDsjS;-EF3!eG%Y=W|DUXPe(JoFh$-kIu~0~H?Giu zCOy|$$ecxx9)D>$%{V!iDBnr(=*WdkEu+s-GcFf91Yg&~)gJiA6jX4H`DJ{!Zs?V{ zhZ&i`k=g^tKrYVOVbxXR%agT0iv}uQi`6BYHazlc^~0NYIX1$;`UvY;X%9tEB6%*e z;VOao)yT^{&QQ$BS-cLOd#3)X2XG&a9rMDoI6=C*&Cg^qfGECNQ^OL6hUAN%h1%J5 zdwiqAB>hl~C_q;Dj3NAeXc@)_OUil-OEns1FV6h32*u^l5<=;>7`+hhlQU*?Q+vzh zlOmf*LVv77PK#vWCN>PvZW=l?=5ujw{o6C}>vZ!pWw+Cx9vNpsOhuNytFgFAiGP_& z`s3#6O^HzW)ORxQ`}kYlx1?k0&_Zv9H62QeNvXikz2g?^%KQ3r_m_+oAo?;|3e{5y z4$8dn0}4H03^L$|p!9m@lYPPCWM23TUvFR}PG+0UY^;sjA$EA}56;COZUG-j{0%lg z>LIG;BS~ulvWzgGGtNVH6-ma$!A-*jsOSB~@Xwk4a5f7W#kCnli-GQVdb#u>#0Jb? zkh_rD9<2~p7_2z~g>y{aC2>8>#;S|L;g#a^5aFa?h9CEF-Nbu`%zi8gujjF%oE1mr zghs_ zF>k`0ODW^e^UX^kLqzVU_C;wgXQ1$v_+c)d99#&>ePnTsVK2U!N2-d>c0~kdR_a27 zz#~Bow>bmeHoGIS1L-&&X}GsPSL2S9L|-*caAg(2Ob^jrW~pPsW0oW3-{M3ZHt|yO z(?10%bwRrLr*)fC2~(P3JxR!hdA#W)AyuDT6@oc%s%mqLG$eM+bQCMI(T|;NcBqZ3 z_+>q)Ui|wd3<1m@N0D$k?fhcFD!K4EIjHBOb2shnwVX24&J272vVn?KDAK6DI##zM zgxCVIv>ylxD{poLEA(inXTlW5@%Sc;p)~`EOsrsHRR0!Eon=ZG5ilAm*+=oybylSL zdq8lJP+QK9iQ*foB-H4naYWl8K}XG4{k!%ZjGL~-x+(sruqY@{NxkK@c<}iW|1nR! zDDq8^Aq;aZaCR5ize2R;oieHnP7y>-A?>!X$ISj_s#WQ@svE`f?Fk@WUQ|rVPpuO9 zl&W9g#iWuIIu+H^ozK4bEfPz9_LWA}Z(wAaF`pL)m=8r+-e#M7Eja%bmEGfTYM_#V z{RB;aM?{dyP}}+W&`mcXan??u(?k{jphTB|NzEYdqPg%Ujs@jK5yvG>9DNTsuf+*d zXUu&<>v%{V^bomAu{J@&0|lZ2`KQuA1=ug*e5O=UhLGOlB`t}%xhm0yLoPrEVFR;z z3aoIa6;_C;NZK4+fbu_apy~CMur5NI_}MrgH%l3bzI2j{gTz7|N2$oeT#d$N@=<@* zpm2J)GdR8ID)pY-I3mw-_L#bNvF`NK(HQ$>a?iTOn+I~>`fR2I-%u&`8?ad9RG}E> zigi<$D5z5YXs6=3zI}G34(HR9UgexX$7XzYQi3g7)pb_O8l6rn`+i^>rEJuR5_CD4 z_E4lBSvN!5M2liN2yHT+5F*n^8JYM@hPgR3K%|QBCU9siQ-fL`cG51#{@|I?E=LM3 zPCi+ZBW$va=}{G#lCt(3m4xrHG}!Zt_JMh^^4{?Kbh?O#aexE^?xqLMrrBR{IVo%Y)Y}!EIk>rPVRha7bh-s2M^g;Q+tEt$A`v^}2t z^MP@=q}f5QL`%)~YrQ4_ip6(tn>T#5`)|y`_5yV5T8}kcQZ+rr@c)b=j+nKpA2SCA z*fegrUYzI`MT}!0Lq5r%xEE66fxkQA-tLfJ@qh946Nl>TB1iITJ-K6kWR<2UEG-_L z6V>X&5)S;`ZbO4ruQ7PIpXOyAVDCy`2~jjKVU#b5S}J}ZG+&l{zr*@wm%p@YjIOxc z(|cuh@NCD2J;QOh_@KROd(;Mv*6%Db`h*3n$~x4WuDaS_+CC|H3>5lsG-x_2R}YHN zP^*wT*fbl&s=Ps1zkM%unaT`3W5iyx0~8r4n8(qnML|lv87TSwkd@lW-8O()hA_Kg zzbhHqxlC0zP@>Ig4=TnZOyzt7t>H$@3%`sE4JO;NPS%hY*BG2%N*3iM8z!2g*Oq<^ z+7!0Dm=rh}^e)P7CE*Dg40+0KH^#EqOR1J6_sCyv7CAQ@tZ33y1w^&n|NZ3bNc4{% z#HYSx$YHi=&kVuga31kl4Lx!SdS$a`KtuBzaFK~L3j@zcI*}YQyNs!Cyq#%%iC3^* zHKFDk$1lbLALHx7D7<^)nyzcAse4c%zL@jzWzS7vV`#&O#D3^6|DZ11Jo##%y-hj0 zA*<@!*c6N=iLqGF)8iY*O^v>*5yK}BbOF(m3RCU{Rreo+r`)ap9&dqJEhO?I~2UB0T=0gh^EEWCIIJF z`i4NwL@;M(cUHQ-y@SS)F@n3~8}CD0SFlWOF<>NWJ|?MMvJeY+vYe%5*^837m!4(` zfUF8F!8Y;bmgCk@?3IjePJM=*LwDvp-g>fROrxg8lVSBJD*JTkb}`(NB~FGHOzrTd zRSxdH0g>t>oY>kkwO5vpPujIq6}VH|W`qJ_UX8SIrOls+970O`nvdZVV#?;OQZH`h zyQLE9hm)rW!;iD zri-?4EL*}RKAvv#zdo)Fjv>0ToOi346tS31mXY41w3VF}HPb`KBfC!|S~-z@q8Chr zXvp%bpUIq}Q&P{O5FoQYRMNcJ2s$NvtZsD;-$S~o&h-B+sNFPN)H?@i2+PGZPZ-g| zpU=X|`9~&z<5LG~q>olSkS83PK(bU>D#QPM-kC{x3k5bvY>`9BuZW`O8c=zVI874J zOYZj`^|(&0E!E(UF%2ZIok@Zny?=F9w5%`VplsL3vbdM<~HuG67USxm+sLskq<=E4B8)J3%6>gLT+uCnjwLHoqZ zf-GuFFNR`IqXZmcO?z1o^>n-%rk?0}80w=mh%In%#*pJEr=UBd@CdOdv;KSuD0lV_ z&32qc2nCOX+FL%3q||*Sn97mji2foR;m^zZ=7g`Ymun$uJbRRYRD+bnl=om~PPuZm z%IUj-FmQhrkUANVdTmleSKFf$Sj)LE?lEK)Da?1g77ZM*fO?6x!#Kq~FlrF%6av_i z8P&$)7DDN|UoOOr?xX??YlHjb}j zE?W%b!qb*&GfAlx`Nra;anw2TiB#A*AdU8VRL5h$LRaUc;-Adx!K#UbE=ld{?$Hw3 zi7g{~nKRl&$K(z#KRD^-@4oQ=8`O}c|$I)Vt*TuqS*z7peOx<3Fl7@w2>I!>Kr6j1;d{R!~GA^i{Us} z4RRN)(F+e3b&CdJwA*R6SizqP39#+JkuNw&rjE#X4C#5Ba9GcQ+k3z2p zOEP#{zt#Q485&Yfh#TcR&%|HFpN)>)xm?c6DJX@2hC)hJ&N`~(xBl#K@1 zdfXmrEc|=8OL69bv1kI>joMoV`RH@rTpj7!rxZ83s=l2FM${Li5vjwbZN@`JEN34L z?s?)iL<>;|_TNGTXr%48iQxiwX~chg9=w z@JR=jKwMAM*K(ck$RJ1J;Cp)z*;xx8mKUagrRN8|hfd}GqaDpC%~6m17cA0?0+rn*Bp+8e4pSOI@|vns=gY3*Y3`%V6EFd_B(2QH zLZv<&x^bf*vsi;a*cp2@=Se^BaZFiqb%3nA*;@~)+u_Vb4Y}AI?kle-rnu1DI`W*0 zL;1#u7AgqrsH8`@tH^WotE|o?dyYzE7Xf8yeiwupU#tDxMVE^UT4w6)I|`>r$KN-MYmyHvSQlQDOJ%KC zeD@3!4q8wC%BpZF!CMQ|P=<>k7s6UHr#rNVN0h6#tjZ#urL@nVj_38~ec$2{-TM|2 zq&8B$PpNs~bM{y4d2h%r)<<2fdKVclsY>N*jvjtbes5vqheu1^-8*Tg(SE`;$6Anj zAQ1DsY?J?BSZ1M^;_t*ijCfw>CO$^AR^xoG7rY{@{IH4~d9Xp0YE*8vXwerA(JWRo zq4lw+fMFo2<{@++FLU|T5NO=BvV7c_3NCi4AxS18@B7r{M8mkpf=tDpwVQ#7JQ=Uq zu?$a$bb-Nk9Yq>{lxpg`&MH!F?$;4G2gzj*ueKRKa=CL6%i-)beS1sq7$_K7qKPOG z4uYqetA=0+AsU!j1cj|K2%2kVvW@wSbg`RDk#Vk7GE26RHT#!jM}ko)A7n4qRTjF#9v3-yx6n!SrViJ7c~uRI!!y1G89h0g zaIH#p@-Ycqd>*b8%;u*np41SpFcHq6d zl7k7VV5iS@23ODrXEp1y`)euJaBa&vBlX`F?6!>6xa4{Fd>TicP!U<^2JI4-QxuqO zu)PN94XIpM{uV>u_Nw3Crp!vQ9D6q+bWaG`Og2oUQzuEKWdfdYZxjBmxty8gvfw$n z3mW|<(i#In`F;>p)IM#;UL39orJcPpNHZC_ovF>52t{USSkh-LeIIK_&>k2al4csQ z%%*1!*3%ZI^j#gSnW7BjF+nLM4M{~r!AtqC8#2ap^lM~iyPoz#^|XU0o^(TBp-zTo zcY`v~n9M5bv*2PKbSU;pGy?KfaqsFfH8_l0#ZlvE`)_2=HDAm{YL!|}CJ#k9IhIh? zH`vfL1cpVkl}G9Jc^7`(eicyMp@}t-cM-kRdYS}!mM0h?(wiM~`M^q|I?`q_$RD1< zAlFvBBV3%V4s$A_p^)00Nt4ECq7SRa*8GHvEJkCJ(U*)5f$)mN_xYc$O1kG79Uyjz z-1shb7vo5|+0`;oxn9J$DlduxpXLn@GM#&57f3BwuD4mugw*2cWy>)PmkXZ~%u2nd z9@bSPUqr+bMjljYRo-h3KTyCp)=?MnC6o%%=7W4HX-j9mii9dMd zFn*m+3uuwFa4GwLarfroY_;v%Xi&7JbVLWDtyWbHEj5ekgleUws4-ea)jSIkQ(I3T zDrQOzt$B=jCaN_HttkkiMN(o+1WAOw^nIS+`~HUG`}XfU_Wq9jZU5vrBrEq?ckXqs z>pHLVJTI@QZn`TzU%{#JHE}?P3C$#oHtP8idhml-6a~c)lhMc%b96=K-;{@WT?lpUsP> zZ>hW(zz}0{mdMw34x;X3Rqj!K4(Q_S3-D@0bWPOl$H>v3fD(_-&<&N!WWrM z!eScpyd`o~t^M&5#KI?GPciVRPh!O*&F^XFYl>_d4tOPZGgDlkO~|yBBp61|XV*E8 zveYwd2-BlXJrZnsKOKc1-QwD3ea^(5pw=Gj#N|o~oxB*Pvh4`2{}M zID)Stz!hC;DxGsQTyh4M_=yUit`{=|Um+`Xw|<6gLmet(wbPij`rG+9;# zeJ?kY@XNYW!(?zk(>vJ`=vABTM z<$!Fk-N9Sdm`}E^UyOTD6N-hd8ApYTN+avCVynZQYqHW$Fn$iPloMxF)dh2wG8Qi7 z<80~mjK*2Td9xU!p0da26yo_YOZzOTg2p#GD}|ZZfq?OAo%Pv_D{!6}dSDNBgiMzUTNxVRJtqOq_Q_)l2`3i<@*x5z&HU?vwS3 z3pXWW@fRI#rA8*qnt(N=ysBGW)t=HW7BiKls9=@-OSAo3wd*2> z8VP|2gw&`WViW3xAznF2LO<}H2zrZZUTRT|Xc>tBV6va1+(w;xJS|_f zri~ZgaIg43IRaSK)Wod3mkj!wchJ|H2JtN?B3uODH$bu9&Xr9B^{E12l{c&9}Uo?2T zWcv;i*Xj)sI)@1dxGQe)BhnQcf5HfE!LhaXS8_k3`4^jN>@yd8^6368(sjJcBi%7E z6s~ye)Paee$ECRk6FN7%HOK|`O%7k!(QCXv@3Kk`z*lnbZ`qy?l}Xw}v_t)b$1XPS z0CI_V`rv9k9Izp>CV}_&Y(hwbwZu`GUXH*gPc+teDmLW;pVqJnOVbEbYKd4$l|cJ? zd(*2cI?dqi*Zzn0CMD=BRv9!CDx(rrM%?L#q1Xg8RzlC)XMEv4GvuJN+R81=XB5qw zj{M+~W0$ys<~S?uBrNt_Gx|z#7qrte{z1YpeN@T4WzmRQo<@M~|Md8CawP(iaXj?0 zN}!3QwTjvPmRhSjC$fA8IUgcGUw3w=-_RvD{q~1^rI~{+9vaya?Sdt7TN+T?ro;9< z7%CU?)gh8a!+Qwe5xQ$nA^nO}^c7U_NB8M}@cvA&ilA7HwIe#KVu2RLDO^Ho!WnA| zR=4a~4Evabxn$%$G5%6{N8`P1KCm1loW;;_XMAM`U>_oi=iN345eZS)~E zMU^fV)qHcH`@SJ!`ySjj%V_6RhymSaywW}YEt>P@OFE>1m_ny&eyW~R2|E4@@mpFW z8%5``8kgP)N9$UB<`xB*2CH38y3A#1AyI{X5N*vJs-DCgRlvi*hPWvQ#0?E%YdJE)zAPXbpN#z z)ZeSIWswLD>PqiCoQ)ITcfT9jvL$-QA?QNm$dj}c7`Mbdwj{MB>0{kSoYsqekUtFi zadRohgC5Zb4>F}k9%%0A^rl@Y;!kn{*lkNe5tbJ(s6pY_T54$`*8ph5&UlIs%n&nJft%5XYF@ydlB&qkvU?sK#Nb{tnPe@DZ-X+!J&B-c ziF8EQZCu0e*2qHI7fe3^J3wZQcro!diQ6_&*euc97P3BnovL43LIwwo$%{h*o9ZY= z>O%hQXBubOJ?89C@84l7hzQ>kEk>#GKIUG4Da2}*EdQeCB&pyvFikv?nCALX^Bq7C zEybTMPntSZ*!z;2M~_q2)1Vb&S6lhq7-u~~&wSa$yigz{c|A8fC1-7TW%!sZi7+ak zlH%>RY)L(fUvnwru1q1d@{NYLQdoZ~wnaENloWjJ66}5G!%K#23)yQh(HZ`WOH&;aU#8HsI z=RILiwaZkVG%rEL))_zuXZU+0N!T9#j*dhbIh;b865hdCwXsL|yt}2U&reJ0+9r$` znF%@YU!Ab02yM{sC=1+XwnSlexIF z7-UBA$mad}<(!q9XL{kp)z!9dsHHla&EgJhPJ=HmD{yy-Xs}X2Dj|jpfZEJJ$&2J=I8T^T>Fis$mN3Ykg}DzM9Irv6;jKS6-Os z*a_mBC+&&L*KwAgLkNm+FGd-REw!DC6x)sspGwE@5U9QXR%#ylHENU2d+9XbY{rz;`#=OsE6V zO~Y5+>C7)~IKM^Pn|?KC-UbY9+-g{^OPtwmBQ6jEvJRd~4fMt$wmE+IMtfqmB9uu9 z_m#xQ%X7gg#vMgwwu9lZ{u*Pl9UB%dC7vtdJGI|&?^6is&z-lHeEA3tkXB8~s={EEyG%a+c^g~`Gi_2fB^R2^EU6L3 zr8!QPtu5<#;DM!Fs1Y#a*yuIoI2v9rDO1TYk=}XJ>V!ODy+6<&9WW!!X|AB!IaaEr%rEdHQm~Pzg6!Vx89h;8W6uX8IQs>O7{ueaew-P zZr#0UVB$T0!Ci0Mv*X?Ryskz-FQ1uVpoV)l_H^A_EADJCqft02P2E8O$N#=6*CzPX zVN-F9z<71OR(PL?pq7Rd)$QRTuIblh)m3I!&Y16rzG=_(}TWpW1Yww=3d@|MS)1{hfI&;$2br0eZsvFaCx1z%Gg?M_ZWw&~u~;tJwyDrM?$A9`#D zwliYsAM9LXxD;$Nq*kJa4?~v)P&d=vJc>JTIZJ}oV8nKrYdMeNY4hoe4S+q%9~x=S zep`1ceng_fCfsnyMcaa_pCZmKZ478E(J2F)bdQvYq}U)^-cwEp(pisnt_Egub$&ARSuIL5RbFdF!`Tw~MTBV=`QFTNXJ$=+!$cABUD~Gu+f@DG z^;Ig}RyAv8rIq=lV{KeW*XrY96evPHZ)Mji;8QH03Fjk37%OTiD1K$i9Q*{@qf-ly znp`z}lm6tye98_TD=W(5vod(>#$^j5mA8el39cRZ>qLl#saFiou&bl7kNFi0Dh2CT zoB4w@e6deNRY^llm>L=spWe6_)OD}>7#m*!uEr@a&F%tJ}- zTIhD&F}rrDuRrw16IM}wsA^z)P?SICliL=g%YnR)NvC=^Pn86AI?pjN5Qv!T42Klp ziR6_#2~H7QqJ4hY&#mxG^h-7!irYSnFr^-Xo@)mZw=<3`v`~bH zytf=Li!`=G9-mq_+{LU1D5hBda2r_PXC(v1c%bX%t#L^X1VItw^KV3`RljB0|F{O53nEzHz&We@{3ui+L4*92ye$!VBeUi z+4S>Rx^7IjZZh?0RdyQ(tt5rgKU-6fzP#6V@A|MV zF0Y&#=c%+)?5(SzC~ghtsHr}!gs>UZoBf;VzUoD_-OfWBC;E@T}L5?;3#cD(E2^a{03&vgrG8}KTj1T=~;?cuw|eJ*cM zS38qRSqGAQ9lbbZRQgd}byEFM{MPkh#=iU8TT%E9z@bTNk@-$C6!B{Ipa(wMA6vC{ z;B;Xj?{Z*+^E}he5<<~zNNWymJtnJq%YM(qWv3cIV=!PNAZ%mi@l z`3n4D{ zG&=ybmURppx6-rae7}1k7aO-6PGf8*Hr0m+pMPRFh|g%z@ZD5loTbMDTEH2~Q1@J- zMFL{BtdJLy4p=*}cCOZ-u!BJO4Bk&TK$}=vR)v*J%Jd*6YjY2pw(~s^SZgJ4D@>wA zCojV$7BCuL$tumS0x5Idn=tE=A-3QwLV6ABQJ=xugdMu3`4RyzxO2JyKCjRou`oKI zaY7h1_i_^0`tNVP#N!la5e$>v^U}kNG34YR02x*&=d@Q{m4d^fHskiR@b#3 zOB@h;Fr8F3Shm>au-X~sHT8DqW|u8Q917R|gq_Dmi__{^r5tiCT2N&%)qz;OdT1;W zmfJi(?oJRbZoa_0MKNKP@{ZCO+*Z9~48bq6r)R)kK73@wEe~>70W3bMKSKa2WEYu& zhj`ziNosf1ObSLWZHo;k`hv4+M5JLcsMckru{*Xj8kBMIKOsCF@x@Gduf>_+;D1yug6fYt%I+im@^ckj7?P z-7YLi#X8{&f17F4EvkLE9!iRJ z^@{~DGK_UBYtCAhr)5-RcYs6jjT8E64T2f%$wFYp(6Yr{n^z6(>6>v2g1E&x`fa7o z)7G~B&6o?8g~(^vGpa=$9IrPI6)yQYMO-L-m>>rlyr{;W3zc^g763qjQSY`jNkI8K zew8hW>he{qg#UePm)(!wz@61vB?`s{QvKeyzvY$I=h;W!wNAr?p}#Y8o*a+ugP_s3 z-XmI3zp(|7z~R4>_y3_A-#;7CwE>aYQ+7H>mp>gT0Z^{wjotGK>1Uk; z0jCQx{gR}eIdQ{yPG`W_D?@DVAZ?mro^7HLFIRR&MMj~RRwNzkS1InTaoFzWp&eHHIZF7jXz>Ykj6Mi(0FuAuy}=F;|&ued5Mb6h4Q&I0mvU|X6F>W zJ8_P{e?B;Tp(@JziY{-X7**wxdq$s2`Tcx@)n94u4Jnu;t=DnMZ@n20>bo5dzeX* z=2{4hQ+u7Vy?gherjwZzOyk=YUf{UU6;Ld<&Y#r5eOAvc)1JMJ)$8GgctSkdKoLWs zdKFqG_q;4IL~3-Fgn@1;V3cEJw9hK~+Aonp7MZBJdrVQl#b0g3c&r?6h|8OE8x zqYnmb2fPQ~3?vNXB!wk}d#kpION_G%V{Zg!hf1Cmsu0m=Ho&gjOCNZ6m#0NO1QNh5 z?bcj*1>h>JE5V#8TU_!NHKSwo~R4|vWWbA|jLv|bMm?f%zIsta9 zaeD4Womb@)*kxM|#sv3&cLBUa>Z#sTae}g~UMeFWPMuJu7Q$GUi-K*=I$d-Uce>;x z;dI%lXWIKYTvYT0kFyvXX!E-eD>`xeyez~uI&f20ogl9V$~m5NiPO-OXrWvYq9CvY34mZEfqg zH%ZiO5An&=OLZJ=qTZxvh4|`tg@o#MB}&VUI~KplK{w7T9cBm74dkNvuKck93Qi>D zIyB3{;NL!#^+yJU$M!X>TPsfvO2<_5zZ|0XkQ}gn8)PGz?ck!Jzz_BtPtD9qwvD6A zQ#Itdg^9m26j|4=7WkT|Ox6 zu2y5@F&kroSU{iNs{bIyuB#zVvzr|{{$$*A{7lm8ePZ73(@%2~UEaHumwU{9LJn0*ZD*3)R$ z5>s{HU?2wg$H7tkPkOAI*PK611emp}{t+N9aoR^n-QL6AA7Y1!PY9SLf10&6cyjzh zp^+e|zzw(=bAV%8L}$a7f6g?ycQ}djznBrTnO*)Q?j#cc0tuWX6%4o6z4Yxl5wvF_ zH)g#tI={O4MYrX{k)V@72npDHIE`-NM}4l~p7Kbt2LZZ3e8dHz8Venta%HFH-3 z>C>_?mk+K>5yL1P#(Z_{)vD9jZdKiA*~(7eZ8z~~Z**#oDwgZl=~mGo$b}(UKE0tD z{1tL1&%L{7??2BmVY06@Pstd|Ln<&FSb0Vf%j zZA^Ha>&3PvhE5-mF1<5`rck#iS#SQ}R6QR~2cqTt)5MR_Xx(-?^%;9b)>{@T$mMUojl~nA`e^ zQ)KAiJjYt!wKvo+q;ww*lS|@@hACMS`a3##nO$D{`V2o5s`VLuiP`+vCFWYzzvytl zvbLr31G}slo|{d`(E?*_>mVQxn!#+ZOoK2FO9R-FOwz8HP=L-GCrv|+-x})!-Nz%D zMEl<6(YYV!Kk*{f#Qi8J>@H>aw?EA8N&t_kSoSt5G?|ry+7ElmPQpKiC6B5JsMkLJnN4 zo4aaJ6_DUOVQ1kT&z*ZAP^fo-%j)NA#E%dN8K}LD=vAQ)(2A+7N4h z3duw?jA?_TnuDHVXKpujGUC!zOqVE|ZFPTo#7~=FFG8+pTs^GMefu0ZODS4C)xGsh z3H$Y({Mg!FZv6%M350pgdC&|oCScTNGb=b%MQJwlu*x56wM+sjn=f*Ge~XxAgd|Jd8N;gj}+#FKpaXQ9g$-8Fm*eIzX4q zO1UCvF*m=zrLrdR#fqSH4D7@o>G|MUo1556ih+m*uzfjKD_gfc^!;TbMrQA3-A5{TO7q{%=Qz6@qH&;P2wlSo zUcYw0RgA1tdY0?3nAJB`P;9j4v*z{Pw^wd_7YAhyeusNK-nq!Bda8%o_~J5*?hWXR z=wGaeZhe-Gp!?oGQedl!?3^!I`iC`PN{R_~pEb z@5;xI7naKpNW~4t$p3WkY6`Cg-8c4!t6)c*FopmUYT&nmIqd$svCzW z86CWALQNRiIvTY_yQI{7rH6DU_w)$1hMc_84d#+Vd2FZiC z?0f3nJ67L>-K)9sTvfxWWLb&tRY!e?rt4F8dVc1xbRcYRLp=cO_6wUk1_xhtZq~+y zo`+B0lsOHAeHu&AoS`u-IyOO|`&TU_`6Ffz_K*W~APepn>D~V_Cn20xrqWwWS?Ra6 zWtz!68^rSUn~i0N)?-3`EFJsYZo&0WlDo(THBc;<=u7*SR-LQNa zasif<BkI{e!;H4RL=4Bp6nQ|B zCG{tI_4)j@NtLn7X7jk~ato+%2rajoa`H|f0?t}aDKtIA2`+arjt%G?IuW!+*TJC% zM1x!bHS{=R&{9UBX5kLuprU1J3Y7j@WOdZ!CHk ze}UrYIcG+%#hxj6~om_eLc@> zaC0xYtct`e;`NU1m$-DrWwEfkmW}D(3Ku}Fo7^ga=@+T+a)V{-zr7cOQ zp9T66=5ptBb@9eWiZ$Kpu6lg>^rd}*j~n34C4)MXMhfXg;G9@jB( zDtX032U^ew)Y&Yxc@gTO@kPu=IDuD%WsP$y0Qc*0SGDe5yPZUlk>KSp!>BnY=D3+I zL&oRK0=}A!TmFu33U{Zg9WrLQE4nhgbk-#T(JI}`_leun*M%pf!{NL{Z}vXJTR+V? zQJY{Z6{?c0z>2Q#)e2izyFM}B%2cNDsn0o_QCx0B@-M~oqUB5K{tPttR>+sO^sESd zqb=2*0dCnwr1;A~A2%4~g{RciNi#YqqA*iG>hhG+1yIEx5V$)5p;QNxUpDo3HsBrQ z#NYBNS3}_JYMCpW(B|{O?R4bZS?8GTf))q6?ErQ75L}$!G28JAq_3$l3!A-Em#Gwq z6kk~N-8?pSekgLEAP|Zze0N}Vx^2VM?>1=%Cqw2|47K!|{Y9W6TBvR7c@z%i7`}LQ zQD`(qtC_5_0Tprb32nvn93<|s9Z>JjCtt;_s`1qRRQbU5 zmc#R#nzjs<(e%xh>2tn>#~TEkB_Vx*W>u#3pp&u`3lT z+U7lPuw&^p%Pw0TvF37z{jt6!IIrNQB=k%PxrHF zJzwM3Ab|YdCvG*t{v&b-}+3#DqjdKcRP#z!5lQI8S+SK-M zvmbQgyid~XRoKbJuQIA%`_2N1sH9WxLao^>~U$vL1~~iUMBGzqgR&7h{G5Q zpCEtAo;vd$tq~H3)QI5MciPlKos$l-{ZjYRZpQpN_}?az>xm}iqyznvD!q!0-qm4{ zi(C+4vyEy%WMQ+GvJPcSWk1MvqMu5Xkb>75LzW z@9IY^cvbTY-l&){ukvs$85i*(c!eob7oP3Q489}Y@#h&iYe11%BztnJQ#daSvvb{J zYq?fiVc@d#=`hEhJ72=@{l)?g-XP%{PiH`#7oR2>5BHykq zCX%NkhVu118rI3@f3?=Vq>J|%;%CD8HCCiA>Hhn~9sq>2^+scD*n}kcKOGLz;gBtv z=o0*u1Ffr_zPG&Q8_*_FF)D?l-XX$22=z zlFl9i6$H4jfk1NSYHxsSkM6xEdJfQ;wnXfgJ{3Z0=+5xpaeLl(o?_j zKoHP5=f5QK0pkIGEuF+uK>%W5@^{0)zg}~)Q>yc7)Z_KoE*sAwxg`Wy~k9G4XeRvlbY+VZgDudqBTfTl~ z2_}V_cs>K*=@I@ba1g*~vtsULyt;lKjTyPX#MB}`A{NwK|L0?(jKf0w4kMd;w z)*)Ld{RY%tH~fJP<)GbZ!0q=uzJt~VwKOGgS_4*f4hk0Pu$7MqD-8giBV+RZm7^KA zX!(uyukZ&6`IQ#$o#>_^_s+>^-7*B6pe2Uu8i|9_`%E718Nc7!TWu}8e+q72zVRuM zw5u3$@Fo5woe|tlsLp7y0*G_k`XACSg3ePZ$8|q=nnG4TQr}B*S!IcMCaZVr7f>13 z(@|m%-kXM40N+*ttm~puML?#cMkPU0{=Q>-NiM3-cc#CQk`i9TD8yFBD#TUCDYU6o znpff_AUfX#e!bv2ctzO!z~>~|)>`UIq%kAz%{5a{&XM)`W3F$h**5TT?s6~vcc2Kz zOpf!Hf%2`yFg&%o(#Bt;l%-@WwF{tP{@bf`5_ZyO@{!}Qix+b|W32B)zAppTjZqXY zA`(f}@xZ0lq-fClu6isCL9r>MzV|TJg7MQsS9t8@>{ab=+3VUH*qd?HobTaa(=>BE z4?v-)_Ft&RS#a=LaQJouY=NHR1_WO%w}lrhE7#JW_gv^mDu+lg_xE@aNV7?Cx;YpSo>z#VBh%*PnUjYaIFuyMH_rb3a?WQ8scRt7Fmhso7 zG#6EM#%jO((n-<9QNRT4yOL|c(E-p1ro%ln1VF>;NVk(xUdwQQKJD0ckK1aZjR{Hz%v-ZJj&uBC&dJnGEs%l=FlialL=iW*8=r`Q04SjBROy zRG=^T{$M}vaj?bF3B1p$)Qc7QzS!g&C}Nj_3FX+n$;Oscd>&LWA+p23_2wIBcWB2 zbZMWIn2;#Ct6xh1qYVxGp4K#NY5bW3Fq3JBLZ_FkfdliKlb}m7%Y_5c-m!YPWl70! zT~%omS}4;oTNqx!u9kh`pD-#!S>ew_qS*Kg=gX6;#-kT{L1G$jgl^Y97uZq$M zsrLt0@gzLXRZajtS8^v!F z0x|LCOo;rPr#0}%LoXDa2Ov(hzA>JYL2os~+F#e5kja_3Q<;L6j_MJl=zuQj^lKP? zZ(KDZ8?(J$t~8(zo;n+Jc(9vYiUy%lx*Pc;<*6}TM@R0_4EO)?RS0AbvNol1&1w#g zZXsr=I(RWQp(?Nm09sBxr9*T~D!>k)ay~Z@p(|Hh+6~ z=-S-!v+GJ#1_0{8)xx;CdWf1NY{!JtcZI2=ireMh7j@vL6p%msJr?HP)JQ(J##`Q|k}Up~So3t`p+_k>a-TwAAuY8Lc&ZdcO9et@>oe z1QUwsL~~i=@rfmMmu2D?nQmnI{eW|BUsvQ zO2mSyV`|bco?Rf~`7QgQh8~rMASkE07~dVfnC(tn`WC-&?f(!cO|bp4=s955^@=)M zH_f;1@XjebI6}Uu7NI}>R=?=>M~TS;#T(KLw|{?lc+jCEYG& zV~e(kQ#DXy8}y5|)UKI=94eB3P4V29b`O4p;)l-AOw)M3V$#>xyZ6%r4&LWjj9JkA zw9PCC(BJ2-aDiXvpr!5qS*Y0Sme=0|dw{Z-3TQ@#GW@zR#pS?$rSc_twpSaK29QaW zC)1?ZYsb4!*0p@y;m{e!Hs-A_H8S~<)KF3szbF<>%1$KdSF#HcJ`RfDtH00Jl0`+b zUP4yPKAHnyAp<_%<5-)%5f^M5z+IL+&V^p^+6}~$7G}0p$4K*obd%g4f#VhZ7Iy-< z%V-|7WkHFd)Gw{1g-HenpCjGA-z~!ZlQ)NSK#ijtO=7ozThyrO-@(aHfuOR5TtzkE zGjD@IyGN1&h^y-A=|N?PZ*4AkTHL#SgNZO~kNVgkcv;Pa^s(E2fBECjnMyLTla`5v zCxgmjJPlQJM6)tV8_Up_!C`j(?00MFH+N){;2$akFM|gCz88kD!&gNQwCu0@mS7cj ze1-0&> zOX$_lZ)zj=`7;tKRDVVH^$P^qyPz(^&PK(os7`t(N+mj{*Y_G)h0 z4a<#93`dsB`CrdSWQkz14gG^U(Smn(Ir zjI1<_vdaxM{SkQb+2>Z$lhSEzZnj6#b19&2_1X> ztzPUmjA7$*(F3`f%;%igrpD!=%0?sAu-H!c;vd7%-+<+GjwHS&qu3sgA}pMU&> z>fe=++)lNb=Mb{Q9IL`K)XKo+>jhRKiV>jp;YSkMCswMD293@C6;saq3#Jp*phGES zN2jiB(qye~78(C4U!sz=S0924`k(6sX%Yk@Q& z+Bwdbzt32Qz6@7`pHZivvNbF<%B9LXO0BJQMd&5uQ4M(IB(06}Vc=gS>eU^N`*tFG zg$1iSYP%CUR4sl)J|q4>-HZbD{1lIx&imSwUphcxTo-SBhNU-j7UZF_b4bQ)P3{+@ z^P51>BTY_40MWYp&vD7oDy+34=);dsj|w z(dDg;vs^*2w@V$~$&ajFx%a;2_t1vZcQ_y3rqq{kOPLX?B{UvX2-kv=fmm?(bKOhx ze}S5=x`*kAP~$)AZI|ByJil`Wst4L99-M&zKNFI2hm)sZx>cS{DCOn``8YlwO7|ar zR3>e@fQ_aDO(*6zzif#Pdk3yx`pN!6;X|P}kPuKm{|iPYmR^=1Qy&XE9hHty^IFJV zK4QgH*Q50pwxmD)cs!y1d%qSi7N6Kx(5;Ssml9u4&cW(9%fcNTwC4HelQpT^y}6cl zOjkB})xR=6w@nM5BssM7UD;DlJpaiVi48_g1p94~VRB(B%{`NEW5PLe=HCAenVszI zORW6-+#b})ok{U}r{LI8Vt}6u2(e;(>^lvh~%lNSIC%JF;9 z^*!2v;3y^TOTmMGCI&!{9AnX}x`+FZ=I)mH%rE z4}y+3o*A=|9uI6>+x7N<*EwSyU%`R1=>M9#E10c3y?36D z2Z$j=FX?tTD}+22&4+8jQANP>eQP|QKnA; zvw7toU}N3rrXcC8>__P>-C(|c?z;=&egV-d>3MI%M>bckHK4<(Du-hznqjq;yp35@ zx4?IZxgN?&Sai!BnyI#G!UZnN7`X6p<%c9ilZ*4O$~(z)NNA;b>&WLFKZ}}1W0Rqs z+xy$af@R{lb#OAjanUybwFY3k)rN1WC_RK#`oFuO^<($XeV_>k6Io*Y^$Od;VJc1J zCB3nOPO4lBU%fB!Rbefa}#LX=S{by)6tX$wuCH(I@7O_)(i^$Ix5NZGR z;y*E?-djC)8d8789(M|kw9RN4_#A&Y!UP2-9_2Aifqp0iwd^6@q9?b`u!yn55>*$)z`f4aL;2~+ zz#^B!0PWXWPdyR%C*y6Pn%7w?ftx*~diw5BkSqAzcQCw5gMEfWknV#SqCS|}XLT?5 zt^UJoo2hs?p4!J$njcne2=HhncT+5F+~AMsyiQR=I%{te8=Yi<6Y%EiGXzcV;by%+ zmBiEM(=6Zd(9u*aU?(&J$XcgnIypE_czr~3u)mwWu^%)G#oksa6&>f;XPK5>LhnP& zX@<8$RN1BVR8|I1bDq!!?QuxnBa%!y`Z{?GZ8n_ppu*VX6%XjOlT#f9rs?h_lBhfG ze2ZNc|Jq}?uf6VIOTiwB`2Q3*#c4GRz|Kam{`<%jr&avkkwO10Sc>h*i9Hsa=>G(h z0vUY)atE~7T(O`Dic>@1G!XQEIf{nBO_%(p{?53^1sC^_^c)nEn7 zy@<*>CM1$S@f&(K623}$>V5H6)^{-=3<^>W2kb3L1@Ir{ucPy2GSlBM&#ljf50y1} zZ)ru>d_Stj7Q6E^`2IWCy-u){v~Xh^%;QClIzAY7u!T3y#VUL@GG===GfFE}Hx!dE zu4r|g$W5Lnhb!d8+mCiM*nETM!_mon>L&!GRx^yW!GHK9T>bDjHFA%HInn(uJNI9Z z&c_oaUMk2(F4xkhMqHlr$M+>AoJCD0W5kpWvCCSUtb!r}O|!R-#a(^!=#TOeuzhn` zXTO1hYDQLe4b2`(ctrJl)1z2w$REgZ*jxVfyK^|fdmI@1T$#~G1^_oX)$nnQ%1Zsr zFzQx2bJBC_Wr5pbKgQ8Hk0|K>Q1W+ZctLRVH}YC6AW;(+cy!@~yKu0_3DRZYUi(II zh%2^?W0HZgTu(5l_nB!6N_5!e=u+z4Vq--4giyEiRn;Y0sVo|>;KAU_n$qiJ&?md(4`BkDCmpl+wP7u#vl3y3 z{}G@0=mjJHG3%$L@h)90Uk0b?E_{r%G+ScbT7^AAx2bbw%~TKK9?W}l<8?8uCQ0?(>3u%WDD`u!IBL=$zP+)>LFe0DoKMl|OiAa-23KXH7d zYG$XZbSW1rWq9h^Fby|8l^~6B5w}SpJ*THk%p9C}Y{^Ltk#$AuWhQ>o6llo$(J zRX4R!^RNi}PL+il>%#C?2o8>@|5x}+X*oq^SSFhjO?wOYl|_2Fs@^TtX#YmE!vCtY zt$+E8G*-E7+5roE%oehkoYSml-;mZ-?L)S~$?1UFWzZuvJtGsla1}p-cfPsVe1=v` ze`&uX=BGh!)8wpnNjooMQ9A6+k=yfNvuUuiU zCv{}QIiZ8}8q_N!pavS8`Zb_K;d}DuEWNKlHFHYK-lQkkNLVd9^ii(d#5Fs=a8TucuRX%X?X!=WSnQuHe`Ba?hxj+k;F{cVBGnD_WEyGJT zBPz!X26M>n@e(~dT(z9VsvOpg;*>k5gE7xFI{M+@W5AIqPc3c(;4oBRqv?pFAg^1{+&M$=my*Ry!O>vsV_n^53`90qNPmD^h_)UF_ zI5M|c%{GB;P&BpBazsrOXu4AWR;~Mq7h~YF5~4ZyBQL$}jq^9tqg>?{q2mic$Lxkb zhwW%f4m*)H>I5NPsPa2T+Z!YG8(8kDwcWht!e1g|%k_m@afqkSnpq>-;OX!~VOp;L z@sf}M-vN?-v`Z#B^dL^b1hAcuKa3^kGZ^`vO1Ol2wf0pdSAcFq20l> zfaS{!)jx{U3w(w9VydBmka{2&UQrG^Lf8K1Z zRgv{k{b>7cPtlvZGUX16A7v)KTz^#6oVr34mR+vbB}pED$Ztx_X`>rHEqgU=4)$6X zHtH2RXa};4v5F-}Sd?1+M6lOVay1HOoM?bEsfR&j1nvDKYF4(#ftF^M1XO`$=8=Ut z>o-=pwVKSGWVmmQ92pGgtfudLlAjD^4pt&^*9~?gwWkCqhj@SeZ=l)`+Gzh;()o)D zu3m=F7*=}%A~M6UB4*q`v56?RSLBh_aCCS{KO8gne9)UmM7h@JWkK!IDW&(A`%Vp-|o8l&l$QG`HZ-oxu!Ek93v1nB+!hCbH-XDw)Uj z>r%{(*CndV`euok_3=Az9KvS#VYmi@{SCZ;6I zSjskbiWxD+HntgN=Jy%ZbGy&)`Q7J!@9#dZ-|zg%Im|idGv|EX>*q6+HTnnE9e5`+~5zJ#u!v5d_rGh7E($*FL>G+<(;VlMuye)!b>acvbvNJ0!Jl(XjQlU^NQ zSG_}hT$v{ssysP-Hz(4ev!*mUnq#9uZLX33=BtiBu`s-A4WG=8V#0hoZ~|>e5wgF} z4w5{xRr=zQTM#+1#`nbDk^x`;+XI_I%e^vhH@82^6J!oIJn$a(xl+TbdqK^WT_wi^ zCKt13S@|1z@%ZkydU)t#qTfUc{ROPzGPC}dUYB_KhDq+k6zyJ}*_51A;3tv~dHLPO zLrTN|rH%J+A-Bcli*Flcn-;3piTeL){n+o&#^mrB#>p#NOweDP&0sQ0TcWGyswg?| zr8xL1xmFNz@KQ3oZY|`07eo?_cFo+$Tj%|rKoQrzHRfQh@Q0vsUU zC=W32<%qJvrB!=E>Gc+pn66!(0vtu!)^cKBh*LMDy-_OT-dYfwvFBeHABG<1K8o^k zv#J0q=`xsdi1S5#@DmSt@eP4L&!TtI9~b$2N?7jpUmhOfXm+8{kyVK@1&ge%=P&@A?T;621WU2v&=XRd ze!sQ0=v=Gb1h6b;`*(HpD?l3j?x%+OzxhXh+Q7l>p8z!czYJQrq`uK*2caoINE{;5 zM|8_T{|fBksqrR>6|@){5;D8LpMUf9Y!V zbHGqoNn2nK34l0Fv6ssQkB!oDUJK)IK_Vy{__gr-f0QB;wD|PxsRU*7uk0&Z_9%3r zUaTZRH90sU@=5ul#KJeTT#%6!AaF%T4nkR=a4o;8?q8e*@;8T~F)UG=MiE*u{d94Y zs^kI6vQP64#@v9sAWOBO$?E>mxD;xtptFrj-O9R@uL;?2Hj=$f2K?@p-eOP71yNDG zJ8)C}#)58BEAgO%kAXi!0FbFtKprqwvydtKC_dcYHf}nhlWc-u#`EUy{|mV97ht1G zKehA#)-2rdTEE^ckhYc_M$z0hpPny~UhxUbIma9m2Q`Du%-0RA`l zhNKJ)Mi8Yz8(z(`{$u1fE{+{@Vw7`gpEGBMD1)y>wUsj~^^UB$lBqna83v`X?BXd}v=g+rW)%R83cD|iHe=294|D5HZC|O>mX`VL2 zRw4iDv}g^-e0ET&%^B$vYZ#xNw%vDt=3H=!YETllfSK^Vz7G_^V7{Unyww=i27RrO z9$9F$N~73)e(cAzq;quI706O)!trGKvziBn5AK_|kp9a=EygqekdP(W7Pm zxMX7-KT6WI^HwAb(ey*D2Y&=ObovLB42yCIr3ZTw-P%p1$eZM@)Wjamt1I}Z>8@dz zV!1a#?s@UHX~?z@p1&hdtZnRVMuL@p)&y@cNHP(JF7Mc(#c+zR8E1G^lvOEJ9bHZ? zuGq9_u5e!mRx}C`RUE{ZZ{3j=S!Z{>JZOC8?!>-x>uv{;VW->8Qie@02^U@&NiF6A z9nYVA(qTo?Bc=L`IVj6r;OX3uT_Y*@?X}buG?RthDZ2AqIHpuL#|jV6aE~KhMDM5S zf%ME%o-SLjfSJqaLqO~NkbJD>JNP}yX1y;x*kHn3XuS$MHQIY!lR;80QZjsN0upr% z6vZtAn%%3UQ$vg|i79;+hz!9B8ae+hATB5kW{U|kNJ1{}Oh+gNyi~4f8_8w#h6_HP zp(Uj9I8qfi$F0tG&+poy-Hxp$BYGBEIe>IC&s`Bzh3=TP6I^?HTPDrR3|4gTM1pRr z45+;bOCz@TrvdrtgL~62$Y{?n67sL^B(XWl*~TW#Hg`JYBpk zlLWru^`Y76Jk257g`&sGj%PFyL_JC*ZvS{F5eAZGz4eLS(NRuSr3Y(D`CE0jjF}JYJ=)aDU2L2M46HL_oIDwAqeukw!_XS~oIv3IR!{`=~%zHnO^am+0cj%$m6ThO^K`{)Qh z&U6b^ktB_%X$jsw+k=+TtQnDj=T|e+M=Hq(l27dLuZPin^GqXS@uJxsIWWJniE&E! zxx*PJEIQhX(dM3TW33WF0&d>Z1$f`NuJjQ{BYUp>g1PiYW~qKba3y3BaG&$iJDT9? zy%q?L1>h9~St>CaC9_m6G$*nsTor@P(~<{XL~da<70hy3)YQY4V|^?_tAUZV$R+n( z2pAe$!BmBtV?exem)Nwp{29##|*ca1)r}%Hj z{3lg-^~yom6;U_f>DzAy1=J3`Ib8bywJo66Hv)+SZ$HxyD#0r$?Yk-u6l^VRDT_*K zkQ6wZEUeoW|0_VsG5Yty?3(;+fEMflTF3_A5hUe71bbUwUEcayJwzfWxyvhu?IlV4 zoR1&*`Y)3~Z61UxY>boj-BGb5gOVKk7uAL5738_S=?Vcn306U&e@Z6&Lo58BGtB>U zufHle_H6Q}`!$QusA`Jjg^HDKj6$i_p_*WNSJvm?9bj6IKS~z$e}X62O#JHo=GgPH5W3~qT`pV%`qg@1+#w+>)+hqoUVX3{MO>qUU6^xmagG=9rZXT;?e0y31 z*yBGA^sbWgqa~TguIsIwZ+1GShoGk%$1E#x5KikoJ-_7|Kl_PF8gkF%kfRA2A?M=E z<|bQgP3XMD6*IS5OZ+6zp*u0OC0_kwx72(Y?nVGi@l4`qxrGBO1sQ%s+Wn%AU8l**8fc6i3HV4g(b2zx>WqK?5$CsE! z?-7VqQ<^=Vwm0sF*4n{MMsfr;k6x_3ajJ_f(0IDEPFgny*%R4-4aDb(d7=UeV+#`spBJVA?>+Sv_F6yTjjE7P zA-7^Ulp} z_=xbR-sToIMfaf|ZrA~f2CfXZ2Bs-DwDuuDdN()}Rr#j9sAS>y6RO|bD=i(^p*OvC z|4kwF7^9RQ+6tD%vk0iQ7zq_$3`bKNVy7O;>s7cn`3#GuH>%;NvWe-b(?l$@|(M8<{{RRKNoWl2LWm}x~K*BcS-8fMbP?^e9UpPv2L>q?}ykeKzw9h zXH~K(lUE~ffz`YJz4D3`9(}U|0w+;?YGsIQ1%|lgf;UsCUi4_Fc$x9Ouvi+3@YA%c zNl@Bmky#&yp<6s_Y0eMwFrjFO9}1o8WmN}7*gHCw;kCr=pAbn3eD7=7ofua|O^m}% z%!AJ{p{{<50Vw+t#-D5P!1fxCPn!!stzS$PWDmLKzMH>9Jl@(_ujBFfdXV2{w5W8) zCbAv^#qYliq z4M7)dvrY}kEr#N`v z_e@mw>yp(k?x8Ew{kk)_F$k z;BtQw(|D+E8{davE)ipmj_UapLshyivyCZRS#c4Fu`0fAJ)=35Am!JD@qxA*U_}6( z*Cx}h8U$PVv8>(H6)HQiCLDWqaW>JLJ{HD_B~)xDUwssLtzM1K<7jCJo`a@m5v$zOy36#Rk^8NK)Cg?6#F7(?nPDLPV3dWf90 z^A`bqqg_TDOFZ-fzuwQsY}c4Xwmgy4cE|L388f7NF`0$SxZz!_ocFF*M<0>nZ(Sy; zo2HjK_M$A2n)H2#d~xT=T6uL5hda%IQ7nt0z(?n6Xu&&`jYgAUj``c!9Ry`q(Pv#N zcXB{5W6sT{F=)t(;+daa5<$10Qf=I0Ev^gN4tSn7a*Y}!wW4;;d7kcQp43gVU8K^e zHzj~J{w`|HOBN{xJXZ%P20x|NZ>-$eBK2bvC?af{r=UWdmv~_=*t)di0nM|8sOCCE ztRUygeo@dq{{e|@?-4VVO?{DPt?FmCEnW3Qd9%mU$_`3Q9VKePpvh9#Nt7m&xA#)f}GZDeaH2pHF#K|5~HLPA&}djU%-^q%YKb6fe}ATp4FuIdbRt^-+YSe zmw*hwx)c(5?bfjX7+{{l#VsMnA2tP#anPsC}?amx?tJ zfhaY2#Rf~yXVeiA8`WSrFhxKtzw7Y~yVhK;64Ny_^n>6@2R?sh@4`E6<((&(A17lL zFtdcTvh)N0hiZ-M1h0zdJpS*o&Q?JVR9d;h%iX)m%`XuzI2M;h9W)bt02)e!J`#=U z6oQfFIZn|zrEHq}Yz0-nH1HE~-wM+~pHVPcDC-0A<|VDXSGU{e?Dp7xm^1DB%9vTY zPl|GgNPc90t=+mT_g0&6$4#%&*6#ksnMGV1F-^GX9k<1pg}-}2=YugeEhJ?`G(nqt zYl^{MLN-I;xNy9fb_)#_*6+tMgj;>y>EyfV7WvXhmaY~_bORy3D@ zU&uUVubiO+d);qK8`P+>tFtg#+jGJyTF_llem8VP;CB}XEFAH1xD1bsU(`fuELzto zXnDN3Xha^)BNUzUbog>_T_Yv*@)0Iu`^yzsdmx2Cqhy&7%Od7ET*uai`(t(mCy94+ z2+)g}eq zI%WO_0wr{3@V|)r66e*m^41P_r&oxFTPrJVN*jwinQOCb2O^*YX^FC?v$8+l>@eL!s;71D&c ziyiX}kDD+G*3DYI*3sJo3Y?uS*6c<{eroJleHDJv3-JkqC&M%tfg1!LOC?=FSfNLC zbSDp8lawM_YcAMs5&Y_ziswhZD}Nohd_!IFmNeh$uG~`&b6(Hd%&Ny;G3FKgY6=pa z)&-_NJIB1Co+X}4#&$3IT^_jN9%_&3yW(@9LQZ}FW0xX0wHH?<@jWfgbmla!@TeH> zs?8H~Klu-5vrCacL06eAz?*p&!nkp&V!mRA=a1CcxuJ);(^@!`(otIHxoCs>C-z4U zKrf;cbFDovGj;~gb2n-IB%p(~pIoeh0PmWkJ)-O<wLq&A_9PcI{h^4m-++ zn_|j7y8hQ=0wQA|Cg9@BaCzm_jG!%s5iKRaIt(IQF&IuQ8n-wbN zqFq^xDx}s|cJ(i7Q45tO15FEb0b!I*8tv&Cc-)e`sos_EmX@3u<(yp7ySeKd{cX+F zKKQ;~&af*l^j$71dsf!e!u0YgJI=#-Bc}z(qk=Mg?`jvy z&kLPXqwmfm*cC|m?dItj`frQu0n$TnR6k9AVf@^0_Dn8lVO)MG(WoNnwzw2TV^-Y^ z&B0a;2-0FXjc3vDVud1~6>q}r^Utz`wycudl`kY)%na~6LAQ$(QsRxMxQ}|v!%^A^ zULer6;hq3Oy2vp+q*+7U^!}0_mZ#BoEcwFinKJ6quLY{NWnwmzXyvB5_jM8X2JeB~ z@YydNXt+hV_kq+y-94$B{a;clbklqLch5c=^XM|H@LLBwAD+%Ib=J+-V#{~0Vyfb_ z?@3QJ(xN>fM(zNxu0JYB&+PS8x7bkZ|Jm=PL1W=P=A0WhnKN6nDy5$H6K0`$(qJFLGAF?`)5>A~M3!k;_-+kgF2JsPaHQ|5^=GLQkx^g+J^en~NgKC1Ag_$istW@AH94&zwV%f`;Iy_WAZ|dZBnm2OA@NW_|>W7HL zg;p|?OgHp@Hr)1>8>~>pX`FyQ0bWWCH};|qpRhuxm8K`LquG0KRe8DPlVw%U&>jj& zUnBpSi{?o9Zfn6JQkHr#itPTU!Ca~<4AzVea3lFyhKMg$O$k(%t>i9NT}yN|D$@L2 zH%EgsM4Rt%iia&s9Eta1!xeeH@pObEbsC|Gi%G0)v~Ih+0Ms2o)j<&rpoB+SBzwSb zq*6`~GnEuO=Qq27Q^k?CH=dQpX1yRM`obF4%Ho9jyTG|Xv+_jf@tu(bRD)ad37ZhO zS`&vxEVOEUut~BZ-l;;Q|I^BD3JX72(acyo2rwTuu`$2jq8z&qCUUM1*o6P5J-?hj gj=yr?B@r4MCd1y$>v}t6#pR%RR`*QqX^VUR3skOm{r~^~ literal 45286 zcmce-cT`hN^e(I*(xfZB2nZ;>cZh<5NK=sBK|nw{p+ltCP^C(dBE5+88hRI$-a~JJ zgiZ(~`S5+;-@V`Z)?MrV_x+LN%w(TA`|O$7v-dO4M7`BeCLy9Hx^w3aiOTDjT6gZ? zGTym!w}9aOZB5ZVs-WASyY5=b3U{i;824@q_iSINzqoU!CZ71l0`Im==W$u!Qm0TY#cxCc9~PY40|%{ zhu!ho9z8g)5l8%rK@8*w@1WC%#;(Q?SsCdg0ub3d3Iwd7;DuOu zJ0P9(&kf`X^ud(^mN$VAYDW27vVDDJ-GM$uXCdW(+A9=0wu6^%M<(oA-8LI=ePP$- z+V@EBITLJfe^>NFs1(~jVwF)=3^SSR3i_wpJ4W9&j|m~>k1eD zEBil&n8=i@w=R%kdxDxnv27o%^%%N%94t_pY#s~(#Zt6XL8NLdDPOuXL}35q`Jl{_{eV9j!%&Tk%!St*4?VZ*!W^I zdj+`!Pxyg;K&H*hQAbP9a$*fA(^yaNwPH1-)Yszh*-U2bSr&zd!+*}y;64dFHVdJ>Y#S~3|&wK>d9seY_f!^!PBDXTWYR}G*jAxQ4^vkTqJw<=kQ>u86;nIt; z~Swujw?m>{y2#lEWBU>c%GM3BJMu04 zKoqamV-F7KW-YV!YtffaK+fvNjVWmcSfLb1K^Q=2N4eQ7pijo6-I#|V#@+-7Y8{^T zcMJ@U=(uD(`2?cE^4B{lu@*IB+RMr@%H)Aer) zv>gdB^1z-(?D;#7s%*oi1X#oPmN(yN3@vqP5i5LiC>h1fb7@%ZE#S2(z%C@c{fJS< zQ>~RruY;v6P|ifAw*=c(6+&;aqUk!MdD^y7=6Y!PcBB3Yn)WIUmmga&hnXUsF0M~s zDz`@!d765EFDQsft*vhEf5a%H1G)h=DeG&uR0p1yqf{d_<<7s@wiRmwL~&b9KGVUv zIq!beu=K;m2);cRd(xI+-0FE~jPcx`6%y_6bj{=MXXjmj127u^L8m22SqyR`=Qz>$ zwb3;A>>Pii2Ayjyxk~D6HMZv-3TagGA}QgTa8|Hto)M*+3Gi zfXlT$8ncRmT_hs|wEa#a`Z4w8CmA~FH4iYb*DprTdur_6vdPh9sfaMj?DL^=CdMMp z^Br??Xz0BFOd792Fd5+Hw}^U^Or4(yoGxVz=@)R>I_T2p*X+3us6NWfMqQW16HL#` zb}ws`CXv6Rgge{pgy~63w|tbk&eR5}=G_&O5~yhM+>ci?{)qAv;#Nb?8DPeLe1gmO zs*AxjSz5cv%neMRDeX!EjXjvfZ-z9CVo5YIST^p;KvZmJb+Q@ceCw#0H07@fZT*`j z1606$?M9kS`?`nza-R`T8hUgeRf8f=qD{~)jXo?&A3))!(eHD&Q!O({CC~|i#bnn< z&vQ%yLpxNMbhtmg6Su}??#6we_^FHi ztjIVl27&E|VlE`miCop9I>zrfa#Z7VsD8clmpc^IZQUo#nS4E)=;bYF_7M^Ss$Scm zQG+p`a_TLle-j|bp zv1RTJyZUY3LZnR6n;HFw!cMI;F-j|;)(F2|XC$Gel@*`Yr0}F}jdKaMOnrlbACnmK zja%D72j&NwS8uYLzt7t`v>AntI%S|>rzX8NL`5+<4~zLg{4Y5_wOo%#Lrdy0By67Hq`{YSCx!XH=UGUoIjizFd8n8b*^@mKcJsxme?0BX(;o62S&SJe>Xc_ z;Mf)R1V_KyK}3>*Hpsf%y)5Ugo61)s;knt>(z6B1WbIuaPq%;N9Or4|Jn;!FZwr(RcoQdM50KQ-8KOv~joQ?UoZN z;!VK@e-Ddg+=k}9Z>cM9;YyEgZlDOS)|K*6F(`}W#;=2m;xOFj=5YAx=?~O5kaAhO zxFU%70Lql|0?RX7dF`cAH53T?fzf5pzVu{>Uxzz&$wKICQgo83{v_t)#6hrVM9%RV z96TG(&Zh$ol4i~+s|v|3GFev`D?OJm>GKI&yqa=8Y)g{dS*Yp%p6M4E8z!>NRi4A; z#Z>PGhjK|Fgqq4B&0HlgtQ2~&bj+-E@bX^v%(;x;dYe3&^YKPYQu30EQ zY?r_vr_yJzcq3O>JoLx{)a(7dG*AuJX%pm^~2@QVY7En21Mf7{DOq5AvPcF7RS%oDe z)@c2+7kAD0n9MUe`6!s@U8go#QUI;}_iM|fFL@IOav^*|#V#Ws0Me0uXYOqV{?z#D zKGV$`1MwSw{T-ufgkGjgF@~(efnV4$_62-lTu4yt1>VS=;rNEaTBidcp_IXZVkV4t zOmFMRyW^^k-Y;2rN*tDNqM35Py;PTxHF`^EwvOk0im+}1g)q^C1VoING4#_7;!eZ3mU~;R!sjBwg zlBdZ>=oD6J;Dy({%ddf+>1`~k>QXOk7q)IVk!mbPDE&I^{6!4IVQ4Joux88U`xr|F z*HVUWHU#^6%Pf>fKo4R;ma+?d=!H3Q@Ck>tJS@ftbk{%QmxUar!Dhr}hOaQ?wUpFc z2@W?oJ0|_=CIfT=_pVJC8l9G<(MfTwh>k@O`6;F@Xro83qo>)Xv`f8e77B0XPGtOAi_DL#fTzel@KI6W3kGBif@RpfV+si>Kh%b{AXnxHo(7 zRrG|bw5@*n;b#VH-TQ3j5yaOM;!%BMG?2;gk>TD2U!R~h^cV5;c$>eJ!9epw=+*aZ zkr|BU54kc3B)x{bdNb2QByerY;c9jrB)mC?4}Bh$V`&mE&+ZMOyn>4 ze}`B3>}o+%t8G8l54sg6%gL#1)=gYbJl^1y2~yea0K54h(pvQ;{coC3tjlOMA`KaM z3`(Ufm%75RXA$TXlZEn`76VJ((jvgnV^ki|n}%biWZK^%_Z*_qrZ+ZS~}u zy0_tv?9RQ{Jh>3K7sCUdgjkqO1<;=h0Ql3NP)S}Qn`?M*)y*2rXvr2 z$d}^9{EhBmuWR+3qn1kdd1jFBU_hMK(IS0L!otq(gsQ-F{%;=jrsRfui}p+5n#b+w zr^kK!3ql8MH-cD6w?(Ed7E>vf0=2~~S3ao_iDUr+zhINrK$WjfZHGS-M2ivXKTbwK z@RLsvI+@}JtxWJbPPLP{0McgCC7-F96GEJu%3Si?Q9c<6qJKG85ZTy>Kwb5cL zv|m-ex{X^6b9z#K#vPK}U>|sFWRb+hZM9ZNIKENEwWQJ{qv7V00wvUD(H=;)I$BoQ zM;NPz1AQkoTHB6%86i9M&ouV6vGak&vO_yWWU34`%;&9_;r6Fm{)K@tH}>mvYE(n> zmR2X5L%z+o9*DegO_G}X*t<41#8bH*izuoxU)+TL_B5=b@*lEIc}_$^RwOoSyYFg( z`2o=}+@QQ2*M`cWr<-m)2$Iy}{w58bbsala2woSIDC!+{-tN2lFiVbJgi2Q32$Su? zGc3mC%?}a{nX;h*bQLnv+IuPH;3u1u6qd#RD2SS&UK;Bp;V*BB%~R|BuKwl@FMn@_ zh;6VF#wA6g-T3Nx9$DVtN%hnTaQT{q+Ij1+D9vq%B2iom(8~Ya| zbIC#$1qQktxM{0P%Ro46{2hv+-+Ku=k>x4qsce;BF8j1Lu~;Vs=+ zGW@dHUh=>(en6Do!ExY*WRAx`#Lk~UF~VI>YAix5-nFE^{d7#m@KY?ENWVyjE*u>4 z5xXOToZS2X%qeqF#(^^f?^p9m$MF?(d|vZxLTNHRRw7O+Kq3-g6`ts%)AMa8fFwsC zO&d$|2f>UL;Ot+;S_ee3$zZ^m$5_le8x^Ngv*!}KlJPfj z0NEK1M*I(H6>$VX@_ok=QD3RGJiXJUr_S-A3D4`kvU#Fp9>s!m~@j~ zIh@@Z0y3al-xn^NZ31ZwW&;X+V_{+|5hB{t2x#lH*`;zE;|mLmJa+N6iO|+_L{2YR zanb5%Ek75q-F~dGoNt2WdhW0zeNH~zGz&#SyM_vw(ooMCAB|ERm3j2E49>i+6EWap z|KQfa?^f^Sy!FR{9ZJq3Kq(!q**7%Xdibn?SB(q8U)-TFZR?I)3LC3kA-8?`h6+9d z^~!Zni+Nl3N~5-A+uzRH9ffEEDFTxQ?ZV?RtT}B%CRK+XV?P8pra;d8Mu^xKe4rC^<3C&08_D`CM<#Ux4|B?{tin!ujqfR&xMm8TQQqvGkRrpDb-M}z=q@?eG+6@o z>kfIw(~KzKbo$cIAOz6#4;YoLz7p|2+z%DgG4@Qdebj>WFYgaE|a zMiVTLc~Gz~Ow?*OEImWuoQAdbcjz<)RE+6vKpg2~<+1rnrlUf+6}(QhWDP3$`~58P zq`C&v?5ZW3vePNDv*#Wwlbx_}eXD2hXG!;VQg0@kVDz(6I{GFAkg58N5?mudZM57Ief7}Osn?+%#hHG=+b0)uDc0-85UdUgj#(yS zsOFxnjEa9BzSCYp-{OUcLj+#70wr%#%FDB!@vP!+?KPj)nMc#&tVi{z_V|!xRI{X) z87zik0X3v--wDZBlI+eUtVC_(uXG-X-^*YIZSL72ERu#M{pMdD{2_T)vhM+=yEGRn zDrnRYAw+z~1Dvdnq!XwiD!UQoz5oJeO@wuNlWj+H>Or?-_l-_l>UgeHFZW2Dm_ylY zH7hG$eEMevmZ#?yq~%*1a2>$6%dil?QHsAnFg+eeW;ie2PqxTU6D~IyAwm=*KWe}l zOH#J%zrd9O^t0VB{)2(}pGy9B^)5uU?4Qep$62+B+u{F}2w2}m1c&^K4O5E!Z)x`J z_REz?28pV+lQ*}pvOZIkgdSQ~Vb7ubUlj=K2wldMG8v4_TqY%Nb#fzRzr@tqj<28X zO+Mx3R)BT{s6Vhf{7*(Sdi7t#nvaEubmGeqpU!{yb%|ovf2u~&KVHB-0T1(SbvQk2k4*fGBsgN zG{(?XlUuV^UE)-l-IC#1_~C0Z28gv2x^dR)*;)3nUUD{L|Kq+U^u?lsM^aVZXfA+7 z#`7TZsq~W@^d+?V#E(j>%as>_ceC{p-{WoV$aFlUvv>ixTIM|3e=t9cHh(I;Egyy` zBT=1!t;USorvo@2%B{vcbwtrbSoE?4V+8%4-3mLi?2k^ivWC?owvT2CFhI)qqWRG}n77sUcSkPpW%uWy z!6oK48E@9hPBp*Wkd7TdWPP55xXuB+thcH_vQo+-3~OOsS|3q2TPK@s)8!HsQwMm` z1od#7zrTZ_ncN$(xU4Q?Ts$RWZtro*MFAR!J?c-;`W0v;j{Xu#zJ&vGaE~UW|%b|d;V|m_Kd0@Lp*PH z>HGJ0bT^H=shLiUwEy-Qo8-#%wZdi|51iSDDZy8y=;AJ^07j-E6tk?Hw*DwxcvnW> z-}_0aTzC zjL#Q5oH@zq2yJIT^x0QXG@ps>`ZzbV9F!AP)rU_mrg~KKhA|P;+8T!5|kRU(Q{R+yieD~BmefJ7^K<5$E~ zozw%r`RRPCCRqG_&dGkR5Fs|kE(Alh*7y$h^J`$k3UZZYuTtBcSe`PzWCKq)QT}6vRmV0mG+yBf*wn(S?P4qrI1a|_Cp=MZC z(lWoPvK{6wM?$~E?{G71-Ipu1zLH)Prf^XTVqKN%oZdmt>b07$kT}2~Q9_mCF|vHT z)4qFlx~9&8O-qZj48)?x8Z8g#6rrqQuz@OqqGx6NsbZ#Nx%`HnctFn{b`f4cQN}zJTH}?1JBM zaZEs{qOI8j0@**xTZq$8X|1`f`M{nIfbDJ#J=Wh&u-e24cfR$BNt&bA+Gb66XN-0W ztfm!R&7vPfu~2_HRPNCtVs4;Qj`1Eg4)*)9?GR1PcA1i`Vj$rbQAL#vBy^EH@m2T3daGAd)Y;pO2(8 zrmxeMI~K9_TLh_0@?>R(sR3ktI{Sfp+!vc)0VEzeb}}UzyQ>85;pRxIAV<$Yk^Wsl zj#ahU0}oF~*;k`Pn~jS_X9?wL?M07zYs}46&~2K#4^6-IeRd#8H!v~SX-%?z3-RWv z4A8eH(Gz$V3S>tp>1B0JVy~5YE?9f}%H1AvX@2E8p8oa_xq+53zZ{=PxD5c(6PuZ@ z$Fky2IpEohH(U2ykckYgLE?nbt@M`&UDwtazL?-&gAR%Iq+tTfH|+k6GCwSh$)1ok z;l|q_-Vd*Qfd$ovKHELm(ww&V>MpSRC0HhhKLml9_V)Gv86_54=Kxso-7`5yJY4dL zp)Geza_wQ-FUIki^XVk2c|E`+(KIXrdK`{PLtVP?d&2dwGZy|6kO`XXQP=E}S4<%t zr;;eIIdJZGj*lX)+o%9Z_rSuxU7s4o>#l{PDBw;>96^Z-?yxf^fYwrU6c_Zl1mfJ+ z2q0}GrD59{B5b+|*+Pzeu9ni=f(~89WC}6%vrCwo!%2os0ss|@ii1oG=1^R{4VkpX z%Vb&)=JSd;KJItPNfTa)>?-}s5w6d`t}IvL9nyn38gBGTX2lqjcAdt_WKE((^roiZ zUMjW|boS{Z~$|ei2TV7_}8RZX9aJsf|r;A9OEr4VLE-a0? zv2m?Tdl%s49mUKWzosR_p?Awm(OKG|hUN)i2w+8?@<@`qHZYH0#^$?wLD>J!sz+^YxF7CmVvK6_mf9N;od%t1sEOnPOSz zYi8xk2sK@#u`*QBEF2{=V^$(yy;s(}o+^l?C8gGL?w{_VrypbW9U)xI=VXofBd$ctp`=kSx{|ksA zTk~CuCi?XIJ#T()sf+u8(nljr8=!