diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index b0ec9a4b4f..f55624a429 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -23,23 +23,23 @@ ###[What is Enterprise Mode?](ie11-deploy-guide/what-is-enterprise-mode.md) ###[Set up Enterprise Mode logging and data collection](ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md) ###[Turn on Enterprise Mode and use a site list](ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md) -###[Enterprise Mode schema v.2 guidance for Windows 10 devices](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) -###[Enterprise Mode schema v.1 guidance for Windows 7 and Windows 8.1 devices](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) +###[Enterprise Mode schema v.2 guidance](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) +###[Enterprise Mode schema v.1 guidance](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) ###[Check for a new Enterprise Mode site list xml file](ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md) ###[Turn on local control and logging for Enterprise Mode](ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md) -###[Use the Enterprise Mode Site List Manager tool](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) -####[Add sites to the Enterprise Mode site list using the Windows 10 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) -####[Add sites to the Enterprise Mode site list using the Windows 7 and Windows 8.1 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Windows 10 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and Windows 8.1 Enterprise Mode Site List Manager tool](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager tool](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) -####[Fix validation problems using the Enterprise Mode Site List Manager tool](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) -####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Save your site list to XML in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) -####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager tool](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) -####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager tool](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) -####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager tool](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +###[Use the Enterprise Mode Site List Manager](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) +####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) +####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) +####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) +####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) +####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) +####[Fix validation problems using the Enterprise Mode Site List Manager](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) +####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +####[Save your site list to XML in the Enterprise Mode Site List Manager](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) +####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) +####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) +####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) ###[Using IE7 Enterprise Mode or IE8 Enterprise Mode](ie11-deploy-guide/using-enterprise-mode.md) ###[Fix web compatibility issues using document modes and the Enterprise Mode site list](ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) ###[Remove sites from a local Enterprise Mode site list](ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md index 1a51930de6..fdd8ac9361 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md @@ -14,6 +14,8 @@ This topic lists new and updated topics in the Internet Explorer 11 documentatio ## August 2016 |New or changed topic | Description | |----------------------|-------------| +|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | |[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | ## July 2016 diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index 0530962b03..e78df6c4c1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -15,8 +15,9 @@ ms.sitesec: library **Applies to:** -- Windows 8.1 -- Windows 7 +- Windows 10 +- Windows 8.1 +- Windows 7 Use the Enterprise Mode Site List Manager (schema v.1) to create and update your Enterprise Mode site list for devices running the v.1 version of the schema, or the Enterprise Mode Site List Manager (schema v.2) to create and update your Enterprise Mode site list for devices running the v.2 version of the schema. We strongly recommend moving to the new schema, v.2. For more info, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). @@ -86,7 +87,19 @@ This table includes the elements used by the Enterprise Mode schema. <emie> <domain>contoso.com</domain> </emie> -</rules>> +</rules> +-or- +
For IPv6 ranges:
<rules version="205"> + <emie> + <domain>[10.122.34.99]:8080</domain> + </emie> + </rules>+-or- +
For IPv4 ranges:
<rules version="205"> + <emie> + <domain>10.122.34.99:8080</domain> + </emie> + </rules>
+</site> +-or- +
For IPv4 ranges:
<site url="10.122.34.99:8080"> + <compat-mode>IE8Enterprise</compat-mode> +<site>
+-or- +
For IPv6 ranges:
<site url="[10.122.34.99]:8080"> + <compat-mode>IE8Enterprise</compat-mode> +<site>
You can also use the self-closing version, <url="contoso.com" />, which also sets:
<site url="contoso.com"> <compat-mode>IE8Enterprise</compat-mode> -</site>
+</site> +-or- +
For IPv4 ranges:
<site url="10.122.34.99:8080"> + <compat-mode>IE8Enterprise</compat-mode> +<site>
+-or- +
For IPv6 ranges:
<site url="[10.122.34.99]:8080"> + <compat-mode>IE8Enterprise</compat-mode> +<site>
Where:
@@ -260,7 +276,6 @@ We recommend that you not add any of the following items to your schema because
- Don’t use protocols. For example, http://, https://, or custom protocols. They break parsing.
