White glove gives a red screen | White glove is not supported on a VM.
diff --git a/windows/deployment/windows-autopilot/self-deploying.md b/windows/deployment/windows-autopilot/self-deploying.md
index 939b4ac431..ca49b045ee 100644
--- a/windows/deployment/windows-autopilot/self-deploying.md
+++ b/windows/deployment/windows-autopilot/self-deploying.md
@@ -39,7 +39,7 @@ Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage
Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.)
>[!IMPORTANT]
->If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported).. Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC.
+>If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported). Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC. See [Windows Autopilot known issues](known-issues.md) to review other known errors and solutions.
In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details.
diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md
index e4021e6946..8e10f74a84 100644
--- a/windows/privacy/TOC.md
+++ b/windows/privacy/TOC.md
@@ -14,7 +14,7 @@
### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
## Enhanced level Windows diagnostic data events and fields
-### [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
+### [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
## Full level categories
### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md)
### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md)
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index aed5ac00b0..06c4e844c4 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -390,20 +390,26 @@ However, before more data is gathered, Microsoft’s privacy governance team, in
> [!NOTE]
> Crash dumps collected at this diagnostic data level may unintentionally contain personal data, such as portions of memory from a documents, a web page, etc.
-## Limit Enhanced diagnostic data to the minimum required by Windows Analytics
+## Limit Enhanced diagnostic data to the minimum required by Desktop Analytics
-Windows Analytics Device Health reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. In the past, organizations sending **Enhanced** or **Full** level diagnostic data were able to participate in Device Health. However, organizations that required detailed event and field level documentation were unable to move from **Basic** to **Enhanced**.
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
-In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic.
+Desktop Analytics reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events.
-- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic.
+In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data.
+
+- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic.
- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode.
>[!NOTE]
> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump.
-### Enable limiting enhanced diagnostic data to the minimum required by Windows Analytics
+With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
+
+### Enable limiting enhanced diagnostic data to the minimum required by Desktop Analytics
1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM.
diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
index 29da582e50..c6e50f98f3 100644
--- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
+++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
@@ -1,6 +1,6 @@
---
-description: Use this article to learn more about the enhanced diagnostic data events used by Windows Analytics
-title: Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics (Windows 10)
+description: Use this article to learn more about the limit enhanced diagnostic data events policy used by Desktop Analytics
+title: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy (Windows 10)
keywords: privacy, diagnostic data
ms.prod: w10
ms.mktglfcycl: manage
@@ -18,19 +18,24 @@ ms.reviewer:
---
-# Windows 10 enhanced diagnostic data events and fields used by Windows Analytics
+# Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
**Applies to**
- Windows 10, version 1709 and newer
-Windows Analytics Device Health reports are powered by diagnostic data not included in the Basic level. This includes crash reports and certain OS diagnostic data events. Organizations sending Enhanced or Full level diagnostic data were able to participate in Device Health, but some organizations which required detailed event and field level documentation were unable to move from Basic to Enhanced.
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
-In Windows 10, version 1709, we introduce a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+Desktop Analytics reports are powered by diagnostic data not included in the Basic level.
+In Windows 10, version 1709, we introduced a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+
+With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
## KernelProcess.AppStateChangeSummary
-This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Windows Analytics to gain insights into application reliability.
+This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Desktop Analytics to gain insights into application reliability.
The following fields are available:
@@ -241,7 +246,7 @@ This event is fired when the office application suspends as per app life-cycle c
- **SuspendType:** Type of suspend
## Microsoft.OSG.OSS.CredProvFramework.ReportResultStop
-This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Windows Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices.
+This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Desktop Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices.
The following fields are available:
@@ -261,7 +266,7 @@ The following fields are available:
- **UserTag:** Count of the number of times a user has selected a provider
## Microsoft.Windows.Kernel.Power.OSStateChange
-This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to monitor reliability and performance of managed devices
+This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Desktop Analytics, organizations can use this to monitor reliability and performance of managed devices
The following fields are available:
@@ -322,7 +327,7 @@ The following field is available:
- **ticksSinceBoot:** Duration of boot event (milliseconds)
## Microsoft.Windows.Shell.Desktop.LogonFramework.AllLogonTasks
-This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Windows Analytics organizations can help identify logon problems on managed devices.
+This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Desktop Analytics organizations can help identify logon problems on managed devices.
The following fields are available:
@@ -359,7 +364,7 @@ The following fields are available:
- **status:** Indicates whether errors occurred during WIP learning events
## Win32kTraceLogging.AppInteractivitySummary
-Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Windows Analytics) to understand and improve application reliability on managed devices.
+Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Desktop Analytics) to understand and improve application reliability on managed devices.
The following fields are available:
@@ -415,8 +420,11 @@ A previous revision of this list stated that a field named PartA_UserSid was a m
### Office events added
In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 16 events were added, describing Office app launch and availability. These events were added to improve the precision of Office data in Windows Analytics.
+> [!NOTE]
+> Office data will no longer be provided through this policy in Desktop Analytics.
+
### CertAnalytics events removed
-In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Windows Analytics.
+In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Desktop Analytics.
>[!NOTE]
>You can use the Windows Diagnostic Data Viewer to observe and review events and their fields as described in this topic.
diff --git a/windows/release-information/resolved-issues-windows-10-1507.yml b/windows/release-information/resolved-issues-windows-10-1507.yml
index 96c938dec5..50c83837eb 100644
--- a/windows/release-information/resolved-issues-windows-10-1507.yml
+++ b/windows/release-information/resolved-issues-windows-10-1507.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 10240.18334
September 23, 2019 KB4522009 | Resolved KB4520011 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 10240.18334
September 23, 2019 KB4522009 | Resolved KB4520011 | October 08, 2019 10:00 AM PT |
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.
See details > | OS Build 10240.18305
August 13, 2019 KB4512497 | Resolved KB4517276 | August 17, 2019 02:00 PM PT |
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.
See details > | OS Build 10240.18244
June 11, 2019 KB4503291 | Resolved External
| August 09, 2019 07:03 PM PT |
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.
See details > | OS Build 10240.18244
June 11, 2019 KB4503291 | Resolved KB4507458 | July 09, 2019 10:00 AM PT |
diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml
index 7cbaf548d3..44e89ad24d 100644
--- a/windows/release-information/resolved-issues-windows-10-1607.yml
+++ b/windows/release-information/resolved-issues-windows-10-1607.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 14393.3206
September 23, 2019 KB4522010 | Resolved KB4519998 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 14393.3206
September 23, 2019 KB4522010 | Resolved KB4519998 | October 08, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 14393.3204
September 10, 2019 KB4516044 | Resolved
| September 17, 2019 04:47 PM PT |
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.
See details > | OS Build 14393.3053
June 18, 2019 KB4503294 | Resolved KB4516044 | September 10, 2019 10:00 AM PT |
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.
See details > | OS Build 14393.3115
July 16, 2019 KB4507459 | Resolved KB4512517 | August 13, 2019 10:00 AM PT |
diff --git a/windows/release-information/resolved-issues-windows-10-1703.yml b/windows/release-information/resolved-issues-windows-10-1703.yml
index 862a0cb913..b66de78474 100644
--- a/windows/release-information/resolved-issues-windows-10-1703.yml
+++ b/windows/release-information/resolved-issues-windows-10-1703.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 15063.2046
September 23, 2019 KB4522011 | Resolved KB4520010 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 15063.2046
September 23, 2019 KB4522011 | Resolved KB4520010 | October 08, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 15063.2045
September 10, 2019 KB4516068 | Resolved
| September 17, 2019 04:47 PM PT |
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.
See details > | OS Build 15063.1955
July 16, 2019 KB4507467 | Resolved KB4512507 | August 13, 2019 10:00 AM PT |
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.
See details > | OS Build 15063.1988
August 13, 2019 KB4512507 | Resolved KB4512474 | August 17, 2019 02:00 PM PT |
diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml
index 2461882d7f..8a16e56715 100644
--- a/windows/release-information/resolved-issues-windows-10-1709.yml
+++ b/windows/release-information/resolved-issues-windows-10-1709.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 16299.1392
September 23, 2019 KB4522012 | Resolved KB4520004 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 16299.1392
September 23, 2019 KB4522012 | Resolved KB4520004 | October 08, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 16299.1387
September 10, 2019 KB4516066 | Resolved
| September 19, 2019 04:08 PM PT |
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.
See details > | OS Build 16299.1296
July 16, 2019 KB4507465 | Resolved KB4512516 | August 13, 2019 10:00 AM PT |
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"
See details > | OS Build 16299.1217
June 11, 2019 KB4503284 | Resolved KB4512494 | August 16, 2019 02:00 PM PT |
diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml
index 9af252fa36..aeeb0b6087 100644
--- a/windows/release-information/resolved-issues-windows-10-1803.yml
+++ b/windows/release-information/resolved-issues-windows-10-1803.yml
@@ -32,7 +32,9 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 17134.1009
September 23, 2019 KB4522014 | Resolved KB4520008 | October 08, 2019 10:00 AM PT |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.
