diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 1ca366ecf5..d0dbb126b7 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -20,7 +20,7 @@ In Windows 10, version 1803, you can configure your HoloLens devices to run as m When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the bloom gesture and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. The following table lists the device capabilities in the different kiosk modes. diff --git a/devices/hololens/hololens-offline.md b/devices/hololens/hololens-offline.md index 6ee4fb35c1..4c468667f9 100644 --- a/devices/hololens/hololens-offline.md +++ b/devices/hololens/hololens-offline.md @@ -1,5 +1,5 @@ --- -title: Use HoloLens offline +title: Manage connection endpoints for HoloLens description: To set up HoloLens, you'll need to connect to a Wi-Fi network keywords: hololens, offline, OOBE audience: ITPro @@ -17,13 +17,11 @@ appliesto: - HoloLens 2 --- -# Use HoloLens offline - -HoloLens support a limited set of offline experiences for connectivity conscious customers and for customers who have environmental limits on connectivity. +Some HoloLens components, apps, and related services transfer data to Microsoft network endpoints. This article lists different endpoints and URLs that need to be whitelisted in your network configuratiion (e.g. proxy or firewall) for those components to be functional. ## Near-offline setup -HoloLens need a network connection to go through initial device set up. If your corporate network has network restrictions, the following URLs will need to be available: +HoloLens supports a limited set of offline experiences for customers who have network environment restrictions. However, HoloLens needs network connection to go through initial device set up and the following URLs have to be enabled: | Purpose | URL | |------|------| @@ -35,9 +33,125 @@ HoloLens need a network connection to go through initial device set up. If your | MSA | https://login.live.com/ppsecure/inlineconnect.srf?id=80600 | | MSA Pin | https://account.live.com/msangc?fl=enroll | -Additional references: +## Endpoint configuration + +In addition to the list above, to take full advantage of HoloLens functionality, the following endpoints need to be enabled in your network configuration. + + +| Purpose | URL | +|------|------| +| Azure | wd-prod-fe.cloudapp.azure.com | | | +| | ris-prod-atm.trafficmanager.net | | | | +| | validation-v2.sls.trafficmanager.net | | | | +| Azure AD Multi-Factor Authentication | https://secure.aadcdn.microsoftonline-p.com | | | | +| Intune and MDM Configurations | activation-v2.sls.microsoft.com/* | | | | +| | cdn.onenote.net | | | | +| | client.wns.windows.com | | | | +| | crl.microsoft.com/pki/crl/* | | | | +| | ctldl.windowsupdate.com | | | | +| | *displaycatalog.mp.microsoft.com | | | | +| | dm3p.wns.windows.com | | | | +| | *microsoft.com/pkiops/* | | | | +| | ocsp.digicert.com/* | | | | +| | r.manage.microsoft.com | | | | +| | tile-service.weather.microsoft.com | | | | +| | settings-win.data.microsoft.com | | | | +| Certificates | activation-v2.sls.microsoft.com/* | | | | +| | crl.microsoft.com/pki/crl/* | | | | +| | ocsp.digicert.com/* | | | | +| | www.microsoft.com/pkiops/* | | | | +| Cortana and Search | store-images.*microsoft.com | | | | +| | www.bing.com/client | | | | +| | www.bing.com | | | | +| | www.bing.com/proactive | | | | +| | www.bing.com/threshold/xls.aspx | | | | +| | exo-ring.msedge.net | | | | +| | fp.msedge.net | | | | +| | fp-vp.azureedge.net | | | | +| | odinvzc.azureedge.net | | | | +| | spo-ring.msedge.net | | | | +| Device Authentication | login.live.com* | | | | +| Device metadata | dmd.metaservices.microsoft.com | | | | +| Location | inference.location.live.net | | | | +| | location-inference-westus.cloudapp.net | | | | +| Diagnostic Data | v10.events.data.microsoft.com | | | | +| | v10.vortex-win.data.microsoft.com/collect/v1 | | | | +| | www.microsoft.com | | | | +| | co4.telecommand.telemetry.microsoft.com | | | | +| | cs11.wpc.v0cdn.net | | | | +| | cs1137.wpc.gammacdn.net | | | | +| | modern.watson.data.microsoft.com* | | | | +| | watson.telemetry.microsoft.com | | | | +| Licensing | licensing.mp.microsoft.com | | | | +| Microsoft Account | login.msa.akadns6.net | | | | +| | us.configsvc1.live.com.akadns.net | | | | +| Microsoft Edge | iecvlist.microsoft.com | | | | +| Microsoft forward link redirection service (FWLink) | go.microsoft.com | | | | +| Microsoft Store | *.wns.windows.com | | | | +| | storecatalogrevocation.storequality.microsoft.com | | | | +| | img-prod-cms-rt-microsoft-com* | | | | +| | store-images.microsoft.com | | | | +| | .md.mp.microsoft.com | | | +| | *displaycatalog.mp.microsoft.com | | | | +| | pti.store.microsoft.com | | | | +| | storeedgefd.dsx.mp.microsoft.com | | | | +| | markets.books.microsoft.com | | | | +| | share.microsoft.com | | | | +| Network Connection Status Indicator (NCSI) | www.msftconnecttest.com* | | | | +| Office | *.c-msedge.net | | | | +| | *.e-msedge.net | | | | +| | *.s-msedge.net | | | | +| | nexusrules.officeapps.live.com | | | | +| | ocos-office365-s2s.msedge.net | | | | +| | officeclient.microsoft.com | | | | +| | outlook.office365.com | | | | +| | client-office365-tas.msedge.net | | | | +| | www.office.com | | | | +| | onecollector.cloudapp.aria | | | | +| | v10.events.data.microsoft.com/onecollector/1.0/ | | | | +| | self.events.data.microsoft.com | | | | +| | to-do.microsoft.com | | | | +| OneDrive | g.live.com/1rewlive5skydrive/* | | | | +| | msagfx.live.com | | | | +| | oneclient.sfx.ms | | | | +| Photos App | evoke-windowsservices-tas.msedge.net | | | | +| Settings | cy2.settings.data.microsoft.com.akadns.net | | | | +| | settings.data.microsoft.com | | | | +| | settings-win.data.microsoft.com | | | | +| Windows Defender | wdcp.microsoft.com | | | | +| | definitionupdates.microsoft.com | | | | +| | go.microsoft.com | | | | +| | *smartscreen.microsoft.com | | | | +| | smartscreen-sn3p.smartscreen.microsoft.com | | | | +| | unitedstates.smartscreen-prod.microsoft.com | | | | +| Windows Spotlight | *.search.msn.com | | | | +| | arc.msn.com | | | | +| | g.msn.com* | | | | +| | query.prod.cms.rt.microsoft.com | | | | +| | ris.api.iris.microsoft.com | | | | +| Windows Update | *.prod.do.dsp.mp.microsoft.com | | | | +| | cs9.wac.phicdn.net | | | | +| | emdl.ws.microsoft.com | | | | +| | *.dl.delivery.mp.microsoft.com | | | | +| | *.windowsupdate.com | | | | +| | *.delivery.mp.microsoft.com | | | | +| | *.update.microsoft.com | | | | + + + +## References + +> [!NOTE] +> If you are deploying D365 Remote Assist, you will have to enable the endpoints on this [list](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams) +- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) +- [Manage connection endpoints for Windows 10 Enterprise, version 1903](https://docs.microsoft.com/windows/privacy/manage-windows-1903-endpoints) +- [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) +- [Intune network configuration requirements and bandwidth](https://docs.microsoft.com/intune/fundamentals/network-bandwidth-use#network-communication-requirements) +- [Network endpoints for Microsoft Intune](https://docs.microsoft.com/intune/fundamentals/intune-endpoints) +- [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges) +- [Prerequisites for Azure AD Connect](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-install-prerequisites) -- [Technical reference for AAD related IP ranges and URLs](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges) ## HoloLens limitations diff --git a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md index 40a5768d27..0e5600c12c 100644 --- a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md +++ b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md @@ -93,7 +93,7 @@ Internet Connectivity |Device does have Internet connectivity |Device does not