- Don’t use wildcards.
-- Don't use IP Addresses.
- Don’t use query strings, ampersands break parsing.
## Related topics
diff --git a/windows/deploy/monitor-activation-client.md b/windows/deploy/monitor-activation-client.md
index 26c8257cc3..5b49e544c2 100644
--- a/windows/deploy/monitor-activation-client.md
+++ b/windows/deploy/monitor-activation-client.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
author: greg-lindsay
+localizationpriority: medium
---
# Monitor activation
diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md
index 9ae5d89ffc..57a7d44fcf 100644
--- a/windows/keep-secure/TOC.md
+++ b/windows/keep-secure/TOC.md
@@ -32,7 +32,6 @@
#### [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md)
#### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md)
### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
-#### [Windows Information Protection (WIP) overview](wip-enterprise-overview.md)
#### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md)
#### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md)
#### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md)
diff --git a/windows/keep-secure/active-directory-security-groups.md b/windows/keep-secure/active-directory-security-groups.md
index 630308945a..0bf7a79a16 100644
--- a/windows/keep-secure/active-directory-security-groups.md
+++ b/windows/keep-secure/active-directory-security-groups.md
@@ -172,10 +172,10 @@ The following tables provide descriptions of the default groups that are located
Default Security Group
+Windows Server 2016
Windows Server 2012 R2
Windows Server 2012
Windows Server 2008 R2
-Windows Server 2008
[Access Control Assistance Operators](#bkmk-acasstops)
Yes
Yes
Yes
[Cloneable Domain Controllers](#bkmk-cloneabledomaincontrollers)
Yes
Yes
Yes
Yes
[Group Policy Creators Owners](#bkmk-gpcreatorsowners)
[Group Policy Creator Owners](#bkmk-gpcreatorsowners)
Yes
Yes
Yes
[Hyper-V Administrators](#bkmk-hypervadministrators)
Yes
Yes
Yes
Yes
[Key Admins](#key-admins)
Yes
[Network Configuration Operators](#bkmk-networkcfgoperators)
Yes
Yes
Yes
Yes
[Performance Log Users](#bkmk-perflogusers)
Yes
Yes
Yes
Yes
[Performance Monitor Users](#bkmk-perfmonitorusers)
Yes
Yes
Yes
Yes
[Pre–Windows 2000 Compatible Access](#bkmk-pre-ws2kcompataccess)
Yes
Yes
Yes
Yes
[Print Operators](#bkmk-printoperators)
Yes
Yes
Yes
Yes
[Protected Users](#bkmk-protectedusers)
Yes
Yes
[RAS and IAS Servers](#bkmk-rasandias)
Yes
Yes
Yes
Yes
[RDS Endpoint Servers](#bkmk-rdsendpointservers)
Yes
Yes
[RDS Management Servers](#bkmk-rdsmanagementservers)
Yes
Yes
[RDS Remote Access Servers](#bkmk-rdsremoteaccessservers)
[RDS Management Servers](#bkmk-rdsmanagementservers)
Yes
Yes
Yes
[RDS Remote Access Servers](#bkmk-rdsremoteaccessservers)
Yes
Yes
Yes
[Read-only Domain Controllers](#bkmk-rodc)
Yes
Yes
Yes
Yes
[Remote Desktop Users](#bkmk-remotedesktopusers)
Yes
Yes
Yes
Yes
[Remote Management Users](#bkmk-remotemanagementusers)
Yes
Yes
Yes
[Replicator](#bkmk-replicator)
Yes
Yes
Yes
Yes
[Schema Admins](#bkmk-schemaadmins)
Yes
Yes
Yes
Yes
[Server Operators](#bkmk-serveroperators)
Yes
Yes
Yes
Yes
[Storage Replica Administrators](#storage-replica-administrators)
Yes
[System Managed Accounts Group](#system-managed-accounts-group)
Yes
[Terminal Server License Servers](#bkmk-terminalserverlic)
Yes
Yes
Yes
Yes
[Users](#bkmk-users)
Yes
Yes
Yes
Yes
[Windows Authorization Access Group](#bkmk-winauthaccess)
Yes
Yes
Yes
Yes
[WinRMRemoteWMIUsers_](#bkmk-winrmremotewmiusers-)
Yes
Yes
Yes
Yes
It's your choice whether you check the box to **Remember the user credentials at each logon**.