See details > | OS Build 17134.950
August 13, 2019 KB4512501 | Resolved KB4519978 | October 15, 2019 10:00 AM PT |
+ Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.
See details > | OS Build 17134.829
June 11, 2019 KB4503286 | Resolved KB4519978 | October 15, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 17134.1009
September 23, 2019 KB4522014 | Resolved KB4520008 | October 08, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 17134.1006
September 10, 2019 KB4516058 | Resolved
| September 19, 2019 04:08 PM PT |
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.
See details > | OS Build 17134.915
July 16, 2019 KB4507466 | Resolved KB4512501 | August 13, 2019 10:00 AM PT |
Notification issue: \"Your device is missing important security and quality fixes.\" Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"
See details > | N/A
| Resolved
| September 03, 2019 12:32 PM PT |
@@ -61,6 +63,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error codeAfter installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms: - Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in KB4519978. Back to top | OS Build 17134.950
August 13, 2019 KB4512501 | Resolved KB4519978 | Resolved: October 15, 2019 10:00 AM PT
Opened: September 11, 2019 05:32 PM PT |
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms: - Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
- The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520008. Back to top | OS Build 17134.1009
September 23, 2019 KB4522014 | Resolved KB4520008 | Resolved: October 08, 2019 10:00 AM PT
Opened: September 30, 2019 06:26 PM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in KB4516058, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps: - Select the Start button and type Services.
- Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
- Locate Startup type: and change it to Manual
- Select Ok
- The TabletInputService service is now in the default configuration and IME should work as expected.
Back to top | OS Build 17134.1006
September 10, 2019 KB4516058 | Resolved
| Resolved: September 19, 2019 04:08 PM PT
Opened: September 13, 2019 05:25 PM PT |
Notification issue: \"Your device is missing important security and quality fixes.\" Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.
Affected platforms: - Client: Windows 10, version 1803
- Server: Windows Server, version 1803
Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. Back to top | N/A
| Resolved
| Resolved: September 03, 2019 12:32 PM PT
Opened: September 03, 2019 12:32 PM PT |
@@ -93,6 +96,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
+ Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
- Server: Windows Server 2019
Resolution: This issue was resolved in KB4519978. Back to top | OS Build 17134.829
June 11, 2019 KB4503286 | Resolved KB4519978 | Resolved: October 15, 2019 10:00 AM PT
Opened: June 14, 2019 04:41 PM PT |
Difficulty connecting to some iSCSI-based SANsDevices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4499183. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
- Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4509478. Back to top | OS Build 17134.799
May 21, 2019 KB4499183 | Resolved KB4509478 | Resolved: June 26, 2019 04:00 PM PT
Opened: June 20, 2019 04:46 PM PT |
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4503288. Back to top | OS Build 17134.829
June 11, 2019 KB4503286 | Resolved KB4503288 | Resolved: June 18, 2019 02:00 PM PT
Opened: June 12, 2019 11:11 AM PT |
Opening Internet Explorer 11 may fail Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4503286. Back to top | OS Build 17134.799
May 21, 2019 KB4499183 | Resolved KB4503286 | Resolved: June 11, 2019 10:00 AM PT
Opened: June 05, 2019 05:49 PM PT |
diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
index 576221ee19..d8ce5f8d4a 100644
--- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
+++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
@@ -32,7 +32,9 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 17763.740
September 23, 2019 KB4522015 | Resolved KB4519338 | October 08, 2019 10:00 AM PT |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.
See details > | OS Build 17763.678
August 13, 2019 KB4511553 | Resolved KB4520062 | October 15, 2019 10:00 AM PT |
+ Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.
See details > | OS Build 17763.557
June 11, 2019 KB4503327 | Resolved KB4520062 | October 15, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 17763.740
September 23, 2019 KB4522015 | Resolved KB4519338 | October 08, 2019 10:00 AM PT |
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.
See details > | OS Build 17763.55
October 09, 2018 KB4464330 | Resolved KB4516077 | September 24, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 17763.737
September 10, 2019 KB4512578 | Resolved
| September 19, 2019 04:08 PM PT |
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.
See details > | OS Build 17763.652
July 22, 2019 KB4505658 | Resolved KB4511553 | August 13, 2019 10:00 AM PT |
@@ -68,6 +70,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error codeAfter installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms: - Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in KB4520062. Back to top | OS Build 17763.678
August 13, 2019 KB4511553 | Resolved KB4520062 | Resolved: October 15, 2019 10:00 AM PT
Opened: September 11, 2019 05:32 PM PT |
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms: - Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
- The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519338. Back to top | OS Build 17763.740
September 23, 2019 KB4522015 | Resolved KB4519338 | Resolved: October 08, 2019 10:00 AM PT
Opened: September 30, 2019 06:26 PM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in KB4512578, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps: - Select the Start button and type Services.
- Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
- Locate Startup type: and change it to Manual
- Select Ok
- The TabletInputService service is now in the default configuration and IME should work as expected.
Back to top | OS Build 17763.737
September 10, 2019 KB4512578 | Resolved
| Resolved: September 19, 2019 04:08 PM PT
Opened: September 13, 2019 05:25 PM PT |
@@ -100,6 +103,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
+ Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
- Server: Windows Server 2019
Resolution: This issue was resolved in KB4520062. Back to top | OS Build 17763.557
June 11, 2019 KB4503327 | Resolved KB4520062 | Resolved: October 15, 2019 10:00 AM PT
Opened: June 14, 2019 04:41 PM PT |
Difficulty connecting to some iSCSI-based SANsDevices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing KB4497934. You may also receive an error in the System log section of Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
- Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in KB4509479. Back to top | OS Build 17763.529
May 21, 2019 KB4497934 | Resolved KB4509479 | Resolved: June 26, 2019 04:00 PM PT
Opened: June 20, 2019 04:46 PM PT |
Devices with Realtek Bluetooth radios drivers may not pair or connect as expected In some circumstances, devices with Realtek Bluetooth radios may have issues pairing or connecting to Bluetooth devices due to a driver issue.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
- Server: Windows Server 2019
Resolution: This issue was resolved in KB4501371. Back to top | OS Build 17763.503
May 14, 2019 KB4494441 | Resolved KB4501371 | Resolved: June 18, 2019 02:00 PM PT
Opened: June 14, 2019 05:45 PM PT |
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4501371. Back to top | OS Build 17763.557
June 11, 2019 KB4503327 | Resolved KB4501371 | Resolved: June 18, 2019 02:00 PM PT
Opened: June 12, 2019 11:11 AM PT |
diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml
index 25f5d45af6..e0d9f8160e 100644
--- a/windows/release-information/resolved-issues-windows-10-1903.yml
+++ b/windows/release-information/resolved-issues-windows-10-1903.yml
@@ -32,8 +32,8 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- dGPU occasionally disappear from device manager on Surface Book 2 Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.
See details > | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| October 11, 2019 03:15 PM PT |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 18362.357
September 23, 2019 KB4522016 | Resolved KB4517389 | October 08, 2019 10:00 AM PT |
+ dGPU occasionally disappear from device manager on Surface Book 2 Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.
See details > | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| October 18, 2019 04:33 PM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 18362.357
September 23, 2019 KB4522016 | Resolved KB4517389 | October 08, 2019 10:00 AM PT |
Audio in games is quiet or different than expected Microsoft has received reports that audio in certain games is quieter or different than expected.
See details > | OS Build 18362.356
September 10, 2019 KB4515384 | Resolved KB4517211 | September 26, 2019 02:00 PM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 18362.356
September 10, 2019 KB4515384 | Resolved
| September 19, 2019 04:08 PM PT |
Some users report issues related to the Start menu and Windows Desktop Search A small number of users have reported issues related to the Start menu and Windows Desktop Search.
See details > | OS Build 18362.356
September 10, 2019 KB4515384 | Resolved
| September 19, 2019 04:58 PM PT |
@@ -95,7 +95,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
- dGPU occasionally disappear from device manager on Surface Book 2 Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open. To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved. Affected platforms: - Client: Windows 10, version 1903
Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue. The safeguard hold will be removed in the coming weeks. Back to top | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| Resolved: October 11, 2019 03:15 PM PT
Opened: July 12, 2019 04:20 PM PT |
+ dGPU occasionally disappear from device manager on Surface Book 2 Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open. To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved. Affected platforms: - Client: Windows 10, version 1903
Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue. The safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903. Back to top | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| Resolved: October 18, 2019 04:33 PM PT
Opened: July 12, 2019 04:20 PM PT |
Domain connected devices that use MIT Kerberos realms will not start upDevices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.
To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.
Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903. Back to top | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved KB4512941 | Resolved: August 30, 2019 10:00 AM PT
Opened: July 25, 2019 06:10 PM PT |
Issues updating when certain versions of Intel storage drivers are installed Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).
To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.
Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.
Affected platforms: - Client: Windows 10, version 1903
- Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903. Back to top | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved KB4512941 | Resolved: August 30, 2019 10:00 AM PT
Opened: July 25, 2019 06:10 PM PT |
diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
index 7232cf65f7..018a7f2bc2 100644
--- a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
+++ b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516048 | Resolved KB4519976 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516048 | Resolved KB4519976 | October 08, 2019 10:00 AM PT |
You may receive an error when opening or using the Toshiba Qosmio AV Center Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.
See details > | August 13, 2019 KB4512506 | Resolved KB4516048 | September 24, 2019 10:00 AM PT |
Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed
See details > | August 13, 2019 KB4512506 | Resolved External
| August 27, 2019 02:29 PM PT |
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"
See details > | June 11, 2019 KB4503292 | Resolved KB4512514 | August 17, 2019 02:00 PM PT |
diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
index c58e1391c1..773e34d6fa 100644
--- a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
+++ b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516041 | Resolved KB4520005 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516041 | Resolved KB4520005 | October 08, 2019 10:00 AM PT |
Windows RT 8.1 devices may have issues opening Internet Explorer 11 On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.
See details > | September 10, 2019 KB4516067 | Resolved KB4516041 | September 24, 2019 10:00 AM PT |
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"
See details > | June 11, 2019 KB4503276 | Resolved KB4512478 | August 17, 2019 02:00 PM PT |
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.
See details > | August 13, 2019 KB4512488 | Resolved KB4517298 | August 16, 2019 02:00 PM PT |
diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
index 57adef5214..ae70b4a30e 100644
--- a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
+++ b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516030 | Resolved KB4520002 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516030 | Resolved KB4520002 | October 08, 2019 10:00 AM PT |
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"
See details > | June 11, 2019 KB4503273 | Resolved KB4512499 | August 17, 2019 02:00 PM PT |
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.
See details > | August 13, 2019 KB4512476 | Resolved KB4517301 | August 16, 2019 02:00 PM PT |
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.
See details > | June 11, 2019 KB4503273 | Resolved External
| August 09, 2019 07:03 PM PT |
diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml
index 1ca43d3f61..660872c996 100644
--- a/windows/release-information/resolved-issues-windows-server-2012.yml
+++ b/windows/release-information/resolved-issues-windows-server-2012.yml
@@ -32,7 +32,7 @@ sections:
- type: markdown
text: "
Summary | Originating update | Status | Date resolved |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516069 | Resolved KB4520007 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516069 | Resolved KB4520007 | October 08, 2019 10:00 AM PT |
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"
See details > | June 11, 2019 KB4503285 | Resolved KB4512512 | August 17, 2019 02:00 PM PT |
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.
See details > | August 13, 2019 KB4512518 | Resolved KB4517302 | August 16, 2019 02:00 PM PT |
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.
See details > | June 11, 2019 KB4503285 | Resolved External
| August 09, 2019 07:03 PM PT |
diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml
index e84e0fc49b..be4512cee7 100644
--- a/windows/release-information/status-windows-10-1507.yml
+++ b/windows/release-information/status-windows-10-1507.yml
@@ -60,7 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 10240.18334
September 23, 2019 KB4522009 | Resolved KB4520011 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 10240.18334
September 23, 2019 KB4522009 | Resolved KB4520011 | October 08, 2019 10:00 AM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | OS Build 10240.18094
January 08, 2019 KB4480962 | Mitigated
| April 25, 2019 02:00 PM PT |
"
diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
index f91ae43fc4..c75ec5b5a9 100644
--- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
+++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
@@ -60,8 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 14393.3206
September 23, 2019 KB4522010 | Resolved KB4519998 | October 08, 2019 10:00 AM PT |
- IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 14393.3204
September 10, 2019 KB4516044 | Resolved
| September 17, 2019 04:47 PM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 14393.3206
September 23, 2019 KB4522010 | Resolved KB4519998 | October 08, 2019 10:00 AM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | OS Build 14393.2724
January 08, 2019 KB4480961 | Mitigated
| April 25, 2019 02:00 PM PT |
Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.
See details > | OS Build 14393.2608
November 13, 2018 KB4467691 | Mitigated
| February 19, 2019 10:00 AM PT |
Cluster service may fail if the minimum password length is set to greater than 14 The cluster service may fail to start if “Minimum Password Length” is configured with greater than 14 characters.
See details > | OS Build 14393.2639
November 27, 2018 KB4467684 | Mitigated
| April 25, 2019 02:00 PM PT |
@@ -81,7 +80,6 @@ sections:
text: "
Details | Originating update | Status | History |
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms: - Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
- The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519998. Back to top | OS Build 14393.3206
September 23, 2019 KB4522010 | Resolved KB4519998 | Resolved: October 08, 2019 10:00 AM PT
Opened: September 30, 2019 06:26 PM PT |
- IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows. Back to top | OS Build 14393.3204
September 10, 2019 KB4516044 | Resolved
| Resolved: September 17, 2019 04:47 PM PT
Opened: September 13, 2019 05:25 PM PT |
"
diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml
index 519ad969c5..9b774ca109 100644
--- a/windows/release-information/status-windows-10-1703.yml
+++ b/windows/release-information/status-windows-10-1703.yml
@@ -64,8 +64,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 15063.2046
September 23, 2019 KB4522011 | Resolved KB4520010 | October 08, 2019 10:00 AM PT |
- IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 15063.2045
September 10, 2019 KB4516068 | Resolved
| September 17, 2019 04:47 PM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 15063.2046
September 23, 2019 KB4522011 | Resolved KB4520010 | October 08, 2019 10:00 AM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | OS Build 15063.1563
January 08, 2019 KB4480973 | Mitigated
| April 25, 2019 02:00 PM PT |
"
@@ -83,7 +82,6 @@ sections:
text: "
Details | Originating update | Status | History |
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms: - Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
- The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520010. Back to top | OS Build 15063.2046
September 23, 2019 KB4522011 | Resolved KB4520010 | Resolved: October 08, 2019 10:00 AM PT
Opened: September 30, 2019 06:26 PM PT |
- IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows. Back to top | OS Build 15063.2045
September 10, 2019 KB4516068 | Resolved
| Resolved: September 17, 2019 04:47 PM PT
Opened: September 13, 2019 05:25 PM PT |
"
diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml
index e7cfb4d349..72f9e6f8fa 100644
--- a/windows/release-information/status-windows-10-1709.yml
+++ b/windows/release-information/status-windows-10-1709.yml
@@ -60,7 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 16299.1392
September 23, 2019 KB4522012 | Resolved KB4520004 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 16299.1392
September 23, 2019 KB4522012 | Resolved KB4520004 | October 08, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 16299.1387
September 10, 2019 KB4516066 | Resolved
| September 19, 2019 04:08 PM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | OS Build 16299.904
January 08, 2019 KB4480978 | Mitigated
| April 25, 2019 02:00 PM PT |
diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml
index 807dd2cfdf..5ad00ae3bb 100644
--- a/windows/release-information/status-windows-10-1803.yml
+++ b/windows/release-information/status-windows-10-1803.yml
@@ -64,10 +64,10 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 17134.1009
September 23, 2019 KB4522014 | Resolved KB4520008 | October 08, 2019 10:00 AM PT |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.
See details > | OS Build 17134.950
August 13, 2019 KB4512501 | Resolved KB4519978 | October 15, 2019 10:00 AM PT |
+ Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.
See details > | OS Build 17134.829
June 11, 2019 KB4503286 | Resolved KB4519978 | October 15, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 17134.1009
September 23, 2019 KB4522014 | Resolved KB4520008 | October 08, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 17134.1006
September 10, 2019 KB4516058 | Resolved
| September 19, 2019 04:08 PM PT |
- Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.
See details > | OS Build 17134.950
August 13, 2019 KB4512501 | Mitigated
| September 11, 2019 05:32 PM PT |
- Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.
See details > | OS Build 17134.829
June 11, 2019 KB4503286 | Mitigated
| June 14, 2019 04:41 PM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | OS Build 17134.523
January 08, 2019 KB4480966 | Mitigated
| April 25, 2019 02:00 PM PT |
"
@@ -84,9 +84,9 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error codeAfter installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms: - Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in KB4519978. Back to top | OS Build 17134.950
August 13, 2019 KB4512501 | Resolved KB4519978 | Resolved: October 15, 2019 10:00 AM PT
Opened: September 11, 2019 05:32 PM PT |
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms: - Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
- The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4520008. Back to top | OS Build 17134.1009
September 23, 2019 KB4522014 | Resolved KB4520008 | Resolved: October 08, 2019 10:00 AM PT
Opened: September 30, 2019 06:26 PM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in KB4516058, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps: - Select the Start button and type Services.
- Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
- Locate Startup type: and change it to Manual
- Select Ok
- The TabletInputService service is now in the default configuration and IME should work as expected.
Back to top | OS Build 17134.1006
September 10, 2019 KB4516058 | Resolved
| Resolved: September 19, 2019 04:08 PM PT
Opened: September 13, 2019 05:25 PM PT |
- Windows Mixed Reality Portal users may intermittently receive a 15-5 error codeAfter installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms: - Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps: - Close the Windows Mixed Reality Portal, if it is running.
- Open Task Manager by selecting the Start button and typing Task Manager.
- In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
- You can now open the Windows Mixed Reality Portal.
Next steps: We are working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17134.950
August 13, 2019 KB4512501 | Mitigated
| Last updated: September 11, 2019 05:32 PM PT
Opened: September 11, 2019 05:32 PM PT |
"
@@ -95,7 +95,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
- Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
- Server: Windows Server 2019
Workaround: To mitigate this issue, press Ctrl+Alt+Delete, then select the Power button in the lower right corner of the screen and select Restart. Your device should now restart normally.
Next steps: We are working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17134.829
June 11, 2019 KB4503286 | Mitigated
| Last updated: June 14, 2019 04:41 PM PT
Opened: June 14, 2019 04:41 PM PT |
+ Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
- Server: Windows Server 2019
Resolution: This issue was resolved in KB4519978. Back to top | OS Build 17134.829
June 11, 2019 KB4503286 | Resolved KB4519978 | Resolved: October 15, 2019 10:00 AM PT
Opened: June 14, 2019 04:41 PM PT |
"
diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
index 9bae55dbb7..f19b9b7ad2 100644
--- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
+++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
@@ -64,11 +64,12 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 17763.740
September 23, 2019 KB4522015 | Resolved KB4519338 | October 08, 2019 10:00 AM PT |
+ Microsoft Defender Advanced Threat Protection might stop running The Microsoft Defender ATP service might stop running and might fail to send reporting data.
See details > | OS Build 17763.832
October 15, 2019 KB4520062 | Investigating
| October 18, 2019 04:23 PM PT |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.
See details > | OS Build 17763.678
August 13, 2019 KB4511553 | Resolved KB4520062 | October 15, 2019 10:00 AM PT |
+ Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.
See details > | OS Build 17763.557
June 11, 2019 KB4503327 | Resolved KB4520062 | October 15, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 17763.740
September 23, 2019 KB4522015 | Resolved KB4519338 | October 08, 2019 10:00 AM PT |
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.
See details > | OS Build 17763.55
October 09, 2018 KB4464330 | Resolved KB4516077 | September 24, 2019 10:00 AM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 17763.737
September 10, 2019 KB4512578 | Resolved
| September 19, 2019 04:08 PM PT |
- Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.
See details > | OS Build 17763.678
August 13, 2019 KB4511553 | Mitigated
| September 11, 2019 05:32 PM PT |
- Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.
See details > | OS Build 17763.557
June 11, 2019 KB4503327 | Mitigated
| June 14, 2019 04:41 PM PT |
Devices with some Asian language packs installed may receive an error Devices with Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"
See details > | OS Build 17763.437
April 09, 2019 KB4493509 | Mitigated
| May 03, 2019 10:59 AM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | OS Build 17763.253
January 08, 2019 KB4480116 | Mitigated
| April 09, 2019 10:00 AM PT |
@@ -81,14 +82,23 @@ sections:
"
+- title: October 2019
+- items:
+ - type: markdown
+ text: "
+ Details | Originating update | Status | History |
+ Microsoft Defender Advanced Threat Protection might stop runningAfter installing the optional non-security update ( KB4520062), the Microsoft Defender Advanced Threat Protection (ATP) service might stop running and might fail to send reporting data. You might also receive a 0xc0000409 error in Event Viewer on MsSense.exe.
Note Microsoft Windows Defender Antivirus is not affected by this issue.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
- Server: Windows Server, version 1809; Windows Server 2019
Next steps: At this time, we suggest that devices in an affected environment do not install the optional non-security update, KB4520062. We are working on a resolution and estimate a solution will be available in mid-November. Back to top | OS Build 17763.832
October 15, 2019 KB4520062 | Investigating
| Last updated: October 18, 2019 04:23 PM PT
Opened: October 17, 2019 05:14 PM PT |
+
+ "
+
- title: September 2019
- items:
- type: markdown
text: "
Details | Originating update | Status | History |
+ Windows Mixed Reality Portal users may intermittently receive a 15-5 error codeAfter installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms: - Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in KB4520062. Back to top | OS Build 17763.678
August 13, 2019 KB4511553 | Resolved KB4520062 | Resolved: October 15, 2019 10:00 AM PT
Opened: September 11, 2019 05:32 PM PT |
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms: - Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
- The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4519338. Back to top | OS Build 17763.740
September 23, 2019 KB4522015 | Resolved KB4519338 | Resolved: October 08, 2019 10:00 AM PT
Opened: September 30, 2019 06:26 PM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms: - Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
- Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in KB4512578, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps: - Select the Start button and type Services.
- Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
- Locate Startup type: and change it to Manual
- Select Ok
- The TabletInputService service is now in the default configuration and IME should work as expected.
Back to top | OS Build 17763.737
September 10, 2019 KB4512578 | Resolved
| Resolved: September 19, 2019 04:08 PM PT
Opened: September 13, 2019 05:25 PM PT |
- Windows Mixed Reality Portal users may intermittently receive a 15-5 error codeAfter installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms: - Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps: - Close the Windows Mixed Reality Portal, if it is running.
- Open Task Manager by selecting the Start button and typing Task Manager.
- In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
- You can now open the Windows Mixed Reality Portal.
Next steps: We are working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.678
August 13, 2019 KB4511553 | Mitigated
| Last updated: September 11, 2019 05:32 PM PT
Opened: September 11, 2019 05:32 PM PT |
"
@@ -106,7 +116,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
- Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
- Server: Windows Server 2019
Workaround: To mitigate this issue, press Ctrl+Alt+Delete, then select the Power button in the lower right corner of the screen and select Restart. Your device should now restart normally.
Next steps: We are working on a resolution and will provide an update in an upcoming release. Back to top | OS Build 17763.557
June 11, 2019 KB4503327 | Mitigated
| Last updated: June 14, 2019 04:41 PM PT
Opened: June 14, 2019 04:41 PM PT |
+ Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms: - Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
- Server: Windows Server 2019
Resolution: This issue was resolved in KB4520062. Back to top | OS Build 17763.557
June 11, 2019 KB4503327 | Resolved KB4520062 | Resolved: October 15, 2019 10:00 AM PT
Opened: June 14, 2019 04:41 PM PT |
"
diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml
index 4a9b8d4364..d34418e158 100644
--- a/windows/release-information/status-windows-10-1903.yml
+++ b/windows/release-information/status-windows-10-1903.yml
@@ -64,8 +64,8 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- dGPU occasionally disappear from device manager on Surface Book 2 Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.
See details > | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| October 11, 2019 03:15 PM PT |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | OS Build 18362.357
September 23, 2019 KB4522016 | Resolved KB4517389 | October 08, 2019 10:00 AM PT |
+ dGPU occasionally disappear from device manager on Surface Book 2 Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.
See details > | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| October 18, 2019 04:33 PM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | OS Build 18362.357
September 23, 2019 KB4522016 | Resolved KB4517389 | October 08, 2019 10:00 AM PT |
Audio in games is quiet or different than expected Microsoft has received reports that audio in certain games is quieter or different than expected.
See details > | OS Build 18362.356
September 10, 2019 KB4515384 | Resolved KB4517211 | September 26, 2019 02:00 PM PT |
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.
See details > | OS Build 18362.356
September 10, 2019 KB4515384 | Resolved
| September 19, 2019 04:08 PM PT |
Some users report issues related to the Start menu and Windows Desktop Search A small number of users have reported issues related to the Start menu and Windows Desktop Search.
See details > | OS Build 18362.356
September 10, 2019 KB4515384 | Resolved
| September 19, 2019 04:58 PM PT |
@@ -113,7 +113,7 @@ sections:
- type: markdown
text: "
Details | Originating update | Status | History |
- dGPU occasionally disappear from device manager on Surface Book 2 Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open. To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved. Affected platforms: - Client: Windows 10, version 1903
Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue. The safeguard hold will be removed in the coming weeks. Back to top | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| Resolved: October 11, 2019 03:15 PM PT
Opened: July 12, 2019 04:20 PM PT |
+ dGPU occasionally disappear from device manager on Surface Book 2 Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open. To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved. Affected platforms: - Client: Windows 10, version 1903
Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue. The safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903. Back to top | OS Build 18362.145
May 29, 2019 KB4497935 | Resolved
| Resolved: October 18, 2019 04:33 PM PT
Opened: July 12, 2019 04:20 PM PT |
"
diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
index 3d71ca817a..8102e3efa0 100644
--- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
+++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -60,7 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516048 | Resolved KB4519976 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516048 | Resolved KB4519976 | October 08, 2019 10:00 AM PT |
You may receive an error when opening or using the Toshiba Qosmio AV Center Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.