h HTTP Version |1.1 |1.0 |If HTTP 1.0 found, it will cause issue with WU and Store | Direct Internet Connectivity |Device has a Proxy configured Device has no Proxy configured |N/A |Informational. Is your device behind a proxy? | Proxy Address | | |If configured, returns proxy address. | -Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated thru the proxy. |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) +Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated through the proxy. |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) Proxy Auth Types | | |If proxy authentication is used, return the Authentication methods advertised by the proxy. | #### Environment diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md index 1abd2b9751..0b9915c4b0 100644 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md @@ -29,10 +29,8 @@ Although the deployment and management of Surface devices is fundamentally the s ## Updating Surface device drivers and firmware - For devices that recieve updates through Windows Update, drivers for Surface components (and even firmware updates) are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS) or Configuration Manager, see [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates/). - > [!NOTE] > Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2. For more information, see [Can't import drivers into Microsoft Endpoint Configuration Manager (KB3025419)](https://support.microsoft.com/kb/3025419). diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md index f280b2ff62..3c05a0d165 100644 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md @@ -33,9 +33,6 @@ The primary concern when selecting an Ethernet adapter is how that adapter will Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](https://www.microsoft.com/surface/accessories/surface-dock) use a chipset that is compatible with the Surface firmware. -> [!NOTE] -> PXE boot is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) - The following Ethernet devices are supported for network boot with Surface devices: - Surface USB-C to Ethernet and USB 3.0 Adapter diff --git a/mdop/agpm/resources-for-agpm.md b/mdop/agpm/resources-for-agpm.md index 3ebc42e3e4..bd2fe5372b 100644 --- a/mdop/agpm/resources-for-agpm.md +++ b/mdop/agpm/resources-for-agpm.md @@ -19,7 +19,7 @@ ms.date: 08/30/2016 ### Documents for download -- [Advanced Group Policy Management 4.0 documents](https://go.microsoft.com/fwlink/?LinkID=158931) +- [Advanced Group Policy Management 4.0 documents](https://www.microsoft.com/download/details.aspx?id=13975) ### Microsoft Desktop Optimization Pack resources diff --git a/mdop/mbam-v25/troubleshooting-mbam-installation.md b/mdop/mbam-v25/troubleshooting-mbam-installation.md index d8e8d0fc89..f2d0494b7f 100644 --- a/mdop/mbam-v25/troubleshooting-mbam-installation.md +++ b/mdop/mbam-v25/troubleshooting-mbam-installation.md @@ -335,7 +335,7 @@ The MBAM agent will be unable to post any updates to the database if connectivit User: SYSTEM Computer: TESTLABS.CONTOSO.COM Description: - An error occured while applying MBAM policies. + An error occurred while applying MBAM policies. Volume ID:\\?\Volume{871c5858-2467-4d0b-8c83-d68af8ce10e5}\ Error code: 0x803D0010 @@ -352,7 +352,7 @@ The MBAM agent will be unable to post any updates to the database if connectivit User: SYSTEM Computer: TESTLABS.CONTOSO.COM Description: - An error occured while applying MBAM policies. + An error occurred while applying MBAM policies. Volume ID:\\?