- 
+ 
6. You can leave the rest of the default or blank settings, and then click **Save Policy**.
@@ -77,7 +77,7 @@ The final step to making your VPN configuration work with WIP, is to link your t
2. Go to **Windows**, click the **Custom Configuration (Windows 10 Desktop and Mobile and later)**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**.
- 
+ 
3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
@@ -106,6 +106,8 @@ The final step to making your VPN configuration work with WIP, is to link your t
2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**. The added people move to the **Selected Groups** list on the right-hand pane.
+ 
+
3. After you've picked all of the employees and groups that should get the policy, click **OK**. The policy is deployed to the selected users' devices.
diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md
index 4a8a8e9052..0d428ec0a2 100644
--- a/windows/keep-secure/create-wip-policy-using-intune.md
+++ b/windows/keep-secure/create-wip-policy-using-intune.md
@@ -411,12 +411,12 @@ There are no default locations included with WIP, you must add each of your netw
4. Decide if you want to Windows to look for additional network settings:
+ 
+
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network.
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network.
- - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware in the Windows Start menu and on corporate file icons in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files or in the Start menu, on top the tiles for your unenlightened protected apps.
-
5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.

diff --git a/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md b/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md
index 40242549af..a071720d2c 100644
--- a/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md
+++ b/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md
@@ -79,11 +79,6 @@ File rule levels allow administrators to specify the level at which they want to
Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario.
-
-
Table 3. Code integrity policy - file rule levels
| Rule level | Description |
@@ -100,7 +95,7 @@ Table 3. Code integrity policy - file rule levels
| **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. |
| **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. |
-> **Note** When you create code integrity policies with the [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) cmdlet, you can specify a primary file rule level by including the **–Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **–Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate.
+> **Note** When you create code integrity policies with the [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) cmdlet, you can specify a primary file rule level by including the **-Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **-Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate.
## Related topics
diff --git a/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md b/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md
index b2d0ca16e4..82a3908d87 100644
--- a/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md
+++ b/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md
@@ -31,13 +31,13 @@ These applications can increase the risk of your network being infected with mal
Since the stakes are higher in an enterprise environment, the potential disaster and potential productivity and performance disruptions that PUA brings can be a cause of concern. Hence, it is important to deliver trusted protection in this field.
-##Enable PUA protection in SCCM and Intune
+##Enable PUA protection in System Center Configuration Manager and Intune
-The PUA feature is available for enterprise users who are running System Center Configuration Manager (SCCM) or Intune in their infrastructure.
+The PUA feature is available for enterprise users who are running System Center Configuration Manager or Intune in their infrastructure.
-###Configure PUA in SCCM
+###Configure PUA in System Center Configuration Manager
-For SCCM users, PUA is enabled by default. See the following topics for configuration details:
+For System Center Configuration Manager users, PUA is enabled by default. See the following topics for configuration details:
If you are using these versions | See these topics
:---|:---
@@ -45,7 +45,7 @@ System Center Configuration Manager (current branch) version 1606 | [Create a ne
System Center 2012 R2 Endpoint Protection
System Center 2012 Configuration Manager
System Center 2012 Configuration Manager SP1
System Center 2012 Configuration Manager SP2
System Center 2012 R2 Configuration Manager
System Center 2012 Endpoint Protection SP1
System Center 2012 Endpoint Protection
System Center 2012 R2 Configuration Manager SP1| [How to Deploy Potentially Unwanted Application Protection Policy for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508770.aspx#BKMK_PUA)
-###Use PUA audit mode in SCCM
+###Use PUA audit mode in System Center Configuration Manager
You can use PowerShell to detect PUA without blocking them. In fact, you can run audit mode on individual machines. This feature is useful if your company is conducting an internal software security compliance check and you’d like to avoid any false positives.
@@ -59,10 +59,10 @@ You can use PowerShell to detect PUA without blocking them. In fact, you can run
2. Enter the PowerShell command:
```text
- et-mpPreference -puaprotection 2
+ set-mpPreference -puaprotection 2
```
> [!NOTE]
-> PUA events are reported in the Windows Event Viewer and not in SCCM.
+> PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager.
###Configure PUA in Intune
@@ -86,12 +86,12 @@ You can use PowerShell to detect PUA without blocking them. In fact, you can run
2. Enter the PowerShell command:
```text
- et-mpPreference -puaprotection 1
+ set-mpPreference -puaprotection 1
```
##View PUA events
-PUA events are reported in the Windows Event Viewer and not in SCCM or Intune. To view PUA events:
+PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager or Intune. To view PUA events:
1. Open **Event Viewer**.
2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**.
diff --git a/windows/keep-secure/images/intune-add-applocker-xml-file.png b/windows/keep-secure/images/intune-add-applocker-xml-file.png
index 8829c070a6..3ceabfd15a 100644
Binary files a/windows/keep-secure/images/intune-add-applocker-xml-file.png and b/windows/keep-secure/images/intune-add-applocker-xml-file.png differ
diff --git a/windows/keep-secure/images/intune-add-classic-apps.png b/windows/keep-secure/images/intune-add-classic-apps.png
index bf4e5792c1..09bbda3a06 100644
Binary files a/windows/keep-secure/images/intune-add-classic-apps.png and b/windows/keep-secure/images/intune-add-classic-apps.png differ
diff --git a/windows/keep-secure/images/intune-add-uwp-apps.png b/windows/keep-secure/images/intune-add-uwp-apps.png
index 933cd9addf..17a97b8d3a 100644
Binary files a/windows/keep-secure/images/intune-add-uwp-apps.png and b/windows/keep-secure/images/intune-add-uwp-apps.png differ
diff --git a/windows/keep-secure/images/intune-corporate-identity.png b/windows/keep-secure/images/intune-corporate-identity.png
index 4ffb6223ea..808de2db0e 100644
Binary files a/windows/keep-secure/images/intune-corporate-identity.png and b/windows/keep-secure/images/intune-corporate-identity.png differ
diff --git a/windows/keep-secure/images/intune-createnewpolicy.png b/windows/keep-secure/images/intune-createnewpolicy.png
index 26ab066343..3f7b7af6b6 100644
Binary files a/windows/keep-secure/images/intune-createnewpolicy.png and b/windows/keep-secure/images/intune-createnewpolicy.png differ
diff --git a/windows/keep-secure/images/intune-data-recovery.png b/windows/keep-secure/images/intune-data-recovery.png
index 32d7282110..f889dbca48 100644
Binary files a/windows/keep-secure/images/intune-data-recovery.png and b/windows/keep-secure/images/intune-data-recovery.png differ
diff --git a/windows/keep-secure/images/intune-generalinfo.png b/windows/keep-secure/images/intune-generalinfo.png
index c740cad913..70e726d379 100644
Binary files a/windows/keep-secure/images/intune-generalinfo.png and b/windows/keep-secure/images/intune-generalinfo.png differ
diff --git a/windows/keep-secure/images/intune-groupselection.png b/windows/keep-secure/images/intune-groupselection.png
index 992d7a52cf..e48b59aa4b 100644
Binary files a/windows/keep-secure/images/intune-groupselection.png and b/windows/keep-secure/images/intune-groupselection.png differ
diff --git a/windows/keep-secure/images/intune-groupselection_vpnlink.png b/windows/keep-secure/images/intune-groupselection_vpnlink.png
new file mode 100644
index 0000000000..6aa8f89355
Binary files /dev/null and b/windows/keep-secure/images/intune-groupselection_vpnlink.png differ
diff --git a/windows/keep-secure/images/intune-managedeployment.png b/windows/keep-secure/images/intune-managedeployment.png
index 93d37116ef..6786a93416 100644
Binary files a/windows/keep-secure/images/intune-managedeployment.png and b/windows/keep-secure/images/intune-managedeployment.png differ
diff --git a/windows/keep-secure/images/intune-network-detection-boxes.png b/windows/keep-secure/images/intune-network-detection-boxes.png
index 256b586c70..bc801a8521 100644
Binary files a/windows/keep-secure/images/intune-network-detection-boxes.png and b/windows/keep-secure/images/intune-network-detection-boxes.png differ
diff --git a/windows/keep-secure/images/intune-networklocation.png b/windows/keep-secure/images/intune-networklocation.png