`ApDqPne>lm(c#aL55v_?OJK%MNlhdm)IyOi0 zY7Gz3s@1okx7h1CRNn4y7N~G_OYQR6gN%uz(<$){Ywf#9l2ltP5=IrO= zQn6d3H_wK$$AK=^=x zX(KMpj9+qpJ4d#h+z;@2?uildAZ(U+>J>H1G#D{O;YQ|9=m2ehEZXj7vN3Hkl}41k zxo3N9U!WF;jjF`!GR@-l#ua$_YSO|50PFfFX;gdM`{FU$7BUb*HRZpG!am@b`AEvoXp_$V;?h55xn zR8XFYbtM3YNf^Uu3~hpAJ|h~GamL$G_N&u+xx`CQvk4C}*`GRW@%P;jY3&pQy-*it zbCre^o37rxpxmAPr7mEMMU2!Xe=~P_PB@6g> zRVO}(I5sA&0g2NncajAkXK%d1VfxLw>bJ?ab z6@e}3Lwds}1?OPTTjPmkGqUNtPn?rDZ~SMC2U@NVJ4%{%;ACfM=Vi+*guB|W30Mo? zeVmYEM6LW`{SDlG3B=|wrK3Y?f&$$TT9-Q+uu-|)k4~$B&5dQ(ZSIf&rx)hyzjN_} z8+U(PZ><3Eg*TbkmT=8TJ_z_c7WAB`9cx<+fvi+rvOLCwcecA>M@%Wb%?}DYYdM43 zi}Mw+*SO=>ShgeE)}Q1D&CxCKC?`_cldLIs=hgem5#>0Vk__D4a3AMi^%uIx4wk_$ z4RTVff>XB3xFMH+3WCxQb;EEF);;LJ>}LLK)`~2mr5th|xwH{-`L>wp*j~dDVI3uE zdqi}p#-QtU8=okYvCTGN^sta_(vJkbim9j&zX`2}7IO^ghhW`vD#jCK-Au?6!M&Ev z=WUyM{PI^VopZ{j#EdTGSs*zo+C@nD`34)n2|aM1+2`>2TY_v}lC~Q2Pv0OEJiEWe zR$H%DI-!SBwUDT~p0>m49`h-&HaOQ({@cDf(PelZgAw`X&#T?r=_t%1;xL>TGmM!r=NeRx)79&LY5e^lD(I?7>rz|L>t+jJZKgVqrLTHe50&(J%gMVYs3>Z z9}r4S&{$;x*3G4taJ21MRuCnVufXen0Fu&Z{|Lp7G$AS&&gmZ<>Qah{{F?Ju9`ZN0 z;{SjlL`08cOG)07vQ}X@&{zr%s_`mU+kpB~?^Z#4rKj;zh zU{{KsDIu@|_qPAY-JHk??zvnX7-UHUiI`+OMe{<*CtN-SP!t4ytXqwYiuwbPzKu2p zs!Upc-$s=i?4b$$ivQT_Pq5W3;&W4ZI|%3-I#!do{|^@VKbq#b<}f zAGKFZEB+}x5P?RW!-VW6o=_R3d<={zXlrAvZoi<9W0bN~upjs(0ge5eDD^87*i|0M zFoq_4>_WJZPpJI^h5XE^82J@&Fjv!rT#r%zGW zDz{6{Pu3z>)^BaoHI&Sy{`#pf|1BG>x|Wvxwo_k|8{TTA@Tn#-JG&CiCLVaZf$=va zoyELl{q1jwH7aVExlQLj&fN{6KjNL5+nHQjI1`=o!1>xw*O3 zy($1-*={=n+jIMTAYojla2S&NW@!)ni>Hwp_v7ynX|6QJw*#IqxD8F%zb!M5h3rBYquKYb22sO z(hvJYlvsii&GAkw*Dw zEXER?T%Yn?|R@tKzKXZ4Gzx1XKM4 z#l*=GyZe#(2NYOuFe5D8Kumzg(aFu`SMc;O)3(ZcJIYuHu)$5=FGHDT68 z9(!}DUvHlhh=s@=a)j1B_>j*uG=1Md{tTS+%DXFroME#RQoA`Qi-xR^G?BiN+#PKt zGxy46Zc^w~;uoB1e>r5L%Wf%9K%~qo1>e#E2k*~bu+OeB6q(HkmmgVw^m>l(2Tofn zXpGN~2qkM**h`{0@=T-PJbe4@=?4))Rz3ojqA}H;x>py4YU;@CJFxA>EbH%u&j!2l zD^%tf2+TL$=Mp-6aHD2*m@vJE!$48V-F>XS9C@dDD^j$1)%*Iev3`~ImNMu$YvPqn z&HVlQcg|N#N7da_m(ciY@W`;p8d$}Y8eXm5)xu}+Lkm^2A7$R!D_8U8nXL*{4e!wD zy(b2TLy9wKNN+W>f%P*F1^P%{1m%b-uu8nUU_{Jom+*+70vJU)o9sPr5wKZ8v=_K3=E#l0Xr?X>{+qOc8nP>&}EP26{*^KBnCG3 zO(urCaWlc+^L%Q$VePsHG!ti-h+o}Jl&4+$M2-k{KwSzAgw{P5hIb|1NTEt=0q*&k z4_9zA^5-?%>fLkFBMhk6BvATxEPF}4`)|oDQ z1H37-q>cUW`vWAYH`Nsd##Z6HDe)J^qM+?}b`7(x-*bIVOxRxdrdKD$ zBXNM|;k<|yDWTn?Io&t|eNjG=)6L`B%#w3q&9*H^ao9wWg(dQdFx$*MYFI^EP^Uki zx$yQPrak>j{b0t?mil7UAI>Fec~)eRWr3ZtIg?;mOBReHVbPFM5TmRV}GRm1H&`t zE{3}c+c_bH?k9d5XCTCr52aDJS-KzZ`wXfe>lV4Y2Zs^^6nMlx4~~GZzj9h-23_rY z+n^|c@G?V6H=A=|-TN}*FLffMu?&Z@6ZpyctUI5UM?HAop=2jm&=MA!Uh5h)a-WtL~R| zS^ey(96vK%_JgdMRTFVod?GB=@i6<>28JC!W_2{V)i?xW5`9z+dX%S%b*PB)DjsX{ zxb(DzDu^bapRQTt_zBCB%iID%StO#o@l^lUqEw+y+N_}-jCi={m?13?|e5$)@s6s zfX~@>u&H|z#Q6ZygL|m+A6iEG!5_L@v~wG%58gM2W~9u*}8k9VaX(J@<`ZuyAP_Kc$$zc)B0v zALTM)B)AltVg0DIYN^GvVe0}?5eRh*gEA$#Unq`a^aOPY?UYS{5AW8Nf9Jv2doPO z`4fl(e9e&8s3%J+0(TXA*$TK%pK)k6XsbUctb8Me+>*>cXJ@opuHoh=e3z(#%oKB| za|adVdm0A`c&#|`;Zj~IQ1}Kab|~j{Pv4*pX)2DE3QQDo=FI*S5PKrvl>V(Ll&oHZ z9eBwrHTOl?PCU6O9^H9NgAaK!&(vj0{o*!0cKiRYS#iL>$Y( zTlo#+`FHhaV$2!7et?Bi64)6??YF^SLLLB3Q>xB(o>C-=w_J@I@O)Fji_jOspb;Pj zGja-s3(E4ARfYgSPSdf~&7TH+q~6-EZ0orr<&ihX1Gn=>!Ey&))nvkXC9VED>FtRt z9ctOhfHR@-EHMQQVK1N zmeo1$FlBlHLNX@eTD6feKQO&S;8}bf+vd=5uvFLg=Tb36c1DEDSfxpCV=FlkveoFA1~a1* z0Jfxp&w4U>Bwx44>d^sT<|GKX@DYy~6e@MYz2x3Gs(YmwIQJ6$?5uynhYz1zAouSO z-Q43asV`W7l@m?Zw?@z}^NtQBiR<&L`gEray?SZ=dZf0(guaF|qsKjn6DrD|ub9(2 z)bBb!$%-BRT2=+Y_$KGa6>4^0hBNkmy_hHnY-At~vzGd;T221&?hDmmg3oUqUMe(& zy?Ec5z`9KsQK(sB8A`tPds>&GgMZiXqNeOm%x}*oyl@@Qx3M2tISwK1xs)6>0+9uw zyfMQ}{Ph$Q_Z9Xd)fx_?Di6jZ!C>G`2tJv3Y4G4|ABP6#hGS6XMWyKObW>s^la3b#S_dxsCrV3V2N zY`bYgNq_CMy#NN?_L&yYwMwhL*vXfN6VxPp(O*1-6#CWs{T&byI^k|`@E@_HpsSzG z1!+S(Mh4>d(@3X@+p%3bHtGz2tb?ltTI^e5uYO`*h&!oDwYZ9P2)*g&^O$VH-}g-n zpqK%&R)zmUQ&bB$vo$VKX81I`QsiacubVM_8J1n$Vv<>z`?(9KFOcI0mvVoYp=TB# zb~Gk~xc4_&e(vPtWWF_=64bcjt9s4Qy^;bUz46^Ll_I!7DXZc#s5kZXcWTL~4Pc-C zcrWXA153G^GGe(g(HZaYlKhzjZQ-zMu|#N5qGjOw?~LlNud2ie*Boo!`FKE#KN+K7 z&p-ZN=^QqTxXcj6ufJj_5%{|)b9+QDp?~XOzBcHVP=P0ZeISCFA)k0(@s+M~6xcuM zd5c0M8%Xv>C#I)ImRENe3gjk9=*(C5RgSxrt!~4w&oK|sy-*2yuLn}GX=+XNYtl^Z z*N1i8rVq=5YqSQLi7q)0&sb^QkQ~}Y>F>}4^SW#GrADj_4a7To8WPzoBs?5hX_jqXzgyFw(;tmfb&#KPsGi=SQd#C|A9jcnNO6&td_|o zidiml6rqQaLi>tdD~vNSTO(;!-Jyj2G|@(%>ZESU6Y6VOI9~-QhPAzLAoGR&IuJLt zC~Pi)JAcbNSg0qyJ=iEFuRvfYySW0|9;HKvx1g^tPaDI@CqCYuFWje&yM-s}Olnw> zs5RnNiNXERr^#_DI=%g0k=>V1#s5*|^$5p)uwtmv*GCNWEJ{!)V{#zHI0OaDDA8JZ>Y*5zM(Mj`(`9{#_$&J%mleWNl0soALQ+aJ~^^n>l#+ulI&>6~Qx zc6^T}pU{^?Dcp@KSkfvS8kNwtsD2!!KBy>R2^l8?lf^5nR{UvGKjX6;)BD&WhIC5jE-Oko!@% z{lc!VBycg{{f5k>hbJN_13c+02H&gnzT+6s#qrOZ*jXbJrSRXLn%&EUZP;Pd9>7z= zRQz-p3Ymrvv%iFyhKT6E2>#8a#P}J6>eV6dL~u_R{aF}D|9#WU@GJw`tc(rR`U&r5 z`cwRjL0FS{8^B%ASAC=>c#Zp$ZX9d+~$ewsK*Od;>`?5Mdx7ZLA!|JV9W z(7f%7%~9c7GUMwE)3x9@?F|a8Z~i1k;AWm&v5veZ7;zldh4(LgK+7hM{&bBvL83D4 z4V7$!XO21Gy*%)ig{-}|xiqd7=pOJoIorRg10P1_45{l0P;b70*SJiSV9HQgY#!*Y zCHjt^utB_3S}JlTsKK#Uel<@5iW*!#Wf6%5G4OAb@{F%=46-n1 zdGHS=?LWzW8X~Ku@Jg=Do|-ZH>MGkN zj+_rT<*k;e^@e*YOId+)u&WQIgv~lLw0Kj5ufK{5ebTDVl!tyP-T(Tf{`L8boRjLF z(K8O+47z>Bs;^OJ9F}Y8@ejmY;VEJ&eFj$wsJxfMV}B^CCZeFy7Q@vV9hB)*HKRjT z#LecQp2gfCzbUbLZpo5CGdD8f?*8u6mYA3EfzMM1iNroh8SE1cN65Eh7(aXmH!K*_ zWMP_7g-R}|i-rySB$J$FFd?fBY4Hu(W5Z8O|IV<&q1Rppc>Z+B2|3lAh}79GpI|;s zFE3`nJc@)UmekISa-J?>=c0^<+%{wGno|?mD(&NGMGN_y1q;bRDt6MebOp9$DuKx4 zQ`Fj*YQqEzz17DS7n_p!g;qHSDfqlDRhSI{LhpSW^#| z)gk4@7BE>j9Tc^_+`)(@T3vOV1MePdgp$;#Tja3S#l(pOMU9=3JBK;R=6{YjB@rnL+ z`65)kZkfu{fl!rXm+SY%#KSNEl{2 z=0SOnTAZzph>yu?1z8gKgjmqMuGJ;u0q$gQ_N?89o0p>{k=%z$3$mY@K)iygIz1nSPLnHd-o)C_O?%Uq5 z_%MJwDRp6~5T#}yb+0+=>(;g^iJI`O@r)4vrf$x5G}GbX9#L=K%4lp$1jIT7_G^tw6Wg@YdHBHN;{` zl2W~M#(|EYBQc%C@6bvj{%uuogRR%*rfp=}qH+BaN{gPk9l;1AHp)&l`gIk(%xS1q4^keM0S>?-rR-5#^{?KT4u>6rWM3J~U(# z&_o-JGkYie4R(4uQa?bV0+>{m9nB}b3j&bwj*S9>~qLM{D)e?iI`u`<~Cb$z_ zv3XCEt@yA)zejeh{t%eo8WlF%yRfy?O{rdb6~Z`LHW>kZkD`}O7b)M@o7e&?tOYo# zPhr}WD6V@#YjY-NHMARwU!4JP{%hM5>7Kv=&B3VlDukuL}S&B*f`wBbK+dZGwN2&Y<48IY|56x<>x(f@< zX*dH~&dUXXyk@&IYeI0Y^Qw~+VjH?xgA82*TrSd=)pkDmf=fC!_im&NUVm+*IJM#L zETexEVNFs4Yv9GBq&~>4o3D91s5kqo#@4Jbx2PiBpj^%T=?v9jnH7C7x_9}Jz&VN8 z|HIo`2GzB7+oHjOCAe#F*Wm6h!QCMQcY?dSy98Lc6D+uUAh<)Y;O+~%lkEMSckZk6 zs@{)Vw~9hm0aMl-U0Q3sjkr*Yb`U>zS#)ph2Rl5EQZ^5%6_?f}(1di6T27Tla;n8r z)x+k@4o`6vn7@+h+4l=A35OIRX(1$Mj1UkUAffPzgv`JDx5&&wE`S z&O!rN$Ho?8;j51ZM1MTUA-wW7SytO)35r6nSD{^y_{I5P^L`6-wnWU8- z*h|;^6u22T{CN)4uDF) zR=p;?r5+YRQTYW=Goyrv>HDm6%o*-QZtc*+JQY&2V%rCOxsik5G&S{=HH!PRg5|uC zsp3A`@`!6O%E>CXLoZXqj^lM8j7=HJ*Vua7?lw~%F!BwG9sE%_o^dOiHC zea1>U!_BeFZW1!Y1@G)?Y3Y23X5=FBzVv?dk)(k6#~%j)^6 zek{^IJWa{|T9}SwUiEpqot3&=m%yL1>LlI8vCt6S`y@L2Y5A?395tDi-h>W&bx};w zJcx8F-`|#gZ(lc7F8w=*WT!A%ecB*+rq(c-OuvlO*qHJUcjDMP0B%CDA@QC&#%eOn z&d8GCmQmg=?%qXLGO1ty(==$}@qtONGkfhnS7q8YD3Q1<22e_!(X?y2X0b$xjnmSn zaVsh|v*X^Dq?B-2#PU!n6ky1JH1$!{ySWSo$U*xB@1k;kyyVE%@#(TxG$)6$81t zdc*j(&&C*im!n$(o~2X#j_maoN)b*fE~i4E&w957uNydFl@3>ZlvWcFdeXS8qeV{A zlo}loRv1^f8XfwSD3b2i(ibI1Z(|kU+70hy@-a~r>hhmrO%AA55iTQS3}y(T zKifTyv&;vK^~CbjG^SD)QV>QPTG}yXOk0=Nmu{AT(;Nb8q(ApMUk(ydED@G-#ni=) zI^0;lu{(OvY+WKV?lq&tY-%F@(>%{30d;RwF}W=ZEXBB`t=^evPd&w-f#~kOe+cG{ z6ZuSc7C7$-O71)L13(U1_|7@$mKThQ?JV+4xU8sY--RmR28iL^oARnpeS z3RpG3bU;(+NqBnr_qwLip zME56=_fMRR_a>S6L7m17R^**Zc6=yZXnE3>?-s1ovYEvr!fI zV;UoDV$mc0bcYDNFH*0}^%N<*t$lLC`5anel&5KRFs6W#bjWY?V`tED)|aVKQAsPk zb_ojY!d{bKvTIc!Dma-Tdc+jWf?E_1_%A{g_$*jN-lM z6CEcPGRg@2NHM30-jLJ1Zh3k9?MPfMkDJEil%-E;oqSS9^|5wjyWs{uNZ^Nt2`iK4 zIIRW^Zb9W)nR;kVi;Kp=!`W;DkN9|~CwI!XKaQg*+lTUVJkbZOb_Z?0xzwjmrQBj9 z2fW&=`$`8*lI8a9zY~3t6exBPn`L^CKB7?SzC>~L0W&CRw8P$H%?nT!d3ThK>dudg z9m!e!kS#M#vYe+C!m~m;45lwmc)z*9m$gO+=ok9?uo2|K`ZYSPU;t|ZfdLJ|x|>g~ zBW_uyi_oC_Kk_3z_AH%?zGjqO>5u+HwG|LEs2BAjK3?0%hM3^eNV^Q>@)v$?C0)?YpDV;Bu?BBEd3$nQXMaA*$w5*M0Rips zhzW%+o!C$yqr*o(k6SeML9KkL%*hQ}tra4q}bn-_A zv=kaSJ2$k$Ff^Px2)Q{i8Sa~h26&781(B_**3*rd&Nb2dK;(kW^I%Gjq}3mzwR~Tj z&T(CLH zzmgO=Q8_;@!J*?T)Pe2jde|jZ9M66Wzj_tjt)BXX&KvmZAtIf>+)wy&(7XafQwd*G zyB#L)kIx>KpP>w7_sd?j92ZNr$70T5LvCL*nW8!mSP2cR>S<&+3>RcGOx=^(DCTW! zG3mqwu$rmBYOdEBw@7>Mq7-!eU~CV=B5Cd7?bqxL4}!B5M~1)O#C;J2l%J@$$2@}t zfoORC1%vf(&Wi|YrD>?wGZ2}6<}rL2W!Tl^uZJ;3bac6+i!-Fk*7=cS-AzYnhe;P9 zOpi}WFXjw)yY4I4asSiqV2g9zD>467NMzy9wxmOWq_)E9OKge){ zS2$3VWrkBUYIvVHk_TviQZg|i13DUZfp3br0(W}_vG&_TsOXTUpFackVp2A7p1!hw z2g0ra+cJp;`({)J64_#(uR4N*Wx}<>Qls1Xr}9&C?`xgK(C}>&-Xe*~+!NVU!gbdw zSBP%ZIwob_DbRR-YYe;Q7ROt`qH)t#_$LpTbkQQ z1uv$Kz~2rsF!v94qGJV}QWod&jy*&NE0u=QG2M^M4D4L4gSV6IYPE>R$>d>yHWlPU z{=TmZgl4^{VtX$;qO?YXHHTRJwE(0^JQFisyQg|&!~!o0Ede+sDec|*!I4xVy8kS{ zL|y;f8(NCrE;y3H^0MMpXc0+e;uF*q=MnFJPvYq(t?~+Em2%eA)4~s0BYO-kkLD*i zmP7`N?zA5-xnWd&%pCan=fd9fKFJe4`DisRdYc2dTnL5@9A> z@xHxiM{B(kA%nYqN4T@O|I(t7??TL9It%I2b-E{CP#6gPjHp#*wFme zxoeh;U5`R7BJc;RLa`$*r*ukdqp?s-lFMjTAeysz`E#;Ov_X-kzetbh;mo!8mrN>; zqmMsvv@Eh)vIppNkDDek0TR2-RZrb**1<`|Mkg?EhsWHq0(9~Z^oPrfS^fNT=2&%C zCYfclbjT%J>S-c)_kF|3m-38OMmm&0HN5J>$^&E#41q{Da0*cJo2NYm>ZxR zgHkDyb65d>#@B3htqi9KnhE~T5X7fV{)0~T!_TD5PT2woW2%=(nnaj6M4ELP#A$az zhNlV6yPEEh`^**?-HxOm_Ot6yrJ6n-IDRf$!YpG1F~MuHybg{8npI_5OiA%(vn6;J zSp?P#E)adyQqEmv(#xgml&`TXTT7qqM|8!n;NbC&=h5?aKBy?N>Aq<_NOtp-ySiK0 z`f#1@sJlh8uq(TSOCVZ0@42#~YEe#?y=pgcS-!M?r8mDLQ?SH2-4~o?ml@Y){Fu4!da9KNqSs9`3M1=Ecii- z`(lh+@O?){O7mFOE`4CUW1D@B`fWx?o0oe^Ho)9}e%o11u|BT+(UQb`7E%q={!UWg z!H(22(93OMmgtFr`KS-#SQ^;}S?)mgJJPD+TE9oZU^n{g0lmrUq~cV+wqfe=f$YGS zo$n5_S~kmV(gu#P*OtC6Xj4U-eU@#4REX|~0l9B+IzAxt%KLY-j0puzqe*D$ zG*FN`>s}3Jh0Yra+b``?9(m0R?XiClZGf(dQEOi_9h>EXz733968Q(SEfV%6;DqJo z=AC3B6P5pB#+n&e0k_^&hR*#RKyvt=5XOZJv#nUySclSQ5qWo|my>ifR1RlAUe(g& ztB)bEicr!9b@Q`Cr~Hi9#(!Gk9IuIR7ZXu6-^!_q^fhFa-p4-?L(un%QN%Ta${7De z?!x!{eTI6n=%1MNTIqMB@mJ3l%hz*buYCSgx?F7Q5|@Cdunm*j*}JOyV^IVrvCg=k9A4J(vEeZ=~*xlVvG%J%w3}mG3~lg}s6@`_Sn78$6RR&Dk&K zCAj|reW-PEutVP&@QlwtU3yh>=O|K)AuqD&^LLb9#!=!2nz@hDYI%V~SzH#;$_e0e zo6#*k?_Ts2ioP2{DnV~9ltYJpEc z)1C2!*G8o(#l%o)zHv4n>fSOSJ9fj>)3l&5{DN|-Id}tT3{Dy|uDYWa+vC`W>2DLP z`WNpA)1&SW1Lpnpd_iqx28YhPmEaH)y=yxXC!4I(WcFbbY3y*ZnGRs6*n%(rsn7w? zKSr)R+ymc8vDI9|03o!}?+ZeVd5-%4P`za&w4St#60kD?&`{hLU@TdRj&v!&1Q2hKf6g2XGF+2Yw-SfY{2trEAGqmBD!%D*K4ECL-ytH)^xEw>y$!_`(1l?tEjDTaQe=Dl}&jSd)?lNV;L~&=NjPNktS?7{bb+ zPhU3)4a5*atMNT%y1vnfH286)iLrQCOZ!+NS2NY`x&2p{I{GReR^~P3R?`h&uf3)C zPztJ0sz8934wo_7{&C}Wr>2HUJEX~U@mNw)qUtD#x*Iq_9a(n&_vmPOuSZAdG?0Ik zMHoXXf=nuTIWXQXDT%5P1jqSmHM^8$anc#J%b8ghrvr> zj9uW+A@&7SF)%e#Lh+=+qD6x}3w{VFh$YC1-@T0%w^W9q9od8(rq@1BympMd72U?iIiyps zpn9Y}Wj8=Ch-+|3di(s*eEj!Jsmem9uOJq^rlB!#B1ZK3Z8+1#ip9S_fY^T>0rzsM zq~5d}wQ?N~cmzW$nVLZne<4s5Gmckvq&m{Xr*1D8i_}5G0_rKKV5iu(f=59^2`+&ew_BxJ~VI zPg9X`PA13VV@QRy4$LBlvxBBnS?*y*k2WRH(d~$*_Z11fU<4oQK*vE$f?SB}&h*s9pPG$XJ65EV*I6KXiB?UM|KVxj zEFAH?kp~+L9w3yT&j|GATYmGmow=d<@ST)53k@Qq0@>TsfgYu6c;(b^`t~KDN&ekh zh1k*v8J8Bgv)N&Tpp6=Gv&ZVJV8xg~V;}j6242v|nq6krx7_C{_ijCJqTp&9wPN&> zRwbHhvTv8K0Q;MXR2UTM^)S0&5JLJV889 z@}k45Fm;0i%4^6!BY}@s!%F!_YDf+T-R^ujjCTjk?)J_wDv-t`W5>Gp8k~qAFOxm| zh|>c-jdt7K{6Y3WW_rFL;d|a(rWSC1*I(M%zZNY(AAyThp>m#}J8zSm8~+jKiHN>C zwd0pQDI3(Es_qLrpW!<=3vaOp!1*AqDD;&au6F^%?=amg#Pd}-5kZn~H}{PMd!4+S zwusjmouRu+7);LlI~9c{H(x}WHUZ|f0sXQJm0;b23_^wX5z76AALSh1oaD1YX9kSq zMgiCJVYL)AiA}&4AVv@Ucn<_Ja&58ehURQrFh@tH8D$YYLA0kNMdqi-h>PAmXDzgj zU*{MIPAMjl@Udb$#i0)F${NmmFDBa+9^F9zJyh<8tzIdf4)&+lx#Z+CH}<%~4^hxc zzw7iKl>ZxofQR}=Sj6wH`#_cx$!tG|b)gpUU^J5nmP8vfB)02Oqyffl|12dR+Pu%< z{GI7Qs=aV=wTa46H070y*NdI6#LKP(35x*kR-<0P2IZee;oFVb(3s7W4s1)c+5HR2 zfCt`xk0URGe>ZjKK%jm3#x`vYlZns`1xk*Z#0H)bxQ$|ne?Lc-FqT>(C}37~nLcT+ zL^}Ko%-sy1KP~>N;s#DNc=9bhK~TN-D=#7Tx0;#EpVa|k>)!>%K>Vt@hxrBgW`twa z+sB3cIvMBxQ*w-!mIQi<9;Oxky&T?k&l2Wdh2g)<1Y+Vc18})qjk7IVA}P z`uesdCpN8bZjAYhhEcdT;n zy!tYWS;A-1pa}jpGUv_gjp(H|iw`_FV%5Ptk_DFJckB=2v+g zPpbI1_|+7MLr&!?7B~P9e&k2M0YCTF+HuM=P3v+4&SRMdql^Y*rS#(Yv24;Q_Y4Y- zH{4#HZhxYZ>@w=LI1B6QW}UMWt@OU$UHQ&X6Mn35#{NnbzvA4tMSKGK(va}_VT*;~ zQu;s8GW&gdo#{Dg^X&Vr$MoDk5wF|#zNc1b!=%MmAJd0=M;$T}z~V$a=vL8n^n=c* z@W?i}v}c}47j7&Kg63x{{VJp~@^~;mfrrTRz6JW!Tcs!7hZ)R)>1M9Xfu~$;+TO1Y z?`CRaDv*m6n>Nser5G%*r;(1wt-N|S!bM-R{NAta08vCl9p*3ndE)*-ikk1_3>bTa zQiRjF7)WJUltX3f;5DfYiBQFLNFe__e5M1wM zEwBk389#k4ZH%~LVlFHP(he{_+XkploSk>uB13>jGp?}@9ANxzj|u$|P<{Ti_vR7+(Jg)a3pONhz21EtP|Cr4jh>u5!X*>hva>LZ&gAgk%aC zsIm2GK8|Zlsc*eRPkOf(ASv%A`;Df8^B?Za0*xNASC`(PW5r=QQNviCy}DdRS`G;y z1~*m`jY^x1E-kqpe$7{R%aG@1o+C6cMzS&d$R+bt)iAw=O=(xLg(NGeB=NW)s*l*_ zQ`-*1e7O`Cwvyf;c?bVJYX}G51HIQ@d?RUWc)n>iAS%t z0;X6ByA5NBgu}bcJn`Wb_!KqJoA?yr_q|d3!!g%lr?9o0pyins`l+OCjI4n^tIdtp zBC?wHwxvQ9Qp%2q$e+-B@R7*g5f6_3MB$B^G?L>tAG`8YS_ocv2jf$gx}M-Kc23_q zF8bN3XPUbRJx__sybHb9>s^gg-);;b|6K?{3(R_(-tzg^N*Gd1RM)e@q0JZS1`~G$ zQkLkmiM&|mPjW<~i{wkzb4H(zd&BH_+xB*mj~dkNU{=sY4K|>MaY$~44B!j z{!VPiLne4jdE2L2h+&2-InK^MQ+u>QEjiGBKIG7E<%n!3wNJ5NFV7v)<{`kbg1B;v z!7P)!(^*L6RgJapn|r6^8@RamG0eZ zZ7!Aoz(ZDvk+p-3^he_^6~r+O!a8(O;^gxS^eaY7GDcc-jb9KWG&z#iL74I1&Az(f z()!%1V-VBzwd~O9tEtsdXuOm=q}px5=%vV*2Q!7PX4${W-XyKVhVB5^u1Y*4=;h>V zC*og&rTo~Jdq?`aZ)ok;=#OY}FTdp~Q`FQ*D2ULJy<@UgCj4irhNNs_Zw2_GQjuN6 zB>4M7BmL_0-Y;JS2hT;B2+UH*XAPyvz3{>M1E}=qpCkQoKvqDGqo$5sbz2=DGJ{col+Q8cRsg}(TbTKt+nG5dtb%h zAS&{m|8?$1^ESOluW?hbKkZpGXOdVN&HXS4f}c4e(D!K{v0KH{vD#L zyS*zAhU%BE6lW9*3kNY)GReK!Zz@H#=yJN~WkEYUHG40&W*oX_wV;XEWG#qX-~6W+ z9=A6v{@=fR{lhhfb<#`Mdb81{a^g=JRIe%{K;2!tSs8O}Xm!q_N+jR2Bl8ZU%ISD; zK`&r)d(DVcIImBXc)~?1JC602J_p5)i-`M=R5|9L)M^BIVTu^bSlZDl@_k40;r2nO zCKyqHDe8RDtmua{0837yp&w)o()rM0JmW%j=2&$evVlLZcDh`1!;@sF^+NvWT7pTX z9?jRvSL^os-M4-zs72ouf*E3S^`D~z!E2Ty=%84yN` zH=>%7WDcn5w!S}BTfv<3i3Lx=J(Y(`U=o<+=JvPd<_t_Gnm4@6Ec)G~5;Z;cz~*N6 zuOYZV0E1?1t+ElQ#CAVVcnjY(Rlp8}3yY@c$*08yp`nt-&oMVJugtyEQfBwK`f{~5 z+51|xSSTyE7zM7iqRI@kw>N~HMJGPtqoKu?-Y)IWoSQVVgE%>&oZut!`0eLtCS=Sb z<3oOZd%_QZgJOv5;qbBJ4YJCX|4qE1t$}x&6Aep@Fj_w1H1f*~-$7XsZ>3ZF7f*_+ zO5)ep0DsfgIYT9HNXjbJTEHT{?b0ck15 zHS`rbC9=W#>pqcW1L}cr`^&J%vx~2%5+ufxi*8n;#C9r?qPHijKy?s=VvO4Sr0g`q zVG;4%ki$=~Zcx0QPjSNiZm`)rW7jh=lQ^uq7e5LX*KKb)8pk*I9Bs-HSQIWdpRFl4 z>}~9kC35p{a+G5#DaV%{^#T~G7oIDH?4-;4LXXO8MoZ6UTe49Meo$x*G~DDw3&?Ck zb4J6$(;1kTE@xKsz%zC*) z*@elY@q^@$RNEWQ>jQriNtqh(DnFM47LJn{vU5vC%14)4`$rSD$5=DBhfEYyf@)s| zztE60z#Pi&OD9$nH=Hk~oeBwl|4y`Ooq=eI+F}?E&=BvEdND9sz}1aOrf@W!*n?REXSAa3P-yZ#JS^os%<{hUZ4Hv&c_&0zmrF*=hehAus945zW<} zk2ofxp~MLJJHx^!a>Ktx@Y9 z-4+{#ROMS$Q$FuI_6fqaH`(>wA&W3j!X|ayp{A6wA_pZC+it|Ms&5o2?rw#|akPvy z8!LU+GLc%&V|axe8KAU*a+V95{>@DgA7weTza16i?%;<%Ka{ObMUULW?mK(oqMD(b zoB56P!EpXp<3jV7sF$~7-~tb+6Th^E+z-DVM1IQ>qJDo?fmX#y5~Mt(hNLA1_mfg~ z5J3VmQ8TF@%(OwJo!z2r8IP}HohTlFPi8L2*0H>$hmJ-cS?+E7vd zF(r_!IR9jz=RfjM{Q-nrX1xkK-PEOlzhR?Kw15=@Ec8}nLXpq~O5ZB3iZOA{SH%-T62D*d2s#*# zZ_(pf$R>jD>X}P3s1knf6^&fbo3s#bffb>2^Mm7BULneGtiPz#B)I{epyy2m8m>7C zmys{ay_(Ip5mU)RTb<2H4(R-btk zyw;$JXIgqfX9VAUl|OjWJRgFTd(L1W!ust(#Rxkw_NIfSFO*0FWONuM-rbIK{jG@A zW2FK0In~^FUr>95&ij=o2ezvbP|{PrmL7g^>%4fCwsTd25$PFhWdWf zLz++E5dYH=f*7Vt0=DX^R^z4$5qSovG$F9{^Pl+98AU%75sv4~qqZ|0m#q}aTd)2H zYk*Z+Wm~Ho>Jrse5dYg&N+miX!T)D`U**;4u$1V9vb~#q#wNhvsR_X6M&#-~m{DtH zM$7wbRla>GvaVn#(H6lRL8zIdVODOx7P_t+03Sck7m1RTxGuSiES(PEmB-aqI`Lzf z!B`z;Yc$QSzTG;|(-rG^pqp1BEIr8@{!wjS(gc(0mskcU^`l}^P# zjJ&vV7V^vSh$@KYlK z4yb;jN&%`CKMpYSP?aDJQit;)7mps&4d<$cf53n$yJKaHl$wU2O`JfiP-Mp=&}>Kl zDyiV*Ww)nazCKf{L? zQrkDlQkDGybS_{znmU647&MF5r1H651EuJ)(v!ohsGCtj&s#jiR^VPIo| z$J5qJ$~;pQ_=LAw^I@J@*(`}*GJPu`TJiyLp9EBio;<&aCNj?QinGEAR5Bvyv4qyj;^%u;Lz?G7ITyC|7#Wl0(k*2($`iUy%Si_bO_KzJ$Ex*Sjs% z#0oa}IaPI1zDw}i!d`5uM7dEkGA!Kk=zS^rWO1{GuJWhZ1V2z8*Wst|aKh%L(vOW_ z&>sab4V3@P95a;*87Fv}&XRLiV}uXL7)7@tB!;&$N=9p0D>0HZcP|Vd@ZiKMl`-U+S9m`U_=d)1KxnBH-6%KY206x~&}&))W;(E> zf1<0wVr$Y=vazb2BUUx`QesjMt3mwdoKn0`wPbOhuoV=5J1L94@nZxYmwU!HG+3} zcGzWG4Tlsf?E_c!EJJ)jJE=0Iu`DpW)#4)}CJM5O3n&1HrnnIMD!7<0@m#?`#a=u`Q>V6R>J467;aEvIg(z4Y{22GgIG38j~nh%kAxswR~QWSX#l@gXOrAt9=DplC2~B$xfE zY-EF1-RRxW=@W1_gEHH}Ai$n;;&3w>jAE5-0YFjjU(IXL*!zr)+MiYDrZcZ!h{ATd zWm2OdH4~3fuAp0m`ZaFx)QI2iKS8@@6IHuhzn?n1yp;38O*jh6xGaNrRHUlT$l%dZ z>vUdLy+dlJ$fKQY?1Y9XQn1RJ%BFg{_(Sv6GtjQOE=VXG+;osu)&Uym&fOg;pt`N9 z;b}wSAfZ9Ulo7jj&P{6OQaxcd8|FZ?fj}{ei{SFjDJ{UN=1aLG8Qqsj;9K5xf1(yH zJS^Fe*Y6NMX-s>T7{Pbd!zfYbR%d>_lvhh$3z+&S3bpMl(1>I48HE}MNSfTmsj8I* zVepau`=jQDY4Bz2w5LZ?I_GzH80eqSg8_<|QAUz+FzRgNKv!K)GdB3Uti$2f7Haeq z;gzQCTU(q!mVP>ULA6yxe_S=5l{r?4b0M&8|@olo_n zX6X>*rP!pq?*{q%Br=7>B)88B0Xx2g^Qpt5eJ0Q+y!m(HCvn(U1*yf>iV;TR@48!EH<*0Y1(e+<+ z_2HGP_1O?nD-Zsv#pui{C!v>>LJn*?WZMB_OiCNq+i7`byPC=%Hi~}%D4sd&Z*D@qAkfv|8|z-zdFZ>}Bg&wW zY4DB{OOaax8EKAwx;1~l1|w!>Wnae6vLG7TM~5gyt=M3vCZjH0y48#QVa@xih;QFe z%NRy~F-)S01TQyje27r8bgyCH#_XL*5^&^)t*v8I3x#EPpU{CpCfZ}I3ZCu4SS8xO zG?q-_GRb2Nm(q^fSNE=R?)_Y{b;7y#ET)Y`>5ix@uag=pW^tERk3!_#%sDRLReG)! zl|Bo_M5Bk$w^OI)zN7D_^H#$1K_N9>+qlJ~?jDt5=GGkDe)H zwT!Z)kju19An3^Wn+vKTmW^G6f8U<}f*I#C-c0DZqrk3?mT5z?o-;{wgRjBSX1yVW zq(83WWT|KU14mp0;gZ{NmGTD~2fk>;MuR6muZT-6sfQ3_Kv;;H$Qzp0vx_ON1**qO z5_j~V(wThLL#U>JSzQN*$v@7wMi0r>%DT!7%X4K2Lu31%-IOQ{Q9jQ5$9hb z8$Ko2sLJZ1mEaYvjGiBW5|uG_45N;JznepCWZ(Pw`#V|9&bM^&VYUNwGmZ4p8f_lz z5&ijjGE(&V(X%*jDmg8cVnuHu(k||t4IM!3=&*WNIoF!sm4C*ThvAK))lcD)FH(2l z4u?0O3erf)sY6z`K-fa?Wq1%>IMLOz-a`NS?$jV#EGG8|otp-KM^bU%1>YD0wZ>x{ znXD;yvPiV&<ve(ne@ z6^qFRZ_7@xt1}uPR9i(~7y3LQ3hNu_^fu7|DllEm^^p>*r|4h$fnLdLw8b=onQX{& zQ{T?u8|bZ;bU*zJa$9)EAoJ&dLKywin^?0?8AfR&4>VENVx6v>kID5746+q?u*Z!+ z*%c_Gs%bWxpM#?6vB;Y@#hW=v*h2Q>%A%a0{M&D325g$G;yqwcx8=tIhoNodxM;7LJ-@>WfK;L^8&5G!}>ok4Y?)-Q zXF)K$kIM}0E|~FP<+wqalM3KH^!y9OQ_}3YqEgpS{0w-E^8v?Sn6}$IG*TEU=F7P< zNSI~hg4K+h1*dA-YRs-zS0{uoAJ;cfy8VSq9(2^r0uCjQ!p=A;XNgb=o)=KnS4p`Z zYjKopL`@;zy|YZv=;3JdeP2*@&8hDxZeJp-zQeZT#wob__?0V6Voh1iqr7S83jl4v1f!jA;|cj_%sk4$1)N0?>_XWek?71|&V$>=vq8l~Ee49AsQ z1wJ3%6RwliOQ$GDEn4!Qr)ZwWs@+6wSxfkxgqEbxYWl70#qrO=o{x2?75I)w_%ofB zuYOo04FgXU_RGeGI`9DofsLK|HaR|{=wA~D4i_VfY|d;qP6fSXxyCU# zvuMB393-_@g|zU^>4c=Xpm5lw@hBXzOEvgz_F-Yd5cgTWo5{7clICVXGqk(bsSIiV z)OI!osPQY9Vt6gyCHN+;^J5iNw!}b|Bcl~PX0{ECs}(Vp3+<>Fu?m>MWU4-x5diuP zmGhJHI1iBlD*ASsWh*a{ILD(q%T63(nIRX_C&$}P8Se)C;#al7&%j#EG2|1yFJE`5 zsBwS6#AaaRsYW=wDLAdUHKitD1wqL~>>w$H-^S#GhKr7Wr^oYDB(n(1_>E0yQ?u|z zcO?EhVVYaCl|>R7F|a>~e=hgKN2INLR0`9tZZ<+yw!XccF*r4DDOHB?2Gth5HjbMDHhyX&Z9=rM9{vg=JI zzfZ{=Y9#g{7_?yexX=S$QXZkueFMqg4lBMQU(F)uGHEGr8r(tn8>6 zS}hh0i`Tv(k*QINa>7!Xo_KoN$b^No0a;nHgmo*yIc*;58IAn|JY{>mODKPuE3rsN zBuRjfhT&}HiD)nymg{W=y>fLn8A<&!MCl%`2Er;s@QJMA*L$OVHBYi=ML76UoV=}M zSv4oWFl;fKPu?p^5q-`oIYeyxU+uF7ZYr*Dipi5yhb5&hS*#@v8*SOrAhP4%e$N`& zAZr8rz^<^4yY*^vcLEb|H7QgsqS})rx({ubw}#!gx}Q^vQ_UM->v1f6viJ$Uj_5~M zrQx}*eLP8igxQpmf{?cCu@NsF{=y6iFI~lFG!)b*0*`$-+@#k57e;;IGeTLhAKc&a<-e^5v~R_@^S;B@O3EV!q?=5Z&Mkyyg35*4*~x%4;&~L zBAI9LT>t_lWG$YZ+Lit8(3>x)wT>NtP(My)-VY^ik@jU2_ZZWB zvEHQv6s^ zu^YK5#zURWE0QmpxRHblMQI{r@|IIS$Yv!;GMQVljj1@8|4c?R6sHKA zh9Vtpq5Y()n#X`wH&B*e0w<;VG`q%?gdtvII)p~Xejf7$?4X230H^m=+2six6(sR- zK^ON$ThmMAjD)00HCZXMw!+pcAW1`=%V?>rFxFD^jOW*Un#-3nqhAZEHd=HlRDxCc z;6evs-FrCz4T{_QD`SGt%26>&DLWD}%Q{?iPRM{hIJ4ePrX*c;>C}eQ2``nSy zgnR#%WR=Dsi~g&$(7|loZCB87Nl@$3hdI-x9v=iI#Xqxh>Wa_3aXX4FZ618H3R3Ob zr?NFmsi9MS&VvYK>d^@7{qtDw`4>~)YNA`YXE1s)UL1Aoo2gbs|77Lxph>vu#e=H; zLs6=$@8XHh;mRJ}S!DS%RhrfS-ig~nPVDNep&7*R;emP_#`Hx@M||9<9&CPy2t0Dy5EulzjPi_J+iidDl}H{) zMAm%7@z8&^WKf&72%B4Xh`G~jf} zzE=lnZP^pMwP?^=HMs1g!&Il#ro?;1<7+f@*EkeQhz4MnfB(|BfO1V-YBqB(6U<(} zi*S+b(qRdRs>T@r9T9MjKc7-)Uy2$^qM`%W4FW)_?6|R<)e6Z&AkI?Y3%|hIO`@ncj*MQX=~6EP)Or| zs7f!k`H+3ejX`B{%HLb{4Zv^|xNXbWVgeoJ2g-W__bWz41oLg0`ihz6Y8Bv=pa{*} z1K2A%zj)2OPW#HsBs-DDRjuOavenF)h4-x0>6noL?u9i(%RypESgOmV{b2dr z)&0ViGoN|NY70e0c3YCI68u9v><6_UJnhap9VkpjwP&FqX_4@cj8hqg?m+ULxhDd} zsQs{_i;vTcfb`V8cK;P>L-guT;mFw41faZqlxb7|L){G3tW6jx$lo}m?E|80 zgu%3|EA6e8unuMq$Jj1y1QGIb5QZ1BN;j08mBSYYm1`CGszA^t;Y{vV#RSu}2CkPa z$RrX)l9p;7u&amHnwTk>kOtBhU{AIi=;u)@#pq-_Ue z7@nRDmeQ-|K$FSR%Y2F`ujC_jcAiw{d4jpdOQkKXWvCncsOMX|Oc(i4eP1SP+pK`T zTfqR@Dp)z_GQWhoIv>;(M3-9Dw}W&~+Y+Ugo~)reA#+soF)2xVR|G!J(d8uT+__`b zC^ixy@j@&Oj8h>JoaDZVIUb z3q=m}xFnq7Shfo>-D2!RF&I@x`7GLL+S%B;1R&d(-@{AWn>WR=Svpoxjw#zU@(ov) zh@~se7E+FOdqXHU$z)?2U6d_pm032l1_r5K$ssfjN3y2t^4h3{mU#;Y93v^F#x0>s zPf2XuN<<&e=50}K;l_Mahp!Eb{JwmOw+pu`UcyrSEhwenr>UG;>!?`;t;{FG5sXoJ zakC%El%>UFBc^;Z2y<`yBL`dr3i%GHF=kWBMaSK*cl`mT^e_lmcgkPuF}wIC)vLhl z_deDmkrBsb}P$MZ70voto8M@Oe}HxmzX-q~5?hl;}K* zWFD-j1rZ^$iK6p!g-`gpGGDb};;uhqOFV$15;`?1`89o9>tX9Dl?_P39`1;DpQwGC ziD5pLkt+-R6lSk)8Eq*l)vAW?WsDl{jpr)XK>oo+tOf5{hO77+rLKu_v<_*4sr1T{ zy%oTC#Lc~X#nx@fLB>H9fV7!|TRph^`WcGO8kTlz%#l#54#S-3S_z(?fxxoPqoHDh z)9j=qD4Rb_?u!cQ?!-rzwE1!{C--yPl-QjYs}cK-DfXLjR;J9FmJ8F)(1v?H(hgxM z7jRr<#D2gyfKHoE^`#h=|(g3u+YOVrr0Z zk=6+kS+Y5{au|@|W(tgdqBYWD)yTlnRaPfEAlHac6T3L53eBYhP$wG*U^N5L+o`j# z>|_XJ;L1Gjbg|MC58r5AbEB=Ns&S=L=4IoQRW|4$n|w-uiA!4d8VaR!2IsJWr@tOj zJNP$>Y~Ur2=Ay!{5Pb*QOkn4@pR`#T4;+9F2ZP|JeDiP38bkkZ;C6-7x}6)#d zU5}T7JG>w847M)DK28|^H`TYp{~-1Co$;}fS_Z9V1DkYN{LJ!hY~r@m{eP5sagBhu z+=4EPE`UrM{UXILtM>~c(yMe4;LU&}`X0!Ez*n~ShuFqFN0`)X`p3DSHk&fZkmG9}zjo0*3=?l$bacgBz>17ALL4i#r9MlQ5FdNU3?#!Wy4>K3qq@Bn^ow zs9xZ;H38^eHjJvS9!%qPK-D*!>Ck(HYd;!h^zo0e+_|Mxf@mSEJT9`=V9xSc9l4E7D8~4Fs&|!H zBD7J&5qU3qu@V2m>j$R38{F;Upo?(wZqlU8KhD)sh^9E7fw|lG!ZcnZ$mZYz1}7TZ z`%Me41@1Mts76U}3HcLc$@dBUsQOev;TU*9jeq|RefoX)YNV2Ozq3-<)aHrQ(dV{+ zqX$g^Ld`am83LOm2W%1x9bBJJ(4hCx?EdkSb13}o$lBsW-ggL+6;bIf;=i<6zu`yp z(o_AE*`V1rSR>+(;*{cMB|fVOpnjadb`L>RU-8FcGW_>u^??i@hfFK7@M%fsn6e_1 zhsjv=r^CXd&ygeq@u8tRj_x`PSM$8g zY8G^=stZgCmX>kP2D82ous_6pSa?;lC&t-Ys7x3}R@azLIRb{YV3e!XlF3ASS)2Ns ze=*3Ar1P{54uicN!_W2=UWG6Yg} z9)lpsK|N>;uOL{&@o%0?sc9B0ePjiKHAmSYHsEm;#;3q(E<<-6zJJ$02$vZv^1izr z@%ZEsngXijw^AZ$k_-!y;T7RcPLyUF+iN3FH|s#L#_K^uiNrlo_vMH`8bop~G^tcE zW1)kvGqi{#*EZ0=hM>oC(1L!K{#|g3+2@wke#cBm!V;EV(+SQ8-6V0Xla50UrUNWA z+nfUT&&2_E{H?PDUJnBb@y6^e@9z|c0sMiHdoz#qkOsa|{HX|}jiud6u3F3gxj$`G zq}kG6Y%(go$4Fb6mibr@`@C3*)*k%gx!&%^F{?gT&VI2d;#kYWb+z)xv_u0x|974QUCKc zf&cd$aeK#wOyn` zI;6W~=u%3gQ<`C5kOt{ex=ZOEN#hxctxn3h8A;*7sqA^2>ZBunb^b{T+sR;Q9HrJe9uX%jbINDI>K-aK+@XocDAe* z_XW`8(tFzl)As%&so@e@GoQFQRDSp`NDU)`8a_)8<_&wbKI7Oe=dRMk(4Mt0PARK4 zUIG}syt~CGagb!iAa&KAouvX3PmG$|&^^u7?vW!!vpT6UCAKYtFF65c7V!2P9C!7L z=D(;CBZ60|Zv0}SvvW_I=nw>hA&|$xuo{8x-YRH+u6K3)y&grrcCH2<4!A!5J~OKm zsGBev&~H|=^9#;W=W!g!lzw_oXu2E;6R54gHd4cUA?KE{4mZ3n8F4d&c>n4M^S;ss z8a&3R-K=XoUs;qQekt(ol#P3}aYj3%=f&Ju z(g>nR-hXcnHsSYQ48ly(JB9lD#mL1Bz;`A1xBSc2+WY7wT?9B}eZK439uSW53xfy%It;;-sB z25h6=952X0?)!=4sG_9pckk6adj=*{2d8W!8VBg(M<7>Uwbea)9r{imyB!m=Zh9&n z(Qzc*5LKO;FX{KJ4&FOoZkMR|`dfT!CrbTnCvLZyv%M!0quPr0rH(>Iv|Q6cw)c(a zoZFn&<|gGj34ulP#ZwE-Sgz@?bX~vIM!6^9jO*oMagv-&#}NG^9fLJm(W0OU$3u!4pws^#_Cr$uQk`p#&|dTUfSnNEip_a}O-S)Z=G-KGC2fSGsxHLh zy<3!$VvyO41R%}LE;PQvDs<~SZt(td#g|nUVjOxKtp6j-@80bEC5|fQi;wTw6*yrK zBlOr0-3uwiG3hT~JXUeb7q95?Q~J`~!?d})WU@Z*N39~a5|Z~GQas*3_V>my*&kV{ z(6gXE^P7F^rNN=#*lz@ostuwW_CEIZAOpt?T>sOM5;q=V0RO?siS~f7MZgrK2B@-g zWz@uzbbziDt+G)jrbS2#Wcuz}k0JxtYMTgpG8v$Nt2$(QZ<%o}cVuJ<^_e z$erUO71ZDta<<=-OFT01Qf zb|9NiZdjY-)zSl~V>VBEzWMHJ+DEhL--7x)q^)sNl#CY6B&_UO$DAj^-7343SAiA#lh_Cl>R{(}X50Mhd^m*gq{C!)pq2C{ z>bU6TP2<&V&FPhwqX6OXK1rAn3vMBFp@$>Bj-R(yPk2ul>urw}t>m zZAOYH64ob_CGb!P?c}?|jBt)sBRU&H`34HL3=*zl70&yd;Tn14Co-3yR+uNJk~vdq zB2|%~fAG*N0zLPxY=iv$%+OGUK6ug%G}W};VaU1X9J3)yTs;47zf(bO;-i-^7Z!`vD2|-YXKw>u?$5Wf zNJ-HJ{oFD2Fn;?ez!eai?pVrZq5V^QOSRcYR8qh`h;Mnc(wp%pKpa>_%R_(?soEKv zSvY?Fho$jVeAciZ5%WWEMsM^jmC z%ynms;Ha1(Y1ehwp~2wjrl=Z!GjVmbUt_&IEd z>-$Cu8fVqRkiq0J4n0cwydG6YLvb<{G(Q%@?Wsowmt*uhoPu0W{0FeaD^qFSTBT>j zI?%lv!%`XO*YeSu^|{*%ebSNcqHqKZ5)~<)o3@a9=(_Y6mapgX;j-XX)I3WMoXm;h zW(Uhn;HW663jBqd*n!tj{V)G2?rkcjxC&-jh4D|0QD zbh*=oEGdk2hA5A2mEBy`*C!pTO6Uw$Pv}p%KD*TY9BFnx-CFys)lET}EFC1X%*$ek zgI{{HzM~4*Eo!VzsKh1V*&0;lbKa|Q8%13Ap1vSHcR^NLwyEvS z;LMFv`ySV?hOBfo1=%$90d_YZC=4RR3rvJ|T>S7fChlmpf5#deE_@FF(|{}&`Im_) zvWlM~Hbj3>c!Eg&c9wJhgO1B5Jfe@TzO(!+;F=i%qDg=gy<84}?d2%9LwWK9cxV~C z4xHkFzDzbBEubM|Mm~Fszgf5cpfljkKgI|nedoZ=?k{_9WIjV?1>bMpsc0S6{?P?= z#}lu#(xs5&a_Ug?cpd^CZwG(iLc=H_as7svwmvfzKq;c9KM{a17ETV}ePu*wXjmQj z?EJtF1jWN^$J0p_U{M~qgG9iTE!H?UZ-+W&96mK7{p zmLWw0!i_V~Zn6+%=Qein2XJVH6ab#r7jf{Gql=SH@#Kc$ad+-zomKRA;gBvlx5VwI zoXAKfo8;rQd=;%QE$V8+)Bf2wCaThb9VLi7mW`GdQ_H8aC7hAkS>xN(&)TFAdoeQZH@sQgV}Ng762pj|L3i+S=To zW0@h08@0CL_j@t)!}XWXoT}8QL@ilW--@EXOa$Ws%N9JX=VSUKunYga^c+ZZ+cx{> zq(l6!X~5OaztEBt{EfIE(3Cb=r+k&T_!Ly`Yy9&`Tv(7&fI>1Bz@!Rz68ZN*rND2o zCU^zxP;c|X*FJ+P+d_dr6>0`IA?{O5M^E;xS6a~mlqqfah|i9`fN*Ork&E=|6k=<$ zZXp0^lFhk*fA0=givliI_y5#(lJhK4!ICQ#SLkWrEZ?q4YhBxZ7QhrkX9l z3>QIa(2MWk6tg5|>4h?1k9I(K=P0mzR1X@grZx8_I$qO04`Fys3ku~iF*dKS36I3+ zbPB2Zd0fdQ)b{jcF2;Kxn#L40nTt!iLds@d39D|j;YVD>gQd%LeOA-^pn7hT~%&dXGuNPN2q%Wgza1?qXd)k57SnT29 z{M_UZrYYi1F*xbJGW;YBaq<;?3bc-Ba!(a0UpL;-t%I3~CmU3ZuH?G*jzcmf=OKhT z`plqm3Q|C1*H^;tr7l1b6UzU%XMnCh9a_AR6+N)l0tE-yTk9e(DUbYvLE3@fSFv=lUHK35$mI`{8o3n)2ZL~ zW*ABxj-iM}_o@+k=^od?lKmcc;0$`o-z!CBc_a2z72cTEtFeJ}Nq^L!w=U!ql@0hV1O0X#*`6~P`R-#o zi4tLT(XB< zy}YKqQ3`zwWWw;H?{m#Uzm5`u%(`FV>&w52jO(ZOyW4R!QOWOpXhy0kyHyZ)k2|LC z*7N!{H1(Ig;{Ba6tCdQN*349AXDw1!hZ5<##l8)^YU$s?Pr%UZ>1CbRcvo)X`>RSu z%pCdBm_;2VhNB)u!c^mh9MF^txqMaSA|nNCN0Z%}-0+mLlnDM^aBOwD{7jdE(zgin zCjBVpp+lCRsuf%bqlBGUss;GlWuO~Ps3!lInTY z-(O|upA$$MWlOb4;8&3*89?OpZLfTFmrQDBi-~!fMkP1s9jm_ZvXCV%gv7FUql)L) zcH8IEm-3#$Inu{pMkaW(Nd%5a{Vmv+UR9O+V4D^v@ZO2!0b2+(Kl3|P^8I&0J@9%? z$`3u9v{Nsr3;~NS@4+0}_x5&{Gs=*9bK^FcOk&fRH~9h@6`;=iv!vD>KG*+Dp9$!=ffhe+whhgW3^Jw?*l}X zBlX)>CzOp@mo$>nJ{bYH?d7|29;^wzq>4#k7TmGkD0(u)4Y4A$b@8WQaFz&PyM+0U zU#!icH3htO1dx3`AzkkpFv|LPEP!j6m3|7XcR)$ccPYQHWvLy%ljmWu!zdc`h>Cyh zPlw1ZdFmc9-l?LfPrAtpgu{yJ8!H=^sIhMR^+Hs?OFvyd(0GW~=2eS;U;Zx*p4>r) z#tq>yY1;%-(NGV$5%VWMOAi(s{%XtCp?@4*A%0hb)->z0?tH=eCNT{SLkXl%#)wf2 zafYgAq4?;#$ZWd{o5MWv%tPgHqFnEUs8yfN#2jvCV;zFYKe}NPg^cCX?$MKgUacLx z+^0EP0($lVw4@Sfmpb$<@4VfyQpsS;MrOru#l20_NCd}Y$2eMT!kCY?uL2i=bPW5C zRa8&7M8nO6fWeQp{Al7V_%>p&ZYA&2p9D?TZ;oD8y9Z`2G@A2hZojO{lQVKecB(#F zd;0kLfc_uD>%0B|R_URI_NmcfnB$;*yTzP0sm)oZMAH>j7&7Stsm?r{sE%{KEN^D$TMJ)s`7X@;4j0I`Wg6Edf+Jj5if26sw0Fy3jCTITRs)T#==dx&S>=?m+FCJN8)O4; z6sUR7UCR2|ate=M+zU4=90*h>C!NzlX0c!_hvvFUz-dmOQQB|^(XQ$uecFE!T3O-d#ShGCg)F7Rbz(ne ztT|0Pll21`E=^4OR(-zQ!ULHs9Lg8JUX}%8<({gi7Cv6@%uQM5aiC656Q-C3V%hsvo?xc?}n3?Cg8CB zDHDLEZGkz2%ejh&dIwKSGFSSF0~JxX!YOZeg#Xo-CH6BS_&zYh=kj<9$beDQ{Dx;B z83!8}*UtzqERhEr@vu{%jeA_U57X(!_A;BaY(>AA|7TZ5Dx=}uR!Nr_IXAlpaCU$! zQM>=W1#HRMSDNR9BypY4HnQB|?V1uR>q~AYqeY~9}MX5^0NZy^=sSHl>hF(NI%&7JkD_F7< z8K|^DYr#%mncxbPnslT=QTib)I^SW+{MN69I+}WxR-la70)8)=M2#;!k3}aJZkwn1->VobHnL6ej`%wybrOH|W0~ zHNa`oPTgxUO5_kjLQpDzvTv{3Cmr9+TPm-w!yjlR*dSFtSj?OV=X+f}s|`|3EvviB z*(Fm8SA*~oC!wcBR)tmML!I6z>3)$5bY=r@jAHp((P0;*Ir2+PY%yO zpjML6XrO01XVUtcXT-A97*d&!C~L^sC(vX zmSJ~zGXfL%x#)-h0GGMxa0}qfqlnKHpAYDkuUkx)s}``frfFc{IHfzXz>;bj}jd{x3SMEQ^bxBXP_oVj6;r zdiH2E81IWsl7OD_>Y3lmyB^g%EPW3aoAT1$^sa=phyh7n+qm33H9g_o=505gST|$D zq)*+>IhWcAVMO;IhGaH^$vLM3DfcGp`g8pBeacY+?cM;Yr5{0d#yy?mo#FigvOlM% zBC+GWt}SmelppBw!Q(|Py5xjh%W;aSh-o`7ij$sUGCzDo@7xH@4{9O{qo+PFA7O{v zEhCAq$Nw2FBKZ~`@D^7ns{fYvg3)_#74v$#pt<4^6kRJ5I`%&6OvF1J@*_0QS1~b_ z=l(`Bv-Z?C$}&6AS}P^B2$`L;@5e#kLFYw#K7T2u*vw6yyx|okB~W5UXri$fw@4sD z9LiNWpEa)hJ69@j273};>=pjDsmP%kK%9EVFR~Oy`!b^@?j5j*g&^(k&2w-=*c_M)bF=wgSL^x z?1{^kiOQ%&Hbj@z4ML9!tbGg}xLH~fG#;g&_UKEObA%J=(8Tsy1iBu`wn|9L3%^i_2E1zLki$u0qSMkbE{+EsEsXx)cl+d%reJws$BM5_dXx7apMoY%P0YOk zjkMB@Cr)R@5*f7e?-;QT5^mj)%12rv6>PT!5JoruuMsODH!sZs7&e3;_OjbuvTW|8 zqO`jwRDBZf>rjuhWE&ZXtwVkKEk@t$vTna+kKA(s;Y&<9(O-%w^S!NKFo&pK*Nt)Y ze~uF>t4VzwI3en&v)ANVqUz`5b+zWt@$qh^-~m{~IzJfa+CsIh)XY!c9c z=1ldh&AjZ5X~DS@WGJPDsr)-pMZiL|U)9oG-rAw@q1stAqgY|-5&C!u>qac4wMKPPPjsnoo z!g+Krax(cnAXbw@D%I*Zd+ZMnvmZCK`>Wz$J26F`yjX;gy%C<+ZM4OP3T<*FnQb?X z|D0GXkVzOqH)Hz~H^Fq<$I{ecCTXl7@WIo=mLg5kYSZC!aUWkTxzm{?;^E6O(Rwg* zEr(m}Id5a^kq>PmTUkxs2PQGEBd$z}CVEq7blqUBdoC3+ydNl+1#%w3i2$^w%mZPVtK!i(14ZV`vQOK%yduAMg=^G)F88E!Cn0aycn8*M@UAme;NI^K_RiCf63AjH=^gt`Hh*Sx)*JZl zNfC!$>%3?lEA-`il`j3H<5Br`5fBFIH6ZDlCy= zq{3_Q7wBZkg>w&YBZKyu*(nKfS+KU;fh*OctxkCCjzZL$bE zD;A-tBqivK%H`>FdX(F}{!W9%o6m}9S950YeZ!(&uPGH4IpoX#gw%Ft9wK<7Q*56a ze3$q6v0~TR)qWV%LcChZAF_!`Zz*FWN=5_h>TQesY_1Aj>@DUuxT*2D=8bOUVJ3^L z5%0QEf({Tv6Nxkg{0j2(Iwa|*>T|nk43d#NHxuaVCLxj!=kX*2iG>HZW8=&7;~E_@ zgC+G|f0c_fVO8aoC0D1oD}Tru`6>^K20}!PJ|kB<0G8bsi<$O$wlI^O`P7<>gXYsY z8k$h;!N~Op?MZ-tj+eY7LxRWG(GnX!?|1E{6TU$T5jP1i$4_4_lYjDe)y3JU4>!jX z)7fhO-1qW2-3V0usWxU`IX=>Srt;ZKH)}?SBQ6;c$nGK}sM{(oV3}#;_N8@i-obmX zq#w+g@?6G-Y1(V4)mi$NPvPPf>Q8Z~$6UPD;>Zt3!XvzET0SaE^Fe8bX3-BB)r-Fv zr%{4YPzg|ucusp>4^t?f7*{&7TPf{XdTlrGIjT5_TGm|4X3=}FAIxCD2+}8t-Og)I zL*CFkzjbiZqn>>+>r7ZWqu%6qF5>t78PpTL;2Jfx?O?ayFPi>CgS-8O==fQ-jYyvH z`0CdqxJ2gSgnGZ)seVOkZtVFUSL4BU)BI7!4-KMZKPkunN_laibFO|y%lkN`0^#90 zyjXSceCUM9X;+`)Laqbx zxbwkPq0?ds1HH!-Ed$x-)OJIs%*Lzp_hLaIY2bPX)87&M?eGU*DC7cc=wlHMm=9%o zf8@J8LC^Wzu3g!YBE`XoyP)gYaynXYSRhs?tFAFqoB^zfY zIZpyFdxYh)kX8_k?T#Tp!{(6xkB(?41M+?@FU=kDYsj zlA)kbM+KvG)@R_j8*?z6O=QNG{c=@{j29vPl-2XumC`1eUav91!3`DHOTFIOh+Lzy zem{N&o&Fbf^#0?h^!Xe2(%i3Iel9;$^X(6|n6vj0Eum9~_YRc=`9@CTcX?4z;$%DT zFs60snYqx46`O~1?)laIA!eN* zjuuzRDRM{h zJ4fg(2$HuKE?8Dda$Rw&d$PSa7_nK5gk|~_&UD*1Pb?Bby6>RawtZ{vo>$4Y^19=1 z4fwLhw(6u>3=gCc*{>~3sIGS_Ja=HEcZ!+=|0`NnBAbe92=J^2hD`UeqoGHAtX*C_*&uYJ_Flb;&eAzvYD7W!WsOHnca diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index c800d8d29d..87ffeb5b9f 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -62,13 +62,13 @@ To ensure that the auto-enrollment feature is working as expected, you must veri :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: -1. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. +1. When using group policy for enrollment, verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. -1. Verify that Microsoft Intune should allow enrollment of Windows devices. +1. Verify that Microsoft Intune allows enrollment of Windows devices. :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: -## Troubleshoot auto-enrollment using group policy +## Troubleshoot group policy enrollment Investigate the logs if you have issues even after performing all the verification steps. The first log file to investigate is the event log on the target Windows device. To collect Event Viewer logs: diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 12a2e704c9..f1cc2a5917 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -21,7 +21,7 @@ items: - name: MAM support for device management href: implement-server-side-mobile-application-management.md - name: Enroll devices - expanded: true + expanded: false items: - name: Enrollment overview href: mobile-device-enrollment.md @@ -40,7 +40,7 @@ items: - name: On-premises authentication enrollment href: on-premise-authentication-device-enrollment.md - name: Manage devices - expanded: true + expanded: false items: - name: Manage settings href: windows-mdm-enterprise-settings.md @@ -53,6 +53,7 @@ items: - name: Certificate renewal href: certificate-renewal-windows-mdm.md - name: Diagnose MDM failures + expanded: false items: - name: Collect MDM logs href: mdm-collect-logs.md From cc83555504ebbf35aac4498c9ca79d6ebbba48dd Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 12 Apr 2023 11:25:37 -0700 Subject: [PATCH 076/139] Update windows-autopatch-windows-update.md Reviewed --- .../operate/windows-autopatch-windows-update.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md index 2434233e74..9f3d420192 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md @@ -53,11 +53,11 @@ However, if an update has already started for a particular deployment ring, Wind #### Scheduled install > [!NOTE] ->