\Volume{871c5858-2467-4d0b-8c83-d68af8ce10e5}\ Error code: 0x803D0006 @@ -420,7 +420,7 @@ The MBAM services may be unable to connect to the database server because of a n Computer: MBAM2-Admin.contoso.com Description: Event code: 100001 - Event message: SQL error occured + Event message: SQL error occurred Event time: 7/11/2013 6:16:34 PM Event time (UTC): 7/11/2013 12:46:34 PM Event ID: 6615fb8eb9d54e778b933d5bb7ca91ed @@ -552,7 +552,7 @@ Review the activity in the service trace log for any error or warning entries. B XXXXXXXXXXX - AddUpdateVolume: While executing sql transaction for add volume to store exception occured Key Recovery Data Store processing error: Violation of UNIQUE KEY constraint 'UniqueRecoveryKeyId'. Cannot insert duplicate key in object 'RecoveryAndHardwareCore.Keys'. The duplicate key value is (8637036e-b379-4798-bd9e-5a0b36296de3). + AddUpdateVolume: While executing sql transaction for add volume to store exception occurred Key Recovery Data Store processing error: Violation of UNIQUE KEY constraint 'UniqueRecoveryKeyId'. Cannot insert duplicate key in object 'RecoveryAndHardwareCore.Keys'. The duplicate key value is (8637036e-b379-4798-bd9e-5a0b36296de3). diff --git a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md index 665b8f08a0..d501b3826f 100644 --- a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md +++ b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md @@ -81,7 +81,7 @@ When you install updates to Windows XP, make sure that you remain on the version Although it is optional, we recommend that you install the following update for [hotfix KB972435](https://go.microsoft.com/fwlink/?LinkId=201077) (https://go.microsoft.com/fwlink/?LinkId=201077). This update increases the performance of shared folders in a Terminal Services session: **Note**   -The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. +The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md index 06b7cfbe45..e2ebe0a01f 100644 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md +++ b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md @@ -29,7 +29,7 @@ If you are using System Center Configuration Manager 2007 SP2 and your MED-V wor The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client. -The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. +The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. diff --git a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md index 0ec14a0a96..5dfe7451d7 100644 --- a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md +++ b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md @@ -29,7 +29,7 @@ If you are using System Center Configuration Manager 2007 SP2 and your MED-V wor The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client. -The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. +The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index c4591652a5..8bedac1205 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1806,7 +1806,7 @@ The content below are the latest versions of the DDF files: 4 - This node is used for setting or getting the block size (in Kilobytes) for the download of assoicated log file. The value range is 1~16. Default value is 4. + This node is used for setting or getting the block size (in Kilobytes) for the download of associated log file. The value range is 1~16. Default value is 4. diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index c93fe4da96..15b21d0197 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -957,7 +957,7 @@ The XML below is for Windows 10, version 1803. - Number of days after last sucessful sync to unenroll + Number of days after last successful sync to unenroll diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index 1fe417dd0f..ab13935f66 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -89,7 +89,7 @@ The following diagram shows the EnterpriseAppVManagement configuration service p - SYNC\_ERR\_PUBLISH\_GROUP_PACKAGES (3) - Publish group packages failed during publish. - SYNC\_ERR\_UNPUBLISH_PACKAGES (4) - Unpublish packages failed during publish. - SYNC\_ERR\_NEW_POLICY_WRITE (5) - New policy write failed during publish. -- SYNC\_ERR\_MULTIPLE\_DURING_PUBLISH (6) - Multiple non-fatal errors occured during publish. +- SYNC\_ERR\_MULTIPLE\_DURING_PUBLISH (6) - Multiple non-fatal errors occurred during publish.

Value type is string. Supported operation is Get.

