The data type is boolean. Supported operation is Get and Replace. **InBoxApps/Welcome/CurrentBackgroundPath** -
Background image for the welcome screen. To set this, specify an https URL to a PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image. +
Download location for image to be used as the background during user sessions and on the welcome screen. To set this, specify an https URL to a PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image.
The data type is string. Supported operation is Get and Replace. @@ -316,12 +316,12 @@ SurfaceHub
Invitations to collaborate from the Whiteboard app are not allowed.
The data type is boolean. Supported operation is Get and Replace. - + **InBoxApps/Whiteboard/SigninDisabled**
Sign-ins from the Whiteboard app are not allowed.
The data type is boolean. Supported operation is Get and Replace. - + **InBoxApps/Whiteboard/TelemeteryDisabled**
Telemetry collection from the Whiteboard app is not allowed. @@ -571,7 +571,7 @@ SurfaceHub
If this setting is true, the device account will be used for proxy authentication. If false, a separate account will be used.
The data type is boolean. Supported operation is Get and Replace. - + **Properties/ProxyServers**
Added in KB4499162 for Windows 10, version 1703. Specifies FQDNs of proxy servers to provide device account credentials to before any user interaction (if AllowAutoProxyAuth is enabled). This is a semi-colon separated list of server names, without any additional prefixes (e.g. https://). diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 793835661a..183335b55e 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -481,7 +481,7 @@ For a spreadsheet of Group Policy settings included in Windows 10 and Windows Se ## New MDM policies -Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile includes settings from Windows Phone 8.1, plus new or enhanced settings for Windows 10, such as: +Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education includes settings from Windows Phone 8.1, plus new or enhanced settings for Windows 10, such as: - Defender (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education only) diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 633939454a..faba5b0483 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -55,6 +55,12 @@ items: items: - name: Collect data using Network Monitor href: troubleshoot-tcpip-netmon.md + - name: "Part 1: TCP/IP performance overview" + href: /troubleshoot/windows-server/networking/overview-of-tcpip-performance + - name: "Part 2: TCP/IP performance underlying network issues" + href: /troubleshoot/windows-server/networking/troubleshooting-tcpip-performance-underlying-network + - name: "Part 3: TCP/IP performance known issues" + href: /troubleshoot/windows-server/networking/tcpip-performance-known-issues - name: Troubleshoot TCP/IP connectivity href: troubleshoot-tcpip-connectivity.md - name: Troubleshoot port exhaustion diff --git a/windows/client-management/troubleshoot-tcpip.md b/windows/client-management/troubleshoot-tcpip.md index 48a95cd4e0..1ffd3f1dc2 100644 --- a/windows/client-management/troubleshoot-tcpip.md +++ b/windows/client-management/troubleshoot-tcpip.md @@ -17,6 +17,9 @@ manager: dansimp In these topics, you will learn how to troubleshoot common problems in a TCP/IP network environment. - [Collect data using Network Monitor](troubleshoot-tcpip-netmon.md) +- [Part 1: TCP/IP performance overview](/troubleshoot/windows-server/networking/overview-of-tcpip-performance) +- [Part 2: TCP/IP performance underlying network issues](/troubleshoot/windows-server/networking/troubleshooting-tcpip-performance-underlying-network) +- [Part 3: TCP/IP performance known issues](/troubleshoot/windows-server/networking/tcpip-performance-known-issues) - [Troubleshoot TCP/IP connectivity](troubleshoot-tcpip-connectivity.md) - [Troubleshoot port exhaustion issues](troubleshoot-tcpip-port-exhaust.md) - [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md) diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index 3b6738986f..3ed83421c9 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -145,7 +145,7 @@ If the computer is no longer frozen and now is running in a good state, use the Use the Dump Check Utility (Dumpchk.exe) to read a memory dump file or verify that the file was created correctly. You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that the memory dump files are not corrupted or invalid. -- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) +- [Using DumpChk](/windows-hardware/drivers/debugger/dumpchk) - [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) Learn how to use Dumpchk.exe to check your dump files: diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md deleted file mode 100644 index dda6ed1f76..0000000000 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ /dev/null @@ -1,1090 +0,0 @@ ---- -title: Windows 10 Mobile deployment and management guide (Windows 10) -description: This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. -ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E -ms.reviewer: -manager: dansimp -ms.author: dansimp -keywords: Mobile, diagnostic data, BYOD, MDM -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: mobile, devices, security -ms.localizationpriority: medium -author: dansimp -ms.date: -ms.topic: article ---- - -# Windows 10 Mobile deployment and management guide - -**Applies to:** -- Windows 10 Mobile, version 1511 and Windows 10 Mobile, version 1607 - -This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. - -Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. -Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement, by using a comprehensive mobile device management solution. - -**In this article** -- [Deploy](#deploy) -- [Configure](#configure) -- [Apps](#apps) -- [Manage](#manage) -- [Retire](#retire) - - -## Deploy - -Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which mobile device management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. -Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select the system that best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](./mdm/index.md). - -### Deployment scenarios - -*Applies to: Corporate and personal devices* - -The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. - -Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. -Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Microsoft Store for Business, or by using their MDM system, which can also work with the Microsoft Store for Business for public store apps. -Knowing who owns the device and what the employee uses it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. - -For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. - -For **corporate devices**, organizations have a lot more control. IT can provide a selected list of supported device models to employees, or they can directly purchase and preconfigure them. Because devices are owned by the company, employees can be limited as to how much they can personalize these devices. Security and privacy concerns may be easier to navigate, because the device falls entirely under existing company policy. - -### Device enrollment - -*Applies to: Corporate and personal devices* - -The way in which personal and corporate devices are enrolled into an MDM system differs. Your operations team should consider these differences when determining which approach is best for mobile workers in your organization. - -**Device initialization and enrollment considerations** - -