    If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective).

    +>If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective). -While the Windows Autopatch default options will meet the majority of the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. The **Scheduled install** cadence type will prevent forced restarts and interruptions to critical business activities for end users, thereby minimizing disruptions. Upon selecting the **Scheduled install** cadence type, any previously set deadlines and grace periods will be removed. The expectation is that devices would only update and restart according to the time specified. +While the Windows Autopatch default options will meet the majority of the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. The **Scheduled install** cadence type will minimize disruptions by preventing forced restarts and interruptions to critical business activities for end users. Upon selecting the **Scheduled install** cadence type, any previously set deadlines and grace periods will be removed. Devices will only update and restart according to the time specified. -Scheduled install will ensure that Windows Updates will only cause a device to restart in your specified time windows. If other applications trigger a device restart outside of these windows and a Windows update is pending a restart, the Windows update will complete its installation at this time. For this reason, ensure that you consider your update and restart scenarios for devices running business critical or restart sensitive workloads before using Scheduled Install. +If other applications force a device to restart outside of the specified time and a Windows Update is pending a restart, the Windows Update will complete its installation at this time. For this reason, ensure that you consider your update and restart scenarios for devices running business critical activities, or restart sensitive workloads before using the Scheduled Install option. > [!NOTE] > The compliance deadline and grace period for Windows quality updates won't be configured for the Scheduled Install cadence type. From 18869a05136ceeb8a341a5337c5f4e3a8c39b7d8 Mon Sep 17 00:00:00 2001 From: BMathew <32939761+bmathew17@users.noreply.github.com> Date: Wed, 12 Apr 2023 14:24:49 -0700 Subject: [PATCH 077/139] Update windows-autopatch-faq.yml --- .../windows-autopatch/overview/windows-autopatch-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index 5cbf2a8380..0b990ea9b6 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -96,7 +96,7 @@ sections: - Rollback: For more information about Microsoft 365 Apps for enterprise, see [Update controls for Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md#microsoft-365-apps-for-enterprise-update-controls). - question: Can I permanently pause a Windows feature update deployment? answer: | - Yes. Windows Autopatch provides a [permanent pause of either a feature update deployment](../operate/windows-autopatch-windows-feature-update-overview.md#pausing-and-resuming-a-release). + Yes. Windows Autopatch provides a [permanent pause of a feature update deployment](../operate/windows-autopatch-windows-feature-update-overview.md#pausing-and-resuming-a-release). - question: Will Windows quality updates be released more quickly after vulnerabilities are identified, or what is the regular cadence of updates? answer: | For zero-day threats, Autopatch will have an [expedited release cadence](../operate/windows-autopatch-windows-quality-update-overview.md#expedited-releases). For normal updates Autopatch, uses a [regular release cadence](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) starting with devices in the Test ring and completing with general rollout to the Broad ring. From dc13afe1fdc585ff06a6d1c0f8597d2cf7f1406c Mon Sep 17 00:00:00 2001 From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com> Date: Thu, 13 Apr 2023 15:08:39 +0200 Subject: [PATCH 078/139] Update mandatory-user-profile.md add steps to set the correct owner for the mandatory profile folders --- windows/client-management/mandatory-user-profile.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 0771fcc433..425ea46700 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -118,6 +118,13 @@ First, you create a default user profile with the customizations that you want, 1. Rename `Ntuser.dat` to `Ntuser.man`. +### Check and set the correct owner for the mandatory profile folders + +1. Open the properties of the "profile.v6" folder. +2. Go to the "security" tab and click "Advanced". +3. Check the "owner" of the folder. It has to be the builtin Administrators group. To change it here if it does not match, you need to be in the Administrators group of the file server to take ownership, or have "set owner" privilege on the server. +4. When you have set the owner, check the box "Replace owner on subcontainers and objects" before you click OK. + ## Apply a mandatory user profile to users In a domain, you modify properties for the user account to point to the mandatory profile in a shared folder residing on the server. From 5d94ca3538aaea019f4349be856d4fc9f599ea74 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 13 Apr 2023 10:35:59 -0400 Subject: [PATCH 079/139] Update mandatory-user-profile.md --- windows/client-management/mandatory-user-profile.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 425ea46700..6f1798eb0e 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -118,12 +118,12 @@ First, you create a default user profile with the customizations that you want, 1. Rename `Ntuser.dat` to `Ntuser.man`. -### Check and set the correct owner for the mandatory profile folders +### Verify the correct owner for the mandatory profile folders 1. Open the properties of the "profile.v6" folder. -2. Go to the "security" tab and click "Advanced". -3. Check the "owner" of the folder. It has to be the builtin Administrators group. To change it here if it does not match, you need to be in the Administrators group of the file server to take ownership, or have "set owner" privilege on the server. -4. When you have set the owner, check the box "Replace owner on subcontainers and objects" before you click OK. +1. Select the **Security** tab and then select **Advanced**. +1. Verify the **Owner** of the folder. It must be the builtin **Administrators** group. To change the owner, you must be a member of the Administrators group on the file server, or have "Set owner" privilege on the server. +1. When you set the owner, select **Replace owner on subcontainers and objects** before you click OK. ## Apply a mandatory user profile to users From 6aedc6f12df56df118fbb34ef2ac094b636ec14f Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 13 Apr 2023 11:05:41 -0400 Subject: [PATCH 080/139] Minor updates --- .../bulk-enrollment-using-windows-provisioning-tool.md | 2 +- windows/client-management/client-tools/toc.yml | 4 ++-- windows/client-management/mdm-diagnose-enrollment.md | 5 +---- windows/client-management/mdm-known-issues.md | 5 +---- windows/client-management/toc.yml | 6 +++--- 5 files changed, 8 insertions(+), 14 deletions(-) diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index c7c6829f18..a09f295976 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -16,7 +16,7 @@ appliesto: # Bulk enrollment using Windows Configuration Designer -Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join (Cloud Domain Join) enrollment scenario. +Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. You can use the [Provisioning CSP](mdm/provisioning-csp.md) for bulk enrollment, except for the Azure Active Directory Join enrollment scenario. ## Typical use cases diff --git a/windows/client-management/client-tools/toc.yml b/windows/client-management/client-tools/toc.yml index f40eb9275b..311cb0c84f 100644 --- a/windows/client-management/client-tools/toc.yml +++ b/windows/client-management/client-tools/toc.yml @@ -7,12 +7,12 @@ items: href: connect-to-remote-aadj-pc.md - name: Create mandatory user profiles href: mandatory-user-profile.md - - name: Windows 10 default media removal policy - href: change-default-removal-policy-external-storage-media.md - name: Manage Device Installation with Group Policy href: manage-device-installation-with-group-policy.md - name: Manage the Settings app with Group Policy href: manage-settings-app-with-group-policy.md + - name: Manage default media removal policy + href: change-default-removal-policy-external-storage-media.md - name: What version of Windows am I running href: windows-version-search.md - name: Windows libraries diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index 87ffeb5b9f..d36c8fd5bc 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -8,10 +8,7 @@ ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 06/25/2018 -ms.collection: -- highpri -- tier2 +ms.date: 04/12/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index c6f5a15905..4fa277cae8 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -8,10 +8,7 @@ ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 04/10/2023 -ms.collection: -- highpri -- tier2 +ms.date: 04/12/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index f1cc2a5917..5b714f4154 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -12,13 +12,13 @@ items: href: mdm-overview.md - name: What's new in MDM href: new-in-windows-mdm-enrollment-management.md - - name: Azure Active Directory integration with MDM + - name: Azure Active Directory integration href: azure-active-directory-integration-with-mdm.md - name: Transitioning to modern management href: manage-windows-10-in-your-organization-modern-management.md - - name: Push notification support for device management + - name: Push notification support href: push-notification-windows-mdm.md - - name: MAM support for device management + - name: MAM support href: implement-server-side-mobile-application-management.md - name: Enroll devices expanded: false From 8f25313b72da25290c5ec0944450004858d254e6 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 13 Apr 2023 11:30:06 -0400 Subject: [PATCH 081/139] Update metadata --- .../manage-settings-app-with-group-policy.md | 2 +- .../client-tools/windows-version-search.md | 2 +- .../disconnecting-from-mdm-unenrollment.md | 26 +++++-------------- .../enable-admx-backed-policies-in-mdm.md | 12 ++++----- ...device-automatically-using-group-policy.md | 2 +- .../enterprise-app-management.md | 2 +- windows/client-management/index.yml | 2 +- windows/client-management/mdm-collect-logs.md | 2 +- 8 files changed, 19 insertions(+), 31 deletions(-) diff --git a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md index c796cf1452..a0af81bb73 100644 --- a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md +++ b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md @@ -3,7 +3,7 @@ title: Manage the Settings app with Group Policy description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users. ms.prod: windows-client author: vinaypamnani-msft -ms.date: 09/14/2021 +ms.date: 04/13/2023 ms.reviewer: manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/client-tools/windows-version-search.md b/windows/client-management/client-tools/windows-version-search.md index d6a32eef5f..e7316b19c0 100644 --- a/windows/client-management/client-tools/windows-version-search.md +++ b/windows/client-management/client-tools/windows-version-search.md @@ -4,7 +4,7 @@ description: Discover which version of Windows you're running to determine wheth ms.prod: windows-client author: vinaypamnani-msft ms.author: vinpa -ms.date: 04/30/2018 +ms.date: 04/13/2023 ms.reviewer: manager: aaroncz ms.topic: troubleshooting diff --git a/windows/client-management/disconnecting-from-mdm-unenrollment.md b/windows/client-management/disconnecting-from-mdm-unenrollment.md index 4e2488f898..6e4d3f8d8c 100644 --- a/windows/client-management/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/disconnecting-from-mdm-unenrollment.md @@ -1,14 +1,14 @@ --- title: Disconnecting from the management infrastructure (unenrollment) description: Disconnecting is initiated either locally by the user using a phone or remotely by the IT admin using management server. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 06/26/2017 +ms.date: 04/13/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -16,7 +16,7 @@ appliesto: # Disconnecting from the management infrastructure (unenrollment) -The Disconnecting process is done either locally by the user who uses a phone or remotely by the IT administrator using management server. The user-initiated disconnection process is similar to the initial connection, wherein its initiation is from the same location in the Setting Control Panel as creating the workplace account. +The Disconnecting process is done either locally by the user who uses a phone or remotely by the IT administrator using management server. The user-initiated disconnection process is similar to the initial connection, wherein its initiation is from the same location in the Setting Control Panel as creating the workplace account. The users choose to disconnect for any number of reasons, such as the ones described below: leaving the company or getting a new device or not needing access to their LOB apps on the old device, anymore. When an IT administrator initiates a disconnection, the enrollment client performs the disconnection during the next regular maintenance session. Administrators choose to disconnect users' device after they've left the company or because the device is regularly failing to comply with the organization's security settings policy. During disconnection, the client executes the following tasks: @@ -27,14 +27,6 @@ During disconnection, the client executes the following tasks: - Removes the device management client configuration and other setting configuration added by MDM server, including the scheduled maintenance task. The client remains dormant unless the user reconnects it to the management infrastructure. - Reports successfully initiated disassociation to the management infrastructure if the admin initiated the process. In Windows, a user-initiated disassociation is reported to the server as a best effort. -## In this topic - -- [User-initiated disconnection](#user-initiated-disconnection) -- [Server-initiated disconnection](#server-initiated-disconnection) -- [Unenrollment from Work Access settings page](#unenrollment-from-work-access-settings-page) -- [IT admin-requested disconnection](#it-admin-requested-disconnection) -- [Unenrollment from Azure Active Directory Join](#dataloss) - ## User-initiated disconnection In Windows, after the user confirms the account deletion command and before the account is deleted, the MDM client will notify to the MDM server that the account will be removed. This notification is a best-effort action as no retry is built-in to ensure the notification is successfully sent to the device. @@ -44,14 +36,13 @@ This action utilizes the OMA DM generic alert 1226 function to send a user an MD > [!NOTE] > The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, see the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/). - The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**. After the user elects to unenroll, any active MDM OMA DM sessions are terminated. After that, the DM client starts a DM session, including a user unenroll generic alert in the first package that it sends to the server. The following sample shows an OMA DM first package that contains a generic alert message. For more information on WP OMA DM support, see the [OMA DM protocol support](oma-dm-protocol-support.md) topic. -``` +```xml 1.2 @@ -100,7 +91,7 @@ After the previous package is sent, the unenrollment process begins. ## Server-initiated disconnection -When the server initiates disconnection, all undergoing sessions for the enrollment ID are aborted immediately to avoid deadlocks. The server will not get a response for the unenrollment, instead a generic alert notification is sent with messageid=1. +When the server initiates disconnection, all undergoing sessions for the enrollment ID are aborted immediately to avoid deadlocks. The server will not get a response for the unenrollment, instead a generic alert notification is sent with `messageid=1`. ```xml @@ -116,7 +107,6 @@ When the server initiates disconnection, all undergoing sessions for the enrollm ``` - ## Unenrollment from Work Access settings page If the user is enrolled into MDM using an Azure Active Directory (AAD Join or by adding a Microsoft work account), the MDM account will show up under the Work Access page. However, the **Disconnect** button is greyed out and not accessible. Users can remove that MDM account by removing the Azure AD association to the device. @@ -126,20 +116,18 @@ You can only use the Work Access page to unenroll under the following conditions - Enrollment was done using bulk enrollment. - Enrollment was created using the Work Access page. - ## Unenrollment from Azure Active Directory Join When a user is enrolled into MDM through Azure Active Directory Join and later, the enrollment disconnects, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. ![aadj unenerollment.](images/azure-ad-unenrollment.png) -During the process in which a device is enrolled into MDM through Azure Active Directory Join and then remotely unenrolled, the device may get into a state where it must be reimaged. When devices are remotely unenrolled from MDM, the Azure Active Directory association is also removed. This safeguard is in place to avoid leaving the corporated devices in unmanaged state. +During the process in which a device is enrolled into MDM through Azure Active Directory Join and then remotely unenrolled, the device may get into a state where it must be re-imaged. When devices are remotely unenrolled from MDM, the Azure Active Directory association is also removed. This safeguard is in place to avoid leaving the corporate devices in un-managed state. -Before remotely unenrolling corporate devices, you must ensure that there is at least one admin user on the device that is not part of the Azure tenant, otherwise the device will not have any admin user after the operation. +Before remotely un-enrolling corporate devices, you must ensure that there is at least one admin user on the device that is not part of the Azure tenant, otherwise the device will not have any admin user after the operation. In mobile devices, remote unenrollment for Azure Active Directory Joined devices will fail. To remove corporate content from these devices, we recommend you remotely wipe the device. - ## IT admin-requested disconnection The server requests an enterprise management disconnection by issuing an Exec OMA DM SyncML XML command to the device, using the DMClient configuration service provider's Unenroll node during the next client-initiated DM session. The Data tag inside the Exec command should be the value of the provisioned DM server ProviderID. For more information, see the Enterprise-specific DMClient configuration topic. diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index 1983b4f76f..03f598f6ae 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -102,17 +102,17 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ ![Enable publishing server 2 settings.](images/admx-app-v-enablepublishingserver2settings.png) - 2. Find the variable names of the parameters in the ADMX file. + 1. Find the variable names of the parameters in the ADMX file. You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](mdm/policy-csp-appvirtualization.md#publishingallowserver2). ![Publishing server 2 policy description.](images/admx-appv-policy-description.png) - 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the ADMX files) and open appv.admx. + 1. Navigate to **C:\Windows\PolicyDefinitions** (default location of the ADMX files) and open appv.admx. - 4. Search for GP name **Publishing_Server2_policy**. + 1. Search for GP name **Publishing_Server2_policy**. - 5. Under **policy name="Publishing_Server2_Policy"** you can see the \ listed. The *text id* and *enum id* represent the *data id* you need to include in the SyncML data payload. They correspond to the fields you see in the Group Policy Editor. + 1. Under **policy name="Publishing_Server2_Policy"** you can see the \ listed. The *text id* and *enum id* represent the *data id* you need to include in the SyncML data payload. They correspond to the fields you see in the Group Policy Editor. Here's the snippet from appv.admx: @@ -204,7 +204,7 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ ``` - 6. From the **\** tag, copy all of the *text id* and *enum id* and create an XML with *data id* and *value* fields. The *value* field contains the configuration settings that you would enter in the Group Policy Editor. + 1. From the **\** tag, copy all of the *text id* and *enum id* and create an XML with *data id* and *value* fields. The *value* field contains the configuration settings that you would enter in the Group Policy Editor. Here's the example XML for Publishing_Server2_Policy: @@ -221,7 +221,7 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ ``` - 7. Create the SyncML to enable the policy. Payload contains \ and name/value pairs. + 1. Create the SyncML to enable the policy. Payload contains \ and name/value pairs. Here's the example for **AppVirtualization/PublishingAllowServer2**: diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index a81c66fd6c..b06a046e5b 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 04/30/2022 +ms.date: 04/13/2023 ms.reviewer: manager: aaroncz ms.collection: diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index f21b883f35..197087b7dc 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -8,7 +8,7 @@ ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 04/05/2023 +ms.date: 04/13/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index 74bdfba5df..8b288e7905 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -15,7 +15,7 @@ metadata: author: aczechowski ms.author: aaroncz manager: dougeby - ms.date: 03/28/2022 #Required; mm/dd/yyyy format. + ms.date: 04/13/2023 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/client-management/mdm-collect-logs.md b/windows/client-management/mdm-collect-logs.md index df8b03a6cc..d544eab6d4 100644 --- a/windows/client-management/mdm-collect-logs.md +++ b/windows/client-management/mdm-collect-logs.md @@ -8,7 +8,7 @@ ms.topic: article ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 06/25/2018 +ms.date: 04/13/2023 ms.collection: - highpri - tier2 From ea34b6e41acfe4bdac2ec6764dfe67d9b2fc0efc Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 13 Apr 2023 17:46:38 -0400 Subject: [PATCH 082/139] Update docfx --- windows/client-management/docfx.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index c3e140606c..c90a4dfc5f 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -43,7 +43,7 @@ "ms.technology": "itpro-manage", "audience": "ITPro", "ms.topic": "article", - "manager": "dansimp", + "manager": "aaroncz", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", "feedback_product_url": "https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332", @@ -55,10 +55,10 @@ }, "titleSuffix": "Windows Client Management", "contributors_to_exclude": [ - "rjagiewich", - "traya1", - "rmca14", - "claydetels19", + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", "jborsecnik", "tiburd", "garycentric", From 7111b7ce4698ee32233a6b1cdae37e7d4e7749a3 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:31:58 -0400 Subject: [PATCH 083/139] Update ms.topic to reference for CSP articles --- windows/client-management/mdm/accountmanagement-csp.md | 4 ++-- windows/client-management/mdm/accountmanagement-ddf.md | 4 ++-- windows/client-management/mdm/accounts-csp.md | 4 ++-- windows/client-management/mdm/accounts-ddf-file.md | 4 ++-- windows/client-management/mdm/alljoynmanagement-csp.md | 4 ++-- windows/client-management/mdm/alljoynmanagement-ddf.md | 4 ++-- windows/client-management/mdm/application-csp.md | 4 ++-- windows/client-management/mdm/cellularsettings-csp.md | 4 ++-- windows/client-management/mdm/cleanpc-csp.md | 4 ++-- windows/client-management/mdm/cleanpc-ddf.md | 4 ++-- windows/client-management/mdm/cm-cellularentries-csp.md | 4 ++-- windows/client-management/mdm/cmpolicy-csp.md | 4 ++-- windows/client-management/mdm/cmpolicyenterprise-csp.md | 4 ++-- windows/client-management/mdm/cmpolicyenterprise-ddf-file.md | 4 ++-- .../mdm/configuration-service-provider-ddf.md | 2 +- .../mdm/configuration-service-provider-support.md | 2 +- windows/client-management/mdm/customdeviceui-csp.md | 4 ++-- windows/client-management/mdm/customdeviceui-ddf.md | 4 ++-- windows/client-management/mdm/developersetup-csp.md | 4 ++-- windows/client-management/mdm/developersetup-ddf.md | 4 ++-- windows/client-management/mdm/devicelock-csp.md | 4 ++-- windows/client-management/mdm/devicelock-ddf-file.md | 4 ++-- windows/client-management/mdm/dmsessionactions-csp.md | 4 ++-- windows/client-management/mdm/dmsessionactions-ddf.md | 4 ++-- windows/client-management/mdm/dynamicmanagement-csp.md | 2 +- windows/client-management/mdm/dynamicmanagement-ddf.md | 4 ++-- windows/client-management/mdm/eap-configuration.md | 2 +- .../client-management/mdm/enrollmentstatustracking-csp-ddf.md | 2 +- windows/client-management/mdm/enrollmentstatustracking-csp.md | 2 +- windows/client-management/mdm/enterpriseapn-csp.md | 4 ++-- windows/client-management/mdm/enterpriseapn-ddf.md | 4 ++-- windows/client-management/mdm/enterpriseappvmanagement-csp.md | 4 ++-- windows/client-management/mdm/enterpriseappvmanagement-ddf.md | 4 ++-- windows/client-management/mdm/enterprisedataprotection-csp.md | 4 ++-- .../mdm/enterprisedataprotection-ddf-file.md | 4 ++-- windows/client-management/mdm/multisim-csp.md | 4 ++-- windows/client-management/mdm/multisim-ddf.md | 4 ++-- windows/client-management/mdm/nap-csp.md | 4 ++-- windows/client-management/mdm/napdef-csp.md | 4 ++-- ...licy-csp-supported-by-hololens-1st-gen-commercial-suite.md | 2 +- ...y-csp-supported-by-hololens-1st-gen-development-edition.md | 2 +- .../mdm/policies-in-policy-csp-supported-by-hololens2.md | 2 +- .../mdm/policies-in-policy-csp-supported-by-iot-core.md | 2 +- .../mdm/policies-in-policy-csp-that-can-be-set-using-eas.md | 2 +- windows/client-management/mdm/policy-csp-feeds.md | 4 ++-- windows/client-management/mdm/provisioning-csp.md | 4 ++-- windows/client-management/mdm/pxlogical-csp.md | 4 ++-- windows/client-management/mdm/remotefind-csp.md | 4 ++-- windows/client-management/mdm/remotefind-ddf-file.md | 4 ++-- windows/client-management/mdm/reporting-csp.md | 4 ++-- windows/client-management/mdm/reporting-ddf-file.md | 4 ++-- windows/client-management/mdm/secureassessment-csp.md | 4 ++-- windows/client-management/mdm/secureassessment-ddf-file.md | 4 ++-- windows/client-management/mdm/securitypolicy-csp.md | 4 ++-- windows/client-management/mdm/storage-csp.md | 4 ++-- windows/client-management/mdm/storage-ddf-file.md | 4 ++-- windows/client-management/mdm/tenantlockdown-csp.md | 4 ++-- windows/client-management/mdm/tenantlockdown-ddf.md | 4 ++-- windows/client-management/mdm/tpmpolicy-csp.md | 4 ++-- windows/client-management/mdm/tpmpolicy-ddf-file.md | 4 ++-- windows/client-management/mdm/uefi-csp.md | 2 +- windows/client-management/mdm/uefi-ddf.md | 4 ++-- windows/client-management/mdm/unifiedwritefilter-csp.md | 4 ++-- windows/client-management/mdm/unifiedwritefilter-ddf.md | 4 ++-- windows/client-management/mdm/universalprint-csp.md | 2 +- windows/client-management/mdm/universalprint-ddf-file.md | 2 +- windows/client-management/mdm/update-csp.md | 4 ++-- windows/client-management/mdm/update-ddf-file.md | 4 ++-- windows/client-management/mdm/vpn-csp.md | 4 ++-- windows/client-management/mdm/vpn-ddf-file.md | 4 ++-- windows/client-management/mdm/w4-application-csp.md | 4 ++-- windows/client-management/mdm/w7-application-csp.md | 4 ++-- windows/client-management/mdm/win32appinventory-csp.md | 4 ++-- windows/client-management/mdm/win32appinventory-ddf-file.md | 4 ++-- .../client-management/mdm/win32compatibilityappraiser-csp.md | 4 ++-- .../client-management/mdm/win32compatibilityappraiser-ddf.md | 4 ++-- .../mdm/windowsadvancedthreatprotection-csp.md | 4 ++-- .../mdm/windowsadvancedthreatprotection-ddf.md | 4 ++-- windows/client-management/mdm/windowsautopilot-csp.md | 4 ++-- windows/client-management/mdm/windowsautopilot-ddf-file.md | 4 ++-- 80 files changed, 146 insertions(+), 146 deletions(-) diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index c79bf9d6b9..9863ad1ccf 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -2,12 +2,12 @@ title: AccountManagement CSP description: Learn about the AccountManagement CSP, which is used to configure settings in the Account Manager service. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 03/23/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index f621db9654..c6ec83beff 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -2,12 +2,12 @@ title: AccountManagement DDF file description: View the OMA DM device description framework (DDF) for the AccountManagement configuration service provider. This file is used to configure settings. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 03/23/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index 0bacf6f8d2..9e3a505d95 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -2,12 +2,12 @@ title: Accounts CSP description: The Accounts configuration service provider (CSP) is used by the enterprise to rename devices, and create local Windows accounts & join them to a group. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 03/27/2020 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md index afd14959c5..330218b819 100644 --- a/windows/client-management/mdm/accounts-ddf-file.md +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -2,12 +2,12 @@ title: Accounts DDF file description: View the XML file containing the device description framework (DDF) for the Accounts configuration service provider. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 04/17/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index d123dc8037..c87f85294d 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -1,10 +1,10 @@ --- title: AllJoynManagement CSP description: The AllJoynManagement configuration service provider (CSP) allows an IT administrator to enumerate the AllJoyn devices that are connected to the AllJoyn bus. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index f5a886a028..32030275e8 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -1,10 +1,10 @@ --- title: AllJoynManagement DDF description: Learn the OMA DM device description framework (DDF) for the AllJoynManagement configuration service provider. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index 03d9b18055..c53a080791 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -1,10 +1,10 @@ --- title: APPLICATION CSP description: Learn how the APPLICATION configuration service provider is used to configure an application transport using Open Mobile Alliance (OMA) Client Provisioning. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index f64cf2be86..629021dd17 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -1,10 +1,10 @@ --- title: CellularSettings CSP description: Learn how the CellularSettings configuration service provider is used to configure cellular settings on a mobile device. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/cleanpc-csp.md b/windows/client-management/mdm/cleanpc-csp.md index 4252fc2469..a1b634ff45 100644 --- a/windows/client-management/mdm/cleanpc-csp.md +++ b/windows/client-management/mdm/cleanpc-csp.md @@ -2,12 +2,12 @@ title: CleanPC CSP description: The CleanPC configuration service provider (CSP) allows you to remove user-installed and pre-installed applications, with the option to persist user data. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/cleanpc-ddf.md b/windows/client-management/mdm/cleanpc-ddf.md index b9905656b8..1bc37c5325 100644 --- a/windows/client-management/mdm/cleanpc-ddf.md +++ b/windows/client-management/mdm/cleanpc-ddf.md @@ -1,10 +1,10 @@ --- title: CleanPC DDF description: Learn about the OMA DM device description framework (DDF) for the CleanPC configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index bc1967ab1b..1997c7878c 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -1,10 +1,10 @@ --- title: CM\_CellularEntries CSP description: Learn how to configure the General Packet Radio Service (GPRS) entries using the CM\_CellularEntries CSP. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index e8cd768732..caf0856091 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -1,10 +1,10 @@ --- title: CMPolicy CSP description: Learn how the CMPolicy configuration service provider (CSP) is used to define rules that the Connection Manager uses to identify correct connections. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index 55ae5b8083..72db3fe0f1 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -1,10 +1,10 @@ --- title: CMPolicyEnterprise CSP description: Learn how the CMPolicyEnterprise CSP is used to define rules that the Connection Manager uses to identify the correct connection for a connection request. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md index 35f1e9f495..15d65b1bc8 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md +++ b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md @@ -1,10 +1,10 @@ --- title: CMPolicyEnterprise DDF file description: Learn about the OMA DM device description framework (DDF) for the CMPolicyEnterprise configuration service provider. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/configuration-service-provider-ddf.md b/windows/client-management/mdm/configuration-service-provider-ddf.md index c8fad72461..121ac1c046 100644 --- a/windows/client-management/mdm/configuration-service-provider-ddf.md +++ b/windows/client-management/mdm/configuration-service-provider-ddf.md @@ -4,7 +4,7 @@ description: Learn more about the OMA DM device description framework (DDF) for ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/configuration-service-provider-support.md b/windows/client-management/mdm/configuration-service-provider-support.md index 80f903585c..578d4aa804 100644 --- a/windows/client-management/mdm/configuration-service-provider-support.md +++ b/windows/client-management/mdm/configuration-service-provider-support.md @@ -4,7 +4,7 @@ description: Learn more about configuration service provider (CSP) supported sce ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 1731f78223..7e206209d2 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -1,10 +1,10 @@ --- title: CustomDeviceUI CSP description: Learn how the CustomDeviceUI configuration service provider (CSP) allows OEMs to implement their custom foreground application. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 1c2b2eb1e0..78d4037e82 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -1,10 +1,10 @@ --- title: CustomDeviceUI DDF description: Learn about the OMA DM device description framework (DDF) for the CustomDeviceUI configuration service provider. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index 56d85eb234..55b326e83b 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -1,10 +1,10 @@ --- title: DeveloperSetup CSP description: The DeveloperSetup configuration service provider (CSP) is used to configure developer mode on the device. This CSP was added in the Windows 10, version 1703. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/developersetup-ddf.md b/windows/client-management/mdm/developersetup-ddf.md index 5194793e17..daa6a0b7f9 100644 --- a/windows/client-management/mdm/developersetup-ddf.md +++ b/windows/client-management/mdm/developersetup-ddf.md @@ -1,10 +1,10 @@ --- title: DeveloperSetup DDF file description: This topic shows the OMA DM device description framework (DDF) for the DeveloperSetup configuration service provider. This CSP was added in Windows 10, version 1703. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index b10bd93a62..ab39986c26 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -1,10 +1,10 @@ --- title: DeviceLock CSP description: Learn how the DeviceLock configuration service provider (CSP) is used by the enterprise management server to configure device lock related policies. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index a7baeea8fe..03f27aef68 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -1,10 +1,10 @@ --- title: DeviceLock DDF file description: Learn about the OMA DM device description framework (DDF) for the DeviceLock configuration service provider (CSP). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index b7d129f30a..cb1f8535c4 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -2,12 +2,12 @@ title: DMSessionActions CSP description: Learn how the DMSessionActions configuration service provider (CSP) is used to manage the number of sessions the client skips if the device is in a low-power state. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index bbf9287698..3fd2404a22 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -2,12 +2,12 @@ title: DMSessionActions DDF file description: Learn about the OMA DM device description framework (DDF) for the DMSessionActions configuration service provider (CSP). ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index 5a0260cdc0..bf39a0e3fd 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -2,7 +2,7 @@ title: DynamicManagement CSP description: Learn how the Dynamic Management configuration service provider (CSP) enables configuration of policies that change how the device is managed. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index e4b4235d51..a5456ee32d 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -1,10 +1,10 @@ --- title: DynamicManagement DDF file description: Learn about the OMA DM device description framework (DDF) for the DynamicManagement configuration service provider (CSP). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 7f96c29f4f..9b4bb74c16 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -4,7 +4,7 @@ description: Learn how to create an Extensible Authentication Protocol (EAP) con ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index a7cf76b52f..35513a778a 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -2,7 +2,7 @@ title: EnrollmentStatusTracking DDF description: View the OMA DM DDF for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md index 01d414693b..d3c9c60797 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -2,7 +2,7 @@ title: EnrollmentStatusTracking CSP description: Learn how to execute a hybrid certificate trust deployment of Windows Hello for Business, for systems with no previous installations. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index abbf2c055b..2c93f02a94 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -1,10 +1,10 @@ --- title: EnterpriseAPN CSP description: The EnterpriseAPN configuration service provider is used by the enterprise to provision an APN for the Internet. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index df2d42aa34..665a9234c3 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -1,10 +1,10 @@ --- title: EnterpriseAPN DDF description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAPN configuration service provider (CSP). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index f283d78393..c6ad92193c 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -2,12 +2,12 @@ title: EnterpriseAppVManagement CSP description: Examine the tree format for EnterpriseAppVManagement CSP to manage virtual applications in Windows 10 or Windows 11 PCs. (Enterprise and Education editions). ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index 95e991df6b..fa2e075e71 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -2,12 +2,12 @@ title: EnterpriseAppVManagement DDF file description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAppVManagement configuration service provider (CSP). ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index 3a3a87afe4..a6c2a4662b 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -2,10 +2,10 @@ title: EnterpriseDataProtection CSP description: Learn how the EnterpriseDataProtection configuration service provider (CSP) configures Windows Information Protection (formerly, Enterprise Data Protection) settings. ms.assetid: E2D4467F-A154-4C00-9208-7798EF3E25B3 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md index cde4878163..73469ecfa7 100644 --- a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md +++ b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md @@ -1,10 +1,10 @@ --- title: EnterpriseDataProtection DDF file description: The following topic shows the OMA DM device description framework (DDF) for the EnterpriseDataProtection configuration service provider. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index dad200f3b6..b225f2f4c3 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -2,12 +2,12 @@ title: MultiSIM CSP description: MultiSIM configuration service provider (CSP) allows the enterprise to manage devices with dual SIM single active configuration. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 03/22/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md index 492326bc04..55f8ef2b32 100644 --- a/windows/client-management/mdm/multisim-ddf.md +++ b/windows/client-management/mdm/multisim-ddf.md @@ -2,12 +2,12 @@ title: MultiSIM DDF file description: XML file containing the device description framework for the MultiSIM configuration service provider. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 02/27/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index 95cd0ee469..801f6fc15d 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -1,10 +1,10 @@ --- title: NAP CSP description: Learn how the Network Access Point (NAP) configuration service provider (CSP) is used to manage and query GPRS and CDMA connections. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 615e9f4a47..4af7ac6717 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -1,10 +1,10 @@ --- title: NAPDEF CSP description: Learn how the NAPDEF configuration service provider (CSP) is used to add, modify, or delete WAP network access points (NAPs). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md index 0bdb057669..2329114e1b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md @@ -4,7 +4,7 @@ description: Learn the policies in Policy CSP supported by HoloLens (1st gen) Co ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md index d610e84f01..631059455e 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by HoloLens (1st g ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index b34eebfedb..11a4bb0c2c 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by HoloLens 2. ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md index e15af01618..a538f58f8d 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Windows 10 IoT ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md index 3d2e78b195..b2cb734aa7 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md +++ b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP that can be set using Exchan ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/policy-csp-feeds.md b/windows/client-management/mdm/policy-csp-feeds.md index 58d44e12de..a8a7ae5f57 100644 --- a/windows/client-management/mdm/policy-csp-feeds.md +++ b/windows/client-management/mdm/policy-csp-feeds.md @@ -2,13 +2,13 @@ title: Policy CSP - Feeds description: Use the Policy CSP - Feeds setting policy specifies whether news and interests is allowed on the device. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 09/17/2021 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md index dfa0ed323d..11e636ca48 100644 --- a/windows/client-management/mdm/provisioning-csp.md +++ b/windows/client-management/mdm/provisioning-csp.md @@ -1,10 +1,10 @@ --- title: Provisioning CSP description: The Provisioning configuration service provider is used for bulk user enrollment to an MDM service. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 82b9629e4d..bfc6a262c4 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -1,10 +1,10 @@ --- title: PXLOGICAL configuration service provider description: The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md index 8430142ede..2b3973921d 100644 --- a/windows/client-management/mdm/remotefind-csp.md +++ b/windows/client-management/mdm/remotefind-csp.md @@ -1,10 +1,10 @@ --- title: RemoteFind CSP description: The RemoteFind configuration service provider retrieves the location information for a particular device. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md index b0a282ba66..e805197cf2 100644 --- a/windows/client-management/mdm/remotefind-ddf-file.md +++ b/windows/client-management/mdm/remotefind-ddf-file.md @@ -1,10 +1,10 @@ --- title: RemoteFind DDF file description: This topic shows the OMA DM device description framework (DDF) for the RemoteFind configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md index 7921654d92..a6ff79d5e1 100644 --- a/windows/client-management/mdm/reporting-csp.md +++ b/windows/client-management/mdm/reporting-csp.md @@ -1,10 +1,10 @@ --- title: Reporting CSP description: The Reporting configuration service provider is used to retrieve Windows Information Protection (formerly known as Enterprise Data Protection) and security auditing logs. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md index 1681b2d8c2..71c1e4a728 100644 --- a/windows/client-management/mdm/reporting-ddf-file.md +++ b/windows/client-management/mdm/reporting-ddf-file.md @@ -1,10 +1,10 @@ --- title: Reporting DDF file description: View the OMA DM device description framework (DDF) for the Reporting configuration service provider. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 196eff5292..6c9fbf4445 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -1,10 +1,10 @@ --- title: SecureAssessment CSP description: Learn how the SecureAssessment configuration service provider (CSP) is used to provide configuration information for the secure assessment browser. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index 4225ec9c51..57f576724e 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,10 +1,10 @@ --- title: SecureAssessment DDF file description: View the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 3ca90e30a3..49390c0ef7 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -1,10 +1,10 @@ --- title: SecurityPolicy CSP description: The SecurityPolicy CSP is used to configure security policy settings for WAP push, OMA DM, Service Indication (SI), Service Loading (SL), and MMS. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md index e1e42f6685..7593043812 100644 --- a/windows/client-management/mdm/storage-csp.md +++ b/windows/client-management/mdm/storage-csp.md @@ -1,10 +1,10 @@ --- title: Storage CSP description: Learn how the Storage enterprise configuration service provider (CSP) is used to configure the storage card settings. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md index 508dfb3f66..9b582019e9 100644 --- a/windows/client-management/mdm/storage-ddf-file.md +++ b/windows/client-management/mdm/storage-ddf-file.md @@ -1,10 +1,10 @@ --- title: Storage DDF file description: Learn about the OMA DM device description framework (DDF) for the Storage configuration service provider (CSP). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/tenantlockdown-csp.md b/windows/client-management/mdm/tenantlockdown-csp.md index 615cdfaa7a..7c469706c0 100644 --- a/windows/client-management/mdm/tenantlockdown-csp.md +++ b/windows/client-management/mdm/tenantlockdown-csp.md @@ -2,12 +2,12 @@ title: TenantLockdown CSP description: To lock a device to a tenant to prevent accidental or intentional resets or wipes, use the TenantLockdown configuration service provider. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 08/13/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md index 788ba62e5c..3aa78e83a1 100644 --- a/windows/client-management/mdm/tenantlockdown-ddf.md +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -2,12 +2,12 @@ title: TenantLockdown DDF file description: XML file containing the device description framework for the TenantLockdown configuration service provider (CSP). ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 08/13/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index ceee66f4b0..5486abb6d0 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -2,12 +2,12 @@ title: TPMPolicy CSP description: The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero-exhaust configuration on a Windows device for TPM software components. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 11/01/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md index b4bcb92ce0..2987a036eb 100644 --- a/windows/client-management/mdm/tpmpolicy-ddf-file.md +++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md @@ -2,12 +2,12 @@ title: TPMPolicy DDF file description: Learn about the OMA DM device description framework (DDF) for the TPMPolicy configuration service provider (CSP). ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md index b6cc17127d..a818eb9880 100644 --- a/windows/client-management/mdm/uefi-csp.md +++ b/windows/client-management/mdm/uefi-csp.md @@ -2,7 +2,7 @@ title: UEFI CSP description: The Uefi CSP interfaces to UEFI's Device Firmware Configuration Interface (DFCI) to make BIOS configuration changes. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/uefi-ddf.md b/windows/client-management/mdm/uefi-ddf.md index 89a1f72465..dde7789737 100644 --- a/windows/client-management/mdm/uefi-ddf.md +++ b/windows/client-management/mdm/uefi-ddf.md @@ -2,12 +2,12 @@ title: UEFI DDF file description: Learn about the OMA DM device description framework (DDF) for the Uefi configuration service provider (CSP). ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index b4e14b056c..b35a740976 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -1,10 +1,10 @@ --- title: UnifiedWriteFilter CSP description: The UnifiedWriteFilter (UWF) configuration service provider allows you to remotely manage the UWF. Understand how it helps protect physical storage media. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/unifiedwritefilter-ddf.md b/windows/client-management/mdm/unifiedwritefilter-ddf.md index c44499af11..ffaf61bb19 100644 --- a/windows/client-management/mdm/unifiedwritefilter-ddf.md +++ b/windows/client-management/mdm/unifiedwritefilter-ddf.md @@ -1,10 +1,10 @@ --- title: UnifiedWriteFilter DDF File description: UnifiedWriteFilter DDF File -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/universalprint-csp.md b/windows/client-management/mdm/universalprint-csp.md index c004954f59..cfaae48b05 100644 --- a/windows/client-management/mdm/universalprint-csp.md +++ b/windows/client-management/mdm/universalprint-csp.md @@ -2,7 +2,7 @@ title: UniversalPrint CSP description: Learn how the UniversalPrint configuration service provider (CSP) is used to install printers on Windows client devices. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/universalprint-ddf-file.md b/windows/client-management/mdm/universalprint-ddf-file.md index 86b77653c2..3d3fdc2426 100644 --- a/windows/client-management/mdm/universalprint-ddf-file.md +++ b/windows/client-management/mdm/universalprint-ddf-file.md @@ -2,7 +2,7 @@ title: UniversalPrint DDF file description: UniversalPrint DDF file ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index fa7376a759..9a3988642d 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -1,10 +1,10 @@ --- title: Update CSP description: Learn how the Update configuration service provider (CSP) enables IT administrators to manage and control the rollout of new updates. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index 3e5be4786d..a1ba78b157 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -1,10 +1,10 @@ --- title: Update DDF file description: Learn about the OMA DM device description framework (DDF) for the Update configuration service provider (CSP). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 0ef20477a4..4f43fb1e32 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -1,10 +1,10 @@ --- title: VPN CSP description: Learn how the VPN configuration service provider (CSP) allows the mobile device management (MDM) server to configure the VPN profile of the device. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index db77d0704f..f3df5126a9 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -1,10 +1,10 @@ --- title: VPN DDF file description: Learn about the OMA DM device description framework (DDF) for the VPN configuration service provider (CSP). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index dea054addd..6b33ccc664 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -1,10 +1,10 @@ --- title: w4 APPLICATION CSP description: Use an APPLICATION configuration service provider (CSP) that has an APPID of w4 to configure Multimedia Messaging Service (MMS). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index e58f0e5922..0c5e7f4cd5 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -1,10 +1,10 @@ --- title: w7 APPLICATION CSP description: Learn that the APPLICATION configuration service provider (CSP) that has an APPID of w7 is used for bootstrapping a device with an OMA DM account. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index c0862b854f..d76120673d 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -1,10 +1,10 @@ --- title: Win32AppInventory CSP description: Learn how the Win32AppInventory configuration service provider (CSP) is used to provide an inventory of installed applications on a device. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 8825199231..413f6927a8 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -1,10 +1,10 @@ --- title: Win32AppInventory DDF file description: Learn about the OMA DM device description framework (DDF) for the Win32AppInventory configuration service provider (CSP). -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index 9f3d0f3181..72e4dc7e0d 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -2,12 +2,12 @@ title: Win32CompatibilityAppraiser CSP description: Learn how the Win32CompatibilityAppraiser configuration service provider enables the IT admin to query the current status of the Appraiser and UTC telemetry health. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 07/19/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md index 9fec57ce5d..2412d86ade 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md @@ -2,12 +2,12 @@ title: Win32CompatibilityAppraiser DDF file description: Learn about the XML file containing the device description framework for the Win32CompatibilityAppraiser configuration service provider. ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 07/19/2018 -ms.reviewer: +ms.reviewer: manager: aaroncz --- diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index fc74d86711..ab6d3cfd03 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -1,10 +1,10 @@ --- title: WindowsAdvancedThreatProtection CSP description: The Windows Defender Advanced Threat Protection (WDATP) CSP allows IT Admins to onboard, determine configuration and health status, and offboard endpoints for WDATP. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index b1cbacd77d..1e3460593d 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -2,10 +2,10 @@ title: WindowsAdvancedThreatProtection DDF file description: Learn about the OMA DM device description framework (DDF) for the WindowsAdvancedThreatProtection configuration service provider (CSP). ms.assetid: 0C62A790-4351-48AF-89FD-7D46C42D13E0 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/windowsautopilot-csp.md b/windows/client-management/mdm/windowsautopilot-csp.md index 34d9296f84..7a34b0a995 100644 --- a/windows/client-management/mdm/windowsautopilot-csp.md +++ b/windows/client-management/mdm/windowsautopilot-csp.md @@ -1,10 +1,10 @@ --- title: WindowsAutopilot CSP description: Learn how without the ability to mark a device as remediation required, the device will remain in a broken state, which results in security and privacy concerns in Autopilot. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft diff --git a/windows/client-management/mdm/windowsautopilot-ddf-file.md b/windows/client-management/mdm/windowsautopilot-ddf-file.md index 8d6ee2e942..88313274a6 100644 --- a/windows/client-management/mdm/windowsautopilot-ddf-file.md +++ b/windows/client-management/mdm/windowsautopilot-ddf-file.md @@ -2,12 +2,12 @@ title: WindowsAutopilot DDF file description: Learn how, without the ability to mark a device as remediation required, the device will remain in a broken state for the WindowsAutopilot DDF file configuration service provider (CSP). ms.author: vinpa -ms.topic: article +ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft ms.date: 02/07/2022 -ms.reviewer: +ms.reviewer: manager: aaroncz --- From 315b6543de83285481254e7ffead293cdab76627 Mon Sep 17 00:00:00 2001 From: Scott Figg Date: Fri, 14 Apr 2023 08:33:59 -0700 Subject: [PATCH 084/139] Update lock-down-windows-10-to-specific-apps.md Made small change in the xml samples, was "httsp" and needed to be "https" --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 800e7781f6..87899c2977 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -255,7 +255,7 @@ The following example pins Groove Music, Movies & TV, Photos, Weather, Calculato ```xml - + From 40302015c1a547c40980fde76fc0d9f92dc2094c Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 14 Apr 2023 12:51:37 -0400 Subject: [PATCH 085/139] Remove collapsible sections --- .../mdm/assignedaccess-csp.md | 2225 ++++++++--------- ...s-defender-application-control-policies.md | 83 +- .../microsoft-recommended-block-rules.md | 12 +- ...icrosoft-recommended-driver-block-rules.md | 88 +- 4 files changed, 1140 insertions(+), 1268 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 5042ee9974..2a3bd93b6d 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -95,49 +95,41 @@ In **Windows 10, version 1909**, Microsoft Edge kiosk mode support was added. Th For more examples, see [AssignedAccessConfiguration examples](#assignedaccessconfiguration-examples). -
    -
    - Get Configuration +- Get Configuration -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/Configuration - - - - - - -``` + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/Configuration + + + + + + + ``` -
    +- Delete Configuration -
    -
    - Delete Configuration - -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/Configuration - - - - - - -``` - -
    + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/Configuration + + + + + + + ``` @@ -201,101 +193,85 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu **Examples**: -
    -
    - Add KioskModeApp +- Add KioskModeApp -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp - - - chr - - {"Account":"Domain\\AccountName","AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"} - - - - - -``` + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp + + + chr + + {"Account":"Domain\\AccountName","AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"} + + + + + + ``` -
    +- Delete KioskModeApp -
    -
    - Delete KioskModeApp + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp + + + + + + + ``` -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp - - - - - - -``` +- Get KioskModeApp -
    + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp + + + + + + + ``` -
    -
    - Get KioskModeApp +- Replace KioskModeApp -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp - - - - - - -``` - -
    - -
    -
    - Replace KioskModeApp - -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp - - - chr - - {"Account":"Domain\\AccountName","AUMID":"Microsoft.WindowsAlarms_8wekyb3d8bbwe!App"} - - - - - -``` - -
    + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/KioskModeApp + + + chr + + {"Account":"Domain\\AccountName","AUMID":"Microsoft.WindowsAlarms_8wekyb3d8bbwe!App"} + + + + + + ``` @@ -351,412 +327,387 @@ For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllau > [!NOTE] > Shell Launcher V2 uses a separate XSD and namespace for backward compatibility. The original V1 XSD has a reference to the V2 XSD. -
    -
    - Shell Launcher V1 XSD +- Shell Launcher V1 XSD -```xml - - + ```xml + + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - - - - - - - - - - - - - - - - - - - - + + + + + - - -``` -
    + + + + + -
    -
    - Shell Launcher V2 XSD + + + + + + + + -```xml - - + + + + + + + + + + + + + + - - - - - - - - + + + - + + + + + + + + - -``` + + + + + + + -