diff --git a/windows/configuration/wcd/wcd-calling.md b/windows/configuration/wcd/wcd-calling.md index 186d34e8ec..ea77470ed5 100644 --- a/windows/configuration/wcd/wcd-calling.md +++ b/windows/configuration/wcd/wcd-calling.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: dansimp -ms.localizationpriority: medium +ms.localizationpriority: medium ms.author: dansimp ms.topic: article ms.date: 04/30/2018 @@ -57,7 +57,7 @@ See [Dialer codes to launch diagnostic applications](https://docs.microsoft.com/ ## PerSimSettings -Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, select **Add**, and then configure the folowing settings. +Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, select **Add**, and then configure the following settings. ### Critical diff --git a/windows/configuration/wcd/wcd-messaging.md b/windows/configuration/wcd/wcd-messaging.md index 67158a5f0c..f556155dc7 100644 --- a/windows/configuration/wcd/wcd-messaging.md +++ b/windows/configuration/wcd/wcd-messaging.md @@ -81,7 +81,7 @@ SyncSender | Specify a value for SyncSender that is greater than 3 characters bu ## PerSimSettings -Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, click **Add**, and then configure the folowing settings. +Use to configure settings for each subscriber identification module (SIM) card. Enter the Integrated Circuit Card Identifier (ICCID) for the SIM card, click **Add**, and then configure the following settings. ### AllowMmsIfDataIsOff diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 61db3462a7..14223dbdc3 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -272,7 +272,7 @@ For clients that should have their feature updates approved as soon as they’re Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. > [!WARNING] -> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actualy want--which can be a problem when the download sizes are very large. +> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actually want--which can be a problem when the download sizes are very large. ## Manually approve and deploy feature updates diff --git a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md index 2a7e01c1d8..ee85dd816a 100644 --- a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -11,7 +11,8 @@ ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.pagetype: mdt -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.topic: article --- @@ -24,7 +25,7 @@ The simplest path to upgrade PCs that are currently running Windows 7, Windows ## Proof-of-concept environment -For the purposes of this topic, we will use four machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). +For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). ![fig 1](../images/upgrademdt-fig1-machines.png) diff --git a/windows/deployment/volume-activation/vamt-requirements.md b/windows/deployment/volume-activation/vamt-requirements.md index 264ebca94c..e9c0da934f 100644 --- a/windows/deployment/volume-activation/vamt-requirements.md +++ b/windows/deployment/volume-activation/vamt-requirements.md @@ -31,17 +31,16 @@ The Volume Activation Management Tool (VAMT) can be used to perform activations The following table lists the system requirements for the VAMT host computer. -|Item |Minimum system requirement | -|-----|---------------------------| -|Computer and Processor |1 GHz x86 or x64 processor | -|Memory |1 GB RAM for x86 or 2 GB RAM for x64 | -|Hard Disk |16 GB available hard disk space for x86 or 20 GB for x64 | -|External Drive|Removable media (Optional) | -|Display |1024x768 or higher resolution monitor | -|Network |Connectivity to remote computers via Windows® Management Instrumentation (TCP/IP) and Microsoft® Activation Web Service on the Internet via HTTPS | -|Operating System |Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, or Windows Server 2012. | -|Additional Requirements |
  • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
  • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server® 2012, PowerShell is included in the installation. For previous versions of Windows and -Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
  • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
| +| Item | Minimum system requirement | +| ---- | ---------------------------| +| Computer and Processor | 1 GHz x86 or x64 processor | +| Memory | 1 GB RAM for x86 or 2 GB RAM for x64 | +| Hard Disk | 16 GB available hard disk space for x86 or 20 GB for x64 | +| External Drive | Removable media (Optional) | +| Display | 1024x768 or higher resolution monitor | +| Network | Connectivity to remote computers via Windows Management Instrumentation (TCP/IP) and Microsoft Activation Web Service on the Internet via HTTPS | +| Operating System | Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, or later. | +| Additional Requirements |
  • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
  • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012, PowerShell is included in the installation. For previous versions of Windows and Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
  • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
| ## Related topics - [Install and Configure VAMT](install-configure-vamt.md) diff --git a/windows/deployment/windows-autopilot/existing-devices.md b/windows/deployment/windows-autopilot/existing-devices.md index ad9577ade4..81cc5bf9a7 100644 --- a/windows/deployment/windows-autopilot/existing-devices.md +++ b/windows/deployment/windows-autopilot/existing-devices.md @@ -215,7 +215,7 @@ See the following examples. - Click **Next**. >[!NOTE] - >The Autopilot for existing devices task sequence will result in an Azure Active Directory Domain (AAD) joined device. The User State Migration Toolkit (USMT) does not support AAD joined or hybrid AAD joined devices. + >Because the Autopilot for existing devices task sequence completes while in Windows PE, User State Migration Toolkit (USMT) data migration is not supported as there is no way to restore the user state into the new OS. Also, the User State Migration Toolkit (USMT) does not support Azure AD-joined devices. 7. On the Include Updates page, choose one of the three available options. This selection is optional. 8. On the Install applications page, add applications if desired. This is optional. diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index b93eba2709..338d548271 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -121,8 +121,11 @@ Specific scenarios will then have additional requirements. Generally, there are See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details. For a walkthrough for some of these and related steps, see this video: -
 