| - | Personal devices | -Corporate devices | -
|---|---|---|
| Ownership | -Employee | -Organization | -
| Device Initialization - -In the out-of-box experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device. | -The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. | -The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). -Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory (Azure AD) organizational identity. -Skipping the account setup in OOBE results in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device must be reset. - | -
| Device Enrollment - -Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. | -Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+Azure AD+MDM). If your organization does not have Azure AD, the employee’s device is automatically enrolled into your organization’s MDM system (MSA+MDM). -MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). - | -The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (Azure AD+MDM). | -
| - | Personal identity | -Work identity | -
| First account on the device | -Microsoft Account | -Azure AD account | -
| Ease of enrollment | -Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+Azure AD+MDM). | -Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (Azure AD+MDM – requires Azure AD Premium). | -
| Credential management | -Employees sign in to the device with Microsoft Account credentials. -Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft Account. - | -Employees sign in to the device with Azure AD credentials. -IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. - | -
| Ability to block the use of a personal identity on the device | -No | -Yes | -
| User settings and data roaming across multiple Windows devices | -User and app settings roam across all devices activated with the same personal identity through OneDrive. | -If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD-joined device, this is not the case. Microsoft is investigating Enterprise roaming for a future release. | -
| Level of control | -Organizations can apply most of the available restrictive policies to devices and disable the Microsoft account. You can prevent users from reclaiming full control over their devices by unenrolling them from the organization’s MDM solution or resetting the device. Legal limitations may apply. For more information, contact your legal department. | -Organizations are free to apply any restrictive policies to devices to bring them in line with corporate standards and compliance regulations. They can also prevent the user from unenrolling the device from the enterprise. | -
| Information Protection | -You can apply policies to help protect and contain corporate apps and data on the devices and prevent intellectual property leaks, but still provide employees with full control over personal activities like downloading and installing apps and games. | -Companies can block personal use of devices. Using organizational identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization. | -
| App purchases | -Employees can purchase and install apps from the Store using a personal credit card. | -Employees can install apps from your Store for Business. Employees cannot install or purchase app from the Store without the addition of an MSA. | -
| Branch | -Version | -Release Date | -
| Current Branch | -1511 | -November 2015 | -
| Current Branch for Business | -1511 | -March 2016 | -
| Current Branch | -1607 | -July 2016 | -
| Network connection | -Description | -Auto Scan | -Auto Download | -Auto Install | -Auto Restart | -
| Wi-Fi | -Device is connected to a personal or corporate Wi-Fi network (no data charges) | -Yes | -Yes/td> - | Yes | -Yes – outside of Active Hours (forced restart after 7 days if user postpones restart) | -
| Cellular | -Device is only connected to a cellular network (standard data charges apply) | -Skips a daily scan if scan was successfully completed in the last 5 days | -Only occurs if update package is small and does not exceed the mobile operator data limit. | -Yes | -Idem | -
| Cellular -- Roaming | -Device is only connected to a cellular network and roaming charges apply | -No | -No | -No | -Idem | -
| Servicing option | -Availability of new features for installation | -Minimum length of servicing lifetime | -Key benefits | -Supported editions | -
| Windows Insider Builds | -As appropriate during development cycle, released to Windows Insiders only | -Variable, until the next Insider build is released to Windows Insiders | -Allows Insiders to test new feature and application compatibility before a Feature Update is released/td> - | Mobile | -
| Current Branch (CB) | -Immediately after the Feature Update is published to Windows Update by Microsoft | -Microsoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer) | -Makes new features available to users as soon as possible | -|
| Current Branch for Business (CBB) | -A minimum of four months after the corresponding Feature Update is first published to Windows Update by Microsoft | -A minimum of four months, though it potentially can be longerNo | -Provides additional time to test new feature before deployment | -
| Activity (Policy) | -Version 1511 settings | -Version 1607 settings | -
| Subscribe device to CBB, to defer Feature Updates | -RequireDeferUpgrade - -Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). -Defers feature update for minimum of 4 months after Current Branch was release. | -BranchReadinessLevel - -Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). -Defers feature update for minimum of 4 months after Current Branch was release. |
| Defer Updates | -DeferUpdatePeriod - -Defer Quality Updates for 4 weeks or 28 days | -DeferQualityUpdatePeriodInDays - -Defer Feature and Quality Updates for up to 30 days. |
| Approve Updates | -RequireUpdateApproval - - | -RequireUpdateApproval - - | -
| Pause Update rollout once an approved update is being deployed, pausing the rollout of the update. | -PauseDeferrals - -Pause Feature Updates for up to 35 days | -PauseQualityUpdates - -Pause Feature Updates for up to 35 days | -
Well-Known SID/RID
S-1-5-21-<domain>-1000
S-1-5-21-<domain>-<variable RID>
Type
Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|If one authentication method is required, the other methods cannot be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.| +|**When enabled**|Users can configure advanced startup options in the BitLocker Setup Wizard.| +|**When disabled or not configured**|Users can configure only basic options on computers with a TPM.
Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.| **Reference** @@ -197,15 +197,15 @@ There are four options for TPM-enabled computers or devices: This policy setting permits the use of enhanced PINs when you use an unlock method that includes a PIN. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.| -|When disabled or not configured|Enhanced PINs will not be used.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.| +|**When disabled or not configured**|Enhanced PINs will not be used.| **Reference** @@ -218,15 +218,15 @@ Enhanced startup PINs permit the use of characters (including uppercase and lowe This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.| -|When disabled or not configured|Users can configure a startup PIN of any length between 6 and 20 digits.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.| +|**When disabled or not configured**|Users can configure a startup PIN of any length between 6 and 20 digits.| **Reference** @@ -255,15 +255,15 @@ If the minimum PIN length is reduced from the default of six characters, then th This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI ports until a user signs in to Windows. -| | | -|---------|---------| -|Policy description|This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys.| -|Introduced|Windows 10, version 1703| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|Every time the user locks the scree, DMA will be blocked on hot pluggable PCI ports until the user signs in again.| -|When disabled or not configured|DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| +| | | +|:---|:---| +|**Policy description**|This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys.| +|**Introduced**|Windows 10, version 1703| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|Every time the user locks the scree, DMA will be blocked on hot pluggable PCI ports until the user signs in again.| +|**When disabled or not configured**|DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| **Reference** @@ -273,15 +273,15 @@ This policy setting is only enforced when BitLocker or device encryption is enab This policy setting allows you to configure whether standard users are allowed to change the PIN or password that is used to protect the operating system drive. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|Standard users are not allowed to change BitLocker PINs or passwords.| -|When disabled or not configured|Standard users are permitted to change BitLocker PINs or passwords.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|Standard users are not allowed to change BitLocker PINs or passwords.| +|**When disabled or not configured**|Standard users are permitted to change BitLocker PINs or passwords.| **Reference** @@ -291,15 +291,15 @@ To change the PIN or password, the user must be able to provide the current PIN This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|Passwords cannot be used if FIPS-compliance is enabled.
**NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.|
-|When enabled|Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select **Require complexity**.|
-|When disabled or not configured|The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|Passwords cannot be used if FIPS-compliance is enabled.
**NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.|
+|**When enabled**|Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select **Require complexity**.|
+|**When disabled or not configured**|The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.|
**Reference**
@@ -321,15 +321,15 @@ When this policy setting is enabled, you can set the option **Configure password
This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.|
-|Introduced|Windows Server 2008 and Windows Vista|
-|Drive type|Operating system drives (Windows Server 2008 and Windows Vista)|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|If you choose to require an additional authentication method, other authentication methods cannot be allowed.|
-|When enabled|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.|
-|When disabled or not configured|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.|
+|**Introduced**|Windows Server 2008 and Windows Vista|
+|**Drive type**|Operating system drives (Windows Server 2008 and Windows Vista)|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|If you choose to require an additional authentication method, other authentication methods cannot be allowed.|
+|**When enabled**|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.|
+|**When disabled or not configured**|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.|
**Reference**
@@ -358,16 +358,16 @@ To hide the advanced page on a TPM-enabled computer or device, set these options
This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Fixed data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
-|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.|
-|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on fixed data drives** check box.|
-|When disabled|Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.|
-|When not configured|Smart cards can be used to authenticate user access to a BitLocker-protected drive.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Fixed data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
+|**Conflicts**|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.|
+|**When enabled**|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on fixed data drives** check box.|
+|**When disabled**|Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.|
+|**When not configured**|Smart cards can be used to authenticate user access to a BitLocker-protected drive.|
**Reference**
@@ -378,16 +378,16 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
This policy setting is used to require, allow, or deny the use of passwords with fixed data drives.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Fixed data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
-|Conflicts|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.|
-|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.|
-|When disabled|The user is not allowed to use a password.|
-|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Fixed data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
+|**Conflicts**|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.|
+|**When enabled**|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.|
+|**When disabled**|The user is not allowed to use a password.|
+|**When not configured**|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.|
**Reference**
@@ -414,16 +414,16 @@ Enabling this policy setting requires that connectivity to a domain be establish
This policy setting is used to require, allow, or deny the use of smart cards with removable data drives.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Removable data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
-|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.|
-|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on removable data drives** check box.|
-|When disabled or not configured|Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.|
-|When not configured|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Removable data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
+|**Conflicts**|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.|
+|**When enabled**|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on removable data drives** check box.|
+|**When disabled or not configured**|Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.|
+|**When not configured**|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.|
**Reference**
@@ -434,16 +434,17 @@ This policy setting is used to require, allow, or deny the use of smart cards wi
This policy setting is used to require, allow, or deny the use of passwords with removable data drives.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Removable data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
-|Conflicts|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.|
-|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.|
-|When disabled|The user is not allowed to use a password.|