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ``` + +- Shell Launcher V2 XSD + + ```xml + + + + + + + + + + + + + + + + ``` **Examples**: -
    -
    - Add +- Add -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher - - - chr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - -``` + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + chr + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + ``` -
    +- Add AutoLogon -
    -
    - Add AutoLogon + This function creates an auto-logon account on your behalf. It's a standard user with no password. The auto-logon account is managed by AssignedAccessCSP, so the account name isn't exposed. -This function creates an auto-logon account on your behalf. It's a standard user with no password. The auto-logon account is managed by AssignedAccessCSP, so the account name isn't exposed. + > [!NOTE] + > The auto-logon function is designed to be used after OOBE with provisioning packages. -> [!NOTE] -> The auto-logon function is designed to be used after OOBE with provisioning packages. + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + chr + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + ``` -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher - - - chr - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - -``` +- V2 Add -
    + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + chr + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + ``` -
    -
    - V2 Add +- Get -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher - - - chr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - -``` - -
    - -
    -
    - Get - -```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher - - - - - - -``` - -
    + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + + + + + ``` @@ -814,10 +765,6 @@ Additionally, the Status payload includes the following fields: **AssignedAccessAlert XSD**: -
    -
    - Expand this section to see the schema XML - ```xml ``` -

    - **Example**: ```xml @@ -954,10 +899,6 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat **StatusConfiguration XSD**: -
    -
    - Expand this section to see the schema XML - ```xml ``` -

    - **Examples**: -
    -
    - Add StatusConfiguration with StatusEnabled set to OnWithAlerts +- Add StatusConfiguration with StatusEnabled set to OnWithAlerts - ```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration - - - chr - - - - - OnWithAlerts - - ]]> - - - - - - - ``` - -
    - -
    -
    - Delete StatusConfiguration - - ```xml - + ```xml + - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration - - - - + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + chr + + + + + OnWithAlerts + + ]]> + + + + - - ``` + + ``` -
    +Delete StatusConfiguration -
    -
    - Get StatusConfiguration + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + + + + + ``` - ```xml - +- Get StatusConfiguration + + ```xml + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + + + + + ``` + +- Replace StatusEnabled value with On + + ```xml + - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration - - - - + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration + + + chr + + + + + On + + ]]> + + + + - - ``` - -
    - -
    -
    - Replace StatusEnabled value with On - - ```xml - - - - 2 - - - ./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration - - - chr - - - - - On - - ]]> - - - - - - - ``` - -
    +     + ``` @@ -1108,322 +1031,306 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat ## AssignedAccessConfiguration XSD -
    -
    - Schema for AssignedAccessConfiguration. +- Schema for AssignedAccessConfiguration. -```xml - - + ```xml + + - - - + + + - - - - - - - - - - - - - - - - - - - - - - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -); -``` -
    + + + + -
    -
    - Schema for features introduced in Windows 10, version 1909 which added support for Microsoft Edge kiosk mode and breakout key sequence customization. + + + + -```xml - - + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - -``` - -
    - -
    -
    - Schema for new features introduced in Windows 10 1809 release. - -```xml - - - - - - - - - - + + + + + + + + + + + + - - - + - - - + + + + + + + + + + - - - - - + + + + + - + + + + - + + + - + + + - + + + + + - -``` + + + + + + -
    + + + + + + + + + + + -
    -
    - Schema for Windows 10 prerelease. + + + + -```xml - - + + + + - - - - - + + + - - - + + + + + + + - - - + + + + + + - -``` + + + + + -
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ); + ``` + +- Schema for features introduced in Windows 10, version 1909 which added support for Microsoft Edge kiosk mode and breakout key sequence customization. + + ```xml + + + + + + + + + + + + + + ``` + +- Schema for new features introduced in Windows 10 1809 release. + + ```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ``` + +- Schema for Windows 10 prerelease. + + ```xml + + + + + + + + + + + + + + + + + + + ``` ## AssignedAccessConfiguration examples @@ -1444,118 +1351,108 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat > > ``` -
    -
    - Example XML configuration for a multi-app kiosk for Windows 10. +- Example XML configuration for a multi-app kiosk for Windows 10. -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - - - MultiAppKioskUser - - - - -``` + ```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + MultiAppKioskUser + + + + + ``` -
    +- Example XML configuration for a Microsoft Edge kiosk. This Microsoft Edge kiosk is configured to launch www.bing.com on startup in a public browsing mode. -
    -
    - Example XML configuration for a Microsoft Edge kiosk. This Microsoft Edge kiosk is configured to launch www.bing.com on startup in a public browsing mode. + ```xml + + + + + + + + + + EdgeKioskUser + + + + + ``` -```xml - - - - - - - - - - EdgeKioskUser - - - - -``` +- Example XML configuration for setting a breakout sequence to be Ctrl+A on a Microsoft Edge kiosk. -
    + > [!NOTE] + > **BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk. -
    -
    - Example XML configuration for setting a breakout sequence to be Ctrl+A on a Microsoft Edge kiosk. - -> [!NOTE] -> **BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk. - -```xml - - - - - - - - - - - EdgeKioskUser - - - - -``` + ```xml + + + + + + + + + + + EdgeKioskUser + + + + + ```
    @@ -1563,10 +1460,6 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat This example configures the following apps: Skype, Learning, Feedback Hub, and Calibration, for first line workers. Use this XML in a provisioning package using Windows Configuration Designer. For instructions, see [Configure HoloLens using a provisioning package](/hololens/hololens-provisioning). -
    -
    - Expand this section to see the example. - ```xml diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md index 644f65163a..abd3fc56ae 100644 --- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md @@ -40,7 +40,7 @@ There may come a time when you want to remove one or more WDAC policies, or remo > > The replacement policy must have the same PolicyId as the one it's replacing and a version that's equal to or greater than the existing policy. The replacement policy must also include \. > -> To take effect, this policy must be signed with a certificate included in the \ section of the original policy you want to replace. +> To take effect, this policy must be signed with a certificate included in the \ section of the original policy you want to replace. > > You must then restart the computer so that the UEFI protection of the policy is deactivated. ***Failing to do so will result in a boot start failure.*** @@ -107,58 +107,53 @@ For **single policy format WDAC policies**, in addition to the two locations abo Then restart the computer. -#### Sample script - -
    - Expand this section to see a sample script to delete a single WDAC policy +#### Sample script to delete a single WDAC policy ```powershell - # Set PolicyId GUID to the PolicyId from your WDAC policy XML - $PolicyId = "{PolicyId GUID}" +# Set PolicyId GUID to the PolicyId from your WDAC policy XML +$PolicyId = "{PolicyId GUID}" - # Initialize variables - $SinglePolicyFormatPolicyId = "{A244370E-44C9-4C06-B551-F6016E563076}" - $SinglePolicyFormatFileName = "\SiPolicy.p7b" - $MountPoint = $env:SystemDrive+"\EFIMount" - $SystemCodeIntegrityFolderRoot = $env:windir+"\System32\CodeIntegrity" - $EFICodeIntegrityFolderRoot = $MountPoint+"\EFI\Microsoft\Boot" - $MultiplePolicyFilePath = "\CiPolicies\Active\"+$PolicyId+".cip" +# Initialize variables +$SinglePolicyFormatPolicyId = "{A244370E-44C9-4C06-B551-F6016E563076}" +$SinglePolicyFormatFileName = "\SiPolicy.p7b" +$MountPoint = $env:SystemDrive+"\EFIMount" +$SystemCodeIntegrityFolderRoot = $env:windir+"\System32\CodeIntegrity" +$EFICodeIntegrityFolderRoot = $MountPoint+"\EFI\Microsoft\Boot" +$MultiplePolicyFilePath = "\CiPolicies\Active\"+$PolicyId+".cip" - # Mount the EFI partition - $EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0] - if (-Not (Test-Path $MountPoint)) { New-Item -Path $MountPoint -Type Directory -Force } - mountvol $MountPoint $EFIPartition +# Mount the EFI partition +$EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0] +if (-Not (Test-Path $MountPoint)) { New-Item -Path $MountPoint -Type Directory -Force } +mountvol $MountPoint $EFIPartition - # Check if the PolicyId to be removed is the system reserved GUID for single policy format. - # If so, the policy may exist as both SiPolicy.p7b in the policy path root as well as - # {GUID}.cip in the CiPolicies\Active subdirectory - if ($PolicyId -eq $SinglePolicyFormatPolicyId) {$NumFilesToDelete = 4} else {$NumFilesToDelete = 2} - - $Count = 1 - while ($Count -le $NumFilesToDelete) +# Check if the PolicyId to be removed is the system reserved GUID for single policy format. +# If so, the policy may exist as both SiPolicy.p7b in the policy path root as well as +# {GUID}.cip in the CiPolicies\Active subdirectory +if ($PolicyId -eq $SinglePolicyFormatPolicyId) {$NumFilesToDelete = 4} else {$NumFilesToDelete = 2} + +$Count = 1 +while ($Count -le $NumFilesToDelete) +{ + + # Set the $PolicyPath to the file to be deleted, if exists + Switch ($Count) { - - # Set the $PolicyPath to the file to be deleted, if exists - Switch ($Count) - { - 1 {$PolicyPath = $SystemCodeIntegrityFolderRoot+$MultiplePolicyFilePath} - 2 {$PolicyPath = $EFICodeIntegrityFolderRoot+$MultiplePolicyFilePath} - 3 {$PolicyPath = $SystemCodeIntegrityFolderRoot+$SinglePolicyFormatFileName} - 4 {$PolicyPath = $EFICodeIntegrityFolderRoot+$SinglePolicyFormatFileName} - } - - # Delete the policy file from the current $PolicyPath - Write-Host "Attempting to remove $PolicyPath..." -ForegroundColor Cyan - if (Test-Path $PolicyPath) {Remove-Item -Path $PolicyPath -Force -ErrorAction Continue} - - $Count = $Count + 1 + 1 {$PolicyPath = $SystemCodeIntegrityFolderRoot+$MultiplePolicyFilePath} + 2 {$PolicyPath = $EFICodeIntegrityFolderRoot+$MultiplePolicyFilePath} + 3 {$PolicyPath = $SystemCodeIntegrityFolderRoot+$SinglePolicyFormatFileName} + 4 {$PolicyPath = $EFICodeIntegrityFolderRoot+$SinglePolicyFormatFileName} } - # Dismount the EFI partition - mountvol $MountPoint /D -``` + # Delete the policy file from the current $PolicyPath + Write-Host "Attempting to remove $PolicyPath..." -ForegroundColor Cyan + if (Test-Path $PolicyPath) {Remove-Item -Path $PolicyPath -Force -ErrorAction Continue} -
    + $Count = $Count + 1 +} + +# Dismount the EFI partition +mountvol $MountPoint /D +``` > [!NOTE] > You must run the script as administrator to remove WDAC policies on your computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 68be5afd9a..e8331a7fcf 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -113,9 +113,7 @@ If you wish to use this blocklist policy on Windows Server 2016, locate the deny The blocklist policy below includes "Allow all" rules for both kernel and user mode that make it safe to deploy as a standalone WDAC policy. On Windows versions 1903 and above, Microsoft recommends converting this policy to multiple policy format using the *Set-CiPolicyIdInfo* cmdlet with the *-ResetPolicyId* switch. Then, you can deploy it as a Base policy side-by-side with any other policies in your environment. To instead add these rules to an existing Base policy, you can merge the policy below using the *Merge-CIPolicy* cmdlet. If merging into an existing policy that includes an explicit allowlist, you should first remove the two "Allow all" rules and their corresponding FileRuleRefs from the sample policy below. -
    -
    - Expand this section to see the WDAC policy XML +**WDAC policy XML**: ```xml @@ -183,7 +181,7 @@ The blocklist policy below includes "Allow all" rules for both kernel and user m - + @@ -893,8 +891,8 @@ The blocklist policy below includes "Allow all" rules for both kernel and user m - - + + @@ -1512,8 +1510,6 @@ The blocklist policy below includes "Allow all" rules for both kernel and user m ``` -
    - ## More information - [Merge WDAC policies](merge-windows-defender-application-control-policies.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 54c82d24ae..161e563a19 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 author: jgeurten @@ -61,14 +61,39 @@ Customers who always want the most up-to-date driver blocklist can also use Wind ## Blocking vulnerable drivers using WDAC -Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this setting isn't possible, Microsoft recommends blocking this list of drivers within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can cause devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies) and review the audit block events. +Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this setting isn't possible, Microsoft recommends blocking [this list of drivers](#vulnerable-driver-blocklist-xml) within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can cause devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies) and review the audit block events. > [!IMPORTANT] > Microsoft also recommends enabling Attack Surface Reduction (ASR) rule [**Block abuse of exploited vulnerable signed drivers**](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-abuse-of-exploited-vulnerable-signed-drivers) to prevent an application from writing a vulnerable signed driver to disk. The ASR rule doesn't block a driver already existing on the system from loading, however enabling **Microsoft vulnerable driver blocklist** or applying this WDAC policy will prevent the existing driver from loading. -
    -
    - Expand this section to see the blocklist WDAC policy XML +## Steps to download and apply the vulnerable driver blocklist binary + +If you prefer to apply the [vulnerable driver blocklist](#vulnerable-driver-blocklist-xml) exactly as shown, follow these steps: + +1. Download the [WDAC policy refresh tool](https://aka.ms/refreshpolicy) +2. Download and extract the [vulnerable driver blocklist binaries](https://aka.ms/VulnerableDriverBlockList) +3. Select either the audit only version or the enforced version and rename the file to SiPolicy.p7b +4. Copy SiPolicy.p7b to %windir%\system32\CodeIntegrity +5. Run the WDAC policy refresh tool you downloaded in Step 1 above to activate and refresh all WDAC policies on your computer + +To check that the policy was successfully applied on your computer: + +1. Open Event Viewer +2. Browse to **Applications and Services Logs - Microsoft - Windows - CodeIntegrity - Operational** +3. Select **Filter Current Log...** +4. Replace "<All Event IDs>" with "3099" and select OK. +5. Look for a 3099 event where the PolicyNameBuffer and PolicyIdBuffer match the Name and Id PolicyInfo settings found at the bottom of the blocklist WDAC Policy XML in this article. NOTE: Your computer may have more than one 3099 event if other WDAC policies are also present. + +> [!NOTE] +> If any vulnerable drivers are already running that would be blocked by the policy, you must reboot your computer for those drivers to be blocked. Running processes aren't shutdown when activating a new WDAC policy without reboot. + +## Vulnerable driver blocklist XML + +> [!IMPORTANT] +> The policy listed below contains **Allow All** rules. If your version of Windows supports WDAC multiple policies, we recommend deploying this policy alongside any existing WDAC policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create a WDAC Deny Policy](/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy#single-policy-considerations). + +> [!NOTE] +> To use this policy with Windows Server 2016, you must convert the policy XML on a device running a newer operating system. ```xml @@ -642,11 +667,11 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + - + @@ -1079,7 +1104,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -1213,7 +1238,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -1228,7 +1253,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -1238,7 +1263,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -1402,7 +1427,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -1811,8 +1836,8 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - + + @@ -1837,7 +1862,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -1849,7 +1874,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -1894,7 +1919,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -2879,35 +2904,6 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- ``` -
    - -> [!NOTE] -> The policy listed above contains **Allow All** rules. If your version of Windows supports WDAC multiple policies, we recommend deploying this policy alongside any existing WDAC policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create a WDAC Deny Policy](/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy#single-policy-considerations). - -> [!NOTE] -> To use the policy above with Windows Server 2016, you must convert the policy XML on a device running a newer operating system. - -## Steps to download and apply the vulnerable driver blocklist binary - -If you prefer to apply the vulnerable driver blocklist exactly as shown above, follow these steps: - -1. Download the [WDAC policy refresh tool](https://aka.ms/refreshpolicy) -2. Download and extract the [vulnerable driver blocklist binaries](https://aka.ms/VulnerableDriverBlockList) -3. Select either the audit only version or the enforced version and rename the file to SiPolicy.p7b -4. Copy SiPolicy.p7b to %windir%\system32\CodeIntegrity -5. Run the WDAC policy refresh tool you downloaded in Step 1 above to activate and refresh all WDAC policies on your computer - -To check that the policy was successfully applied on your computer: - -1. Open Event Viewer -2. Browse to **Applications and Services Logs - Microsoft - Windows - CodeIntegrity - Operational** -3. Select **Filter Current Log...** -4. Replace "<All Event IDs>" with "3099" and select OK. -5. Look for a 3099 event where the PolicyNameBuffer and PolicyIdBuffer match the Name and Id PolicyInfo settings found at the bottom of the blocklist WDAC Policy XML in this article. NOTE: Your computer may have more than one 3099 event if other WDAC policies are also present. - -> [!NOTE] -> If any vulnerable drivers are already running that would be blocked by the policy, you must reboot your computer for those drivers to be blocked. Running processes aren't shutdown when activating a new WDAC policy without reboot. - ## More information - [Merge Windows Defender Application Control policies](/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies) From 94c3b6b8a8a759d26f8c6ab8ec47dbd8820e0fba Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 14 Apr 2023 13:26:21 -0400 Subject: [PATCH 086/139] Fix indentation --- windows/client-management/mdm/assignedaccess-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 2a3bd93b6d..59a54a27da 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -959,7 +959,7 @@ By default, the StatusConfiguration node doesn't exist, and it implies this feat ``` -Delete StatusConfiguration +- Delete StatusConfiguration ```xml From 0ac5a4a9d37072128ce601bc7d65fd779a7f33cd Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 14 Apr 2023 14:26:07 -0400 Subject: [PATCH 087/139] Fix broken links --- windows/client-management/mdm/passportforwork-csp.md | 4 ++-- windows/client-management/mdm/policy-csp-audit.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index a937496bd1..6d0a94f3a5 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -106,7 +106,7 @@ This policy specifies the Tenant ID in the format of a Globally Unique Identifie -To get the GUID, use the PowerShell cmdlet [Get-AzureAccount](/powershell/module/servicemanagement/azure.service/get-azureaccount). For more information, see [Get Windows Azure Active Directory Tenant ID in Windows PowerShell](https://devblogs.microsoft.com/scripting/get-windows-azure-active-directory-tenant-id-in-windows-powershell). +To get the GUID, use the PowerShell cmdlet [Get-AzureAccount](/powershell/module/servicemanagement/azure/get-azureaccount). For more information, see [Get Windows Azure Active Directory Tenant ID in Windows PowerShell](https://devblogs.microsoft.com/scripting/get-windows-azure-active-directory-tenant-id-in-windows-powershell). @@ -1831,7 +1831,7 @@ This policy specifies the Tenant ID in the format of a Globally Unique Identifie -To get the GUID, use the PowerShell cmdlet [Get-AzureAccount](/powershell/module/servicemanagement/azure.service/get-azureaccount). For more information, see [Get Windows Azure Active Directory Tenant ID in Windows PowerShell](https://devblogs.microsoft.com/scripting/get-windows-azure-active-directory-tenant-id-in-windows-powershell). +To get the GUID, use the PowerShell cmdlet [Get-AzureAccount](/powershell/module/servicemanagement/azure/get-azureaccount). For more information, see [Get Windows Azure Active Directory Tenant ID in Windows PowerShell](https://devblogs.microsoft.com/scripting/get-windows-azure-active-directory-tenant-id-in-windows-powershell). diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index f558a57eaa..67fb66304b 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -4,7 +4,7 @@ description: Learn more about the Audit Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/23/2023 +ms.date: 04/14/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -2803,7 +2803,7 @@ This policy setting allows you to audit events generated by attempts to access t - If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. > [!NOTE] -> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume: High on domain controllers. From ee710a0333793a5ebe5dc5f2c76f6e7b489c0836 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 14 Apr 2023 16:00:36 -0400 Subject: [PATCH 088/139] Update PDE CSP --- .../mdm/personaldataencryption-csp.md | 279 +----------------- 1 file changed, 1 insertion(+), 278 deletions(-) diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md index af0cf9f34d..9477520647 100644 --- a/windows/client-management/mdm/personaldataencryption-csp.md +++ b/windows/client-management/mdm/personaldataencryption-csp.md @@ -4,7 +4,7 @@ description: Learn more about the PDE CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 03/23/2023 +ms.date: 04/14/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -26,13 +26,7 @@ The following list shows the PDE configuration service provider nodes: - ./User/Vendor/MSFT/PDE - [EnablePersonalDataEncryption](#enablepersonaldataencryption) - - [ProtectFolders](#protectfolders) - - [ProtectDesktop](#protectfoldersprotectdesktop) - - [ProtectDocuments](#protectfoldersprotectdocuments) - - [ProtectPictures](#protectfoldersprotectpictures) - [Status](#status) - - [FolderProtectionStatus](#statusfolderprotectionstatus) - - [FoldersProtected](#statusfoldersprotected) - [PersonalDataEncryptionStatus](#statuspersonaldataencryptionstatus) @@ -85,188 +79,6 @@ The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.u - -## ProtectFolders - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :x: Device
    :heavy_check_mark: User | :x: Home
    :x: Pro
    :heavy_check_mark: Enterprise
    :heavy_check_mark: Education
    :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | - - - -```User -./User/Vendor/MSFT/PDE/ProtectFolders -``` - - - - - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | node | -| Access Type | Get | - - - - - - - - - -### ProtectFolders/ProtectDesktop - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :x: Device
    :heavy_check_mark: User | :x: Home
    :x: Pro
    :heavy_check_mark: Enterprise
    :heavy_check_mark: Education
    :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | - - - -```User -./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDesktop -``` - - - - -Allows the Admin to enable PDE on Desktop folder. Set to '1' to set this policy. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | int | -| Access Type | Add, Delete, Get, Replace | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | -| 1 | Enable PDE on the folder. | - - - - - - - - - -### ProtectFolders/ProtectDocuments - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :x: Device
    :heavy_check_mark: User | :x: Home
    :x: Pro
    :heavy_check_mark: Enterprise
    :heavy_check_mark: Education
    :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | - - - -```User -./User/Vendor/MSFT/PDE/ProtectFolders/ProtectDocuments -``` - - - - -Allows the Admin to enable PDE on Documents folder. Set to '1' to set this policy. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | int | -| Access Type | Add, Delete, Get, Replace | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | -| 1 | Enable PDE on the folder. | - - - - - - - - - -### ProtectFolders/ProtectPictures - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :x: Device
    :heavy_check_mark: User | :x: Home
    :x: Pro
    :heavy_check_mark: Enterprise
    :heavy_check_mark: Education
    :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | - - - -```User -./User/Vendor/MSFT/PDE/ProtectFolders/ProtectPictures -``` - - - - -Allows the Admin to enable PDE on Pictures folder. Set to '1' to set this policy. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | int | -| Access Type | Add, Delete, Get, Replace | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 | Disable PDE on the folder. If the folder is currently protected by PDE, this will result in unprotecting the folder. | -| 1 | Enable PDE on the folder. | - - - - - - - - ## Status @@ -309,95 +121,6 @@ Reports the current status of Personal Data Encryption (PDE) for the user. - -### Status/FolderProtectionStatus - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :x: Device
    :heavy_check_mark: User | :x: Home
    :x: Pro
    :heavy_check_mark: Enterprise
    :heavy_check_mark: Education
    :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | - - - -```User -./User/Vendor/MSFT/PDE/Status/FolderProtectionStatus -``` - - - - -This node reports folder protection status for a user. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | int | -| Access Type | Get | - - - -**Allowed values**: - -| Value | Description | -|:--|:--| -| 0 | Protection not started. | -| 1 | Protection is completed with no failures. | -| 2 | Protection in progress. | -| 3 | Protection failed. | - - - - - - - - - -### Status/FoldersProtected - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| :x: Device
    :heavy_check_mark: User | :x: Home
    :x: Pro
    :heavy_check_mark: Enterprise
    :heavy_check_mark: Education
    :x: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | - - - -```User -./User/Vendor/MSFT/PDE/Status/FoldersProtected -``` - - - - -This node reports all folders (full path to each folder) that have been protected. - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | chr (string) | -| Access Type | Get | - - - - - - - - ### Status/PersonalDataEncryptionStatus From 1ad065e5f51473914190a0a0bfb262f640df489b Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Fri, 14 Apr 2023 13:41:28 -0700 Subject: [PATCH 089/139] Fix broken link --- windows/privacy/Microsoft-DiagnosticDataViewer.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md index 0e92139786..976780994e 100644 --- a/windows/privacy/Microsoft-DiagnosticDataViewer.md +++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md @@ -40,7 +40,7 @@ Using the Diagnostic Data Viewer for PowerShell requires administrative (elevate ### Install the Diagnostic Data Viewer for PowerShell >[!IMPORTANT] - >It is recommended to visit the documentation on [Getting Started](/powershell/scripting/gallery/getting-started) with PowerShell Gallery. This page provides more specific details on installing a PowerShell module. + >It is recommended to visit the documentation on [Getting Started](/powershell/gallery/gallery/getting-started) with PowerShell Gallery. This page provides more specific details on installing a PowerShell module. To install the newest version of the Diagnostic Data Viewer PowerShell module, run the following command within an elevated PowerShell session: ```powershell @@ -180,4 +180,4 @@ When resetting the size of your data history to a lower value, be sure to turn o ## Related Links - [Module in PowerShell Gallery](https://www.powershellgallery.com/packages/Microsoft.DiagnosticDataViewer) -- [Documentation for Diagnostic Data Viewer for PowerShell](/powershell/module/microsoft.diagnosticdataviewer/?) +- [Documentation for Diagnostic Data Viewer for PowerShell](/powershell/module/microsoft.diagnosticdataviewer) From 49bd2e1c3331d77c5d3d8818d2220f5850a52fa5 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Fri, 14 Apr 2023 16:08:01 -0500 Subject: [PATCH 090/139] Update passportforwork-csp.md Acro edits. --- .../client-management/mdm/passportforwork-csp.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 6d0a94f3a5..79728405bf 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -445,7 +445,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to | Value | Description | |:--|:--| | 0 (Default) | Allows the use of digits in PIN. | -| 1 | Requires the use of at least one digits in PIN. | +| 1 | Requires the use of at least one digit in PIN. | | 2 | Does not allow the use of digits in PIN. | @@ -583,7 +583,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to | Value | Description | |:--|:--| | 0 (Default) | Allows the use of lowercase letters in PIN. | -| 1 | Requires the use of at least one lowercase letters in PIN. | +| 1 | Requires the use of at least one lowercase letter in PIN. | | 2 | Does not allow the use of lowercase letters in PIN. | @@ -706,7 +706,7 @@ Minimum PIN length configures the minimum number of characters required for the -Use this policy setting to configure the use of special characters in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) * + , - . / : ; `< = >` ? @ [ \ ] ^ _ ` { | } ~ . +Use this policy setting to configure the use of special character in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) * + , - . / : ; `< = >` ? @ [ \ ] ^ _ ` { | } ~ . A value of 1 corresponds to "Required." If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one special character in their PIN. @@ -791,7 +791,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to | Value | Description | |:--|:--| | 0 (Default) | Allows the use of uppercase letters in PIN. | -| 1 | Requires the use of at least one uppercase letters in PIN. | +| 1 | Requires the use of at least one uppercase letter in PIN. | | 2 | Does not allow the use of uppercase letters in PIN. | @@ -2027,7 +2027,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to | Value | Description | |:--|:--| | 0 (Default) | Allows the use of digits in PIN. | -| 1 | Requires the use of at least one digits in PIN. | +| 1 | Requires the use of at least one digit in PIN. | | 2 | Does not allow the use of digits in PIN. | @@ -2165,7 +2165,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to | Value | Description | |:--|:--| | 0 (Default) | Allows the use of lowercase letters in PIN. | -| 1 | Requires the use of at least one lowercase letters in PIN. | +| 1 | Requires the use of at least one lowercase letter in PIN. | | 2 | Does not allow the use of lowercase letters in PIN. | @@ -2317,7 +2317,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to | Value | Description | |:--|:--| | 0 (Default) | Allows the use of special characters in PIN. | -| 1 | Requires the use of at least one special characters in PIN. | +| 1 | Requires the use of at least one special character in PIN. | | 2 | Does not allow the use of special characters in PIN. | @@ -2373,7 +2373,7 @@ A value of 2 corresponds to "Disallow." If you configure this policy setting to | Value | Description | |:--|:--| | 0 (Default) | Allows the use of uppercase letters in PIN. | -| 1 | Requires the use of at least one uppercase letters in PIN. | +| 1 | Requires the use of at least one uppercase letter in PIN. | | 2 | Does not allow the use of uppercase letters in PIN. | From 7ba6866c3f9e33a37476d101f2b435cd0dad069a Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Fri, 14 Apr 2023 16:10:14 -0500 Subject: [PATCH 091/139] Update policy-csp-audit.md --- windows/client-management/mdm/policy-csp-audit.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 67fb66304b..0b01016c5f 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -843,7 +843,7 @@ Volume: Low. -This policy setting allows you to audit events generated by special logons such as the following : The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). +This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). From 75be2783cf39dd2816c960fa9bf80357a1ad5166 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 14 Apr 2023 16:14:34 -0600 Subject: [PATCH 092/139] Update waas-delivery-optimization-faq.yml --- windows/deployment/do/waas-delivery-optimization-faq.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index f363e5116d..66d5f82e1b 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -99,3 +99,9 @@ sections: > [!NOTE] > If you use public IP addresses instead of private in LAN mode, the bytes downloaded from or uploaded to LAN peers with public IP addresses might be reported as coming from Internet peers. + - question: How are downloads initiated by Delivery Optimization? + answer: Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). + + - question: How does Delivery Optimization determine which content is available for peering? + answer: Delivery Optimization uses the cache content on the device to determine what is available for peering. There is a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. + From f5000ee018bd39dd5e8ef62cb429116380ff2dfd Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 14 Apr 2023 16:21:36 -0600 Subject: [PATCH 093/139] Update waas-delivery-optimization-faq.yml --- windows/deployment/do/waas-delivery-optimization-faq.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 66d5f82e1b..7dcafef147 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -100,8 +100,10 @@ sections: > If you use public IP addresses instead of private in LAN mode, the bytes downloaded from or uploaded to LAN peers with public IP addresses might be reported as coming from Internet peers. - question: How are downloads initiated by Delivery Optimization? - answer: Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). + answer: | + Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). - question: How does Delivery Optimization determine which content is available for peering? - answer: Delivery Optimization uses the cache content on the device to determine what is available for peering. There is a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. + answer: | + Delivery Optimization uses the cache content on the device to determine what is available for peering. There is a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. From 95384f5df5bbfd7baca40382012f32b2ad3ab32b Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 14 Apr 2023 16:30:38 -0600 Subject: [PATCH 094/139] Update waas-delivery-optimization-faq.yml --- windows/deployment/do/waas-delivery-optimization-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 7dcafef147..9d0334392d 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -101,7 +101,7 @@ sections: - question: How are downloads initiated by Delivery Optimization? answer: | - Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). + Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). - question: How does Delivery Optimization determine which content is available for peering? answer: | From 5cc83ba33c0d275e03982db29a5a814b9d76902c Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Fri, 14 Apr 2023 16:41:14 -0600 Subject: [PATCH 095/139] Update waas-delivery-optimization-faq.yml --- windows/deployment/do/waas-delivery-optimization-faq.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 9d0334392d..6cbda96233 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -99,11 +99,11 @@ sections: > [!NOTE] > If you use public IP addresses instead of private in LAN mode, the bytes downloaded from or uploaded to LAN peers with public IP addresses might be reported as coming from Internet peers. - - question: How are downloads initiated by Delivery Optimization? - answer: | + - question: How are downloads initiated by Delivery Optimization? + answer: | Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). - - question: How does Delivery Optimization determine which content is available for peering? - answer: | + - question: How does Delivery Optimization determine which content is available for peering? + answer: | Delivery Optimization uses the cache content on the device to determine what is available for peering. There is a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. From f051d872f35d2c7dfbbe4d3ed3ff8038e8a08dc7 Mon Sep 17 00:00:00 2001 From: Office Content Publishing 2 <44301038+officedocspr2@users.noreply.github.com> Date: Sat, 15 Apr 2023 23:31:32 -0700 Subject: [PATCH 096/139] Uploaded file: education-content-updates.md - 2023-04-15 23:31:31.8205 --- .../includes/education-content-updates.md | 46 ++++--------------- 1 file changed, 8 insertions(+), 38 deletions(-) diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md index 195a92eff6..665fb1ee2c 100644 --- a/education/includes/education-content-updates.md +++ b/education/includes/education-content-updates.md @@ -2,6 +2,14 @@ +## Week of April 10, 2023 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 4/11/2023 | [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in) | modified | + + ## Week of March 20, 2023 @@ -15,41 +23,3 @@ | 3/22/2023 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified | | 3/22/2023 | [Deploy Windows 10 in a school (Windows 10)](/education/windows/deploy-windows-10-in-a-school) | modified | | 3/22/2023 | [Deployment recommendations for school IT administrators](/education/windows/edu-deployment-recommendations) | modified | - - -## Week of March 06, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 3/8/2023 | Change to Windows 10 Education from Windows 10 Pro | removed | -| 3/8/2023 | [Deployment recommendations for school IT administrators](/education/windows/edu-deployment-recommendations) | modified | -| 3/8/2023 | Enable S mode on Surface Go devices for Education | removed | -| 3/8/2023 | Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode | removed | -| 3/8/2023 | Test Windows 10 in S mode on existing Windows 10 education devices | removed | -| 3/9/2023 | [Windows for Education documentation](/education/windows/index) | modified | - - -## Week of February 27, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 2/28/2023 | [Configure federation between Google Workspace and Azure AD](/education/windows/configure-aad-google-trust) | modified | -| 2/28/2023 | [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in) | modified | - - -## Week of February 20, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 2/22/2023 | [Upgrade Windows Home to Windows Education on student-owned devices](/education/windows/change-home-to-edu) | modified | -| 2/22/2023 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified | -| 2/22/2023 | [Management functionalities for Surface devices](/education/windows/tutorial-school-deployment/manage-surface-devices) | modified | -| 2/22/2023 | [Set up device management](/education/windows/tutorial-school-deployment/set-up-microsoft-intune) | modified | -| 2/22/2023 | [Troubleshoot Windows devices](/education/windows/tutorial-school-deployment/troubleshoot-overview) | modified | -| 2/23/2023 | Education scenarios Microsoft Store for Education | removed | -| 2/23/2023 | [Get and deploy Minecraft Education](/education/windows/get-minecraft-for-education) | modified | -| 2/23/2023 | For IT administrators get Minecraft Education Edition | removed | -| 2/23/2023 | For teachers get Minecraft Education Edition | removed | From 18e2d4750d7a7cecf3e3d6d3c22b377561d531af Mon Sep 17 00:00:00 2001 From: Christine Eaton <40660908+ceaton001@users.noreply.github.com> Date: Mon, 17 Apr 2023 11:45:27 +0100 Subject: [PATCH 097/139] Update windows-autopatch-device-registration-overview.md Removed references to Dynamic Windows 10 and Windows 11 groups that are no longer created. --- .../deploy/windows-autopatch-device-registration-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md index b6ead33041..55898ea671 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md @@ -48,7 +48,7 @@ See the following detailed workflow diagram. The diagram covers the Windows Auto | **Step 4: Check prerequisites** | The Windows Autopatch prerequisite function makes an Intune Graph API call to sequentially validate device readiness attributes required for the registration process. For detailed information, see the [Detailed prerequisite check workflow diagram](#detailed-prerequisite-check-workflow-diagram) section. The service checks the following device readiness attributes, and/or prerequisites:
    1. **Serial number, model, and manufacturer.**
      1. Checks if the serial number already exists in the Windows Autopatch’s managed device database.
    2. **If the device is Intune-managed or not.**
      1. Windows Autopatch looks to see **if the Azure AD device ID has an Intune device ID associated with it**.
        1. If **yes**, it means this device is enrolled into Intune.
        2. If **not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.
      2. **If the device is not managed by Intune**, the Windows Autopatch service can't gather device attributes such as operating system version, Intune enrollment date, device name and other attributes. When this happens, the Windows Autopatch service uses the Azure AD device attributes gathered and saved to its memory in **step 3a**.
        1. Once it has the device attributes gathered from Azure AD in **step 3a**, the device is flagged with the **Prerequisite failed** status, then added to the **Not registered** tab so the IT admin can review the reason(s) the device wasn't registered into Windows Autopatch. The IT admin will remediate these devices. In this case, the IT admin should check why the device wasn’t enrolled into Intune.
        2. A common reason is when the Azure AD device ID is stale, it doesn’t have an Intune device ID associated with it anymore. To remediate, [clean up any stale Azure AD device records from your tenant](windows-autopatch-register-devices.md#clean-up-dual-state-of-hybrid-azure-ad-joined-and-azure-registered-devices-in-your-azure-ad-tenant).
      3. **If the device is managed by Intune**, the Windows Autopatch prerequisite check function continues to the next prerequisite check, which evaluates whether the device has checked into Intune in the last 28 days.
    3. **If the device is a Windows device or not.**
      1. Windows Autopatch looks to see if the device is a Windows and corporate-owned device.
        1. **If yes**, it means this device can be registered with the service because it's a Windows corporate-owned device.
        2. **If not**, it means the device is a non-Windows device, or it's a Windows device but it's a personal device.
    4. **Windows Autopatch checks the Windows SKU family**. The SKU must be either:
      1. **Enterprise**
      2. **Pro**
      3. **Pro Workstation**
    5. **If the device meets the operating system requirements**, Windows Autopatch checks whether the device is either:
      1. **Only managed by Intune.**
        1. If the device is only managed by Intune, the device is marked as Passed all prerequisites.
      2. **Co-managed by both Configuration Manager and Intune.**
        1. If the device is co-managed by both Configuration Manager and Intune, an additional prerequisite check is evaluated to determine if the device satisfies the co-management-enabled workloads required by Windows Autopatch to manage devices in a co-managed state. The required co-management workloads evaluated in this step are:
          1. **Windows Updates Policies**
          2. **Device Configuration**
          3. **Office Click to Run**
        2. If Windows Autopatch determines that one of these workloads isn’t enabled on the device, the service marks the device as **Prerequisite failed** and moves the device to the **Not registered** tab.
    | | **Step 5: Calculate deployment ring assignment** | Once the device passes all prerequisites described in **step #4**, Windows Autopatch starts its deployment ring assignment calculation. The following logic is used to calculate the Windows Autopatch deployment ring assignment:
    1. If the Windows Autopatch tenant’s existing managed device size is **≤ 200**, the deployment ring assignment is **First (5%)**, **Fast (15%)**, remaining devices go to the **Broad ring (80%)**.
    2. If the Windows Autopatch tenant’s existing managed device size is **>200**, the deployment ring assignment will be **First (1%)**, **Fast (9%)**, remaining devices go to the **Broad ring (90%)**.
    | | **Step 6: Assign devices to a deployment ring group** | Once the deployment ring calculation is done, Windows Autopatch assigns devices to one of the following deployment ring groups:
    1. **Modern Workplace Devices-Windows Autopatch-First**
      1. The Windows Autopatch device registration process doesn’t automatically assign devices to the Test ring represented by the Azure AD group (Modern Workplace Devices-Windows Autopatch-Test). It’s important that you assign devices to the Test ring to validate the update deployments before the updates are deployed to a broader population of devices.
    2. **Modern Workplace Devices-Windows Autopatch-Fast**
    3. **Modern Workplace Devices-Windows Autopatch-Broad**
    | -| **Step 7: Assign devices to an Azure AD group** | Windows Autopatch also assigns devices to the following Azure AD groups when certain conditions apply:
    1. **Modern Workplace Devices - All**
      1. This group has all devices managed by Windows Autopatch.
    2. When registering **Windows 10 devices**, use **Modern Workplace Devices Dynamic - Windows 10**
      1. This group has all devices managed by Windows Autopatch and that have Windows 10 installed.
    3. When registering **Windows 11 devices**, use **Modern Workplace Devices Dynamic - Windows 11**
      1. This group has all devices managed by Windows Autopatch and that have Windows 11 installed.
    4. When registering **virtual devices**, use **Modern Workplace Devices - Virtual Machine**
      1. This group has all virtual devices managed by Windows Autopatch.
      | +| **Step 7: Assign devices to an Azure AD group** | Windows Autopatch also assigns devices to the following Azure AD groups when certain conditions apply:
      1. **Modern Workplace Devices - All**
        1. This group has all devices managed by Windows Autopatch.
      2. **Modern Workplace Devices - Virtual Machine**
        1. This group has all **virtual devices** managed by Windows Autopatch.
        | | **Step 8: Post-device registration** | In post-device registration, three actions occur:
        1. Windows Autopatch adds devices to its managed database.
        2. Flags devices as **Active** in the **Ready** tab.
        3. The Azure AD device ID of the device successfully registered is added into the Microsoft Cloud Managed Desktop Extension’s allowlist. Windows Autopatch installs the Microsoft Cloud Managed Desktop Extension agent once devices are registered, so the agent can communicate back to the Microsoft Cloud Managed Desktop Extension service.
          1. The agent is the **Modern Workplace - Autopatch Client setup** PowerShell script that was created during the Windows Autopatch tenant enrollment process. The script is executed once devices are successfully registered into the Windows Autopatch service.
          | | **Step 9: Review device registration status** | IT admins review the device registration status in both the **Ready** and **Not registered** tabs.
          1. If the device was **successfully registered**, the device shows up in the **Ready** tab.
          2. If **not**, the device shows up in the **Not registered** tab.
          | | **Step 10: End of registration workflow** | This is the end of the Windows Autopatch device registration workflow. | From 047174950af24ed7e1e64040e68344bb25530907 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 17 Apr 2023 08:44:21 -0600 Subject: [PATCH 098/139] Update waas-delivery-optimization-faq.yml --- windows/deployment/do/waas-delivery-optimization-faq.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 6cbda96233..21e2d8223e 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -101,9 +101,9 @@ sections: - question: How are downloads initiated by Delivery Optimization? answer: | - Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). + Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). [Learn more](waas-delivery-optimization#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. - question: How does Delivery Optimization determine which content is available for peering? answer: | - Delivery Optimization uses the cache content on the device to determine what is available for peering. There is a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. + Delivery Optimization uses the cache content on the device to determine what is available for peering. For the upload source device there is a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. From 1c2f371a1e89886742797dbf968d329094b73369 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 17 Apr 2023 08:47:35 -0600 Subject: [PATCH 099/139] Update waas-delivery-optimization-faq.yml --- windows/deployment/do/waas-delivery-optimization-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 21e2d8223e..303e6a22c3 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -101,7 +101,7 @@ sections: - question: How are downloads initiated by Delivery Optimization? answer: | - Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). [Learn more](waas-delivery-optimization#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. + Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). [Learn more](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. - question: How does Delivery Optimization determine which content is available for peering? answer: | From 79356e6dcd7b3662513576b7b0e8156d97001e67 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 17 Apr 2023 09:00:42 -0600 Subject: [PATCH 100/139] Update waas-delivery-optimization-faq.yml --- .../deployment/do/waas-delivery-optimization-faq.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 303e6a22c3..ab1278c4e9 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -1,7 +1,7 @@ ### YamlMime:FAQ metadata: title: Delivery Optimization Frequently Asked Questions - description: The following is a list of frequently asked questions for Delivery Optimization. + description: List of frequently asked questions for Delivery Optimization. ms.reviewer: mstewart ms.prod: windows-client author: cmknox @@ -29,7 +29,7 @@ sections: answer: | Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device. The port must be set to accept inbound traffic through your firewall. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data). - Delivery Optimization will use Teredo to create peer groups, which include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets). For this to work, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up. + Delivery Optimization will use Teredo to create peer groups, which include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets). To enable this scenario, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up. Delivery Optimization also communicates with its cloud service by using HTTP/HTTPS over port 80. @@ -70,7 +70,7 @@ sections: If the connection is identified as a VPN, Delivery Optimization will suspend uploads to other peers. However, you can allow uploads over a VPN by using the [Enable Peer Caching while the device connects via VPN](../do/waas-delivery-optimization-reference.md#enable-peer-caching-while-the-device-connects-via-vpn) policy. - If you have defined a boundary group in Configuration Manager for VPN IP ranges, you can set the [DownloadMode](../do/waas-delivery-optimization-reference.md#download-mode) policy to 0 for that boundary group, to ensure that there will be no peer-to-peer activity over the VPN. When the device is not connected using a VPN, it can still use peer-to-peer with the default of LAN. + If you have defined a boundary group in Configuration Manager for VPN IP ranges, you can set the [DownloadMode](../do/waas-delivery-optimization-reference.md#download-mode) policy to 0 for that boundary group, to ensure that there will be no peer-to-peer activity over the VPN. When the device isn't connected using a VPN, it can still use peer-to-peer with the default of LAN. With split tunneling, make sure to allow direct access to these endpoints: @@ -101,9 +101,9 @@ sections: - question: How are downloads initiated by Delivery Optimization? answer: | - Delivery Optimization only starts a download when it is initated by an application/service that has been integrated with Delivery Optimization (e.g. Edge browser). [Learn more](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. + Delivery Optimization only starts when an application/service that has been integrated with Delivery Optimizationdownload initiates a download (for example, Edge browser). [Learn more](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. - question: How does Delivery Optimization determine which content is available for peering? answer: | - Delivery Optimization uses the cache content on the device to determine what is available for peering. For the upload source device there is a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. + Delivery Optimization uses the cache content on the device to determine what is available for peering. For the upload source device there's a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. From 993b0de41ea61f5dd9e7648bbc7cd7df4ac8a355 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 17 Apr 2023 09:11:51 -0600 Subject: [PATCH 101/139] Update waas-delivery-optimization-faq.yml --- windows/deployment/do/waas-delivery-optimization-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index ab1278c4e9..91340c5637 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -101,7 +101,7 @@ sections: - question: How are downloads initiated by Delivery Optimization? answer: | - Delivery Optimization only starts when an application/service that has been integrated with Delivery Optimizationdownload initiates a download (for example, Edge browser). [Learn more](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. + Delivery Optimization only starts when an application/service that has been integrated with Delivery Optimization initiates a download (for example, Edge browser). [Learn more](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. - question: How does Delivery Optimization determine which content is available for peering? answer: | From 37d872deebb063b47cec8eaefb59bc985190a86d Mon Sep 17 00:00:00 2001 From: Christine Eaton <40660908+ceaton001@users.noreply.github.com> Date: Mon, 17 Apr 2023 17:11:26 +0100 Subject: [PATCH 102/139] Update windows-autopatch-changes-to-tenant.md Added a group missing from the list (after checking with Andre that it's still used). --- .../references/windows-autopatch-changes-to-tenant.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md index b330342957..bf23950f18 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md @@ -45,7 +45,8 @@ The following groups target Windows Autopatch configurations to devices and mana | ----- | ----- | | Modern Workplace-All | All Modern Workplace users | | Modern Workplace - Windows 11 Pre-Release Test Devices | Device group for Windows 11 Pre-Release testing. | -| Modern Workplace Devices-All | All Modern Workplace devices | +| Modern Workplace Devices-All | All Autopatch devices | +| Modern Workplace Devices-Virtual Machine | All Autopatch virtual devices | | Modern Workplace Devices-Windows Autopatch-Test | Deployment ring for testing update deployments prior production rollout | | Modern Workplace Devices-Windows Autopatch-First | First production deployment ring for early adopters | | Modern Workplace Devices-Windows Autopatch-Fast | Fast deployment ring for quick rollout and adoption | From 563fed4aa999013e18e2f096872be7680186290d Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Mon, 17 Apr 2023 09:30:17 -0700 Subject: [PATCH 103/139] editorial revision --- windows/deployment/do/waas-delivery-optimization-faq.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 91340c5637..1a0f413fd5 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -12,7 +12,7 @@ metadata: - highpri - tier3 ms.topic: faq - ms.date: 08/04/2022 + ms.date: 04/17/2023 title: Delivery Optimization Frequently Asked Questions summary: | **Applies to** @@ -101,9 +101,9 @@ sections: - question: How are downloads initiated by Delivery Optimization? answer: | - Delivery Optimization only starts when an application/service that has been integrated with Delivery Optimization initiates a download (for example, Edge browser). [Learn more](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization) about the complete list of Delivery Optimization callers. + Delivery Optimization only starts when an application or service that's integrated with Delivery Optimization starts a download. For example, the Microsoft Edge browser. For more information about Delivery Optimization callers, see [Types of download content supported by Delivery Optimization](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization). - question: How does Delivery Optimization determine which content is available for peering? answer: | - Delivery Optimization uses the cache content on the device to determine what is available for peering. For the upload source device there's a limited number (4) of slots for cached content that is available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. + Delivery Optimization uses the cache content on the device to determine what's available for peering. For the upload source device, there's a limited number (4) of slots for cached content that's available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots. From c250de836935a6b0ea08ca83af33fc0e97be6053 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Mon, 17 Apr 2023 10:10:28 -0700 Subject: [PATCH 104/139] add note re window size --- .../windows-sandbox-configure-using-wsb-file.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 4ff1d859be..e9790d83e9 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -30,6 +30,9 @@ A configuration file enables the user to control the following aspects of Window - **Clipboard redirection**: Shares the host clipboard with the sandbox so that text and files can be pasted back and forth. - **Memory in MB**: The amount of memory, in megabytes, to assign to the sandbox. +> [!NOTE] +> The size of the sandbox window currently isn't configurable. + ## Creating a configuration file To create a configuration file: From 219dffe4ef5dde489c5bc6f20a99628725c199f1 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 18 Apr 2023 08:29:19 -0700 Subject: [PATCH 105/139] Updated what's new with April baseline config --- .../whats-new/windows-autopatch-whats-new-2023.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 22a90e7d70..501d2c9659 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -24,6 +24,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Message center post number | Description | | ----- | ----- | +| [MC542842](https://admin.microsoft.com/adminportal/home#/MessageCenter) | April 2023 Windows Autopatch baseline configuration update | | [MC538728](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Update: Windows Autopatch quality updates release communication | | [MC536881](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Take action: Review Windows Autopatch Tenant management blade for potential action required to prevent inactive status | From 597f3d5679651f6fffedfd7996e413ec9328ffa1 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 18 Apr 2023 08:30:23 -0700 Subject: [PATCH 106/139] Updated date --- .../whats-new/windows-autopatch-whats-new-2023.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 501d2c9659..04d0ae58bc 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 04/11/2023 +ms.date: 04/18/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new From 225b3aa848a32fb6deddb759a4f0b3d2531a606b Mon Sep 17 00:00:00 2001 From: Tarun Maganur <104856032+Tarun-Edu@users.noreply.github.com> Date: Tue, 18 Apr 2023 13:17:11 -0700 Subject: [PATCH 107/139] Update windows-11-se-overview.md --- education/windows/windows-11-se-overview.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index f9adaaae34..44eea6b076 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -96,6 +96,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `CoGat Secure Browser` | 11.0.0.19 | Win32 | `Riverside Insights` | | `ColorVeil` | 4.0.0.175 | Win32 | `East-Tec` | | `ContentKeeper Cloud` | 9.01.45 | Win32 | `ContentKeeper Technologies` | +| `DigiExam` | 14.0.6 | Win32 | `Digiexam` | | `Dragon Professional Individual` | 15.00.100 | Win32 | `Nuance Communications` | | `DRC INSIGHT Online Assessments` | 13.0.0.0 | `Store` | `Data recognition Corporation` | | `Duo from Cisco` | 3.0.0 | Win32 | `Cisco` | @@ -103,6 +104,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `EasyReader` | 10.0.3.481 | Win32 | `Dolphin Computer Access` | | `Epson iProjection` | 3.31 | Win32 | `Epson` | | `eTests` | 4.0.25 | Win32 | `CASAS` | +| `Exam Writepad` | 22.10.14.1834 | Win32 | `Sheldnet` | | `FirstVoices Keyboard` | 15.0.270 | Win32 | `SIL International` | | `FortiClient` | 7.2.0.4034+ | Win32 | `Fortinet` | | `Free NaturalReader` | 16.1.2 | Win32 | `Natural Soft` | @@ -126,7 +128,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `MetaMoJi ClassRoom` | 3.12.4.0 | `Store` | `MetaMoJi Corporation` | | `Microsoft Connect` | 10.0.22000.1 | `Store` | `Microsoft` | | `Mozilla Firefox` | 105.0.0 | Win32 | `Mozilla` | -| `NAPLAN` | 2.5.0 | Win32 | `NAP` | +| `NAPLAN` | 5.2.2 | Win32 | `NAP` | | `Netref Student` | 23.1.0 | Win32 | `NetRef` | | `NetSupport Manager` | 12.01.0014 | Win32 | `NetSupport` | | `NetSupport Notify` | 5.10.1.215 | Win32 | `NetSupport` | @@ -149,7 +151,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us |`TX Secure Browser` | 15.0.0 | Win32 | `Cambium Development` | | `VitalSourceBookShelf` | 10.2.26.0 | Win32 | `VitalSource Technologies Inc` | | `Winbird` | 19 | Win32 | `Winbird Co., Ltd.` | -| `WordQ` | 5.4.23 | Win32 | `WordQ` | +| `WordQ` | 5.4.29 | Win32 | `WordQ` | | `Zoom` | 5.12.8 (10232) | Win32 | `Zoom` | | `ZoomText Fusion` | 2022.2109.10 | Win32 | `Freedom Scientific` | | `ZoomText Magnifier/Reader` | 2022.2109.25 | Win32 | `Freedom Scientific` | From 1f1b40dadcf40e4ff7e3d698eb65000f0f0f736c Mon Sep 17 00:00:00 2001 From: olkorsha <130001581+olkorsha@users.noreply.github.com> Date: Tue, 18 Apr 2023 13:49:09 -0700 Subject: [PATCH 108/139] Add notes for how to gray out/activate the memory integrity UI Adds reg command for deleting & setting WasEnabledBy --- ...irtualization-based-protection-of-code-integrity.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index d40726923d..f0fd6be3e9 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -159,6 +159,16 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorE reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 1 /f ``` +**To gray out the memory integrity UI and display the message "This setting is managed by your administrator"** +```console +reg delete HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "WasEnabledBy" /f +``` + +**To let memory integrity UI behave normally (Not grayed out)** +```console +reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "WasEnabledBy" /t REG_DWORD /d 2 /f +``` + #### For Windows 10 version 1511 and earlier Recommended settings (to enable memory integrity, without UEFI Lock): From 9fb21d4986c32990333a4dbe1b3cd906f6cbf5d2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 19 Apr 2023 08:46:56 -0700 Subject: [PATCH 109/139] edits --- windows/deployment/update/waas-wu-settings.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 46e13890a1..bb8d50b541 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -35,7 +35,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | | | [Windows Update notifications display organization name](#display-organization-name-in-windows-update-notifications)

          *Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | -| [Allow Windows updates to install before initial user sign-in](#allow-windows-update-before-initial-sign-in) | Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or later | +| [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign--in) | Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or later | >[!IMPORTANT] @@ -266,7 +266,7 @@ The organization name appears automatically for Windows 11 clients that are asso To disable displaying the organization name in Windows Update notifications, add or modify the following in the registry: - **Registry key**: `HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\Orchestrator\Configurations` - - **DWORD value name**: UsoDisableAADJAttribution + - **DWORD value name**: UsoDisableAADJAttribution - **Value data:** 1 The following PowerShell script is provided as an example to you: @@ -283,7 +283,7 @@ if (!(Test-Path $registryPath)) New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null ``` -## Allow Windows updates to install before initial user sign-in +## Allow Windows updates to install before initial user sign-in *(Starting in Windows 11, version 22H2 with 2023-04 Cumulative Update Preview, or later)* On new devices, Windows Update doesn't begin installing background updates until a user has completed the Out of Box Experience (OOBE) and signs in for the first time. In many cases, the user signs in immediately after completing the OOBE. However, some VM-based solutions provision a device and automate the first user experience. These VMs may not be immediately assigned to a user so they won't see an initial sign-in until several days later. From 25cc48a48cfb814406e0ff1dc1f26ef9a17960c9 Mon Sep 17 00:00:00 2001 From: "Daniel H. Brown" <32883970+DHB-MSFT@users.noreply.github.com> Date: Wed, 19 Apr 2023 09:23:11 -0700 Subject: [PATCH 110/139] Fix broken link --- windows/privacy/Microsoft-DiagnosticDataViewer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md index 976780994e..82b280bbf7 100644 --- a/windows/privacy/Microsoft-DiagnosticDataViewer.md +++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md @@ -40,7 +40,7 @@ Using the Diagnostic Data Viewer for PowerShell requires administrative (elevate ### Install the Diagnostic Data Viewer for PowerShell >[!IMPORTANT] - >It is recommended to visit the documentation on [Getting Started](/powershell/gallery/gallery/getting-started) with PowerShell Gallery. This page provides more specific details on installing a PowerShell module. + >It is recommended to visit the documentation on [Getting Started](/powershell/gallery/getting-started) with PowerShell Gallery. This page provides more specific details on installing a PowerShell module. To install the newest version of the Diagnostic Data Viewer PowerShell module, run the following command within an elevated PowerShell session: ```powershell From 2eef0e76a178a5f2bf5acb4b59e5f62d119dace8 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 19 Apr 2023 13:04:01 -0400 Subject: [PATCH 111/139] Remove note regarding Azure govt. --- windows/client-management/client-tools/quick-assist.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index cc7784c94e..9997673adf 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -26,9 +26,6 @@ Quick Assist is a Microsoft Store application that enables a person to share the All that's required to use Quick Assist is suitable network and internet connectivity. No roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn't have to authenticate. -> [!IMPORTANT] -> Quick Assist is not available in the Azure Government cloud. - ### Authentication The helper can authenticate when they sign in by using a Microsoft account (MSA) or Azure Active Directory (Azure AD). Local Active Directory authentication isn't currently supported. From 4677e7fbdc8803f96c4392cff96cdebea0977008 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 19 Apr 2023 10:12:50 -0700 Subject: [PATCH 112/139] edits --- windows/deployment/update/waas-wu-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index bb8d50b541..77a014acd7 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -35,7 +35,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | | | [Windows Update notifications display organization name](#display-organization-name-in-windows-update-notifications)