- + +
+ + + There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications). diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 50958f0314..c712073a39 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -334,7 +334,7 @@ A strong password is assigned to the KRBTGT and trust accounts automatically. Li Resetting the password requires you either to be a member of the Domain Admins group, or to have been delegated with the appropriate authority. In addition, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority. -After you reset the KRBTGT password, ensure that event ID 6 in the (Kerberos) Key-Distribution-Center event source is written to the System event log. +After you reset the KRBTGT password, ensure that event ID 9 in the (Kerberos) Key-Distribution-Center event source is written to the System event log. ### Security considerations diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 68102f6e49..d0124ff8cf 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -78,9 +78,6 @@ Applications may cause performance issues when they attempt to hook the isolated Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard. -See this video: [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) - - ## Security considerations All computers that meet baseline protections for hardware, firmware, and software can use Windows Defender Credential Guard. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index 41d11386b2..bbe8176263 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -55,6 +55,9 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. 8. Close the console. +>[!NOTE] +>Don't confuse the **Request hash** algorithm with the hash argorithm of the certificate. + #### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md index 5b2d65942a..116ddd8e14 100644 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md @@ -47,7 +47,7 @@ Microsoft information protection technologies include: ## How WIP protects sensitivity labels with endpoint data loss prevention You can create and manage [sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) in the Microsoft 365 compliance center. -When you create a sensitivity label, you can specify that endpoint data loss prevention applies to content with that label. +When you [create a sensitivity label](https://docs.microsoft.com/microsoft-365/compliance/create-sensitivity-labels), you can specify that endpoint data loss prevention applies to content with that label. ![Endpoint data loss prevention](images/sensitivity-label-endpoint-dlp.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md index 511c7973f6..e6e2a56c92 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md @@ -101,11 +101,13 @@ Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](htt * **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log * **Disable (Default)** - The Controlled folder access feature will not work. All apps can make changes to files in protected folders. * **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. + * **Block disk modification only** - Attempts by untrusted apps to write to disk sectors will be logged in Windows Event log. These logs can be found in **Applications and Services Logs** > Microsoft > Windows > Windows Defender > Operational > ID 1123. + * **Audit disk modification only** - Only attempts to write to protected disk sectors will be recorded in the Windows event log (under **Applications and Services Logs** > **Microsoft** > **Windows** > **Windows Defender** > **Operational** > **ID 1124**). Attempts to modify or delete files in protected folders will not be recorded. - ![Screenshot of group policy option with Enabled and then Enable selected in the drop-down](../images/cfa-gp-enable.png) + ![Screenshot of the group policy option Enabled and Audit Mode selected in the drop-down](../images/cfa-gp-enable.png) > [!IMPORTANT] -> To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. +> To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and select **Block** in the options drop-down menu. ## PowerShell diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index ccab9e8250..42ce3aa2b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -127,8 +127,8 @@ If you are looking for a pre-made simulation, you can use our ["Do It Yourself" You can also use [Advanced hunting](advanced-hunting-query-language.md) to query data and [Threat analytics](threat-analytics.md) to view reports about emerging threats. ->[!NOTE] ->The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. +> [!NOTE] +> The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. 1. Connect to your machine and run an attack simulation by selecting **Connect**. @@ -179,4 +179,3 @@ Your feedback helps us get better in protecting your environment from advanced a Let us know what you think, by selecting **Provide feedback**. ![Image of provide feedback](images/send-us-feedback-eval-lab.png) - diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 3003c707b4..ddd34985a3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -119,11 +119,11 @@ The following commands are available for user roles that's been granted the abil Command | Description :---|:--- analyze | Analyses the entity with various incrimination engines to reach a verdict. -getfile | Gets a file from the machine.