-|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Removable data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
+|**Conflicts**|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.|
+|**When enabled**|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.|
+|**When disabled**|The user is not allowed to use a password.|
+|**When not configured**|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.|
+
**Reference**
If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at
@@ -469,15 +470,15 @@ For information about this setting, see [System cryptography: Use FIPS-compliant
This policy setting is used to determine what certificate to use with BitLocker.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Fixed and removable data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
-|Conflicts|None|
-|When enabled|The object identifier that is specified in the **Object identifier** setting must match the object identifier in the smart card certificate.|
-|When disabled or not configured|The default object identifier is used.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Fixed and removable data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
+|**Conflicts**|None|
+|**When enabled**|The object identifier that is specified in the **Object identifier** setting must match the object identifier in the smart card certificate.|
+|**When disabled or not configured**|The default object identifier is used.|
**Reference**
@@ -494,15 +495,15 @@ The default object identifier is 1.3.6.1.4.1.311.67.1.1.
This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Operating system drive|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive|
-|Conflicts|None|
-|When enabled|Devices must have an alternative means of preboot input (such as an attached USB keyboard).|
-|When disabled or not configured|The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drive|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive|
+|**Conflicts**|None|
+|**When enabled**|Devices must have an alternative means of preboot input (such as an attached USB keyboard).|
+|**When disabled or not configured**|The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.|
**Reference**
@@ -522,15 +523,15 @@ If you do not enable this policy setting, the following options in the **Require
This policy setting is used to require encryption of fixed drives prior to granting Write access.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Fixed data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
-|Conflicts|See the Reference section for a description of conflicts.|
-|When enabled|All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.|
-|When disabled or not configured|All fixed data drives on the computer are mounted with Read and Write access.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Fixed data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
+|**Conflicts**|See the Reference section for a description of conflicts.|
+|**When enabled**|All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.|
+|**When disabled or not configured**|All fixed data drives on the computer are mounted with Read and Write access.|
**Reference**
@@ -550,15 +551,15 @@ Conflict considerations include:
This policy setting is used to require that removable drives are encrypted prior to granting Write access, and to control whether BitLocker-protected removable drives that were configured in another organization can be opened with Write access.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Removable data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
-|Conflicts|See the Reference section for a description of conflicts.|
-|When enabled|All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.|
-|When disabled or not configured|All removable data drives on the computer are mounted with Read and Write access.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Removable data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
+|**Conflicts**|See the Reference section for a description of conflicts.|
+|**When enabled**|All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.|
+|**When disabled or not configured**|All removable data drives on the computer are mounted with Read and Write access.|
**Reference**
@@ -577,16 +578,16 @@ Conflict considerations include:
This policy setting is used to prevent users from turning BitLocker on or off on removable data drives.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can control the use of BitLocker on removable data drives.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Removable data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
-|Conflicts|None|
-|When enabled|You can select property settings that control how users can configure BitLocker.|
-|When disabled|Users cannot use BitLocker on removable data drives.|
-|When not configured|Users can use BitLocker on removable data drives.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can control the use of BitLocker on removable data drives.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Removable data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
+|**Conflicts**|None|
+|**When enabled**|You can select property settings that control how users can configure BitLocker.|
+|**When disabled**|Users cannot use BitLocker on removable data drives.|
+|**When not configured**|Users can use BitLocker on removable data drives.|
**Reference**
@@ -603,15 +604,15 @@ The options for choosing property settings that control how users can configure
This policy setting is used to control the encryption method and cipher strength.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can control the encryption method and strength for drives.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|All drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
-|Conflicts|None|
-|When enabled|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.|
-|When disabled or not configured|Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can control the encryption method and strength for drives.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|All drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
+|**Conflicts**|None|
+|**When enabled**|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.|
+|**When disabled or not configured**|Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.|
**Reference**
@@ -633,16 +634,16 @@ When this policy setting is disabled or not configured, BitLocker will use the d
This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they are used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Fixed data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
-|Conflicts|None|
-|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
-|When disabled|BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
-|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Fixed data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
+|**Conflicts**|None|
+|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
+|**When disabled**|BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
+|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
**Reference**
@@ -658,16 +659,16 @@ The encryption algorithm that is used by hardware-based encryption is set when t
This policy controls how BitLocker reacts when encrypted drives are used as operating system drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Operating system drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|None|
-|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
-|When disabled|BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
-|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|None|
+|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
+|**When disabled**|BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
+|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
**Reference**
@@ -685,16 +686,16 @@ The encryption algorithm that is used by hardware-based encryption is set when t
This policy controls how BitLocker reacts to encrypted drives when they are used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Removable data drive|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
-|Conflicts|None|
-|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