          *Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | -| [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign--in) | Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or later | +| [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign-in) | Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or later | >[!IMPORTANT] From 22e5103357a48c5518dcc2e5c372b97179fda765 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 19 Apr 2023 10:50:16 -0700 Subject: [PATCH 113/139] edits --- windows/deployment/update/waas-wu-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 77a014acd7..5d01b577d1 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -35,7 +35,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | | | [Windows Update notifications display organization name](#display-organization-name-in-windows-update-notifications)

          *Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | -| [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign-in) | Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or later | +| | [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign-in) | Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or a later cumulative update | >[!IMPORTANT] @@ -284,7 +284,7 @@ New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWO ``` ## Allow Windows updates to install before initial user sign-in -*(Starting in Windows 11, version 22H2 with 2023-04 Cumulative Update Preview, or later)* +*(Starting in Windows 11, version 22H2 with 2023-04 Cumulative Update Preview, or a later cumulative update)* On new devices, Windows Update doesn't begin installing background updates until a user has completed the Out of Box Experience (OOBE) and signs in for the first time. In many cases, the user signs in immediately after completing the OOBE. However, some VM-based solutions provision a device and automate the first user experience. These VMs may not be immediately assigned to a user so they won't see an initial sign-in until several days later. From 3c8cbf7faf4c7b1bbe7d920caada3aae2ee6fef3 Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Wed, 19 Apr 2023 10:54:12 -0700 Subject: [PATCH 114/139] Update wcd-browser.md place example URL within in-line code blocks --- windows/configuration/wcd/wcd-browser.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/wcd/wcd-browser.md b/windows/configuration/wcd/wcd-browser.md index 37887f4c3d..eed909eb0d 100644 --- a/windows/configuration/wcd/wcd-browser.md +++ b/windows/configuration/wcd/wcd-browser.md @@ -56,7 +56,7 @@ To add a new item under the browser's **Favorites** list: 2. In the **Available customizations** pane, select the friendly name that you created, and in the text field, enter the URL for the item. -For example, to include the corporate Web site to the list of browser favorites, a company called Contoso can specify **Contoso** as the value for the name and "" for the URL. +For example, to include the corporate Web site to the list of browser favorites, a company called Contoso can specify **Contoso** as the value for the name and `http://www.contoso.com` for the URL. ## PartnerSearchCode From 8315716c015320dbff91baec9fdf43229318bf7e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 19 Apr 2023 10:57:13 -0700 Subject: [PATCH 115/139] edits --- windows/deployment/update/waas-wu-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 5d01b577d1..0c088b2aee 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -35,7 +35,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure | [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | | [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | | | [Windows Update notifications display organization name](#display-organization-name-in-windows-update-notifications)

          *Organization name is displayed by default. A registry value can disable this behavior. | Windows 11 devices that are Azure Active Directory joined or registered | -| | [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign-in) | Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or a later cumulative update | +| | [Allow Windows updates to install before initial user sign-in](#allow-windows-updates-to-install-before-initial-user-sign-in) (registry only)| Windows 11 version 22H2 with 2023-04 Cumulative Update Preview, or a later cumulative update | >[!IMPORTANT] From 87ca402a6b33573d17a11ab9227c5060586b993b Mon Sep 17 00:00:00 2001 From: Adam Nichols <40191591+Mauvlans@users.noreply.github.com> Date: Wed, 19 Apr 2023 12:38:39 -0700 Subject: [PATCH 116/139] Update windows-autopatch-prerequisites.md Updating minimum supported OS to 20H2+ --- .../prepare/windows-autopatch-prerequisites.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index c2f86d2ca3..40591c7936 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -46,9 +46,9 @@ Windows Autopatch is included with Windows 10/11 Enterprise E3 or higher (user-b The following Windows OS 10 editions, 1809+ builds and architecture are supported in Windows Autopatch: -- Windows 10 (1809+)/11 Pro -- Windows 10 (1809+)/11 Enterprise -- Windows 10 (1809+)/11 Pro for Workstations +- Windows 10 (20H2+)/11 Pro +- Windows 10 (20H2+)/11 Enterprise +- Windows 10 (20H2+)/11 Pro for Workstations > [!NOTE] > Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Additionally, Windows Autopatch can only manage Windows quality updates for devices that haven't reached the LTSC's [end of servicing date](/windows/release-health/release-information#enterprise-and-iot-enterprise-ltsbltsc-editions). From f4426059c956785fa9465e003066072d6f0b795c Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 19 Apr 2023 12:55:35 -0700 Subject: [PATCH 117/139] Revert "Update windows-autopatch-prerequisites.md" --- .../prepare/windows-autopatch-prerequisites.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index 40591c7936..c2f86d2ca3 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -46,9 +46,9 @@ Windows Autopatch is included with Windows 10/11 Enterprise E3 or higher (user-b The following Windows OS 10 editions, 1809+ builds and architecture are supported in Windows Autopatch: -- Windows 10 (20H2+)/11 Pro -- Windows 10 (20H2+)/11 Enterprise -- Windows 10 (20H2+)/11 Pro for Workstations +- Windows 10 (1809+)/11 Pro +- Windows 10 (1809+)/11 Enterprise +- Windows 10 (1809+)/11 Pro for Workstations > [!NOTE] > Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Additionally, Windows Autopatch can only manage Windows quality updates for devices that haven't reached the LTSC's [end of servicing date](/windows/release-health/release-information#enterprise-and-iot-enterprise-ltsbltsc-editions). From 720432bd79d97cbf5b5099393d065c359b61a4e9 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Wed, 19 Apr 2023 16:34:52 -0700 Subject: [PATCH 118/139] reset all redirect_document_id to false --- .openpublishing.redirection.json | 80 ++++++++++++++++---------------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 723d827b23..4a67054982 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6538,7 +6538,7 @@ { "source_path": "windows/access-protection/access-control/dynamic-access-control.md", "redirect_url": "/windows-server/identity/solution-guides/dynamic-access-control-overview", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/access-protection/access-control/local-accounts.md", @@ -19313,22 +19313,22 @@ { "source_path": "windows/deployment/update/change-history-for-update-windows-10.md", "redirect_url": "/windows/deployment/deploy-whats-new", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md", "redirect_url": "/windows/client-management/mdm/policy-csp-admx-wordwheel", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/policy-csp-admx-windowsfileprotection.md", "redirect_url": "/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/policy-csp-admx-skydrive.md", "redirect_url": "/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md", @@ -19338,7 +19338,7 @@ { "source_path": "windows/privacy/windows-endpoints-1709-non-enterprise-editions.md", "redirect_url": "/windows/privacy/windows-endpoints-21h1-non-enterprise-editions", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/privacy/windows-endpoints-1803-non-enterprise-editions.md", @@ -19348,7 +19348,7 @@ { "source_path": "windows/privacy/manage-windows-1709-endpoints.md", "redirect_url": "/windows/privacy/manage-windows-21h2-endpoints", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/privacy/manage-windows-1803-endpoints.md", @@ -20343,27 +20343,27 @@ { "source_path": "windows/deployment/windows-autopatch/prepare/index.md", "redirect_url": "/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/deploy/index.md", "redirect_url": "/windows/deployment/windows-autopatch/deploy/windows-autopatch-admin-contacts", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/index.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-update-management", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-unsupported-policies.md", "redirect_url": "/windows/deployment/windows-autopatch/references/windows-autopatch-wqu-unsupported-policies", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/references/windows-autopatch-preview-addendum.md", "redirect_url": "/windows/deployment/windows-autopatch/overview/windows-autopatch-overview", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md", @@ -20378,7 +20378,7 @@ { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md", @@ -20428,12 +20428,12 @@ { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md", @@ -20463,17 +20463,17 @@ { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md", "redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-with-apps", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/configuration/cortana-at-work/cortana-at-work-crm.md", @@ -20493,7 +20493,7 @@ { "source_path": "windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md", "redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md", @@ -20518,7 +20518,7 @@ { "source_path": "windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/hello-faq", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md", @@ -20533,92 +20533,92 @@ { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-fu-overview.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-fu-end-user-exp.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-end-user-exp", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-end-user-exp.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-end-user-exp", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-signals.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-signals", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-communications.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-communications", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-reports-overview", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-summary-dashboard", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-report", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-all-devices-historical-report", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-eligible-devices-historical-report", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md", "redirect_url": "/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-ineligible-devices-historical-report", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/deployment/windows-autopatch/references/windows-autopatch-wqu-unsupported-policies.md", "redirect_url": "/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/policy-ddf-file.md", "redirect_url": "/windows/client-management/mdm/configuration-service-provider-ddf", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/applocker-xsd.md", "redirect_url": "/windows/client-management/mdm/applocker-csp#policy-xsd-schema", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/vpnv2-profile-xsd.md", "redirect_url": "/windows/client-management/mdm/vpnv2-csp#profilexml-xsd-schema", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md", "redirect_url": "/windows/client-management/mdm/enterprisedesktopappmanagement-csp#downloadinstall-xsd-schema", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/client-management/mdm/enterprisemodernappmanagement-xsd.md", "redirect_url": "/windows/client-management/mdm/enterprisemodernappmanagement-csp#enterprisemodernappmanagement-xsd", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "education/windows/education-scenarios-store-for-business.md", @@ -20638,7 +20638,7 @@ { "source_path": "windows/security/identity-protection/credential-guard/dg-readiness-tool.md", "redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "windows/security/information-protection/tpm/change-the-tpm-owner-password.md", @@ -20738,7 +20738,7 @@ { "source_path": "windows/deployment/windows-autopatch/references/windows-autopatch-privacy.md", "redirect_url": "/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy", - "redirect_document_id": true + "redirect_document_id": false }, { "source_path": "store-for-business/sign-up-microsoft-store-for-business.md", From 0ed866d1c6edceef373c263c7a71d94ebeba2634 Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Wed, 19 Apr 2023 17:20:05 -0700 Subject: [PATCH 119/139] Update waas-delivery-optimization-setup.md correct -peerinfo definition of output, it's not "connected" peers but rather list of proposed peers by the service + indication when it is successfully connected to a peer --- windows/deployment/do/waas-delivery-optimization-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-setup.md b/windows/deployment/do/waas-delivery-optimization-setup.md index 9fa907d90e..c26e194cd0 100644 --- a/windows/deployment/do/waas-delivery-optimization-setup.md +++ b/windows/deployment/do/waas-delivery-optimization-setup.md @@ -152,7 +152,7 @@ Try these steps: 4. If the number of peers is zero and **[DODownloadMode](waas-delivery-optimization-reference.md#download-mode)** is 1, ensure that both devices are using the same public IP address to reach the internet (you can easily do this by opening a browser window and do a search for “what is my IP”). In the case where devices aren't reporting the same public IP address, configure **[DODownloadMode](waas-delivery-optimization-reference.md#download-mode)** to 2 (Group) and use a custom **[DOGroupID (Guid)](waas-delivery-optimization-reference.md#group-id)**, to fix this. > [!NOTE] -> Starting in Windows 10, version 2004, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of the connected peers. +> Starting in Windows 10, version 2004, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of potential peers per file, including which peers are successfully connected and the total bytes sent or recieved from each peer. ### Clients aren't able to connect to peers offered by the cloud service From de8ceb80b3c99f1c638a044ac8a5f156813ec816 Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Thu, 20 Apr 2023 15:13:40 -0700 Subject: [PATCH 120/139] Update windows/deployment/do/waas-delivery-optimization-setup.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/do/waas-delivery-optimization-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-setup.md b/windows/deployment/do/waas-delivery-optimization-setup.md index c26e194cd0..04c0b9e893 100644 --- a/windows/deployment/do/waas-delivery-optimization-setup.md +++ b/windows/deployment/do/waas-delivery-optimization-setup.md @@ -152,7 +152,7 @@ Try these steps: 4. If the number of peers is zero and **[DODownloadMode](waas-delivery-optimization-reference.md#download-mode)** is 1, ensure that both devices are using the same public IP address to reach the internet (you can easily do this by opening a browser window and do a search for “what is my IP”). In the case where devices aren't reporting the same public IP address, configure **[DODownloadMode](waas-delivery-optimization-reference.md#download-mode)** to 2 (Group) and use a custom **[DOGroupID (Guid)](waas-delivery-optimization-reference.md#group-id)**, to fix this. > [!NOTE] -> Starting in Windows 10, version 2004, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of potential peers per file, including which peers are successfully connected and the total bytes sent or recieved from each peer. +> Starting in Windows 10, version 2004, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of potential peers per file, including which peers are successfully connected and the total bytes sent or received from each peer. ### Clients aren't able to connect to peers offered by the cloud service From 5eb5bce4074db7502adc2171e4fb32e5ff8666f6 Mon Sep 17 00:00:00 2001 From: Michael Date: Fri, 21 Apr 2023 08:07:15 +0200 Subject: [PATCH 121/139] Fix typo --- windows/security/threat-protection/fips-140-validation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index 4f3fd11f90..85a59f77d7 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -628,7 +628,7 @@ For more details, expand each product section.
    -## Cryprtographic algorithms +## Cryptographic algorithms The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate.\ For more details, expand each algorithm section. @@ -1779,4 +1779,4 @@ SMB3 can be FIPS 140 compliant, if Windows is configured to operate in FIPS 140 [sp-3615]: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3615.pdf [sp-3644]: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3644.pdf [sp-3651]: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3651.pdf -[sp-3690]: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3690.pdf \ No newline at end of file +[sp-3690]: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3690.pdf From 4a3d1d34c3d56db0533a93a84d9f5355fffcd8d1 Mon Sep 17 00:00:00 2001 From: Marius Wyss <53998264+MrWyss-MSFT@users.noreply.github.com> Date: Fri, 21 Apr 2023 14:30:46 +0200 Subject: [PATCH 122/139] additional information for ScheduledInstall*week policies --- .../mdm/policy-csp-update.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 28b396eb2f..3215ea8066 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -3069,6 +3069,15 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie +The ScheduledInstall*week policies operate on numeric days. + +- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 +- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 +- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 +- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 + +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. + > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. @@ -3167,6 +3176,15 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie +The ScheduledInstall*week policies operate on numeric days. + +- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 +- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 +- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 +- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 + +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. + > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. @@ -3265,6 +3283,15 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie +The ScheduledInstall*week policies operate on numeric days. + +- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 +- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 +- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 +- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 + +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. + > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. @@ -3363,6 +3390,15 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie +The ScheduledInstall*week policies operate on numeric days. + +- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 +- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 +- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 +- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 + +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. + > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. From 04e13ecb77dcb861ecd8a7c6e887d99aee2a95fb Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 21 Apr 2023 16:00:21 -0400 Subject: [PATCH 123/139] Fix tracker --- .openpublishing.redirection.json | 2 +- ...e-active-directory-integration-with-mdm.md | 2 +- .../images/{copy-to.PNG => copy-to.png} | Bin .../images/{slmgr_dlv.png => slmgr-dlv.png} | Bin .../images/{WinVer.PNG => winver.png} | Bin ...e-device-installation-with-group-policy.md | 56 +++++++++--------- .../client-tools/windows-version-search.md | 10 ++-- .../device-update-management.md | 45 +++++++------- windows/client-management/docfx.json | 12 +++- .../enable-admx-backed-policies-in-mdm.md | 3 - ...device-automatically-using-group-policy.md | 4 +- .../images/azure-ad-device-list.png | Bin 84823 -> 0 bytes ...-in-your-organization-modern-management.md | 2 +- .../mdm-diagnose-enrollment.md | 22 ++++--- windows/client-management/mdm-known-issues.md | 2 +- ...-scripting-with-the-wmi-bridge-provider.md | 14 ++--- ...and-centennial-app-policy-configuration.md | 2 +- 17 files changed, 87 insertions(+), 89 deletions(-) rename windows/client-management/client-tools/images/{copy-to.PNG => copy-to.png} (100%) rename windows/client-management/client-tools/images/{slmgr_dlv.png => slmgr-dlv.png} (100%) rename windows/client-management/client-tools/images/{WinVer.PNG => winver.png} (100%) delete mode 100644 windows/client-management/images/azure-ad-device-list.png diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 70c9214e97..ab57f2990f 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20826,4 +20826,4 @@ "redirect_document_id": false } ] -} \ No newline at end of file +} diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 20a3fc0b42..6fba3ba595 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -67,7 +67,7 @@ To support Azure AD enrollment, MDM vendors must host and expose a **Terms of Us The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Then, the device is enrolled for management with the MDM. This step calls the enrollment endpoint and requests enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is available to the MDM in the form of claims within an access token presented at the enrollment endpoint. - ![azure ad enrollment flow.](images/azure-ad-enrollment-flow.png) + [![azure ad enrollment flow](images/azure-ad-enrollment-flow.png)](images/azure-ad-enrollment-flow.png#lightbox) The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Microsoft Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this article. diff --git a/windows/client-management/client-tools/images/copy-to.PNG b/windows/client-management/client-tools/images/copy-to.png similarity index 100% rename from windows/client-management/client-tools/images/copy-to.PNG rename to windows/client-management/client-tools/images/copy-to.png diff --git a/windows/client-management/client-tools/images/slmgr_dlv.png b/windows/client-management/client-tools/images/slmgr-dlv.png similarity index 100% rename from windows/client-management/client-tools/images/slmgr_dlv.png rename to windows/client-management/client-tools/images/slmgr-dlv.png diff --git a/windows/client-management/client-tools/images/WinVer.PNG b/windows/client-management/client-tools/images/winver.png similarity index 100% rename from windows/client-management/client-tools/images/WinVer.PNG rename to windows/client-management/client-tools/images/winver.png diff --git a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md index 71760bdd78..d936efcee7 100644 --- a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md +++ b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md @@ -4,7 +4,7 @@ description: Find out how to manage Device Installation Restrictions with Group ms.prod: windows-client author: vinaypamnani-msft ms.date: 09/14/2021 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -62,7 +62,7 @@ You can ensure that users install only those devices that your technical support ## Scenario Overview -The scenarios presented in this guide illustrate how you can control device installation and usage on the computers that you manage. The scenarios use Group Policy on a local machine to simplify using the procedures in a lab environment. In an environment where you manage multiple client computers, you should apply these settings using Group Policy.. With Group Policy deployed by Active Directory, you can apply settings to all computers that are members of a domain or an organizational unit in a domain. For more information about how to use Group Policy to manage your client computers, see Group Policy at the Microsoft Web site. +The scenarios presented in this guide illustrate how you can control device installation and usage on the computers that you manage. The scenarios use Group Policy on a local machine to simplify using the procedures in a lab environment. In an environment where you manage multiple client computers, you should apply these settings using Group Policy. With Group Policy deployed by Active Directory, you can apply settings to all computers that are members of a domain or an organizational unit in a domain. For more information about how to use Group Policy to manage your client computers, see Group Policy at the Microsoft Web site. Group Policy guides: @@ -83,7 +83,7 @@ In this scenario, you'll combine what you learned from both scenario #1 and scen ### Scenario #4: Prevent installation of a specific USB device -This scenario, although similar to scenario #2, brings another layer of complexity - how does device connectivity work in the PnP tree. The administrator wants to prevent standard users from installing a specific USB device. By the end of the scenario, you should understand the way devices are nested in layers under the PnP device connectivity tree. +This scenario, although similar to scenario #2, brings another layer of complexity—how does device connectivity work in the PnP tree. The administrator wants to prevent standard users from installing a specific USB device. By the end of the scenario, you should understand the way devices are nested in layers under the PnP device connectivity tree. ### Scenario #5: Prevent installation of all USB devices while allowing an installation of only an authorized USB thumb drive @@ -95,7 +95,7 @@ The following sections provide a brief overview of the core technologies discuss ### Device Installation in Windows -A device is a piece of hardware with which Windows interacts to perform some function, or in a more technical definition - it's a single instance of a hardware component with a unique representation in the Windows Plug and Play subsystem. Windows can communicate with a device only through a piece of software called a device-driver (also known as a _driver_). To install a driver, Windows detects the device, recognizes its type, and then finds the driver that matches that type. +A device is a piece of hardware with which Windows interacts to perform some function, or in a more technical definition—it's a single instance of a hardware component with a unique representation in the Windows Plug and Play subsystem. Windows can communicate with a device only through a piece of software called a device-driver (also known as a _driver_). To install a driver, Windows detects the device, recognizes its type, and then finds the driver that matches that type. When Windows detects a device that has never been installed on the computer, the operating system queries the device to retrieve its list of device identification strings. A device usually has multiple device identification strings, which the device manufacturer assigns. The same device identification strings are included in the .inf file (also known as an _INF_) that is part of the driver package. Windows chooses which driver package to install by matching the device identification strings retrieved from the device to those strings included with the driver packages. @@ -260,7 +260,7 @@ To find device identification strings using Device Manager !['Details' tab.](images/device-installation-dm-printer-details-screen.png)
    _Open the 'Details' tab to look for the device identifiers_ -1. From the 'Value' window, copy the most detailed Hardware ID - we'll use this value in the policies. +1. From the 'Value' window, copy the most detailed Hardware ID—we'll use this value in the policies. ![HWID.](images/device-installation-dm-printer-hardware-ids.png) @@ -351,25 +351,25 @@ Creating the policy to prevent all printers from being installed: 1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the class identifier to block. -1. Enter the printer class GUID you found above with the curly braces (this convention is important! Otherwise, it won't work): {4d36e979-e325-11ce-bfc1-08002be10318} +1. Enter the printer class GUID you found above with the curly braces: `{4d36e979-e325-11ce-bfc1-08002be10318}`. ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
    _List of prevent Class GUIDs_ 1. Click 'OK'. -1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks all future printer installations, but doesn't apply to existing installs. +1. Click 'Apply' on the bottom right of the policy's window—this option pushes the policy and blocks all future printer installations, but doesn't apply to existing installs. -1. Optional - if you would like to apply the policy to existing installs: Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' +1. Optional—if you would like to apply the policy to existing installs: Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' > [!IMPORTANT] > Using a Prevent policy (like the one we used in scenario #1 above) and applying it to all previously installed devices (see step #9) could render crucial devices unusable; hence, use with caution. For example: If an IT admin wants to prevent all removable storage devices from being installed on the machine, using 'Disk Drive' class for blocking and applying it retroactive could render the internal hard-drive unusable and to break the machine. ### Testing the scenario -1. If you haven't completed step #9 - follow these steps: +1. If you haven't completed step #9, follow these steps: 1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click "Uninstall device". - 1. For USB printer - unplug and plug back the cable; for network device - make a search for the printer in the Windows Settings app. + 1. For USB printer—unplug and plug back the cable; for network device—make a search for the printer in the Windows Settings app. 1. You shouldn't be able to reinstall the printer. 1. If you completed step #9 above and restarted the machine, look for your printer under Device Manager or the Windows Settings app and see that it's no-longer available for you to use. @@ -390,17 +390,17 @@ Setting up the environment for the scenario with the following steps: Getting the right device identifier to prevent it from being installed: -1. Get your printer's Hardware ID - in this example we'll use the identifier we found previously +1. Get your printer's Hardware ID. In this example we'll use the identifier we found previously. ![Printer Hardware ID identifier.](images/device-installation-dm-printer-hardware-ids.png)
    _Printer Hardware ID_ -1. Write down the device ID (in this case Hardware ID) - WSDPRINT\CanonMX920_seriesC1A0; Take the more specific identifier to make sure you block a specific printer and not a family of printers +1. Write down the device ID (in this case Hardware ID): `WSDPRINT\CanonMX920_seriesC1A0;`. Take the more specific identifier to make sure you block a specific printer and not a family of printers Creating the policy to prevent a single printer from being installed: -1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. +1. Open Group Policy Object Editor. -1. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions @@ -408,7 +408,7 @@ Creating the policy to prevent a single printer from being installed: 1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the device identifier to block. -1. Enter the printer device ID you found above - WSDPRINT\CanonMX920_seriesC1A0 +1. Enter the printer device ID you found above: `WSDPRINT\CanonMX920_seriesC1A0`. ![Prevent Device ID list.](images/device-installation-gpo-prevent-device-id-list-printer.png)
    _Prevent Device ID list_ @@ -416,7 +416,7 @@ Creating the policy to prevent a single printer from being installed: 1. Click 'Apply' on the bottom right of the policy's window. This option pushes the policy and blocks the target printer in future installations, but doesn't apply to an existing install. -1. Optional - if you would like to apply the policy to an existing install: Open the **Prevent installation of devices that match any of these device IDs** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed'. +1. Optionally, if you would like to apply the policy to an existing install, open the **Prevent installation of devices that match any of these device IDs** policy again. In the 'Options' window, mark the checkbox that says 'Also apply to matching devices that are already installed'. ### Testing the scenario @@ -426,7 +426,7 @@ If you haven't completed step #8, follow these steps: 1. Uninstall your printer: Device Manager > Printers > right click the Canon Printer > click "Uninstall device". -1. For USB printer - unplug and plug back the cable; for network device - make a search for the printer in the Windows Settings app. +1. For USB printer, unplug and plug back the cable; for network device, make a search for the printer in the Windows Settings app. 1. You shouldn't be able to reinstall the printer. @@ -457,7 +457,7 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -1. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions @@ -477,11 +477,11 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. To complete the coverage of all future and existing printers - Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' and click 'OK' -1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it - this policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. +1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it—this policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. ![Image of Local Group Policy Editor that shows the policies under "Device Installation Restrictions" and the policy named in this step.](images/device-installation-apply-layered_policy-1.png) - ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.".](images/device-installation-apply-layered-policy-2.png)
    _Apply layered order of evaluation policy_ + [![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.](images/device-installation-apply-layered-policy-2.png)](images/device-installation-apply-layered-policy-2.png#lightbox)
    _Apply layered order of evaluation policy_ 1. Now Open **Allow installation of devices that match any of these device IDs** policy and select the 'Enable' radio button. @@ -522,7 +522,7 @@ Getting the right device identifier to prevent it from being installed and its l 1. Open Device Manager 1. Find the USB thumb-drive and select it. - + ![Selecting the usb thumb-drive in Device Manager.](images/device-installation-dm-usb-by-device.png)
    _Selecting the usb thumb-drive in Device Manager_ 1. Change View (in the top menu) to 'Devices by connections'. This view represents the way devices are installed in the PnP tree. @@ -531,20 +531,20 @@ Getting the right device identifier to prevent it from being installed and its l > [!NOTE] > When blocking\Preventing a device that sits higher in the PnP tree, all the devices that sit under it will be blocked. For example: Preventing a "Generic USB Hub" from being installed, all the devices that lay below a "Generic USB Hub" will be blocked. - + ![Blocking nested devices from the root.](images/device-installation-dm-usb-by-connection-blocked.png)
    _When blocking one device, all the devices that are nested below it will be blocked as well_ 1. Double-click the USB thumb-drive and move to the 'Details' tab. 1. From the 'Value' window, copy the most detailed Hardware ID-we'll use this value in the policies. In this case Device ID = USBSTOR\DiskGeneric_Flash_Disk______8.07 - + ![USB device hardware IDs.](images/device-installation-dm-usb-hwid.png)
    _USB device hardware IDs_ Creating the policy to prevent a single USB thumb-drive from being installed: 1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -1. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions @@ -553,7 +553,7 @@ Creating the policy to prevent a single USB thumb-drive from being installed: 1. In the lower left side, in the 'Options' window, click the 'Show' box. This option will take you to a table where you can enter the device identifier to block. 1. Enter the USB thumb-drive device ID you found above - USBSTOR\DiskGeneric_Flash_Disk______8.07 - + ![Prevent Device IDs list.](images/device-installation-gpo-prevent-device-id-list-usb.png)
    _Prevent Device IDs list_ 1. Click 'OK'. @@ -608,7 +608,7 @@ As mentioned in scenario #4, it's not enough to enable only a single hardware ID - "Intel(R) USB 3.0 eXtensible Host Controller - 1.0 (Microsoft)" -> PCI\CC_0C03 - "USB Root Hub (USB 3.0)" -> USB\ROOT_HUB30 - "Generic USB Hub" -> USB\USB20_HUB - + ![USB devices nested in the PnP tree.](images/device-installation-dm-usb-by-connection-layering.png)
    _USB devices nested under each other in the PnP tree_ These devices are internal devices on the machine that define the USB port connection to the outside world. Enabling them shouldn't enable any external/peripheral device from being installed on the machine. @@ -628,7 +628,7 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. -1. Navigate to the Device Installation Restriction page: +1. Navigate to the Device Installation Restriction page: > Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions @@ -641,7 +641,7 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Enter both USB classes GUID you found above with the curly braces: > {36fc9e60-c465-11cf-8056-444553540000}/ - > {88BAE032-5A81-49f0-BC3D-A4FF138216D6} + > {88BAE032-5A81-49f0-BC3D-A4FF138216D6} 1. Click 'OK'. diff --git a/windows/client-management/client-tools/windows-version-search.md b/windows/client-management/client-tools/windows-version-search.md index e7316b19c0..42f0454fa7 100644 --- a/windows/client-management/client-tools/windows-version-search.md +++ b/windows/client-management/client-tools/windows-version-search.md @@ -26,7 +26,7 @@ To determine if your device is enrolled in the Long-Term Servicing Channel or th Select **Start** > **Settings** > **System**, then select **About**. You'll then see **Edition**, **Version**, and **OS Build** information. -![screenshot of the system properties window for a device running Windows 10.](images/systemcollage.png) +:::image type="content" source="images/systemcollage.png" alt-text="screenshot of the system properties window for a device running Windows 10."::: ## Using Keyword Search @@ -34,11 +34,11 @@ You can type the following in the search bar and press **ENTER** to see version - **"winver"**: - ![screenshot of the About Windows display text.](images/winver.png) + :::image type="content" source="images/winver.png" alt-text="screenshot of the About Windows display text."::: - **"msinfo"** or **"msinfo32"** to open **System Information**: - ![screenshot of the System Information display text.](images/msinfo32.png) + :::image type="content" source="images/msinfo32.png" alt-text="screenshot of the System Information display text."::: > [!TIP] > You can also use `winver` or `msinfo32` commands at the command prompt. @@ -47,8 +47,8 @@ You can type the following in the search bar and press **ENTER** to see version - At the PowerShell or Command Prompt, type `systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"` and then press **ENTER** - ![screenshot of system information display text.](images/refcmd.png) + :::image type="content" source="images/refcmd.png" alt-text="screenshot of system information display text."::: - At the PowerShell or Command Prompt, type `slmgr /dlv`, and then press ENTER. The /dlv command displays the detailed licensing information. Notice the output displays "EnterpriseS" as seen in the image below: - ![screenshot of software licensing manager.](images/slmgr_dlv.png) + :::image type="content" source="images/slmgr-dlv.png" alt-text="screenshot of software licensing manager."::: diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index 06053d6ba5..9680e7249e 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -41,7 +41,7 @@ This article provides independent software vendors (ISV) with the information th The following diagram provides a conceptual overview of how this works: -![mobile device update management.](images/mdm-update-sync.png) +:::image type="content" source="images/mdm-update-sync.png" alt-text="mobile device update management."::: The diagram can be roughly divided into three areas: @@ -69,7 +69,7 @@ Some important highlights: - For mobile devices, you can sync metadata for a particular update by calling GetUpdateData. Or, for a local on-premises solution, you can use Windows Server Update Services (WSUS) and manually import the mobile updates from the Microsoft Update Catalog site. For more information, see [Process flow diagram and screenshots of server sync process](#process-flow-diagram-and-screenshots-of-server-sync-process). > [!NOTE] -> On Microsoft Update, metadata for a given update gets modified over time (updating descriptive information, fixing bugs in applicability rules, localization changes, and so on). Each time such a change is made that doesn't affect the update itself, a new update revision is created. The identity of an update revision is a compound key containing both an UpdateID (GUID) and a RevisionNumber (int). The MDM should not expose the notion of an update revision to IT. Instead, for each UpdateID (GUID) the MDM should just keep the metadata for the later revision of that update (the one with the highest revision number). +> Over time, Microsoft Update modifies metadata for a given update, for example, by updating descriptive information, fixing bugs in applicability rules, making localization changes, and so on. Each time a change occurs that doesn't affect the update itself, a new update revision is created. An UpdateID (GUID) and a RevisionNumber (int) compounds to comprise an identity key for an update revision. The MDM doesn't present an update revision to IT. Instead, for each UpdateID (GUID) the MDM keeps the metadata for the later revision of that update, which is the one with the highest revision number. ### Examples of update metadata XML structure and element descriptions @@ -77,15 +77,15 @@ The response of the GetUpdateData call returns an array of ServerSyncUpdateData - **UpdateID** - The unique identifier for an update - **RevisionNumber** - Revision number for the update in case the update was modified. -- **CreationDate** - the date on which this update was created. +- **CreationDate** - The date on which this update was created. - **UpdateType** - The type of update, which could include the following: - - **Detectoid** - if this update identity represents a compatibility logic + - **Detectoid** - If this update identity represents a compatibility logic - **Category** - This element could represent either of the following: - A Product category the update belongs to. For example, Windows, MS office, and so on. - The classification the update belongs to. For example, drivers, security, and so on. - **Software** - If the update is a software update. - - **Driver** - if the update is a driver update. -- **LocalizedProperties** - represents the language the update is available in, title and description of the update. It has the following fields: + - **Driver** - If the update is a driver update. +- **LocalizedProperties** - Represents the language the update is available in, title and description of the update. It has the following fields: - **Language** - The language code identifier (LCID). For example, en or es. - **Title** - Title of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 x64 Edition (KB2526305)" - **Description** - Description of the update. For example, "Windows SharePoint Services 3.0 Service Pack 3 (KB2526305) provides the latest updates to Windows SharePoint Services 3.0. After you install this item, you may have to restart your computer. After you've installed this item, it can't be removed." @@ -106,10 +106,9 @@ The following procedure describes a basic algorithm for a metadata sync service: 1. Create an empty list of "needed update IDs to fault in". This list will get updated by the MDM service component that uses OMA DM. We recommend not adding definition updates to this list, since they're temporary. For example, Defender can release new definition updates many times per day, each of which is cumulative. 1. Sync periodically (we recommend once every 2 hours - no more than once/hour). 1. Implement the authorization phase of the protocol to get a cookie if you don't already have a non-expired cookie. See **Sample 1: Authorization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a). - 1. Implement the metadata portion of the protocol (see **Sample 2: Metadata and Deployments Synchronization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a)), and: - - Call GetUpdateData for all updates in the "needed update IDs to fault in" list if the update metadata hasn't already been pulled into the DB. - - If the update is a newer revision of an existing update (same UpdateID, higher revision number), replace the previous update metadata with the new one. - - Remove updates from the "needed update IDs to fault in" list once they've been brought in. + 1. Implement the metadata portion of the protocol. See **Sample 2: Metadata and Deployments Synchronization** in [Protocol Examples](/openspecs/windows_protocols/ms-wsusss/2dedbd00-fbb7-46ee-8ee0-aec9bd1ecd2a)), and call GetUpdateData for all updates in the "needed update IDs to fault in" list if the update metadata hasn't already been pulled into the DB. + - If the update is a newer revision of an existing update (same UpdateID, higher revision number), replace the previous update metadata with the new one. + - Remove updates from the "needed update IDs to fault in" list once they've been brought in. These steps get information about the set of Microsoft Updates that IT needs to manage, so the information can be used in various update management scenarios. For example, at update approval time, you can get information so IT can see what updates they're approving. Or, for compliance reports to see what updates are needed but not yet installed. @@ -118,15 +117,15 @@ These steps get information about the set of Microsoft Updates that IT needs to An MDM can manage updates via OMA DM. The details of how to use and integrate an MDM with the Windows OMA DM protocol, and how to enroll devices for MDM management, is documented in [Mobile device management](mobile-device-enrollment.md). This section focuses on how to extend that integration to support update management. The key aspects of update management include the following information: - Configure automatic update policies to ensure devices stay up to date. -- Get device compliance information (the list of updates that are needed but not yet installed) +- Get device compliance information (the list of updates that are needed but not yet installed). - Specify a per-device update approval list. The list makes sure devices only install updates that are approved and tested. -- Approve EULAs for the end user so update deployment can be automated, even for updates with EULAs +- Approve EULAs for the end user so update deployment can be automated, even for updates with EULAs. The following list describes a suggested model for applying updates. 1. Have a "Test Group" and an "All Group". -1. In the Test group, just let all updates flow. -1. In the All Group, set up Quality Update deferral for seven days. Then, Quality Updates will be auto approved after the seven days. Definition Updates are excluded from Quality Update deferrals, and will be auto approved when they're available. This schedule can be done by setting Update/DeferQualityUpdatesPeriodInDays to seven, and just letting updates flow after seven days or pushing Pause if any issues. +1. In the Test group, let all updates flow. +1. In the All Group, set the Quality Update deferral for seven days, and then, Quality Updates are auto approved after seven days. Quality Update deferrals exclude Definition Updates, so Definition Updates automatically are approved when they're available. Match the schedule for Definition Updates with the Quality Update deferral schedule by setting Update/DeferQualityUpdatesPeriodInDays to seven. Let updates flow after seven days or by pausing if any issues occur. Updates are configured using the [Update Policy CSP](mdm/policy-csp-update.md). @@ -134,9 +133,9 @@ Updates are configured using the [Update Policy CSP](mdm/policy-csp-update.md). The following screenshots of the administrator console show the list of update titles, approval status, and additional metadata fields. -![mdm update management screenshot.](images/deviceupdatescreenshot1.png) +:::image type="content" source="images/deviceupdatescreenshot1.png" alt-text="mdm update management screenshot."::: -![mdm update management metadata screenshot.](images/deviceupdatescreenshot2.png) +:::image type="content" source="images/deviceupdatescreenshot2.png" alt-text="mdm update management metadata screenshot."::: ### SyncML example @@ -189,19 +188,19 @@ Set auto update to notify and defer. The following diagram and screenshots show the process flow of the device update process using Windows Server Update Services and Microsoft Update Catalog. -![mdm device update management screenshot3.](images/deviceupdatescreenshot3.png) +:::image type="content" source="images/deviceupdatescreenshot3.png" alt-text="mdm device update management screenshot3."::: -![mdm device update management screenshot4](images/deviceupdatescreenshot4.png) +:::image type="content" source="images/deviceupdatescreenshot4.png" alt-text="mdm device update management screenshot4"::: -![mdm device update management screenshot5](images/deviceupdatescreenshot5.png) +:::image type="content" source="images/deviceupdatescreenshot5.png" alt-text="mdm device update management screenshot5"::: -![mdm device update management screenshot6](images/deviceupdatescreenshot6.png) +:::image type="content" source="images/deviceupdatescreenshot6.png" alt-text="mdm device update management screenshot6"::: -![mdm device update management screenshot7](images/deviceupdatescreenshot7.png) +:::image type="content" source="images/deviceupdatescreenshot7.png" alt-text="mdm device update management screenshot7"::: -![mdm device update management screenshot8](images/deviceupdatescreenshot8.png) +:::image type="content" source="images/deviceupdatescreenshot8.png" alt-text="mdm device update management screenshot8"::: -![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) +:::image type="content" source="images/deviceupdatescreenshot9.png" alt-text="mdm device update management screenshot9"::: ## Related articles diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index c90a4dfc5f..1aecb97d90 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -62,13 +62,19 @@ "jborsecnik", "tiburd", "garycentric", - "beccarobins" + "beccarobins", + "american-dipper", + "angelamotherofdragons", + "v-stsavell", + "stacyrch140" ], - "searchScope": ["Windows 10"] + "searchScope": [ + "Windows 10" + ] }, "fileMetadata": {}, "template": [], "dest": "win-client-management", "markdownEngineName": "markdig" } -} +} \ No newline at end of file diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index 03f598f6ae..c60b1439b5 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -28,9 +28,6 @@ Summary of steps to enable a policy: See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Ingesting-Office-ADMX-Backed-policies-using/ba-p/354824) and [Deploying ADMX policies using Microsoft Intune](/archive/blogs/senthilkumar/intune-deploying-admx-backed-policies-using-microsoft-intune) for a walk-through using Intune. - - - ## Enable a policy > [!NOTE] diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index b06a046e5b..fc976f6277 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -107,7 +107,7 @@ When a group policy refresh occurs on the client, a task is created and schedule If two-factor authentication is required, you'll be prompted to complete the process. Here's an example screenshot. -![Two-factor authentication notification.](images/autoenrollment-2-factor-auth.png) +:::image type="content" source="images/autoenrollment-2-factor-auth.png" alt-text="Screenshot of Two-factor authentication notification."::: > [!TIP] > You can avoid this behavior by using Conditional Access Policies in Azure AD. Learn more by reading [What is Conditional Access?](/azure/active-directory/conditional-access/overview). @@ -116,7 +116,7 @@ If two-factor authentication is required, you'll be prompted to complete the pro To verify successful enrollment to MDM, go to **Start** > **Settings** > **Accounts** > **Access work or school**, then select your domain account.Select **Info** to see the MDM enrollment information. -![Work School Settings.](images/autoenrollment-settings-work-school.png) +:::image type="content" source="images/autoenrollment-settings-work-school.png" alt-text="Screenshot of Work School Settings."::: > [!NOTE] > If you don't see the **Info** button or the enrollment information, enrollment might have failed. Check the status in [Task Scheduler app](#task-scheduler-app) and see [Diagnose MDM enrollment](./mdm-diagnose-enrollment.md). diff --git a/windows/client-management/images/azure-ad-device-list.png b/windows/client-management/images/azure-ad-device-list.png deleted file mode 100644 index 607c36c307f4f59244dd64ebddfd326ad459dfd3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 84823 zcmY(qWmJ^k7dA{vGa^Wrf^>s442TlaAR*l#Fo1Lqp&&{+q;yO75JPvT)DT1W&|UNL z`@hfg;aO|nalY*Pth4sH?z8v4t_Te^1tNTEd^9vPA|=K5T4-qK@Td1h+-Fbs*+H}a z9_Vgb3h&U$M`?GT23WSTsdxgBz6ZGMQg*8*XVXe zGz)c0tdn-kpbSMzuNc*m;_|&od;?pIqB>me%ll}Q`Zrs~7eCMhg5K+-4bvP3_B3wO z`y6?oV1Tk`wZ?Pb|F4ng6V%Gd$)!{gz$*WbdEtDUTfjiBoEtNu)T~oGj*pL594T%q zjir~BWq{H}kScWngcoRcJ$QOLfo>)xy(Zt-aEVr$*s!>v$)V@}_mhed-bVU`B5;XO zuXbo?2;}ZwTUJ_X^(QlPYzHVToT#vQ8od8=@-)q%L@nWB6(U}9%cmh&9o4tS+j{AP zyJx@=Na1|q;pD`#5EU6|6_7>$SMuWSURN#A+-ck|g$5@>bJV)3>s+GWK?jmaWiIN#UQK z`T_?6*J}{fkaew9bTB~4QLz^sWxWS`RzA=67!OeVjBOgfs$Hj3;a$9_$swVO(|^a8 zC1pfq_e)eEeROoR9B--7AL|g&23GAqEjMcX9gHpSslAEbY|Zxa zUevK~t;+X$fL(cIJX>yHb|{H=+k-t}ePd&TIyzOvxxDTb0e&vfXKHHdvuT@%(_(*M z?E=i}$Uq92zV9%WA%)zVE^(0eUuh41`+c`dzVWicOKZ!W6tuheOmZsoK4-!^Eq7_| zbC4fOX4b-3K9bR~y$Fn>I@{Wg)1lon$hV0cj%vPg*6Nq&X0T%nB>4yBF zuPd&Jk^+qwB)$1|lW+6AYWTc?+q#im2P%e{olnO4hwI>IX#!gn(o6%()o1^^JO?vEkv;6H{sF z&Vg2rivZdTF%0P6R)HJuEu+1z@XdtFfzWHrYNil*+}F6*(|V>L;B^PUHH%d(&93cC zq74$Qoc@b~7kU(U1w*ELEh}MPLx4As%bnbqaDMeZBr2sO9)kLCWXPl&k!Vyb90;rmgdc#)Nwl|Reb-8o&8^?_ZBk}ewU7u z=Z0+;h7lz|;!4f(hyCX9nVZniB(=sQc|NrKk?@F$1&u@zK+#Khuj9*kUx$D6S_7R}Q7kjuHZ1~q^-Z8VKL!@{>kU~~xnMBbQ=h}eZTQtY-SelF zU{Es@$ZqjId3U!80RNLdOBt)peRbvbWabJ0;Hl!=GzB~+@O(YFyN8)iw{2)>iTSAY z?oe6E=iy>@N`7}xuk|$Ha*(s4_6Ur+E7HceVG0ga8wWMv)PfJH`l_W(H7mcWFywq9(V)=yEKinyCLi+LRy-L*Ydpg2L_kyS(BtD{Hb)1mjFNbsRsrt*SR z;Jr7TCv#Bmaf0DN^OPv_TCrj7jN!h6A9%3|O!Q`^zIFQX zehejP`=0hB27JGMISYQ66?^_Io>apL4Rs7a#S*S=uv30mp(V7)6})D{_T$AgH*Iiv zb@MYkjUPw3QPjkL!wOsUA|3%oJq(;31swUM6sBkGro};i-2!hXVg$^zR7(CTC-LO- z|0c=zLDtP`iD8qFvVz!)1(1)AM<{8c)Y6IbtyJfNYJ7wLfU{CrP(C?HOk?@f4H&b4MpvalT>I_}w|sw|jR z0ETUo^%8g1Cjd8|6F0Lgw^?V%hz?7SjEw%4D~$+z-f@I@TmYvgIFi)#)XU+_k)>bn zw>@5c30;3RrDxH3yHsiHN`V!4{J@Y08XX?aU#>J9MdYOtS83mzkBhaeQq<=AxyLdH zH-?5krZP`%vS#`VASqg2isIk;o@nm(`(1=Tempmkv4-{9uG&blJfMb9r)_zNlAbQq z4frv07cs|5qlI|uSA_QyJ4&fk+;P9+aj)WcCd+{7btlE7@C|X0ywJ|rNefHuLa=k- zSt|EC$16UvjjS9|bb}FU#^6+blIoOrN&NN*#*7!q)?^cK1Q7=KWi}ap+mNhV=e3d& z8_Bkzp<-m;pk6?)e((paLfYo{6B}-$Huf0N!XaTD?TJZg+T|Axa({G> zG1{eC%3*Shqnp%|?uctG8UiFYPvA7kDX2uhkxnho2_IuKyk^E|I_cIwjsSNtG}n+? zFM4Z9qOq{OSm=^FB}s~RFq8=P-cM8So?3%^5{5$jhv)|*wAiA5LS73AhF1h$lpr%7 zr@(&j4vSab0t*{n4K4V3QeNJvThbTqi z#dKfOiaB2l^fb!c9n_2!oOzYezsda(G7P?FK=mPkcVmw=i+dRH(X{ANSy^O>B)Lgn z3CwOA^s)%w%UCeKMbCz9W<_EHq85Z1Zc+2VJ6ohW>Rf%c*Azl_aiW_ucHXKRXJr*q z#4EsN*kM?&-G8cVdaFeZzHdgCIQV5X856Q;|tkWR+kq!co@Uh-k{eQUd zHVlbsC3cwu>CDBfWGfbvjX$4gOj;Nc&1d2%@SwcFS6*-i)C5C4%5Y~2e42UB3UZ9U zPh9BUcn_zAH6^2;$nU*;U&!QQ1Pd%f0xN;!yfFpRaV@uqn^CXHumRffmfuCb=UTtj zDW)MCCzu#KbQJ@OEm*ypyAMHQUrUq)R-cQ`3xQcq6neMQq8ih0G9L?3U*IpK@$=S_ z#G%Q?sr{$6-r;&KHJtYxZCgKDPwV!URTVjTI$T~uMMYWVV_ZhN<6fX);p6^q^K2*P zeC}$y5kaveZQ2mSTx_4?=D~@(C1j&sY2o9y|8TIe_tb;XGqNoh#Ipg!?pGNe&DBDf z1@3^4F{s=JB;pY?>RQKCp+)<%Tk(xRQehkZB#RD4SQewGrn_3(-ZG~dtuTf z>CVgJf7wIsv)(6^;B-!H(?;Q5lV`nu6N>I=+D>TZiFvUW|KQaCM31}QvW7ovKu^QS z&r)9Ad)#tJXmq#LmX#S5j|86|Q=Uecty|)p!8;eC*S4kGoV6AmAs&ZED>c}TI2b14qaC{yk#u&3 zu59br8--FnkW@N`+AJN0=vy0Q+WcuA-~M9H*R;PfjIZs?*)Z1ne`JQl+KLpt#wQhn z=@7Ft>mcI|u0DqN! zRLy?VS@M0623)zrGT3C9y2g%oC{#uCErFz2w%#emVyVZbp;@0~sYy)?in(FMcgwH` zb>LEeIBwzC@IybQIHJU9MF-GM6RL=1tg(JSuBBBdr3H&Qs1GUWX6k;nvV^iICgXLg zR$*aQb8JqT1l5VxBzzH8sX8xQ9G-7X$wg|MzHzSk0=oNn{T0*qxL7yeJ=%QQe*7mw z%$O%v2d6?Z&W-~8XoE)3q=P9A5ZI+k9For(B_xriR@ zLgyE^XPKy+fNcp>EPw-}$^H5`+Y|M`I+-$+)b&d4qNAjub&{o*72Y~t5)pBsMD}p( z&b4Ije2`eKcw5`z*r|{?S7a#X6#7YkeJhhYl4E6A*(}X)T3xc;K{ifZklb^ad`<^B zNmatALhSg**%EgDCRJ12?<*k?+eOmK@1DtMuj9LIbb#U1(b9&cv`4A7Ivr{jbpcMt z;`79K1{GlbX?Zuq^e>vI&`W@ zgP*Ct_Z3LP)a-k&Cw3cElX-}Bqyr@|47ajm=G0(?#tg*gZXw9Yx4Jq|Tr8z+xME{a z!~<&^4fH&fh-6o1%QT^jx?Dv(dABENSl;HPq?0kL*0k<$mTd z&HmVIaP)Ga{Be6;2uu$ZHe4Yie2(d8_%Y3gU4}v0z9TR#2>kHL$D`X2!-`hdG*X%G z`376iOP)6Z+S-W37jIluKMx|Oru;z^Vc+O`IEJhn_08UZCNH$0*+X(c{ih$^>psw%I+aCMGCvnTPf+<#j6K~ z09kVxgjPl7lX0u0#I>K2RBq{m&O1z#m*-;=S=vJ-t}O811W4jZ!{M2=2~s zOR(O-XIn3)6;#LWFmkUR=rqWkKm)+~?wF>lsTzkj?w87T7x1VcNI})Ui z3(vm+v-Hki1YRs&W-$aI%u0d+=i@@$a_P@2fFJ36c+)@W3Nugm!8G^IK6u7;zp&Iv z8u=m8d$27rcoNo9b@7MNaOo_H1$tbq(|`?v+D~c&)OUZWb|7X$t7`y5oJa`H32W7m zOuRDw+TR-ZA2*)of5YuUh0#LEjL-`dG2UHUC^zvFcsat0c=LYU3YHRp4X!9<$Tc6l{dPsn=;8f!VVBS${QYH zoA|{eG^McJj!#e0;Dlntf{$E*6wiIgLE#tmse4PIdFW3+MKcM^0Fn5pphq$N&-`%)qZGQaNv^)O zlJ0iq*?xYS^UE7nS6I!fomQ?}B2f1qk##x%71buG38e41dBe0)3(cHV=10@{r|6f# zS(xc18D|G!0faRS3m;C-K~><#4m6XZ7+cKIi*kgHpm}WY`>XZ|)BE(yOjW6Ew@5)# zYbxQ7yO+z;I9>qUpjN8!vI%RFb1cqqSk`9M~o zS_$nd8QJg5j`^?p=8nWo(<_eNr|vJg7q8eiZb(nc0vr1uoRyy97e{Jc><1Uulf-EGS&rd;QE}Hy{nM-u{?hNt(FE(gQlub!Ghv^&*dz)@ zbDAZzP;vIEsz^jsZ&c~LL;c-vs2!w3Yr&pR^ujhsydtS<Bg6*21o)iGhAx4{s+|t6luY5OX9)b+)t%R&D=Ua^=q8a}cDXp_Aj; zx(?s5^Wz&+V}%PxP8ZKwyd65_9V@KK4QFx>ko!tgNyar4aO5;KL3-Ykc~CAOjCte5 zu|RmM=1(zW4)ecfl!-R{j{MhBkH&ygctjA&?*u_guoN)b4jCcTmH_w?qNB+I-CtQT zxq&t7wD1?_m}`AR2fntBsnwK)p9CoT&2#COlqznmT7GroW;k4nyt{Z=*%a7nuzgh6 zro{*xm+@Lubm7H0p<79%r7M1h zv)sGlBd&vSJ}>$ZeuosK6avI6h_b>E#x!Zb$>hSJ+lH9h{I#>nAb9{upk@cl(`4}(CmEK%bBC9p=;-6zJe8ilK zq^pn1!|;#ZPk_~^+O>i7ioF&~GbMuh-p*j&ErmtZdQ{Tb0a@mFc)eacxn5NQwg4SD z$IC~)0ey}KYTpR0`+3z_x&W%SX1mId$n5g*YYlg4DsE+=THTCDJwJ4bY!@dz!GbS&I@D^cC2EhDxr6<-=kyIDpIpd?_!IlA3$ODW(2gg5q%r6G zX@I;Hy=^$G^=L*fR&sB&KGQF0pt18>mFr}c7|#j#b#7ZnH#42SHiA=CMHfFc>OwMO zaC7j@vMXju#?QH3SLm;4;iw4xz$e1jV^g<05%VI^R%d7_el zfgak0^83D>{qv+Ae6%ga_zQ@;bk(bW^u`4&EcV!;aw(M+7+)*ZZHQur_;#%}FC*g- z$|$do2;h&gJF8n5(ThFPZWkv8O|J{5nNMXSy`~i(7R7<}UAG%PkI|kj6L)VBk%JO) zW((t4CiyABo?nXmQv6%aZ)fSGBRcjVgmSxwNox(7C|#T|y~@BA52}|T#$upvF9TPX zT330{=DY0$kLo}HJt;@UbZKq8%&W%8R-Q#AUQgt?Q;-bo=3y!t_DFn9dw=Qd_LXpt zP-m%lLw{F|&rUE1)Ue0+1rp)U=smU!Efqf^mMj^3D?KoD65a4l`#UU=@%QwxuF^zf9*V$Z(? zdQq5rSm%{-)#Q%Qo!N{J*p+l+ZPL!Mge)a*`?4Zy{g-t?G2r>=m`2-n;?8kJtf*iW zPK_|GnNauvM}zTuoNh)IDG-~-0C z=kn_7W5v9qck+ctT#rqd1t8Hmjfxp zqd!%)+^x_Tt2csl)E45tw2zxPo? zq)E5DTyIvea_5yTv+@cNTpDCfI~7hGT8P`-iv`s1{yqdDmkIjR;Jcm&#EYELmVSK6 zl4ba{rIVB#vEsiY&N@7>1~vv^A#XT&1AF+r^=5Cr_t)*!8=o_t=J=N9oK$JN`ScKl z=s=Kk#n|;DsY087pMromY^WaX9m!XxHj<**YqTcd& zNnsoq_}r{d-v4<(tme30MATl@g}J9NlpwXs^SXhKv4T!$chjX>c?bg}T9vW3sD$!@ zw>kE0XKzAwk1QhVm%Mmi8IIuBhU~8-vs=~R88*f0y8bMQ|D1FnR8hr(c`h$KU5De% zIdi_p48IU}crI=8g}q#GocQ#`GxSSnGXRas3K8}Gf0M*WuQ)|;_rd6F0f%q%7l@@6 z==RmRJa-!PuBFL7{&8=k5ThA_c3sx`fIU~4Fx6bYjeCCVbENh9LLtpzmP>P;o)p^d zYZz<1`&h=+b0co0PlGi>tnIb@M#4aMq(vqp;a2?LY>`C5RdzYD9BbJq>IjSZRf{Fg z8V4{nSofKNSB2h>9C$I5cfpwH*rF9@2Nd4ggTsE77pfSn@-iN6g^1D$~sp636@4#^M7?L^S% z9m4_FP+0LpWhL3K(Rs5+qhTDx2x?@b$|D1&PUaEr<#A_R3E}!2rK4JI^NcgPteqU` zH2u@ou8An>AcnI9ZhXBHTzXqF_mTd`-l$%gonBI>?z$_{UJku~se@i_T&dmumy1c9 zzDFOgS_>1@jYgYV#|qru%cC@kP`&#@A#Z)0yPjD9ZNT4#KfyB*se@ko?Ee5SyvLsq zl^8m7^@ON$awJv@7m69ah=%F8!YXjUBpLZfhQCzc={Na;QOyr^Ju zQ3fLbG@`1xYl_ovw#rOsZ9!3G2j*8B;IpLZ8P{fAwY+N1_BEl@Yr~walI{b%{P!Vq zR(|gG!>&lT--sFX+3LReAKSG9$2?z&Pa?!#7WjM3g5_oJym$+bk)7fz76o+X zQPX&RjTe4@*%931)qk$$qw80*NwbgcnugIG|Lr#|f00x* zOcN_I?ml{Lhjy)$hQ>}@`bRa@&$c1W*(ywE85o?Em6u2@@`dsVqZ9NL;tb4mXTY__ zjqOW%%(FE6pL`M;6Y&fGnVRdF$WBazb3C0+{F%;A%4DsGwgq>O5cFKRRU#SEWJGjQ zK7Tasi{{nZmUU%mE+iJ|#$=5t)cV$rN_9(4J;DOKV3VqAviZXoNb;o zkCdHI;N}ZU{V$Hy5Kzw0t?}`T{=}r|BlyB=-tF~5Kt5?#S8uU=BtN`@YX~6Om_Di` z{_MSB-S0^|0t$uT#OeFsT=B3q$;wRvv>g{>-Y+y%P*;7traAdOhge__uF0mZsaQ9< z`YElHL&SJfF2C=D|5Z(l6CqRX9R@=1tH1EAD7BBKm#Tg_zWOHm1Cd&X!Gy1k!Vuag zhRB+8p&CJ6*Y&2+VE(I$66v{QQ|kvek7AQkKbOO~zB;OA)0?Fb!fMbfaaxtI0XFMS z+bKHP3*CQ>RJ-zXlL^pTf3b7dKn>uzux`SVb6}G&6TO|`$)9(Iy_O*Nf5bg2!Ed^9 z#D=ZMX}ZE|9#NKfqFt_|=xVQ*j~_2}KZhMY;;*?WgWh!fW0>>b|%R z?IFyY9i~@cVJrX8{k)`ujL71zk-!o`K|zqOuXw@-1ASbZXOYp-Ht$LYL$b0Cd@U?; zMn*>qw64pZYbY4}3>uLks683&`+4|aR?MqlecR-*ue-)|zgIXFffe3Vcgo|NFi_z; zT9VmxD2MX3q}p=CNla|XrFeLg<)Lq|w?j)uhnK&f=15B&Nb_qzbz)cl9({)czCmT% zMjP{s;q(|EwJ|MGqMYb=c`$I_nH!ZWd>t8G3=lre+ku!0?U+uI#{>r^C{F`4On;l6 z7nc}s)ulk2$k07+ERy#estN*LIU?&SLmiMa!znwckKNxQg!!TMs*#6Eu+;Pv<<{uv zuzQ8qwA|e9Gchn8^zmW(Uve$GK=$^{+*~6c(x?AQ(BHnLct+9C%NiP%pg3fHAP4g0 zh~zUf_mQ@0dM*@39OK!<6h$0WzsU#9@5u^4H`RmB^;@Mb!&rM|09%+8tnWuv(w)K{ z@w&^`j9z$)2d?(nMFXkd1ilJ%a+2OL#k-C4%Hu9w{8^kXDM2rvnmxKaeDAzW=$kZ$ z7C@~met@r{s#@T$N?X8kC69Oo%huG$dl6)SC4b1<3lW#XQA^f(bf_r$h&T!(&e}$52pLWWs-`w7{ zd4#tKz|ce@n*r%2ZKft>eM>6~=dZs>JYjd|>}{wO`nP411i4~jT1Sp&_rZ6%ojzDZ4Xmbd`VX+m#fnEIgH)cScJ;+HVqm zXdbLMYjwt6w#_0+oh(11CD5OW2QnuozjMZ-S;l-b&BqzC)?zRcXC)m-4*giEPSmoTiIToUijiNNjE zuO4CXI+4>8iE}@8tvMS4iS$eW161Ko&Gw|Erp~EaOjuZY4SqucWP*S$^KW*ZJb#auW}8I@gVbmfPDn8;MV<6v;SkaboW zg|5cyZTvwz*B_hh!7{j-)4U(B;OHRb>(hTzt?_jgS%bzB6^yI2CdhMaBjv2yukrsT zo&^?>)v7Bna5&dgw>Pa`FKYxS8=UixV)N>SBu=;p=ZcXQpLkjh3QLL8{X%`8N-i;p zV%VvNvv+aM{uWS@*3cEj)*TmF>tw2cU!24rY?f$8_xW6KR@}0UlRM7nUBqoGi*(ge zu19GsZo`KcP3vz~kFbGb@>!w`4`cOJKk&PTASAH`r(&u3-#00hH=?-Y(b7OeBzECg zzxjTy?$`#J3sW{Pvar6E3H!=Z=CWsQ!*5v-kOrOKo10^`h0cutmEA_0TW|5B0rfewRDqtAod+^;x;z?yKt3=y9r;+S^kqN>pT!qPxp-a50&!yHE$I{ z3d`TNlS8fcB(h%etd}@txld5UZ9p3pxq?#M<4rX&$q@-=Wx2@h;=iF^CS?!V5v=@(mTb?tn`vX;#eF2wyTN9o@A7FmIgeSW1sax=3*8=Kbk;M9(64oBK)w9)aZpe zxgTN68s8KBS*y@-c%E?6%VoC~>J}|1PH4T?8?wdW7DevvfN9_Swmd4U^<-9zjq2~1 z3;Kte>Y^aKkUZ1b{BLkJ2u`@0l9UonfT#jPIO70kz^(-0#kj`#OXCkUc}LWl4x;J*U4DQdcbA zk@`|St8S)!#v%GXeN(68U*k@Foz!|b#*tQPR6?%Kid|`Jd*_-s!i`gW@!@^x40%^X zGJ8x^&md5@Qr1c(OBA;$jFle}4fQL$`lgB%MIe%6%DG?%{4%|c{IC&85jyYb{k56z z#x?M)*Wy@z9AKck%8W^>fBVAsg{+cvq1nZs1!pA(taX0QucT$8%kQvKnp!P%$dK5x zMYus2*Y}HBsnI%x2`D4c+<8UqDQ%K}svL>$G6YE^2f~rvKY_h!8QKuc)@`7B-^Rd< zi;)uN>faog6JZ>wE+wiI-Xue_%vP>ya}N~=IhZs$P9P3Dd~Zr;!%0WlOc{h@p<7EN zg@*%u5k30t^(P@+SwNrtJutEw#buGM9riiz7VUPHM7c00Tin{4)PLi-+2gy}<{iS0 zb~{%8{H4xU^M&j0r;__0ge<0}9f88lA_t!8Tw2=#5C}VbEn{?omOb8I`1>`w&yx##~DNqEE0VCHo;$Gc9uyPV?MUTH_PSn?%DBB zs43V5;?}k-Z_+su950FHgMQ8)-X$TE;8lzGIm**}qD8osFD!u)0h#ZFn-k9F-0P}1 z+IG5xFGO*=f$S}uMFSQRZ+}I|mUc2PE#OBlzqX?z_>4?Q)NMG4_Oa+VbE#b zO^FrmFzb}p98E7p4VJ)5Il(XAAyou@jgIN_w$M>r6LDJZ-(SS|)vH^C5m`2dJO8;b zbbP_HW$8~N3A*>I^NjL7?~!3l`7*QIawMXNT^8sr=A9v4%keyX{m0Ae5yOc zS2emwf)mmz-@E*&Jd;IiLs&__swTNAi?a~0yx^=dfG&YJzlu&OmU5JeI%=k}9W0={ zR~~GGFM#-BfgI5iWOnPWfvtu;r>sFl|3a`B#)&t?3dc4IRd-u@BK$84q{QM@SG&Rm z+u9Y3Yt3t1*xZagO*Ejol_$Q1XkLy+-})sE2eaONrKKmP4oALjp-QQcuk_0vskj#n zL8`;oP7UKIf^Gf53lg3UBj2LAdA@^UhU*_lahNE>op@AxzWIt@&n@Mcv7YC_0&2wP zvITZKe*GZg*EAeKb57!MWcA8Sgl}>tEyT%%TXKj_Z|OP_UsIk6ej#2S3zJm!1RP2| zxBMZEVdy=5O+)YtxA#}5jDu@^)9}o@40EURuR<6X7UO-u?sHaW)hGqTTYg(hJAFbw ze)FCx%R7^pua3C2KXTBd1y&UMTcyz`>tcvCh_66w!}-dql$fR7Y=94Nn1~H`HsfG0 z)8b~lu^W_3k3Jj_uS8pW*`G6Pm(^ZQP}qz8UyPW_P_u1_%x zwD@lpCGHgr`e^`Tq$SE~Z4ad0-F3;ky>0R0o&|abcnUIeBe8q)r7+g&ru}<1cz4#-L z3aV2A+T3(8x(2UrUBvd-!H!y)_(%0+Kc4l%(i#%=R1z<7(zRb9iab|V9@#RLS#73Q z9%sK3P+)=`p4g{VS?sz*t8)b`5_FYxZO@wxjUtssN`;5`A4AzK2Xrq(?!KVgJkaL7 zRLuGzh|bA!(IE%O!KH`mJNYSoP}w1VK=c;Y2HikD*Ax?5jh>*(@BI$Q-nyRV z7T<%NRovL6;>(q}6Hh^b3gfE&Uju#F1 zlsr_rZMvW*F+Gd;ZS}TeR;Be!Y`wtoII3WN-IeoE6J?cDCgxk#Vc*M;w0SpMBc`r{ zA0rb(-=Vx1XL)obl>q4=&^C|GTrC~-!u%P3aHX6ezZiWmxMArJY(84WgJ3!iOtrF+ zinzDAs{!8Cd#u^|;lzI7$p52Tg+& zIf>3YzY`!g2DFh;v!;OW5ufcv^J;9zp!LhXoI@&hSgb+<^2n$d*|z)Bq0b5dq_iE? z-UjZ17OuV*(|QoFcVSxT3L_A-+DqUQFyE;}evMlD#cKoJP+W%3y%l{Tv#vo9fIM&Y zz`f3^UK(fSvcahJZ6L~LYgQB;M+bB#Ky^~wsuRp3dD|bg(s85TlWxB~X5z$(Xn0-> zu0*D`0+Yp;Ml)f{JQ-~-q67HTPv-iUS3HiLQUn)hN;B%hRcSPVv*B=Zbi_HTNT^DDa;luHhhe>29*5W?8bv4Vqjn=?>=SIk|>t4XFTP z0G(Zp2rImV*VL|}new!;^aRe+K_=m{>i7F5q#LJ$VRN>$X6qb}$sat^N@{`VlPz*X5%RI{ z`O7GF_i@`dw49rYz0vASa(+37@6V}(Y1ZGi>fiNz6|f3;b1lvwF3b=tJj14a9{xxd zDV>2Yp7C>nA;MBsW$r`L%ovao_udl+jiImiKQMX^ zw!6s!{})R~tecxObVE37L;OU?=jN8nHXfe%TpkCi^~x=>O}1^Dq!oaf$1{^g{b2%Hxzy+BMqmn!bD zx;Q;PyJDT}9%e4K71vQ(@WMDacdJ z5(6eqC+yC6J_^d$Pk~~R*k5&byKz}bPWLJhed>sz9d!nL)>1x*Rw7#0eten(j zJ~)oVY0In46c>_(Wn+9~Vry4jW!_G!Tp3AmTZ@stwd07I)?d}3U<=n?BQpwZb=3n$ z?`138Nw9A%X^lVXmjDILNaIZJ*S4v;=>s?7JkNSZ8XiAT7i6*Gsp*!~xiL1h9Cs2R z8Biw-5Zk@AsVd7p0gY9>`)dX1CkX;?O?i+W=fD3b?oXg|{81t}nRfLZ#m#@ZhxtsI z+faskM$FgSU$=%+{*xa_{;smb_J7c8|EA3s@SlJ{{fW5VeI$%Ne}9C!LuFh{{9uJE zx(AomQaDa!m*Q7;v}p>ySD(*t-sWjuH1T~Lxg5$2Q|eYZZDp$Z`8nO5SMtih?<{Jb zZ!y8eTULQ`;UgBDT>dTfGrPB5m%}Q4hZM652?RsP$2*3R^lyt>RGIjZg0HJSz4%jrDllfL`l%QdAc;Pa#Ajl&Zc9h0|T3}n-ea4Bvwhz z*nlwj{ehL=Dh0&?06ZQ7=1%Kz5naY%5NF<_VVyg1Z5OIsf8(cAoU4a0EKg6b| z@6!KGPM)JU^^hoHQpo-D3sO-Wd5l7`hJMu4t^t8 zf?NRmK_Bi}%Zy`uj^zMpxCWPXC3;)0uTAX7P_N

    S>YfK1?BVjb|bGpYQC-OP832 z?iQ-tGt%ou>R*Uccf7$!pS~DLc5w-_Gx}WjtCqUSzr>h`!Edd5m9}KM-7!+?A1{k2 zOAn+&g40I*dBw(rzNJFY)*p)kK zPY^(P`-v71egF%qr8m0UW+0422sZ`|0jrAs$18So^*V@>thh~F>-Rwbp16zdUnS|*PjI=gYXA?`X9&~yPL9|yiX-CG%(33bnM}o&c0s=4&t{MeS*_Z)q)j~XlQvEL8A!FAa=6|;yoGDdP} zXoTUvz=&9}oVJm-tFsEbz8M2c+eZKP)HNU@ZSM<)75o@9(zYmJMaOjVzKFTJJ8Ell z+wjtO>isd04L)Ci7_AqrSkd-g|AVN%iRwKWmjhVK2#}X7^f7=XLo=Wu@Kop46v>+| z;C&ZuX3*z_Q{6V}wBv+Q$~KuH{U`+C0&_(3aW*vMKZR6xQO1gjuulcA)m1)k0Q;Bg zCxuKJF$UfBeIfX^a6rMGFAzp+b8)(ZPP_A#eq946x-i3+)7JS^*`=5^5o&`+WO#q{}&hvDn@p2^qP{&H|C+xnVA>nmtaru%tJQUg@ zomMl6d8hU*HJx?4< zvrHRFN-B89Ga8)p(nTK?N1IH+7wIeO^PZRKoU5^8RvPubPcC%N%{!}kLk2&N2ecZu zL7#`U0@H@Sd+u%Ycy6WBkgzf3d>7PDV{k59zdg;ToQ>Ki5wZ;l>$#tgM4a)2NfY*P z1su+NlJN2^YPr7uj%#Ort<4?MnH@VH;X52(2wGD-y$?o@zBVA->OMNY$0Rx2W{`^9d z%p^_SpQVs{Cep>vT~H(Lc5AS6lTV3Ik?=fU#Vwes!bo9mJUP|7yP)8}da$esBVNgMUuaN>-> zZC42zaS*H3*uS{(j?Kz+zDw3JX{#~q)`Mu;_wTJx)-g&zM`qnjtPlV1si+U#{Ko=H zvhOc6`@yIqRKT+&{2a2eM%Um~1>mhF2N|}k)yVP6bAR@1MwwUa4B>!^l>Ci*3B-+> zxLfW2Bz)V$S~)9(7{r!yN`I#Xm(l%C&-pP)nwfzjUx9-^NmN7Dn5sH;!eTJePf|tQ zWvzr+=`pD3_c5LAEne|!ScfDrmJ%;sYeLBIO$5f}pZ_a_?hP@ipSnfao(>mJFq&o_ z)5M6o%YMdIJ}u<^?QpYU{~?n1Hy#chBUp6MCsuWp>Xb1~s;F{$x_NBxRp?3b0F>{q zAwQ&HORHUWB!<>Xv;Q zYE%iEnxlDt7}Z|O8@Xqu5^eFj(pQuPvy2WnX;IJ&#E@4(BPUjP3;sPsxg2;sQ+tzQ#H-2?%>x^d$1cHxg7>NYUmG_CJ*OyBpbb zq30)&ew(!Wc42)sk*VK+KdQ%D%n?#(NHQFfxK3hsr4}}l<}}MBI>xg&>{pPH4u`c( zRXm}qzFJQ|u8z!9vFrvT{jY^~RH4bGyl&Q{H4eG#8zAic^=)r8^{gE7d|>ku z{?v6L8LNX-jBRi1?QK$ysl=M+GLefh$tl1GCxcf&J58*gEZYKb`;6 zdh~LqfLAvGdd>RUyZfhvx6lT=H*c<@kNbc~fmFKm3t>r-n&b%D7zTm`BI753^u4}%}e6)CoQ7dFob_#;~8 zGVbQ5#}g8S-2#};GEg@~p05s0;G5*WqNKOff$J9~=E}27-;bI|N|xigvJG>QWwSir zmeV5!cI{w+K4R`i7I*V8CZn}{q|*JOmi{=Mi&rYwWlr^S8;QU0?pz|P?gk7?i!BKQ z4_ifHg~sBre}UI6CCD;8%S-W~Na6>oIJakPf3;o*Yw~Sql&P>~NPg73;)r+4siP)U zHf(;2uWGW@&0`@58lNf6or9AIoboaSicc}q;J&TOh?TJ@lj05BK9 z^n5tClQCPp(jsQW>eI?NRzR1Q+H0>|iPh;+Oe(^d-VQVo06hWhXFd}XM?)8$j6k_R zg4aqo{ox3(bM2LvTesrd^H2oKV}T8a(sPVg!|$Fzm@#Wgl;QCLe2iV`Vsn z%;BREl=cMG(Z`U<=v34Vhq!nk0_`_qmi~Ac@xBO9OKm9v?SXwyx5=?b+NJXm^sfoR zd!zhd1f6g;=f=V?kAzd%-`%$?xSi+C) z4L#g99S)c*{)pN8}u*4N_HjA$J^xigPDd_4#pV6cbr;mFFk*)J@@l)vX}Qnp9iDf zWK1Nk#;WEtcfXr9SU!)h zGcnf}-*|68#0mG_n|q~sMU6r>A%{%DNu)StUf5^%5TBowc?rubw;J@N!J5Cq`pJf8gP^Z_oX0=H_ra z7j}9k?0s_dXawNNSS?>|uY^9XEbI-txxd|rVEf`PPq&w!Kie*!iwWb&g;4J4ybZNH zKN*wTa}iuGw-ZO7Z2P88w2S9v+IPSGVy5K?_=onLXvYq<_Q-<|2i=cE-v@GsXn!~Z zFSxOq9gQ?1e&R!<)x~`=Q5b2jhkak~?jR)G7HBCAXV1Y_5TFPI&LP{{Rfp10A`aDd zWhsLIM~OIIK~#GB>8EpBg`+kLq*M<-{BUk*njzY*w6#eA1qF^-K>zyJzn;z-UWx}V z+N{pdLzx8xiY+MF5`|YkwrJ2T0KvDDkS4$o{2v&^Q1HR;w9tnq8JL1^`0TOuS}ht+ z1tS3sKN%>%d-y8g!6VNkM8X3O0AKI|jtYRB!Pma_wf5|@&nCZ2PE1GyV1`c)f}-u* zFMjchDF=X;f-=B6{FmgL>~I7{udxC2;Xk?sVL{YZ_@DgApS0imz2D0Ozp+Rb0*)}s56Sjq=Ot%8Z!cts^ z9?bd)Psruk&6)Q0>8tI=t%cy>P`fo76Nd;XV{AR2$Zd|+7E}ecS zR>F((#06UamDt6%$r@CCmW6PQP0au&h(+-yvE z7DK0FVmNvz^q>DY(7y83-)YZ0`}s`M(}!BHCv?_t^Os|y-rAL`bM4m6px?dg2=14! z%m&RP?STiMXrKA)mxK3Dw-9~M7XdH$Gcp=72nW~woT>9!I|b~GZqi$JTDv%3{pwfK zcbVj~Ba>75%H`oEW;Tfqi@ zdPgaP>?&F##c?Q-RbReXW^6Lk_^5}7T6;Ri?^T_zzVcdo>BW~~!Em5G{NMw5>tt^T zeE;74+1}gVE?>ADK{h5Q;TIlz^ojQDGoNk`oOm!+$eyxmkvG|%`P8Q~sGmA{Iwohs z?Nd)Z+rIeuuf*}8cKOmmOb#!F{ZB?vj|uF_3+>9KTd}eYo4K{z#>0+3^XwPer=R(J zOp1@>j*E2das=$KUxD@D{zL7^p(E|SV-eRLjKCXl=2-Y#yGGugCK)T|W74oUeAD5B zQSXt*u`D42Eu|`OE(x?8JcXh}wjCdP?6Gu|0-qy=;Aklk=T9LiM>)|-6(lH)`lUPq zi8d5Y8!I$;%nl3Wql41IL9w;3`;N9^thNOgGtS@r-QUgr zu8oZW8jnZL@d3Zw_rWg)V*K60!*^2CXD-B(P7(v5q z^lxQ17Bu?JsXRZyl|oB{j*)J=KWO!m2R1Ypoy;$VQAOP-3|WsSp0{I}X_^qW)ehe` z(T<)7eV>?bH|H+2t2fWI*G@jy&R%@0?L9Eu9(nx!cHqdKz%vuUGXmbit#)I^mhP?S z+k+<2d#IA%Dh|h_V{&gy)B@M=)J&TS!#)1+bbI32``V|!_;{wzeR;g?KN@2gUvA68 z5ex#)`OBe4S7Wkq{JwVh*nMqk@1eYNcJ9K>2)-+AG8`GdxVRLnurQ75H)q?$D+|ew z6Av7UU^|)P#fRb1(65k>_IR}zV;9u@C|}tSJ&&@9kh?TIIud+Zh{a9FG$so(^ViyB z1Zrt&e`Lhi7M5>?PYhkz*V+RQA8SuM9h2_QJkg&1>=Vt;lyA*l$)wKe@O;W-X*Kw> zdb2GLg|dv(IggMtNKXUt6q}_qT^0ysv%Z>-XgYfY1N( zg?8rj*|r!;?`ifx8n|P68AO=~bSZp55FDZjydl3BwBLe<8*B5kUfL8BTZ{JPg*=)Y zd4^-9g}+&e#YFTzI!;GBcvqmM5P%|ZtQ<5YG6N%cz*$lnfrCRWr(eog&Q{V^5)>&I z$4(IiOf$F&hH!E6pzbqTL7}5o$H3N#z6E{(skX2ws(h<7N5M#YwC*Hu$Y~6NbK`eS zKvg~-{Ft8Jn`8GgA7ihF9*h}(@WMSEytA^!6RUr98KOXEa-*JP+}i0+xjykjAKI%c za4W|f!Ppbtj^t|Bp@KcRX{()nI1;iVTf8h?paUj2WMGyqp%aib84J94Z%4rxCH2t< z4}1mami#_5Z*b&Kd}cGqws5p#ldElS1egOyrrP1-d)u)S2iu{e`_ggyUED+jjlBmB zhm)UfZ=MVX9-jQ6M;?m+6;408nGIt-dFHkD&bhZEkSw)BM<&{s->Zg25RV6l=41Rz zF&*`DS4r@g2n*gHd=yB}2cOTzien}W*h}&SnbjEU!s=4Ha_xFMeSW6xkJa%*j~{4{ zJbAP|{`7tA_yf~zWHM&bmru4AU-@Y}dHSsk{9{wmYdDN$zX6WGJTrHroetVAU%QmS z)jNmhm%QX5PRB`%U z^O?pbLSB0VZA=O#_l`un(944{89TfuWEy&R-+^`@&WFcBe{P&_=P%*Qxi(8Jf-ft> zG5KmUfj@L(WFh3#1==(`>8?N_TSrK**$3S&AIA@V`O9BUT{q#R!~7Q;qUU@U+hyPN zgmO2@?t-RcAE$N}3T%uoQ=c8O$7)mHynp>sLj~FlvJulV0s1Rtu z^U{dDVXMaJ)u@8) zSP8#%vR#NcifCc&6`(aHGDmY75qJ&?zsN6eYpF0l#% zl*KBFQerSA6)4nkbpL`=7dSb1b*=7fr#Ql?A8p+O;l!=1)i-;j(7*lLzny)#_Y1Ff zaN4GEq|ALNMZFsen_oGJV;Vr0)g6P60-<1rm!JO3XOb3t`1#L&k-Gwn=o{boM$T-F z&DOcG0er_FyscHIJS%l$l<>yb^dSkJ47+%%K4Z2$EFi)!c-G1oEdnnYc(@GzfGuaZ z-5zis$rc$}@toXUdtgJLMK32(69e)_%U}G(Ut~FY$wNMQa3~uch}R`9FU2e|9P{GR z`EaghV|5l2uvtF^S!fU3|71FzZM`The(n-@mdy7d#9v*)c?&j)Q+!k`y}mc!v>yjF5NXu005UtMj74nEYr^rhc! z_doDR1jv0^&kA{TJRHX8zG!=`&CIU0Yu7KeQ}3J#yB=+iJo;GZPT1_wR2!c>5UYhl z?ev+LFuif6-I`r#pZ~&_l8!6E)0bWjXBW%nk(il0{K%uhv;DDJ?%sj^#HXH&3Est^ zXQ4gw>{ARQx1){o%9Trz_nFX1uc}CsxWAFI^6v%(S=9T#7nY z+IzxTJ`l1x7?19X{dLFN&p#M+y6K_1#q>qx!%X<;qTtA` z=`nr&joXI&koPKF&a^Ugp)Ib^pL1<&+-fr>T@i>++B>7{9}Df_M~}5*_w8*DJbX0#$o2f0(!-A)4LdRkz8ZRes~tSL*!ISRcY0q;B*quR zw%uEgMN0(vz58OZIX>U6-mez6pSdK_5z4H&@zj{OiZ}2K2*&-hx-hmwFi~(4gbgh z@9;%^^3YaL#5Z|@seFcSMT%B5D3drIyr(O83?JUt?gE;%gBQ4#FL>*}_%7f1%JR*y z*K2XS5{CI|TN-|`%`E<+UA;Wp&YZg59ytDF=-{zvu@FJxR0Q%E*K|0b)rofM&0FpH zU!IGgHru}R)yLZxA`OpvG03@a?pNBv{9;=Ur@m)$x*a_dEBOnVg0q=){;7mh$(h`wtv!hhuqZcjJ2SkDUBg6K~1N+nJ8VWa%9f zq>#_CW5+{Io=sQ^xzFZPns`1wcuD)-gY&T(9F71q6~SjU%CF_aQbS88+9MBrDrWoL z1nAuP*JI*xAy%`CZDM?XJNf3t;N4W49CuIuM%dV%NJk?;yT9tqWDx|f-)cYl(NALX z^iJ5;RQr$q>7PWfuv>901EIHPnYf&Yi3Q!i6nS&=b1_N#bhHUOy>YqSfB(^tuceQt zOhdoVoNu4|+!vxxKZCj)ybHO<>UlEkV&A^$I8KBdW0igGbWASyhyKj8+4&p6heN^J zz4=onKP@?M;Qlr-^qaxmuY`ksFtF1np_L7GsXO1yzBd9pue1($;J38KDG0JpI$tYK zcF$(mBU`i>pzmxzJvKwv`7XLIUjY5w=RTMIj=k`8CdYgi+lCVkZB1ZnC0srkZ0@r@ zLO_cfl2)#(9p9VJ;0@c^x)qo2MA^xxaX)B?3s4$ z=Bds%?7uH3)o;H3T6_Glhok*M1jb9T8jS!KI>8T~ITL_C%3!%J6LjSx-!IRb31Gk?~O~wlDe0$@yYwgTC3+|gV zL-2jvcKn_QG%?=b$KHJ=4IQ6+>FII=A^e%1KG?kAVm#>af(pO?rDvm)9j&92UJP(K z0#G=giLsbj2aWUlgZYP&{?SoeZXTSv65;7u8=LTkrRm^_AK;I~LL_u1R=Vy-c~`UG zj{a-0jC|{@lkK_Zo{wI-=OMoEg)gQpnmpc`35T^DD~gyH96IDZ=8Kuvuow|0{^`V@X8NTkz5>(!%PJL;+F@p13p-=BTY%tVm9 z78A#?l>>q2@PW=xd3J(c8)5gQpH2to=L7$U>zIVaa9y0=sL2mu;rW^c9q zVb}X6E~Z>>3$zr16YL9kP`oDKa{~#*JRk&63T^x_jAZM!R~>S?Ww7`qUwip@gO{!uEl?NE3Y^7TJks8z$u)pWyQ&AYQx8AotE+FRpnt8u z3bcSR7;8Bqc+dlnAH3(6KUQPH&`yW4o{big&(Z}=t6s{Gk0}KhzYhk?wU=LhBZBRX zFy5*5+rRVsZE`w-YXrlQ@fgqacylK4em$s z`&;(`gRi48-Wc=J^3__sz{~ zF~RU)S>FF1nro9D*2oVY#N?($FplxBMBl^B)9T^Gf-cT!YRXT*E(dSBH^be3;zaIT z9XQxMwC8F1{F+WURS&FqLY(9E@d7Vv7clMIn1JZ9(T z6@a^X_`~5XHt)LS^d`I&sCj1Nfxu?G>g~je7OkBw(|KUBOOIWfc$CcmKCk?nHf6Kg z&~^Tc9kG$VJ-Rl*F8je}Z43H+^z%P@zz;S==E1M!;JK%by?Qaf-otmDi?TCuJl$sI zUv5`!{G#nY(D61xYy?pc!>+dB@tCxZTnRhA753nnp77K80g16tCqCcLL%R<;_|9_o zo_KmDhIA7gawuQob(!qVMD*anBl$VZ`Or`Ana4jbm`I-%2t!n7K3HP43o?E`zX6ItE9zl03ChjJJcEG%{)#n|%uXDk&(hg1kBxRa` z7QqlY$}FWan9cyZAVA3J7ze_p5Rx_<^9zT332q?YHAe}zHk7WCYs@oHimX2T$)rKs zQglan%>G>K7tQ6sox@jj71Z^{{0_?CZa2L50`&PUtsCokJ;=+xt2}7yKHp^J*?n+8 zLaTaN9^*C+bQ`~R5GUxGLZv*$W+?TR)9E);O5kEchUSl7(4-q8p#Ry_! zaQV_vII)S*1Cbvi33=INp_5)U2yDUms*cx%TA5GB1Z;Y*_d^E{eQetkEIGmGoNkwv z(g_N>zPQqT8qWkHW+N#>KyHzuULJ!V^^-T(Rsqgk;*l51%Y)y)(cnjZ+AOQ{EuNm1 zx=D<5Hv?_vgkBVMv~|0DYyy;@L9epX=f3ZfS9Za6*rvML$#-N!a4FLsu*HrKgBQAB zOh6q!9ta&8$bqp zZ&(T6IUIg`#I2Z^z&yY2KEm+|zCQ(faIUiP8tXm7kgefgD&x6X?XWwg$# z4+%XRSO3bZkD{?~fEoiRUKW1ss-8M@3@z}$2aH!eA6u}M>Ps_LoGa~W;J6;j8RJ^< z-cn9kP>A+^Ydf?U#uk$aj(5eDoo%G(R}g@EIGmO3tXRRt^eqB%1l?t`Qx94M&JJGCJDmVh}#O8uFTN-M4_1 z3k(8Jq`Zz}$|Y9gOFlK$@ilpn+hUXP%ttvg*KQtoYhkMXtf#0Md zaKy~l$KHoW1*70kFx!2cq2+L1BVDjfgS6!(Kt?e1&rg0jh^wTln_w_v91gq=L33M~+oJ~jY8yWA)*MJJdb#fR98B8Jwnnj1lT8%#Qo|T{;`3p-o z!`N>`-KG4o|3q#>+rsW->)V~(r}2V6s0`=gQ)BeRmv}e?1o+PFI^Z!~>l{?~`8u{t zZ%qh0`h6kD#KA|dO@wmQ?DbL6)BJ)h?2t{+DCoL>m5WTf4FgBjBEb5P_DaYE;H4Eo zoD3K+fS9PHql`Y$O&8X@cJVHbw&l@Ack=Uu;TTtkcP`Lc&3KRwAJI<7%cjsMb^6-* zF8agl+OkXd;8mZ^vOni#SD=m`2MDmCG5IgTU+7y*@PZ{J`uu%u z!K$EkH451BU`4xfG}7^mbIYrj1Islg6?(BJj(ad5g0Qb=@$YQOIq3{qvzTp!Z=d`RJH3uS;a9p9D8U25q|oIMRqVsY>jHJFJ|_;G zbGUsa5+LA~N15b1ul}lC|0rKwirWtu+R3Xjif%m4H{vX)>y7yx)Yvv3<7S{Qedcd! z11G%l&@L67agr-2Pn$9x_iU;hI5Jpu$zv@D1zu2N1nN|({(z(4SF>REVBLR(qwrO` zqOX!V+B5PBu2tq7z~NeZG}br^Z=d%PP>y!>0*8Wx-i9uC_Z zT8Klu$Q9_&%{Dp_6R_o2{l?7NJCS{Zc45H-D&7bclPnJ}4b4W|`8FN~HX>l=Rv?-@ zw1Ae-m0ZzwJ1Gfh>CIH}!g#zD%2SL!O1@;JnyX0lLoQ3P;vB6lQ{&?FqaeIUZpj*B zS33Z&;worbSa9Fly&!xSWFx3W;G3SF%6mysGr5v4%~%#Z>`uVk^<$MQctIZ|#mW9(6PX5Oa>eeG&0`J&uv+<3jA$BMV>$5@g@`Dby? z8_sToF8g{=@Q*{(i9i|k+%p^H(E?HzWQPMPcCZzqy-eq4pt{pglc3WRZf>ICiN!m;Zi%m`dx=@2~V!qPvvaln<}6YFE%d|ENKbjqo37A-ENMp@%UM&IM?YRoq8m-lk|*LxflJMGzf$ z(ec4#_44w~wzv{2-iXfmdB+T9T8I4yKLlAr&EbX)n`omT{R9P#e7v#p6#hM=hmWbN zVTX85kE}##M%0dWW9`=U*)}_Oy&XCy7yx^cnsBkj6CNL3eMV!naK;5)aYLlNZjGhV^NMTlax8G(}F3|JmK>iCgHZKk>+&~`eWtLgEn zkfm9CIKD78ww`oFcdNrucXT$e!y!0EAMxKRjc#<~uL-8WVT(NEz3Rz%4mI>#(DSfQ z^v#I#zEs=S7M6nttAaee4*K)+dR_3c@HJFpkTRx4M)nzF7Q_W2JT*DstMI#<=?6ta zv3l?#h!qp;kv2YT3oim)T=@*)=zvFpR&J4ZjZ&x6rk6OIx$flyw)Zl?8hc;}!L4v& zYs;LV$*7~O{BF0UO;0*L(@D)eRnB3OEe5;atd2=W65d_KAF1%84z4b3KhT0Y1`RPr zld!sX4@?Y#fkDT>rh^C0`KFqfX1y3w*=pYooUdQg3+Ot0a8!ABpT6_0%F9+k_3?2) zOot-K#st?JnnF+9AGhT@9FyI#AS-`P8}*XJpxrlVmshSf-=9rbIntKr_k=vzaFqMa zZOBlN^-!MR4T9~#`=yw?S_}lQW8%9oKNtFKr&67c|5n4D&X~}IZbizc^7)OxNQU)L z-O7@u7$Tg`m>9PfbI%Uo7^Rm2tr*qmfWK^Ebu|`)3-r{tZcTd778GzTQOD3q<#S_7 zV}FQQfFAD_G$r)}M03yx?JLMeAnX!2B%3)>cq*yeuUEKT>+?>1Rei@&TC{0s;fXODe9yp`Uz(|l8!=;>cQOw%G#s-GB&=EqE&pdp%c<)u-Tms335~vHS81x}x1`tYTxFlXH-IY?2jICyG0`R+>5)LoqRtr>rY~?|&Wc_e*GauN33nBpHXv zq#mI<^Z&O19Ru6I0=XbstUD!)sfF9^0K1;*zAqOq{w@alsWU0Zx}JHo<6qOJbf zq8$r;7z@2}8z|d_P5FQUeI1Vp89R|rAEI>}gED=FpNxxq1KRYyPF~uX1 zdX7Qm7PdhK7(-;o;>kD$d2Av&N?Ga9K%@cWiZ)LIS>O3>6{?N)TZIqW=Kbn_5WIJW z?epSJfUF{^JKvnXt&DLaY#j3k!SV4!-$@khopHTO3|S@qtUdWFOB+@|>(iwTz!@jm zrLJs%cP(uO+7*^MR{eoXS??q+U2sNs!q-8{Dynq-YqK$dGFJ5>U}t}fUYo(#234!K zwYNez@1xIfgFB-zw|QD}O+G59;b&1(79h&~Np>c3cM|tseTI=DLi) z#v|zC?dNY+_x<4AwB;B!%m1)2AZrIOC#>-^Cx!i9dgp7b*^G+!&U4mjj37ieyXaFW z`^T7)#owj%?(D>vY|6+?HUnd4Q>BIPhR~GsYtH>CdN$I!S^LTh&TOn+kOkeSZilYz z?LH%}2h}#~Z6laOCGGJif_=A=vNGC*UHEvQg6;dmRuufh!qzA$7*MpmMjtzTkO^5% z7CvF{LB`p+{cyf_d$>Ugl)YaL-F3)y*kJc%^8v`~=hykhV?kY8({}6HPn;SgJ9e7r zfpB|ZXK^jix@T&;u^wRBg!gl!hNer?D+t(L? z*5U4sx#FMWPH{K*j?C#j{|ZGbE{4*oaRoO`PPHV<_7jjf!#p+(ZU)BcZ!^~m2BBa z^|(=Xo5(V^P&cbz=e9uuYu+#aq`_w6x|^`h_da;_>{_4|U}boZ@h}<2nC>8RNfq;c&eF*^&}4Yt2F zfi~)Qo5wpK+hE~NYE06-*1=}-l6QyvwEzn?o(IyE4OKo-uyK5M5$@mzydHQh(C$7A zwF@6VRG@u-NOgXDbU?+4q>E0oAylsuY6CLa%d?ZA_oALF&fef@xWLVkm!Y+K|zz9MI zx3{9rzdHj-%XZ-12KGsSUzZi_w#OOujk40+1e9djK{oQ@wX%Ib*qk$)x9sW;RTWEjvih4#Mt=b~A`T8`X{W zZjU%MC6FdHJHgICT$Z#Y^ie-)NqFy8YcvZSy;h$L*fK{x1mMZ-e7P;q%Akm!WJB78 zPda=QhOkrcZUftePd4nNHkPLBgvKP@@n=)oH|!sLMw3`Lox~})t_CXsDQ90K8brbO>Gf4STACK#L2us^)C%?Y(18*Oc z)kg;4(nfNw3@z19pN`FFx*MP`a3}m#4yw*Z8l6kd`*rGk$xF6_7sWeu<$*pA3i{{j zR(~ZQ*I*;hLH}CXh`Vrs;<*HuG6`+<&Sd$ZzD!j4UXViezAm)(Nw<)7=@XpwuIz&P zfP)vjm)=x)(W%CIi@~^*#W}oHugcWV7sdzBxf%;vi;nK25VzMwi;q}$s#yYlfdK$9SXOfULx& zzAqW&SDo7WJLfk8b#L#lqr39x=SE$sHfub_!+|c!FFPn)g}drk`)b#(C*QaXi0$_K z&JwtSC+j2bp!*`wQkxiG|1wj@*PtuTwOtH{!Q02N(@_0x?9Vki`m{Ok^R+;} zv2m3BF&0$)l1rsN?mleHb6$N*Ro=%{GINfO&2T$MpE}B`PLY$M7f z-!=_N=F#=yGM^VXvaYhw(Wt)!$DmDzqiZ91f3Uhqv!GCEK-W;ziPcp&{wnM8jbSeZNl{JRat0^qLk=@UPcIah|36xLwO{aGEF@vc6^Zj91KP^bFSzQ5Y*kFEMF&_*i3 zqXn(SEBU^M>9^GC;k7q~_4%wG+I`)9PmU zKDX9=+A6Z*pINqX(}C2LNb1fnSiQydp#K8>>lfalp9c5{vwqA@%|44ef_citx3dC# zMWy;LC>=EGH|uqdAMp5cPZVdrQt`q$y6aoauKiBk7`&EEpGCKN=q;Xt(jj&53eWcM z-=F>J9~fu7;!Qamz;%rs4)sgsC2#fB)28y!q@HWwI>$Mn-+7h&s>4#~O08C`NJo6C zCBR3;yDu4ayDi0gUzv%@QG?^{Ryrnbct@`J3C&1kArv~N8+1~8KsPC-YYERQe7laHov|@r0b7^NXy`5-U6WGasEH!b&WctA6Gb?!=J zfsJ#3BXQa8iF5zdtu_lmqkwFy4QfV_*rTofa^)Jd3F^7U7uV$sv>OZDHD36P10BW~ z9VUKx>P}8fCV!$Jal_T;O+SDtL$7*{1?u+sQss^kp6jn46hS`^j_O~k^U9Z;!;daB zmhF{X;6tl(;JWC5%XyXksso2?%huMRZ_=7%fy@hiq)R4xbkMo)$9A7m>-eV~Ju7a> zhr^1!|3;ee7KInXQeVw-92u@2Qzc|mPOmrdKwUWs!LT&0tby0)(u zV|AUn9jU&(EQrWmR6@JI6103Oy%I4&)>vKm#H|D{&kKKOp^Dst+9TL7ukV_|^lbywbS>b)`O3UZs+UbNnxQ zLG}G>55WeU2&oQ~h+Jawk@BTCU7*Y$7V->cMiL0a59BrZSp9@e+x3Y2)DyVW8>AtV zJ%LZ~f+J)z6tZy~4*5#U(eYCB8=4wa(7Vv1LFzOauCSXpOB{hW{)8^lVKx=Gf`)Dq zz=ld^qgK}K%GubMy`JqD^<~5?Hr~^;pp_FTGQz>>gBodR&1i?K9dr zFPx>bK$&Y$I17K}^-~{`o@CF!2M+Rqer*l21xb1CLd0?HT3=C@kCB&lmpp_NmJXxq z{y4#HPaPM+n%x_GXt0j0r-v=wt#_ij#S+~Z;CGMYqqT4l4Z%FXom;LLmN7j75%`qzLZz{q7TpqbtIrq z<1_Z@>24;gjX*mW{K>JRCGvCS8OE+o%6fn==^E5oh#5Q7>g0F^yh2O$>4>H@;z;_= zm2I@ahpJ=Dj%KvAMFfNGKxOcQq&L#7TeH~@yg3sNe9k53#-cAYYmZObUAlBB%N}{; zku_XW$r%lFN`I1e=q!0FzkdCCp35(L1&%e2x~>G2p~-5(R-X3yRgUIrUv2v5zYee% z!Bh|xw5$M)+ciB~Tm6L0Z7Et6@=0_659xs2qVciLHo(GSxAQh;YvG3sN-j-_F$d*Q-`M5rF8dEmf-Ov(^ZQ1=_*k*_cPI2Sw( z6l395=2{ts!v)F_NZL}8V%T5^*;dk49>!D|Plz*jUb693CUrP+H2HW0C!j98 zXp)a6b@fLv9)JAt#DkAThk6GO9&9I0oET8B&hHv09tiTr;sX_>A84Q#`YT;97P2JY z+R6%43G&RE17X&C`<-`^_T!-+@JvokQs-Pb2!#4mzkAxUlly$|5Ix3e9NmKqVQBFW ze`?(F^f57@3k~kqE<_u&3gYnSi-VmFyw`$PU~f3rBZrT)nc%5=TX=B#^y%aY{%P-i z7bol*9-!ZMVoYzp{dV^Km9Kmy`Cg8v0AjI}QjCX@vUUeJi@oyUuY{Y$(WNNYHezF&Pxl%6kLTJ%8K*x#zYzW1TKm!(InoQd zMwXez#@l2Zr>6GAHGQB{c7`G_j`B}*(5;V{CBHtsAU(>d9o<4%ocWprFd?n>YgLAe6kF9yU zsa>e5V}jyV5d3JWet^ly%^Nq{)oWMV-jHqjwy>YtPG+ZYI$jSydFkTicHe#Xr9IVR zv+Vv|D_V_y{_~%=^XJc}QU2y{{${&)@nU=7g%{eZufE#;@DKm6J@(jRDd?A8dMODL z1TYE%AAR)EBoZzFJ!ZHzVAlo&IPvG6doFQtNWc5LzngR*l5jEDb+s!e0hi>wkGr58 zmG*<-B@}b-CiKSzjLo^RnXquC_=k_^KX>k2PFU~@n8-Z!)KfXhFrI4n#v5;>bA+FO zzwm`GqyXUn6pewu`R1D`2SJdMl7;pRP#u9rKAQB6ulVg6PWTuC+2Rj_wXbKhQ>Wf;ue|a~+715D zJrfLu#`xGwXXxESXk=kU3u9aDfnp2fil6ie-vqUV zh3+|vqhZ5GkH*S2ShN@js55pEmm|&%R4dwdN4v6of90#k)z2-gx2r5hZ7=)|d$ zry{4dH{N`s9XfcZ9X@h6bpz0YsmZCdlj&&>;{`pjs0@*I_@Yk4)|ixL_3S76j)KuR zUxdT8wUK{vFkJRqN4fbW0*`{}Fx_>cd%J@d>n z>8t3O81S>7{j9whHvV7!m;YssgU<6s{KfI(#}hXw9W321U6torKB)Y@-W!cP38FIQ^6`(M#FjHyHh4D7t0@Yr&*CB3z4qE`Sy!HGicXmXHuUO?9{l1Lzeq(l+eDju zIMJc5U||yW)1Uq{%jKIz(iin=vYSla{1cr1xBu;bOGiMz9)J9aoH%g8c!-|@Ek4m<`T8T9{;HK6@LxUh zF*fxa(W_j)=~P2L@EW^(JeAO^5B2G`JmnHx_=5KWgF5Q74`ZYwWc#U4eJXWJow6-Z zc30Ox`A*o-y$Avfmwj_~wY_utOnc+4Q|)Zn>cnI?+ok1@$vbT*oUx!Z8_`(a)Sl^( z zu~LiZALQo5;nwVOOazAFxDWw-sf|xYL5Ni_z7aw7W)LtR`PvOdv_+@uD_5_ynb4i3 zSm~9oE1jWpbqz`nl?hmM^RNEuuiC%;xBoU{gkUAnPjTfh{^Bp%Km5Z#v~PUl8)%af+|N9mpc0JI3>s#My|KeZ# zizI^cG=t;ht!xAY1LtG}UXDQ-0w5J65Upd#fB3^6w%1>OJ=>V2m_1_{1{22jzW2R! z&YZ7ugj)%j*{jRZb1s}2$Acz=DJF6*2FwX@a&W2N4fy4xS6%JUirHYNoJ0i-$8u2m zLOU7-sV{x$OG&%n^~EoKF=uKNz!)i<2QceH?m*#jgzeCi|gVSAQpHSdz@q$r=!m|UVo##{m$EMer`V7n+fj=oEO6B z(Jzw{^u8SZ&4$cp!;oA9_nhbio(sy*{~&a;R-T?DW~k)zV(1VWUwuX0>urw-LG*_X z^jR6-4EeqO#_OTqKT7!;8{Iz`D+)5umprRPycfXqg^y%Q#>Rj@Xi^`~tc>(+EP@}q zP^Ts|#as2XQ;#judG+Z4d7;I4*d8Y#kr|njGg?f5;8#X&Cb!z5%b4htW9cy<8+ny} z)xp$)E4H>-S{-WFZp>x?8y%ZyPe1c)1h4}Ue9wlC?2URcnF~j~XYalY!ZQ)PUU=!1 z2+9}QrOQ{^#YiKgyiI*d*#*F+v#`C1nG|+e)9vc@ z+4f@8ldfF3mcegj#p-da#o{?u(4!%%y`dj=y7q_cuZCXPF?pgr^zb90^F!^eQ*XD^ zXD{Ru_RU!NUcYgx?cH}M`WtDlzj?C#d z(pLGYD}ndT@FCxialI6A2;T9afuBAd_9#yMN1FLF;$E{q6L{RiysGGnJ8loBX62IDW@7z3rST2z-zBucIh{FD|C$%LX+ z@Ws2o`J2DV;LTa8kG7Jj0E{*?o0wD?r|;aPNuL6RYxVG1UH#!P8tIDhFcAFKm-^~S z#-pvtgJhiQ7`HyG8u0~A+s5*&JoQa)4uoU-LQDeiflk43DEh>k)W^tU80RmXZ|6hd z?FL*9UG#9m%-IqbDc7klSjbw&v{Qnq6hL8EMR6d#6+B@P@ooP4-918lz#;0;+x)^j>P2ZYZY?IUbbCPf>g63NhL{FVQ9|8Dc(0aYC z2JKgG%(ORx26U-&F8aB6`Fa}-ybCeYkoVeKZ@0J4oNs5&Uu>_vaWW?rd-v^4+oR+B zM+MwI(5JEkwlC3bF@(<5VvcWugRQ_x7sUd$APAdG^J8=u)NL6y$0o!CcE`5VrRVU& zMgPSdwqnAroZXwKyYKpZGitMp4&UCKX$wXbtd$AY7-uCdU%)VPQO=>j%~7ID zP$ek1F_+^sxC%%F(pQ3y!kJ)tG2XZ-7lq?oDMKlr6+{I&AYVH{2<^)78vT-dIE+Cm z$4&{zsuUFe)KiWRW>)w|G1cMFId?ef{s&p013&TDxjZvANA(4IG!%XCRnpw0-FAf->lTO@%{+j(wU&`l~~2jg|m~inTfXaN?_Ion618U zbsYiwfd?K8-rXPcujIXByai-teA?ho$rzs`dCH6#2&l%0zw}vKdQYBgM4(kprus0> zl7)olCR%`u@tF;gap?*jP{!HN54$IJ1=uC~AcLY8IM%uLpss(Nz|d{ux<6|5=C;Pg zSf!pne=hyqp6NZQ_nsoQ?RY)(>-?pQ?aaBenXb>=j9?cN=PQ@ml^fS17+-A{uU?5D zHr|dNKh_Q(JJPO1-u%)+{%-ZbhaPO#ZeEYz7L&Ql7u)DWEKufW+v#&>BCvJ)% zE@)aE3R{Y_4020TWvvYy>Y&#XUbM5A>Hab4pjvNcW zJ2f3E+Sv@CZ$v;fQ5YVZY{!m2(DofT660EKCr^c+J%71fzZnzfx$p~NGwhD;vAxo5 zKC1MjY{oUemNp)VJ7sbRm%A1V_%m(kIh*DC1yczw!B{;<_1F)9lkX9@wPQbS zal*%r1z7oKBY1n5%zgE%F$qc=zi~6{;n@hb52o)h>6U`IA>aM!XYRlMf#~x@1lwcn zNCaHA&+ifh`=Kl7tKZVfLyPeiWT5RoiPb%wxg4{W>2@Rte*XFA!l=(jCr5Job7t1| z=PT_>5H9#0I4}q#OI9Y`iw}<9cRU9wS#8F|*Kz=a;|(17PAJ?JpLdRT+}4_yuKdN_jWRQOVXb8K>=9X)Yh~CtLkHXa4?f&ZJb0j;c;KN}+3szZuf;;;;-$7SG!pp_w?`kpuRZk0<89x; zBT;siq7J>ph~CNDEno{Y>Pjk^XiBd zCX#T{uWBb7me~^#1KM(`lAIfnff*gak zg5?Y{s6?O^oOJ>yB}P`lFavfpDD^O6qsSl4C4*T z-~UJs!Q?(@b2p(JP$^hH&$aPTAP%e&gRK?0F&mR>N~euF@+cS{;SZ(4EA=G& zQ%4Xt@xWV-le5O3;v-rp8JXEehUcqa{b~kLd=iue&)@l--^m9N@ET3%;LKfr`O9C< zzzZ)$$5UH5g0KFK-FWGPz64YE{sat(!s|odln^*dc%uzEi3T1|{0Z77Oa~4eOv5oD z_~IA8l;u`+f}Dq>+#7Lk8GdD+%0xe0cw}OCGiLF(A}KQ_<=m$r&1pRO}Nmwxg6gUPdu6YBPV@Tu)-hx=2lh6$T&+U$QGZB z8;{jhMkmOc-b;9jPP{2+0Y5owFO^-<4@dpTFaH0*AN)byCnq=g`a>suF`*KawW+|W z&q@Hjzph~I5p3xqSMb9VwtAbM`^MKIpgk0;$B8x@bymWw@|S+-$}wvv*~Q7lO)O}RMeu#((TCd?zVwCm zm9Ks&pMH<{7{R=w%LB6BG9`IcB0s$-@W!0UDwo`l9pcUxSO_TeZSP(ya6d5&e{*&w zCXd&0D_Gv)BN6=f?vJs|<`%a5%O1Kqa^!fFPv%2i?kO8&K5csk-RS4jE%wGoNOW9Y zExh<7x{o$MAL((@ALYu}7aZ(~o$-Nm)v;`g{^Gm(CiU>>%TZk`;IDn{Ywb_}^iR_V z3GjTchoi{ON|uihx6me;n5RGk_!2%zUxKQ>;dd?{{b^r;2mR<^=Y6;>(5jFFkC~Ui z<~M@wQSFZ<^urPH4@N+P&=Z+%24ez8z~J|V5ch^-uz!DFtY~#E!G}@WaqNuV;4zJ( zX7uU^mYleH9FCwv5S$HXZ&raO*XnYta1jbd3iwtK`an}TG(y-(Ksy?YsS>C>JTL)3 zw-tyn8kb-}SXO^%6u69;Fe!ufl!ntaCha&$0Y>5|jn_Dhoec1WlITyMvLYfQ0T?YD zzxw*1r0_8Sj@q?4`W74=Ic9j&fd>r|3a7y@~ zf3%{pf+0Ng&&(Pvb^#<45Qc|G>f=YrQvdLnb(0O?K#UPi{n1hV;|rcyF|!Liv-%`E zyiL0cnqBApqDa~l|L_2P_+$L|hjuiTUKkhMu`)LvIN{d5Xe;^vUKUi|uLBr0$H-L< z$FRrZ&)z)~?V%IL+e5MXeBi!A?f9YL7Flg90-N%wv5|K4(19pB)(*r zx5KwwI@iXc-J=iO*FN>w!|lGq2ip9tSV5k9r`^1IsZETmwkIA5e-ioA<0CmPFX6Dl zFWu7Fj^w$oR zdTflps+DCwHo&V58*y6&ZnnhcBzW~Nc9o53t50~@Dqq2dYn;l|(GG57D9ERd!;IQD zzxl29t#5s^V-i)1qYgMP52BbM9}Gqqq za6|^m(Fp*El*b`*8k`ZF22erRks$p35@R?AjN~XWzZ{JfjeHKyOofwC|F?eYw{qYc zm7%UT=6_h|J0rLWgyRLZBE$pEQ~=`ufB*M?Kj}p~z7R5+1ya1G6x!Nu5hy8yw#JR$ zwW`rKg_4J-@CiPyZKqHMIMvl2p9=KjX;gWX9pCI2kb$4oP+GDSWYFT8G7B)2o05^I z@sg!6`|T_FRiDPKZ7Cpn%CQ>@g;x*Xl+io#wvt7E?O4Dq8G~~5;Xo^1sH45{Tlu4# zzGzPu^+7kJ(hYPQlRiy=st&ryrt}mpdMD7rsl7VtJ4$$oHc30dnEvV?E_LObB;X(U z*k;!^Ug0Ynz-zxN*N5@qnZEG}kLeD3A@`abpbL%qaDSJssIMN!p+6G6~s!0_` zqMdv^F&5xl+AR3~>OzdyFk{Fo%dO4N#!56+pL=3edLkAP2lh`!aCJ+emv(N1%wd2V!CLl~_67A2j&- z(Am@PByGd1%Ta%S`}}90ZF}i?1mwve;Gz4&hfT-oaiAlmADe-Eb=VhQ?V5hlIkw>1 zLPId*L+GAs`P$HTiGH$g_ED=;_1OS_<;bt_uY7{Ke3^VZoci>TlnEw!_*lQ?Wn1jj zlf`U;U0L~}2VSye6MUh7t6%k$Y0D&mx>a&g?1~@r*1Vq5G z8Jlb4;4~=*exL5#C*gxU?cq@mFW|>3 zWi`9RCpgqA9P%adlt;PIMG4VBp5y=zdCN0qV=`{-94R_lfc_+PobLHBRJDoQ!eQ_}4>ZwH69EmMnG)QpjhmO+?*T$l|n& z$yXQd5?DEA`PI%5tx^dAW0X1XLn%fbKMa&W%lVbFDo5qon2KL$?(;w$^c8;#;2>yt zI9SKR4NCCES8Z!NRTqAFc%WQcwCJxCDNsi{ zbSXn~)hj%X1@a|Oe68!E7f^2b_y;$T`Q~c(rZv-lnQsI`b zZRM2{la#}Q7Ij<~@9{@lPQYs0wlZV2ZEU5lJvz`@^vSDh;2aM40o(v?w8%Fm{nk-i zJXEfpymb6QH+*nN@VZv6-@;XW7q6sWRWQa5LMKAqq!2>{*iMI(3PAM|3I5TO$xE?f zBs+X_6BTdO^*X~nv65Zz5L2uYy#yh@3>7RK63L@+@igm489DJOY+ms86B2mI0e#BJ zi=PF4hT=H_eF66x%>YIsZ(=+q-Sg`{hAA=a#UMx?yb%`j34J?~CJ&2?%lQ_l(wouI z$cqVpk7-QUHV&GtZmnq1tzKUz;H^ZL@TK&%^t-N=(@En&i?KPvr>-)1>bmq<`_fNs z%0~e01y3^Q#=QQq0t+730(jwqmrvlk)T^-+ztyWgl+`4^aMxIiPW7c4H#ufm{0SKo z_(;1ob2AxOgsV)kqGl=r5{eKxUM}q#QItXlDy9H62vA;a5L}Ffy9S^gGT;G)6JVGm z4>RD_R#K-Jt`6K4WR>?B*oUI0jvod#I=^yeCA3PQ#*c2}0BMv#ziWJPF2TXz;H@AH zlE(qYr>%C%IrzTt)z_YK)eKO-^0h-t;f2dM;F9Dim+xFX=kV&IXjE3TNQJ*r(F&AF zKwJIbg?7%XTs!nRFP_39p{e+)UCFijhEE-Umqlw$hU66#&KgTW(NIUATwVPDbUCj) zNnPX6XCFt=E$QEi*X&%rAZw?n_@Ryb(gSTAYs|){Z+L;a+7-C2vB-B_=Vc$tix1A> zgWI`sZQ!pyE6K0(UsWjH0fEd@rudK_4v1jtsnq&~h6jT@01B)O<=f89k6T2Zm91|j z!|CT_oTuMvhGw)Sbwal6s(YVs_qH!Dt`7#MKIzvBRXok=Cq!fdm%!WCfpv=GJn)bq zUmml7tZy5c%<@Y@8R5IS4%+&@tQWl)8@ztrY3wCy{bl_)R~AUKrS?@v>O<*W_CL@Y zfM)0Py689V8c(&WdRDc@Lw~I{3zXrJGJcCbS0DIR6Yy%|Ts`^fnrNb}{Gk5itH)OW z*XWXG!9!MjsCH$S+Li6=x2~0?-o*KuKaM}axh~Mo&dp?jU`t`VFIHz7L8j9>=1bRu z7)*eIGEpo7B`8b)>euQPfd*U-9v(@)>%Ie!kI-Vec0hkcd@;KmseHH#ue#c9gv#5j zY`c)`8-PCR8gBG~KL6xN&gGSo$TP+gSb=(=l(F!uubm{na61+b=adOws()pm@aj`L zyy`1_Uw+D}Z}?op-l+=Zj`0e+wiE`3#dZP4HvttM3^f1tfK z=mk|Dz^@GN3t#mGk23A?L%F29ctW3RZ0hyFb>XPV4S)mvQqjxc%QgzC?|#2!*k$<6 z0o;;2cx!xBZtQUB0}fEQ>se|T=SNY2`>?GQ%!NSxa#^whFost+G=2N~1@XP@u%p!=jel$3iy3hCZKmHJUxF|4 zYKyz#6Fi{CQuv)0zm3JQd`xn@8rr%LWP#r@QjQdGC`B;|6ygF(l?-zc&1*nXC&YCq z9951WM+0^wU&pGAd{D9lRZn@z z0Td1nz_u~jsAFu}!cl!y--TZtb%A5Q@8VCL7w`3DoQ2=9k6$XBpvEdyAN}%QC$K{8 zzI4;sM(VsEm!%>9(19!qUUfk+K1G-Pb&!4dlRyX63Asn=j^WUw9G&uP^LqG6idjS67p^kNwMA~04aF)f)Cqka zs{JR&qiJAx2-ZdM_=h~`G(R%d|*TBsRLZACvT&DtD`NQ zPaY0vAVc}`1X}h`?VYQqZPB5xQ5R;sJ^7aSCBQ<2#rQ66alpoA{)m- zE~PS5+xTw_BrcLbLNDc%3V-3)2*m*XcI~@WjyxbQ`yABk*TIyUZ77GMpz3`TP<)X< z@vz2=j-o|g@ur|ZKA^6=&2Us%<(16jY42$4MMKrAW0e8*OEI-8{MyN@RQYtGkF)3~ z8k8A_vVyA9$Ej|=J&;#Hsh?kcS9`~e_=_$$HtL6?I*tH+>I3=xzLaTGvZ(7imq4|t zaX3n#+SGW;;H!W6>bRDV-lDnaDg6CB?fT_+s$Z$-b*`-==+_7R{NmNGJ0vgYn!p%= z(nCWX1h106biMO~`6)#sd#Gghln(gZQ#xL4t6in?k@9PGt8Tw9=Y^}<_s`4TL2ezd29tfYe`&d!eNzBW%-Mo)W7!X; zy(I(Uz>>ms?i-zP7R-+h0;$hM`SGvqV>jrtgQ#CjD&{zs4-#j9eD#XJDzANXvx;&| z#Q@;C2IL%$s%LdnPO=ZxwvHbLivGe?V?=ZHtxnYgH9PAIquTUotug?A%4UFv@U;QT z@zmJV0ptpA;Z|22`6f=qx5_Ww zD4f*?o=CM-t)4oiWBoA#__b56zWl;j0Jl_afVu^h54XO_qHt87^7W-IKGl|X(OWbq zhg-W!`c?-XZL5x1I6T!?=~$K5SV3R+3ul3LKv}f~)fQC!>g(45`aH@}$Dfo<{8Kg` z{;hixP-lw(53OuHge0FX2$~*J(uUuH3ud^w?P&TH@(MZNx#wW$0{OyW(V%Y81Amd0 zvK+_@)Hd*Kkd-6F|E2WFo!_wK8Z!rq+kAW@14yJK4w3ZMj#A*{`{Pen25Jz4`@i5e ze%(P&)Uo9ZjJ51keMdHe4rTPW^tF$#`cbY8DBV@IvA#O$O88nh`=Aax&|d$bUq>1I z5>QVY2|l1s*)S+Nizcu}WBgeaV8=$sLm=HJh!m)xvZv*|{ld&`Bd811ladk9b|iv! zbuPa;b}Za|kXM7Kehc7K-e;EUKJ@dYy4H3hKCton!$8rpkp`*Xchv*NDZdh^Hg#Rl zzb<|QxC^H`)xMx`Z-x_8{i;`apnoluysEs8rEpcR`U6!4>pGk=R3m~8)P8B< zm^=>|mEWS51?x12Z2ilXV*JaMtQ8o2>1?MPT1Q3pSwlrjSD3JITqx~JJXhL5tM>U| ztNMa`y7p0RqDpkrHxSd$~OBTA5^=#E}TI7KE0duQRB@(yBvYmkENHE)_;=mF4zRgogjvl zf42%Xh+X*Afii@x0;Tr9Be1 zMvYoQyDi);wGbro@8J6VpbNBHw!S1`>y)DeZ?+1*?!LVi0JlALYzuiaP-UwOQ)|U9 zy|)3P{&pSnE_}4GRrwd}v_sy7UD!$B3G=6}-DSc?jm~Qo;w0~N_Tas=Uz6=w)7GKu zHy!(X(r_DW%T~8jcl+>3_A{F;7H(V7u1268jzGI|hd{e6SmV>Z!+>4*@bFP6^mdKx zlL+_P1Y|or|8=1qR*Bo(tcQ)5Zo7^Kcj`%g;*OKe@ZJs3N2RU8cIs{ywrkVd)vjHTp>UGDHo4pD*d5j(@{{gJRkm3jc^&SMYgQN_ zd@sm)@4|LRP?P03+T?vdNP4!)^ZeV@-3mn?#HO{`Ngdcp*v#j77|wVy(4Iekw%vE% z{q5YjGlSyWVLJoDqwYa~LB5UeSRM0-FU|?`}4p-5aC3unW7e3%jrjI|#X=y?ps%J96Y$yL9QoAp3R@ zk+(X_FgqUh*!VW)JzK@S3m+eBch_ONTb{c*usQ7HZV#UC5%-zFK z>-5xF9((HQ+Upc=EAKOp5S6;0@w`9OR`gc3q(3O!D?0E& zU^7~3MVo=vJC65EO}Cj@Uw+sGqN2)MgOuEDiuiu8Q;uX8?jDfQcI32meOZSO(&kqg zJ}SGoSNOi&@$MMiK?l^`uU&7aDX*feavi(0zExYtKGc@7!YC?fWelYI^O!wJNa(+=RMnH@GgAxu$dCQ7wpRO?!ZpZ*f+bc z^l`y<#=7G^BXIXMzTeYry;h~ZecZ`ZM1<%PUK5bYv`F!MGXZ&Gju0sOoK<0Ss)r4Bmy07Cy;aI`gf4Hs&{*6}=mbb8xyv81hQoEp7+H zyMy@j89eJA7TXALc-N=)??ppL>ssBoO#Ewd8SrWVHMSsNjdy*> z%P1&*x(+JyT3xA|sSV2W@8;0Qy$KuM6Yf;KFV6z~_~tSFsQl`CW4%r;oBxDmqptM9 zb-#_epy~s4q~wpR4Q&d@%16Tcd?Y(KtDkzWY+lo&tkpsFQ}5Ni6V!MH#N1}bechDx zUU>R|_IxKV+7p+V`#Qh+IQ0o`&)XcTPC@aZkJor=Ot;g2dp~y{;E!?VBT<9CN+Qws zdjDiL09i#(S3H1To_2ZZ7%BB(09n=>&!CUY%hL_z?*-d^%4&!BXb5=K`Lyo5W?qdZk7u;!Qg2Mkb; z0s5>{F)S4_$J!e_=2EJ`z}J{P5J3HQ%GX9T^&taaADNn*$~O8{o{WxvD}$G-yY55L zRAt@oc{`!h%f01E^6EEO^(78fC3=wTry~gaYu(*&s&98|J01xv^Hog-X`RXq%4!(ra zT}9ol zEnW5nlgUZnpN+hz>_g$cc13USp8WI)-}rd<4dH_N@Ob_9B^ zarbSj8`I`nb$18QO{+rx2R^Zzh;|=NVHfE1={)1b>#j~WZuG00Z3aGWbvdxnu^eOf zm=*hV9T{um&ucyB7z3a7eKuzKR$)7Jw*o;3S_fC}2Yds5ksnBV33-y6kH^zfx@Amw zSMuy8rk%cPqmCmTsJzb3)^(+?J78z^W9v|K-4?U98bTV0&!B&7jK_AeEaluov0Yxt;I@AL-rmA0M<@`ZZ zS<6=sk8`|nEgy8WcTiIF#}BS9nXB>DtQ@$=}(rlEqeQqxZ>E!An=7u$$%4z z!YubCm^$C+bkWdO!Q^U2FK9^{{a?hp8z{r7OGgO~H6lRo99%%p~sgwLnW zN=7v%BSAmsnmRx~0#WfzeTi+A4B*-b@+9;*YTvKh=V71by9+s*__rK3S(BHJhpa}R zC8xECZj8%ESxV-e&fTsD$RmD^a6%=D^l z0h~D?G!CwdX2*hlUeXaX>8q5yUw5leZQ$w)y&(I_K352oB6@Ku2>+)75L=oJ82n=RTrIO?}Doq>MjKDtA5EfSF3PF8??zot51TdzZC6U zulLjOFaB>EGEnMk0C2)zdgz+d$ET!g(1|wm))<^ij5`fF>g0+y&~~fyf$qgoDx*!_ zC*8Lb-oM^h2FSof$hh$=PGVAmkL%+o{-~!f0GF}hYwCF%*+n{^0jR6({QO+z>#Jxr zHmRV-lsXaRiy$}_^!uxSI0epH_2T~;z~>r{z$s8W*UmK{m*PoRx5Jyh z!F7P^N&rp$)XxJYpK4S5O`93u0DYW02c7;`KhEc3Vv9bLN;H)o1w~O$i*77&B`eOm zcB!uc=1GzXQ}I!IawdlwKhUr94*w?R3Ed+6e3cDGh9cvUgs@J z#T&dU{(-_*{B*3cj|)0!4?vKco1IM~?1E-Ds4~KwT?e>Y8+eqbvBptK2Omx&Ds)Mk zfl?{A4OWB4EKbq3nk2|CS(Od?D@Fl-J6bx1rNfC-P&gec0ft&mPB|dxnn}rbE!mpr z&#<-%g}a2!h`i&{%)eWOcH1QBkmKmuQC(xu9&e|nCiBQ?TOFZ0@rUz*r`kx`j9RHg z-Bh~3Ly3(+dwAs+sGogtgi($jeUY)1%iP>-;=%{VY#%FGeNBu{WPYH?YpYlRKu}5A z!*M7_uXB0Zh5l;P)*~ErgW-i1rTmSj=n^EPS&A>U@Xc%>ETMZmw{40ks5_t>ZP|zW;6ll+Jpp9Vy zb>x>Y;8G@E9^feZupNPvfZ;6O0Oy6DgUOj~@Jaq?7-l)gF2HpC)l4~83z^gLKzYaS zu6-XkTy;2l4&FqjIL+ByI|f;IPl7m;i0iF*W}mW98I<}tGpaK zo)w+Rg8gcNyP+oE&UpV2$^P(;L56A1iD_Nt-80D)2hskBP)!OMq1tjhD z+)dKfd7WFx0h~Rke%0mRlkP~)(Pf3prqy$s!u?uytqmG#y!z00@j`ukR~NnHn-jUv z)5VZajwb+3*(TbvOE}zjCQbP71UbF|Z}nYAxN@9vUim;>Gy`?s3-^bE=x5oE4ZaQT z6Aol#H%H%7lY3&KGL!Z*IWZY+LQk}eKO|gq%c~KfA0K6wO#3`2-Ck=u$nQg+A0G#V zrXy@{_1<7?##`gy+uiGT-SIT^IZ`bm=u~G<9be=X^v7Mg0grP&pU$QK*`!{<$HBXz zGe=_336Yu3CkQMe(_jZ%Psy~XRt(UtRt{J|x^*+h(A~>Lb4RySw05h>&KbC_l`vlBY6dRyjk0Pd$anV^ zIbJivZgrSkhCkZXsu=&epe#6dj$S_J3rBZvHdeVYLCbCb9O3pMx=R|nJ~|v|h^$WM z;@r6KE9on~#(8d!#j-0( zGI47g#|-Gb@d(=8B(Td%h0a)pczeAZ^YTBq~!0UT>G8sI=fr5Zzrqw^V+ zU$`8LmP!Tk%W)U}odSH3toqSOhMYM*gHHE5y^GpOTk<@Tpj=~(5#>L_Fjn-}xFwJ} zf^T#pD)#x(AO9x}&|dbKvW>jrOX_Q+wK0-^_!8h+e);aivw#!m5oeyySa;Rr?@BcsxQN&4g@h>TMy=Jpwl z!8Nln({W9S(WWnXgr+{j>1N;S!FD?WfrB#WU!O%o;nt7-9bIDy=Xh)8R<78L@4$im zgSsA|;?S%FI=mMyTxfgtOt(Xa4zA7m;09)c9CX*`aykU^nu-;mF;ZIfv(td0P5<)o z4{fzI$yx5-w{LA6%5H^x(Xlu3ldj;6y0f!$*(XPH;J|_CZ$8E})28?ANj}%ZJlg?c z)-OHc-~?@sKDW&S=S0v2N`B;&t1Dv+5G?47z?!lTI_U};(O!euCiW?2`|`6 z$q|PfB{Hb7tA`gLWfSEEmH%-;P?);06-a#x8?K!f_Q6gL>^~6v41XB5Jrmb-1y9)x zUWyr|tHp18!3zoWdB#V9Dpyy+D{bX{Tzo5??gH&R<=qnlo67;b^2#fz(44`84?Wm! z-Mp1f|I(#P?dfNpX-5tpZZ{(6zJ2Oc8bSuK2%g7}9dAdE9Od=an9JcLlPJqzupA&Q z!}zz~emf1{J0Tx`;_zKh z^TQ86)Q%oKmiK2nr!*9GF1J%BPqi~=PN(wSci(;OvBw^d`g_*KX55_9wQJYf>C>mP z?a`x0+P-jf#<_RzbUS?La0KZ?S*G5(bLV0bb-mqp{JwVo{r9JgPo6y4&YeG>+p^Du zY>!7@R>iNs{(8FZr(8-h`Gvc9k?dsKb_Uzf@-@^|-+#ZTVZ;b6~jKxnY9)0A|bnJLv6CN}f7aq%h z_S2uv$sdCYF{RF^;~J11`M?Y0jvPsOl-vj62!6fR-hA`T zcJScAr1wb3fyoK1rLwk7CNqou&WuSCUJ#CHu%$YOo z;-!l*`I&B?{>-P7787MWeg669(*fcO9em=6CsOY4-;7DNqn|9j{@UwV*M#d2|L_mn z;UkBmY&?UDU}}Y|&#NJ;x5KVXyq|gYne4M0kMVZnKv(i1Xf}qT8Mu}TI=&9IQ{i9O zE1t4Zle#MF*T4Hf3x$-Woc!V&|M&9CFSlo({d9XI^v>-jdUGLc=gO6+MA8 zn>g~$+o_*VKKWGEtJ^%rp1g`wHXxNs$YA z`?Ej)vozk<-*}^)499aml!$`A6OR1nKl@pG?)m51p-_4bo`P{^R=*7H#?2eyiqtkyWt5(wCiFp80IYL6b*obwAWywH9Y zeB-1!XA1XnOkxCjoQigWE~6*|ITiGn zdu0T1dxHj2%BlPfvpjV*3KlBif@${{? z-VFIJ#>{ws?znWT`_2%_n*+oXvNoXzb`4S|V|WB+bW1f^F?Q|g4X3V-1kZPar{smt zM}v0-X5d$^UP<15{|7%vUEUMHOK=d#@XD-xE_VUeXXW?~D&XTETHtq1e+4w#%%xX$ zBj7XnQCC}KfR0x}@8A9X-?bnA_$R4f4@D3#CacqzLawid-3o@rVd8b_?Ng~^2V=}+ ztgqY=2!6TWY~peM0}mt)G@;#5IU#$1QUIqD4?Xx`(z9;E-R&D=C!apO${gX*XUUHo z@PMxV;upWja`IrW&ed@&Tsr~o&zg*Q;LxPy$3OmY`-{K$i=c5hX))n42|(kkufEnE zee}`PQ#7GJ?I?Gxx?f1}Whu+hZaV<-)Ghx(-lYSe${hRSl=tz%)`M)psaQERKs%|++0i&)3FH9#e4vLTk4?*w2a0rKEWv-6kP|8dgeZ}4i5Iiux zG8+90Rwfd7`Q(#NX3%`$g%>kuQUZ<$Z>*jeE+;1ltN&K;kn!T-xpQZO=hN-L!2@k7 zcn`X*)y4Kk%n+Y@?zxy{KN90yPJBQ4$xo7>$BrM%$qQwEE$aQ?hd&Ib@M=0vy9a2^ zTLTd+&YeFOtH^6Pfk7ME(W5TMj3@fuZ`&tUHC8Vs1jbAT%3q8iX#3b$CMIrwFyZ~c zWPogo_Z`s+p(#gfvpGH)Y}-FMVn_hOjdsK)9_89w-#jL z27CD7kABpyh8{fo%(Hph1drHf>VNoc{GsP;NTPen@fttyiC*9#|0iFY@=NN_ImeHh ze*iB*(7v|?S_bs5{?)&Z%zv4LF=R@F=&yeDtGObzM7QsQcQ*FeE_@(>Nar z;y#7|`{Qu*0)_3kmtT1~9gurh$}vtLcM_{AWJ%nfC0n&t`c!t5WRk3ZgGO zbfSU7=bRkTp>JEq9PMkbzt;ZX5B?yxVoe;(h&jRsVm9Z#4(E>V4DQkReen(_WC;a&1k7Xb=TR(N`?c~2n%aJ38bH<8~?mHif zeg(s=f}IW~oGYdHXO&II-V7aiG$s*GJo!WhE~{($=$@@{S&@+;nmITtU=AN&7^GVk z&pr2i8YW{SYdbMNj7f)EB>2Ig8LDK}B*=0A|M-vpI9Rc~nhq6DpMLu39B+TNee%@F z+&aZS+w1s?MV)*lP?`GxkR7UD<04}I{9Ge9etsr#&4y| zR;|h}MW4^V@OF3pKRUQA(7HkYumAP`Gcx`KkC%pR=4>T(?AY;K zL0~{_AtBrhgmbgq0hJ{-nl2FqES z(NehA-+UvL>$9KzOa`f3eFQCMgO++S_d=|`e*UwcueGJ@j5X_qL0btjPDYKV+GezdU=w5^k>{~npGLQ;Q3fMwVQ*L_&2`sjjUIzCG;L~ zZ#$Iu_1E7BsoUVI^SkFn7e z6RH#Uod{#?#_CoG1C|6tx#8Sjxnz=0?zL2SQ*of%)$DzMB&r_5{~YV}i*!pvf3bD)sZ3Pk%c2 za3-A*e)>%_Te1!L+%KO?de{I*=D|Ue2;=l{(!)Uy9pJ3sLMuKxYG)@Un3&_HXQ9zq z56$Q&gI8XDC3OQ2o)727p?xia3OQdme<69!&ICsF1aFQ|5Tf(+P+|uhB_1i~NKJx` zS^xMe7_m?CCqs0)W*_8WETtcJ!(qa;IYd5%9_sA60xffYz>Z!7T9Xezc5Y*k+pA$G zw&tID>Z#z@qsha+|Ms_&KgMSQrC#3u4`hNx1qs{I>e0pWWqgxcKko-0ZScLFXSZE# zh7i2;1|YhTN4 zkk?~SwnhxtLm!+12TtkSk1{~_=_Jfkhw_-wc<@FbhtJj($4A*XH34ZRW{nITqYuSw z+?F2!d3yBf)oUrVbLY;dB2s?aHnycO5+2S0lg)x^T*?^r=Rg1X3@{X!@B}1%=C~tq z_7Y$u<@k+_@G2N^0FrCv1^OdQftDc6R-J2ar3U2Zc4x0${(L4@?y}T{7tK*SmDR%m z#%7|Cd6`;{(>+4UG%+c_O(*ZH{NTq6v%J?{eJvj#^7OF&tpf3mve!6(?Lzm#O`s^R zdyLnvUklmX%yFX$jkY@T3Gn!r_euhfaq2stB#gk=AKzAh-lGi<%LtNBakP4-W1Ul5 zNQ3qyt%--4R_k_71Xp!Dv?CDUKm8+fIxV=;8#Gt2Q7#b3m*}A&LC?^k4-*s4kqq#m zKwl=0^hmHUS@cw~mA=WJdr|Vx=)phtFHhWmB6MUV`!W^|mu_8&KFO2AVJq7F|J%Fo zXUVSXKJ-oGG{7KZK;#^mz$j9ZOOmB3mo55LS>->*mMyAemH!RD^83xtc9nzlOe-)4 zfFwu|B$0C_at2iIBp^ZT*t9Bx&0i-4dDpSuIJte2Bj3$#x#FVzccYJJue}^z0FW$%E&yuM}Mp zg@A}=lM@p%y5fHx_uwB-0A1wkrAZSr1@5eD`5qeerx!H!#H#d11|~ET5*u`%eBh%G zZR6L60#o~R{=QOwWNJL}K?6H6`881@)826?x_vy4-I#dV9=_)4YkHzU_a;d0nPi*r z*txrUo^0ugA1acFaqvt2&XuXX0kj=0Kt@H-RzcYg8P091UyQ8c1-o-fw`6FgZz9bO z$Okrd^Uy;Nx2#OA$dJ!Tu6&Y>u|Ja!6FTuu{N^vQd$MC|Y{VoE9b)n{$$l8n7K<4` zsRYA72t+cp6=w?!W1p&-2xe_zaTwb~XYW0`1FgP9jZp^aIiw;m^y}PZjG`$4cw>}7 znf)6>Uk3Zu+rBL0#GZk;XZ1!o=)3;<>sk?JE*!d(O9@o))J&6-Je zz^Z$M>?p9>w*8Yo`IGL?u_YojDV$jW0+jPD+G=dFp*T+GzN2dZKhQ?Ke)?0kiHF1_ zQEDfc_+kk`RnpWma`9|)INE4$Y%klOS0dy1ael^2uKm%F!mHo-vV<{?zLEf4b$}~F z6c}yIaBM4}8*9b%na_M?YgYJh1wp$FpRP&O)ipCWR=)sJIurnnaqBI&%x?SCZM}-L zZSOGwo58c)5ii253MLcn5XDcg2+6gIRm{yd-#q*M-~YYYKlvyBq-nk6(o5PV%xc*W z-hS|dAGE_>dda1|J3tO-@@BGYwn88DMmB7WZ6skkV~c|lfOE-K{ID1>dBc;qCeEPSbKd@>M9G3pixg+>IkS1TbxM|r z6ZByW*YwUW;W?H8U-{Uda%wHyXpVj_uF2OKr=Kyqt5&3vqy^T9ts|F^A6c?5b^#X~ zP)~krP(2%AM{FuZoTMicY<5J>N78O~gHE&|AV<#V<0hE0CvG)l>Far&*}Pyuh`#B^Gd7OzB^xts?FrQuA7PIbg%`3O?iv5sin*-m(-s{Z zldx^GQ3ip#?%-3a5Xr1(@$&#c0i0Z&*}3-cX{TP{I1-Rql4mJq-rC#ZL9e7qVH9jt zOg?Z#Zh(;}2{zhm$I$lHq=cghgvNQM0vukf*3E`Jqj63a-r|1v;Ya#8ESX$<@xJ2o zj2fZmja_F|=lI-n&o&<|_Zr)b(9F-u^z&c%!t9^^(|bX!51BzYTJLfE_atac7O8;1=D&?nc5SCQDs`Kd}S?BT+TF5DrLWuWC%#ZiF6 zmm*=J%}ZEbwj)zcDY0c2OsKp0Iasy3>}!@m~?&r``>GwYMbCjR%m1!3FHdU z2Co92AiyppOu;mKIkGAD1xC-j+1@|<<3H{duzR+_jBmSEU=;x1m5lV4$UJkF2tA5H zQ?Xn=Gu~EBkfAdxAd^ookz7zSdd2helWJn7pKWO`l<`YR`g5QA-0X{A{Nn6Wx82qW zK6dWC0PXNbCU^bhuAWGf;l6$2&0-(T^Q<}Jo9x==hF9R^4-Y-`VA}z@`X#;M%f!#K z^&!jm+Rvg#en4L)Hz`&o3R@&IH1IJKK3mdc>l(m8Z(ypcbwYV^PyWfoZjhHVjVsWb z)SJkl)g*||o_gA;ZA)Uuz4wln&Lm6kUU*(fxgPD;$=Ru9bea0Ot(0)E8sm0zRK3v9J!FI7)gfYFNWsGKa*$T%j`*x;N!_v z{F3b8`>e zsaLE}d=Y|G1?Ig3WLsJy@bU-e<6sPuu@R0yfB*gW^%kVy*XE+k8bIkJR)Oql7wtia&We!9=(zz zddNV%KuMnZ!htXK>Ej3wr>1w4Ezn7)N`RBo{Y^LD)WOmF2)EvPOD7F0K6b`-1WT)1 z&ysxv#w3>9@G05RgPAvdX-f|h8z2X^uD#D1vPq9$6iLmb1iwW{2XHp;xo+$HhU>3mJZb z_CgMNB`-l0oo0mSW~hu7AMR!dS6|gDA`S{SoDwpblauW$ zGem}bT#7|&k@Q0vBw_m7uO^M&Oiso zd$s~B2k>l?EI#|$&$KSQIA;r)j^XbW&O|QD02=729i#g8*GX0p$lAe*IUjc+9|_pe z8;xj^pwO?dM@hv>?1baTHoJgL2OJiD@{mmN;948VHK&`MTvF|qbCmaXU{Ycjmy`Ww41I_Z_nO#s|u9})_`(;lttR~z^p(Jh_`pyWZ0 z#wU9^YdcvJRGO`Eh92zz*iJ_uJ=4E)JcwKB+P}{{tL5#ZX=oECKmLi2j|oTt`AII( z3%1;H^E1QUQ~I9{GPtsMQGx8H4t2c83Zkp*9#N#G>-iUjS@wg)*KN9DwXOz;vZTCLU7Y2^au1o zPZBM>&fz2n_ux~E*WxRHXL_z=JOPE$8JcbOS4vg{&@V8xBjIJNx{VLW7@Y*?xh{o6e=_YE%s?<%JJtI~U37{eE^;(xgksh9HD#z?f| zb9LloH8|ch{zb3iz0D}m(h=Tl`}v+vddU}VpjUr7M}Nj*hk(xEb}u_5odzYw{+e=wKFOMet0y1DbkuCYb6CYEwQD-$GnYl(g`i!M*WSR0oA-)Qx=L726 z8^<3p{`S|l8qY$Yzh1Fu;e)M{vMnErvaRlO?{w>$|Jlk%zcJXDqxeM^?2BE)Mdwp~ zI=&Xq(d2U;@9E~uwy{~cylBZ#W^|oJz9364&VBd zkJv;9fUU4K#r?!__w}Wdw2KTCZ39P2X2vn@`+mJgFwKmh6KP#{69sW|V%;YQ0wM^; z=*|iKQcJBOYV`?PIMr6*t&_&pGevl-CIW-Q*0hygKWi#ssZ;bHZ%mHw82vSc6&^Gw z#wJKkOhM|YLsg16r~+$?$nj+uT;0w#m(iyKgfcS>bgAd;MZ7(KDXa0b|5wfO`sF z=~8jewR*`EOuv{vZ91{db=>&sXfi<$CP2ZbK3~t6zFSbd~!$C z{dre?-A9iCn*Rd0ozsbS5o&sFQZl^ivCeh9r?jT=a_TLU!Jp?Di_f}Ma zZG;wTAtU$%fADVAqsMn0cfzT0Fwx`B1q_#x0BW2L)CG*4f+AqaFMU&IO#Nc;F?4-{ zTYbQ}zUgl)IMq+vyKlDZdb|ij4h(}~Spki$WGh^&4dd!Zu4aK&yROk6W3)} zi2=RPr8lOh-^;udptBAwJAcJfWEgvkP7TaPeZ;Ka#;tl=!oEmF(96mR{eXPX3#^#n zpi})~ALJ4sXR^=^JpeE2+|$psG5CZgEyH;t8v(aU@syXv@B{Q$BG-P)xZ1aGRbOK` z*Izp}At<+S>OX;LU@{5XxxynS&H9=g>l!_Q4(5_W{TT!OCQsU%$i&9TkDP2{T5*}Y zWX0PuBb(|^zVQ3_4_SG}mY_)9Lw3Uk^ow69p;;Xq(MRZQn&$05$Dq1r%+wtUOyx2? zAHV`jf3uR;yW3xZ>F7%-0N*4hw1|=Tun6D_nb^V8{MSEzNw(~)e^{c<$uzv6!KB$3 zCaSLC#5dVad0yoIaL8j>SS8V-3qOhP^eeuw9rf(hy-eD4)kmC3tRnZexw>{Q=N^}g zJ|lm?=Ngb3U{m^#A=$I}$STKmgK^NfBhmV`3QpZs1&-URu@O`_I-(Kptz$E0&_*cG zmm&W8JwFycW^~7u;ZebBulv5^<9j=-hOho+*yD>AKr`OVmw{DsA*>N_<|}{_nlX#u zuK!I1CtzH3ZqYOsuKu=WY%3&SQV4!1%Qi)X?H-8ZXb<3^RO4ymUV?Y}!j*G0fLx=? zIUbEI823k4D(ITwj%0g6kC7k57nmhb3D;YmJ*lWNWHERK`g-{Y;2G~@HCTbHj>aW7 zv&qn&6%NN2_~C1s>RPZsKg#JEP5KGu9gORo{;GMw=-c{eoPwY2*RdUmH;xcFECXiw zO=F#Rm@EA@{@|zs+eEK=@*2UfO0_|&;+_>*-iSx%n{T|;=K@>vSnU(AU2CH+h+}Wt z-=JelhV#Dafoomaj*^MW)UN4u2c9bZRhNaIKqWOn#kMY9$R5Ass&66b`p6*Q-m7Kf z#_-Y_QrW??vNfR=cf4odmw-H1)W-P3rpJUD&#v*B`%{Q4 z1B=(|gt8g}o1fQlLRz0rXkDbAd`y_dm*fp{We?hlS7gWT$b86qey{ogHb749#cs5X zZ>iTNwvzq_li|7`V|SwUt34;5?8T?C{p$vzbQNo!w88ln5{>NFcofWF^}; z$Vc=mtPIPbwtsCs#fjjaGHnDa0XWU{`&RvDpP$j5L~tCq>IgFiIR&%>3W=b#1=^!O zvqa|s?ScMLqV~Y~pnvc+9lK>!C3V`iY$mv!cLI^%iocd;fdHnh>)_HBE@L?=p-2A# zg{`gyw6S6uhE*IjAALSAw%sK^+jv$Zj9icx0IZndr#!(@qHtdwC+JCz1kk~wn$d>y!pCbdn|+%Cwc?WJTc05(79r~(H6gBNl` zTP9J?qcaeFfYE+?5}51g8ASIj`@&^HsEvsfS)sKjF?Dp`7I|O1UMG}f z>c1hc{(pWB7O#OTb`rp2`!t!&dG3j2fyIv>OAk23D|)}s1$@M0RYK~@_E zoIh6-U?l}Jp$Zxt*l0s(11E@pyIu8(&|M3vQ^7ko<52=rMYZycHNiP`>}lKGO4>{d zaBqA?o`5%kprhL(FpX`%4z|Xv3fn8rb6rSaYMChd>2qSq)Hs9oYFFo>$NA7*jpc8S z2d05{@T-1GKS;gy+KuY!32%XWW}kh}b^W2`0_fp02{ z9`Ufil)eGRD%l)gviXhpL#DRy%cknOlPI3&vg~&0Q?lvzROYf8f*Jm8=RiL)kZ{3n z{N+05t3q(DqYQq?tIG7eioYUyyVUjQhbC3S=DOXy@0hsF?{|bBx^H`{V<0+;oIq$| zM@s4=yT~u)gTS=^2PuJG(W*dX65yf1Txt{eU@Y#0vh9ZPgYxr>B_Ik~7m(fZa5yA! z04P@1!)>sxSC-2IBc7kG36{5;5VAZ$%iGM+Cim4~Ro`39msZEW3Y3K*XnwT>6fK=V zmVkkKez63sTaN!w;Dgx9p~}((0FF+ySypE&(`?}#!9pFH)vdxUy-*QlNuS9ufn8z4=P`_JNuSb_(uTIZ8af5aG$FT|@h8(wc z(&|5OSXZ?0Ij#pHtmTEaPNy8aE(`0FOF{9uK2Bj?ANEyXHJN`fSl(tr%W^bztEK4= z4M&IESA}&ZA8_>e^=h=No6jTRAIBnm7;@aPqE&&2!-05gi@r1t(%Y9vNIPCObu)NKLmgQ&~{xQEeC>%X9{~)mLz;^Wb^=h=No6jTRAIBnm z7;?0Lh3DAYItD9jr>)Z&!Ai<#Qr0J%^>P~Q>m6lTI2=xJAXwgR(6JgVtF z0~-=zy@}1 z9Utyzv<+(sJ_+{6YVaxI*O_eBgmyq=z6tz0Awpk4_{)m0lk7&`8`!|H3On99KHMwX z@yvN$Q9praxd4R8b;4>7*wL~+dK&Xu_+3rrM*@zf7hzV?Ytg+th`k)DEZ6q&o?>U=c(@^qAB)CBChL;Rx`Dhm4*Y&tr@bG`w!VQ4 zY#@1cN20Z&^##vXw=%IhUj*)40ZGQm^sW`FVs*;#$8Z1Ig4Vw0Q=9&E3-}7Z&lmYl z*nB^wcD}zic+e0SeaA0^_^!-V0uNla#^LQTtE4Vp&=KC$gYdWvgx=r<`UiLJ4G7+y z`1AeG`0wxVt-2jJs(*iJeAQ_K+}|3rN+bev&UXX%-#3;r$BQ4b_WiguNROkPFG8== z){9@uFz)mV`r%|hWI2_^vH%Cr7askimno#3`}ytR@m;^~|6bGpo+3;1J6D`*3#T>! zp5Q`9cnM9@`vV3&e$W6OZ5GE581q2)cY`_ETYXmP8=lB9{7-2Q-@!TMH+5;Rf9?e$ zNBH$s`g@z_?V_vw!4y|uiZkbl1)(=KcBCNogWlMr>#1y}yzIu;6!4)e$}{zg_go(c z4mRG01>uEV0CdLxoa1rIn|hFYQ*bYBBOBMjm9iV8-~R5e6GG=ftu@4HoL>V8OqpL~ zLT%rf-ybk<+owYbTQI-wGOyYJyH+j_@N$@xjO~aIg+aKtDg;*`V@>7bIL^m-WNA|4 zyl!kI$NZwoPASZBRDCC9cy@?;)HQzhC*v-{T$_F0Z(?TrDU`|fSi9lq_H)Sn#x`1bRl;wsqc^adJhjy(kbcHUN&mwIQ+$UT_u&9EMTYBu_r=m0XIhRWh`lLb z8J}I`GuOd0Z8N>z4W@1P*XBsTjumYfah?+3Y<>*fFW*=}xF=aSPG_9;f7hAe2ZATe z_AfTf1=PP3P6z13BU??Zdlz;5@W#*}z1n>8H4_EEwIS2IBqQ~$PV$+~~|z5e_LCp(C~1zY`-VBv%dWLtSzX!@%Emd>jHbO893fVOGl zJmcqFKj+a&?g3*sM|X7Yd^f;P+J}aWHEb!{rE^-U1gGu(DFn};;@|+|suRobIOSQ% zH3$zt9lypW-N*LTM~Cjwd-NPW;GE*pPE62G+l&XIt7SkxxPpJNuX`Z0t{cLy@yNmW zk&n9Yxj%mQ$NT=;FGB1ou-NuMeLqaVAKF8oYb8FJy7)Nzo9aD~ehP43N#9&A+Dh7| z?{wTF1)+0CqGd!e93?_>&ow8CGrC78?j=a6Yoqwczy~tZ@A?A4+g}oG7|)olo4ERO zAHdZ~r|yeV<2mhe5d6l62hGmWoUsCpe?`!r+?2@1IK~M6@Fp=1LmE8geg|yy&D-KN zKisVyoM7M>GU+2k1^%BV$WDOO2aleQTZw8Tsq2^RY0&)&&s!C2O+F$c$HrfMt#1AH zEO`6vVFT!HTvfD<4Mc{yUKS!F0H5>d%2<(W!2QTJGz5qGv;pp=?G)6<$wRL(L1az` z+PDthz!!St2XMmiPDZS1kzu0BU6sEYQc1JhUK8yW8 z`t9%jI>C6x??j7HOlF0ugo)fseT1S!FwO(++qyjA#Nh<}1Kf3N$9Fx!qZERzfYc6D z=PimlN(c>AVPXJRi7Z|kKDX~=DK$V5TSjw z6<|*;+&1Hjj@|0l4aV%T>%ZngMFbJYbk4BUW1evdesO}{uB`e9 z&N+1Nykk~7R#*vO`Upn)Ng^SjVb1^7Ouw$(7m>6He&+(uz`2~z;K75WqF=Uq)H%jk zfI1MGmj!ewi@|4lEGQ61Jm<> zK2sc1y9iGA7yBOUdYv$p!7_lh#Xk7rACBxO_LYhC{`i^JYd^KaqZPvc`(B1}NeE#C z%$qdiT>Bu=FF{cdw;~c)KpaCGfkyizT6KbvbM1Pz+UcTjcdr^xnd7g9^JKHUaE*r_ z#TcPyakT`r0co=g-~s)?flhU<6*wjN(@r~e>zS*d4De>PnYK#$6F^U7ieEekhSPDZ znuaQdyt0~d-%(OER-Om9o~l?ao6xi#$h+D&*JnJ7-8nfzzpZ*JW_YZwBPU~_)ioTF zj&pT%xeDm7gumbg(FZvu@oGD0J8s8Vsc(BJNMHOZ?&lh~Z!Goz@DLpEYM1-2wRdlO z>>(?YOJip82}j#lwa+e2Y_4BqTLK1!{vT({fN_=9CmX19W1<&0$HP<}_*2qX0elk< zeR{GrZ=-+Y3a|Pk^3zX0z3V|_99X>gQk%{pXye&@jvgPi+dUDzy z>_#`7(Gi~YpSBAPi+C4t?S^|@fL3K$n6}3YAirsSY-nnm)BCPdK<>GY9R{X-js`$S z(^~(5X3`PEUZxQg2xRZxy)B5>Uw?h}^2;yJ&N=6tep8l#_|+fnG0O-!*%@aHN6X70 zVYs(Ot8Ll?W8{Ynyohu5*=KJNrd@A~R(GG{&pN9)CYwOZy~d*(a7wkadU~bwWPJD~+Be^Lv+1BCL0&sNt4l(Lt5?=1ju&9) z8XxM7Z*pU3ILHv4bY>jw5)k1{Sp}wg2k;q-EcWc#(>52~Mdrp%iTw4~#t&sUKlj{o zyB@t$nv4~_!K*!B!{Hv1#2mI3{TUY=Ob&+v#>hD6B1^JhPiK`cq7l#P z$>5@kE^7I$3i=u+GMn;5?(QwhagpzJ%3%?vayb}ihX?in*d6;L!+hGp1dW}sNAaKE z;78xYf<;?eycd|#2FFw`M^Z*p2rr#z34;+Mp5pJh=bmPs;oNe|Ep71k-FIJ?&wcK5 zvr8_yq=U-+_ut=r1Qrf@;e{8rqn&>Gsat|@G+3NR@M$NlBOJzhr-Xe@3HiF~uWvfM z87qN!cBpM3=r?nRF>>%mwG`luGT_C>V~;)7LG{{euWh;|Bgzd#QOg3}j6rU|G4kY? z0<`hS(RTVX&ptEz;SYaMPWnpo{M*0%+iiHB#hOfz)00m=IlKGryJt^5^;F~e=tn;~ z``qV0-$6R#7*|p-QF-8j2YSqX`}WOFIrWs;cfa%9*+q4J)sZ&~kz<@Pfep>qTyxFr>Z`AA8+-7<2itBW2V*<33vz-3FX+DO zuDkmD;~)R{mX5Un#!={+ebUb_e({UG$0qPWmf8U0{qToBY`!kN^wJKhKz}dwy<4_= z?|t`{9`2u=x#!H;jW^!dv;l!cp7e~H4eMjVxD?DykxAkWIOZJec1=G&``OQ0euCF$ zKl|C{#Wh>`@sEGpa^~Lx9^1U`y6c)ReaX|khaP%p_Jbe%pabN;{Fnc-Wr+UB8{p6V zM<0E(<#f|cH?>`|k11V&MOvpIp~0WvdGEdVw*Kj!JS8{~y>x6?BcMegH+J`$UMGa6Wk5SV zNPa*ZA}=z$vSJf`vK_uhr|gjJur2&Y&xzk4<4^CUE(Ju6?&thS$|+z>G#&qE1)SwC z{^BoY|N3A5>vljvo?%H$0w;rFWZ(JDcRJ7rzJeJ635aH!aB%8#&poFDNj|c|d2C6x zplVQCoRX|@o`2!_+0TFe^G+7Fl?6EM;NrBDWV=&)=LptLLV|ml0`xN;MSu6Z-);UV zI*B%hti86YC?tYZ(9T($Gav!&&O7hy;C9(%m$p2A`qR5Q7~=>u|Rss zB}0EjWCztVPCujhzyJORnvPcsr{G3jR>#$>+nI@Sn4kRQC*2>90`cXSU*0t913#Gx z$g2jy$PnmDHk=Y~#xo8&*^8jgModtQMV9oyInm8FB}VkJU;UzE?bsxK+P>O1bZefF(yerxt@jd^bA>cR^y*wW{# zuf5v1Vpr^WnbNlY-q==4iJYeA(}Kn)o_J#R_kaKQtt;0O1A6Jv9NNi z?K%^QQ%*4<@l8+TBXD+M=#<~1pUmKN#CzVPCu{iO?TKr#N}f|+JXi_9O(!Nx^ba2z zOsde3w$Z^lft*dw>G!|=xBphMIkD~TqKhu<1S_VP)R+vC*CJ256%$4U#5U!LE-cz!!VO)Awp(|Fy4ut&^!(!k8aXF z{^5M;4@&4Drz0(^uYBbzvr4fe(IWaU|MD+qfBL6?+QeE>5smlGD2>+?j7j|Rd=58<@3 z2>u;2=-1o$1!I9i;1$rkNTi>0^d#}=Pht3w#2jsfaTv~#fB?|xe5#O~yB9uEH*IGu z1uzD5g%63HV;cYZ8vB$oGC>?4X6qMJU^YP^tA`$br~}u{H{a3;(z#%B*518i3%S}^ z?UUgHh41kv9-rNC{SDp5mb1iu&N=6nA)nS`KK|I_CCA^?7#GeitN^j+j6EGNPCW6X zZiin%`OLG^*C5^J~)e#v5bHkjOH2qIK{nYH0S6^w~AAW>?JXv(V)cSb$-SG$l-AQP8#XG(eY#ix` z+)Rw|?7j&QodgH@NU}HGd{a%dPOAycLp|v|^UOV^^Rvp1POQoCyR&!SduR4i$?olU z-kM#sPhxq#?D>hJl}-P0_FBn}PAcuso_*%&mh--S7tMb8{ByG>%7$F?H8k@9lS(lH z9pvgB9iSP&6}{`jCh430C2$jYJhBtIcfLO0=O#MuG(9GG694HXFE+&nUV7<;-o;=i zpZLVb`*ZS7RZM%PWbyp-FSMTe<;LSrn7#PIi#6fBzh&<}-tkR8z(h|SxsU<=*!XTc z0|&c4njrav&GSj|o*$VwIkJ6vCMUZgj&x5RvGw@3y2N_2Vqbg!9Wo!1w;ZzOIAGS1(e0f;Sjhv4B9D)GK~W$n+!mlT5(PWQCO7bm;eBrN5Rg? z7k}usRr{$=ezNHXKe_8CvukQH!*Ojv3i!`F{Y)F^XFl_p=KtkaUao%6H$P~0&$Cyn z(5H)6^1JP}Pgg*?qpz0+Y&V+7ql+C@S;vCba&^E@0^``&Uq~# z6Cm3-Xe7rU{_sat|3>pkhM)fQr<*T&!WSEWM=)|OC`KN;mEC~+@kL+883E~;4$x$S zcaFs_&?sP&6+6WnIs|35M!&HK^sBe}h6^5a|L_0(zq^0*W7RL=k_$U9mQ^9g){niS z!^D%Fc7mDnA^^Yn#_K&1@-mSX6;Q1 z=z}cTJ6Z5!e3~HLbn}hX=KPwRJzqBRV)?#nUp`P11Cet1VEmIr!r@j}@$y;%W2U9?NE`^sj%^WAUHzEk`>_uMZ#xQZkET!56| z$7-(JaN?7FZ`zD39P-GATgzxIrJ-v&y>cm$ulFgEZ`?lZt^DQ^`IMZN9aR2O&|9E!oHP^JD87~#u2IY9qK0BU$3dD-O3MHaLf-pf4dGl)D2(OBEl9QyNjgn-EH$|J=OX5hGf<9zn9JG!^SA7bHb8n-1F6$#S8YolGCsaj#aAJ|X|`PF=U;F^-_sUItmN>{eDyCF`dlnoeD!~Q zb@t6~e6xcf+5|d==_M$WsLL)JTeSDwbMNfVJAYip{&3^nw{Ijn`bdyOx3=ge7h}=` z{VvJ_L~gr5D>)M`ur&r~z$_p}ifPSITbT(FY9z>+5yz#_D&|O*i%n zXvVwo#v9t+t#VDEJmZBEO$r;gGV-XvgzSr7{9*?ad>fw*B1ZuUKPDD*OMd(T{d8hg zEnsV-p1!oz&dZAZRiJPA7?}4a*xY-)lC?^oePq;Gaiiz4#~vxXj}_m?&3^y)f3Je# zXZ!KR_iz7h@%wBiq8DE92*?&+CH$kd)4Lg%$tZE!>NAo+AgKvD}8?9e@ zq^mD|=}TQqY{&=Qu?ffZ!g%(M50i*fPC2PpvL1`waKrU2>;Lbs|EeYzPnMi2ewNSL zjj$VqzCZe-KWy6RijKyv)(iboB6}kb6IqE^VvtlM5k4+vk%1&bXZYUDmyQKsqx?EW zJY@Uc1tCNBU_!-4#a!p)g=g~PckDQmOZE$oNu$YrCf8)exA}i|q{KY2Lvn{NKJ#Hg zCt8j-1&m8d9GelCEf5gnuu9-0f&wSWws8Wi1mT4z{gsc_?B7a&voJWg2#b&|DM#CP z(Y~5N@9Dk*1Sb-#E~|T^|F*0C+-32K9v_9W9oz}Vcy(W2D<9*( zU9vs-O={5oORxzF5so(h*4H<_t-P44taHdbQvMm~aDf}XlheBu)w;5=)x zk|ry7(1dRK67)=v;3Hf0^uV}Nmp-ckTuOjGS>gJx002unNkl{KG>pUORkcq1dA5n zzT)LXvXfb^z4n^f6<1zS?N4t0jcfcji%&@k-zT1MV##e^2StVa$(61IRI z(t>8Oh7O}|ZR5+KYu#WR?}v~T{v}j4!-p=o;QZNhzkF_Xcli!k`=}kdvx9N7XyPQ^xaxwxj>mw{oM*$K;enwB5ypidgfurHn3IKu%!+fk} z)q;lrD#+NbBydWxEky|uh^;sZG9KKVA2@a(C<8_>e&AD#$=MnI2pq!^;^gSr&FF(a zM@73NisrM9t~so?tY595Y%KEIQ}Th8!J*eVzC}Xx*@mBfZ?V$f6J3s*1YLvoD%mzN zFjlXS>&W5Bh2bSI`miN5nlvQQW|Gp$ zaXvBfu_K1*al`4SonGU3>vQl(O%gAffuzhf?SSAxTR7DXTE~QiZ3=QJY18&yNY#-m zyEJ*DU$zvvPxXOTIMtJZ@{G;~FLro5 zx;nWFx#gaAj_i;w=$DP#L1E|7*Rcp>qOiLZ{PJ0o5j|ipbMAh9_Yi1F(r3&Iezu4Uu|A&8B6F1 z$oOTfzy!qhKOV@>wfn|n%x38DOWelAFDHm$r%YkDYkf130OXA(_td-ZTs=DIn>>uq zE;&?BC4O@AC|NFQ1R<@6*gj}T+_M`+pSD%uKvROHapG_5gnqPBWA(DXAm2!5_vzwF5`XXq zzu#NNURJbv_k!V`Gxs!YY(`vaz1M<3!aVD&Gn;-kNykZ`cvHxLp2?VO$P$kd$hvu5 z7vK-ijP=w&2?Z5h0|EdiIagGSXh%Mufee7fH2$tv=;9#D?aDXHsLGSFd_qK36 z%ODg^|7Hayt5ya_XbJWbh?!zmQf4{cDz=R!Alb(9g3lGD6fg1EI+k2~u9HzlfmUMz z1-$5`D71Q}OhJrRJN!rpj)ICh!JI?j0S>g|QSwPJMH>ai$(0sf@c>fSJe3hSXAChS zb>!s*8E^WkGY*3=b48zzfIR=p=Vw>dip(3y5+wt%GBC;UhN!oQr6|vN1!DBSPzhNQ z;Qa6b&x6p+$r-NkLJPUk0lf(9jF%44;~cFW_=|6{L>v8UPabBUXk*A^L}%Jtxsj0- zrKF6uDY#AvOt0gRfPRdHX7%W0JLJl_=z-0U3t9wb^m1I20(eYR^koMUmOc_K2Zx`o z=!DGJ3m))DZXDLRAg3KXk}F;5!%pZ1UNS<*wbxx+_%H9>7x=vRClI5TOpTMDKC}wN zDtWukk7pPgem02)AH|ZG@PmG1!i6UKLSys?virghZ@cZb*0r{6M>URXa-?^7Y-jrT z*af98<6e5{WfchX%{;S`$@8smUlZDo6HYb}8j~~yPgh=XW$VHi-UEOKZnRx>)ivE7 zkQIHJ2)oCw@T87j@nKwn*mWi}+K4k`Y`m6N;g6543rYg@--v;)zy4bBH-6HReOoY` ze)<_L19Y?Z>nq-Qxy=gLqn_wIJ~;F~ww~4Fm7ejYO%enjg;(5iEr#l+ePDVH7O#&M zKo`F8M0RB9C@!;W_wdTr$(4U;qn|!xNWT15oZ)M1osF>{wyrH1Y6myFfy0sS8$%n{ zN@SJex?#s#$Eir7MFiziG^en2hf&6Wd5&e)&S^1>0RmufnN@hrALFN=!C1x{blUsq zgXd6Q4$)V8g5*g05ttbwC-Z#Qy?iE7`-?8x*Kg^XL23`@^hFiMt6o6OL;w&t-q3Fb z2`_xEDGYt+*Iu0@0tAq3Q~G7*7?LzAhb0Ag^{pv9Td z0mxT?hF9{EAe;*lWZ|5At-|$H&p8A_FCkbJnY^$QvNF~bR=Fl~kck={8 zYzY?s=rb8)tI+}8*_Ufaj~CJp4mz3An&j=MuYPPPZSjY1GDC~vWg)gsc4+kM+?R&z z-FtQ?S|7uTUE4MkjD33=eQHncr;%rkdqv6l{PWLi|1jQp=Z$TzGpv@XKc7GoxuDsY zaN`HCLGnUlCOhiT8=c|L1Ol)zd|qENYk%;qVBN`?JxAB(%xq^PdNB@?aKE!wrm6WbH~;UY&z z_xX$>>11+2R&eOM2nX_=qYcnTPx!zu8HlI+l|Jbe@9c(b=-fRz)?U4dw*KM*nW&5W z^wFQZ*r!;|M%a&g!1(c*z>$(!677y}hQbI(mLL#^;SlaxaZh`M#_;tKoFlx~UK?LU z2h8jl9=0SDZ^@e7!o{FGuhh@EEmUu6ni2XqkmtJult7}bRq#hXGPWSl!CBE1=TwJg z;2M1#1#kK=Wb|-oJZP&9L>cOwYX>*w!vmrqIPr~->A9n#J;yPwde>G9iZ@Gb^TNeo z$OTsY@M^v6qdu=zKqMP4JE7ed81&78=Btk01pUR&$F~|?dF53-!4M>YKJZ(?ppmhn z1%FEDGA=$DZjV3bCqSk>Ue%KooajQoRg`D;R*-fU-~jIL4Xs_Iy6~oyE=n^@Z(zbR$nh{dFjxLPafO+?ce@w(|Tnk18;77A&;G)qu&`Q9^#w* zB{D^$$pl{Cd(R^lFCdPIF1qj#TKHDSg{nsvKvQ@PFRp=e1!$kL9w__jx39-X{ydH` zVKAOW0A-=iwXalt`>jf>l`!yaYh54hL1GHIu`xQ+Z`jT7`N*SV!JOa7N=e&5V7uXWzSfO{SQ z2#Fv=2WLNHo)`cXst3m(HxfKL^h*#iPH1y9cG@XZg~K&f2pIHlZ+AGRPsUcaMbmtY z;Gd4Ao=lvhYtYD$j+?z!!O~W`kMfWO9<=9Z+FS8*+N#{b)rqaz`fg(2V;Q!OO+MZz ze8#f!5qLSdF~c7x4*lu_?)P{_TO2+2T?756N3`k_y5P0?6+|RE{ne%YBIq-PTt`-D zGKT)KH{i%lfj)`^Ynxy4vFgss7cJz~GOKp@bA%HPG%CiK>J=DYTjRMGe$f)UO5f1v z2L;?K%KC9f(_F=UxJ())U~OFkIPk3KCqcn!M+Oh0?dT6*<1Eld0q9F`HkSIF!yBIT z4gbJB?fjHwVb`MVip`tczFD^Av)n$%?n^8@zOgzmN%n3)lD~d=i{800tj5vdT`F7T zd=*5NXjr5xJmx;VQ`ct1>OS)^<68Xt5grUUZRhHi6>zsLfxP5cZQ zZog0lTstQx?OkUKb&Bh>kAE2h4MTqej+D%dgVyblCxFQa1>wq67$8K4Va%k?dEMwD zk#;|fDRtiW3*2)aVj@T@y#Do{NxdV{Flg5)+7mFEwLvSG((jmSknzKp>(ptJ(zML$ zfx0bP>fRJ*&QtFg=W*S2Rd8VCo;n5S>(ADsBnzu#-1mEoVW3tHO0RyZ-ZMeZ*nD@f zB&+F^4ltDu`qit`rpK*<&)f&82l~3N{j?7d6a``1l4&!Q*%aKH!t{EIGcpF#`p^-% z*($Pv?U&^$$!E2IrqG~o`h_>g*hwHbr!=J>Ap6)-@B{?ayrnDAD3XyP5sh7#kqEJ3 z+Yt_Rk`bH&f(eqk!SD8t5m1LVdXrog=juoMoe;YNX_Iza6RJr!NmRWyeze01%_Er` zZt%U$7uVRsU)Y_#uA!Uah0jFVb<R$Y!bwN7pIAxlYKKXc_w6 zrrp`#r|7J9y~@?TCebF+c9e#Gw`qh6kCB0U1Mi4O^yNBsmhq=DJJtXX(d!iOsJp{M}FaFrinphzbK7K0(;E*@E+_F@OkA8-hqsz~sB{ zj+FOTw_v^2X6-&lLgZ7G9c>=95 z+;grDoj^Zz@Z%?24EjN z?ITC`rhF>;yDw23e|+)audcn6Wi@N3BtFr*D<#MD2gYKnCXU)}^{={Z+q24}ulMU& zJG4cnno$AF7*WoR?19&DAppCxTfXF?t$oKl>@P3Fs!1Np}UZV>Scmw#*h7aLA{Hw#W zde_=3uGu`fkVo3O$7bM$(=qqpbl-L44BS%}n4Yf_Lf8AA(Jm4cC96ZU`?&_L(vrD2j1WO^1I=v3jl?p>1J3oqO9a12`y#&3LCJwZ|298U z*zKNc;CgxL8I`={3 zmT|zepL@niV9_pinm!4#N#sD=oCg<3AIJT*ogTHzePz2JKD4O%K9v21-uW2ar_buV z?sY$%=0|PE&21d&yhkzU+?G=ybVP?!K7jLqWB0ybw|fVJ<@=z|1oT(sgN~zbifev4 z>`(Lh&prNEH{X4)`05>vZ9h>TTiC|4%`=F8-CNYzBDi-TIN1FU3R7BkqiYeSeCCKZ zyiWUvXLTuQr%dIM_PKTpS;Hl-oOWelH-#0Xg6hPxtBhVt7Ln$ zz-sm-8c77=;Ud5AydPI_JF43c4?NboZGD|FZ{2=(DEN2dd!4dagxzT0k!V#Q=unv4 zhTvEpS0~w}n@4cV3-Cw^`@n$7<>j(E;PYtVbpuB~tY(Y0nwJg{<#QhO9Gmty5^b$p z`+OV1OC5JqTg!&mNt+F<42P0~j-EKb4auvAe?{B8t|+V`WThTktG9#0Q6>BjBAb<< z23RNhHNvWTIy{rY!vUdt9d;HT*UamZr1y$;Nm@Gf9EE{zDL}R@<4(4V{JOc5uTHYf zYwGKG05Kg+w*EnMv~J(~Ao%yk$C0+dMcT8X9S>qQuz?M1U;`W2z*=Ap&uEj;SDTfr z*80FR#wi?Kv+55fo8wZzBWZ)X(Y@mttv4RMF75U6!vi(oN-zAZD2x@h zj*l*w%VhI1)cfFQbok|9opKM4M+>j3$^A$Mxr4!KwBWH4?UGx^1Lk%AhrbL3jvn9J zre(_W;o^T)JQl2rAg`ja6Rj_6_Thh@)wHRUqv?S zw)dln7O+Yjn9?)t_hH!HZnBYA)pw%xJ+;2*d-}6hhXys^3ahqN(yZ1yj|Ya`nE&vA zT;|8a4u!bUt|H5$2Uc~AqeriydmVBQk4Foy%gg=42y}-Jibsj|Ba18AIZyAKR8^v# zAIHgoc|Y20{b-_R64Ftj??Wsh@TI!e^JTOc_Qd>FxQf3O z;8WR+{-cE_d9`V*|5_^uo1Y#cz;QV690)#KL;he8nXFSbk;$JvRLo9*k%Lkfc+)fqXm*z*OX|d$HNWBvJtOSHj&B3!9NsOr%E?)$go;$ ztG2zO)n~EaZc0(N=zkxc@>Y%GM{}Y&80^OD;pAr(S?)IOjzsHA|NWwfZ+-zmo{srm zUf(wf+|8GY_jR4W_ulx4E~V=x1j6HI^YRsL+AI>KUK`(GT&=q8*7sZ1Uw_}_{QHdy zc+NdAj{m2; zI8VW|W6N{GzdFZ2cu9LOy+4I1?hguV5KQgIsN>s(24tN2SG0_}&>u*f$cs%o*JjiY zUEqKEebIs7OI^;j&pjoe+16#9`^^WxDGU70E2yqrH|(z}wud_~Yz?z)2jdt2MTBt% z-}4&>fJOenlrMMN->YH=@BQD9Y5y!-{pCB7C&VueQ<($T)4J){tHKo5GVqb(wDmo^ z+dl2jcR^#EAFE?uzy4KX8s0T+ETf1q_x$EicHwK-$ovZ{{F2N7NJmiV#Mpz>bp=6*bcm_`uls)0qfV+#e%<7a*}Ly< ze>|vh%nLUCSb!fz_7hSAFQP_qt(~6<>z^De!_~HfMzzrVy>~}&9DP;;fz_`-I2udw zk*4Me@;T(*2Lb(jJPJ;9CYTSJ#}5MdF$CE2Tb0dQ-vxuOzF+^1GJa&>y(-i8O3SVO z*Cs#F*7vmQy6v$;Pxy6?|EWAu(muTGc7G9qFXMq_`b|N9WkAv20WA7~W7yn#WvlPK zH)tC?Ozcvh<{Mvg+nnEr$2~{=@=G|W$AdDh%X#`lUV(9M+fV%c`qyy3RprgC`d|OL z?EYQ90t0`yTCNms?NR664>WC6H^zRyZLJEOESDFe?b-IH=R%H52&*7dH5IUygE(`kRC(*J}YPl4+jvUR1$1i{Q8MyH?PDW!G z{ac<*+xT6}fW9UuC!RQdehld2ho_O+KQC2(0-xWqB`bK1iypM0MafT5shjc+)afh9 zh6nfcL4*5a=05tvm-FVYihhc^MVOAY2$BOC_}M@|g-8z7p|2Z%@s=MI*Uov`!P|Tm z9wYck#ZFRH(ef>MW^&^?vhW$VMF@@BD!C5-K;6I_IlNaZoEo=ia*alTmp`BjG%kJS z=gUIIUl!mFe&abupNXrVY3$#^E#9L?HcP*eU(?y0i?_LK!)MMx%cK6-9a&86!x64k ze^j9RRe@_d?$obRA3Bx=c$SB1JAWCfV_yxW`>^-%i%U&I{WZN+?6y^>t+Fb8#}2fW zjMH79HJ{rpqiyJ(rQ80wz!Q$|-|E&nnvQC z(#D|S8C%gcMg;^o(96^s$psths7Sd`vnc#pS zyN|T(DRAfy`~D?xcwkKAwkNqJ945WL>Pg86WB3e@;ZL%7rxKdqU$yf>6fKX5O!`=5 zt6yD2X4y(L`RR#9$^V0JyEV@I82ka(i*@S&0`GCdi4+lDWAa3zET>%JanH}dE z`Q3ifCr&=E+5-2w?c`j$1fi6)3FLa}Txqv#Nw9McQV*u%PU}~J^hy7z19osNx_gW& zSTJc3xvAG%MmavRA>G93XkGyk-m$~lt_;MzUMrY|_F zO@354WwA{_9e`6iu-Il1_IFQzc-;3J#Y)qPT=?g7gHbhhSWc)_z8@b?a_c^YBQy^f zWA?oQV`(2+r!?sknMFPzw5f}J6@DT>NVe+73P{a(798DH>;9`wjc;AhW4>4VHcprN zS3H=!buz3Y*`h+*)?3lbhO8XleW&=w2mc=^n@>Ds$ED>m=cDD~*jF{Nt<{QTYnwkZ zTDHLJ*z%hf5Zjp6tsBrWY$3KETVf->s!7Q^vv=Nor;`RCgYXepy#7BKn$HDR)wRvc z{{pSYI=b(1Lnq$IcaA1~4*Zw43qbDk(*f^mal~Q1b^LAxtCPxr#t&1!BQO{9&a=JN zMpp(VsMU?W&-t_wwAvV}og{I>i6?IHMwr7;w;hN>C0I?jgL0jqtzYitTASQo2Htq% zjXs`o$|*bg!5Mt$KU9Dx_y9g!r!)^;N=EY_FQC0$4$FzraPr9~Z{6$dy~4o|$qW6A zHb0C{z{ViQx88btc1rbi-IJg>4US2&c&AHrz?Wj&)H%=fn{U3kb^Y3Ful3OuV~XpQv%c(8^9ifXJqVwo@l{m1p%p0ohN63**hfM>t;al>3^UcBMNk!91C!IVd9-38M zO=Y@0(B@F#aNsz6fXN|`z@lv1i??JkX=)r*|L8TM~e4yX|&@Ndj~|1+=13 z(ar=Vbi?mlUq|;9=WwT}LyvPbEQ0$}m|l}ZQM!dcG8E)(c~0r=Rapi0^lvWbJZ4v= zlU=p*Vx52=THOQFF`OrexBZta9Mwf8APHD|dV)_|6d*R*93)a6|$yTo1QRKyY5?U(l7WFpdIe2rei~2ED0Hd z+=CBYCOGO6Dp4~I|N@ZsO?Q`?6L&3p#{-~I>tqi+?u!K&@o z3%J~tW$Y->rxRI|m6*^_e6S}n)53%wm!+J8qD@YeQ{ z3!tL6LP`o8jWP8$l2w$(0#^w{0R*N_AO!FTZq;-Px~>XbVA_}S41?V+Xi&hEt{D5O z5C>hvv3RZ|IIRM~t1k$@t`lU#M}yNEc8oo?gvYk>$hrHMWa5qQqnTQGB6O3Qst zzsXI;Ori@fqwSFGlsDJYq?`9Kzr?iBmG0$fnd8$^{>fXuh^?} zeWBUHrJ$w83_q^bTS>6dEm_Zd^fqbzjrz!O$PQ$j(2P&THC~mp1!+rWWCPrH-fuS7 zeLE0MTiwgns_P!3uhtJO7h@M~*#R+r6IIYO*W`uGpj{ygajLB88#HV6pE7KpOvfXdytLTX zSbYY4gT^TzQ`lequ?B8a(AH-39f>?f4G2C80NMrjGLU`&c-0w4ah^7g@K3j{4hDjA=*ub&UNV^mWx=@l zoL^fd>UY{{r`44t`}XXWS6`i-b>^8BtgM#CmYM#7V$b#~$mLmO^U*zrtQc|2uIg-; z!kr@c!K2-1JNQ;-TUeVj&NyRB2a$*EW2*^YBc`o-1zn)Gx~osd!EgEpM?igGdLC%{ zd*{TK=b!`h5l%8K85n~MJjSq+AeXGT*`)i0r29CwOnUXZ&6~PWKkUvqK7lRz@Y-)j z);XN`(^dhIA@Fe?pP7x_1jKJun_8%s-J(bsmqsQ8C8$`;cS#bNTfus@j&P*fu|%!=kKv7i@lhqyPu@r31JR^z!=ukD$Y zll$5}_Sj=>_wL)qSGT46kNl?X>eVV_bXMu=^qxQs`v9>ufBr2C@0Zho0cy`= z$&ReZd%>Zzw@4?gr@+wkxF_V3J2EuJ#b z!@tQ6942-zz5LSbjo063AJ(@huX`&nT0quh1gCSfkSjg2S$OG=EYTQ$TLxNBO9S8a zk`DbJ*Rp&4_19)Eyzt`eg7Yt!oqooixN+(aW}-d* z&kDRf_wWAQU(WvRzx_AOoyXE#qgNd1m(FOE0z~k1e?|R<`ko@cfA0P6MeYflo>1ca?EfsTIIqu5pa;4!I{f?a^szhISA{$570wx=GuD#&!!yo>z^_P1AlLM2S2dn>2O13YQ zY$W2Adog3eU<FA}|BM(0^yYIgH zX0Mj-S><-pE#I@FaMFn<^_#Srl)PFKxaXdIu3v<@`s%B+i$;pYcg+#j&0HLFQ0pEcCPp@8CF>ah~@pVQQ80Iz^3MBb+Xuc z-SCyKd}UTCb|l(gz4vY>+CTfVf7`QR4tn4H_qTwqyy~jiqcxlV=C{5z`|AJtU$ZN& zys~G%k5}EDKmKtU+e^sl69^>&M~;F?*Mc%fkyr(6NkNd;Mo@H58^Lla zM16;Ij|8f{BglE`Q?#dO=VngE;w*xY;3Fvr3S%b9Ubd~|{R-SaWL&(ap9J--lG!)D z@r@qu(n~MxiN)PNySsxio}aJDiN1UHp4BTQfrL!%zWeUk9e3Q`xFoMfE8tvy+2y^m zZ3C@(!H|r8_Vb_5zEwO4?(pARLG-I%{c6)gPZwQuQOooG(&yj&&EGWt+Fn_DBopIF zq(3h_`8{HCfx|uY-EqeqJsD9ip_&*yT9Yw2(PJ!q*$qC7DL^g4qD-gP{c(^QOC32r zS7Y3F|9!K&e|mR0;JM8|xZ?+RbW#K+b;hS-TcWn2-mDeIOE11O`}@ED`<@6~bImn9 zlg&$d@UuORZyd70r-`HlgLaF`9;=#kuXj2g(-M1e_wsOEz-`H{U^g2(T=1J-t=pzPuI&82*6n}z5C8XU&z>`8`)cKN!37ue1oigv4Z8o- zCqLOMZ@dh?2ET#uoZ?!+v$A+E^&rQi113E6f7{oK5V|dH_`(1DAOCaqU;pcWZU3?G z5O?|O*T44lo>YDGl1qBB;_({Uo1hN-RmiAqX~@6FS?)-* zi2jSe_;<5^^KbsNgAd2C;==q5*I(a(RUjs?kA3W8Bhi*K3s#crndJl$^qw*_{cr#N z_bV8Vm7HKK!C_jE5}?d#%wpWT^UgcF4+oWu;N|%0IWEEJqpjrST5v#%z-WB zYxQRAR$~lbFyxSmi38`*|ArfG=wPV7Hh__HYJA0^T|1{ZbSijBAJ@ROHXus2T9B9| zq3f=@u8r;CngL&5GClwN3$$!rCH;?n^rO}1xLUTVOSYTfZ-HGvYi zw6i5jw(j8>ezLNPL94_@2lS2)c*(^0bSmhOC0-=)Y`+HJ3*>xybZXpOb2NeW*=L@e zJ@V)yvr8|zv?m7IJoeb*vp0)Y;~4+-IzRcOlV_)$ep)9?@_pv%XL_rb6LZQ3?th@$ z(hKKiOIE1tx_1mpPq~K=@*s0ztR@pCw$9GmzuGxLrpE_IH#(e#a*JnSw`)9Lf%Z5EO)#vV#rR2q~fl1Z(%ddX? zlOOk_)=KK6lTX@u?nQ3e;FI6d*@-8e*b`rRW(U1HQTAo){e~NFoPF%pTl*fl@f|q! zoKXR==zFz31MxFZ7~Qe-l=^G0_pH$Q?fS$;ZTkUGP_a#eV2^ z*xCMJH~QBFMl#$~Zd>R5Zz9twmGYWraocVbncz!o_CAVlEaN|RqvRH`*De;@xVz%| zFMs(wG;JS0Dck3_WW}x=P2}Kv&Ur;b5#7%SaxfBQRaL<*-$!exYvQz8_U z^4x_0BtHhm2#v=fjm;pFlnGLC&1gBIF|^^B>5n!%!HXY-!3v_Bm2sn)@}~ly_HmxV zSr~iTI*;+EUO!_1?K7SNpYbFQ<=k`6n_YU@rAYn9>o zABXmGL6{B)oRGK#AU^3i~otTUvvu?Y#Dx!XpDDX@j(ywu;)sYCTaAj zorx#=ez8{Ta45Hb|MpJKd=D+!!i|2D-)pY9c6N5@hEGWF^y)=BtJ%}a2TY9Fr=Ta$ zc|<`TwumK9lNj6d0wjLm;b#IHT<+n+?gRT|GkCYFV)AQ($c7ZMmPpWM5+G3GkNxMG zevN@o_yKvdRlLywJ{@B(hYPlCalp9R_I)wKB+J(L3v>O^6}n82oA1(_Nm4$$E!Nr9 z;(u(84(TWMfmik7V{DUr;2{&SO^gDuz1ZK;0z2ilQ-)|YnIt2H?Boz}!mgf}K3>ur z>5m<=0r`R4#n307c)aX}+{UA?d&|E)(r}-AC1kREsBHAkJAd3VQ*RgId*AzR$0D|E z2XK+TBMCbat^YA6$a6vgrdJ3>IOqKIZMU`X1fZA7NxYzPX05OU3r1%f`RQ6sFd)HS z5q#hgEX>vjSD+M}&0wsWI654h*m&B1?sK2(Ej;}=A%{cnaP7v0b`jaQ=m;7N)`75#*nlWZ3K=E>J|J?uhmyp zeduCf3{J8Y+|Xo&=IzFQCUn-`?RM{sqOIie`s;5r9$Q*__ntjFuM#fV;$tfrmA>@< z_{TrqZDaVxanFQBaMRCfj6MVdb?(DsY)6IM6#*0<+Gk~pSGKS!=vPAQ75Vro${|;Y z&+1KJyW8&bR*L{*wt{nplGx8{Z!R|=eytSwkE-jifwey`7>ESAHS4*_m*BRzx?v{p`V*nl+50G z`>oytmXBt9NFwUlX4|ok|IlM4PV(S`=;L?KR3iA|7r)qi`Em-6M#!8@J!d0V ztM{j$db;H*IVt>5qJc{?^1cV!j4x2SwvrW0(L)-f#CEOQ!%ipBeq~WfbT$nI@>QkSZ-Ezw<-Hv?lOt)-;OgtjvGi1uv zOiFA`(xs%;DzVXfSvGVh>74euZKP(v5 zIv?Nj7Xj5vCg)eckVwrg7!l+6!WX{KjM^45i)AzdZ3o9P1`KkNbIv(?E6H$nNmDS8 z6bV3ZBXkZV@evp!BYgGns*{8{qhKr0IWk%TvpVB!oYt6vJX$DB5F>av(d8&`q0fE6 zaeoerh6FB!JRE^>wVx_1{q;*ANSz?Tz`~msm;^ES1u=ojibL{)Q-T_JYV11dF9APS zD_3tk`e6YdBT>kQ@krX|oHO2dY`W&OB`FAC9NA<9-+~(X(5vz2=hL75bj#WViQ@|< zU;5IQI`P`}A$Rx$2jg-Afdt)jN+)pRKa;LigM%$5lyAv*-e1zZ^pZ<@tN-SkZ)!U@ z@BErfoPACwurtrx(_73B6;CF5CWPpwGqPlBwz}CFdg(K^a8o5!~(B`@+MU$Uh$lMC16PybU|+*jh0>jDYX7@pCZFq!z-roX)G@6t;zX?lM8 z)4MBqK3Z}(wR!NKz|ifCRwqa^I1bf9t+otIe>6x)f`#__3M>>PiE?blEm6Cl=Y+PS(26z=Dyh3Rdz3WL z3%9Y27rH{X0Av=em>IRQDlnk~ZITEc^g*-Y90=M#T^!$7=+Y)Z0SHp+U6UO?ywPbT zVRcHzjES7I^NhjFmJ|BAw+k*9&r-)14OF17KRhwyS6_W)ixxUGF#_6KVM&YxZqMHhCk@^KWpMb8^=dYLnvaD1qt=H_+C$l9`QmW`GikfFdBPXZV7vBYHa^ z6@8S3_5>!gNUJ-=EZa)J%Ffu%tw!SbNmPMc$AOfVL-Flgkar(F{RU?x1^i3kaKG}( z%WZ6u#@M2JtUt=)g(uF-kv&^8p}`kE;a99kta=zCL$!r$EWD!CQSdi=wAE(?8Xb^T zR(F|A<3$~LJ3*=>Vp zpucMVp+UcOjMcAv<&II060bzcd9N==w%uf_iSxRD z%BiRHtmTFqZfrv$AO^?D8I@VAl`3cA=p0BthUFO|MHo}!bB{7?WpZTwDC4%PMym966JhXJ_O>r-GgYY_j1wB^_B2OW1I@ zwjFH;fV`|o=z`pA;~R@E7gx25=P7|cSLQmkDnp0BeR0X{oO91{t7v|ulNDY$m1j8g zN1j#!pZ)A-+o`;Htlk^Cua^$Ih=C7VlJpL&qBtoX366q1`J*2ng1rfsdlCy7NM3AO z0wCvyAAYEl#;qT_b#{IAH7Oxi@-(ikTuIc*RGl}bO#m(~`TNZCBQ=>4IN>~9JA3mO!jVoRJLP@8 zGJ(bGqXp1qyO`bMg#&vW$wtKSo@|tT(kmOhwQS>p3ofkoulC0fy$Izoq{-`5S6$h$ z&f_<$VG}-Y8XH6Gvxp(XyYKd#{GNVc&71OMXTm5UYa2-&DVgQ1$z&Nj!l@GiVoY|XTO?V7Opyfb>_tML+l#|uH0)b5X2%7;3T!Ls4 z76D}?Az%trf|Gm3mXOfpo`50oaayY}xC99}1WXAWUdq!~y>SH`LB$HhY8p;7WVQ{^ zrp`F}=Dyhx`rt_r0?tEcR&}YTNPHMixvC}@r`9AyfU;7p2K~Yc8RElRbsX`^GAJ^| z2bp^Q!`M8B^=#Hw7Vs@To{M?q-Ag2rh>v3Vh>rw~RzZqP(WT%A?~z9mLU@oQ@QFWi z#k+d4B2Rop#_&m|_#C3#-aC7E+tva;pM z;cTzkn)L#O=a`bqZ++nljZG5t7Ok(wGmdX9%gPI0e9$Yq61>S8;2-U15b&Z?ZOB0% zJhK^iylg@DwotvOM7CM=Ytu=+#ure)*lIniCq&xVPV;SQ@JmknDroBur&YXX@FrsP z^h6~fI8CsC=lfm^;d5*|e9@Dnsm=>fzOgBEkT~7qFFxUO$^w<=+ZuS;jy%49`}cdr z?K6-6{L5eNvAt|%0s;6o`@*yKc<@#!U3j11wBn2XfcTQ61do_OmuMw#_C@w=QlfQ@ zHu{OowWAMxQVu7?uiF-XV{Ez~dh#fTPR={;{N~%F#Y<}R0({Q<*VP?QWM-kl*7y|p z;LANpmA=?FJ(#S}!?30Ca@^E+<9Aco={N7cUN4YQ;Jc8STLuHj{q+|;qSt- z0V`8>CL!V-&pt9Grm1`GxnH*K?dH(GIQYbqPxMFQT(c{-&hFThYl)Yxd~4UKr=HgJ z;skly<(krVq-16s^65nDtHw?|Vf;)U<2GC92iN6{1T*%*%dl%1&tbFy3=bl2jak() z2-{fw;z0EcXipFsbefz9Gl~M7&^27f)&?$4Okl2q&ry4Z+H}-4XVyl4<2cXQ3JCs; z?S3G%P27a!wXYhys03>n21-EUlT+b}V5 zU6hwj{j}Qnq7UsHB{=>CA3f1O{A_}4^baQ#E%?SCU>n+KJC$S+&|98#18iC63ltRN zu~~hr8ol9emw+tPqmxd5@WUTAFSc|)``OPl-TJHZ)_2=_{psW5K*sbK#9QNb8hkxy zS9mb&I8&2?J_nQ3)7*9gr)y8Qbc~ z_=~(TT=I)d@Tt9P^pG*0%%%frt6p33l}xk;bZH#p(X(;1rK>6bi{~lZz(MM-#_0OK zXJ@7KRB{r~;U)`U%zlBbR@WvRpZ(nD`i)rhnke?OwQ8du5cu^Mw1IXCTESLQV)Iq! zUJ@;O)Wv>4k5l;A@6gq7?0%W6u1r4Zg@dD2d#hKoZuDA33flM~LwaF#o%=r%dKkxN z!<51lNt-z;=arQvm)x4m#1vMEq+S?{<0lSPaEhS4T7hZ?*Z+hVE%vjApCv2aU z?K!Mu=stX0Zl0MMDCXuynY-YDqLZdss*Ixjg{#xaypqEuyPrxk3S{|wU30+9vwjPtHYDCSrRU*l zK>_G%ug)jVB_jx;06~H+1b?`lG5>e4D`zerLks)16ZEL2rv?~E)HimVKVzbE)Le`L zK$z`c8}#3KT(P;6*Y`1$XBk%mTAmYhyI}kxLg5INY%yr1Dv#UbqBh+ z>?^z-5PPWcQzNze&vq>-w9i>ODsF)`4;mFah(}6}05HeS!v*l%?!H(Ny@`&Zlm-CA zmTDTzAnQV%z1_$6!?u*MQ32Sqp|ATsYOBsHML}cp4rk|%wq=Kmc>k6Re$*eH#E8=~ zM01>QT>=a|+9EaTWr}c&WsGeHw*ikui+DwF+nk^g{S8|KPWguhkne#`&$Ff3mBNd?Atn>r zTeR3-D=uG#W>J%@L#6s^>teEU*U9508j@~NFE?