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjuction with `getfile` to automatically run the prerequisite command. +getfile | Gets a file from the machine.
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `getfile` to automatically run the prerequisite command. run | Runs a PowerShell script from the library on the machine. library | Lists files that were uploaded to the live response library. putfile | Puts a file from the library to the machine. Files are saved in a working folder and are deleted when the machine restarts by default. -remediate | Remediates an entity on the machine. The remediation action will vary depending on the entity type:
- File: delete
- Process: stop, delete image file
- Service: stop, delete image file
- Registry entry: delete
- Scheduled task: remove
- Startup folder item: delete file
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjuction with `remediate` to automatically run the prerequisite command. +remediate | Remediates an entity on the machine. The remediation action will vary depending on the entity type:
- File: delete
- Process: stop, delete image file
- Service: stop, delete image file
- Registry entry: delete
- Scheduled task: remove
- Startup folder item: delete file
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `remediate` to automatically run the prerequisite command. undo | Restores an entity that was remediated. diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index 8d134aaa46..4c475c71c0 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -41,7 +41,10 @@ The Security Compliance Toolkit consists of: - Windows Server 2012 R2 - Microsoft Office security baseline - - Office365 ProPlus (Sept 2019) + - Office 365 ProPlus (Sept 2019) + +- Microsoft Edge security baseline + - Version 79 - Tools - Policy Analyzer tool diff --git a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md index 1ada850d3b..37700da3a6 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md @@ -20,7 +20,7 @@ ms.date: 04/19/2017 # Network security: Configure encryption types allowed for Kerberos **Applies to** -- Windows 10 +- Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2 Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos** security policy setting. @@ -35,11 +35,11 @@ The following table lists and explains the allowed encryption types. | Encryption type | Description and version support | | - | - | -| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function
Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. | -| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function
Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. | -| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function
Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2.| -| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. | -| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. | +| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function
Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10, Windows Server 2008 R2 and later operating systems do not support DES by default. | +| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function
Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10, Windows Server 2008 R2 and later operating systems do not support DES by default. | +| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function
Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 10, Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2.| +| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10, Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2. | +| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10, Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2. | | Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.| ### Possible values diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md index 85b7b015a3..6c817499da 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md @@ -266,7 +266,7 @@ This section lists the exclusions that are delivered automatically when you inst - %windir%\Ntds\ntds.pat -- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files` +- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path` - %windir%\Ntds\EDB*.log diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index b3af31a231..0005561984 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -121,7 +121,7 @@ Here's what you see in the Windows Security app: If you are using Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), or [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. In this case, you can use PowerShell to determine whether tamper protection is enabled. -#### Use PowerShell to determine whether tamper protection is turned +#### Use PowerShell to determine whether tamper protection is turned on 1. Open the Windows PowerShell app. diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 392bc3f8e3..57b00a8aa0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -1,7 +1,7 @@ --- title: Why you should use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection description: For best results, use Windows Defender Antivirus together with your other Microsoft offerings. -keywords: windows defender, antivirus +keywords: windows defender, antivirus, third party av search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index 4095a6a122..4ead268500 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -32,7 +32,8 @@ Refer to the below video for an overview and brief demo. ## Policy Authorization Process ![Policy Authorization](images/wdac-intune-policy-authorization.png) -The general steps for expanding the S mode base policy on your devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups. +The general steps for expanding the S mode base policy on your Intune-managed devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups. Because you need access to WDAC PowerShell cmdlets to generate your supplemental policy, you should create and manage your policies on a non-S mode device. Once the policy has been uploaded to Intune, we recommend assigning it to a single test S-mode device to verify expected functioning before deploying the policy more broadly. + 1. Generate a supplemental policy with WDAC tooling This policy will expand the S mode base policy to authorize additional applications. Anything authorized by either the S mode base policy or your supplemental policy will be allowed to run. Your supplemental policies can specify filepath rules, trusted publishers, and more. @@ -60,7 +61,7 @@ The general steps for expanding the S mode base policy on your devices are to ge - Since you'll be signing your policy, you must authorize the signing certificate you will use to sign the policy and optionally one or more additional signers that can be used to sign updates to the policy in the future. For more information, refer to Section 2, Sign policy. Use Add-SignerRule to add the signing certificate to the WDAC policy: ```powershell - Add-SignerRule -FilePath -CertificatePath -User -Update` + Add-SignerRule -FilePath -CertificatePath -User -Update ``` - Convert to .bin using [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) @@ -70,7 +71,7 @@ The general steps for expanding the S mode base policy on your devices are to ge 2. Sign policy - Supplemental S mode policies must be digitally signed. To sign your policy, you can choose to use the Device Guard Signing Service or your organization's custom Public Key Infrastructure (PKI). Refer to [Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) for guidance on using DGSS and [Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) for guidance on signing using an internal CA. + Supplemental S mode policies must be digitally signed. To sign your policy, you can choose to use the Device Guard Signing Service (DGSS) or your organization's custom Public Key Infrastructure (PKI). Refer to [Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) for guidance on using DGSS and [Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) for guidance on signing using an internal CA. Rename your policy to "{PolicyID}.p7b" after you've signed it. PolicyID can be found by inspecting the Supplemental Policy XML. @@ -91,7 +92,7 @@ Your supplemental policy can be used to significantly relax the S mode base poli Instead of authorizing signers external to your organization, Intune has added new functionality to make it easier to authorize existing applications (without requiring repackaging or access to the source code) through the use of signed catalogs. This works for apps which may be unsigned or even signed apps when you don’t want to trust all apps that may share the same signing certificate. -The basic process is to generate a catalog file for each app using Package Inspector, then sign the catalog files using the DGSS or a custom PKI. After that, IT Pros can use the standard Intune app deployment process outlined above. Refer to [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md) for more in-depth guidance on generating catalogs. +The basic process is to generate a catalog file for each app using Package Inspector, then sign the catalog files using the DGSS or a custom PKI. Use the Add-SignerRule PowerShell cmdlet as shown above to authorize the catalog signing certificate in the supplemental policy. After that, IT Pros can use the standard Intune app deployment process outlined above. Refer to [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md) for more in-depth guidance on generating catalogs. > [!Note] > Every time an app updates, you will need to deploy an updated catalog. Because of this, IT Pros should try to avoid using catalog files for applications that auto-update and direct users not to update applications on their own. @@ -180,8 +181,11 @@ Below is a sample policy that allows kernel debuggers, PowerShell ISE, and Regis ``` ## Policy removal +In order to revert users to an unmodified S mode policy, an IT Pro can remove a user or users from the targeted Intune group which received the policy, which will trigger a removal of both the policy and the authorization token from the device. + +IT Pros also have the choice of deleting a supplemental policy through Intune. > [!Note] -> This feature currently has a known a policy deletion bug, with a fix expected in the 2D update in late February 2020. Devices of users who are unenrolled will still have their WDAC policies removed. In the mentime, IT Pros are recommended to update their policy with the below 'empty' policy which makes no changes to S mode. +> This feature currently has a known bug which occurs when an S mode supplemental policy is deleted through Intune, in which the policy is not immediately removed from the devices to which it was deployed. A fix is expected in the 2D update in late February 2020. In the meantime, IT Pros are recommended to update their policy with the below 'empty' policy which makes no changes to S mode. ```xml @@ -233,3 +237,6 @@ Below is a sample policy that allows kernel debuggers, PowerShell ISE, and Regis ``` + +## Errata +If an S-mode device with a policy authorization token and supplemental policy is rolled back from the 1909 update to the 1903 build, it will not revert to locked-down S mode until the next policy refresh. To achieve an immediate change to a locked-down S mode state, IT Pros should delete any tokens in %SystemRoot%\System32\CI\Tokens\Active. diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index fc2d28a1c6..465dfec3fb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -160,9 +160,8 @@ Pick the correct version of each .dll for the Windows release you plan to suppor - - - + +