-|When disabled|BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
-|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Removable data drive|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
+|**Conflicts**|None|
+|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.|
+|**When disabled**|BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.|
+|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.|
**Reference**
@@ -712,15 +713,15 @@ The encryption algorithm that is used by hardware-based encryption is set when t
This policy controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Fixed data drive|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
-|Conflicts|None|
-|When enabled|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.|
-|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure the encryption type that is used by BitLocker.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Fixed data drive|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
+|**Conflicts**|None|
+|**When enabled**|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.|
+|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
**Reference**
@@ -735,15 +736,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo
This policy controls whether operating system drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Operating system drive|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|None|
-|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.|
-|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure the encryption type that is used by BitLocker.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drive|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|None|
+|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.|
+|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
**Reference**
@@ -758,15 +759,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo
This policy controls whether fixed data drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Removable data drive|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
-|Conflicts|None|
-|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.|
-|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure the encryption type that is used by BitLocker.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Removable data drive|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
+|**Conflicts**|None|
+|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.|
+|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.|
**Reference**
@@ -781,15 +782,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo
This policy setting is used to configure recovery methods for operating system drives.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Operating system drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.
When using data recovery agents, you must enable the **Provide the unique identifiers for your organization** policy setting.| -|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.| -|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, you must enable the **Provide the unique identifiers for your organization** policy setting.| +|**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| **Reference** @@ -815,15 +816,15 @@ Select the **Do not enable BitLocker until recovery information is stored in AD This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. -||| -|--- |--- | -|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.| -|Introduced|Windows Server 2008 and Windows Vista| -|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the **Do not allow** option for both user recovery options, you must enable the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting to prevent a policy error.| -|When enabled|You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.| -|When disabled or not configured|The BitLocker Setup Wizard presents users with ways to store recovery options.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.| +|**Introduced**|Windows Server 2008 and Windows Vista| +|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the **Do not allow** option for both user recovery options, you must enable the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting to prevent a policy error.| +|**When enabled**|You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.| +|**When disabled or not configured**|The BitLocker Setup Wizard presents users with ways to store recovery options.| **Reference** @@ -844,15 +845,15 @@ Saving the recovery password to a USB drive stores the 48-digit recovery passwor This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. -||| -|--- |--- | -|Policy description|With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.| -|Introduced|Windows Server 2008 and Windows Vista| -|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.| -|When disabled or not configured|BitLocker recovery information is not backed up to AD DS.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.| +|**Introduced**|Windows Server 2008 and Windows Vista| +|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.| +|**When disabled or not configured**|BitLocker recovery information is not backed up to AD DS.| **Reference** @@ -875,15 +876,15 @@ For more information about this setting, see [TPM Group Policy settings](/window This policy setting is used to configure the default folder for recovery passwords. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.| -|Introduced|Windows Vista| -|Drive type|All drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| -|When disabled or not configured|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.| +|**Introduced**|Windows Vista| +|**Drive type**|All drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| +|**When disabled or not configured**|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.| **Reference** @@ -896,15 +897,15 @@ This policy setting is applied when you turn on BitLocker. This policy setting is used to configure recovery methods for fixed data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Fixed data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.
When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| -|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.| -|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Fixed data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| **Reference** @@ -930,16 +931,15 @@ Select the **Do not enable BitLocker until recovery information is stored in AD This policy setting is used to configure recovery methods for removable data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. -When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| -|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.| -|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| **Reference** @@ -962,15 +962,15 @@ Select the **Do not enable BitLocker until recovery information is stored in AD This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.| -|Introduced|Windows 10| -|Drive type|Operating system drives| -|Policy path|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| -|Conflicts|None| -|When enabled|The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the **Use default recovery message and URL** option.| -|When disabled or not configured|If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.| +|**Introduced**|Windows 10| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| +|**Conflicts**|None| +|**When enabled**|The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the **Use default recovery message and URL** option.| +|**When disabled or not configured**|If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| **Reference** @@ -992,15 +992,15 @@ Once you enable the setting you have three options: This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|All drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.
For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| -|When enabled or not configured|BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.| -|When disabled|BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.| +| | | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|All drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.