&0Vj;p%avx{?mRqXnvvY_tYZ>WO zw*Y0~F31zRPpHySV^*b5H*RS)RT^JUnDmMJP<#Ek?3mGIV#{&9vO#)-@P;S6_+`4L zO{d$He#^I5y97;b2}hGg@f&9-$`S;d-iQ0$?IEaSo?5kG8O8A|lxru`9*p;#sU|0f z)kTEe+MLIq5|ydAH&2_k#N#JpJjBZrMfu#6WE?Rd(&7fCq#7f{yy!C*Xr(peI{DYT zX60Nvg5QEhUzOs-nmi=UR$i|RvR|0s zqKJfem$aCi)S(Y=j4b7rQ}n+$%Te7?%))@v*w5{?+=N4$FcjTU_A=K8p9jp4Z9aW{ zp17Waa1DZ4!2TSoov8qLjfzhT+a(q>?Ccm zJ=K-5F3jbV!_dV|S0B3zY!=@$mgh}N_J=WVgKM4*gT+H>5S~QNcH+4Ok0oO*0xz*fz*xie^QOLwpHZ?g-keR)0;(o-+ zJ`P6zsOXy<|1Y*FQ|~V&WtTx4rB8u0a1t681*+&QR|&5aDiu`B3wsY!4|;;HRe&F# zSt9KK&S?1`8WaWSowR?=T10ka@}lFsh=zjLwr8Jje$+ZgLZ#}_-ZKEsGrZ31yw;bc zRPJQuX5U45cr{LC#&^p$=f|6}zO=tv!SxPE2)+iabKj{dMHyfplqKy3DtYj6F zQ1!XB##$vL*|lhb`9oc=ajuu4Sl?A8#4Igl4a{0orXBjf3>~>U#(tW;Qp#~?`H668 z<8Bf5{{XtYw*UVp{1)oZF)ni&v?~Vj%RI4DHRmD!KYPWx*Q=_V5vGBP4w>=**>gVV K=1^ttcllqq{rQ;y diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 2a98e5779b..3595276771 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -19,7 +19,7 @@ appliesto: Use of personal devices for work, and employees working outside the office, may be changing how your organization manages devices. Certain parts of your organization might require deep, granular control over devices, while other parts might seek lighter, scenario-based management that empowers the modern workforce. Windows offers the flexibility to respond to these changing requirements, and can easily be deployed in a mixed environment. You can shift the percentage of Windows devices gradually, following the normal upgrade schedules used in your organization. -Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as Microsoft Configuration Manager, Microsoft Intune, or other third-party products. This "managed diversity" enables you to empower your users to benefit from the productivity enhancements available on their new Windows devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows much faster. +Your organization can support various operating systems across a wide range of device types, and manage them through a common set of tools such as Microsoft Configuration Manager, Microsoft Intune, or other third-party products. This "managed diversity" enables you to empower your users to benefit from the productivity enhancements available on their new Windows devices (including rich touch and ink support), while still maintaining your standards for security and manageability. It can help you and your organization benefit from Windows faster. This six-minute video demonstrates how users can bring in a new retail device and be up and working with their personalized settings and a managed experience in a few minutes, without being on the corporate network. It also demonstrates how IT can apply policies and configurations to ensure device compliance. diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index d36c8fd5bc..5022ba4bf1 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -24,7 +24,7 @@ To ensure that the auto-enrollment feature is working as expected, you must veri 1. Verify that the user who is going to enroll the device has a valid [Intune license](/mem/intune/fundamentals/licenses). - :::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png"::: + :::image type="content" alt-text="Screenshot of Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png"::: 1. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). @@ -49,21 +49,19 @@ To ensure that the auto-enrollment feature is working as expected, you must veri This information can also be found on the Azure AD device list. - ![Azure AD device list.](images/azure-ad-device-list.png) - 1. Verify that the MDM discovery URL during auto-enrollment is `https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc`. ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) 1. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. - :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: + :::image type="content" alt-text="Screenshot of Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: 1. When using group policy for enrollment, verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. 1. Verify that Microsoft Intune allows enrollment of Windows devices. - :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: + :::image type="content" alt-text="Screenshot of Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: ## Troubleshoot group policy enrollment @@ -78,13 +76,13 @@ Investigate the logs if you have issues even after performing all the verificati 1. Search for event ID 75, which represents a successful auto-enrollment. Here's an example screenshot that shows the auto-enrollment completed successfully: - :::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png"::: + :::image type="content" alt-text="Screenshot of Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png"::: If you can't find event ID 75 in the logs, it indicates that the auto-enrollment failed. This failure can happen because of the following reasons: - The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here's an example screenshot that shows that the auto-enrollment failed: - :::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png"::: + :::image type="content" alt-text="Screenshot of Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png"::: To troubleshoot, check the error code that appears in the event. For more information, see [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors). @@ -92,31 +90,31 @@ If you can't find event ID 75 in the logs, it indicates that the auto-enrollment The auto-enrollment process is triggered by a task (**Microsoft** > **Windows** > **EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM**) is successfully deployed to the target machine as shown in the following screenshot: - :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: + :::image type="content" alt-text="Screenshot of Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: > [!NOTE] > This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task. This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Azure Active Directory is triggered by event ID 107. - :::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: + :::image type="content" alt-text="Screenshot of Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: When the task is completed, a new event ID 102 is logged. - :::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png"::: + :::image type="content" alt-text="Screenshot of Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png"::: The task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This status-display means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It doesn't indicate the success or failure of auto-enrollment. If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Azure AD is initiated, there's possibly an issue with the group policy. Immediately run the command `gpupdate /force` in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: - :::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: + :::image type="content" alt-text="Screenshot of Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs** > **Microsoft** > **Windows** > **Task Scheduler** > **Operational** event log file under event ID 7016. A resolution to this issue is to remove the registry key manually. If you don't know which registry key to remove, go for the key that displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: - :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: + :::image type="content" alt-text="Screenshot showing manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: ## Error codes diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 4fa277cae8..8c3dc27e89 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -32,7 +32,7 @@ Passing CDATA in data in SyncML to ConfigManager and CSPs doesn't work. The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore". -![ssl settings.](images/ssl-settings.png) +:::image type="content" source="images/ssl-settings.png" alt-text="Screenshot of SSL settings in IIS."::: ## MDM enrollment fails on the Windows device when traffic is going through proxy diff --git a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md index 204269063e..d3ea09a030 100644 --- a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -1,7 +1,7 @@ --- title: Using PowerShell scripting with the WMI Bridge Provider description: This topic covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, and how to invoke methods through the WMI Bridge Provider. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -44,7 +44,7 @@ The following script describes how to create, enumerate, query, modify, and dele $namespaceName = "root\cimv2\mdm\dmmap" $className = "MDM_Policy_Config01_WiFi02" -# Create a new instance for MDM_Policy_Config01_WiFi02 +# Create a new instance for MDM_Policy_Config01_WiFi02 New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{ParentID="./Vendor/MSFT/Policy/Config";InstanceID="WiFi";AllowInternetSharing=1;AllowAutoConnectToWiFiSenseHotspots=0;WLANScanMode=100} # Enumerate all instances available for MDM_Policy_Config01_WiFi02 @@ -86,15 +86,13 @@ class MDM_Policy_User_Config01_Authentication02 }; ``` -> **Note** If the currently logged on user is trying to access or modify user settings for themselves, it is much easier to use the per-device settings script from the previous section. All PowerShell cmdlets must be executed under an elevated admin command prompt. - - +> [!NOTE] +> If the currently logged on user is trying to access or modify user settings for themselves, it is much easier to use the per-device settings script from the previous section. All PowerShell cmdlets must be executed under an elevated admin command prompt. If accessing or modifying settings for a different user, then the PowerShell script is more complicated because the WMI Bridge expects the user SID to be set in MI Custom Context, which isn't supported in native PowerShell cmdlets. -> **Note** All commands must executed under local system. - - +> [!NOTE] +> All commands must executed under local system. A user SID can be obtained by Windows command `wmic useraccount get name, sid`. The following script example assumes the user SID is S-1-5-21-4017247134-4237859428-3008104844-1001. diff --git a/windows/client-management/win32-and-centennial-app-policy-configuration.md b/windows/client-management/win32-and-centennial-app-policy-configuration.md index 5af3714a87..b6502accac 100644 --- a/windows/client-management/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/win32-and-centennial-app-policy-configuration.md @@ -20,7 +20,7 @@ appliesto: You can ingest ADMX files (ADMX ingestion) and set those ADMX policies for Win32 and Desktop Bridge apps by using Windows Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. -NOTE: Starting from the following Windows versions Replace command is supported: +Starting from the following Windows versions `Replace` command is supported: - Windows 10, version 1903 with KB4512941 and KB4517211 installed - Windows 10, version 1809 with KB4512534 and KB installed From febc23d00061be707b4cfd31e2e10fce1dcb3317 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Fri, 21 Apr 2023 15:53:59 -0600 Subject: [PATCH 124/139] Update windows/client-management/client-tools/manage-device-installation-with-group-policy.md Line 482: Add lightbox. --- .../manage-device-installation-with-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md index d936efcee7..36216351f6 100644 --- a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md +++ b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md @@ -479,7 +479,7 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it—this policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. - ![Image of Local Group Policy Editor that shows the policies under "Device Installation Restrictions" and the policy named in this step.](images/device-installation-apply-layered_policy-1.png) + :::image type="content" alt-text="Screenshot of Local Group Policy Editor that shows the policies under Device Installation Restrictions and the policy named in this step." source="images/device-installation-apply-layered_policy-1.png" lightbox="images/device-installation-apply-layered_policy-1.png"::: [![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.](images/device-installation-apply-layered-policy-2.png)](images/device-installation-apply-layered-policy-2.png#lightbox)
    _Apply layered order of evaluation policy_ From 474249bee42fede8a42b1064303053f0616763e6 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Fri, 21 Apr 2023 15:55:25 -0600 Subject: [PATCH 125/139] Update windows/client-management/azure-active-directory-integration-with-mdm.md Line 66: accepts > accept --- .../azure-active-directory-integration-with-mdm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index 6fba3ba595..0bb98be706 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -63,7 +63,7 @@ To support Azure AD enrollment, MDM vendors must host and expose a **Terms of Us The Terms of Use endpoint can implement more business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which can be a degraded user experience. It's not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Azure AD. -- **MDM enrollment endpoint**: After the users accepts the Terms of Use, the device is registered in Azure AD. Automatic MDM enrollment begins. +- **MDM enrollment endpoint**: After the users accept the Terms of Use, the device is registered in Azure AD. Automatic MDM enrollment begins. The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Then, the device is enrolled for management with the MDM. This step calls the enrollment endpoint and requests enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is available to the MDM in the form of claims within an access token presented at the enrollment endpoint. From 49a5ec9a5f74ef077e186e52baf0a158a51dbd2d Mon Sep 17 00:00:00 2001 From: Carmen Date: Fri, 21 Apr 2023 16:01:51 -0600 Subject: [PATCH 126/139] Add details to Get-DeliveryOptimization -PeerInfo --- .../includes/waas-delivery-optimization-monitor.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md index 0d11fcb79e..8ce868101f 100644 --- a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md +++ b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md @@ -98,7 +98,17 @@ Using the `-Verbose` option returns additional information: - Bytes from CDN (the number of bytes received over HTTP) - Average number of peer connections per download -**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of the connected peers. +**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of potential peers per file, including which peers are successfully connected and the total bytes sent or received from each peer. + +| Key | Value | +| --- | --- | +| IP | Device IP address | +| PeerType | The type of peer used (LAN/Group/Internet/LinkLocal), determined by the Delivery Optimization Service, except for the LinkLocal option, which uses the DNS-SD protocol. | +| ConnectionEstablished | True/False to indicate if peer is connected | +| BytesSent | Bytes sent to/from the peer on the current connection | +| BytesReceived | Bytes received to/from the peer on the current connection | +| UploadRateBytes | Average value of upload rates on the current connection, over the past 20 seconds | +| DownloadRateBytes | Average value of download rates on the current connection, over the past 20 seconds | Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. From b76f795fe9ee414ad34b47fa6225697d3b117d10 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Fri, 21 Apr 2023 16:11:44 -0600 Subject: [PATCH 127/139] Update manage-device-installation-with-group-policy.md Fix non-standard uses of hyphens. --- ...e-device-installation-with-group-policy.md | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md index 36216351f6..da685db207 100644 --- a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md +++ b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md @@ -448,14 +448,14 @@ Setting up the environment for the scenario with the following steps: ### Scenario steps - preventing installation of an entire class while allowing a specific printer -Getting the device identifier for both the Printer Class and a specific printer - following the steps in scenario #1 to find Class identifier and scenario #2 to find Device identifier you could get the identifiers you need for this scenario: +Getting the device identifier for both the Printer Class and a specific printer—following the steps in scenario #1 to find Class identifier and scenario #2 to find Device identifier you could get the identifiers you need for this scenario: - ClassGuid = {4d36e979-e325-11ce-bfc1-08002be10318} - Hardware ID = WSDPRINT\CanonMX920_seriesC1A0 First create a 'Prevent Class' policy and then create 'Allow Device' one: -1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. +1. Open Group Policy Object Editor—either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. 1. Navigate to the Device Installation Restriction page: @@ -473,9 +473,9 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Click 'OK'. -1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks all future printer installations, but doesn't apply to existing installs. +1. Click 'Apply' on the bottom right of the policy's window—this option pushes the policy and blocks all future printer installations, but doesn't apply to existing installs. -1. To complete the coverage of all future and existing printers - Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' and click 'OK' +1. To complete the coverage of all future and existing printers, open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' and click 'OK' 1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it—this policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. @@ -493,13 +493,13 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Click 'OK'. -1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and allows the target printer to be installed (or stayed installed). +1. Click 'Apply' on the bottom right of the policy's window—this option pushes the policy and allows the target printer to be installed (or stayed installed). ## Testing the scenario 1. Look for your printer under Device Manager or the Windows Settings app and see that it's still there and accessible. Or just print a test document. -1. Go back to the Group Policy Editor, disable **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and test again your printer - you shouldn't be bale to print anything or able to access the printer at all. +1. Go back to the Group Policy Editor, disable **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and test again your printer—you shouldn't be bale to print anything or able to access the printer at all. ## Scenario #4: Prevent installation of a specific USB device @@ -511,7 +511,7 @@ Setting up the environment for the scenario with the following steps: 1. Open Group Policy Editor and navigate to the Device Installation Restriction section -1. Ensure all previous Device Installation policies are disabled except 'Apply layered order of evaluation' (this prerequisite is optional to be On/Off this scenario) - although the policy is disabled in default, it's recommended to be enabled in most practical applications. +1. Ensure all previous Device Installation policies are disabled except 'Apply layered order of evaluation'. This prerequisite is optional to be On/Off this scenario. Although the policy is disabled in default, it's recommended to be enabled in most practical applications. ### Scenario steps - preventing installation of a specific device @@ -542,7 +542,7 @@ Getting the right device identifier to prevent it from being installed and its l Creating the policy to prevent a single USB thumb-drive from being installed: -1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. +1. Open Group Policy Object Editor and either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. 1. Navigate to the Device Installation Restriction page: @@ -552,19 +552,19 @@ Creating the policy to prevent a single USB thumb-drive from being installed: 1. In the lower left side, in the 'Options' window, click the 'Show' box. This option will take you to a table where you can enter the device identifier to block. -1. Enter the USB thumb-drive device ID you found above - USBSTOR\DiskGeneric_Flash_Disk______8.07 +1. Enter the USB thumb-drive device ID you found above—`USBSTOR\DiskGeneric_Flash_Disk______8.07`. ![Prevent Device IDs list.](images/device-installation-gpo-prevent-device-id-list-usb.png)
    _Prevent Device IDs list_ 1. Click 'OK'. -1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks the target USB thumb-drive in future installations, but doesn't apply to an existing install. +1. Click 'Apply' on the bottom right of the policy's window. This option pushes the policy and blocks the target USB thumb-drive in future installations, but doesn't apply to an existing install. -1. Optional - if you would like to apply the policy to an existing install: Open the **Prevent installation of devices that match any of these device IDs** policy again; in the 'Options' window, mark the checkbox that says 'also apply to matching devices that are already installed' +1. Optional - if you would like to apply the policy to an existing install, open the **Prevent installation of devices that match any of these device IDs** policy again. In the 'Options' window, mark the checkbox that says 'also apply to matching devices that are already installed'. ### Testing the scenario -1. If you haven't completed step #8 - follow these steps: +1. If you haven't completed step #8, follow these steps: - Uninstall your USB thumb-drive: Device Manager > Disk drives > right click the target USB thumb-drive > click "Uninstall device". - You shouldn't be able to reinstall the device. @@ -589,7 +589,7 @@ Setting up the environment for the scenario with the following steps: ### Scenario steps - preventing installation of all USB devices while allowing only an authorized USB thumb-drive -Getting the device identifier for both the USB Classes and a specific USB thumb-drive - following the steps in scenario #1 to find Class identifier and scenario #4 to find Device identifier you could get the identifiers you need for this scenario: +Getting the device identifier for both the USB Classes and a specific USB thumb-drive and following the steps in scenario #1 to find Class identifier and scenario #4 to find Device identifier you could get the identifiers you need for this scenario: - USB Bus Devices (hubs and host controllers) - Class = USB @@ -626,7 +626,7 @@ These devices are internal devices on the machine that define the USB port conne First create a 'Prevent Class' policy and then create 'Allow Device' one: -1. Open Group Policy Object Editor - either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. +1. Open Group Policy Object Editor: either click the Start button, type mmc gpedit.msc in the Start Search box, and then press ENTER; or type in the Windows search "Group Policy Editor" and open the UI. 1. Navigate to the Device Installation Restriction page: @@ -645,12 +645,12 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Click 'OK'. -1. Click 'Apply' on the bottom right of the policy's window - this option pushes the policy and blocks all future USB device installations, but doesn't apply to existing installs. +1. Click 'Apply' on the bottom right of the policy's window. This option pushes the policy and blocks all future USB device installations, but doesn't apply to existing installs. > [!IMPORTANT] > The previous step prevents all future USB devices from being installed. Before you move to the next step make sure you have as complete list as possible of all the USB Host Controllers, USB Root Hubs and Generic USB Hubs Device IDs available to prevent blocking you from interacting with your system through keyboards and mice. -1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it - this policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. +1. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it. This policy will enable you to override the wide coverage of the 'Prevent' policy with a specific device. ![Apply layered order of evaluation policy.](images/device-installation-apply-layered_policy-1.png)
    _Apply layered order of evaluation policy_ @@ -658,7 +658,7 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. In the lower left side, in the 'Options' window, click the 'Show...' box. This option will take you to a table where you can enter the device identifier to allow. -1. Enter the full list of USB device IDs you found above including the specific USB Thumb-drive you would like to authorize for installation - USBSTOR\DiskGeneric_Flash_Disk______8.07 +1. Enter the full list of USB device IDs you found above including the specific USB Thumb-drive you would like to authorize for installation—`USBSTOR\DiskGeneric_Flash_Disk______8.07`. ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs.".](images/device-installation-gpo-allow-device-id-list-usb.png)
    _Allowed USB Device IDs list_ @@ -666,7 +666,7 @@ First create a 'Prevent Class' policy and then create 'Allow Device' one: 1. Click 'Apply' on the bottom right of the policy's window. -1. To apply the 'Prevent' coverage of all currently installed USB devices - Open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' and click 'OK'. +1. To apply the 'Prevent' coverage of all currently installed USB devices, open the **Prevent installation of devices using drivers that match these device setup classes** policy again; in the 'Options' window mark the checkbox that says 'also apply to matching devices that are already installed' and click 'OK'. ### Testing the scenario From a9b516deb9a03cf58e2fce49bba6e060991ba823 Mon Sep 17 00:00:00 2001 From: Carmen Date: Fri, 21 Apr 2023 16:17:07 -0600 Subject: [PATCH 128/139] Addressed acrolinx recommendations. --- .../do/includes/waas-delivery-optimization-monitor.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md index 8ce868101f..42581be74b 100644 --- a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md +++ b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md @@ -28,7 +28,7 @@ ms.localizationpriority: medium | TotalBytesDownloaded | The number of bytes from any source downloaded so far | | PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP | | BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) | -| BytesfromHTTP | Total number of bytes received over HTTP. This represents all HTTP sources, which includes BytesFromCacheServer | +| BytesfromHTTP | Total number of bytes received over HTTP. This metric represents all HTTP sources, which includes BytesFromCacheServer | | Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | | Priority | Priority of the download; values are **foreground** or **background** | | BytesFromCacheServer | Total number of bytes received from cache server (MCC) | @@ -98,7 +98,7 @@ Using the `-Verbose` option returns additional information: - Bytes from CDN (the number of bytes received over HTTP) - Average number of peer connections per download -**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of potential peers per file, including which peers are successfully connected and the total bytes sent or received from each peer. +**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo`, which returns a real-time list of potential peers per file, including which peers are successfully connected and the total bytes sent or received from each peer. | Key | Value | | --- | --- | @@ -110,7 +110,7 @@ Using the `-Verbose` option returns additional information: | UploadRateBytes | Average value of upload rates on the current connection, over the past 20 seconds | | DownloadRateBytes | Average value of download rates on the current connection, over the past 20 seconds | -Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. +Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to data from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. #### Manage the Delivery Optimization cache @@ -120,7 +120,7 @@ Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]` extends expiration for a single specific file in the cache. -You can now "pin" files to keep them persistent in the cache. You can only do this with files that are downloaded in modes 1, 2, or 3. +You can now "pin" files to keep them persistent in the cache, only with files that are downloaded in modes 1, 2, or 3. `set-DeliveryOptimizationStatus -Pin [True] -File ID [FileID]` keeps a specific file in the cache such that it won't be deleted until the expiration date and time (which you set with `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]`). The file is also excluded from the cache quota calculation. From 10a8089c6d882442701acd9855f5d17ddfa66b29 Mon Sep 17 00:00:00 2001 From: Carmen Date: Fri, 21 Apr 2023 16:32:56 -0600 Subject: [PATCH 129/139] More minor updates --- .../do/includes/waas-delivery-optimization-monitor.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md index 42581be74b..a59391f201 100644 --- a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md +++ b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md @@ -28,8 +28,8 @@ ms.localizationpriority: medium | TotalBytesDownloaded | The number of bytes from any source downloaded so far | | PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP | | BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) | -| BytesfromHTTP | Total number of bytes received over HTTP. This metric represents all HTTP sources, which includes BytesFromCacheServer | -| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | +| BytesfromHTTP | Total number of bytes received over HTTP. This metric represents all HTTP sources, which include BytesFromCacheServer | +| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but isn't uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | | Priority | Priority of the download; values are **foreground** or **background** | | BytesFromCacheServer | Total number of bytes received from cache server (MCC) | | BytesFromLanPeers | Total number of bytes received from peers found on the LAN | @@ -165,6 +165,6 @@ Using the `-ListConnections` option returns these details about peers: `Get-DeliveryOptimizationLog [-Path ] [-Flush]` -If `Path` is not specified, this cmdlet reads all logs from the DoSvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops DoSvc before reading logs. +If `Path` isn't specified, this cmdlet reads all logs from the DoSvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops DoSvc before reading logs. Log entries are written to the PowerShell pipeline as objects. To dump logs to a text file, run `Get-DeliveryOptimizationLog | Set-Content ` or something similar. From f7262b2682d525087c42d35c91a33d4f258e1f3d Mon Sep 17 00:00:00 2001 From: Carmen Date: Fri, 21 Apr 2023 17:11:04 -0600 Subject: [PATCH 130/139] fix issue --- .../do/includes/waas-delivery-optimization-monitor.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md index a59391f201..55f373f373 100644 --- a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md +++ b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md @@ -102,7 +102,7 @@ Using the `-Verbose` option returns additional information: | Key | Value | | --- | --- | -| IP | Device IP address | +| IP | Peer device IP address | | PeerType | The type of peer used (LAN/Group/Internet/LinkLocal), determined by the Delivery Optimization Service, except for the LinkLocal option, which uses the DNS-SD protocol. | | ConnectionEstablished | True/False to indicate if peer is connected | | BytesSent | Bytes sent to/from the peer on the current connection | From 60f70f92a8a99d13c1885fb6ed6797636cfee926 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 24 Apr 2023 10:52:31 -0400 Subject: [PATCH 131/139] Update policy-csp-update.md --- .../mdm/policy-csp-update.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 3215ea8066..50b88f32ed 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -3071,12 +3071,12 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie The ScheduledInstall*week policies operate on numeric days. -- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 -- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 -- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 -- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 +- [ScheduledInstallFirstWeek](#scheduledinstallfirstweek): First week of the month (Days 1-7). +- [ScheduledInstallSecondWeek](#scheduledinstallsecondweek): Second week of the month (Days 8-14). +- [ScheduledInstallThirdWeek](#scheduledinstallthirdweek): Third week of the month (Days 15-21). +- [ScheduledInstallFourthWeek](#scheduledinstallfourthweek): Fourth week of the month (Days 22-31). -These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday), it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. If the device is unavailable at the scheduled time, it can postpone installation of updates until the next month. > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. @@ -3178,12 +3178,12 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie The ScheduledInstall*week policies operate on numeric days. -- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 -- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 -- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 -- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 +- [ScheduledInstallFirstWeek](#scheduledinstallfirstweek): First week of the month (Days 1-7). +- [ScheduledInstallSecondWeek](#scheduledinstallsecondweek): Second week of the month (Days 8-14). +- [ScheduledInstallThirdWeek](#scheduledinstallthirdweek): Third week of the month (Days 15-21). +- [ScheduledInstallFourthWeek](#scheduledinstallfourthweek): Fourth week of the month (Days 22-31). -These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday), it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. If the device is unavailable at the scheduled time, it can postpone installation of updates until the next month. > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. @@ -3285,12 +3285,12 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie The ScheduledInstall*week policies operate on numeric days. -- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 -- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 -- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 -- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 +- [ScheduledInstallFirstWeek](#scheduledinstallfirstweek): First week of the month (Days 1-7). +- [ScheduledInstallSecondWeek](#scheduledinstallsecondweek): Second week of the month (Days 8-14). +- [ScheduledInstallThirdWeek](#scheduledinstallthirdweek): Third week of the month (Days 15-21). +- [ScheduledInstallFourthWeek](#scheduledinstallfourthweek): Fourth week of the month (Days 22-31). -These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday), it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. If the device is unavailable at the scheduled time, it can postpone installation of updates until the next month. > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. @@ -3392,12 +3392,12 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie The ScheduledInstall*week policies operate on numeric days. -- first week of the month [ScheduledInstallFirstWeek](#scheduledinstallfirstweek) = Days 1-7 -- second week of the month [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) = Days 8-14 -- third week of the month [ScheduledInstallThirdWeek](#scheduledinstallthirdweek) = Days 15-21 -- fourth week of the month [ScheduledInstallFourthWeek](#scheduledinstallfourthweek) = Days 22-31 +- [ScheduledInstallFirstWeek](#scheduledinstallfirstweek): First week of the month (Days 1-7). +- [ScheduledInstallSecondWeek](#scheduledinstallsecondweek): Second week of the month (Days 8-14). +- [ScheduledInstallThirdWeek](#scheduledinstallthirdweek): Third week of the month (Days 15-21). +- [ScheduledInstallFourthWeek](#scheduledinstallfourthweek): Fourth week of the month (Days 22-31). -These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday) it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#ScheduledInstallSecondWeek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. **Important**, if the first day of the month is a Wednesday, the 2nd Wednesday will be 6 days before 2nd Tuesday. If the device happens to be unavailable at this scheduled time, it can postpone installation of updates until the next month if it misses the install window for a given month. +These policies are not exclusive and can be used in any combination. Together with [ScheduledInstallDay](#scheduledinstallday), it defines the ordinal number of a weekday in a month. E.g. [ScheduledInstallSecondWeek](#scheduledinstallsecondweek) + [ScheduledInstallDay](#scheduledinstallday) = 3 is 2nd Tuesday of the month. If the device is unavailable at the scheduled time, it can postpone installation of updates until the next month. > [!NOTE] > This policy will only take effect if [Update/AllowAutoUpdate](#allowautoupdate) has been configured to option 3 or 4 for scheduled installation. From df62af6f3f8989d9510d3da38731228c24e11802 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Mon, 24 Apr 2023 10:43:17 -0500 Subject: [PATCH 132/139] Update policy-csp-update.md Acro edits. --- .../client-management/mdm/policy-csp-update.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 34a1970df8..8bf785ab2e 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -2143,9 +2143,9 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie | Value | Description | |:--|:--| -| 0 | Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. | -| 1 | Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. | -| 2 (Default) | Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart. | +| 0 | Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option, users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. | +| 1 | Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shut down properly on restart. | +| 2 (Default) | Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shut down properly on restart. | | 3 | Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. | | 4 | Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. | | 5 | Turn off automatic updates. | @@ -3551,7 +3551,7 @@ If the status is set to Not Configured, use of Automatic Updates is not specifie -This setting allows to remove access to "Pause updates" feature. +This setting allows removal access to "Pause updates" feature. Once enabled user access to pause updates is removed. @@ -3693,7 +3693,7 @@ The following rules are followed regarding battery power: - Above 40% - allowed to reboot; - Above 20% - allowed to continue work. -This setting overrides the install deferral behaviour of [AllowAutoUpdate](#allowautoupdate). +This setting overrides the install deferral behavior of [AllowAutoUpdate](#allowautoupdate). These settings are designed for education devices that remain in carts overnight that are left in sleep mode. It is not designed for 1:1 devices. @@ -4311,7 +4311,7 @@ Enable this policy to control the timing before transitioning from Auto restarts You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. -You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. +You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period. If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. @@ -4381,7 +4381,7 @@ Enable this policy to control the timing before transitioning from Auto restarts You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. -You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. +You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period. If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. @@ -4451,7 +4451,7 @@ Enable this policy to control the timing before transitioning from Auto restarts You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. -You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. +You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period. If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. @@ -4521,7 +4521,7 @@ Enable this policy to control the timing before transitioning from Auto restarts You can specify the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. -You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. +You can specify the deadline in days before automatically scheduling and executing a pending restart regardless of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed, within the specified period. If you do not specify a deadline or if the deadline is set to 0, the PC won't automatically restart and will require the person to schedule it prior to restart. From d89a43bec67c1a65833d2b79b24b1672255a281f Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 24 Apr 2023 10:26:05 -0700 Subject: [PATCH 133/139] Update windows/deployment/do/includes/waas-delivery-optimization-monitor.md --- .../do/includes/waas-delivery-optimization-monitor.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md index 55f373f373..faf96a6339 100644 --- a/windows/deployment/do/includes/waas-delivery-optimization-monitor.md +++ b/windows/deployment/do/includes/waas-delivery-optimization-monitor.md @@ -28,7 +28,7 @@ ms.localizationpriority: medium | TotalBytesDownloaded | The number of bytes from any source downloaded so far | | PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP | | BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) | -| BytesfromHTTP | Total number of bytes received over HTTP. This metric represents all HTTP sources, which include BytesFromCacheServer | +| BytesfromHTTP | Total number of bytes received over HTTP. This metric represents all HTTP sources, which includes BytesFromCacheServer | | Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but isn't uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | | Priority | Priority of the download; values are **foreground** or **background** | | BytesFromCacheServer | Total number of bytes received from cache server (MCC) | From f1253599e627677d1105805e8240d23ddce5cc9c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 24 Apr 2023 10:56:40 -0700 Subject: [PATCH 134/139] Resolves https://github.com/MicrosoftDocs/windows-itpro-docs/issues/11478 --- .../update/wufb-reports-schema-ucclientupdatestatus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md index 12318c9c53..c779ba83e4 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md @@ -6,7 +6,7 @@ ms.prod: windows-client author: mestew ms.author: mstewart ms.topic: reference -ms.date: 06/06/2022 +ms.date: 04/24/2023 ms.technology: itpro-updates --- @@ -37,7 +37,7 @@ Update Event that combines the latest client-based data with the latest service- | **SourceSystem** | [string](/azure/kusto/query/scalar-data-types/string)| `Azure`| | | **TargetBuild** | [string](/azure/kusto/query/scalar-data-types/string) | `10.0.18363.836` | The full build of the content this DeviceUpdateEvent is tracking. For Windows 10 updates, this value would correspond to the full build (10.0.14393.385). | | **TargetBuildNumber** | [int](/azure/kusto/query/scalar-data-types/int) | `18363` | Integer of the Major portion of Build. | -| **TargetKBNumber** | [int](/azure/kusto/query/scalar-data-types/int) | `4524570` | KB Article. | +| **TargetKBNumber** | [string](/azure/kusto/query/scalar-data-types/string) | `KB4524570` | KB Article. | | **TargetRevisionNumber** | [int](/azure/kusto/query/scalar-data-types/int) | `836` | Integer or the minor (or revision) portion of the build. | | **TargetVersion** | [int](/azure/kusto/query/scalar-data-types/int) | `1909` | The target operating system version, such as 1909. | | **TimeGenerated** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The time the snapshot generated this specific record. This is to determine to which batch snapshot this record belongs. | From 6767705c3a9d79c18183696ae05f95097039ab4a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 24 Apr 2023 11:45:25 -0700 Subject: [PATCH 135/139] Resolves https://github.com/MicrosoftDocs/windows-itpro-docs/issues/11478 --- .../update/wufb-reports-schema-ucclientupdatestatus.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md index c779ba83e4..34cab456db 100644 --- a/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucclientupdatestatus.md @@ -50,3 +50,4 @@ Update Event that combines the latest client-based data with the latest service- | **UpdateManufacturer** | [string](/azure/kusto/query/scalar-data-types/string) | `Microsoft` | Manufacturer of update. Microsoft for feature or quality updates, for drivers the name of driver manufacturer. | | **UpdateReleaseTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The release date of the update | | **UpdateSource** | [string](/azure/kusto/query/scalar-data-types/string) | `UUP` | The source of the update such as UUP, MUv6, Media | + \ No newline at end of file From 7fd48a7e176b3737f5116382b6163296195178fb Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Mon, 24 Apr 2023 12:24:37 -0700 Subject: [PATCH 136/139] Updated LTSC note --- .../deploy/windows-autopatch-register-devices.md | 6 +++--- .../windows-autopatch-windows-quality-update-overview.md | 6 +++--- .../prepare/windows-autopatch-prerequisites.md | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md index fcc1e157cf..209062f4b0 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md @@ -1,7 +1,7 @@ --- title: Register your devices description: This article details how to register devices in Autopatch -ms.date: 02/03/2023 +ms.date: 04/24/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to @@ -83,8 +83,8 @@ To be eligible for Windows Autopatch management, devices must meet a minimum set > [!NOTE] > Windows Autopatch doesn't support device emulators that don't generate the serial number, model and manufacturer information. Devices that use a non-supported device emulator fail the **Intune or Cloud-Attached** prerequisite check. Additionally, devices with duplicated serial numbers will fail to register with Windows Autopatch. -> [!NOTE] -> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Additionally, Windows Autopatch can only manage Windows quality updates for devices that haven't reached the LTSC's [end of servicing date](/windows/release-health/release-information#enterprise-and-iot-enterprise-ltsbltsc-editions). +> [!IMPORTANT] +> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC. For more information, see [Windows Autopatch Prerequisites](../prepare/windows-autopatch-prerequisites.md). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md index 974c419ebd..943537d1bc 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-quality-update-overview.md @@ -1,7 +1,7 @@ --- title: Windows quality updates description: This article explains how Windows quality updates are managed in Autopatch -ms.date: 02/17/2023 +ms.date: 04/24/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -33,8 +33,8 @@ For a device to be eligible for Windows quality updates as a part of Windows Aut | Mobile device management (MDM) policy conflict | Devices must not have deployed any policies that would prevent device management. For more information, see [Conflicting and unsupported policies](../references/windows-autopatch-windows-update-unsupported-policies.md). | | Group policy conflict | Devices must not have group policies deployed which would prevent device management. For more information, see [Group policy](../references/windows-autopatch-windows-update-unsupported-policies.md#group-policy-and-other-policy-managers) | -> [!NOTE] -> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Additionally, Windows Autopatch can only manage Windows quality updates for devices that haven't reached the LTSC's [end of servicing date](/windows/release-health/release-information#enterprise-and-iot-enterprise-ltsbltsc-editions). +> [!IMPORTANT] +> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC. ## Windows quality update releases diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index c2f86d2ca3..5946fa7bd6 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -1,7 +1,7 @@ --- title: Prerequisites description: This article details the prerequisites needed for Windows Autopatch -ms.date: 02/17/2023 +ms.date: 04/24/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -50,8 +50,8 @@ The following Windows OS 10 editions, 1809+ builds and architecture are supporte - Windows 10 (1809+)/11 Enterprise - Windows 10 (1809+)/11 Pro for Workstations -> [!NOTE] -> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Additionally, Windows Autopatch can only manage Windows quality updates for devices that haven't reached the LTSC's [end of servicing date](/windows/release-health/release-information#enterprise-and-iot-enterprise-ltsbltsc-editions). +> [!IMPORTANT] +> Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC. ## Configuration Manager co-management requirements From 001afa4d7f51e2a06ee3a2b5e12d7a9ed2c00943 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 24 Apr 2023 18:51:48 -0400 Subject: [PATCH 137/139] update to error codes --- .../hello-errors-during-pin-creation.md | 31 +++++++------------ 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 23537daa14..e63b129275 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -2,7 +2,7 @@ title: Windows Hello errors during PIN creation description: When you set up Windows Hello, you may get an error during the Create a work PIN step. ms.topic: troubleshooting -ms.date: 03/31/2023 +ms.date: 04/24/2023 --- # Windows Hello errors during PIN creation @@ -22,7 +22,7 @@ When a user encounters an error when creating the work PIN, advise the user to t 1. Try to create the PIN again. Some errors are transient and resolve themselves. 2. Sign out, sign in, and try to create the PIN again. 3. Reboot the device and then try to create the PIN again. -4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a device, go to **Settings** > **System** > **About** > select **Disconnect from organization**. +4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a device, go to **Settings > System > About > Disconnect from organization**. If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. @@ -31,21 +31,21 @@ If the error occurs again, check the error code against the following table to s | 0x80090005 | NTE\_BAD\_DATA | Unjoin the device from Azure AD and rejoin. | | 0x8009000F | The container or key already exists. | Unjoin the device from Azure AD and rejoin. | | 0x80090011 | The container or key was not found. | Unjoin the device from Azure AD and rejoin. | -| 0x80090029 | TPM is not set up. | Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. | +| 0x80090029 | TPM is not set up. | Sign on with an administrator account. Select **Start**, type `tpm.msc`, and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. | | 0x8009002A | NTE\_NO\_MEMORY | Close programs which are taking up memory and try again. | | 0x80090031 | NTE\_AUTHENTICATION\_IGNORED | Reboot the device. If the error occurs again after rebooting, [reset the TPM](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd851452(v=ws.11)) or run [Clear-TPM](/powershell/module/trustedplatformmodule/clear-tpm). | | 0x80090035 | Policy requires TPM and the device does not have TPM. | Change the Windows Hello for Business policy to not require a TPM. | | 0x80090036 | User canceled an interactive dialog. | User will be asked to try again. | | 0x801C0003 | User is not authorized to enroll. | Check if the user has permission to perform the operation​. | -| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](/azure/active-directory/devices/device-management-azure-portal). | +| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](/azure/active-directory/devices/device-management-azure-portal). | | 0x801C000F | Operation successful, but the device requires a reboot. | Reboot the device. | | 0x801C0010 | The AIK certificate is not valid or trusted. | Sign out and then sign in again. | | 0x801C0011 | The attestation statement of the transport key is invalid. | Sign out and then sign in again. | | 0x801C0012 | Discovery request is not in a valid format. | Sign out and then sign in again. | -| 0x801C0015 | The device is required to be joined to an Active Directory domain. | ​Join the device to an Active Directory domain. | -| 0x801C0016 | The federation provider configuration is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file is not empty. | -| 0x801C0017 | ​The federation provider domain is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element is not empty. | -| 0x801C0018 | The federation provider client configuration URL is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL. | +| 0x801C0015 | The device is required to be joined to an Active Directory domain. | Join the device to an Active Directory domain. | +| 0x801C0016 | The federation provider configuration is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file is not empty. | +| 0x801C0017 | The federation provider domain is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element is not empty. | +| 0x801C0018 | The federation provider client configuration URL is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL. | | 0x801C03E9 | Server response message is invalid | Sign out and then sign in again. | | 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. | | 0x801C03EB | Server response http status is not valid | Sign out and then sign in again. | @@ -53,10 +53,11 @@ If the error occurs again, check the error code against the following table to s | 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.