index 058aaec38e..64d9ebda26 100644
Binary files a/windows/keep-secure/images/intune-networklocation.png and b/windows/keep-secure/images/intune-networklocation.png differ
diff --git a/windows/keep-secure/images/intune-optional-settings.png b/windows/keep-secure/images/intune-optional-settings.png
index 2d2bf90bb1..3ec8bec32d 100644
Binary files a/windows/keep-secure/images/intune-optional-settings.png and b/windows/keep-secure/images/intune-optional-settings.png differ
diff --git a/windows/keep-secure/images/intune-protection-mode.png b/windows/keep-secure/images/intune-protection-mode.png
index 80804f7946..b3340d6e4f 100644
Binary files a/windows/keep-secure/images/intune-protection-mode.png and b/windows/keep-secure/images/intune-protection-mode.png differ
diff --git a/windows/keep-secure/images/intune-vpn-customconfig.png b/windows/keep-secure/images/intune-vpn-customconfig.png
index 1e1dd0345b..cf9f85181a 100644
Binary files a/windows/keep-secure/images/intune-vpn-customconfig.png and b/windows/keep-secure/images/intune-vpn-customconfig.png differ
diff --git a/windows/keep-secure/images/intune-vpn-edpmodeid.png b/windows/keep-secure/images/intune-vpn-edpmodeid.png
deleted file mode 100644
index 80852af30d..0000000000
Binary files a/windows/keep-secure/images/intune-vpn-edpmodeid.png and /dev/null differ
diff --git a/windows/keep-secure/images/intune-vpn-omaurisettings.png b/windows/keep-secure/images/intune-vpn-omaurisettings.png
index 382301498e..c7016e13c4 100644
Binary files a/windows/keep-secure/images/intune-vpn-omaurisettings.png and b/windows/keep-secure/images/intune-vpn-omaurisettings.png differ
diff --git a/windows/keep-secure/images/intune-vpn-wipmodeid.png b/windows/keep-secure/images/intune-vpn-wipmodeid.png
index 80852af30d..6c45fd0a25 100644
Binary files a/windows/keep-secure/images/intune-vpn-wipmodeid.png and b/windows/keep-secure/images/intune-vpn-wipmodeid.png differ
diff --git a/windows/keep-secure/images/wip-sccm-addapplockerfile.png b/windows/keep-secure/images/wip-sccm-addapplockerfile.png
index b226038405..6cd571b404 100644
Binary files a/windows/keep-secure/images/wip-sccm-addapplockerfile.png and b/windows/keep-secure/images/wip-sccm-addapplockerfile.png differ
diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md
index d7d9eacc65..81fc6fa6e2 100644
--- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md
+++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md
@@ -342,7 +342,6 @@ You’ll need this software to set Windows Hello for Business policies in your e
After you turn off WIP, an attempt is made to decrypt any closed WIP-tagged files on the locally attached drives. | -
**Note**
For more info about setting your WIP-protection modes, see either [Create a Windows Information Protection (WIP) policy using Intune](create-wip-policy-using-intune.md) or [Create and deploy a Windows Information Protection (WIP) policy using Configuration Manager](create-wip-policy-using-sccm.md), depending on your management solution.
+|Off |WIP is turned off and doesn't help to protect or audit your data.
After you turn off WIP, an attempt is made to decrypt any closed WIP-tagged files on the locally attached drives.
**Note**
For more info about setting your WIP-protection modes, see either [Create a Windows Information Protection (WIP) policy using Intune](create-wip-policy-using-intune.md) or [Create and deploy a Windows Information Protection (WIP) policy using Configuration Manager](create-wip-policy-using-sccm.md), depending on your management solution. |
## Why use WIP?
WIP gives you a new way to manage data policy enforcement for apps and documents, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune).
@@ -75,9 +126,13 @@ WIP gives you a new way to manage data policy enforcement for apps and documents
- **Helping prevent accidental data disclosure to removable media.** WIP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t.