See details > | August 13, 2019 KB4512506 | Resolved KB4516048 | September 24, 2019 10:00 AM PT |
IA64 and x64 devices may fail to start after installing updates After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.
See details > | August 13, 2019 KB4512506 | Mitigated
| August 17, 2019 12:59 PM PT |
diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
index 378e8da44f..068427814b 100644
--- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
+++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
@@ -60,7 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516041 | Resolved KB4520005 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516041 | Resolved KB4520005 | October 08, 2019 10:00 AM PT |
Windows RT 8.1 devices may have issues opening Internet Explorer 11 On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.
See details > | September 10, 2019 KB4516067 | Resolved KB4516041 | September 24, 2019 10:00 AM PT |
Japanese IME doesn't show the new Japanese Era name as a text input option With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.
See details > | April 25, 2019 KB4493443 | Mitigated
| May 15, 2019 05:53 PM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | January 08, 2019 KB4480963 | Mitigated
| April 25, 2019 02:00 PM PT |
diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml
index fda671a495..9b171c527f 100644
--- a/windows/release-information/status-windows-server-2008-sp2.yml
+++ b/windows/release-information/status-windows-server-2008-sp2.yml
@@ -60,7 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516030 | Resolved KB4520002 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516030 | Resolved KB4520002 | October 08, 2019 10:00 AM PT |
Issues manually installing updates by double-clicking the .msu file You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.
See details > | September 10, 2019 KB4474419 | Mitigated KB4474419 | September 24, 2019 08:17 AM PT |
"
diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml
index 27a39802c2..e05f9d92b9 100644
--- a/windows/release-information/status-windows-server-2012.yml
+++ b/windows/release-information/status-windows-server-2012.yml
@@ -60,7 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary | Originating update | Status | Last updated |
- Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.
See details > | September 24, 2019 KB4516069 | Resolved KB4520007 | October 08, 2019 10:00 AM PT |
+ Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.
See details > | September 24, 2019 KB4516069 | Resolved KB4520007 | October 08, 2019 10:00 AM PT |
Japanese IME doesn't show the new Japanese Era name as a text input option With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.
See details > | April 25, 2019 KB4493462 | Mitigated
| May 15, 2019 05:53 PM PT |
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).
See details > | January 08, 2019 KB4480975 | Mitigated
| April 25, 2019 02:00 PM PT |
diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml
index c6fa6957a7..a41c2b4de0 100644
--- a/windows/release-information/windows-message-center.yml
+++ b/windows/release-information/windows-message-center.yml
@@ -50,6 +50,7 @@ sections:
text: "
Message | Date |
+ October 2019 Windows \"C\" optional release is available.
The October 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release. | October 15, 2019 09:59 AM PT |
Windows 10, version 1703 has reached end of service
Consumer and commercial editions of Windows 10, version 1703 have reached end of service. As devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats, we recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates currently supported versions of Windows 10, see the Windows lifecycle fact sheet. | October 09, 2019 12:00 PM PT |
Take Action: October 2019 security update available for all supported versions of Windows
The October 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate. | October 08, 2019 08:00 AM PT |
Take action: Security update available for all supported versions of Windows
On October 3, 2019, Microsoft expanded delivery of the out-of-band Internet Explorer scripting engine security vulnerability (CVE-2019-1367) update released on September 23, 2019 to Windows Update and Windows Server Update Services (WSUS). This is now a required security update for all supported versions of Windows as it includes the Internet Explorer scripting engine vulnerability mitigation and corrects a recent printing issue some users have experienced. All customers using Windows Update or WSUS will be offered this update automatically. We recommend that you install this update as soon as a possible, then restart your PC to fully apply the mitigations and help secure your devices. As with all cumulative updates, this update supersedes any preceding update. Note: This update does not replace the standard October 2019 monthly security update release, which is scheduled for October 8, 2019. | October 03, 2019 08:00 AM PT |
diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
index fb9a2e4abd..9197e2d07d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
+++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
@@ -16,103 +16,97 @@ localizationpriority: medium
ms.date: 08/20/2018
ms.reviewer:
---
-# Planning an adequate number of Windows Server 2019 Domain Controllers for Windows Hello for Business deployments
+# Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments
**Applies to**
-- Windows 10, version 1703 or later
-- Windows Server, versions 2016 and 2019
-- Hybrid or On-Premises deployment
-- Key trust
+
+- Windows 10, version 1703 or later
+- Windows Server, versions 2016 or later
+- Hybrid or On-Premises deployment
+- Key trust
> [!NOTE]
>There was an issue with key trust on Windows Server 2019. To fix it, refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044).
## How many is adequate
-
-How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged.
+How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged.
-
-Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 and above domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller.
+Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 or later domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers and above. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller.
-
-Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2019) to a deployment of existing domain controllers (Windows Server 2008R2, Windows Server 2012R2 or Windows Server 2016) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario:
+Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding a domain controller that supports public key mapping (in this case Windows Server 2016 or later) to a deployment of existing domain controllers which do not support public key mapping (Windows Server 2008R2, Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario:
-
-Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following:
+Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following:

-
-The environment changes. The first change includes DC1 upgraded to Windows Server 2019 to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following:
+The environment changes. The first change includes DC1 upgraded to Windows Server 2016 or later to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following:

-The Windows Server 2019 domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of the password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2019 domain controller supports public key trust authentication. The Windows Server 2019 domain controller understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2019 domain controller is added, but without deploying Windows Hello for Business to any more clients?
-
+The Windows Server 2016 or later domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2016 and above domain controller supports public key trust authentication. The Windows Server 2016 and above domain controller still understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 or later domain controller is added, but without deploying Windows Hello for Business to any more clients?

-Upgrading another Windows Server 2019 domain controller distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2019, but the number of WHFB clients remains the same.
+Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same.

-Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment.
+Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment.

-You'll notice the distribution did not change. Each Windows Server 2019 domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers.
+You'll notice the distribution did not change. Each Windows Server 2016 or later domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers.
-There are several conclusions here:
-* Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication.
-* Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication.
-* Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication.
-* Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers
-* Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication.
-
-The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers.
+There are several conclusions here:
+- Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication.
+- Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication.
+- Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication.
+- Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers
+- Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication.
+The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers.
## Determining total AS Request load
Each organization needs to have a baseline of the AS request load that occurs in their environment. Windows Server provides the KDC AS Requests performance counter that helps you determine this.
-Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours:
-* A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant
-* The hour you believe initial authentication to be significant
-* And a half-hour after you expect initial authentication to be significant
+Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours:
-For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward.
+- A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant
+- The hour you believe initial authentication to be significant
+- And a half-hour after you expect initial authentication to be significant
+
+For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward.
> [!NOTE]
> To capture all the authentication traffic. Ensure that all computers are powered down to get the most accurate authentication information (computers and services authenticate at first power up--you need to consider this authentication in your evaluation).
-Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experiencing the highest amount of authentication.
-
-Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiply the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent.
+Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experiencing the highest amount of authentication.
-Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller are to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business.
+Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiply the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent.
+
+Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller are to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business.
## Monitoring Authentication
-Using the same methods described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2019. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. It gives you a baseline for your environment to where you can form a statement such as:
-
+Using the same methods described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2016 or newer. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. It gives you a baseline for your environment to where you can form a statement such as:
```"Every n Windows Hello for Business clients results in x percentage of key-trust authentication."```
-Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with this information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment.
+Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with this information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment.
-Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2019 domain controllers. If there is only one Windows Server 2019 domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible.
+Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 or newer domain controllers. If there is only one Windows Server 2016 or newer domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible.
Increasing the number of domain controllers distributes the volume of authentication, but doesn't change it. Therefore, as you add more domain controllers, the burden of authentication, for which each domain controller is responsible, decreases. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on.
## Strategy
+
The simplest strategy you can employ is to upgrade one domain controller and monitor the single domain controller as you continue to phase in new Windows Hello for Business key-trust clients until it reaches a 70 or 80 percent threshold.
-Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environment's designated capacity, you can upgrade another domain controller.
+Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environment's designated capacity, you can upgrade another domain controller.
-Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume.
+Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume.
However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically-configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. It's not the best load balancer, however, it is a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application.