    -or-

    Token was not found in the Authorization header.

    -or-

    Failed to read one or more objects.

    -or-

    The request sent to the server was invalid.

    -or-

    User does not have permissions to join to Azure AD. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure AD and rejoin.
    Allow user(s) to join to Azure AD under Azure AD Device settings. | 0x801C03EE | Attestation failed. | Sign out and then sign in again. | | 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | -| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in Azure Active Directory and the Primary SMTP address are the same in the proxy address. +| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in Azure Active Directory and the Primary SMTP address are the same in the proxy address. | 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. | | | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. | | 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. | +| 0x801C0451 | User token switch account. | Delete the Web Account Manager token broker files located in `%LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts\*.*\` and reboot.| | 0xC00000BB | Your PIN or this option is temporarily unavailable. | The destination domain controller doesn't support the login method. Most often the KDC service doesn't have the proper certificate to support the login. Another common cause can be the client cannot verify the KDC certificate CRL. Use a different login method.| ## Errors with unknown mitigation @@ -72,7 +73,7 @@ For errors listed in this table, contact Microsoft Support for assistance. | 0x80090020 | NTE\_FAIL | | 0x80090027 | Caller provided a wrong parameter. If third-party code receives this error, they must change their code. | | 0x8009002D | NTE\_INTERNAL\_ERROR | -| 0x801C0001 | ​ADRS server response is not in a valid format. | +| 0x801C0001 | ADRS server response is not in a valid format. | | 0x801C0002 | Server failed to authenticate the user. | | 0x801C0006 | Unhandled exception from server. | | 0x801C000B | Redirection is needed and redirected location is not a well known server. | @@ -88,13 +89,3 @@ For errors listed in this table, contact Microsoft Support for assistance. | 0x801c004D | DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to find the default WAM account to use to request Azure Active Directory token for provisioning. Unable to enroll a device to use a PIN for login. | | 0xCAA30193 | HTTP 403 Request Forbidden: it means request left the device, however either Server, proxy or firewall generated this response. | -## Related topics - -- [Windows Hello for Business](hello-identity-verification.md) -- [How Windows Hello for Business works](hello-how-it-works.md) -- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) -- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) -- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) -- [Windows Hello and password changes](hello-and-password-changes.md) -- [Event ID 300 - Windows Hello successfully created](/troubleshoot/windows-client/user-profiles-and-logon/event-id-300-windows-hello-successfully-created-in-windows-10) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) From ed9ac90bbfb32c9777dd24a96d5623a477285fe8 Mon Sep 17 00:00:00 2001 From: Andre Della Monica Date: Mon, 24 Apr 2023 18:19:50 -0500 Subject: [PATCH 138/139] More changes --- .../prepare/windows-autopatch-prerequisites.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index 5946fa7bd6..a6392239f1 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -44,13 +44,16 @@ Windows Autopatch is included with Windows 10/11 Enterprise E3 or higher (user-b | [Windows 10/11 Enterprise E5](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E5 | 488ba24a-39a9-4473-8ee5-19291e71b002 | | [Windows 10/11 Enterprise VDA](/windows/deployment/deploy-enterprise-licenses#virtual-desktop-access-vda) | E3_VDA_only | d13ef257-988a-46f3-8fce-f47484dd4550 | -The following Windows OS 10 editions, 1809+ builds and architecture are supported in Windows Autopatch: +The following Windows 10 editions, build version and architecture are supported to be [registered](windows-autopatch-register-devices) with Windows Autopatch: - Windows 10 (1809+)/11 Pro - Windows 10 (1809+)/11 Enterprise - Windows 10 (1809+)/11 Pro for Workstations > [!IMPORTANT] +> While Windows Autopatch supports registering devices below the [minimum Windows OS version enforced by the service](windows-autopatch-windows-feature-update-overview#enforcing-a-minimum-windows-os-version), once registered, devices are automatically offered with the [minimum windows OS version](windows-autopatch-windows-feature-update-overview#enforcing-a-minimum-windows-os-version) as these devices must be on a [minimum Windows OS currently serviced](https://learn.microsoft.com/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2) by the Windows servicing channels to keep receiving monthly quality updates that are critical to security and the health of the Windows ecosystem. + +> [!NOTE] > Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC. ## Configuration Manager co-management requirements @@ -58,9 +61,9 @@ The following Windows OS 10 editions, 1809+ builds and architecture are supporte Windows Autopatch fully supports co-management. The following co-management requirements apply: - Use a currently supported [Configuration Manager version](/mem/configmgr/core/servers/manage/updates#supported-versions). -- ConfigMgr must be [cloud-attached with Intune (co-management)](/mem/configmgr/cloud-attach/overview) and must have the following co-management workloads enabled: - - Set the [Windows Update policies workload](/mem/configmgr/comanage/workloads#windows-update-policies) to Pilot Intune or Intune. - - Set the [Device configuration workload](/mem/configmgr/comanage/workloads#device-configuration) to Pilot Intune or Intune. - - Set the [Office Click-to-Run apps workload](/mem/configmgr/comanage/workloads#office-click-to-run-apps) to Pilot Intune or Intune. +- Configuration Manager must be [cloud-attached with Intune (co-management)](/mem/configmgr/cloud-attach/overview) and must have the following co-management workloads enabled and set to either **Pilot Intune** or **Intune**: + - [Windows Update policies workload](/mem/configmgr/comanage/workloads#windows-update-policies) + - [Device configuration workload](/mem/configmgr/comanage/workloads#device-configuration) + - [Office Click-to-Run apps workload](/mem/configmgr/comanage/workloads#office-click-to-run-apps) For more information, see [paths to co-management](/mem/configmgr/comanage/quickstart-paths). From c7123a332b23c793a62e4fc437caa63844651179 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Tue, 25 Apr 2023 08:17:36 -0700 Subject: [PATCH 139/139] Update windows-autopatch-prerequisites.md Fixed links, grammar --- .../prepare/windows-autopatch-prerequisites.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index a6392239f1..1808dd285c 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -44,14 +44,14 @@ Windows Autopatch is included with Windows 10/11 Enterprise E3 or higher (user-b | [Windows 10/11 Enterprise E5](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E5 | 488ba24a-39a9-4473-8ee5-19291e71b002 | | [Windows 10/11 Enterprise VDA](/windows/deployment/deploy-enterprise-licenses#virtual-desktop-access-vda) | E3_VDA_only | d13ef257-988a-46f3-8fce-f47484dd4550 | -The following Windows 10 editions, build version and architecture are supported to be [registered](windows-autopatch-register-devices) with Windows Autopatch: +The following Windows 10 editions, build version and architecture are supported to be [registered](../deploy/windows-autopatch-register-devices.md) with Windows Autopatch: - Windows 10 (1809+)/11 Pro - Windows 10 (1809+)/11 Enterprise - Windows 10 (1809+)/11 Pro for Workstations > [!IMPORTANT] -> While Windows Autopatch supports registering devices below the [minimum Windows OS version enforced by the service](windows-autopatch-windows-feature-update-overview#enforcing-a-minimum-windows-os-version), once registered, devices are automatically offered with the [minimum windows OS version](windows-autopatch-windows-feature-update-overview#enforcing-a-minimum-windows-os-version) as these devices must be on a [minimum Windows OS currently serviced](https://learn.microsoft.com/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2) by the Windows servicing channels to keep receiving monthly quality updates that are critical to security and the health of the Windows ecosystem. +> While Windows Autopatch supports registering devices below the [minimum Windows OS version enforced by the service](../operate/windows-autopatch-windows-feature-update-overview.md#enforcing-a-minimum-windows-os-version), once registered, devices are automatically offered with the [minimum windows OS version](../operate/windows-autopatch-windows-feature-update-overview.md#enforcing-a-minimum-windows-os-version). The devices must be on a [minimum Windows OS currently serviced](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2) by the [Windows servicing channels](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2) to keep receiving monthly security updates that are critical to security and the health Windows. > [!NOTE] > Windows Autopatch supports registering [Windows 10 Long-Term Servicing Channel (LTSC)](/windows/whats-new/ltsc/) devices that are being currently serviced by the [Windows LTSC](/windows/release-health/release-information). The service only supports managing the [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md) workload for devices currently serviced by the LTSC. Windows Update for Business service and Windows Autopatch don't offer Windows feature updates for devices that are part of the LTSC. You must either use [LTSC media](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) or the [Configuration Manager Operating System Deployment capabilities to perform an in-place upgrade](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager) for Windows devices that are part of the LTSC.