For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.|
+|**When enabled or not configured**|BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.|
+|**When disabled**|BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.|
**Reference**
@@ -1014,15 +1014,15 @@ When this policy is enabled and the hardware is capable of using Secure Boot for
This policy setting is used to establish an identifier that is applied to all drives that are encrypted in your organization.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|All drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
-|Conflicts|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.|
-|When enabled|You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.|
-|When disabled or not configured|The identification field is not required.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|All drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
+|**Conflicts**|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.|
+|**When enabled**|You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.|
+|**When disabled or not configured**|The identification field is not required.|
**Reference**
@@ -1044,15 +1044,15 @@ Multiple values separated by commas can be entered in the identification and all
This policy setting is used to control whether the computer's memory will be overwritten the next time the computer is restarted.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.|
-|Introduced|Windows Vista|
-|Drive type|All drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
-|Conflicts|None|
-|When enabled|The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.|
-|When disabled or not configured|BitLocker secrets are removed from memory when the computer restarts.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.|
+|**Introduced**|Windows Vista|
+|**Drive type**|All drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption|
+|**Conflicts**|None|
+|**When enabled**|The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.|
+|**When disabled or not configured**|BitLocker secrets are removed from memory when the computer restarts.|
**Reference**
@@ -1062,15 +1062,15 @@ This policy setting is applied when you turn on BitLocker. BitLocker secrets inc
This policy setting determines what values the TPM measures when it validates early boot components before it unlocks an operating system drive on a computer with a BIOS configuration or with UEFI firmware that has the Compatibility Support Module (CSM) enabled.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Operating system drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|None|
-|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.|
-|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|None|
+|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.|
+|**When disabled or not configured**|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.|
**Reference**
@@ -1112,15 +1112,15 @@ The following list identifies all of the PCRs available:
This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.|
-|Introduced|Windows Server 2008 and Windows Vista|
-|Drive type|Operating system drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|None|
-|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.|
-|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.|
+|**Introduced**|Windows Server 2008 and Windows Vista|
+|**Drive type**|Operating system drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|None|
+|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.|
+|**When disabled or not configured**|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.|
**Reference**
@@ -1162,15 +1162,15 @@ The following list identifies all of the PCRs available:
This policy setting determines what values the TPM measures when it validates early boot components before unlocking an operating system drive on a computer with native UEFI firmware configurations.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Operating system drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation,
If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.
For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.|
-|When enabled|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.|
-|When disabled or not configured|BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.
If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.
For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.|
+|**When enabled**|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.|
+|**When disabled or not configured**|BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.|
**Reference**
@@ -1210,16 +1210,16 @@ The following list identifies all of the PCRs available:
This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Operating system drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|None|
-|When enabled|Platform validation data is refreshed when Windows is started following a BitLocker recovery.|
-|When disabled|Platform validation data is not refreshed when Windows is started following a BitLocker recovery.|
-|When not configured|Platform validation data is refreshed when Windows is started following a BitLocker recovery.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|None|
+|**When enabled**|Platform validation data is refreshed when Windows is started following a BitLocker recovery.|
+|**When disabled**|Platform validation data is not refreshed when Windows is started following a BitLocker recovery.|
+|**When not configured**|Platform validation data is refreshed when Windows is started following a BitLocker recovery.|
**Reference**
@@ -1229,16 +1229,16 @@ For more information about the recovery process, see the [BitLocker recovery gui
This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.|
-|Introduced|Windows Server 2012 and Windows 8|
-|Drive type|Operating system drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
-|Conflicts|When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored (as defined by the **Allow Secure Boot for integrity validation** Group Policy setting).|
-|When enabled|You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.|
-|When disabled|The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.|
-|When not configured|The computer verifies the default BCD settings in Windows.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.|
+|**Introduced**|Windows Server 2012 and Windows 8|
+|**Drive type**|Operating system drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives|
+|**Conflicts**|When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored (as defined by the **Allow Secure Boot for integrity validation** Group Policy setting).|
+|**When enabled**|You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.|
+|**When disabled**|The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.|
+|**When not configured**|The computer verifies the default BCD settings in Windows.|
**Reference**
@@ -1249,15 +1249,15 @@ This policy setting determines specific Boot Configuration Data (BCD) settings t
This policy setting is used to control whether access to drives is allowed by using the BitLocker To Go Reader, and if the application is installed on the drive.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Fixed data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
-|Conflicts|None|
-|When enabled and When not configured|Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.|
-|When disabled|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Fixed data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives|
+|**Conflicts**|None|
+|**When enabled and When not configured**|Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.|
+|**When disabled**|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.|
**Reference**
@@ -1270,15 +1270,15 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go
This policy setting controls access to removable data drives that are using the BitLocker To Go Reader and whether the BitLocker To Go Reader can be installed on the drive.
-|||
-|--- |--- |
-|Policy description|With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.|
-|Introduced|Windows Server 2008 R2 and Windows 7|
-|Drive type|Removable data drives|
-|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
-|Conflicts|None|
-|When enabled and When not configured|Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.|
-|When disabled|Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.|
+| | |
+|:---|:---|
+|**Policy description**|With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.|
+|**Introduced**|Windows Server 2008 R2 and Windows 7|
+|**Drive type**|Removable data drives|
+|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives|
+|**Conflicts**|None|
+|**When enabled and When not configured**|Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.|
+|**When disabled**|Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.|
**Reference**
@@ -1291,15 +1291,15 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go
You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users cannot create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted.