-- **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.
**Note**
System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device.
+- **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.
+ > **Note**
System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device.
+
+## Turn off WIP
+You can turn off all Windows Information Protection and restrictions, reverting to where you were pre-WIP, with no data loss. However, turning off WIP isn't recommended. If you choose to turn it off, you can always turn it back on, but WIP won't retain your decryption and policies info.
## Next steps
After deciding to use WIP in your enterprise, you need to:
-- [Create a Windows Information Protection (WIP) policy](overview-create-wip-policy.md)
\ No newline at end of file
+- [Create a Windows Information Protection (WIP) policy](overview-create-wip-policy.md)
diff --git a/windows/keep-secure/testing-scenarios-for-wip.md b/windows/keep-secure/testing-scenarios-for-wip.md
index e74a83cfad..45737291cf 100644
--- a/windows/keep-secure/testing-scenarios-for-wip.md
+++ b/windows/keep-secure/testing-scenarios-for-wip.md
@@ -1,6 +1,6 @@
---
title: Testing scenarios for Windows Information Protection (WIP) (Windows 10)
-description: We've come up with a list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company.
+description: A list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company.
ms.assetid: 53db29d2-d99d-4db6-b494-90e2b3962ca2
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection
ms.prod: w10
@@ -22,16 +22,145 @@ We've come up with a list of suggested testing scenarios that you can use to tes
## Testing scenarios
You can try any of the processes included in these scenarios, but you should focus on the ones that you might encounter in your organization.
-|Scenario |Processes |
-|---------|----------|
-|Automatically encrypt files from enterprise apps |
**Note**
Some file types, like .exe and .dll, along with some file paths, like `%windir%` and `%programfiles%`, are excluded from automatic encryption.
The app shouldn't be able to access the file.
If your default app association is an app not on your allowed apps list, you should get an **Access Denied** error message.
You should see a WIP-related warning box, asking you to click either **Got it** or **Cancel**.
The content isn't pasted into the non-enterprise app.
The content is pasted into the non-enterprise app.
The content should copy and paste between apps without any warning messages.
You should see a WIP-related warning box, asking you to click either **Drag Anyway** or **Cancel**.
The content isn't dropped into the non-enterprise app.
The content is dropped into the non-enterprise app.
The content should move between the apps without any warning messages.
You should see a WIP-related warning box, asking you to click either **Share Anyway** or **Cancel**.
The content isn't shared into Facebook.
The content is shared into Facebook.
The content should share between the apps without any warning messages.
WIP should encrypt the file to your Enterprise Identity.
The file should be decrypted and the **Lock** icon should disappear.
**Note**
Most Windows-signed components like Windows Explorer (when running in the user’s context), should have access to enterprise data.
A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.
Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.
The device should be removed and all of the enterprise content for that managed account should be gone.
**Important**
Unenrolling a device revokes and erases all of the enterprise data for the managed account.
Scenario | +Processes | +
---|---|
Encrypt and decrypt files using File Explorer. | +For desktop: +
+
|
+
Create work documents in enterprise-allowed apps. | +For desktop: +
+
|
+
Block enterprise data from non-enterprise apps. | +
+
|
+
Copy and paste from enterprise apps to non-enterprise apps. | +
+
|
+
Drag and drop from enterprise apps to non-enterprise apps. | +
+
|
+
Share between enterprise apps and non-enterprise apps. | +
+
|
+
Verify that Windows system components can use WIP. | +
+
|
+
Use WIP on NTFS, FAT, and exFAT systems. | +
+
|
+
Verify your shared files can use WIP. | +
+
|
+
Verify your cloud resources can use WIP. | +
+
|
+
Verify your Virtual Private Network (VPN) can be auto-triggered. | +
+
|
+
Unenroll client devices from WIP. | +
+
|
+
Verify that app content is protected when a Windows 10 Mobile phone is locked. | +
+
|
+
[How to Load the PowerShell Cmdlets and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)
[How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)
Describes how to install the Windows PowerShell cmdlets and find cmdlet help and examples.
[How to Manage App-V Packages Running on a Stand-Alone Computer by Using PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)
[How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)
Describes how to manage the client package lifecycle on a stand-alone computer by using Windows PowerShell.
[How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)
[How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)
Describes how to manage connection groups by using Windows PowerShell.
Describes how to modify the client by using Windows PowerShell.
[How to Apply the User Configuration File by Using PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)
[How to Apply the User Configuration File by Using Windows PowerShell](appv-apply-the-user-configuration-file-with-powershell.md)
Describes how to apply a user configuration file by using Windows PowerShell.
[How to Apply the Deployment Configuration File by Using PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)
[How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)
Describes how to apply a deployment configuration file by using Windows PowerShell.
[How to Sequence a Package by Using PowerShell](appv-sequence-a-package-with-powershell.md)
[How to Sequence a Package by Using Windows PowerShell](appv-sequence-a-package-with-powershell.md)
Describes how to create a new package by using Windows PowerShell.
[How to Create a Package Accelerator by Using PowerShell](appv-create-a-package-accelerator-with-powershell.md)
[How to Create a Package Accelerator by Using Windows PowerShell](appv-create-a-package-accelerator-with-powershell.md)
Describes how to create a package accelerator by using Windows PowerShell. You can use package accelerators automatically sequence large, complex applications.
[How to Enable Reporting on the App-V Client by Using PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)
[How to Enable Reporting on the App-V Client by Using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)
Describes how to enable the computer running the App-V to send reporting information.
[How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)
[How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)
Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.
Package name contains $ |
-If a package name contains the character ( $ ), you must use a single-quote ( ‘ ), for example, -Add-AppvClientPackage ‘Contoso$App.appv’ |
+If a package name contains the character ( $ ), you must use a single-quote ( ' ), for example, +Add-AppvClientPackage 'Contoso$App.appv' |
PowerShell cmdlet |
-Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter. + | Windows PowerShell cmdlet |
+Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter. Parameter values:
Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1 |
+
Parameter | -What to change the value to | -||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
SourcePath |
- Point to the Office applications downloaded earlier. |
- ||||||||||||
ProductID |
- Specify the type of licensing, as shown in the following examples: -
|
- ||||||||||||
ExcludeApp (optional) |
- Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath. |
- ||||||||||||
PACKAGEGUID (optional) |
- By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server. -An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users. -
- Note
-
- Even if you use unique package IDs, you can still deploy only one App-V package to a single device. -
-
- |
-
\\server\Office2013
\\server\Office2013
is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
Setup.exe
setup.exe
is the Office Deployment Tool.
/packager
/packager
creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.
\\server\Office2013\Customconfig.xml
\\server\Office2013\Customconfig.xml
passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
\\server\share\Office 2013AppV
\\server\share\Office2013AppV
specifies the location of the newly created Office App-V package.
Enable PowerShell scripting on the App-V clients
Enable Windows PowerShell scripting on the App-V clients
To publish Office 2013 packages, you must run a script.
-Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:
+Package scripts are disabled by default on App-V clients. To enable scripting, run the following Windows PowerShell command:
Set-AppvClientConfiguration –EnablePackageScripts 1
Task | -Details | -||||
---|---|---|---|---|---|
How do I package and publish Visio 2013 and Project 2013 with Office? |
-You must include Visio 2013 and Project 2013 in the same package with Office. -If you aren’t deploying Office, you can create a package that contains Visio and/or Project. |
-||||
How can I deploy Visio 2013 and Project 2013 to specific users? |
-Use one of the following methods: -
|
-
Method | -More resources | -
---|---|
Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter. |
-
|
-
Enable the “Require publish as administrator” Group Policy setting for App-V Clients. |
-[How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md#bkmk-admin-pub-pkg-only-posh) |
-
+
Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.
+For more information, see:
[How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md#bkmk-admin-only-posh-topic-cg)
[How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#bkmk-admins-pub-pkgs).
Enable the “Require publish as administrator” Group Policy setting for App-V Clients.
+For more information, see [How to Publish a Package by Using the Management Console](appv-publish-a-packages-with-the-management-console.md#bkmk-admin-pub-pkg-only-posh)
Format | -Description | -
---|---|
As a downloadable module |
-To download the latest help after downloading the cmdlet module: -
|
-
On TechNet as web pages |
-See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx). |
-
Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345
Disable -AppVClientConnectionGroup
Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345
Disable-AppVClientConnectionGroup
Disable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345
Set-AppvClientConfiguration
–RequirePublishAsAdmin
+-RequirePublishAsAdmin
0 - False
1 - True
Set-AppvClientConfiguration –RequirePublishAsAdmin1
Set-AppvClientConfiguration -RequirePublishAsAdmin 1
[How to Publish a Connection Group](appv-publish-a-connection-group.md) |
Explains how to publish a connection group. |
-
+
[How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md) |
+Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. |
+
[How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md) |
+Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups. |
+
Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).
Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
Configure Preserve User Integrations on Login Registry DWORD.
Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.
Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).
Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
Configure Preserve User Integrations on Login Registry DWORD.
Pre-configure all global-targeted packages for example, Add-AppvClientPackage.
Account for Synchronous Script Execution during Package Lifecycle. |
-If script collateral is embedded in the package, Add (Powershell) may be significantly slower. + | If script collateral is embedded in the package, Add cmdlets may be significantly slower. Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations. |
Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently. |
This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously. |
@@ -681,18 +678,15 @@ For documentation on How to Apply a Dynamic Configuration, see:
- Open AppxManifest.xml and locate the following:
- <appv:Extension Category="AppV.Fonts">
+ ```
+
Value | -Additional details | -
---|---|
ClientVersion |
-If you omit the ClientVersion parameter from the query, the metadata excludes the features that were new in App-V 5.0 SP3. |
-
ClientOS |
-You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query. -If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata. |
-
Version of App-V | -Query syntax | -Parameter descriptions | -Example | -||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
App-V 5.0 SP3 and App-V |
-
|
-
- To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet. |
-
In the example: -
|
-||||||||||
App-V 5.0 through App-V 5.0 SP2 |
-
-Note
-
-ClientVersion and ClientOS are supported only in App-V 5.0 SP3 and App-V. -
-
- |
-See the information for App-V 5.0 SP3 and App-V. |
-
In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services. |
-
WindowsServer_6.2_x86 |
||
Windows 7 |
-64-bit |
-WindowsClient_6.1_x64 |
-
Windows 7 |
-32-bit |
-WindowsClient_6.1_x86 |
-
Windows Server 2008 R2 |
64-bit |
WindowsServer_6.1_x64 |
@@ -230,36 +150,11 @@ In your publishing metadata query, enter the string values that correspond to th
Store for Business has thousands of apps from many different categories.
[Acquire apps in the Windows Store for Business](acquire-apps-windows-store-for-business.md)
You can acquire apps from the Windows Store for Business for your employees.
[Working with line-of-business apps](working-with-line-of-business-apps.md)
Your company can make line-of-business (LOB) applications available through Store for Business. These apps are custom to your company – they might be internal business apps, or apps specific to your business or industry.
Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.) -20 Roszel Road -Princeton, NJ 08540 |
-- |
Telephone number from within the United States: |
-(800) 221-4792 |
-
Telephone number from outside the United States and Canada: |
-(609) 452-0606 |
-
Fax: |
-(609) 987-8116 |
-
[http://www.learningally.org/](http://go.microsoft.com/fwlink/p/?linkid=239) |
-Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here. |
-
Windows Logon
Application and Windows settings are imported to the local cache from the settings storage location.
[Asynchronous Windows settings](http://technet.microsoft.com/library/dn458932.aspx#autosyncsettings2) are applied.
[Asynchronous Windows settings](uev-prepare-for-deployment.md#windows-settings-synchronized-by-default) are applied.
Synchronous Windows settings will be applied during the next Windows logon.
Application settings will be applied when the application starts.
Asynchronous Windows settings are applied directly.
Application settings are applied when the application starts.
Both asynchronous and synchronous Windows settings are applied during the next Windows logon.
Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](http://technet.microsoft.com/library/dn458944.aspx) for more information.
Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](uev-changing-the-frequency-of-scheduled-tasks.md#monitor-application-settings) for more information.
NA