-
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
index 5830eaa9af..8c0c0aa43c 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
@@ -109,10 +109,10 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec
Service location | Microsoft.com DNS record
-|-
-Common URLs for all locations | ```*.blob.core.windows.net``` ```crl.microsoft.com``` ```ctldl.windowsupdate.com``` ```events.data.microsoft.com``` ```notify.windows.com``` ```settings-win.data.microsoft.com ```
-European Union | ```eu.vortex-win.data.microsoft.com``` ```eu-v20.events.data.microsoft.com``` ```winatp-gw-neu.microsoft.com``` ```winatp-gw-weu.microsoft.com```
-United Kingdom | ```uk.vortex-win.data.microsoft.com``` ```uk-v20.events.data.microsoft.com``` ```winatp-gw-uks.microsoft.com``` ```winatp-gw-ukw.microsoft.com```
-United States | ```us.vortex-win.data.microsoft.com``` ```us-v20.events.data.microsoft.com``` ```winatp-gw-cus.microsoft.com``` ```winatp-gw-eus.microsoft.com```
+Common URLs for all locations | ```crl.microsoft.com``` ```ctldl.windowsupdate.com``` ```events.data.microsoft.com``` ```notify.windows.com``` ```settings-win.data.microsoft.com```
+European Union | ```eu.vortex-win.data.microsoft.com``` ```eu-v20.events.data.microsoft.com``` ```usseu1northprod.blob.core.windows.net``` ```usseu1westprod.blob.core.windows.net``` ```winatp-gw-neu.microsoft.com``` ```winatp-gw-weu.microsoft.com``` ```wseu1northprod.blob.core.windows.net``` ```wseu1westprod.blob.core.windows.net```
+United Kingdom | ```uk.vortex-win.data.microsoft.com``` ```uk-v20.events.data.microsoft.com``` ```ussuk1southprod. blob.core.windows.net``` ```ussuk1westprod. blob.core.windows.net``` ```winatp-gw-uks.microsoft.com``` ```winatp-gw-ukw.microsoft.com``` ```wsuk1southprod. blob.core.windows.net``` ```wsuk1westprod. blob.core.windows.net```
+United States | ```us.vortex-win.data.microsoft.com``` ```ussus1eastprod.blob.core.windows.net``` ```ussus1westprod.blob.core.windows.net``` ```ussus2eastprod.blob.core.windows.net``` ```ussus2westprod.blob.core.windows.net``` ```ussus3eastprod.blob.core.windows.net``` ```ussus3westprod.blob.core.windows.net``` ```ussus4eastprod.blob.core.windows.net``` ```ussus4westprod.blob.core.windows.net``` ```us-v20.events.data.microsoft.com``` ```winatp-gw-cus.microsoft.com``` ```winatp-gw-eus.microsoft.com``` ```wsus1eastprod.blob.core.windows.net``` ```wsus1westprod.blob.core.windows.net``` ```wsus2eastprod.blob.core.windows.net``` ```wsus2westprod.blob.core.windows.net```
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md
index 7d87930ea5..8829cf492a 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md
@@ -15,7 +15,6 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
-ms.date: 04/24/2018
---
# Enable Secure Score security controls
@@ -27,7 +26,7 @@ ms.date: 04/24/2018
-Set the baselines for calculating the score of Windows Defender security controls on the Secure Score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
+Set the baselines for calculating the score of security controls on the Secure Score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
>[!NOTE]
>Changes might take up to a few hours to reflect on the dashboard.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md
index 4d70c50373..d0ad0448da 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md
@@ -1,7 +1,7 @@
---
title: See how exploit protection works in a demo
description: See how exploit protection can prevent suspicious behaviors from occurring on specific apps.
-keywords: Exploit protection, exploits, kernel, events, evaluate, demo, try, mitigiation
+keywords: Exploit protection, exploits, kernel, events, evaluate, demo, try, mitigation
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -10,9 +10,9 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
audience: ITPro
-author: levinec
-ms.author: ellevin
-ms.date: 04/02/2019
+author: denisebmsft
+ms.author: deniseb
+ms.date: 10/21/2019
ms.reviewer:
manager: dansimp
---
@@ -23,21 +23,16 @@ manager: dansimp
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices.
-It consists of a number of mitigations that can be applied to either the operating system or an individual app.
-Many of the features that were part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are included in exploit protection.
+[Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the [Enhanced Mitigation Experience Toolkit (EMET)](emet-exploit-protection.md) are included in exploit protection.
-This topic helps you enable exploit protection in audit mode and review related events in Event Viewer.
-You can enable audit mode for certain app-level mitigations to see how they will work in a test environment.
-This lets you see a record of what *would* have happened if you had enabled the mitigation in production.
-You can make sure it doesn't affect your line-of-business apps, and see which suspicious or malicious events occur.
+This article helps you enable exploit protection in audit mode and review related events in Event Viewer. You can enable audit mode to see how mitigation works for certain apps in a test environment. By auditing exploit protection, you can see what *would* have happened if you had enabled exploit protection in your production environment. This way, you can help ensure exploit protection doesn't adversely affect your line-of-business apps, and you can see which suspicious or malicious events occur.
> [!TIP]
> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how exploit protection works.
## Enable exploit protection in audit mode
-You can set mitigations in audit mode for specific programs either by using the Windows Security app or PowerShell.
+You can set mitigation in audit mode for specific programs either by using the Windows Security app or Windows PowerShell.
### Windows Security app
@@ -45,12 +40,12 @@ You can set mitigations in audit mode for specific programs either by using the
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**.
-3. Go to **Program settings** and choose the app you want to apply mitigations to:
+3. Go to **Program settings** and choose the app you want to apply protection to:
1. If the app you want to configure is already listed, click it and then click **Edit**
- 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
- * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
- * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
+ 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app.
+ - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
+ - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
@@ -76,14 +71,14 @@ Where:
* \:
* The mitigation's cmdlet as defined in the following table. Each mitigation is separated with a comma.
- Mitigation | Audit mode cmdlet
--|-
- Arbitrary code guard (ACG) | AuditDynamicCode
- Block low integrity images | AuditImageLoad
- Block untrusted fonts | AuditFont, FontAuditOnly
- Code integrity guard | AuditMicrosoftSigned, AuditStoreSigned
- Disable Win32k system calls | AuditSystemCall
- Do not allow child processes | AuditChildProcess
+ |Mitigation | Audit mode cmdlet |
+|---|---|
+ |Arbitrary code guard (ACG) | AuditDynamicCode |
+ |Block low integrity images | AuditImageLoad
+ |Block untrusted fonts | AuditFont, FontAuditOnly |
+ |Code integrity guard | AuditMicrosoftSigned, AuditStoreSigned |
+ |Disable Win32k system calls | AuditSystemCall |
+ |Do not allow child processes | AuditChildProcess |
For example, to enable Arbitrary Code Guard (ACG) in audit mode for an app named *testing.exe*, run the following command:
@@ -97,14 +92,14 @@ You can disable audit mode by replacing `-Enable` with `-Disable`.
To review which apps would have been blocked, open Event Viewer and filter for the following events in the Security-Mitigations log.
-Feature | Provider/source | Event ID | Description
--|-|-|-
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit
+|Feature | Provider/source | Event ID | Description |
+|---|---|--|---|
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit |
## Related topics
diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md
index 08ab2a0d71..3d3a959ecb 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md
@@ -49,6 +49,9 @@ To add machine tags using API, see [Add or remove machine tags API](add-or-remov
Tags are added to the machine view and will also be reflected on the **Machines list** view. You can then use the **Tags** filter to see the relevant list of machines.
+>[!NOTE]
+> Filtering might not work on tag names that contain parenthesis.
+
You can also delete tags from this view.

diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md
index 56e0d4eeb2..249d6de806 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md
@@ -15,7 +15,7 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
-ms.date: 010/08/2018
+ms.date: 10/08/2018
---
# Manage Microsoft Defender ATP incidents
diff --git a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
index 3395bce7c7..e52e94be42 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
@@ -178,10 +178,11 @@ Here is an example return value:
The following code example demonstrates how to obtain an access token and call the Microsoft Defender ATP API.
```csharp
-AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}/oauth2", tenantId));
+AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}", tenantId));
ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret);
-AuthenticationResult authenticationResult = context.AcquireToken(resource, clientCredentials);
+AuthenticationResult authenticationResult = context.AcquireTokenAsync(detectionsResource, clientCredentials).GetAwaiter().GetResult();
```
+
### Use token to connect to the detections endpoint
```
diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md
index bf3d381bd3..53233130eb 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md
@@ -72,7 +72,7 @@ Event ID | Error Type | Resolution steps
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```. Verify that the script was ran as an administrator.
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
-15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
+15 | Failed to start SENSE service | If the message of the error is: System error 577 or error 1058 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location ```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```. The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
@@ -180,7 +180,7 @@ There are additional components on the machine that the Microsoft Defender ATP a
### Ensure the diagnostic data service is enabled
-If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
+If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
@@ -248,7 +248,7 @@ If the verification fails and your environment is using a proxy to connect to th
### Ensure that Windows Defender Antivirus is not disabled by a policy
**Problem**: The Microsoft Defender ATP service does not start after onboarding.
-**Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service.
+**Symptom**: Onboarding successfully completes, but you see error 577 or error 1058 when trying to start the service.
**Solution**: If your machines are running a third-party antimalware client, the Microsoft Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
index 10cc42c9f3..f76c49cd91 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
@@ -9,83 +9,83 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-ms.date: 09/03/2018
+author: denisebmsft
+ms.author: deniseb
+ms.date: 10/18/2019
ms.reviewer:
manager: dansimp
+ms.custom: nextgen
---
# Manage the sources for Windows Defender Antivirus protection updates
**Applies to:**
-- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+- [Microsoft Defender Advanced Threat Protection](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-There are two components to managing protection updates - where the updates are downloaded from, and when updates are downloaded and applied.
+Keeping your antivirus protection up to date is critical. There are two components to managing protection updates for Windows Defender Antivirus:
+- *Where* the updates are downloaded from; and
+- *When* updates are downloaded and applied.
-This topic describes where you can specify the updates should be downloaded from, also known as the fallback order.
+This article describes the *where* - how to specify where updates should be downloaded from (this is also known as the fallback order). See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).
+
+> [!IMPORTANT]
+> Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
-See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).
-There are five locations where you can specify where an endpoint should obtain updates. Typically, you would configure endpoints to individually download the updates from a primary source, followed by the other sources in order of priority based on your network configuration.
+## Fallback order
-Updates will be obtained from the sources in the order you specify. If a source is not available, the next source in the list will be used.
+Typically, you configure endpoints to individually download updates from a primary source, followed by other sources in order of priority, based on your network configuration. Updates are obtained from sources in the order you specify. If a source is not available, the next source in the list is used.
-You can use the following sources:
+When updates are published, some logic is applied to minimize the size of the update. In most cases, only the differences between the latest update and the update that is currently installed (this is referred to as the delta) on the device is downloaded and applied. However, the size of the delta depends on two main factors:
+- The age of the last update on the device; and
+- The source used to download and apply updates.
+The older the updates on an endpoint, the larger the download will be. However, you must also consider download frequency as well. A more frequent update schedule can result in more network usage, whereas a less-frequent schedule can result in larger file sizes per download.
-- Microsoft Update
-- [Windows Server Update Service (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx)
-- System Center Configuration Manager
-- A network file share
-- The [Microsoft Malware Protection Center Security intelligence page (MMPC)](https://www.microsoft.com/security/portal/definitions/adl.aspx)
+There are five locations where you can specify where an endpoint should obtain updates:
+- [Microsoft Update](https://support.microsoft.com/help/12373/windows-update-faq)
+- [Windows Server Update Service](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus)
+- [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/servers/manage/updates)
+- [Network file share](https://docs.microsoft.com/windows-server/storage/nfs/nfs-overview)
+- [Security intelligence updates for Windows Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates) (Your policy and registry might have this listed as Microsoft Malware Protection Center (MMPC) security intelligence, its former name.)
-When updates are published, some logic will be applied to minimize the size of the update. In most cases, only the "delta" (or the differences between the latest update and the update that is currently installed on the endpoint) will be downloaded and applied. However, the size of the delta depends on:
-
-- How old the current update on the endpoint is
-- Which source you use
-
-
-The older the updates on an endpoint, the larger the download. However, you must also consider frequency versus size - a more frequent update schedule may result in more ad hoc network usage, while a less-frequent schedule may result in larger file sizes.
-
-Microsoft Update allows for rapid releases, which means it will download small deltas on a frequent basis. This ensures the best protection, but may increase network bandwidth.
-
-The WSUS, Configuration Manager, and MMPC sources will deliver less frequent updates. The size of the updates may be slightly larger than the frequent release from Microsoft Update (as the delta, or differences between the latest version and what is on the endpoint will be larger). This ensures consistent protection without increasing ad hoc network usage (although the amount of data may be the same or increased as the updates will be fewer, but may be slightly larger).
+To ensure the best level of protection, Microsoft Update allows for rapid releases, which means smaller downloads on a frequent basis. The Windows Server Update Service, System Center Configuration Manager, and Microsoft security intelligence updates sources deliver less frequent updates. Thus, the delta can be larger, resulting in larger downloads.
> [!IMPORTANT]
-> If you have set MMPC as a fallback source after WSUS or Microsoft Update, updates will only be downloaded from MMPC when the current update is considered to be out-of-date (by default, this is 14 consecutive days of not being able to apply updates from the WSUS or Microsoft Update services).
-> You can, however, [set the number of days before protection is reported as out-of-date](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).
+> If you have set [Microsoft Malware Protection Center Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) (MMPC) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates when the current update is considered out-of-date. (By default, this is 14 consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services).
+> You can, however, [set the number of days before protection is reported as out-of-date](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).
+> Starting Monday, October 21, 2019, security intelligence updates will be SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table:
-Location | Sample scenario
----|---
-WSUS | You are using WSUS to manage updates for your network.
-Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use WSUS to manage your updates.
-File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.
-Configuration Manager | You are using System Center Configuration Manager to update your endpoints.
-MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from WSUS or Microsoft Update for [a specified number of days](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).
+|Location | Sample scenario |
+|---|---|
+|Windows Server Update Service | You are using Windows Server Update Service to manage updates for your network.|
+|Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use Windows Server Update Service to manage your updates.|
+|File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.|
+|System Center Configuration Manager | You are using System Center Configuration Manager to update your endpoints.|
+|Security intelligence updates for Windows Defender Antivirus and other Microsoft antimalware (formerly referred to as MMPC) |[Make sure your devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update, and starting Monday October 21, 2019 security intelligence updates will be SHA-2 signed exclusively. Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).|
You can manage the order in which update sources are used with Group Policy, System Center Configuration Manager, PowerShell cmdlets, and WMI.
> [!IMPORTANT]
-> If you set WSUS as a download location, you must approve the updates - regardless of what management tool you use to specify the location. You can set up an automatic approval rule with WSUS, which may be useful as updates arrive at least once a day. See [To synchronize endpoint protection updates in standalone WSUS](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) for more details.
+> If you set Windows Server Update Service as a download location, you must approve the updates, regardless of the management tool you use to specify the location. You can set up an automatic approval rule with Windows Server Update Service, which might be useful as updates arrive at least once a day. To learn more, see [synchronize endpoint protection updates in standalone Windows Server Update Service](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus).
The procedures in this article first describe how to set the order, and then how to set up the **File share** option if you have enabled it.
-**Use Group Policy to manage the update location:**
+## Use Group Policy to manage the update location
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**.
2. In the **Group Policy Management Editor** go to **Computer configuration**.
@@ -103,7 +103,7 @@ The procedures in this article first describe how to set the order, and then how
4. Double-click the **Define file shares for downloading security intelligence updates** setting and set the option to **Enabled**.
- 5. Enter the file share source. If you have multiple sources, enter each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](https://msdn.microsoft.com/library/gg465305.aspx) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you do not enter any paths then this source will be skipped when the VM downloads updates.
+ 5. Enter the file share source. If you have multiple sources, enter each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](https://docs.microsoft.com/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you do not enter any paths then this source will be skipped when the VM downloads updates.
6. Click **OK**. This will set the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting.
@@ -111,12 +111,12 @@ The procedures in this article first describe how to set the order, and then how
> For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Windows Defender Antivirus > Signature Updates**
> For Windows 10, version 1903, the policy path is **Windows Components > Windows Defender Antivirus > Security Intelligence Updates**
-**Use Configuration Manager to manage the update location:**
+## Use Configuration Manager to manage the update location
See [Configure Security intelligence Updates for Endpoint Protection](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-definition-updates) for details on configuring System Center Configuration Manager (current branch).
-**Use PowerShell cmdlets to manage the update location:**
+## Use PowerShell cmdlets to manage the update location
Use the following PowerShell cmdlets to set the update order.
@@ -125,14 +125,14 @@ Set-MpPreference -SignatureFallbackOrder {LOCATION|LOCATION|LOCATION|LOCATION}
Set-MpPreference -SignatureDefinitionUpdateFileSharesSource {\\UNC SHARE PATH|\\UNC SHARE PATH}
```
See the following for more information:
-- [Set-MpPreference -SignatureFallbackOrder](https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference#-signaturefallbackorder)
+- [Set-MpPreference -SignatureFallbackOrder](https://docs.microsoft.com/powershell/module/defender/set-mppreference)
- [Set-MpPreference -SignatureDefinitionUpdateFileSharesSource](https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference#-signaturedefinitionupdatefilesharessources)
- [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md)
-- [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx)
+- [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index)
-**Use Windows Management Instruction (WMI) to manage the update location:**
+## Use Windows Management Instruction (WMI) to manage the update location
-Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
+Use the [**Set** method of the **MSFT_MpPreference**](https://docs.microsoft.com/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties:
```WMI
SignatureFallbackOrder
@@ -140,21 +140,14 @@ SignatureDefinitionUpdateFileSharesSource
```
See the following for more information:
-- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
+- [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal)
-**Use Mobile Device Management (MDM) to manage the update location:**
+## Use Mobile Device Management (MDM) to manage the update location
See [Policy CSP - Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-signatureupdatefallbackorder) for details on configuring MDM.
-
-
-
-
-
-
-
-## Related topics
+## Related articles
- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md
index 8324650680..6a39c1dd9a 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md
@@ -36,7 +36,7 @@ With Tamper Protection, malicious apps are prevented from taking actions like th
## How it works
- Tamper Protection essentially locks Microsoft Defender and prevents your security settings from being changed through apps and methods like these:
+ Tamper Protection essentially locks Windows Defender Antivirus and prevents your security settings from being changed through apps and methods like these:
- Configuring settings in Registry Editor on your Windows machine
- Changing settings through PowerShell cmdlets
- Editing or removing security settings through group policies
@@ -70,16 +70,16 @@ If you are a home user, or you are not subject to settings managed by a security
## Turn Tamper Protection on (or off) for your organization using Intune
-If you are part of your organization's security team, you can turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). (This feature is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender ATP](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) and that you meet the prerequisites listed below.)
+If you are part of your organization's security team, you can turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). (This feature is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) (Microsoft Defender ATP) and that you meet the prerequisites listed below.)
You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task.
1. Make sure your organization meets the following requirements:
- - Your organization must have [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in Microsoft 365 E5. See [Microsoft 365 Enterprise overview](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview) for more details.)
+ - Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in Microsoft 365 E5. See [Microsoft 365 Enterprise overview](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview) for more details.)
- Your organization's devices must be managed by [Intune](https://docs.microsoft.com/intune/device-management-capabilities).
- Your Windows machines must be running [Windows OS 1903](https://docs.microsoft.com/windows/release-information/status-windows-10-1903) or later.
- - You must be using Windows security and update [security intelligence](https://www.microsoft.com/wdsi/definitions) to version 1.287.60.0 (or above)
+ - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above)
- Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). (See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md).)
2. Go to the Microsoft 365 Device Management portal ([https://devicemanagement.microsoft.com](https://devicemanagement.microsoft.com)) and sign in with your work or school account.
@@ -108,7 +108,7 @@ No
No, third-party antivirus will continue to register with the Windows Security application.
-### What happens if Microsoft Defender is not active on a device?
+### What happens if Microsoft Defender Antivirus is not active on a device?
Tamper Protection will not have any impact on such devices.
@@ -116,14 +116,14 @@ Tamper Protection will not have any impact on such devices.
If you are a home user, see [Turn Tamper Protection on (or off) for an individual machine](#turn-tamper-protection-on-or-off-for-an-individual-machine).
-If you are an organization using [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage Tamper Protection in Intune similar to how you manage other endpoint protection features. See [Turn Tamper Protection on (or off) for your organization using Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune).
+If you are an organization using [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage Tamper Protection in Intune similar to how you manage other endpoint protection features. See [Turn Tamper Protection on (or off) for your organization using Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune).
-### How does configuring Tamper Protection in Intune affect how I manage Windows Defender through my group policy?
+### How does configuring Tamper Protection in Intune affect how I manage Windows Defender Antivirus through my group policy?
-Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender settings will be ignored when Tamper Protection is on.
+Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.
-### For Microsoft Defender Advanced Threat Protection E5, is configuring Tamper Protection in Intune targeted to the entire organization only?
+### For Microsoft Defender ATP E5, is configuring Tamper Protection in Intune targeted to the entire organization only?
Configuring Tamper Protection in Intune can be targeted to your entire organization as well as to devices and user groups with Intune.
@@ -135,7 +135,7 @@ Currently we do not have support to manage Tamper Protection through System Cent
Currently, configuring Tamper Protection in Intune is only available for customers who have [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp).
-### What happens if I try to change Microsoft Defender settings in Intune, System Center Configuration Manager, and Windows Management Instrumentation when Tamper Protection is enabled on a device?
+### What happens if I try to change Microsoft Defender ATP settings in Intune, System Center Configuration Manager, and Windows Management Instrumentation when Tamper Protection is enabled on a device?
You won’t be able to change the features that are protected by Tamper Protection; those change requests are ignored.
@@ -143,11 +143,11 @@ You won’t be able to change the features that are protected by Tamper Protecti
No. Local admins cannot change or modify Tamper Protection settings.
-### What happens if my device is onboarded with Microsoft Defender Advanced Threat Protection and then goes into an off-boarded state?
+### What happens if my device is onboarded with Microsoft Defender ATP and then goes into an off-boarded state?
In this case, Tamper Protection status changes, and this feature is no longer applied.
-### Will there be an alert about Tamper Protection status changing in the Microsoft Defender Advanced Threat Protection portal?
+### Will there be an alert about Tamper Protection status changing in the Microsoft Defender Security Center?
Yes. The alert is shown in [https://securitycenter.microsoft.com](https://microsoft.securitycenter.com) under **Alerts**.
@@ -167,4 +167,4 @@ No.
[Microsoft 365 Enterprise overview (at a glance)](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview#at-a-glance)
-[Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)
+[Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
index f4224a60a4..6327898e26 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
@@ -1,5 +1,5 @@
---
-title: Windows Defender Antivirus
+title: Next-generation protection in Windows 10 and Windows Server 2016
description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10 and Windows Server 2016
keywords: windows defender antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security
search.product: eADQiWindows 10XVcnh
@@ -9,50 +9,44 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-ms.date: 06/11/2019
+author: denisebmsft
+ms.author: deniseb
+ms.date: 10/14/2019
ms.reviewer:
manager: dansimp
---
-# Next Generation Protection in Windows 10 and Windows Server 2016
+# Next-generation protection in Windows 10 and Windows Server 2016
**Applies to:**
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-Next-gen protection provides enhanced safety, alongside more traditional security measures. Next-gen services use machine learning and the cloud to keep all devices on your enterprise network safe.
-
-Next-gen protection services include:
+Next-generation protection includes services that use machine learning together with the cloud to protect devices in your enterprise organization. Next-generation protection services include:
- [Always-on scanning](configure-real-time-protection-windows-defender-antivirus.md), also known as "real-time protection", for advanced file and process behavior monitoring
- [Cloud-based delivery](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for near-instant detection and blocking of new and emerging threats
- [Dedicated protection updates](manage-updates-baselines-windows-defender-antivirus.md) powered by machine-learning, big-data analysis, and in-depth threat resistance research
>[!TIP]
->You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
->
->- Cloud-delivered protection
->- Fast learning (including Block at first sight)
->- Potentially unwanted application blocking
+>Visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how the following features work:
+>- [Cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
+>- Fast learning (including [block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md))
+>- [Potentially unwanted application blocking](detect-block-potentially-unwanted-apps-windows-defender-antivirus.md)
> [!NOTE]
> For more information regarding what's new in each Windows version, please refer to [What's new in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp).
-
## Minimum system requirements
-Windows Defender Antivirus is our main vehicle for next-gen protection.
+Windows Defender Antivirus is your main vehicle for next-generation protection, and it has the same hardware requirements as Windows 10. For more information, see:
-It has the same hardware requirements as Windows 10. For more information, see:
+- [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview)
+- [Hardware component guidelines](https://docs.microsoft.com/windows-hardware/design/component-guidelines/components)
-- [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086.aspx)
-- [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049.aspx)
+## Configuring Next-generation services
-## Configuring next-gen services
-
-You can use the following to configure and manage next-gen services in Windows 10, while running Windows Defender Antivirus:
+You can use the following to configure and manage next-generation services in Windows 10 while running Windows Defender Antivirus:
- System Center Configuration Manager (as System Center Endpoint Protection, or SCEP)
- Microsoft Intune
@@ -60,13 +54,7 @@ You can use the following to configure and manage next-gen services in Windows 1
- Windows Management Instrumentation (WMI)
- Group Policy
-Configuration and management is largely the same in Windows Server 2016, while running Windows Defender Antivirus; however, [there are some differences](windows-defender-antivirus-on-windows-server-2016.md).
-
->[!TIP]
->You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
->- Cloud-delivered protection
->- Fast learning (including Block at first sight)
->- Potentially unwanted application blocking
+Configuration and management is largely the same in Windows Server 2016, while running Windows Defender Antivirus; however, there are some differences. To learn more, see [Windows Defender Antivirus on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md).
## Related topics
|