-|||
-|--- |--- |
-|Policy description|Notes|
-|Introduced|Windows Server 2003 with SP1|
-|Drive type|System-wide|
-|Policy path|Local Policies\Security Options\System cryptography: **Use FIPS compliant algorithms for encryption, hashing, and signing**|
-|Conflicts|Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.|
-|When enabled|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.|
-|When disabled or not configured|No BitLocker encryption key is generated|
+| | |
+|:---|:---|
+|**Policy description**|Notes|
+|**Introduced**|Windows Server 2003 with SP1|
+|**Drive type**|System-wide|
+|**Policy path**|Local Policies\Security Options\System cryptography: **Use FIPS compliant algorithms for encryption, hashing, and signing**|
+|**Conflicts**|Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.|
+|**When enabled**|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.|
+|**When disabled or not configured**|No BitLocker encryption key is generated|
**Reference**
diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md
index 3261c5f549..5bbb8174ec 100644
--- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md
+++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md
@@ -14,12 +14,12 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: conceptual
-ms.date: 11/29/2018
---
# Trusted Platform Module Technology Overview
**Applies to**
+- Windows 11
- Windows 10
- Windows Server 2016
- Windows Server 2019
@@ -28,7 +28,7 @@ This topic for the IT professional describes the Trusted Platform Module (TPM) a
## Feature description
-Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can:
+[Trusted Platform Module (TPM)](/windows/security/information-protection/tpm/trusted-platform-module-top-node) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper-resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can:
- Generate, store, and limit the use of cryptographic keys.
@@ -54,13 +54,13 @@ Certificates can be installed or created on computers that are using the TPM. Af
Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process.
-Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry.
+Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 and later editions or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry.
The TPM has several Group Policy settings that might be useful in certain enterprise scenarios. For more info, see [TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md).
## New and changed functionality
-For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module).
+For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module)
## Device health attestation
@@ -75,14 +75,14 @@ Some things that you can check on the device are:
- Is SecureBoot supported and enabled?
> [!NOTE]
-> Windows 10, Windows Server 2016 and Windows Server 2019 support Device Health Attestation with TPM 2.0. Support for TPM 1.2 was added beginning with Windows version 1607 (RS1). TPM 2.0 requires UEFI firmware. A computer with legacy BIOS and TPM 2.0 won't work as expected.
+> Windows 11, Windows 10, Windows Server 2016, and Windows Server 2019 support Device Health Attestation with TPM 2.0. Support for TPM 1.2 was added beginning with Windows version 1607 (RS1). TPM 2.0 requires UEFI firmware. A computer with legacy BIOS and TPM 2.0 won't work as expected.
## Supported versions for device health attestation
-| TPM version | Windows 10 | Windows Server 2016 | Windows Server 2019 |
-|-------------|-------------|---------------------|---------------------|
-| TPM 1.2 | >= ver 1607 | >= ver 1607 | Yes |
-| TPM 2.0 | Yes | Yes | Yes |
+| TPM version | Windows 11 | Windows 10 | Windows Server 2016 | Windows Server 2019 |
+|-------------|-------------|-------------|---------------------|---------------------|
+| TPM 1.2 | | >= ver 1607 | >= ver 1607 | Yes |
+| TPM 2.0 | Yes | Yes | Yes | Yes |
## Related topics
diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md
index 429cc12f93..1ede3ef4ed 100644
--- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md
+++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md
@@ -17,7 +17,8 @@ ms.technology: mde
# Enable virtualization-based protection of code integrity
-**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+**Applies to**
+- Windows 10
This topic covers different ways to enable Hypervisor-protected code integrity (HVCI) on Windows 10.
Some applications, including device drivers, may be incompatible with HVCI.
diff --git a/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md
index 21b9780bc2..4065b2122a 100644
--- a/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md
+++ b/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md
@@ -18,7 +18,8 @@ ms.technology: mde
# Baseline protections and additional qualifications for virtualization-based protection of code integrity
-**Applies to** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+**Applies to**
+- Windows 10
Computers must meet certain hardware, firmware, and software requirements in order to take advantage of all of the virtualization-based security (VBS) features in [Windows Defender Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md). Computers lacking these requirements can still be protected by Windows Defender Application Control (WDAC) policies—the difference is that those computers will not be as hardened against certain threats.
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md
index 593984f0dc..d2ee8b1f7a 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md
@@ -19,7 +19,7 @@ ms.technology: mde
**Applies to:**
-- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/)
+- Windows 10
Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a Group Policy Object, which is linked to a domain, and then apply all those settings to every endpoint in the domain.
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
index 7a2cd61939..9ad53a26f5 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml
@@ -17,7 +17,7 @@ metadata:
title: Frequently asked questions - Microsoft Defender Application Guard
summary: |
- **Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+
This article lists frequently asked questions with answers for Microsoft Defender Application Guard (Application Guard). Questions span features, integration with the Windows operating system, and general configuration.
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
index f3cbd518da..994ade09de 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md
@@ -18,7 +18,7 @@ ms.technology: mde
# Prepare to install Microsoft Defender Application Guard
**Applies to:**
-- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/)
+- - Windows 10
## Review system requirements
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
index 83850f5a21..de798293db 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
@@ -17,7 +17,8 @@ ms.technology: mde
# Microsoft Defender Application Guard overview
-**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+**Applies to**
+- Windows 10
Microsoft Defender Application Guard (Application Guard) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by making current attack methods obsolete.
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md
index a54f8667cd..fb162b5632 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md
@@ -1,5 +1,5 @@
---
-title: System requirements for Microsoft Defender Application Guard (Windows 10)
+title: System requirements for Microsoft Defender Application Guard
description: Learn about the system requirements for installing and running Microsoft Defender Application Guard.
ms.prod: m365-security
ms.mktglfcycl: manage
@@ -17,7 +17,8 @@ ms.technology: mde
# System requirements for Microsoft Defender Application Guard
-**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+**Applies to**
+- Windows 10
The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. Microsoft Defender Application Guard is designed to help prevent old, and newly emerging attacks, to help keep employees productive.
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md
index 9baa7baa78..74525211f8 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md
@@ -19,7 +19,7 @@ ms.technology: mde
**Applies to:**
-- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/)
+- Windows 10
We've come up with a list of scenarios that you can use to test hardware-based isolation in your organization.
diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md
index 2a578d07ab..2ec5067168 100644
--- a/windows/security/threat-protection/security-compliance-toolkit-10.md
+++ b/windows/security/threat-protection/security-compliance-toolkit-10.md
@@ -45,7 +45,7 @@ The Security Compliance Toolkit consists of:
- Microsoft 365 Apps for enterprise, Version 2104
- Microsoft Edge security baseline
- - Version 88
+ - Version 92
- Windows Update security baseline
- Windows 10 20H2 and below (October 2020 Update)
diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md
index 4df87c418a..be2c2f115a 100644
--- a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md
+++ b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md
@@ -14,7 +14,7 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: conceptual
-ms.date: 04/19/2017
+ms.date: 08/16/2021
ms.technology: mde
---
@@ -35,7 +35,7 @@ This policy setting is dependent on the **Account lockout threshold** policy set
- A user-defined number of minutes from 0 through 99,999
- Not defined
-If [Account lockout threshold](account-lockout-threshold.md) is configured, after the specified number of failed attempts, the account will be locked out. If th **Account lockout duration** is set to 0, the account will remain locked until an administrator unlocks it manually.
+If [Account lockout threshold](account-lockout-threshold.md) is configured, after the specified number of failed attempts, the account will be locked out. If the **Account lockout duration** is set to 0, the account will remain locked until an administrator unlocks it manually.
It is advisable to set **Account lockout duration** to approximately 15 minutes. To specify that the account will never be locked out, set the **Account lockout threshold** value to 0.
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
index 7f98409069..66c3926643 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
@@ -89,12 +89,12 @@ Administrators can test whether applying the same restriction earlier versions o
In other words, the hotfix in each KB article provides the necessary code and functionality, but you need to configure the restriction after you install the hotfix—no restrictions are enabled by default after the hotfix is installed on earlier versions of Windows.
-| |Default SDDL |Translated SDDL| Comments
+| |Default SDDL |Translated SDDL| Comments |
|---|---|---|---|
-|Windows Server 2016 (or later) domain controller (reading Active Directory)|“”|-|Everyone has read permissions to preserve compatibility.|
-|Earlier domain controller |-|-|No access check is performed by default.|
-|Windows 10, version 1607 (or later) non-domain controller|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
AceType:0x00
(ACCESS\_ALLOWED_ACE_TYPE)
AceSize:0x0018
InheritFlags:0x00
Access Mask:0x00020000
AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)
SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. |
-|Earlier non-domain controller |-|-|No access check is performed by default.|
+|**Windows Server 2016 (or later) domain controller (reading Active Directory)**|“”|-|Everyone has read permissions to preserve compatibility.|
+|**Earlier domain controller** |-|-|No access check is performed by default.|
+|**Windows 10, version 1607 (or later) non-domain controller**|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
AceType:0x00
(ACCESS\_ALLOWED_ACE_TYPE)
AceSize:0x0018
InheritFlags:0x00
Access Mask:0x00020000
AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)
SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. |
+|**Earlier non-domain controller** |-|-|No access check is performed by default.|
## Policy management
diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
index 5028f2de9f..15639fd8d3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md
@@ -14,7 +14,7 @@ author: jsuther1974
ms.reviewer: isbrahm
ms.author: dansimp
manager: dansimp
-ms.date: 07/15/2021
+ms.date: 08/10/2021
ms.technology: mde
---
@@ -93,27 +93,86 @@ Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerS